Boeing 737 Max8 Aircraft Crashes and Investigations [Part 4] 28

[Sparweb]

This is the continuation from:

thread815-445840
thread815-450258
thread815-452000

This topic is broken into multiple threads due to the long length to be scrolled, and many images to load, creating long load times for some users and devices. If you are NEW to this discussion, please read the above threads prior to posting, to avoid rehashing old discussions.

Thank you everyone for your interest! I have learned a lot from the discussion, too.

My personal point of view, since this falls close to (but not exactly within) my discipline, is the same as that expressed by many other aviation authorities: that there were flaws in an on-board system that should have been caught. We can describe the process that "should have happened" in great detail, but the reason the flaws were allowed to persist is unknown. They are probably too complex to reveal by pure reasoning from our position outside of the agencies involved. Rather, an investigation of the process that led to the error inside these agencies will bring new facts to light, and that process is under way, which will make its results public in due time. It may even reveal flaws in the design process that "should have" produced a reliable system. Every failure is an opportunity to learn - which is the mandate of the agencies that examine these accidents.

Some key references:

Ethiopian CAA preliminary report

Indonesian National Transportation Safety Committee preliminary report

The Boeing 737 Technical Site


No one believes the theory except the one who developed it. Everyone believes the experiment except the one who ran it.
STF

 

[VEBill]

"The AD is clear. Trim the airplane before shutting off the motors."

You are incorrect on both points.

It actually emphasizes ensuring that the STAB TRIM CUTOUT are set to CUTOUT first. Later, in a note, it allows what would be a contradictory back pedaling to switch the system back on.

You may review it here.

Extracted from report.

This unclear and out of order wording will almost certainly be a point of discussion in the final report.

 

[Alistair_Heaton]

To be fair there is some justified blame towards the pilots.

But as they are dead now there is not a lot they can say or do in their own defence.

And even if we were all to agree that it was the pilots fault it won't now change the status of the 737 MAX or allow it to fly again with out it being recertified.

The how and why it came about that the authorities revisited its certification and found it lacking really won't change the current situation or for that matter the changes that are required before it can fly again.

Something has to be done to restore confidence in the airframe for the pax never mind pilots. If the pilots arn't happy they will say so and if the pax hear the pilots they definately won't be happy to fly on it. So the type is dead anyway.

Anyway the sorting out the manual trim system hasn't been mentioned yet offically. Thats going to be the real killer. They might be able to get it past the FAA (but I doudt it) but the rest of the world won't accept it unless its changed.

 

[VEBill]

"MCAS is to meet a maneuvering characteristics requirement. That's why it cannot be separately shut off."

Incorrect for multiple reasons.

The panel designer would simply specify a guarded switch. If engines can have e-handles, then the MCAS could have its own cutout switch.

MCAS can be shut off. So your first sentence fails to explain the point you claim about 'separately'.

The likely reason it didn't have a separate switch is that the very existence of MCAS would have to be explained. Which apparently was to be avoided.

 

[Alistair_Heaton]

There is uncommanded stabiliser trim inputs all the time on both the NG and MAX.

The other STS system is constantly changing the trim while manual flying. At no point does the trim wheel stay still unless the pilot actions the thumb trim switches.

There is also no indication when the STS is in action or for that matter the MCAS is in action.

It isn't the case that you can say well I haven't pushed the trim button and its moving, hey we have a problem.


Its a case of spot the difference in movement.


This is all while trying to recover from a big bird hitting near the cockpit windows at 250 mph. Mutiple alarms going off etc etc.

 

[VEBill]

"...some justified blame towards the pilots..."

I believe that point has been mentioned once or twice.

There's certainly some truth in it (there always is), but when it's single-mindedly used to deflect blame it becomes an issue.

 

[3DDave]

STS offsets control loads. The difference is spotted because the yoke isn't pulling you out of the seat; the yoke is not doing anything the pilot isn't doing to it. When you get to 50 pounds of pull or so a pilot should probably have some clue the plane is out of trim. I can see how a Q400 pilot would not know this. It's really easy - if you find the controls on a heavy jet are pushing or pulling far too much for the maneuver you want it's a good idea to use that trim switch and maybe see if the plane is out-of-trim, especially if, just 5 months ago, there was a mass casualty crash that was related to being out-of-trim.

