User avatar
PW100
Posts: 3146
Joined: Mon Jan 28, 2002 9:17 pm

Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

Wed Nov 28, 2018 10:41 pm

Looking at the FDR graphs, it seems that right at the point the fatal dive started, BOTH engines went to max power (TOGA?) in terms of power lever angle, fuel flow, and EGT. Why would this be? Would this be for the same reason the last couple of MCAS nose down trims were not followed up by manual nose-up trim?

Could this be suggesting that the pilots' mental mindset was that they were on the verge of a stall?
Immigration officer: "What's the purpose of your visit to the USA?" Spotter: "Shooting airliners with my Canon!"
 
User avatar
zeke
Posts: 12887
Joined: Thu Dec 14, 2006 1:42 pm

Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

Wed Nov 28, 2018 10:54 pm

dragon6172 wrote:

All the AD says is that if you have uncommanded stabilizer combined with this list of indications.... you must do the runaway stabilizer procedure (which was already in the manual).

Now.... that means you have to recognize the stabilizer is making uncommanded movements.... and if you recognize that why wouldn't you have already complied with the procedure, regardless of other indications?


I find your comments quite insulting as I clearly do understand the system, and by the terms you are using you do not.

In manual flight STS,MCAS, and Mach trim are all commanded control inputs, they are BY DESIGN addded by the autopilot even on a serviceable aircraft when the pilot is manually flying. These are automatic inputs by the autopilot when the autopilot is selected off.

The STS/MCAS inputs were not “uncommaned” they were commanded by the FCC in response to the bad AOA and good ADR data. This however is also the NORMAL behaviour even with good AOA and ADR data.

The runaway trim procedure is for when the trim starts moving and cannot be stopped in an uncommanded manor, ie a switch or contact remains closed. This came about as a result of Sabina accident I previously mentioned that resulted in the change of the control column trim switch design.

As we see in the FDR data the MCAS trim stopped for 5 seconds each time a control column trim input was made, and they could even reverse the direction. Previously I posed the trim values after MCAS input and after Pilot input. The post MCAS average was around 4 units, the post pilot trim around 5 units.

The emergency AD is to alert pilots that the MCAS can command nose down trim as designed as a result of receiving bad AOA data.

The way to remove the FCC commanded nose down trim is to move the stab PRI and B/U switches to cutoff.

In summary - previously runaway trim waa just fir uncommaded and uncontrollable trim, now runaway trim covers what it previously did and also commanded MCAS nose down trim associated with other symptoms.
Human rights lawyers are "ambulance chasers of the very worst kind.'" - Sky News
 
User avatar
glideslope
Posts: 1517
Joined: Sun May 30, 2004 8:06 pm

Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

Wed Nov 28, 2018 10:54 pm

hivue wrote:
airtechy wrote:
If the report is correct that the pilots of the prior flight used the kill switches, then that is obviously what they did .. replaced a motor driving the trim wheel with a hand turning it for the duration of the flight. Not as sophisticated but works the same except you have to "hand fly" the airplane.


So do I understand correctly that the crew on the previous flight flew it with AP off, AT off, and trimming the airplane by hand-turning the trim wheel?


My understanding is this would be correct. I am under the impression they were in the shaker for the majority of the flight as well, but this is from what I have read, no first hand knowledge. Tragic chain of events leading to loss of life once again. JT610 should have never flown that morning, IMO.
To know your Enemy, you must become your Enemy.” Sun Tzu
 
User avatar
zeke
Posts: 12887
Joined: Thu Dec 14, 2006 1:42 pm

Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

Wed Nov 28, 2018 10:58 pm

Finn350 wrote:
Convention used by Leeham:
- left side = left elevator = red = local = captain
- right side = right elevator = green = remote/foreign = FO


I understand that however I still do not know if that is correct.

Where there is a large mismatch the aircraft enters into a tight accelerated turn with speed going up around 400 kts.

