Boeing 737 Max8 Aircraft Crashes and Investigations [Part 4] 28

[Sparweb]

This is the continuation from:

thread815-445840
thread815-450258
thread815-452000

This topic is broken into multiple threads due to the long length to be scrolled, and many images to load, creating long load times for some users and devices. If you are NEW to this discussion, please read the above threads prior to posting, to avoid rehashing old discussions.

Thank you everyone for your interest! I have learned a lot from the discussion, too.

My personal point of view, since this falls close to (but not exactly within) my discipline, is the same as that expressed by many other aviation authorities: that there were flaws in an on-board system that should have been caught. We can describe the process that "should have happened" in great detail, but the reason the flaws were allowed to persist is unknown. They are probably too complex to reveal by pure reasoning from our position outside of the agencies involved. Rather, an investigation of the process that led to the error inside these agencies will bring new facts to light, and that process is under way, which will make its results public in due time. It may even reveal flaws in the design process that "should have" produced a reliable system. Every failure is an opportunity to learn - which is the mandate of the agencies that examine these accidents.

Some key references:

Ethiopian CAA preliminary report

Indonesian National Transportation Safety Committee preliminary report

The Boeing 737 Technical Site


No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

 

[Alistair_Heaton]

it also removes the max number of articles a month limits.

Time for a new thread again?

 

[3DDave]

Alistair - mobile phones? That's a jump. Anyway, as I suggested before the FAA simply added onto unlikely things to make sure a failure is seen. If it took 8 bits or 20 bits or setting fire to it, they would have done so.

Instead of blaming MCAS how about blaming the false stall detection that should never have been triggered in the first place? Without that false information MCAS never triggers, and the poor crew is never startled by the stick shaking and annunciators.
With the changed software will the plane revert to manual on an AoA failure and leave even less qualified pilots who cannot manage the trim any better than these crews did to crash even less encumbered planes? For certain that's exactly what happened on AF447. To be fair, in AF447 it required special software to ensure that one pilot who should not be flying gain command over the other. That particular fault won't happen in a 737, but in the case of ET302 it is clear that neither pilot was prepared for manual operation. Both "voted" to crash the plane.

I saw a suggestion that shutting off the ADIRU with the failed AoA sensor would have forced the FCC to roll over to the working unit and operate MCAS correctly. That appeals to me as it means that the MCAS protection still functions without stepping over the trim system. The chance that both AoA sensors are destroyed is fairly small, but it still depends on pilots knowing enough about flying the plane to be sure to shut off the actual failed unit. Lots of accidents where a pilot gets an alarm in a twin and feathers the good engine, crashing the plane almost immediately, so maybe pilots knowing which side of the plane they are sitting on is a problem.

Shutting the bad ADIRU off would have been the better answer than the AD. No need for judgement or remembering a list.

Others have suggested the ADIRU itself could tell that the sudden jump in AoA with the WOW switch off is enough to flag itself out for being unreliable. No 737 is operating above 35 degrees of AoA in any meaningful manner and cross checking that with the other unit would confirm, if the rate of change is lower.

As to the trimming answer. 100% disconnect the trim wheel cables from the trim jackshaft and just use a redundant motor. Add switches or valves to the trim wheels like they seem to have on the fake wheels on Airbus planes. They can make the redundant motor hydraulically operated and get rid of the trim position indicator that pilots obviously never bother to look at anyway.

With MCAS handled in software and years of this one-motor, cable drive trim system functioning as-is on the NG, make the alteration a roll-in option for changing the existing Max hulls and a requirement on new hulls produced after 6 months. This will let Boeing ship what they have, gracefully slow production to give time for testing a system not much different than Airbus uses already, and not increase the risk to passengers over what's been seen in the NG for the last 20 years. When already built Max hulls come in for major maintenance, overhaul with the new system.

And maybe the airlines can finally come clean about how they don't really train pilots to handle problems, but to wring out every dime in fuel they can get by abdicating piloting responsibility to a chip of silicon under the floor to get minimum fuel burn.

Just kidding. Airlines won't ever admit fault or take any steps to correct this negligent oversight. The only ones who can are the governments where they operate, and national treasures don't get criticized. Which is why Ethiopian has not produced a video or document of any of their pilots having done even one second's worth of MCAS consideration after the AD was published.

