PixelFlight wrote:

trpmb6 wrote:

I worry that in the future we may have the opposite of what happened in this accident. A pilot (let's assume flying at night, with cloud cover), finds themselves thinking their IAS and AOA sensors are whack and hits the cutoff switch for the auto trim, when in actuality the IAS and AOA were correct, and they are now approaching a stall instead of what they perceive to be the plane trying to nose itself into the ground.

While there didn't cutoff the sensors, this is basically what happened to AF447: there didn't trust the IAS indication anymore. This is why pilots have since more training to aviate with unreliable air speed.
From my point of view, actual redundancy practice in aircraft is obsolete and must be replaced by predictors that take in account all available information on the aircraft.

airtechy wrote:

I must say that this trim system with a lot of switches and a few relays plus what ever is in the motor itself would not seem to be out of place on a DC-7 or Connie. I guess if it works don't change it.

LDRA wrote:

BaconButty wrote:

Just read Boeings response.
https://boeing.mediaroom.com/news-relea ... tem=130336
Anyone else shocked by this? The way I see it, there's 4 elements to this crash:
1. Maintenance prior to the flight - why did the AOA sensor repeatedly fail?
2. The response of the pilots - did they perform the runaway stabilizer procedure and if not why? (Probably answered by Zeke in the previous page)
3. How was MCAS certified (without cutting out when encountering unreliable inputs)? Loss of airspeed/AOA information can be fatal if badly handled anyway, throwing a runaway horizontal stab into the picture seems crazy.
4. Why weren't MCAS changes communicated to pilots? Rectified by the AD earlier in the month.

Boeing is basically throwing everything at #1 and #2 whereas it's #3 that worries me. Deflection is not the kind of attitude to safety I want to see from an aircraft manufacturer. There have been concerns about the Boeing tail wagging the FAA dog for some time now, for example the Lithium Ion batteries in the 787 - in which the FAA were called out by the NTSB. They got away without causing fatilities there by sheer luck - not this time. I imagine we'll see US pressure on the Indonesians to keep quiet on that.

I am quite appalled


I guess the lawyers decided to grasp onto "Runaway stab trim procedure" line of defense

Did Boeing ever define criteria for what constitutes a "runaway stab trim" in their flight manual?

JoeCanuck wrote:

If you had a phone or a pad with a bubble level app on it, if you were careful, you could fly with that information and throttle position.

zeke wrote:

mjoelnir wrote:

That is exactly no answer to my question. The question is not what, but how. How does the switch disconnect the trim motor.

Does the positive power flow through the switch and throwing the switch isolates the motor electrical. Or does the cutout switch works on a contactor that cuts the power to the motor or does the cutout switch tells a computer or circuit to cut off the power.

Fadecfault has kindly posted this before which answers your question, refer to the bottom LH side which tells you exactly what happens when the cutout is used.

airtechy wrote:

If the report is correct that the pilots of the prior flight used the kill switches, then that is obviously what they did .. replaced a motor driving the trim wheel with a hand turning it for the duration of the flight. Not as sophisticated but works the same except you have to "hand fly" the airplane.

hivue wrote:

airtechy wrote:

If the report is correct that the pilots of the prior flight used the kill switches, then that is obviously what they did .. replaced a motor driving the trim wheel with a hand turning it for the duration of the flight. Not as sophisticated but works the same except you have to "hand fly" the airplane.

So do I understand correctly that the crew on the previous flight flew it with AP off, AT off, and trimming the airplane by hand-turning the trim wheel?

JoeCanuck wrote:

I'm not excusing Boeing for anything but so far, nobody here knows what kind of testing Boeing did for the MCAS system. Presumably, it was flight tested. Unfortunately, it is impossible to test for every single potential failure mode.

litz wrote:

Something I noticed ... apparently with flaps out, the trim didn't runaway, it was only after retraction to flaps 0.

Could this whole thing could possibly been avoided by leaving the flaps out and returning to base with a flight control problem?

I think it’s safe to say; it wasn’t a clear-cut “execute the Trim Runaway” checklist situation for the crew. All 737 MAX crews now know this is the thing to do in the above situation. But these crews didn’t have this information. Secondly, MCAS operating off a single AoA signal will not be for long.

LDRA wrote:

airtechy wrote:

Every modern aircraft of any size since the at least the 40's ...jets and private .. have had some form of motor driven trim probably at first to give the autopilot a method to control the pitch trim and maintain a constant altitude. And several instances and accidents mentioned in this thread have been caused by this "electic/motor trim" .. "running away" due to one fault or another. It was common enough and disastrous enough that designs were incorporated to stop it if it occurred.