The elevator feel should increase the pressure based upon the increase in dumynsmic pressure which is what I am suggesting this is.
Human rights lawyers are "ambulance chasers of the very worst kind.'" - Sky News
 
User avatar
trpmb6
Posts: 1582
Joined: Thu Apr 19, 2018 5:45 pm

Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

Wed Nov 28, 2018 11:03 pm

zeke wrote:

In summary - previously runaway trim waa just fir uncommaded and uncontrollable trim, now runaway trim covers what it previously did and also commanded MCAS nose down trim associated with other symptoms.


This doesn't necessarily mean that Boeing's press release is a lie.

As far as I'm concerned, the global problem is the same and the resulting solution is the same. The only difference is what is causing the problem. Whether it be unreliable air speed or a bad AOA sensor. The manuals and training do not cover MCAS - that does need to be rectified. But that doesn't change the procedures that should have been followed, as indicated by the AD which states to follow existing runaway trim checklist procedures.

The biggest problem is this, as you pointed out earlier Zeke, doesn't allow the pilot(s) to correctly identify to engineering and maintenance what the problem was - and therefore makes it difficult (or impossible) to rectify the problem. Had they been able to identify the problem after the flight the previous day they may have been able to save these lives.

That being said, if I'm not mistaken they DID do maintenance on the AOA sensors correct? So they should have caught the problem there and didn't.
 
Aviation737
Posts: 1
Joined: Sun Nov 25, 2018 1:53 am

Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

Wed Nov 28, 2018 11:20 pm

Here is a video explaining about the crash of the 737MAX. For those who don't know he is a 737NG pilot

https://www.youtube.com/watch?v=1sZfeFJ9n0I&t
 
stratclub
Posts: 553
Joined: Fri Jan 05, 2018 10:38 pm

Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

Thu Nov 29, 2018 12:00 am

PixelFlight wrote:
stratclub wrote:
I could not find any reference for "relay sticking" in regards to mission critical aircraft systems, mostly hobbyist type design stuff like building non critical automation and control circuits.

Anything used on an aircraft is well past the design phase and is thoroughly tested for reliability and failure modes at an individual component and systems level prior to being used on an aircraft then the aircraft design has to proven to the FAA by Flight Test validation prior to being put into service.

Spanair Flight 5022 (JK5022) McDonnell Douglas MD-80
"When the R2-5 relay was recovered from the wreckage it was subjected to detailed examination. Two stuck contacts within the relay were identified"

1 chance of how many billions of aircraft relays manufactured? The cause of the accident was determined to be that the crew took off with the flaps fully retracted and if they had followed correct and mandatory cockpit checklist procedure, they would have never taken off with the flaps not properly configured.

Automation should never be a solution for sloppy CRM. TOWS did not work, so what? Mandated proper CRM would have caught that before peoples lives were lost. During T/O, why is it that the PF and the PO cross check IAS at 100 Knots every single time? I I really doubt that is because they are bored.
 
ryanov
Posts: 93
Joined: Sat Nov 03, 2012 4:38 am

Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

Thu Nov 29, 2018 12:33 am

From the preliminary report (which frankly I think more people in this topic should be reading rather than contradicting the report or guessing at things that are clearly explained), this would appear to be the section (page 20) that saved the previous crew:

After three automatic AND trim occurrences, the SIC commented that the control column was too heavy to hold back. At 14:25:46 UTC, the PIC declared “PAN PAN” to the Denpasar Approach controller due to instrument failure and requested to maintain runway heading. The Denpasar Approach controller acknowledged the message and approved the pilot request. A few second later, the Denpasar Approach controller asked the LNI043 whether he wanted to return to Denpasar and the pilot responded “standby”.

At 14:28:28 UTC, the PIC moved the STAB TRIM switches to CUT OUT. The PIC re-engaged the STAB TRIM switches to NORMAL, but almost immediately the problem re-appeared. The PIC then moved the STAB TRIM switches back to CUT OUT and continued with manual trim without auto-pilot until the end of the flight.