 

[Alistair_Heaton]

They do actually effect things, thankfully on more modern aircraft its limited to an annoying did, did, dit on your headset in the front.

Not so long agon they used to trigger the fire alarms but most of them that were susceptible have been replaced now.


Your thinking along the same lines as me now. They may get a rolling upgrade path in the usa regulators but maybe not after the hit to thier reputation. But no airline will take the risk of accepting a max. And you have zero chance of easa and the Chinese allowing it. If they do take delivery and more things turn up your stuck with a dead duck.

The NG, one of the disconnect switches killed the electronics but left the electric trim working. It also has a control force cut out switch so if the pilots pulled or pushed hard enough it also killed the electronics but left the electric trim working.

The airbus wheels are not fake apparently but they are pretty much useless until you get to the very bottom basic control law. Airbus is never out of trim until that last level. There is no manual trim wheel on the Q400 but as its not a stab the control forces are low enough you can fly it across the full range of the operating envelope at max trim either way.

At least 18 months to get your list sorted and certified.

The airlines will always say they provide the legal requirements for training. And most of them it will be the legal minimum. Some of us are lucky and get more than the bare minimum.

It's the regulators you need to convince and enforce training. Then everyone is operating to the same cost base.

 

[3DDave]

Naw. I'm thinking along the lines that people like you are sitting in the FAA and EASA looking to score a kill and Boeing is going to have to bleed a lot to make up for badly trained pilots and that those regulators failed to do anything about it.

The NG still has exactly the same trim wheel problem, but somehow zero accidents related to it. The number of switches doesn't matter. If a fault in an NG had run the stab trim for more than a few seconds in the hands of that Ethiopian crew everyone would have died just the same. MCAS became a pass-fail test of whether pilots had ever trained.

The Airbus wheels don't require force just like the control sticks don't. They could have used paddle switches, but used fake wheels instead, no doubt as a cost savings measure for compatibility with training on some long extinct type.

 

[Alistair_Heaton]

Just confirmed it on the airbus there is definitely a mechanical linkage to the trim stab setup.

Yes there will be loads of people like me. But its nothing to do with taking revenge on Boeing or the USA. Its just wanting a safe environment to work in, with realistic expectations about human performance.


I have never flown a Boeing or an Airbus.

 

[3DDave]

All the Airbus cockpit photos show only a tiny portion of a wheel exposed. So lets get an Airbus to full nose down trim and see how easy it is to move the wheels.

 

[Alistair_Heaton]

Extremely easy. Until you get all the way down to mechanical backup. And even then there is power assist on it aka power steering on a car. So you would need a failure of all three hydraulic systems and no electrics to turn it into a 737 max.


Finger tip stuff.

http://www.airbusdriver.net/airbus_fltlaws.htm

Even in dual engine failure with the RAT out you don't go to that law.

Its only there to give you control while the electrics come back online and the computers come up. You can't land using it.

 

[3DDave]

Gotta be full failure. So I guess that's a nope, the trim wheels won't help. If the software fails from cosmic rays bashing a bunch of bits, so be it. Ground Airbus until this is a dealt with.

 

[Alistair_Heaton]

That will be the 777 and 787 grounded as well then. Along with all the E jets.

But as FBW system don't rely on the pilot as the secondary back up system for any of there flight major or critical systems unlike the 737 max in fact with the A320 the pilot only gets involved at the 5 or 6th redundancy level then I suspect your wish will not come true.

 

[VEBill]

"Instead of blaming MCAS..."



Of course there will be other contributing factors, but it is clear that MCAS will ultimately shoulder most of the blame.

('most' = roughly 60-80%)

But it is nice to see that they're uncovering other somewhat unrelated deficiencies along the way. Prevention of future incidents sort of makes up for it requiring two MCAS incidents to respond appropriately.

 

[Alistair_Heaton]

There is a small percentage of people out that see this issue as purely a pilot issue. There is a similar sized number who see it only as a hardware issue.

There is another group which is more interested in shafting the FAA.

Another group which global politics are driving their feelings.

Then there is the accountants/finance types, quiet what they thinking while they run around in circles I do not know. But it more than likely centres round bonuses and making sure the finger pointing doesn't finish pointing at them.

Then there is the majority of us that see it has a failure in regulation of both certification design and training standards. The politics of how Boeing runs itself are of zero interest to us.