There's also just one PF. The second seat can monitor the instruments, including the trim indicator, which would be a handy thing to do with a false stall warning going off. The PF can just ask "are we in trim" and the second seat can look.

Alistair - where have you heard the bird strike on the CVR so you know it was a large bird? You previously commented they saw the bird before the collision; do you have link to that video?
---

First, MCAS cannot be shut off because it is to meet a requirement from the FAA. This is particularly true since it is to operate when all other automation is shut off to discourage pilots from approaching stall under manual control. It's like a switch that disables ABS on a car. See any cars with that switch on the dash-board?

Being able to shut off the trim motors at all has been a point of contention. There should never be a need to shut MCAS off; had there not been a false AoA detection MCAS would not have needed interaction.

Second, MCAS is a software overlay on the Speed Trim System. It's not a separate thing. There's no MCAS unit in the plane so MCAS has no individual shut-off. It can be overridden using the electric trim switches. That was known as soon as the Lion Air report came out.

While the instructions are out-of-order the steps presented are not.

"Electric stabilizer trim can be used to neutralize control column pitch forces before ..."

That's why a walk-through even once by the pilots would tell them what to do. They never did. Like those times a test is given and people are told to read the entire thing first? Be a professional and read the entire document, make a plan of action, rehearse that plan until it is second nature, work with the other pilot to confirm that the rehearsal is correct. Things competent pilots should do.

I am correct that, if anyone thinks this document was unclear, the ET pilots had 5 months if they also felt it was unclear to get it right. Had it been written as total gibberish they would still be 100% responsible for not asking for clarification.

 

[Lou Scannon]

3DDave, I do not have a dog in this fight, so to speak (it is actually a cordial professional discussion), if you have any personal stake to reduce the culpability of MCAS and those responsible for it, now would be a good time to come clean. If you are truly disinterested, that's cool, stick to your guns.

"Schiefgehen wird, was schiefgehen kann" - das Murphygesetz

 

[Alistair_Heaton]

" It's like a switch that disables ABS on a car. See any cars with that switch on the dash-board? "

Yes and also I have a C+E license and you can turn the ABS off on 40 ton artic's as well.

I also have a button to turn the traction control off on my 3ltr turbo Merc E class as well. Which is really stupid thing to do especially with a trailer on the back.

It could be that EU design rules require it or litigation in the US means you can't have it.

We don't know if the pilots did or didn't walk through it. To be honest response in simulator after reading new emergency SOP's very rarely occurs as it should do. It usually takes a years worth of sim checks before things become predictable if the situation occurs. Is not uncommon for go-arounds to not go book standard. And we do at least 5 of them every time we are in the sim. Usual mistake is to miss to putting the gear up.

"The difference is spotted because the yoke isn't pulling you out of the seat; the yoke is not doing anything the pilot isn't doing to it. When you get to 50 pounds of pull or so a pilot should probably have some clue the plane is out of trim. I can see how a Q400 pilot would not know this. It's really easy - if you find the controls on a heavy jet are pushing or pulling far too much for the manoeuvre you want it's a good idea to use that trim switch and maybe see if the plane is out-of-trim, especially if, just 5 months ago, there was a mass casualty crash that was related to being out-of-trim."

You have never flown an aircraft obviously. I have flown jets in the sim. There is no difference in control forces between turbo props and swept wing jets apart from the zero force FBW machines which I have also flown in the sim. Everything heavier than 15 tons has powered controls and a feel unit and they are all about the same. The input responce is the same. Hence the requirement for MCAS. 50lb's does not pull you out of yourseat. With adrenlin kicked in which this crew will have after a great big bird just battered off the hull the human strength system is in uncalibrated mode which can mean you break bones. Its pretty well documented that 60kg cabin crew can bend door handles that are jammed. They had to change the stick I think it was on the F16 to make it move after they intially had a fixed stick. Apparently one of the test pilots broke his wrist trying to move it. And because it didn't move and he wasn't seeing an effect he just kept putting the muscle power on and then his wrist snapped. There are also multiple cases of mothers lifting cars to rescue children.

BTW guys don't be worried about people sticking it onto the pilots its pretty much standard policy of OEM's to do this after any incident. And if that doesn't work they go after the maintenance. Only only eventually kicking and screaming will they change anything As VEIBLL points out there is always an element of truth in it it as well including the maint. This case though is extremly unusual because of the shear volume of issues with the original hardware. The pushing of the its the pilots fault really will have zero effect on the resultant outcome now. The trying to put it back onto the pilots is like flogging a dead horse.


