Ethiopian Airlines 737 MAX Investigation Preliminary Report
ecaa.gov.et
ecaa.gov.et
> At 05:40:35, the First-Officer called out “stab trim cut-out” two times. Captain agreed and First Officer confirmed stab trim cut-out.
[...]
> At 05:41:46, the Captain asked the First-Officer if the trim is functional. The First-Officer has replied that the trim was not working and asked if he could try it manually. The Captain told him to try.
> At 05:41:54, the First-Officer replied that it is not working.
[...]
> At 05:43:04, the Captain asked the First Officer to pitch up together and said that pitch is not enough.
> At 05:43:11, about 32 seconds before the end of the recording, at approximately 13,4002 ft, two momentary manual electric trim inputs are recorded in the ANU direction. The stabilizer moved in the ANU direction from 2.1 units to 2.3 units.
> At 05:43:20, approximately five seconds after the last manual electric trim input, an AND automatic trim command occurred and the stabilizer moved in the AND direction from 2.3 to 1.0 unit in approximately 5 seconds. The aircraft began pitching nose down. Additional simultaneous aft column force was applied, but the nose down pitch continues, eventually reaching 40° nose down. The stabilizer position varied between 1.1 and 0.8 units for the remainder of the recording.
Seems this debunks the initial implicit commentary how this was due to 'third world' pilots and couldn't happen in the US.
Wonder why didn't they trim up more when they turned the electric trim back on. On the surface it appears that was their last chance to salvage the situation.
Prehaps they didn't think it moved at all and decided they stablizer was jammed. 5 seconds later, MCAS commands down and because that's in the same direction as the aerodynamic forces it moved a lot easier.
Yeah, from my computer screen I can wonder why they didn’t sit on that ANU switch hard and long. But in that cockpit Boeing had already sealed their fate.
How does anyone expect pilots to run through these crazy scenarios and perform flawlessly unless they have done it in a simulator many times?
But a whole lot of social and political engineering was put into ensuring that simulator drills of emergency scenarios related to this system would not be part of any pilot's training.
For specific training to be reqired I assume it would need to be made a different certification entirely? Is that even a plausible scenario that this could change?
Then this is much worse than initially suggested, it means a pilot can be aware of MCAS and still be put in a extremely dangerous position due to the extreme control authority of the module.
I'm not saying that MCAS isn't mostly to blame but the fact that the maximum inputs from the pilot is still lesser than the control authority from the trim raises some serious questions MCAS or not. Had "extend flaps" been at the bottom of the checklist that would have disabled MCAS and likely prevented this crash.
The point still stands, the root cause was MCAS, without it this would never have happened. MCAS would not have pitched them into a dive, and even if they were pitched into a dive by some non MCAS system, they would have been able to turn on electric trim and recover. MCAS both caused the situation, and made fixing it impossible, so it was the root cause of the crash.
Agreed. One could argue that the AoA reading mismatch was the root cause, but the plane alerted the pilots to the discrepancy just as it was meant to (through stick shake and panel readouts).
They were aware of the issue, took measures to mitigate them, and MCAS still drove the plane into the ground.
I don't see in the report that the pilots attempted to both operate the manual trim wheel at the same time. I'm not sure if its explicit in the training, but in the manual its made clear that pilots may need to work together to move the trim out of extreme positions when the electric system is not available, and that doing so will not break the manual trim system.
Releasing the stick to assist with the wheel would have meant allowing the plane to nose-dive. This might have allowed them to crank in the stabilizer in time to recover, but they only had 7,000 feet above the ground to work with.
I didn't say that MCAS wasn't the lions share root cause here. It's just not as simple as the "hurr durr, MCAS bad" that a lot of people keep trying to portray the more nuanced statements of various regulatory agencies as being equivalent to. MCAS might be bad but on an aircraft with a different trim system it wouldn't be "hurr durr" levels of bad.
Sure, maybe some complex combination of maneuvers could have helped them out of this but there's really everything pointing the blame at this one system. Pilots did what the boeing manual suggested (even included at the end of this report).
I guess that there is a max speed for flaps (maybe the computer even actively refuses to extend them if the airspeed is higher than X to avoid that wings are destroyed).
I could not find if Boeing updated their manuals/checklists after the first crash.
http://www.avioesemusicas.com/wp-content/uploads/2018/10/TBC...
And the FAA made it an emergency airworthiness directive in response.
The steps on it were broadly followed by the Ethiopian flight.
Because the other factors don't single this flight out, and the plane wouldn't have crashed without MCAS misbehaving, or more fundamentally, without the flawed plane design that required such a system in the first place.
Are the trim wheels mechanically connected to the trim mechanism in the back? Is there no way to trim the horizontal stabilizer electrically without also enabling MCAS? What would happen if the pilots continually pressed the trim up switch on the yoke? That should've prevented MCAS from activating, right?
I thought Boeing airplanes were built such that "the pilot is always in control". That doesn't seem to be the case anymore, if by cutting the power to certain subsystems you can't control the airplane anymore.
I think the only way to survive this is to use the electrical trim assist to get to level flight and then shut off the system. After it’s level you can go ahead and trim using the manual wheel. Well the other way to survive this is to not have Boeing design the mcas to read from one sensor only and also have mcas operate in a narrow authority.
it seems the trim wheels are connected manually to the trim mechanism in the back, but when the trim stabilizers are in an extreme position the wind loading on them makes it very hard/impossible to rotate the trim wheels manually.
from what i understand, one way to relieve/lessen the wind loading so that the manual wheels can be used again is to (in the case of trim down) dive the plane. this would lessen the wind loading on the stabilizer and allow the manual wheels to move again. but you would need "room" to dive, something they did not have in this case.
https://news.ycombinator.com/item?id=19575318 "option 2)" (on this same page) refers to a situation where a "dive" could be executed in a situation where manual strength is not enough to trim the aircraft.
Correct. One wonders if this is a consequence of trying to maintain the type rating and therefore not being able to introduce any pilot training about the MCAS feature, and therefore not being able to introduce any control features for it.
