Ethiopian 737-8 MAX down. No survivors.

So, you think that EASA is the land of the best and the brightest? Both EASA and FAA suffer the same problem, they get the people who love the protection of bureaucracies while the best & brightest are far more likely to be in the private sector.

 

My point was merely that the previous relationship of EASA rubber-stamping FAA certifications will have been eroded by the seeming lack of FAA oversight on this occasion. It wasn’t in any way meant as a commentary on public vs private sector talent in general. I tend to agree with your assessment however.

Best rgds all.

 

This ill cause problems with the bilateral agreement covering certifications. EASA might have a valid excuse and the FAA might buy into it on this case but always watch out for retaliation at some point; something that the FAA has a history of.

 

The FAA dropped the ball on this one. It’s either lack of scope and/or lack of expertise. I suspect both.

They must oversee or it will complicate Boeing’s business at this point. It’s cheaper if they oversee.

 

You folks don't understand how the certification system works. Most of the oversight is done by the DER's, or Designated Engineering Representatives. DER's are paid by the airframer but are supposed to be independent and to a very large extent they are and do the best job they can. So if someone dropped the ball it was likely Boeing who didn't grasp the potential effects of the computer code. The DER's, while having a general understanding of what's in the code, don't look at as deeply as the engineers who created it. If Boeing's engineers didn't catch and anticipate the effects of the failure, with their intimate knowledge of the code, then the DER's and the FAA wasn't going to catch it. Boeing didn't think that the MCAS could down the airplane and for that reason it wasn't considered flight critical, it didn't get the level of scrutiny that it would if they knew then what they knew today.

 

The fact that they didnt think it could down a plane is the first area of major caution about boeing as a company today.
The fact that it appears that the ethiopian flight was potentialy only recoverable with a lower airspeed, and given the pilot workload, it appears even after Lion air Boeing did not grasp the basics. I said it before and Ill say it again, Boeing has major management failure.

 

The ODA system has made things worse, IMO. Whereas before the FAA still had considerable oversight on the top level certification, i.e. cert plan, testing plans, reviews, etc, with ODA Boeing (and others who receive that delegation from the FAA) are essentially mini-FAA's acting on their own.

 

From Aviation Week

LOS ANGELES—As the investigation continues into the causes of the Mar. 10 Ethiopian Airlines Boeing 737 MAX accident, sources close to the probe say flight data recorder (FDR) data firmly supports the supposition that the aircraft’s left angle-of-attack (AOA) sensor vane detached seconds after take-off and that, contrary to statements from the airline, suggests the crew did not follow all the steps for the correct procedure for a runaway stabilizer.

Detailed analysis of the FDR trace data shows that approximately six seconds after liftoff was signaled by the weight-on-wheels switch data, the data indicate the divergence in angle-of-attack (AOA) and the onset of the captain’s stick-shaker, or stall warning. Almost simultaneously, data shows the AOA sensor vane pivoted to an extreme nose-high position.

This, says one source, is a clear indication that the AOA’s external vane was sheared off—most likely by a bird impact. The vane is counter-balanced by a weight located inside the AOA sensor mounting unit, and without aerodynamic forces acting on the vane, the counterweight drops down. The AOA sensor, however, interpreted the position of the alpha vane balance as being at an extreme nose-high angle-of-attack.

With the stick shaker active, the trace indicates the crew pushed forward on the column to counteract what they believed were indications of potential approach to stall. The aircraft, now in level flight, also accelerated rapidly as its power setting remained at 94% N1 thrust used for take-off. This was followed by some manual trim inputs using the thumb switches on the control column.

Seconds after speed advisories were heard, the crew raised the flaps. With the autopilot turned off, flaps up and erroneous AOA data being fed to the flight control computer (FCC), the stage was set for the MAX’s maneuvering characteristics augmentation system (MCAS) to activate. This is indicated by approximately 8-sec of nose-down stabilizer movement, which was followed by the use of manual trim on the control column. However, with the MCAS having moved the stabilizer trim by 2.5 units, the amount of manual nose-up trim applied to counteract the movement was around 0.5 units, or roughly only 20% of the amount required to correctly re-trim the aircraft.

Because of the way the aircraft’s flight control computer P11.1 software worked, the use of manual trim also reset the MCAS timer, and 5 sec. later, its logic having not sensed any correction to an appropriate AOA, the MCAS activated again. The second input was enough to put in the full nose-down trim amount. The crew again manually counteracted with nose-up trim, this time offsetting the full amount of mis-trim applied by the latest MCAS activation.

By then, some 80% of the initial MCAS-applied nose down trim was still in place, leaving the aircraft incorrectly trimmed. The crew then activated the stabilizer trim cutoff switches, a fact the flight data recorder indicates by showing that, despite the MCAS issuing a further command, there was no corresponding stabilizer motion. The aircraft was flying at about 2,000 ft. above ground level, and climbing.