Like it or not this has and will continue to effect the global aviation scene for the next 10-20 years. Short term alot of people who had nothing to do with this will be without a job. And then there are some of us who will make quiet a bit of money out of it basically covering the hole the MAX has left. I suspect Airbus pilots in the US are flying their backsides off along with technicians trying to get old classics airworthy again.

The word on the street is that the max is not expected back in service by the next years summer season in the EU. Wetlease contracts are currently being negotiated but crewing is proving to be problematic. More than a few are hoping Ryanair do sack 900 crew. If that crew then go airbus rated then that's another knife in the back to Boeing operators because they won't get them back.

 

[Alistair_Heaton]

An interesting paper on pilot response.

https://www.faa.gov/pilots/training/media/Evaluation_of_Stall_Models_for_Training.pdf

 

[Sparweb]

AH,
Thanks for the stall training and modelling article. Interesting to read that even airline pilots can be overwhelmed. That Figure 6 is a real "bad day" for someone.

Reminds us what is meant when the regulations demand that some maneuvers and pilot reactions cannot require an unusual amount of skill to complete.

No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

 

[Alistair_Heaton]

Of course we can be overwhelmed. And there are a huge number of variables which effect when you hit your 100% capacity point. It changes day to day and also during the day. Experience plays a part. In the sim they kill the Captain to over stress the first officer. For the captains they keep the FO alive but tell them to question every decision. Killing them usually makes life easier.

Figure 6 was your standard minimum height loss old school American stall recovery with min height lost. I won't bother repeating what I have said previously on the subject. But its now been changed after FAA and NASA study's but its taking time to filter through to the whole of the pilot population mainly because the old timers who hold training and examination positions really don't buy into it.


As you can see though its a pre briefed exercise on a standard exercise which is trained for regularly in the sim, it is also an exercise which is part of the initial PPL single engine training. Per say it should be at riding a bike level of muscle memory.


Its a realistic model of human performance and reaction to stimulus that quiet a few of us are hoping is going to come out of this.


And a real definition and method of measuring situational awareness.

 

[3DDave]

Figure 6 is what I hope is a now former pilot. They have negative skills.

Accessing the trim button on the control wheel had better not be an unusual amount of skill.
Cockpit Resource Management had better not be an unusual amount of skill either.

Was anyone of the impression that receiving an AD, glancing at it, and then setting fire to it in the garbage bin was a sufficient skills compensation response? The next sales contract needs a check-box for "Our Pilots Don't Read" so the AD can be issued as an audio book or a video with content cotrols that requires a pilot's license number to access and content based questions before indicating that the pilot had any contact with the material.

Thankfully Airbus has had unusually skilled pilots.

On 5 November 2014, Lufthansa Flight 1829, an Airbus A321 was flying from Bilbao to Munich when the aircraft, while on autopilot, lowered the nose into a descent reaching 4000 fpm. The uncommanded pitch-down was caused by two angle of attack sensors that were jammed in their positions, causing the fly by wire protection to believe the aircraft entered a stall while it climbed through FL310. The Alpha Protection activated, forcing the aircraft to pitch down, which could not be corrected even by full stick input. The crew disconnected the related Air Data Units and were able to recover the aircraft.

More detail here -

http://avherald.com/h?article=47d74074

Airbus/EASA issued an AD telling pilots how to handle the situation. I guess Airbus pilots are believed able and willing to read, so no one called for grounding them world wide before the full fly-by-wire implementation was given a look-over, including improbable injected situations.

This was clearly a case of unusual skill in that no procedure was in place to shut off a key component that is critical to flight management. They managed to get it sorted in about 60 seconds. If the current thought that a plane can be ignored for 3-5 minutes and still must be easily recovered while ignoring the relevant AD steps then Airbus should be in great trouble for taking shortcuts in their software.

Tell me about the superior software developers are AB and how EASA won't let garbage get through.

No wonder Airbus has kept their corporate mouth shut about pitch trim software. They did it first.

 

[3DDave]

Figure 6 lost 1700 feet vs 600 in figure 5. That's not "minimum" that's almost 3X.

 

[Alistair_Heaton]

No he won't be, I suspect he was a 50 year old check airman. But he could have been a management type as well.