Why engage with it?


Because you won't change the mind of the person saying it. But especially in this forum a balanced reply stateing the issues may make another engineer in another disapline think human factors and put a bit of thought in how the operators will interact with their design in both normal and none normal operation.


To be honest if you put this situation against Three mile island from the human responce perspective there is a remarkable number of similarities. To this day there are still issues with reactor operators turning emergency cooling systems off because the "pressuriser will go solid".

 

[Alistair_Heaton]

On another note there is issues found on the A320Neo as well now.

https://www.aerotime.aero/ruta.burb...-pitch-issue-in-second-airbus-a320-family-jet

And more than likely someone will say ground them.....

It hasn't killed anyone, when the issue does kill someone then they will ground the type.

But its good to know that they are actively testing all types now.

 

[LionelHutz]

To me, it does seem odd that pilots flying the MAX wouldn't ensure they understood exactly how to recover from a MCAS issue after the first crash, not just hope they could figure it out.

I'd personally like to see the picture of that ABS disable switch. Seen lots of AH and TC disable switches on passenger cars, but never an ABS disable switch.

 

[3DDave]

ABS, not traction control. Many cars have traction control cutouts. But the question was ABS in cars, not trucks or some other vehicle. I am surprised that articulated trucks have maneuvering feel regulations for their design and operation, because that's the only parallel that makes it worth mentioning it.

I didn't say the nominal control force was different - You went out of the way to say the Q400 has no stab trim, therefore you could never feel a stab trim problem, unlike heavy 737 pilots, who would. If you think holding a continuous 50 pounds is not a big deal when you are expecting 0 pounds, I cannot say anything about your personal ability to ignore such things, just that if I had a 50 pound sack of cement set on my outstretched arms while driving I would notice it, regardless of an engine warning light or a buzzer.

If you feel like 50 pounds pull in level flight is fine, that's up to you, but for everyone else I think it would be quite noticeable.

Boeing is going after their own problem. But airlines and pilots are trying to ignore their own massive failure in this pair of tragedies.

 

[IRstuff]

BTW guys don't be worried about people sticking it onto the pilots its pretty much standard policy of OEM's to do this after any incident.

That's true for almost any hardware or software, not just planes. Just try calling up product support for your laptop, or whatever; the support centers have scripts that cover 99% of the cases, and they're all configured on the assumption that the user did something wrong; "Did you check to see if the power cable is connected to the computer and the plug is connected to a wall socket?" Until the script finally concludes without a solution, several times, with different "technicians", only then will the call center pass you on to a "real" technician, "Oh yeah, we boffo'd your DSL speed; it's outrunning your connection."

In most cases, the human operator is the fallible one, not the hardware. When you consider the cases where American astronauts lost their lives, there were hardware failures, but what allowed the hardware failures to be fatal were fallible human decisions to fly a Shuttle in colder than specified weather, thereby allowing the o-ring seal hardening in cold weather to allow hot gases to pass through the seal, and to continue to allow debris to fall from the Shuttle boosters and impact the Shuttle, because they never had a Shuttle failure before, resulting in damaged heat shields on the wing.

Interestingly, though, NPR had a piece this week about the impact of cosmic rays and random bit flips that caused, among other things, a voting machine to register 4096 (2^12) extra votes and, supposedly, Toyota Prius fuel controllers to lock up into a wide-open throttle setting.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert!

https://www.youtube.com/watch?v=BKorP55Aqvg

faq731-376 forum1529 Entire Forum list

http://www.eng-tips.com/forumlist.cfm

 

[Eufalconimorph]

While the instructions are out-of-order the steps presented are not.

"Electric stabilizer trim can be used to neutralize control column pitch forces before ..."​

Emphasis mine. CAN is not MUST. It's an optional item of the checklist. Skipping it is also a valid (if stupid) choice, and can't be used to say they didn't complete the checklist. Turning electric trim back on can be, since that's not an optional item. But the AD did not require returning the aircraft to an in-trim state using the electric stabilizer trim switches. This is a flaw in the wording of the AD, and probably contributed to confusion.

 

[LionelHutz]

The AD isn't a checklist...