All of this is a way of getting around to the point that I would be very surprised if you asked a group of pilots and they didn't know what "runaway trim" was. It's been known to happen for years.This flight had all the symptoms of trim failure and the fix was documented .. use the kill switches. One group of pilots did .. unfortunately another did not.

Understood and agree in general

However in case of 737, there is speed trim system(STS).

From what I gathered, in normal operation, STS would trim against the normal direction the pilot would have wanted to trim. And the system operates non-continuous similar to MCAS. It blurres line between perception of a actual trim system failure and normal operation

JoeCanuck wrote:

I don't know if the question from way upthread was every answered; is it possible for pilots to manually control the aircraft against full down trim?

LDRA wrote:

Understood and agree in general

However in case of 737, there is speed trim system(STS).

From what I gathered, in normal operation, STS would trim against the normal direction the pilot would have wanted to trim. And the system operates non-continuous similar to MCAS. It blurres line between perception of a actual trim system failure and normal operation

dragon6172 wrote:

LDRA wrote:

Understood and agree in general

However in case of 737, there is speed trim system(STS).

From what I gathered, in normal operation, STS would trim against the normal direction the pilot would have wanted to trim. And the system operates non-continuous similar to MCAS. It blurres line between perception of a actual trim system failure and normal operation

Even if they thought the intermittent trimming was normal STS inputs, they countered it with their own inputs 20+ times for 6-7 minutes, and then just stopped and let the computer trim the aircraft to an un-recoverable nose down attitude.

I think they will find that there was a change in which pilot was flying, and the pilot who took over the controls near the end did not have an instrument scan that was sufficient enough to keep up with the counter-trimming that was required.

airtechy wrote:

litz wrote:

Something I noticed ... apparently with flaps out, the trim didn't runaway, it was only after retraction to flaps 0.

Could this whole thing could possibly been avoided by leaving the flaps out and returning to base with a flight control problem?

It would appear so, but the captain's displays would seem to still be affected and his stick shaker would have been annoying.

edit to add: What you would be essentially doing is using the flaps as a substitute for not using the cutout switches.

scbriml wrote:

From a Leeham update:

https://leehamnews.com/2018/11/28/indon ... more-28725

I think it’s safe to say; it wasn’t a clear-cut “execute the Trim Runaway” checklist situation for the crew. All 737 MAX crews now know this is the thing to do in the above situation. But these crews didn’t have this information. Secondly, MCAS operating off a single AoA signal will not be for long.

mjoelnir wrote:

zeke wrote:

110-240V is still considered low voltage.

What is important and good to see in the design is there is not just one mechanism, there is multiple paths where the motor is isolated, both on the control side and the power side.

The cut off is only on the control side. Something called power cut off in my industry, would cut off power, not control only.

JoeCanuck wrote:

In my experience with relays, I can't recall a failure where a normally open power circuit would stay closed when coil power is removed. I've had more fail than I can count remain open, and not close the power circuit on command.

I'm not saying it's not possible...just that I haven't seen it and it seems like an unlikely failure scenario.

remcor wrote:

The AOA between the left and right were 20 degrees off even during taxi. Seems like a pretty simple system self-test would have been to check the agreement of the two angle-of-attack indicators whenever the wheels are on the ground.

https://leehamnews.com/2018/11/28/indon ... sh-report/

BaconButty wrote:

Just read Boeings response.
https://boeing.mediaroom.com/news-relea ... tem=130336
Anyone else shocked by this? The way I see it, there's 4 elements to this crash:
1. Maintenance prior to the flight - why did the AOA sensor repeatedly fail?
2. The response of the pilots - did they perform the runaway stabilizer procedure and if not why? (Probably answered by Zeke in the previous page)
3. How was MCAS certified (without cutting out when encountering unreliable inputs)? Loss of airspeed/AOA information can be fatal if badly handled anyway, throwing a runaway horizontal stab into the picture seems crazy.
4. Why weren't MCAS changes communicated to pilots? Rectified by the AD earlier in the month.