This would seem to be fairly intuitive to me, and isn't really preceded by anything related (eg. there's no indication that he was following a checklist that demanded this action), but I got a decent night's sleep last night and am not moving at hundreds of knots, and know everything that led up to this moment. I'm curious to know though: is there a reason that this would not occur to a pilot -- specifically "clearly something is trimming AND, let's disable any sort of automatic trim." Would it be a case of "I know what is capable of doing that, and all of it is disabled right now" and ruling it out that way? Given the control inputs, it seems pretty clear that the crew knew that nose down was incorrect.
 
sealevel
Posts: 3
Joined: Wed May 23, 2018 9:57 pm

Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

Thu Nov 29, 2018 1:19 am

Just a question - where are the fdr and cvr located in the max? Both in the same section or are they in separate sections?
 
dragon6172
Posts: 951
Joined: Sat Jul 14, 2007 9:56 am

Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

Thu Nov 29, 2018 1:33 am

zeke wrote:

I find your comments quite insulting as I clearly do understand the system, and by the terms you are using you do not.

In manual flight STS,MCAS, and Mach trim are all commanded control inputs, they are BY DESIGN addded by the autopilot even on a serviceable aircraft when the pilot is manually flying. These are automatic inputs by the autopilot when the autopilot is selected off.

The STS/MCAS inputs were not “uncommaned” they were commanded by the FCC in response to the bad AOA and good ADR data. This however is also the NORMAL behaviour even with good AOA and ADR data.

The runaway trim procedure is for when the trim starts moving and cannot be stopped in an uncommanded manor, ie a switch or contact remains closed. This came about as a result of Sabina accident I previously mentioned that resulted in the change of the control column trim switch design.

As we see in the FDR data the MCAS trim stopped for 5 seconds each time a control column trim input was made, and they could even reverse the direction. Previously I posed the trim values after MCAS input and after Pilot input. The post MCAS average was around 4 units, the post pilot trim around 5 units.

The emergency AD is to alert pilots that the MCAS can command nose down trim as designed as a result of receiving bad AOA data.

The way to remove the FCC commanded nose down trim is to move the stab PRI and B/U switches to cutoff.

In summary - previously runaway trim waa just fir uncommaded and uncontrollable trim, now runaway trim covers what it previously did and also commanded MCAS nose down trim associated with other symptoms.


Insulted? Goodness gracious zeke, it's the internet. Just trying to have a debate / discussion here. And, I don't believe I have said anything about your knowledge of MCAS. What I did say is I thought you should re-read the AD. Instead you just regurgitated some systems knowledge. I'll go over the AD again, if your reading of it is different, please let me know how.

"Uncommanded" is not a word I chose, it is in the AD. I'll quote it again:
In the event of an uncommanded horizontal stabilizer trim movement, combined with any of the following potential effects or indications resulting from an erroneous Angle of Attack (AOA) input, the flight crew must comply with the Runaway Stabilizer procedure in the Operating Procedures chapter of this manual

That is the wording that goes into the AFM Certificate Limitations section.

In the Operating Procedures section of the AFM the following wording is used:

In the event an uncommanded nose down stabilizer trim is experienced on the 737-8/-9, in conjunction with one or more of the indications or effects listed below, do the existing AFM Runaway Stabilizer procedure above

Bold and underline added by me in both quotes.

Notice they say uncommanded trim movement "combined with" or "in conjunction with" any of the other indications or effects. To me this means a pilot has to recognize that the trim movements are undesireable (which probably would have been a better wording for the AD, I believe their use of "uncommanded" is referring to trim inputs not commanded directly by the pilot). So, as I said previously, if you recognize that the trim movements are undesirable, why would you not comply with the runaway trim procedure, which has been in the manual the whole time (notice the AD says to do the "existing" AFM Runaway Stabilizer procedure.)