Such a system should have been subject to extreme scrutiny, and honestly it beggars belief that the potential for these accidents wasn't seen. "This system can trim the nose down beyond the authority of the manual controls, based on readings from a single non-redundant sensor" should have been more than enough to get the gears turning, and it seems that the deeper one looks it only gets worse.
I guess that's no longer a requirement.
They could make the trim control wheel mechanically assisted, for example (since there are cases where electronic trim control is required because because of the amount of force needed to turn the wheel)
I'd imagine it already IS mechanically assisted. There is a limit to how much you can amplify a pilot's input mechanically, and I'd imagine the load on the aircraft exceeded the amount of amplification needed.
I.e. your car has power steering, so the car manually adds power to the turn based on the user's input. That doesn't mean that something in the road can't override the input of both the driver and power steering and jerk the wheel.
MCAS will evidently work with less maximum nose-down trim than the current version has, as the proposed update places a limit on it.
Also, it's not zero power. A ram air turbine deploys and provides hydraulic pressure to move the controls. And there are batteries to keep a small number of essential flight instruments powered.
This is very damning to Boeing. It's precisely the procedure they prescribed and intended to mitigate possible MCAS caused trim runaway. In light of the fact that they put this in place as a justification for moving the engines forward without reclassifying the plane, I don't see how they can get around fault here.
What a tragedy.
I can't imagine the emotion those pilots must have felt after attempting to do exactly what they were told to do to keep the aircraft in the air, only to have the nose lurch back downwards. Godspeed, gentlemen. It wasn't your fault.
It also means that the aircraft will have to be re-designed and re-classified before it ever flies again (it's now a very clear design error, not a training or communication error)
It seems they tried it but MCAS kicked 5 seconds after they turned on the electrical trim. They didn't have enough time to correct the stabilizer. I don't know how fast returning a stabilizer to neutral position can be done, but they probably thought they had more than 5 seconds. They were probably going to turn off electronic trim control afterwards.
Really there should just have been a separate cutout for MCAS itself, but that would have triggered retraining requirements, so Boeing wanted to avoid that. But very simply, there should just be an 'off' switch to disable this system if it starts to run away, distinct from the whole runaway trim procedure.
(as well as 2-of-3 redundancy on the sensors, the lack of redundancy is seriously exacerbating the rate of incorrect MCAS system activations)
Well, not quite: if they wanted it to protect against stalls at very low altitude, it would be operational with flaps extended.
The faulty AoA sensor is causing the plane to think it’s about to stall and therefore MCAS works as designed to prevent the pilot from putting the plane into a stall.
Of course the design is wrong because the plane is actually pointing toward the ground and MCAS thinks it’s pointing to the sky...
Maybe a bit like a self driving car planes will eventually have a system where they can use visual markers as a check on what sensors are reporting.
MCAS is disabled while flaps are extended. It would have activated the second they retracted the flaps.
[0] Appendix 1, 05:40:30 (You can see the AND command being canceled by the pilots manual electric ANU command)
- Boeing will lose 10s of billions of dollars because of this in damages, lost contracts, and redesign costs.
- Their CEO will resign.
- The FAA will revamp many procedures to vastly increase certification costs and not allow these types of same-class-rating bullshit.
- The FAA or similar EU agencies may slap some fine against Boeing
- The families will sue and win a large settlement.
- One or more engineers may commit suicide. (which would be itself tragic)
- Middle management will pay zero or nearly zero price.
- No one will be internally fired by Boeing as the problem is systemic.
- No criminal charges.
Many of these things will only happen with a sustains public relations compaign against Boeing, congressional hearings, persistent news articles, documentaries highlighting the harrowing crash, etc.
EDIT: I’d say there’s a small chance even that a system called MCAS never flies again, even if that means the entire MAX concept has to be shelved.
If the MAX can fly without MCAS but just under a new type rating, that could be the way they go. Boeing simply has not been successful introducing computer-moderated flight controls and envelopes the way that Airbus has over the last decade (and those lessons were hard learned too).
>Back in September the European aerospace giant, which employs 15,000 people in the UK, was on the receiving end when it was found that billions of euros in low interest loans amounted to illegal subsidies.
>Boeing celebrated that moment as a comprehensive victory which would deal a mortal blow to Airbus and result in more US jobs.
>The reality is that neither of these companies can exist without government subsidies.
Both of these companies are strategic assets to the countries that have them. So no surprise here. I'm not even upset at it- it's realpolitik.
Their priority list is, AFAICT: 1. Find out what happened. 2. Find out why. 3. Find out how to make sure it doesn't happen again. 4. See point 3. 5. See point 3.
Not that I think that's going to be the result of step 2. It was a contributing factor, probably, but it's not the whole story by any means.
The ones I have read do not feature three-word explanations, but rather say things like "the chain of events that led to the accident could have been stopped at any of these single points: <seven items> and would also have been stopped if both a&b had been done, or if both c&d, or both c&e" and then discuss how each of the many might be changed. They don't say "five of the links in the event chain were at a profit-hungry corporation, whose CEO should be thrown in gaol, then they'll know to do that differently in the future".
"Runaway corporate greed" is fine reason for a quick and angry post on a social network, but aviation postmortems are a different kind of beast, heavy on analysis and prevention, light on anger.
This postmortem must include "runaway corporate greed" absolutely. Not sure what can be done about it as the FAA is not trustworthy anymore.
The engineering fix is obvious, but management is the problem.
It is certainly within the realm of possibility that there will be severe consequences, up to and including criminal charges.
Boeing's bottom line would like this is be crew or operating procedure.
Let me get you up to date:
"The deal — four years after the 2008 collapse of Lehman Brothers nearly brought down the financial system — was criticized at the time, raising concerns about whether some banks had grown too big to face criminal indictment."
"Citing anonymous officials close to the case, the New York Times reports that federal prosecutors spent months debating whether to issue criminal indictments for money laundering. Authorities eventually ruled it out as such charges could ultimately cost HSBC its charter to operate in the US, seriously undermining the country’s fragile economic recovery."
https://www.nytimes.com/2017/12/11/business/dealbook/hsbc-us...