The crew apparently attempted to manually trim the aircraft, using the center-console mounted control trim wheels, but could not. The cut-out switches were then turned back on, and manual trim briefly applied twice in quick succession. This reset the MCAS and resulted in the triggering of a third nose-down trim activation lasting around 6 sec.

The source says the residual forces from the mis-trim would be locked into the control system when the stabilizer cut-off switches were thrown. This would have resulted in column forces of up to around 50 lb. when the system was switched back on.

Although this could have been reduced by manually trimming the aircraft, this did not occur, and the third MCAS activation placed the aircraft in a steep nose-down attitude. This occurred with the aircraft near its peak altitude on the flight—about 6,000 ft. The engines remained at full take-off power throughout the flight, imposing high aerodynamic loads on the elevators as the crew attempted to pull back on the columns.

Vertical acceleration data also indicates momentary negative g during which the AOA sensor on the left side unwinds. This is seen as further validation of the theory that the external part of the alpha vane was detached as the apparent change in angle indication could only be explained by the effect of negative g on the counterbalance weight, forcing it to float up inside the sensor housing. In addition, the captain’s stick shaker also comes off twice in this final phase, further reinforcing the severed vane notion.

The source indicates the crew appeared to be overwhelmed and, in a high workload environment, may not have followed the recommended procedures for re-trimming. Boeing’s stabilizer runaway checklist’s second step directs pilots to “control aircraft pitch attitude manually with control column and main electric trim as needed,” according to one U.S. airline’s manual reviewed by Aviation Week. If the runaway condition persists, the cut-out switches should be toggled, the checklist says.

 

ODA can have issues but the belief that the ACO has the best knowledge base is regularly questionable. The TD offices may be better but my interaction with any of them has been quite limited. If you ever suffered through an STC application that went into the national pool you would be grateful for the ODA system. Warts and all it is still better.

 

Been through both systems with STC's. No further comment.

 

So the common factor in the two crashes appears to be failure of an AOA vane, in LionAir's case due to faulty maintenance and in Ethiopian's case due to an apparent bird strike. In both cases it made the MCAS think the airplane was at a much higher AOA than actual, and thus over-applied nose-down trim repeatedly, with ultimately fatal results.

 

If memory serves in LionAir it was a failure to fix an AOA condition complaint from a prior flight. It may well have been a bird strike too and was improperly diagnosed. Not sure any better information was made public.

 

Southwest just announced their Max aircraft will be grounded through 5 August.

 

That is absolutely stupid. How did they set that timeline? How can they know what the current investigations will discover ? Again, I would fly on a Max 8 tomorrow with an American crew This is an overblown reaction to a workable problem. BUT I'm not a member of the flying public. AND I'm probably not unbiased in my response. Just me.

 

Very likely based on feedback from Boeing. As a big Boeing customer they have a little clout in getting direct info.

 

It could also be: 1) Fleet planning so they know what to do with their flight and maintenance schedules of the NGs. 2) They are setting up their schedule for the "fix" for all Max before putting any back in service. Don't know if Southwest will have to do any hardware changes too that may have supply line issues. Would this include running all Max pilots through a new sim training program before re-entry into service?

All questions, no answers.

 

As the train wreck slowly unfolds.
At least in the press were starting to see Boeing admit and take ownership of this. In the beginning they were saying but its FAA approved. Its also clear that the complexity of the MCAS interface was not even well understood a few weeks ago. The software fix Boeing had months to do, is not pushed out again, indicating something was underestimated.

In other News Hacket at ford, 4 billion later says the autonomous car is a lot further off than was expected/predicted.

Seems like a lot of people been drinking the Tech can overide human decisions cool aid without understanding whats really required in terms of programing complexity and what the limitations are.

 

Why did the autopilot dis-engage in the Ethiopia crash. Had it not done so the MCAS woudl not have fired.
Why does the MCAS repetitively fire? If its supposed to fire to avoid a stall, once the stall is avoided is it not a flaw to allow it to keep firing every 5 seconds. Is there such a fear of a second stall?

 

Pilots Say MAX MCAS Software Updates Prove Effective In Simulator Demo
Apr 11, 2019Fred George | Aviation Week & Space Technology


Boeing has demonstrated the old and new versions of the MAX’s Maneuvering Characteristics Augmentation System (MCAS) to pilots and regulators in its 737 MAX engineering cab simulator in Seattle. The MCAS is a new flight-control-computer (FCC) function added to the MAX to enable it to meet longitudinal stability requirements for certification.

However, the system is only needed to enhance stability with slats and flaps retracted at very light weights and full aft center of gravity (CG). The aircraft exhibits sufficient natural longitudinal stability in all other parts of the flight envelope without the MCAS to meet the rules. Boeing emphasizes that the MCAS is not an anti-stall or stall-prevention system, as it often has been portrayed in news reports.