The difference between the two flights were that the previous crew recognized that the stab trim inputs were undesirable and disconnected the electric trim in accordance with the procedure already in the AFM. The accident crew failed to conclude that the computer trim inputs were undesirable, and instead decided to "fight" the system for 7 minutes and 20+ cycles of computer trim down and pilot trim up. The accident crew did report a flight control problem to ATC three separate times. What problem did they think they had?

I agree that Boeing can be held to the fire for not including info on MCAS to all operators (allegedly), it very well could have aided in troubleshooting the repeated discrepancy. However, I am not convinced that the accident crew would have faired any better with knowledge of MCAS.
Phrogs Phorever
 
LDRA
Posts: 52
Joined: Fri Jan 15, 2016 3:01 am

Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

Thu Nov 29, 2018 1:36 am

in conjunction with one or more of the indications or effects listed below


Was this text and the listed effects originally in the flight manual?
 
dragon6172
Posts: 951
Joined: Sat Jul 14, 2007 9:56 am

Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

Thu Nov 29, 2018 1:48 am

LDRA wrote:
in conjunction with one or more of the indications or effects listed below


Was this text and the listed effects originally in the flight manual?

Nope
Phrogs Phorever
 
User avatar
caoimhin
Posts: 424
Joined: Thu Oct 23, 2014 12:30 am

Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

Thu Nov 29, 2018 2:44 am

Aviation737 wrote:
Here is a video explaining about the crash of the 737MAX. For those who don't know he is a 737NG pilot

https://www.youtube.com/watch?v=1sZfeFJ9n0I&t


Thanks for posting this. He gives a good discussion and fascinating Q&A at the end.

I would be interested to hear a bit more about the differences between STS and MCAS.
 
smartplane
Posts: 283
Joined: Fri Aug 03, 2018 9:23 pm

Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

Thu Nov 29, 2018 5:16 am

sgbroimp wrote:
I am developing the sense that there is one master switch needed. it would OVERIDE everything automated (except the TCAS of course!). and permit (compel if you wish) immediate return to hand flying. No diagnosing, no trying to fix the problem, just fly on and discuss after landing at nearest airfield. And if the Max won't so fly better than a brick, then shame on the manufacturer and certification folks.

But if the one master switch was introduced, would a Max 7 behave like an 8, 9 and 10? Or an NG? Or classic?

Very likely not, so then your grandfathering, common ratings, etc at risk.

Which is why this cobbled together technology is there in the first place.

So while the master switch is a good idea in principle....................
 
maint123
Posts: 67
Joined: Sun Nov 04, 2018 4:18 pm

Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

Thu Nov 29, 2018 5:30 am

A summary of what i understood -
1. The pilots faced issues right at take off when MCAS was not operational. These issues were due to AOA system giving wrong feedback to the auto systems and forced the pilots to revert to manual. Due to defective OEM supply and/or unresolved maintenance issues in a brand new plane. This i am unclear as AOA is operational st a minimum speed. What else was malfunctioning ?
2. In MANUAL mode the MCAS starts pushing the plane nose down which is countered by the pilot trimming the nose up and they stabilize at a height of only 5000 ft. Until now their training consisted of trimming issues in auto mode , for which supply cut off was recommended(correct me if i am wrong).
3. At the height of 5000 ft , feedbacks are defective and give conflicting speeds , and altitude is also unclear, as per pilots query. Why ?
4. Wrong AOA readings lead to MCAS trying to crash the plane as it thinks the plane is about to stall. This is continuously countered by the pilots by trimming electrically.
5. The pilots have no knowledge of a new MCAS system which works only in MANUAL mode and probably think its a mechanical issue with the plane , which they are stabilizing with the trim switches.
6. Biggest mystery - what happens before final dive ? Why do they stop trimming ? For that the CVR is required.
 
User avatar
Finn350
Posts: 1328
Joined: Tue Jul 09, 2013 4:57 am

Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

Thu Nov 29, 2018 5:50 am

zeke wrote:
Finn350 wrote:
Convention used by Leeham:
- left side = left elevator = red = local = captain
- right side = right elevator = green = remote/foreign = FO


I understand that however I still do not know if that is correct.