The pilots should have been looking for clarification if the AD working was so confusing that the pilots didn't understand it. After all, a plane of the type they fly just crashed and Boeing released this AD to help clarify how to save the plane the next time. Overall, I suspect they didn't much care, at best gave it a cursory read, and carried on.

From everything I read, I believe the 2 most likely suspects for the Toyota runaway throttle were tin whiskers or physical pedal position. There was a 3rd possibility of a software routine crashing which left the cruise control stuck at its current setting, but that one wouldn't cause the sudden throttle applications everyone was going on about. Cosmic rays, not likely...

 

[3DDave]

Toyota was the floor mat. The same floor mat that caused the same car to run away a few days before and was brought to a halt by a driver who shoved the brake pedal hard and pulled to the side of the road before shutting it off. He found the floor mat wedged and pulled it back; then complained to the dealer it was a loaner from. The part that was not covered in the news was the dealership was sued into oblivion for their part. Once that story was over the news had to go after Toyota to keep the story alive.

Since that one crash I don't recall any others. And, though I had searched for hours, I never saw any videos of factory floor mats interfering with the pedals of Toyotas. I expected there would be many of them if it was a fundamental problem. I would have preferred if gas pedals were hinged at the floor so that incorrect floor mats could not trap them, but those can get pushed to part throttle if any mat moves forward.

Toyota did have a throttle glitch problem from tin whiskers, but that wasn't a runaway. Instead it produced an unresponsive throttle from idle/foot-off-pedal to some engagement point at which time the computer would finally detect the position at part throttle. The jump in throttle response from the jump in detected position could startle drivers.

I don't recall any software crashes; there was an embedded applications guy who said such things could happen, but never demonstrated they actually did. He based this on his guesses/observations of how the software was developed. AFAIK no one ever confirmed any of them.

This is in contrast to the VW emmissions cheat where a guy back-engineered how the software worked to detect the car was under test conditions vs on the street. That analysis was not only repeatable, but was repeated.

 

[Alistair_Heaton]

In Europe you have a button to turn off ABS.

The main reason for it is because heavy snow and ABS are not a very good idea especially with studs on.


Alot of Northern countries run white roads and runways in winter and have a compulsory change over onto winter tyres.


A normal runway condition in the north of Sweden.

 

[Alistair_Heaton]

"didn't say the nominal control force was different - You went out of the way to say the Q400 has no stab trim, therefore you could never feel a stab trim problem, unlike heavy 737 pilots, who would. If you think holding a continuous 50 pounds is not a big deal when you are expecting 0 pounds, I cannot say anything about your personal ability to ignore such things, just that if I had a 50 pound sack of cement set on my outstretched arms while driving I would notice it, regardless of an engine warning light or a buzzer."

You can feel an elevator trim runway though where the trim tab hits max. Which means you have to fly the plane with full trim input. Its one of the three year exercises. And no I normally fly with finger tips. So a 50lb pull is not on all the time normal operations. The exercise in the sim usually takes about 20-30 mins to complete. I presume the reason why we have to do this is because we don't have a manual trim wheel.


Most pilots would be able to handle a straight situation like you have described.


Add in bird strike, loads of warnings and cautions going off, Stick shaker, egpws bitching your into sensory overload situation. 99.9% of pilots will never experence this in thier careers thankfully. I certainly haven't yet.


When it adds up to 3 issues at the same time, over 50% of cases it will end up in an accident instead of an incident.

Once the report is out we will discover that both crashes didn't occur as the arm chair pundits predicted. It won't change the views of some but thats also normal in these things.

 

[3DDave]

Odd though, because ABS was originally designed for aircraft to handle runways exactly like that. I still see no indication that there is an option to shut it off specifically in the European market. I did see one reference that very old Audi's had a switch, suggesting that it was removed sometime between 2003 and 2005.

They must have hit an emu and it was so loud and was so startling they called for a heading instead of a pan pan. The first officer didn't mention anything about a bird strike to the tower, so why does that keep coming up? The alerts are alerts they've heard in the simulator; I would expect most stall awareness training should be on take-off and that training reflected that.

I hope the report goes deeply into how training and pilot certification failed these pilots when a report telling them how to safely fly was already released as a template for pilots getting the exact same warnings.

I will not be surprised if a report from the Ethiopian Ministry of Transport glosses over training and evaluation the way the Lion Air report failed to mention the third crew member. If there is a US NTSB report I wonder if they will be given access to the training records and scores for all the Ethiopian pilots.