[...Quebec Premier François Legault said that SNC-Lavalin was one of ten publicly-traded companies headquartered in Quebec that the province considers to be "strategic" and therefore in need of protection from a takeover that would force the company to leave the province....]
https://en.wikipedia.org/wiki/SNC-Lavalin#SNC-Lavalin_affair...
In similar condition (nose down) in other plane just pulling the stick would work but with MCAS you have shut it down using some switch and just the stick won't work.
And now the report is saying even that switch doesn't work? That one MCAS goes bonkers there's essentially no recourse?
It is as ludicrous as it sounds.
Are they talking about manual electric trim, or physically moving the trim wheel with its handle?
I would expect manual electric trim to stop working after you STAB TRIM CUTOUT, since that kills the trim motor. Did the pilots try physically moving the trim wheel?
And, the crew left the power setting at climb throughout almost the entire sequence, so they oversped the airframe.
And, when they (against procedure) (apparently) turned the electric trim system back on, they did not use the yoke manual trim switch to fix the nose down trim problem -- which is a big mystery.
The MCAS design inhibits its FCC trim down output when manual trim is utilized. So, if they had just continuously pushed the nose up manual trim switch on the yoke until they got the trim to neutral, then pulled the cutout (either the first time or second time), the accident could have been avoided.
History shows this is not a good human factors design on the part of Boeing, but the crew does not look good, either, IMO.
The EAD/service bulletin doesn't talk about sufficient nose up trim or caution against performing the cutout with even a slight mistrim.
> And then they did not work the mechanical trim wheel hard enough to reset the residual nose down trim.
It's possible that aerodynamic load (of the stabilizer opposing the elevator) made it physically impossible to manually trim given any mistrim at the time the cutout happened, given the airspeed they had. And, the captain is pulling back on the yoke as hard as he can, so he's unavailable to let go of it and grab a trim wheel instead without immediately losing altitude.
> And, when they (against procedure) (apparently) turned the electric trim system back on
It seems sensible to assume -- and the report states -- that they did this because they found that manual trim was impossible in these circumstances.
Which really under explains the situation. In reality the STAB TRIM CUTOUT must be switched to CUTOUT within 5 seconds of using the electronic stabilizer trim, or the MCAS will re-establish the forces.
Its been noted in previous discussions that while it would be difficult, the load can be overcome if both pilots were to operate the manual trim wheel at the same time.
Not that its a good situation to be in.
I haven't seen that noted anywhere, and have seen it theorized as impossible without motor assist, given their airspeed and with the elevator opposing. Got a link?
Excessive airloads on the stabilizer may require effort by both pilots to correct the mis-trim. In extreme cases it may be necessary to aerodynamically relieve the airloads to allow manual trimming. Accelerate or decelerate towards the in-trim speed while attempting to trim manually.
https://www.pilot18.com/wp-content/uploads/2017/01/B737NG_FC... page 312 (8.16)
It's also from a 20 year-old manual, and isn't present on newer manuals, and pilots haven't trained on it in decades. Not appropriate to expect pilots to know, and possibly not helpful here: the pilots were low altitude, so allowing the nose to drop even further (to relieve aerodynamic load) may have been deadly too.
Vne is where things start to get scary because it's usually based on flutter, which can catastrophically damage/destroy the aircraft in very short order.
I believe that's correct given that they had an Unreliable Airspeed Indicator warning (due to the malfunctioning AoA sensor), per the memory items on the UAI checklist.
It makes the forces on the trim wheel much worse, which explains why they couldn't turn it, but it's the correct checklist response to the conditions observed, and the Boeing/FAA directive completely failed to take the impact of this response into account.
The idea that a pilot would knowingly leave thrust at climb power while in modestly level flight at low altitude and expect not to overspeed is very strange to me, checklist or no checklist.
I think they were too busy fighting the controls to worry about that.
Note IAS DISAGREE alert:
"In the event of an uncommanded horizontal stabilizer trim movement, combined with any of the following potential effects or indications resulting from an erroneous Angle of Attack (AOA) input, the flight crew must comply with the Runaway Stabilizer procedure in the Operating Procedures chapter of this manual:
- Continuous or intermittent stick shaker on the affected side only.
- Minimum speed bar (red and black) on the affected side only.
- Increasing nose down control forces.
- IAS DISAGREE alert.
- ALT DISAGREE alert.
- AOA DISAGREE alert (if the option is installed)"
About which was written here:
https://leehamnews.com/2019/04/03/et302-used-the-cut-out-swi...
"the high speeds observed" ... "were logical. It’s a consequence of following the Emergency checklist for “IAS disagree” (IAS is Indicated Airspeed, i.e. the dynamic air pressure experienced by the aircraft) after takeoff."
In short, seeing that Boeing indeed wrote about the IAS alert being activated when the sensor fails, and MCAS gets activated, I can only conclude that Boeing indeed knew that the pilots would make the plane uncontrollable if they followed Boeing's instructions. It seems they just gambled on the chance that the second crash won't happen so soon after the first.
Either that, or we'd have to believe that what a single pilot manage to do for his Youtube video a company which is to deliver the planes in worth of hundreds of billions (!) of USD wasn't able to do.
Why? Because your instruments disagree about your airspeed. You want to have a large margin to keep your speed high enough that you won’t accidentally stall while you try to establish what’s reliable.
You can't point at a memory item and treat it like the pilots can only apply what's in there in exclusion to everything else. The structural limits of the aircraft are there for a reason.
Aside from anything else the pilots were trying to maintain altitude by their communication with ATC.
Not that I'm blaming them. I think they had too much going on to even consider moving the throttles, and thats 100% on Beoing, but it probably didn't help their chances of recovery.
But aerodynamic forces can conspire to make it very hard or physically impossible for human force to rotate it if the elevator is being used to combat the stabilizer at high speeds. See here for more discussion of the physics behind it: https://www.satcom.guru/2019/04/stabilizer-trim-loads-and-ra...