Where there is a large mismatch the aircraft enters into a tight accelerated turn with speed going up around 400 kts.

The elevator feel should increase the pressure based upon the increase in dumynsmic pressure which is what I am suggesting this is.


Does increase in the dynamic pressure explain the separation of the yoke feel forces on left and right hand side, or is the difference explained by the yoke breakout mechanism separating the sides as Leeham suggest?
 
User avatar
Jouhou
Posts: 1100
Joined: Tue May 24, 2016 4:16 am

Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

Thu Nov 29, 2018 5:54 am

litz wrote:
Something I noticed ... apparently with flaps out, the trim didn't runaway, it was only after retraction to flaps 0.

Could this whole thing could possibly been avoided by leaving the flaps out and returning to base with a flight control problem?


If the pilots weren't aware of MCAS they wouldn't know that it was an intentionally automated thing being set off by a precise set of conditions and sensor readings. I don't blame them for not figuring out that the flaps actually could cause MCAS to activate/deactivate because they didn't know what precisely they were fighting against.
PW100 wrote:
Looking at the FDR graphs, it seems that right at the point the fatal dive started, BOTH engines went to max power (TOGA?) in terms of power lever angle, fuel flow, and EGT. Why would this be? Would this be for the same reason the last couple of MCAS nose down trims were not followed up by manual nose-up trim?

Could this be suggesting that the pilots' mental mindset was that they were on the verge of a stall?


I was wondering what this was myself, but I don't think the pilots thought they were in a stall considering their final communications. Anyone have a good analysis of what this might have been?
 
2175301
Posts: 1294
Joined: Wed May 16, 2007 11:19 am

Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

Thu Nov 29, 2018 6:07 am

PixelFlight wrote:
2175301 wrote:
I concur that the final report will cover this and its an obvious item to investigate in detail. To what degree it is covered in the final report (in depth discussion vs a single summary statement - or something in between) is going to depend on how much the MCAS system is felt to be a significant contributing factor or even a root cause. It appears at this time to me to be a contributing factor based on the information I have seen. Recovery of the CVR and the other information may change that. The more I read the more questions I have about other factors.

Please elaborate how the CVR content could change in any way the validity of the official EAD statement:

"This AD was prompted by analysis performed by the manufacturer showing that if an
erroneously high single angle of attack (AOA) sensor input is received by the flight control system,
there is a potential for repeated nose-down trim commands of the horizontal stabilizer."

There is only two possibles outcomes about the validity of the EAD statement: True or False.
* If True, the described unsafe condition IS the cause of why the operating manual have to tell how to recognize and disable MCAS to avoid immediate crash, and IS the cause of the pilot load increase to learn, train, recognize and implement the procedure in less than a few dozen of seconds to save all on board life. A such mode of failure will inevitably directly impact the safety assessment activity.
* If Flase, then the "analysis performed by the manufacturer" lost credibility and will also inevitably directly impact the safety assessment activity as the AD is produced by this precise activity.
I see no way to escape the safety question of the design. If you see and other solution, please explain.


There are 2 major possibilities that you are apparently not seeing: Please keep in mind that we are likely seeing and hearing about 1% (or less) than the information that the investigation board sees at this stage.

1) The AD is correct; but, for various reasons we have not seen there is not considered to be a design defect (although I am leaning that there is possibly a documentation defect - please note that I do not personally know exactly what level of documentation is required and at what level of detail).

2) The investigation concludes that there is in fact a design defect; but, that it is not of major significance to the crash as the CVR could indicate that the reason (or major reason) for the crash had little, if anything, to do with the MCAS system. In which case, whatever MCAS issue is found to exist does get discussed somewhat briefly in the report as a contributing factor that should be addressed. Please keep in mind that no individual malfunctioning system should result in a crash of an aircraft.