The old days the check airmen wanted less than 300ft height lost. Which from what I could see, usually resulted in multiple secondary stalls triggers in the process. The UK way I was taught we use less than 1000ft and any secondary stall more than a brief blip was more of an issue than height lost. I must admit years ago as a FO I think on my second sim check after starting flying multi crew I found that if I just stick the pitch to 2 deg nose up pause for a fraction of a second roll the wings then progressively increase the power to max. Everything just works. And its worked for 3 different types now. It wasn't something I had been trained to do it just seemed obvious its what you have to do as a Engineer. With the Q400 it gives 500ft height lost and no secondary stalls.


Bombardier, Embraer and Airbus are all keeping there mouths well and truly shut on the subject and are more than likely putting significant effort into testing as well. And as Airbus has already issued a AD on the NEO I suspect they are finding things as well.

I wouldn't say the Airbus pilots are any more skilled its just that the training for Airbus is different. The initial airbus rating is getting on for twice as long as other types and its hellishly expensive. They spend nearly a month in the classroom alone on the airbus philosophy and system method. But once they have gone through that the differences training between even a A320 and A380 is surprisingly short. They have a set procedure for the system going crazy which basically kicks it into alternate law which so far has always saved the day.

I will admit airbus were lucky, if it had killed everyone onboard then the response would have been different I suspect. But even then it would have still been less than 1 event in 1 million flight hours so technically it was still within certification limits. Af it was pretty obvious that 90% of the reason why everyone died was pilot error.


MAx two fatal crashes in no where near 1 million flight hours. No chance.

To be fair Concorde was killed after 1 fatal crash. So its not as if the MAX is being treated any different to any other type.


The current thought is not to be able to ignore anything for 3-5 mins. Its to give the pilots data which can allow a timely identification of an issue with a high success rate of getting the right one and fix it before the aircraft leaves controlled flight. And while going through this process the plane remains inside a recoverable envelope.

Your idea on competency levels would cut down the number of crashes I will admit. But that's mainly because there will be a fraction of the aircraft in the air that there are currently.

 

[VEBill]

"Accessing the trim button on the control wheel had better not be an unusual amount of skill."

Too bad about this:

Boeing altered key switches in 737 MAX cockpit, limiting ability to shut off MCAS

Odds are high that the design of that panel (and its associated wiring) will have to be changed so that the MCAS can be disabled while retaining the manual Trim switches.

Speculation: Perhaps it'll need to provide MCAS Disable and Electric Trim disable on separate switches. That would make sense, at least in concept.

This may prove to be necessary because of the previously-noted issues surrounding the manual Trim Wheels. Presumably redesigning those would be too difficult.

There's an argument to be made that the AD wasn't perfectly clear, specifically with respect to the required sequencing. It can be predicted that the final report will include criticism of that wording.

---

The strident efforts being made in this thread to deflect blame onto the pilots might be more effective if occasionally accompanied by a trace of balance. Narrow one-sided opinions tend to be discounted.

This is offered in the hope that it'll lead to an improvement in the thread content.

Apologies in advance if it causes offense, but somebody needs to mention it.

 

[LittleInch]

VEIBLL

That issue has been noted before on this thread, probably in part I or II and mentioned more than once.

The interesting bit is that the report says no one really knows why there were two switches, side by side as none of the current procedures tries to get a pilot to flick one and not the other, but both at the same time.

I think it is potentially true that if the ET pilots could have re-energised only the thumb switches, then the likelihood of survival would have been increased, but we'll never know.

For this to work (MCAS / AP only disable of the stabiliser ) they would need to place the two switches some way apart I believe to prevent inadvertent operation of the wrong one.



Remember - More details = better answers
Also: If you get a response it's polite to respond to it.

 

[3DDave]

MCAS is to meet a maneuvering characteristics requirement. That's why it cannot be separately shut off. The wheel trim switches override MCAS instantly and reset the timer; there was never a need to let the plane get out of trim in the first place.

The ET pilots did re-energize the thumb switches and then they failed to actually move the stab more than a tiny amount; no doubt because by then the air loads were so high and they were so far outside the normally allowable speed envelope that the small change in trim was like a kick in the butt to the pilots and they didn't want that. Then, having concluded they would not use the trim they left the system armed instead of doing what the AD said and never re-energizing those switches.

The AD is clear. Trim the airplane before shutting off the motors. They had 5 months to ask for clarification, but if one never bothers to even walk through the procedure there will never be any questions. Any of the pilots for Ethiopian could have walked it through and then taken that info to the chief pilot to carry that information to all the others. Never happened.