Counter-intuitively, letting go of the stick in brief increments might have been the correct move. Letting the nose pitch down would take force off the jackscrew and let both pilots crank hard on the stabilizer. Boeing manuals once covered this, but apparently they haven't since the 1980s, and their directive after the Lion Air accident made no mention of the necessity of such a procedure. Also they were only 7,000 feet above the ground so whether or not they'd have recovered in time is hard to say. Quite possibly the MCAS had already doomed the flight.
No, it's worse: the origin airport is at 7000ft elevation. They only had around 1000ft height AGL for all of the flight. So I agree that releasing the elevator at all seems surely suicidal.
So must be manual trim wheel movements.
This entire report is frankly terrifying.
It's interesting that the flight with three pilots in the cockpit survived.
One thing that I've wondered though as I've read more about MCAS. MCAS can't kick in till the flaps are fully retracted. Usually when something goes wrong in response to an action, the response is to undo the action. Why isn't the procedure or even the pilot instinct to re-extend the flaps when the nose down occurs just after having retracting the flaps?
When the two AoA sensors began to disagree during takeoff, the left and right side airspeeds started disagreeing as a result. That leads the pilots to execute the Unreliable airspeed indicator checklist memory items, which include levelling off for troubleshooting and leaving the flaps in their current configuration (retracted), and to keep thrust high to avoid stalling due to the unreliable airspeed indicators.
It's precisely at this point that MCAS now kicks in and starts nosing them down. Extending flaps will cut it back out but: 1) they're now instinctually fighting the stabilizer with elevators to stay out a nose dive, 2) the checklist they were running when this started says not to extend flaps, 3) the Boeing/FAA directive tells them to hit the STAB CUTOUT, so they do that, but 4) the elevator/stabilizer fight + the high speed from the thrust being set to climb due to the checklist they were running when this started results in so much force on the manual stabilizer crank that the co-pilot can't turn it by hand and now they're so engaged in this stabilizer fight and trying to get the plane trimmed for landing that the flaps are the last thing on their mind, and the Boeing/FAA directive never instructed them to try re-extending them, airspeed disagree be damned. They're completely out of the manual and FAA/Boeing directive at this point. Nothing covers this (anymore, 30 year manuals would have had a procedure to ease the forces on the wheel here).
So lacking any other means of trimming for landing, they turn the electronic stabilizers back on, and trim electronically, which works...but they don't cut it again within 5 seconds (the FAA/Boeing directive didn't really spell out how crucial this timing is, or even consider that manual trim would have been made impossible by everything else going on), and the MCAS runs again, and the dive becomes fatal.
Because the story that I heard is that he purposefully commanded max pitch knowing that alpha protection would prevent the airplane from stalling, as his landing speed would be lowest at max AoA.
> I was commanding for more, pulling back full aft on the stick and the flight control computers prevented me from getting more lift therefore we hit harder than we would have (...) It turns out there's a little-known software feature known only then to a few Airbus software engineers, and to no pilots to no airlines that was the case. It's called a phugoid mode. And it was not the way we were trained the airplane should work, apparently it is the way the airplane does work. But that was not apparent to us.
https://aviation.stackexchange.com/questions/52147/why-cant-...
It's a truism of stocks that they move opposite of what you would expect when the final result comes in, and that's because they have already moved when news of whatever it is is released.
Eg: Company announces we will get 1 billion cash for free, stock goes up. when they actually get the cash, stock will go down.
Replace that scenario with whatever is making news about the company (mergers, new sales, personal changes, etc, etc).
The pilots didn't do that at all. Sustained manual trim only occurred after MCAS kicked in again at 5:40:27 and the pilots still waited before invoking the trim up command. The pilots never invoked sufficient trim up to counteract the automatic trim down command. Again, there is a reason the trim controls are on the control yoke in the first place. Of the three major MCAS trim down commands the pilots only stopped the second one with manual commands after it had already pushed the nose dangerously low. If the pilots had simply invoked manual trim promptly and counteracted the erroneous trim manual trim would have been successful after invoking a STAB CUT out.
If you think the pilots are following procedure why at 05:41:46 did: "the Captain ask[ed] the First-Officer if the trim is functional." ? That doesn't make sense, of course the trim doesn't work, the STAB TRIM cut out switches were engaged! But the response by the first officer was that "The First-Officer [has] replied that the trim was not working and asked if he could try it manually." which again doesn't make sense. But it gets worse because this happened a FULL MINUTE after the stab cut out switch was engaged, which means that neither pilot tried to manually trim the aircraft during that time at all!
But it gets better: "At 05:40:27, the Captain advised the First-Officer to trim up with him. " Which again doesn't make sense because it wouldn't make any difference if the both pilots were trimming up or not, the stabilizer doesn't move any faster.
My conclusion is that the pilots didn't know the checklist but its hard to tell because the CDR isn't presented completely.
For some background, systems intended to automatically override pilot input upon detecting an impending stall have been used on large, complex aircraft for a long time. The most common mechanism is a stick pusher, which mechanically pushes forward on the stick to mimic what a pilot should do about an impending stall. The force of a typical stick pusher is low enough that a pilot can overcome it with arm strength.
A stick pusher, or a pilot pushing forward on the stick is not enough for the aerodynamics of the 737 MAX in certain circumstances. The position of the engines means the thrust tends to push the nose up, and at low speed, the elevator controlled by the stick alone is not enough to push the nose down when nearing a stall. Instead, the trim must be used, which moves the whole horizontal stabilizer rather than just the elevator. That's not part of the procedure on most aircraft, including other 737s, so regulators would not allow pilots rated for 737s to easily transfer their rating to the new aircraft, if they were willing to certify such an aircraft at all.
MCAS is the solution to this problem. It automatically uses the trim to force the nose down with greater authority than the elevator alone could provide. While the concept is sound, the implementation strikes me as reckless.