Boeing is basically throwing everything at #1 and #2 whereas it's #3 that worries me. Deflection is not the kind of attitude to safety I want to see from an aircraft manufacturer. There have been concerns about the Boeing tail wagging the FAA dog for some time now, for example the Lithium Ion batteries in the 787 - in which the FAA were called out by the NTSB. They got away without causing fatilities there by sheer luck - not this time. I imagine we'll see US pressure on the Indonesians to keep quiet on that.

zeke wrote:

BaconButty wrote:

Just read Boeings response.
https://boeing.mediaroom.com/news-relea ... tem=130336
Anyone else shocked by this? The way I see it, there's 4 elements to this crash:
1. Maintenance prior to the flight - why did the AOA sensor repeatedly fail?
2. The response of the pilots - did they perform the runaway stabilizer procedure and if not why? (Probably answered by Zeke in the previous page)
3. How was MCAS certified (without cutting out when encountering unreliable inputs)? Loss of airspeed/AOA information can be fatal if badly handled anyway, throwing a runaway horizontal stab into the picture seems crazy.
4. Why weren't MCAS changes communicated to pilots? Rectified by the AD earlier in the month.

Boeing is basically throwing everything at #1 and #2 whereas it's #3 that worries me. Deflection is not the kind of attitude to safety I want to see from an aircraft manufacturer. There have been concerns about the Boeing tail wagging the FAA dog for some time now, for example the Lithium Ion batteries in the 787 - in which the FAA were called out by the NTSB. They got away without causing fatilities there by sheer luck - not this time. I imagine we'll see US pressure on the Indonesians to keep quiet on that.

I am disgusted by Boeing’s response as it is clearly factually incorrect.

Their repose says

“The following day, Oct. 29, shortly after taking off, the pilots experienced issues with altitude and airspeed data that the pilots had previously experienced on the earlier flights, due to erroneous AOA data. Data from the flight data recorder summarized in the report also makes clear that, as on the previous flight, the airplane experienced automatic nose down trim. In response, the flight crew repeatedly commanded nose up trim”

We know from the FDR data that airspeed and altitude were correct. MCAS was going off due to bad AOA data.

The Boeing response also said the crew flying from DPS to CGK applied the procedure contained in the emergency AD. That emergency AD only cane out 3 days after the crash. They could not have applied that procedure as it did not exist as the time for that condition.

Very poor form, clearly trying to distance themselves from what happened.

Folks, Boeing would have the data from the previous flights sent to them by the aircraft. They knew what was going on.

rheinwaldner wrote:

JoeCanuck wrote:

In my experience with relays, I can't recall a failure where a normally open power circuit would stay closed when coil power is removed. I've had more fail than I can count remain open, and not close the power circuit on command.

I'm not saying it's not possible...just that I haven't seen it and it seems like an unlikely failure scenario.

Google "relay sticking"...

litz wrote:

What does the hive mind think ... should it automatically disable if there is a discrepancy between the two AoA sensors, or should it be selectable which sensor it uses? or both?

scbriml wrote:

From a Leeham update:

https://leehamnews.com/2018/11/28/indon ... more-28725

I think it’s safe to say; it wasn’t a clear-cut “execute the Trim Runaway” checklist situation for the crew. All 737 MAX crews now know this is the thing to do in the above situation. But these crews didn’t have this information. Secondly, MCAS operating off a single AoA signal will not be for long.

The 737 has two independent mechanical elevator flight controls; the left side which has its own cables to control a hydraulic PCU actuator which controls the left elevator (Red trace CCFORCE_PITCHCWSLOCAL_FDR in Figure 5) and an identical system on the right (Green trace CCFORCE_PITCHCWSREMOTE_FDR in Figure 5). The systems are joined in the cockpit via a torque tube with a breakout mechanism to get one elevator free, through a very high stick force, in case of an elevator control jam on one side.

At Figure 5 (A) the traces are no longer following each other. The First Officer has taken over and his Yoke exerts a higher force to counter MCAS trimming. The Left pitch force remains the same as before. The two sides of the mechanical flight control system are now independent. It seems a Yoke breakout has occurred.

stratclub wrote:

I could not find any reference for "relay sticking" in regards to mission critical aircraft systems, mostly hobbyist type design stuff like building non critical automation and control circuits.

Anything used on an aircraft is well past the design phase and is thoroughly tested for reliability and failure modes at an individual component and systems level prior to being used on an aircraft then the aircraft design has to proven to the FAA by Flight Test validation prior to being put into service.

ikolkyo wrote:

I think what Boeing is trying to say is that, they applied the correct procedure to counteract bad AOA. I’m pretty sure the Emergency AD was nothing more than a repeat of what they put in their manuals. Which is literally what the say in their statement.

zeke wrote:

We know from the FDR data that airspeed and altitude were correct. MCAS was going off due to bad AOA data.

zeke wrote:

When MCAS, STS, or Mach trim is being added by the autopilot while being manually flown have a flag/FMA on the PFD.

