Hacker News Reader

Comment by mhandley | Hacker News Reader

Indeed looks like they did disable MCAS using the stabilizer trim cutout switches, but the aircraft was trimmed nose down when they did so. Aerodynamic loading prevented manual trimming using the trim wheels. They eventually turned electric trim back on, as they didn't really have any other options, but didn't trim back enough, and left it turned on. At this point the right airspeed indicator (which should be more reliable) reads 365 knots. VMO is 340, so they're already in big trouble. 5 seconds later, MCAS kicked back in, and then it was all over. Very sad.

View on HN

Yeah, from the report:

> At 05:40:35, the First-Officer called out “stab trim cut-out” two times. Captain agreed and First Officer confirmed stab trim cut-out.

[...]

> At 05:41:46, the Captain asked the First-Officer if the trim is functional. The First-Officer has replied that the trim was not working and asked if he could try it manually. The Captain told him to try.

> At 05:41:54, the First-Officer replied that it is not working.

[...]

> At 05:43:04, the Captain asked the First Officer to pitch up together and said that pitch is not enough.

> At 05:43:11, about 32 seconds before the end of the recording, at approximately 13,4002 ft, two momentary manual electric trim inputs are recorded in the ANU direction. The stabilizer moved in the ANU direction from 2.1 units to 2.3 units.

> At 05:43:20, approximately five seconds after the last manual electric trim input, an AND automatic trim command occurred and the stabilizer moved in the AND direction from 2.3 to 1.0 unit in approximately 5 seconds. The aircraft began pitching nose down. Additional simultaneous aft column force was applied, but the nose down pitch continues, eventually reaching 40° nose down. The stabilizer position varied between 1.1 and 0.8 units for the remainder of the recording.

Seems this debunks the initial implicit commentary how this was due to 'third world' pilots and couldn't happen in the US.

Interesting, that when they turned the electric trim back on, they only momentarily blipped the switches to trim up, and the stabilizer did move. Then five seconds later MCAS pitched down again and it was over.

Wonder why didn't they trim up more when they turned the electric trim back on. On the surface it appears that was their last chance to salvage the situation.

That's what I think is most interesting. Given the position they found themselves in, going against the directive from Boeing to leave the trim cutout for the duration of the flight, means they were desperate to get the trim back up. So why did they not immediately make use of the reenabled electric trim control to counteract MCAS for as long as it took? They had kept the plane flying up until reenabling the electric trim, but that one action pushed it over the edge and could not be reversed? Confusing.

They made two small trim up commands. But looking at the flight data graph, the stablizer on the bearly moves. The motor was probably stugling against the aerodynamic forces too.

Prehaps they didn't think it moved at all and decided they stablizer was jammed. 5 seconds later, MCAS commands down and because that's in the same direction as the aerodynamic forces it moved a lot easier.

They are also pulling with all their might on the yoke and have been for several minutes. At this point probably fighting fatigue or even getting close to muscle failure (how many pounds of force for how long?) and starting to question their sanity.

Yeah, from my computer screen I can wonder why they didn’t sit on that ANU switch hard and long. But in that cockpit Boeing had already sealed their fate.

For comparatively trivial things like what to do when we get too much traffic on servers, engineers do “game day” testing.

How does anyone expect pilots to run through these crazy scenarios and perform flawlessly unless they have done it in a simulator many times?

Um, they do? Endless simulator drills of various emergency scenarios is a large part of becoming a pilot and staying certified.

Here, no pilot had any simulator training for the new MAX. Because Boeing was selling the planes as the "same as old ones, no training needed." It seems Boeing also claimed up to just a few days ago that the simulator training is still not going to be needed for the MAX, just the "one hour iPad" game.

Yes, normally.

But a whole lot of social and political engineering was put into ensuring that simulator drills of emergency scenarios related to this system would not be part of any pilot's training.

And if training for this scenario in a MAX-specific simulation was recommended/required then Boeing wouldn’t sell many planes because that would mean buying simulator time and retraining your existing 737 pilots.

For specific training to be reqired I assume it would need to be made a different certification entirely? Is that even a plausible scenario that this could change?