First, the system uses only one of the two angle of attack sensors to determine that the aircraft is nearing a stall. Such sensors have a fairly high rate of failure relative to the safe operation of a commercial aircraft. As far as I can tell, causing the system to use both sensors is a software change and all models of the aircraft had the required hardware. I can't imagine a good reason the system was designed this way, especially since Boeing has included MCAS on a previous aircraft, the tanker version of the 767, and it did use two sensors in that application.
Second, activating the system automatically, and allowing it to contradict the pilot's attempt to pitch up using the elevator seems like a mistake. While stalls are almost always the result of pilot error, I'm inclined to think automated systems should let humans have the last word. A better design might have been to automatically trim nose-down in response to full forward pressure on the stick at low speed. That could be in combination with a stick pusher providing full forward pressure on the stick when an impending stall is detected in the absence of pilot input to the contrary.
MCAS is for an unusual combination of conditions where both elevator and trim might be needed to reduce the angle of attack. An example would be if the pilot set a fairly high nose-up trim to maintain the slow speed of final approach, then decided to go around (abort the landing), applied full thrust, and fully raised the flaps too early.
A pilot would definitely know that using trim is an option if the elevator was not producing enough nose-down pitch, but a pilot who has put the aircraft into the situation where a stall is imminent during a passenger flight has already made a series of errors.
This scenario seems it would apply to previous generation 737s as well. But for some reason, MCAS was required for the MAX 800.
Everything I have read so far indicates the MAX 800 has some 'pitch up on it's own' type problem that can lead to a stall. So while I'm sure it's possible to crash the plane in a variety of ways, none of that has to do with MCAS.
The elevator is not enough to overcome the nose-up pitching moment of the MAX under certain conditions, but the trim is.
If a 737 pilot can operate a 737 MAX only with MCAS, then the pilot shouldn't be able to disable it, right? What if he disables it and then the plane is stalling? There is no MCAS to help.
I believe this is incorrect. From what I understand, the 737 NGs and 737 MAXes both pitch up when thrust is increased and both may need to be trimmed back to counteract this. The reason MCAS is there is because the characteristics of the MAX are different from NG (that is, the airspeeds and angles of attack at which particular trims are required have changed), making the MCAS system regulatorily necessary, not mechanically necessary. Because either the MAX needs a system that emulates the handling of the NG, or pilots need to be trained specifically for the MAX, and the former is cheaper.
In other words the MAX is not objectively mechanically worse, but rather objectively mechanically different.
What's different is that at low speed, high thrust, and high angle of attack, the elevator of the MAX does not always have enough pitch moment to reduce the angle of attack.
I'm inclined to say having an elevator that's not effective enough to recover from all the stall conditions regulators test for without help from the trim is probably a flaw. Whether there's a good technical reason the elevator couldn't be more effective (probably just bigger), a regulatory reason (some rule says it's not a 737 anymore if they change it), or a non-technical reason (e.g. more shared parts to make it cheaper), I can't guess.
It's my understanding that for the 737 NG as well, there are stall scenarios at particular speeds, levels of thrust and angles of attack where trimming the stabilizer is necessary to recover. That the difference between the NG and MAX is what those particular values are, not whether or not that scenario exists ever.
[0] https://www.latimes.com/local/california/la-fi-boeing-max-de...
It's not so much a "problem" as it is "physics". If the stabilizers are forcing the nose down, and the pilot pulls back on the stick (engaging the elevators) to pull the nose up, the forces exerted on the stabilizer are such that, in extreme cases, human force is insufficient to move the manual wheel.
This is extremely (EDIT: No longer) well documented by Boeing going back decades, and it presents solutions of either: 1) reengaging the electronic stabilizer trim and trimming electronically back to a point where the forces are manageable, then cutting electronic trim again, or 2) relaxing the stick, letting the nose go the way the stabilizers want it to, which slackens the force, and makes cranking the wheel manually doable. Great if you're stabilizers are trimmed severely nose down at a height of 40,000 feet; less great at a height of 1,000 feet. (EDITED TO ADD: Apparently this information & procedure was removed from Boeing's manuals after the 1980s, and pilots no longer train on it, as the issues that led to its necessity were thought solved. The MCAS apparently has reintroduced the need for them.).
This is compounded by a new change in the 737-MAX: in prior 737 series aircraft, there are two stab trim cutout switches: one to cut the autopilot's ability to command the stabilizer trim, the other to cut electronic power to the stabilizer trim adjustment entirely, so you could stop the autopilot from changing the trim but still retain electronic control and not need to worry about the manual crank forces. The two switches are MAIN ELEC and AUTO PILOT.
In the MAX, this changed, and it's now an all or nothing setup: you have to kill electronic power to kill autopilot commands to the stabilizer. The two switches are now PRI and B/U. Both must be cut out to stop any stabilizer runaway, including MCAS runaway.
This all seems to add up to Boeing's narrative of "The MCAS is safe, pilots just need to know to hit the stab trim cutout" being grossly insufficient. They must cut it at a moment where the stabilizer isn't grossly mistrimmed with respect to level flight, OR they may well need to re-engage it and race the MCAS to get into a close-to-proper trim setup prior to cutting out the stabtrim and assuming manual trim control.
All while keeping the plane in the air, reading the manual, and attempting not to lose composure knowing that the same thing has happened to another flight that lost all hands.
I'm trying very hard to look at this objectively, but this is an extremely bad look for Boeing.
> All while keeping the plane in the air, reading the manual, and attempting not to lose composure knowing that the same thing has happened to another flight that lost all hands.
Additionally an angle of attack (AOA) sensor failure also triggers an unreliable airspeed warning so the pilots no longer trust their airspeed sensors or their AOA sensors while trying to judge pitch and speed. If they go too fast the control forces overpower them, if they go too slow they are more likely to stall.
I don't think Boeing gamed out or tested in a simulator the human factors involved in an AOA failure at takeoff, particularly for pilots who - like the Lion Air pilots - are entirely ignorant of MCASes existence.
EDIT: Found it: https://www.reuters.com/article/us-ethiopia-airplane-simulat...