MCAS has three new layers of protection

Compares inputs of both AOA sensors

Pilots always retain pitch control authority over MCAS input to stabilizer

MCAS no longer repeats after 5 sec. if electronic trim inputs are made

The new software load [P12.1] has triple-redundant filters that prevent one or both angle-of-attack (AOA) systems from sending erroneous data to the FCCs that could falsely trigger the MCAS. It also has design protections that prevent runaway horizontal stabilizer trim from ever overpowering the elevators. Boeing showed pilots that they can always retain positive pitch control with the elevators, even if they don’t use the left and right manual trim wheels on the sides of the center console to trim out control pressures after turning off the trim cut-out switches.

Most important, the MCAS now uses both left and right AOA sensors for redundancy, instead of relying on just one. The FCC P12.1’s triple AOA validity checks include an average value reasonability filter, a catastrophic failure low-to-high transition filter and a left versus right AOA deviation filter. If any of these abnormal conditions are detected, the MCAS is inhibited.

Three secondary protections are built into the new software load. First, the MCAS cannot trim the stabilizer so that it overpowers elevator pitch control authority. The MCAS nose-down stab trim is limited so that the elevator always can provide at least 1.2g of nose-up pitch authority to enable the flight crew to recover from a nose-low attitude. Second, if the pilots make electric pitch trim inputs to counter the MCAS, it won’t reset after 5 sec. and repeat subsequent nose-down stab trim commands. And third, if the MCAS nose-down stab trim input exceeds limits programmed into the new FCC software, it triggers a maintenance message in the onboard diagnostics system.


Image Unavailable, Please Login
The only change pilots will notice with the upgraded MCAS will be angle-of-attack-disagree symbology availability on the primary flight displays. Credit: Guy Norris/AW&ST


According to a pilot who was shown the changes in a simulator session, the demonstration begins with the original MCAS software load. During a normal takeoff, at rotation, the left AOA indication moves to its maximum reading—as seen from the flight data recorder in the Ethiopian Airlines accident. Pilots currently do not experience this during initial or recurrent simulator training. The stickshaker fires continuously, using loud sound and control wheel vibration to focus the pilot’s attention on the critically high AOA indication. The erroneous AOA reading also creates large-scale indicated airspeed (IAS) and altitude errors on the primary flight display (PFD) which can be both distracting and disorienting.

AOA is used by the aircraft’s air data computers to correct pitot and static pressure variations induced by changes in nose attitude in relation to the relative wind. Large errors in AOA can cause 20-40-kt. errors in IAS and 200-400-ft. errors in indicated altitude. This is accompanied by the illumination of annunciators on both PFDs that warn of disparities in the IAS and altitude between the left and right displays. As part of the MCAS redesign, Boeing also is upgrading the MAX with AOA dial indicator displays and AOA disagree warning annunciators on the PFDs.


Image Unavailable, Please Login
Normal PFD Display on Takeoff: The red and white stall-warning tape on the airspeed indicator is well below the aircraft’s indicated airspeed. Credit: Fred George/AW&ST


After the high-AOA indication, pilots then follow the checklist for “airspeed unreliable,” which assures that auto-pilot, auto-throttles and flight directors are turned off. They then pull back power to 80% fan speed, set 10-deg. nose-up pitch attitude and climb to 1,000 ft. above ground level. At that point, they lower the nose, start accelerating and begin retracting slats and flaps at 210 kt. indicated airspeed. When the slats and flaps are fully retracted—the MCAS kicks in.


Image Unavailable, Please Login
Abnormal PFD Image at Takeoff Due to Erroneous AOA: The updated PFD display indicates angle-of-attack sensing errors as illustrated by the "AOA disagree" icon at lower right along with the red and white stall-warning tape extended well above indicated airspeed. Credit: Fred George/AW&ST


“It’s a good thing we knew what to expect. Otherwise tunnel vision from the ‘airspeed unreliable’ event could have blinded us to the subsequent MCAS nose-down trim input. When I noticed the trim wheels racing, I grabbed the left wheel. It was easy to stop the trim with hand pressure, but I knew in advance what was happening,” says the pilot flying. “We followed the checklist for runaway stabilizer, checking again for auto-pilot off and auto-throttle off. We turned off both trim cut-out switches and cranked the ‘frisbees’ [manual trim wheels on both sides of the center console] to relieve control pressures. We used manual trim for the remainder of the flight to landing touchdown and rollout. That was quite an eye-opener, as I had never been exposed to that during sim training,” he notes.

It is critical to follow the checklist memory items: Pull back thrust to 75% after retracting slats and flaps and set attitude at 4 deg., nose up. If speed builds up beyond 220-250 kt., controllability becomes increasingly difficult, he adds.