Have a great day,
 
sgrow787
Posts: 33
Joined: Fri May 16, 2014 8:12 pm

Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

Thu Nov 29, 2018 6:10 am

PW100 wrote:
Not quite . . . two sensors usually are a poorer performer than a single sensor: double the change that one is wrong. And when one is wrong, there's usually no easy way to quickly establish which is the bad one.
Three sensors will be able to discriminate a faulty one, two sensors can't do that.

Of course some sensor output algorithm can be applied to (try to) determine which one of two sensors would be reliable, but such also can be (and usually is) applied to a single sensor.


Arinc429 protocol includes a status field (two bit SSM field) for devices to communicate the status of the data contained in the data word/label that they are transmitting:

NCD - No Computed Data
Fail
Test - Functional Test
Norm - Normal/OK

So the AOA sensor, being a Arinc429 device, might include it's own data validity checker. Certainly the protocol is designed to allow for that. If so, then it sends it's erratic data to the ADIRU, but also with the SSM indicating the data is Fail or NCD, at which point the ADIRU might be doing some additional analysis before passing that status onward to the FCC (ie, did we get the bad data three times in a row, or just once out of 20 or so, etc). ADIRS's (like the one sold by Honeywell) have three (3) ADIRUs in one housing. By the time this data reaches the FCC, it is a software parameter with a source selection identifier appended on the end (eg _1,_2,_3). It is the FCC where the fancy analysis is done to determine what the hell is most likely happening. While I don't know yet if that includes automatically selecting ADIRU #3 if #1 and #2 disagree, I wouldn't be surprised if that is the case.
 
User avatar
Finn350
Posts: 1328
Joined: Tue Jul 09, 2013 4:57 am

Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

Thu Nov 29, 2018 6:22 am

sgrow787 wrote:
So the AOA sensor, being a Arinc429 device, might include it's own data validity checker. Certainly the protocol is designed to allow for that. If so, then it sends it's erratic data to the ADIRU, but also with the SSM indicating the data is Fail or NCD, at which point the ADIRU might be doing some additional analysis before passing that status onward to the FCC (ie, did we get the bad data three times in a row, or just once out of 20 or so, etc). ADIRS's (like the one sold by Honeywell) have three (3) ADIRUs in one housing. By the time this data reaches the FCC, it is a software parameter with a source selection identifier appended on the end (eg _1,_2,_3). It is the FCC where the fancy analysis is done to determine what the hell is most likely happening. While I don't know yet if that includes automatically selecting ADIRU #3 if #1 and #2 disagree, I wouldn't be surprised if that is the case.


There are only two ADIRUs in a 737 as it is not a fly-by-wire aircraft. If there were 3 ADIRUs, current designs are using ”majority voting” to select the value where (at least) two ADIRUs agree.
 
StTim
Posts: 3064
Joined: Thu Aug 08, 2013 7:39 am

Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

Thu Nov 29, 2018 7:27 am

dragon6172 wrote:
zeke wrote:

I find your comments quite insulting as I clearly do understand the system, and by the terms you are using you do not.

In manual flight STS,MCAS, and Mach trim are all commanded control inputs, they are BY DESIGN addded by the autopilot even on a serviceable aircraft when the pilot is manually flying. These are automatic inputs by the autopilot when the autopilot is selected off.

The STS/MCAS inputs were not “uncommaned” they were commanded by the FCC in response to the bad AOA and good ADR data. This however is also the NORMAL behaviour even with good AOA and ADR data.

The runaway trim procedure is for when the trim starts moving and cannot be stopped in an uncommanded manor, ie a switch or contact remains closed. This came about as a result of Sabina accident I previously mentioned that resulted in the change of the control column trim switch design.

As we see in the FDR data the MCAS trim stopped for 5 seconds each time a control column trim input was made, and they could even reverse the direction. Previously I posed the trim values after MCAS input and after Pilot input. The post MCAS average was around 4 units, the post pilot trim around 5 units.