So MCAS put them in a hard to recover position which required electric trim to recover, and as soon as they turned on the electric trim MCAS turned on again and forced them into a crash?

Then this is much worse than initially suggested, it means a pilot can be aware of MCAS and still be put in a extremely dangerous position due to the extreme control authority of the module.

Per the article a combination of things put them in that situation. Not just MCAS. Why is everyone so wedded to the narrative that this is the fault of MCAS and nothing else? Complex systems that have millions of man hours spent making them safer don't usually have back to back failures because of one faulty subsystem. We've incrementally refined commercial air travel to the point where single source accidents are basically nonexistent.

I'm not saying that MCAS isn't mostly to blame but the fact that the maximum inputs from the pilot is still lesser than the control authority from the trim raises some serious questions MCAS or not. Had "extend flaps" been at the bottom of the checklist that would have disabled MCAS and likely prevented this crash.

It's true there were aggravating factors, like the inability to manually rectify trim, which (would seem to me) would be a aerodynamic or design issue.

The point still stands, the root cause was MCAS, without it this would never have happened. MCAS would not have pitched them into a dive, and even if they were pitched into a dive by some non MCAS system, they would have been able to turn on electric trim and recover. MCAS both caused the situation, and made fixing it impossible, so it was the root cause of the crash.

> The point still stands, the root cause was MCAS

Agreed. One could argue that the AoA reading mismatch was the root cause, but the plane alerted the pilots to the discrepancy just as it was meant to (through stick shake and panel readouts).

They were aware of the issue, took measures to mitigate them, and MCAS still drove the plane into the ground.

> It's true there were aggravating factors, like the inability to manually rectify trim, which (would seem to me) would be a aerodynamic or design issue.

I don't see in the report that the pilots attempted to both operate the manual trim wheel at the same time. I'm not sure if its explicit in the training, but in the manual its made clear that pilots may need to work together to move the trim out of extreme positions when the electric system is not available, and that doing so will not break the manual trim system.

I don't think they were concerned about snapping the cable, but based on a simulation run last week by a Swedish pilot (who needed both arms locked around the column to keep it held back, towards the end), and the reports' notes of the pilot repeatedly instructing the co-pilot to help him trim up, the forces on the column were such that the pilot couldn't assist in cranking AND continue to pull back on the column at the same time.

Releasing the stick to assist with the wheel would have meant allowing the plane to nose-dive. This might have allowed them to crank in the stabilizer in time to recover, but they only had 7,000 feet above the ground to work with.

Likewise had Boeing designed a control surfaces system such that the pilot always has more control authority than the trim this also would not have happened.

I didn't say that MCAS wasn't the lions share root cause here. It's just not as simple as the "hurr durr, MCAS bad" that a lot of people keep trying to portray the more nuanced statements of various regulatory agencies as being equivalent to. MCAS might be bad but on an aircraft with a different trim system it wouldn't be "hurr durr" levels of bad.

Are there any airliners from any manufacturer where the pilot always has enough authority to override full trim?

Airbus just gives you a joystick with no force feedback at all. So yes ... but an entirely different philosophy. You tell the aircraft what you want it to do and it figures out how to do it. I suppose these recent events could be used as an argument against the idea of doing essentially fly by wire but then putting in a whole lot of extra stuff to make it seem that you are not doing fly by wire.

No, on Airbus the joystick still only moves the elevator, which has less control authority than the stabilizer, which is what trim controls.

It normally moves both as required. A good explanation here:

* https://aviation.stackexchange.com/questions/15268/how-does-...

Even if things degrade all the way down to "direct law" the pilot does not feel any aerodynamic force caused by the trim position.

We are talking about two different interpretations of the word "authority". In the case of the incidents, the pilots were physically unable to overcome the simulated force for an extended time.

Thanks for the correction! Reading about this brought me to:

https://en.m.wikipedia.org/wiki/XL_Airways_Germany_Flight_88...

with some similarities to the Ethiopian crash

I doubt this is possible. If it was it would be a certification requirement because it would make any trim runaway incident trivial.