 

[charliealphabravo]

I deleted my comment earlier since it seemed to be going farther off topic but the ABS can be turned off on the Tacomas and most 4x4's I'd suppose by engaging 4x4 or the E-locker. If not disabled offroad, the ABS system would be going off continuously every time you engaged the brake on soft/loose soil and possibly risking burnout I'm guessing. It's really not needed or effective offroad since the tires can effectively brake in soft soil by plowing action or friction even if the wheels are locked up since the tread is engaging the full internal shear friction capacity of the soil/snow which is the maximum resistance you can expect.

 

[Alistair_Heaton]

The Scandinavians hate ABS in the winter. Its not actually to improve braking its to allow you to steer while braking. As Charlie says if the road surface is low friction it creates all sorts of issues.

Here is a link to a EU commission report on the subject. I can't find any regulation on it either. I suspect that city cars won't have the option. Its certainly not the case that its mandatory to have a ABS off button. But to have any success of a model in the Scandinavian market they would need it. I suspect nobody would touch the model without the ability to kill the system. Its not a requirement for ABS to be fitted anyway for new models. Motorbikes are different they have had to be fitted with it since 2016.

https://ec.europa.eu/transport/road...ects/anti_lock_braking_systems_in_cars_abs_en

I could see in the America market if they gave you the ability to turn it off someone would, then get killed then the OEM would get sued. So they don't let you without going in a pulling fuses.

Aircraft are different because the nose wheel is not braked plus also you have directional control via the rudder down to 50 knts ish and we have differential braking.

Its main job is to stop wheel lock up and blow out. The performance difference between normal ops and anti skid off is next to nothing. You get limitations with cross wind and runway contimination but it doesn't effect things vastly. Did 6 sectors the other week without it through the MEL. It is a B cat MEL so 3 days to fix. So is considered important but not in the same league as a DC generator or TCAS not working. If you stamp on the brakes without it all the main tyres will blow out in in a fraction of a second even at relatively low speeds. Not surprising really when you hit 16 disks with 32 360 deg brake pads with 3000 psi per wheel.

"If there is a US NTSB report I wonder if they will be given access to the training records and scores for all the Ethiopian pilots. "

There won't be a NTSB report but as they have been requested to help then they will already have all that information.

It will have the usual section on pilot experence and currency and back ground.

Training wise I suspect there will be a reasonably large section but it will center round the usage of a 45 min presentation on an Ipad being ineffective for preparing pilots to fly a MAX.

The rest of it will be likely conforms to international requirements. Which will be true, training is an issue with the regulators who have been lobbyed by airlines for years to keep the costs to a minimum. Most of it is driven by the FAA to be honest. Its dual remit of promoting aviation and aviation safety clashing. As the only method of recovering a 737 in manual trim with a heavily loaded stab was dropped from Boeing manuals in the 70's the training side of things may prove to be a twist of the knife after the insertion for Boeing.

I susepct the OEM's will be heavily hammered after this works its way through. Airlines will get slightly effected when the regualtors get thier fingers out and do their jobs. Most pilots will not see a difference.

Its a bit like after the murdering German took a plane load into the side of a mountain. everyone was up in arms after that. And if you belived the pilot haters with that one every pilot would have to undergo a full suicide check every year with the medics with a specially trained phycologist. End result 3 years later was 3 questions on the medical form about do you have suicidal thoughts.

Fundementally there is a shortage of experenced pilots. You can have thousands of low houred first officers. Captains there is a huge shortage. Its a catch 22 situation. If you flog a dead horse and force an extremely high level of training to deal with a pilot backup design then the planes won't be flying anyway because there will be nobody to drive them. Nobody will buy your product because its vastly more expensive than a type which requires less training.

If the 737 max requires 1 more sim session per year than other types then thats the type dead as a dodo. BUt I presume you will want every pilot out here to have increased training on stuff that is only relavent to the 737 max. Training is focused on the type and the operation. It would be uttley pointless for a 737 MAX driver to do the amount of gear failure training that I do. The type just doesn't require it. There is no history of issues. Q400 we do it every year and there is plenty of history with issues. Turned out though it was nothing to do with the design it was all poor maintence. But such is life. I am just glad we don't have a HUD's in our Q400's it hurts like hell when you belt your head off it when you go to the sim.