Finn350 wrote:

Thanks! It seems that Leeham has identified a possible reason for the final dive: Yoke breakout mechanism

dragon6172 wrote:

How do you come to this conclusion?

dragon6172 wrote:

There is already trim wheels spinning and increased control forces to maintain level flight when MCAS is making trim inputs. What does a flag do for you?

zeke wrote:

There was no correct procedure as the emergency AD states that Boeing were only aware after they saw the data that an unsafe condition exists when a bad AOA can cause MCAS to trim nose down at much lower speeds than designed.

This was not in the manuals.

We had a pilot earlier on this thread who stated that MCAS was not even mentioned in their MAX differences training.

They regarded MCAS as such a trivial change just to mention it in briefing or a PowerPoint slide is considered good enough to expose the pilot to it. No pilot had been trained or made away that MCAS could trim so far nose down it can kill you.

So no, Boeing are not repeating what they have said before.

In the event of an uncommanded horizontal stabilizer trim movement, combined with any of the following potential effects or indications resulting from an erroneous Angle of Attack (AOA) input, the flight crew must comply with the Runaway Stabilizer procedure in the Operating Procedures chapter of this manual

zeke wrote:

Finn350 wrote:

Thanks! It seems that Leeham has identified a possible reason for the final dive: Yoke breakout mechanism

I don’t agree with that, I had mentioned in a fairly recent tech ops discussion on another topic of a couple of incidents one in a 757 the other in a 747 where flight control cables became jammed they crews tried to force the breakout and were unable to do so.

It also does not fit the data, if the local refers to the captain and remote to the FO, with more elevator being applied on the left than right it should induce roll to the right when the rolled to the left.

This means only right elevator is controlled by the First Officer. Despite an increased force by him, the AoA is going down, meaning the right elevator cannot hold the nose up. Then the First Officer force is quickly lowered (can be a stick forward stall recovery action as the nose dips like in a stall) and the Captain’s force shoots up as the aircraft plunges.

zeke wrote:

Finn350 wrote:

Thanks! It seems that Leeham has identified a possible reason for the final dive: Yoke breakout mechanism

I don’t agree with that, I had mentioned in a fairly recent tech ops discussion on another topic of a couple of incidents one in a 757 the other in a 747 where flight control cables became jammed they crews tried to force the breakout and were unable to do so.

It also does not fit the data, if the local refers to the captain and remote to the FO, with more elevator being applied on the left than right it should induce roll to the right when the rolled to the left.

zeke wrote:

Would the crash had happened if the crew on the previous sector had known it was MCAS making the inputs and they made that entry instead of STS ?

zeke wrote:

ikolkyo wrote:

I think what Boeing is trying to say is that, they applied the correct procedure to counteract bad AOA. I’m pretty sure the Emergency AD was nothing more than a repeat of what they put in their manuals. Which is literally what the say in their statement.

There was no correct procedure as the emergency AD states that Boeing were only aware after they saw the data that an unsafe condition exists when a bad AOA can cause MCAS to trim nose down at much lower speeds than designed.

This was not in the manuals.

We had a pilot earlier on this thread who stated that MCAS was not even mentioned in their MAX differences training.

They regarded MCAS as such a trivial change just to mention it in briefing or a PowerPoint slide is considered good enough to expose the pilot to it. No pilot had been trained or made away that MCAS could trim so far nose down it can kill you.

So no, Boeing are not repeating what they have said before.

The report states that the flight crew of the Oct. 28 flight turned off the stabilizer trim switches within minutes of experiencing the automatic nose down trim, and continued with manual trim through the end of the flight. The report further notes that the pilot performed three non-normal checklist procedures, including the runaway stabilizer non-normal checklist, which is a memory item prescribed by the 737 MAX Flight Crew Operations Manual, and reaffirmed in Boeing Flight Crew Operations Manual Bulletin TBC-19 and FAA Emergency Airworthiness Directive (AD) Number 2018-23-51, as the appropriate procedure to address unintended horizontal stabilizer movement, regardless of source.

PixelFlight wrote:

JoeCanuck wrote:

I'm not excusing Boeing for anything but so far, nobody here knows what kind of testing Boeing did for the MCAS system. Presumably, it was flight tested. Unfortunately, it is impossible to test for every single potential failure mode.

I don't see how the final report could avoid covering in deep (as in the QF32 report) the safety assessment activity of the MCAS. Otherwise it would be a scandal as the failure mode officially published in the EAD is within the domain of the simplest mode of failure possible. Not covering this would affect a lot of credibility. But before the final report will be out, I feel that the actual silence about this critical point is already feeding a growing trouble.