MCAS issues nose-down, speed increases and nose pitches down. Nose never pitches back up. Plane crashes.

Sure, maybe some complex combination of maneuvers could have helped them out of this but there's really everything pointing the blame at this one system. Pilots did what the boeing manual suggested (even included at the end of this report).

MCAS forced the trim to a point where (because of aerodynamics) it was impossible to manually change the trim even after disabling MCAS, and was designed in such a way that it was impossible to engage the electrical trim controls (which could have saved the plane in this case) without also reenabling MCAS.

Flaps out supposedly would have kept MCAS off but the pilots weren't expected to know that.

Maybe, when they started thinking about a plan B, they were anyway already much too fast to use flaps?

I guess that there is a max speed for flaps (maybe the computer even actively refuses to extend them if the airspeed is higher than X to avoid that wings are destroyed).

Post Lion Air, they should have known that.

Why exactly? if Boeing did not updated the manuals and checklists how would pilots know that? from internet forums? Should a pilots ignore the checklists and try steps he read on the internet ?

I could not find if Boeing updated their manuals/checklists after the first crash.

Yes, Boeing issued this service bulletin after Lion Air:

http://www.avioesemusicas.com/wp-content/uploads/2018/10/TBC...

And the FAA made it an emergency airworthiness directive in response.

The steps on it were broadly followed by the Ethiopian flight.

Am I missing it because I don't see flaps mentioned anywhere in that link.

You're not missing it. The pilots followed the instructions, and the instructions do not mention flaps.

This bulletin notes that electric stabilizer can be used to neutralize the control column prior to STAB CUTOUT, which it appears the Ethiopian crew did not do.

They did so repeatedly.

The bulletin completely fails to note that if you don't time the STAB CUTOUT immediately after you use manual electronic control but instead the MCAS acts again before you cutout, you're left trying to manually trim the stabilizers in a situation where the elevators are putting so much force on the jackscrew that manual stabilizer trim may be impossible.

That's what got this flight.

Appears? Where are you reading this to come to that conclusion?

Page 11 of the preliminary report, 05:40:35 "stab trim cut-out".

Page 26, five manual trim up inputs before that time. Manual trim is electric trim instigated with yoke toggle switch.

What is not certain (to me) is if continuous nose up toggle for sure would have inhibited the automatic nose down from MCAS shown at 05:40:45. It really looks like pitch trim still needed to come up more in order to relieve the control column force to bring it back to neutral.

Why didn't they continue to manually trim (electric) after 05:40:35 to relieve yoke back pressure and also to improve climb rate and also reduce speed? I suspect they actually got ahead of themselves, setting trim stab cutoff too soon, not realizing how much more insideous the MCAS upset case is compared to runaway stabilizer trim.

And that is the problem with no training. They had no way to iterate various scenarios of working and failed MCAS behaviors.

It seems the "yo-yo manoeuvre" required to manually trim when severely mistrimmed with deflected elevator stopped being taught or mentioned in Boeing manuals decades ago.

Pilots should have known that MCAS is inactive with flaps extended, per information from Boeing.

Nope.

The Boeing/FAA directive re: MCAS does not instruct them to extend flaps.

Further, there's other things going on in the cockpit due to the malfunctioning AoA sensor that's the root of all this.

Specifically one of the effects is that they get an Unreliable Airspeed Indication, and run that checklist. That checklists memory items include maintaining the current flap configuration (in this case, flaps up).

The Boeing/FAA directive does not instruct them to deviate from this and extend flaps. They have a checklist memory item instructing them to in fact do the exact opposite, and not touch flaps.

You're correct that the AD and runaway trim procedure does not instruct them to extend flaps. What I was addressing was the statement upthread that "Flaps out supposedly would have kept MCAS off but the pilots weren't expected to know that."

If I'm a 737 MAX pilot, after the Lion Air crash I'm learning absolutely everything I can about MCAS. And from information Boeing provided I would learn that it operates with autopilot off, flaps up, at high indicated AoA.