I would hope that Boeing internally had simulators for the MAX while they were testing it - along with a borrowed supply of pilots who were competent but had no inside information. Even if they didn't, a pencil and paper exercise might have been useful:
1. AOA sensor fails at takeoff (A), the pilots receive an unreliable airspeed warning and the stick shaker activates. The pilots now mistrust their sensors and want to keep their speed up and the nose down.
2. At about 1000 feet above ground the pilots level the aircraft, raise the flaps and start the unreliable airspeed checklist. MCAS starts trimming intermittently.
3. The pilot flying is having to pull further back on the stick and trim correctively while the crew work through their checklist. At this point the crew need to avoid any over-focus, task saturation or over-stimulus from the many warnings and indicators and ask themselves why the aircraft is trimming the way it is. They have a fairly narrow window of time in which to do this and then disable the trimming with the plane in a well trimmed state.
(A) That this happened twice in relatively quick succession might be due to a common problem. Even if such a problem is found and fixed the AOA vanes and pitot tubes are delicate sensors sticking out of the nose of the aircraft; the system should be robust to failures in these sensors.
Runaway stabilizer is a memory item, there should be no reading of the manual involved.
Unfortunately the design of MCAS defeated the checklist of this particular memory item when in lower flight altitudes - which goes back to the argument that the 737 MAX never should have been given the same type rating as the older models.
They went for option 1 in this case, with the MCAS kicking in 5 seconds later.
> This all seems to add up to Boeing's narrative of "The MCAS is safe, pilots just need to know to hit the stab trim cutout" being grossly insufficient.
Yeah, and even that is understating it in my opinion.
Yeah, they basically had to go with option 1. They were only 1,000 feet above the ground, the maneuvering room to let the nose dip, crank, dip, crank, etc until properly trimmed just wasn't there.
How did this scenario get missed during testing? You'd think they would do extra testing around the new changes.
Seems like systemic issues. Reportedly Boeing's submitted risk assessment of the MCAS was based on a single adjustment applied from it, not repeated cycles of application based on a failure of the AoA to recover to what it saw as "level".
The FSB noted the change to the cutout configuration as a difference, but didn't analyze how that could change anything during Autopilot or Speed Trim runaway situations. They didn't even make any note of the MCAS as a difference at all (possibly they were not informed of it?).
I suspect this all comes down to the fact that Boeing started with a conclusion -- The MAX series must not require new simulator time -- and that conclusion was the lens through which they analyzed (or didn't) everything else.
Am I reading the chart on page 27 wrong? Because it looks like they reached a maximum height of 7,000 feet. Also looks like they were continuing to slowly climb until they re-enabled electric trim.
EDIT TO ADD:
Page 12 also says:
>about 32 seconds before the end of the recording, at approximately 13,400 ft
Which is a bit under 6,000 feet higher than the airport.
But apparently the option 2 maneuver (relax pressure on stick, then crank) hasn't been covered in a Boeing 737 manual since the 200 series in the 1980s.
So even given the extra room, there was no documentation covering that possible recovery scenario.
Are there real scenarios where you want to have both control surfaces opposing each other so heavily? Are there real cases for having the trim trying to pitch the plane down while the pilot is trying to pitch up with the stabilizer?
Or should we limit the trim so it never actually opposes the pilots intentions? (Maybe set it to a neutral position and disengage auto function if this condition is detected?)
In yet another change in the MAX series, there used to be what was called an aft column cutout switch which did more or less what it sounds like: engage when the stick was pulled back, cutting out autopilot commands to the stabilizer, so that it never attempted to outmuscle the pilot's input commands to the elevator.
This was removed in the MAX. Possibly this was to meet certification requirements: if the MCAS was needed to push down on the nose to meet the requirement that "During the approach to the stall, the longitudinal control pull force should increase continuously as speed is reduced from the trimmed speed to the onset of stall warning." If the MAX tends to pitch nose up at a certain point, the MCAS is intended to create a counter force against the pilots commands as it approaches that, rather than have the pilot pulling back at some point suddenly buck the nose upwards, then the MCAS needs to be active when the pilot is pulling back on the stick.
But it does argue that a LOT more thought needed to go into MCAS failure modes if it was necessary for it not to be cut out when the pilot is operating elevators.
I think what's going on with the 737-MAX is the needed trim is way beyond what's needed to fly the plane.
I'm now wondering is the MACS is needed because the tendency to pitch up also exceeds the pilots control inputs which is why it had to be on the elevator and have that much authority. Meaning once the aircraft pitches up the pilot doesn't have enough authority to push the nose back down.
Or, alternatively, the pitch up happens so quickly and severely the risk of stall is too great above a certain AoA and the pilot won't have adequate time to respond.
If either is the case, it implies the aircraft is not safe to fly without MCAS operational, and possibly not at all.
737 is a common plane. If there were a systemic problem it would have been discovered long ago. (In fact I think several such problems were discovered and fixed long ago.) Look how quickly this new problem was discovered by the public, with both the manufacturer and primary regulator working to hide it.
That's the reason the MAX should have been a separate classification with specific hands-on training.
edited
Yes, and it will only activate during that edge case if the AoA inputs are accurate. But they weren't. And so MCAS activated when it shouldn't have, and did things that the pilots could not recover from because they were things MCAS should never have done in the first place. That's the problem.
Source? That's the first I've heard that it's only for edge cases.
[0] https://theaircurrent.com/aviation-safety/what-is-the-boeing...
Or flying into windshear changes the angle of attack on you.
It's only supposed to activate in a specific edge case (high angle of attack, manual flight, no flaps, low airspeed). That's been discussed plenty online (including previous threads here at HN).
But that assumes that the angle of attack sensors are accurate. If the AoA sensors are inaccurate, as they were on this flight (more specifically the left one), MCAS can activate when it's not supposed to. That's what happened here.
I wasn't talking about at what airspeeds a stall is possible. I was talking about at what airspeeds MCAS is designed to activate (assuming correct AoA sensor input).