Pilots for three U.S. air carriers tell Aviation Week that during their sim training they had never been exposed to extreme and continuous AOA indication errors, they’ve not experienced AOA induced airspeed and altitude deviations on PFDs and have not had to deal with continuous stall-warning stickshaker distractions. They also note that they have never been required to fly the aircraft from the point at which a runaway stab trim incident occurred all the way to landing using only the manual trim wheels. “We’re just checking boxes for the FAA,” says one Seattle-based pilot.

A full aerodynamic stall with the MCAS inoperative is another exercise pilots experience in the MAX engineering cab simulator. “We reduced thrust at 5,000 ft. and slowed the aircraft at about 1 kt. per sec. We were at a midrange cg [center of gravity] with gear, slats and flats up. We trimmed until we reached 30% above stall speed and then just continued to ease back on the control wheel,” one of the pilots says.

“Pitch feel was natural, progressively increasing as airspeed decayed. Somewhere between the audible low airspeed warning and stickshaker, I felt the slightest lightening on control pressure in my fingertips. Quite candidly, if I had not been watching for it, I don’t think I would have noticed any difference between the MAX and the Next Gen [NG] models. I kept pulling back through stickshaker, then buffet, then elevator feel shift [a function that doubles the artificial control feel forces near stall] and finally until the yoke was buried in my lap. The nose just flopped down gently at the stall, and I initiated recovery as I would in most other airplanes I’ve flown,” he adds.

During design of the MAX, Boeing added two more leading-edge vortilons [generating vortices over the top of the wing at high AOA] in 2018, for a total of six per side and also lengthened and raised the inboard leading-edge stall strips to assure stall behavior would be as docile as that of the NG.

Repeating many of the same maneuvers in the engineering cab simulator with the new software load would have been academic at best, as the triple-redundant AOA validity checks all but assure that the MCAS will not be triggered by erroneous AOA inputs in the future. But, FCC P12.1 changes do not protect against erroneous AOA causing stickshaker or large-scale distortions in indicated airspeed and altitude values. Those malfunctions still can cause distraction and disorientation, especially when flying at night and/or in instrument conditions.

The new MCAS protections built into the P12.1 software load preserve its essential role in enhancing the MAX’s longitudinal stability, while virtually guaranteeing that it won’t be triggered by erroneous AOA. And when it does activate, its nose-down stabilizer trim command authority will be limited to assure the pilots always can control aircraft pitch with the elevators.

However, the FCC software upgrades are not the only critical changes needed to boost safety margins for operators. Pilots who underwent the demonstration also say the sessions underscored the need for additional simulator training for dealing with compound emergencies involving AOA and runaway trim failures.

 

"Pilots always retain pitch control authority over MCAS input to stabilizer"


This seems like a no brainer to me but what do I know? I'd think the human should always have override authority.

 

It seems we still have a long way to go before planes fly without pilots.......

 

Which would likely be based on Boeing feedback.

 

Based upon the Aviation Week article I suspect that there is going to be new simulator training requirement as part of the re-entry into service. Interesting if it will be for both left seat and right seat or only for the PIC. That is going to back up all the Max sims as each has to get the software update and the instructors have to learn their new procedure too.

 

They still don't get it.... The failure of the AoA sensor is inducing erroneous readings to the pilot telling him his airspeed is incorrect and this leads to wrong decisions as to how to deal with it. That's wrong. While the ASI can be higher than indicated with the false AoA sensor it can't be lower. When the AoA sensors disagree the computer should be smart enough to know, based on other inputs what is really happening. That is, if you have a bad AoA sensor, but the engine power, VVI, and airspeed all match what should be happening for a given flight condition, you know you have a bad input, and can readily identify the bad input and ignore it. You NEVER want to give a pilot bad information. Telling him is airspeed is unreliable when it's correct is a recipe for disaster... Like I said, they still don't have a criteria for all these systems that is robust. They're going down the wrong road and they don't understand why. Right now they're just trying to add levels of redundancy to what is a simple but poorly conceived system, and praying that this will keep the safe because you may not get multiple failures at the same time. That will work until it doesn't, just like what happened in this case and a plane will fall out of the sky.

 

Sorry if I missed it in the discussion but, why would a system like MCAS be based on one sensor only? What is the thinking behind that? Are there technical challenges, aside from more lines of code and more development time, that would drive the decision to not base it off more than one sensor?

Was it just based on the premise MCAS was only an augmenting system, so it didn't require a more robust set of sensors? Yet, the Boeing engineers knew the level of authority MCAS had, which seems like more than just an augmentation, it could control a lot (all?) of the pitch trim.

Seems like the thinking was a little "off".

And from where I sit, it seems less about Boeing being devious and more about Boeing being a little too casual. Weird.

-F