You mention unreliable airspeed, that was actually their first problem. Flaps were extended at that point, as according to the narrative they were not retracted until after the AoA disagree, stick shaker, and airspeed disagree. In fact it almost reads like they were intending to continue the flight, engage autopilot, and climb to 32,000 ft with the stick shaker going the whole time. That seems very odd to me.

>If I'm a 737 MAX pilot, after the Lion Air crash I'm learning absolutely everything I can about MCAS. And from information Boeing provided I would learn that it operates with autopilot off, flaps up, at high indicated AoA.

And in a crisis situation you skip the checklists and think fast and apply your instincts because you read something on a forum? Sure if you have a lot of time you can try thinking but this is not debugging a bug where you have hours to observe the issue, try different inputs, observe again, Google some questions etc..

We don't want pilots to be creative. Air safety is so good because pilots learn memory items and checklists and actually follow them instead of making stuff up.

If the checklist doesn't mention flaps and the plane crashes if you keep the flaps up, that's on Boeing.

They were already too fast for that.

Sadly, it looks like those millions of man hours of incremental safety refinement also created a false sense of security. That (and management overriding engineering concerns) are the only explanations I have for how MCAS was implemented: because it had to be able to correct the pitch-up tendency of the 737 MAX and stay "invisible", so additional training could be avoided, Boeing apparently chose to use only one AOA sensor as "single source of truth" - because using both would have increased the chance of the system having to deactivate itself, which would probably have made the FAA mandate the additional training that Boeing wanted to avoid. This is just my personal theory however...

> Why is everyone so wedded to the narrative that this is the fault of MCAS and nothing else?

Because the other factors don't single this flight out, and the plane wouldn't have crashed without MCAS misbehaving, or more fundamentally, without the flawed plane design that required such a system in the first place.

> Aerodynamic loading prevented manual trimming using the trim wheels.

Are the trim wheels mechanically connected to the trim mechanism in the back? Is there no way to trim the horizontal stabilizer electrically without also enabling MCAS? What would happen if the pilots continually pressed the trim up switch on the yoke? That should've prevented MCAS from activating, right?

I thought Boeing airplanes were built such that "the pilot is always in control". That doesn't seem to be the case anymore, if by cutting the power to certain subsystems you can't control the airplane anymore.

Yes they are manually connected but not mechanically assisted in any large (maybe any) part and the nose down trim and full back on the yoke made the manual wheel impossible to use. Thumbing the switch will work to disengage the mcas temporarily yes.

I think the only way to survive this is to use the electrical trim assist to get to level flight and then shut off the system. After it’s level you can go ahead and trim using the manual wheel. Well the other way to survive this is to not have Boeing design the mcas to read from one sensor only and also have mcas operate in a narrow authority.

Yes, pilots selecting "up" on the trim switch should stop and override MCAS. But it also "resets" MCAS so that it will pitch down again on its next cycle. So you'd have to be constantly correcting it, or switch the electric trim off entirely (i.e. treat it as runaway trim).

Or toggle the trim control switch when MCAS starts up again.

this video[0] from "mentour pilot" on youtube explains the stabilizer system quite well.

it seems the trim wheels are connected manually to the trim mechanism in the back, but when the trim stabilizers are in an extreme position the wind loading on them makes it very hard/impossible to rotate the trim wheels manually.

from what i understand, one way to relieve/lessen the wind loading so that the manual wheels can be used again is to (in the case of trim down) dive the plane. this would lessen the wind loading on the stabilizer and allow the manual wheels to move again. but you would need "room" to dive, something they did not have in this case.

[0]https://www.youtube.com/watch?v=xixM_cwSLcQ

Its possible and I think it was demonstrated in one of Mentour Pilot's videos that both pilots can work together to manually trim. Boeing put notes in the manual that this may be needed and it would not break the manual trim system to apply that much force to the trim wheels.

the fact that the combined strength of two humans would not be enough to _break_ the manual trim system does not tell us whether that combined strength would be enough to _turn_ the trim wheels at all.

https://news.ycombinator.com/item?id=19575318 "option 2)" (on this same page) refers to a situation where a "dive" could be executed in a situation where manual strength is not enough to trim the aircraft.