>At 05:41:46, the Captain asked the First-Officer if the trim is functional. The First-Officer has replied that the trim was not working and asked if he could try it manually. The Captain told him to try. At 05:41:54, the First-Officer replied that it is not working.
"Manually" here could mean manual electric control. 8 seconds seems an awfully short time for the Captain to ask if trim is functional, FO to say no and ask to try manual, Captain to say Yes, and for the FO to try the wheel and conclude it's not working.
We're now talking about pilots having to have abnormal levels of skill and possibly even strength to fly this aircraft.
That's an untenable state of affairs. Boeing have really screwed this one up.
My God.
If MCAS activates when it isn't supposed to, which is what happened here, disabling it is what you want to do--to stop it from doing an incorrect thing. The plane was not in a situation where MCAS was needed; it was perfectly flyable without MCAS in the flight regime it was in.
The problem is that, if you disable MCAS (which requires disabling the entire electric stability trim system) without first using the electric trim system to get back to something close to neutral trim, you will be stuck with a lot of nose down trim that you can't remove fast enough with the manual trim wheel. It looks like that's the situation this flight got into.
But if you first use the electrim trim system to get back to something close to neutral trim, and then, before MCAS has a change to mess it up again, disable the entire electric stability trim system, you're ok. How do we know? Because that's what the first Lion Air flight (the one the day before the one the crashed) did, because an off duty pilot that was riding in the jump seat figured out what was happening and how to deal with it and told the pilots what to do.
As far as I can tell, there is no takeoff (pitch up) situation where MCAS is not needed on the MAX 800. It's required for safe operation of the plane, otherwise the nose might pitch up unexpectedly into a stall.
As I said, the system can't both "be required for safe operation of the plane" and "it's safe to disable MCAS while it's malfunctioning during takeoff." You have to pick one.
Reference, please? I have not seen anything that says MCAS is required for safe operation at a normal angle of attack for takeoff and climb to altitude. Note that the key parameter is angle of attack, not pitch angle; if the plane is climbing the angle of attack is lower than the pitch angle, because the plane is climbing so the relative wind is coming from somewhat above the horizontal direction.
Likely 99% of the commentariate here are neither 737 Max pilots, let alone even licensed to fly commercial passenger jets, or even have a pilots license. And no, as much as I love the guy, watching Mentour Pilot does not make you an expert. They have fuck all knowledge about, or even experience, about the sudden cockpit workload that was imposed on these pilots until the point of hull loss. Have some respect. Oh, and you know what, this was Ethiopia's national carrier, I expect these flyers were at the top of their profession and as good a pilot as any other national carrier,
The timeline mentions stab trim being switched to cutout, and if you look at the FDR graphs there's a (relatively) long period of more-or-less stable trim after that. But then there's an automatic trim down, which is only possible if the electric stab trim is switched back on, and there's no mention of that.
I also can't help but wonder if exceeding Vmo was a factor.
(I don't mean to sound as though I'm trying to assign any blame here. Obviously this was a confluence of problems, the most significant of which is the control system reacting to an erroneous 75° (!) AOA indication.)
If you carefully study the graphs in the report, the plane was really not in bad shape up until this point. They were 7000 feet above ground and climbing. They were going too fast, but again, this is the fault of the crew. If they would have not flipped the cutout switch and taken stock in the situation and backed the throttles down, it is quite possible this flight would have ended very differently.
We have no way of knowing when, or why those switches were flipped.
How can the sensors record such different readings?
For redundancy, each pilot receives separate instrument readings from independent sensors. When the airspeed readings disagree a warning is activated and the pilots are expected to follow a prescribed and memorized procedure. The warning that the AoA sensors disagree was a paid option before this crash and the Lion Air crash.
The airspeed discrepancy has the same pattern: the left is reading low and also showing blips, where it equals the right reading, that also correspond to when the AofA indicators match.
All this would be consistent with the left AofA reading being used to correct the left static pressure reading by raising it at high angles of attack, and vice-versa for the right AofA vane and static port (this assumes there is a right static port used by the right pressure-driven instruments, an a left port for the left ones.)
>the First-Officer mentioned Master Caution Anti-Ice.
(edit: clearer language)
Hmm. Seems not just faulty AoA sensors? Perhaps some major malfunction in the flight computer? I've felt this entire time there's been a rush to claim 'faulty AoA sensors' because 'sensors' are known to fail, and it's an easy scapegoat.
My question is, does the flight recorder have raw inputs from the sensor, or just what the flight computer is reporting from the sensor? Seems like the latter.
Literally everything depends on a single tube which is known to get clogged with ice, bugs etc.
So for the 737 Max, a single clogged AoA sensor causes all these things immediately and simultaneously:
-- all your airspeed and altitude readouts go haywire, at least on one side of the cockpit
-- a bunch of alarms start going off and a bunch of lights start flashing, each indicating a different problem
-- your control stick starts shaking
-- a little-documented system immediately commands the nose straight down into the ground, and keeps commanding it until turned off (but turning it off effectively prevents you from counteracting the nose down command)
Good luck.
This part is very interesting. This aircraft nose down (AND) trim occurred while the electric trim system was disabled. This means that either the pilots were moving the manual trim wheel in the wrong direction, or that aerodynamic forces were causing significant AND trim.
2. Not ticking the box on the AoA DISAGREE alert option on the order sheet.
3. Not using electronic override to neutral before STAB TRIM CUTOUT.
It sounds like they did everything right. There are two fateful moments:
>At 05:41:46, the Captain asked the First-Officer if the trim is functional. The First-Officer has replied that the trim was not working and asked if he could try it manually. The Captain told him to try. At 05:41:54, the First-Officer replied that it is not working
At this point they were in stable flight and the trim wasn't that extreme. An inability to manually adjust trim is a huge design flaw unless it was pilot error.
>At 05:43:11, about 32 seconds before the end of the recording, at approximately 13,4002 ft, two momentary manual electric trim inputs are recorded in the ANU direction. The stabilizer moved in the ANU direction from 2.1 units to 2.3 units. >At 05:43:20, approximately five seconds after the last manual electric trim input, an AND automatic trim command occurred and the stabilizer moved in the AND direction from 2.3 to 1.0 unit in approximately 5 seconds. The aircraft began pitching nose down. Additional simultaneous aft column force was applied, but the nose down pitch continues, eventually reaching 40° nose down. The stabilizer position varied between 1.1 and 0.8 units for the remainder of the recording.
They re-activated electric trim control but only slightly adjusted it. MCAS kicks in to send them nose down. There's no further pilot correction recorded. Again, unclear here if there is an airplane issue preventing them from adjusting trim or a pilot error.
This document is a big deal.
[1] https://web.archive.org/web/20190404163122/https://www.bbc.c...
(emailed to hn@ also)
EDIT: You guys can fucking blow me. Moderators ban my account please.
Anyway, I'm on your side. Two planes falling from the sky killing hundreds I mean that's a non negligible percentage of 9/11 casualties. Maybe we don't know exactly the cause (tho it seems we do) but at any rate I'd wager a large sum of money that this is boeings fault.
This subthread is clearly about gratifying rage, not intellectual curiosity. That makes it off topic for Hacker News. Yes, the rage is understandable and there are reasons for it. Nevertheless what's going on in this vortex of the discussion is not in keeping with the values of the site. To a weird extent actually.
If this it true then link? When was this confirmed? Who are the assholes?
Else this is just Reddit spam that contributes less than nothing.
There's a piece of additional flavor, which is that as I understand it Boeing proposed building a new type of plane as an a320neo competitor, and the airlines announced that they'd only buy it if it's a 737 subtype to avoid having to retrain their pilots. It's not just "Boeing doesn't want to pay for certifications", but also -- and perhaps primarily -- "Airlines don't want to pay for training".
So while Boeing's ultimately responsible for building unsafe aircraft, I could imagine people being angrier at the airlines than Boeing.
And FAA is another sad excuse these days it seems. One doesn't let trivial things self certify and they let an airlines company self certify critical parts of a plane. What a joke.
Nobody should accept this attempt to excuse Boeing of its responsibility and even less the possible variant of it "we are all guilty we will buy the cheapest flight."
1) decided to move the engines forward making the aircraft dynamically unstable, but improve performance and potential sales
2) decided to counter the instability with a software system (MCAS) based on a single sensor, with zero redundancy or fail-safe mode, AND make a second sensor an optional extra cost for the airlines, AND bury the whole thing in a poor UI, in short: cheaping out on a band-aid fix to a critical problem of their own creation, to maximize profits
3) decided to evade normal requirements to make the airframe a new classification, so that airlines wouldn't need to spend money on retaining and separately qualifying pilots for the different airframe, again to reduce apparent costs of the new airplane and increase sales
4) minimized the training on the MCAS system and require no new training when they made changes to the system. AND make the MCAS system automatically re-engage, based on the single sensor to reduce customer costs
5) ensured that this cascade of bad decisions got implemented through the FAA and rolled out globally.
The effect of all of this was to overlook and minimize critical flaws in a complex human flight system, and do so in order to maximize sales and profits over safety.
They killed 346 people already, and nevermind the economic knock-on effects.
No, I'm not going to hunt back and provide a link to every bit of analysis I read gathering the above facts. It is all recent, non-obscure, and very google-able.
Yes, bad engineering and management decision that kill people will tend to get folks a bit riled up. This is a good thing. While this forum should indeed emphasize facts and intellectual argument, this is not a peer-reviewed journal, it is a forum for humans to discuss issues, and we should also keep here the human perspective on engineering.
This would be extremely egregious, but it's not what happened. Every MAX has two AoA vanes. Every MAX only hooks up the MCAS to one vane. The optional feature was just an "AOA disagree" light and display, which wasn't even hooked up to an error alarm. It's a red herring for these crashes, in my opinion. The pilots aren't going to hunt around the cockpit during an emergency and notice a disagree light and be able to conclude anything meaningful about what's happening to the plane and how to stop it.
I don't believe that's true. Per Mentour Pilot, the 737 MAX and the 737 NG are both very stable aircraft that are not prone to stalling[0]. That there is a difference in performance characteristics that creates a difference in how an escape from stall maneuver is to be performed, and the MCAS is meant to paper over that difference.
[0] https://www.youtube.com/watch?v=TlinocVHpzk @16:25 "[...] The 737 MAX and NG are equally less indicative of getting stalled, okay? They are very good, very nicely flying aircraft. But once they're in a thrust stall, they have slightly different characteristics. [...]"
So, yes, if you;re actively flying the plane and staying on top of your trim & pitch, keeping it in the middle of the range is just a bit different. But, if it gets out of hand, it gets progressively worse at an increasing rate, which is what MCAS was apparently designed to prevent.
Of course, if they'd designed the MCAS with multiple redundant sensors, as well as integrating other data (thrust, accel, GPS trajectory, pilot inputs, etc.) into a complete image, or at least a solid series of sanity checks on then applied it, it could have been a great advance.
Instead, they cheaped out, with the result that they added to the design a single point of failure.
The result, within a year of its rollout, is 346 people dead.
Someone actually downvoted and argued against me that their dog's life is more valuable than "a stranger's". I have no doubt it's the same people downvoting your comment. I can't tell if these people are just really good trolls, or they truly don't value human life (including loss of life in an airplane crash).
(I'm sure somebody might want to tell me about how they have a family and a dog, and love both. That's great, but I'm quite sure losing a child would be a greater blow to you than losing a dog. The point here is that somebody who already feels pain from missing family might try to ameliorate that pain with dog ownership.)
If what you mean to say is "if what I am saying is wrong, then ban me for saying it," you should say that.
Regardless you've created a little drama for your biologically degrading snowflake, and it's unlikely they'll want to make you a martyr, but does your second sentence really add much value except to air your protestations?
There's actually no way of doing that on HN.
If you want to see what it's like with far more automation, look at Airbus. They have a fundamentally different philosophy on computer controlled aviation. They also don't have a perfect record, there have been Airbus crashes due to malfunctioning automation.