Recall that at the same time it's taking the strength of both pilots on the yoke to keep the plane approximately level. You're saying they should both let go at low altitude and see if they can crank a trim wheel together?

> Is there no way to trim the horizontal stabilizer electrically without also enabling MCAS?

Correct. One wonders if this is a consequence of trying to maintain the type rating and therefore not being able to introduce any pilot training about the MCAS feature, and therefore not being able to introduce any control features for it.

Good question. This is what makes these accidents so bad in my eyes: they weren't caused by a defect or flaw in the traditional sense, but rather by a system that seems to have been conceived solely to allow Boeing to skirt retraining/recertification requirements, to sell more planes.

Such a system should have been subject to extreme scrutiny, and honestly it beggars belief that the potential for these accidents wasn't seen. "This system can trim the nose down beyond the authority of the manual controls, based on readings from a single non-redundant sensor" should have been more than enough to get the gears turning, and it seems that the deeper one looks it only gets worse.

I thought all jets had to be capable of performing non powered glides (as in no electrical power, not just engine power).

I guess that's no longer a requirement.

Being capable of performing a glide without electricity does not necessarily imply that a no-power glide can safely be entered from extreme conditions like diving too fast with trim set to insane.

But being able to actually utilize all your control surfaces without electrical power must be a basic requirement.

They could make the trim control wheel mechanically assisted, for example (since there are cases where electronic trim control is required because because of the amount of force needed to turn the wheel)

> They could make the trim control wheel mechanically assisted

I'd imagine it already IS mechanically assisted. There is a limit to how much you can amplify a pilot's input mechanically, and I'd imagine the load on the aircraft exceeded the amount of amplification needed.

I.e. your car has power steering, so the car manually adds power to the turn based on the user's input. That doesn't mean that something in the road can't override the input of both the driver and power steering and jerk the wheel.

Why is it possible to set the trim to insane? Is there a legitimate scenario where that would be used?

Well, the plane might be at an insane angle, so then you need an insane trim setting to correct it :)

If the AoA was truly way too high then insane trim would be required to correct that. MCAS and similar systems came about in response to AF 447 where the pilots entered a high AoA situation and stalled the plane into the Atlantic.

Is it necessarily true that you have to use the stabilizer for MCAS? Would implementing a stick pusher instead fail to avoid some stalls?

It's true in the case of the 737 MAX where the pitch-up moment caused by the engines exceeds the elevator authority in a low-speed, high-thrust situation if the pitch trim is also set too high.

MCAS will evidently work with less maximum nose-down trim than the current version has, as the proposed update places a limit on it.

Sure, but that's assuming the plane was trimmed somewhat correctly to start with. The only reason the pilots had problems manually moving the trim was because the electric motor moved it far out of the correct trim range.

Also, it's not zero power. A ram air turbine deploys and provides hydraulic pressure to move the controls. And there are batteries to keep a small number of essential flight instruments powered.

The planes when setup correctly have a pretty good glide slope actually. When there is no power the pilots can deploy the apu to restore basic power for flight controls.

I assume you mean the Ram Air Turbine (https://en.wikipedia.org/wiki/Ram_air_turbine)?

ah yeah. got my initialisms mixed up. the apu is not an emergency source of power.

The 737 has a better glide ratio than a Cessna 172 when both set up correctly.

Layman question -- Does the MCAS system take current height from terrain into account when forcing the nose down?

Nope. (And arguably it shouldn't: a stall at low altitude is much worse than a stall at high altitude, because you lack recovery time. Most fatal stalls begin below 1000ft AGL, which is where this plane was. So your stall avoidance system shouldn't shutdown just because you're at low altitude: that's when you want to avoid stalls.)

MCAS doesn't work in most low altitude conditions as it is switched off when flaps are extended (the case both for departure and landing).

Would there be different change in altitude characteristics in a nose up vs nose down situation?

It would appear that it does not.

Had they paid closer attention to their airspeed. The aircraft could have been saved. By reactivating the system at such high speed, adding further nose down trim, there was no way to keep the aircraft level. Tunnel vision.

Reply on news.ycombinator.com