The emergency AD is to alert pilots that the MCAS can command nose down trim as designed as a result of receiving bad AOA data.

The way to remove the FCC commanded nose down trim is to move the stab PRI and B/U switches to cutoff.

In summary - previously runaway trim waa just fir uncommaded and uncontrollable trim, now runaway trim covers what it previously did and also commanded MCAS nose down trim associated with other symptoms.


Insulted? Goodness gracious zeke, it's the internet. Just trying to have a debate / discussion here. And, I don't believe I have said anything about your knowledge of MCAS. What I did say is I thought you should re-read the AD. Instead you just regurgitated some systems knowledge. I'll go over the AD again, if your reading of it is different, please let me know how.

"Uncommanded" is not a word I chose, it is in the AD. I'll quote it again:
In the event of an uncommanded horizontal stabilizer trim movement, combined with any of the following potential effects or indications resulting from an erroneous Angle of Attack (AOA) input, the flight crew must comply with the Runaway Stabilizer procedure in the Operating Procedures chapter of this manual

That is the wording that goes into the AFM Certificate Limitations section.

In the Operating Procedures section of the AFM the following wording is used:

In the event an uncommanded nose down stabilizer trim is experienced on the 737-8/-9, in conjunction with one or more of the indications or effects listed below, do the existing AFM Runaway Stabilizer procedure above

Bold and underline added by me in both quotes.

Notice they say uncommanded trim movement "combined with" or "in conjunction with" any of the other indications or effects. To me this means a pilot has to recognize that the trim movements are undesireable (which probably would have been a better wording for the AD, I believe their use of "uncommanded" is referring to trim inputs not commanded directly by the pilot). So, as I said previously, if you recognize that the trim movements are undesirable, why would you not comply with the runaway trim procedure, which has been in the manual the whole time (notice the AD says to do the "existing" AFM Runaway Stabilizer procedure.)

The difference between the two flights were that the previous crew recognized that the stab trim inputs were undesirable and disconnected the electric trim in accordance with the procedure already in the AFM. The accident crew failed to conclude that the computer trim inputs were undesirable, and instead decided to "fight" the system for 7 minutes and 20+ cycles of computer trim down and pilot trim up. The accident crew did report a flight control problem to ATC three separate times. What problem did they think they had?

I agree that Boeing can be held to the fire for not including info on MCAS to all operators (allegedly), it very well could have aided in troubleshooting the repeated discrepancy. However, I am not convinced that the accident crew would have faired any better with knowledge of MCAS.


In normal and expected MCAS operation it is only ever commanded by the FCC never by the pilots. Should they therefore always override its operations as uncommanded?
 
User avatar
AirlineCritic
Posts: 1487
Joined: Sat Mar 14, 2009 1:07 pm

Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

Thu Nov 29, 2018 7:49 am

A lot of people jumping to conclusions. Even if we have some pictures of the FDR, we (the public) do not have the full data set. We don't know all the systems and logic in the airplane. We don't have a full picture of what training or materials pilots in different parts of the world have seen.

And again, it is likely that today's accidents are combinations of issues. I find it a bit unhappy to read lots of people stating how airplanes or pilots are resolved of any blame because something else happened or somebody should have done something. This video (https://www.youtube.com/watch?v=s3LrsvaCUoo) makes the point that pilots are mostly trained to deal with single emergencies, but here we had two in parallel.

We should start from the principle that no single fault should bring the airplane down, be it a fault in the machine or maintenance or even by the pilot. The rest of the system (redundancies, including the pilots or the other pilot) should catch the problems. So what happened here?


    1. A mechanical or electrical error somewhere leads to bad data (could be sensor or computer issue, we don't know; we also don't know if there were multiple sensors in error but some information seems to point to it)

    2. Maintenance does not succeed in correcting the issues and several crews are exposed to them (could be due to insufficient 737 maintenance or testing procedures or perhaps the maintenance made an error)

    3. Accident crew takes off and is immediately exposed to the first problem as the plane's system believe it is about to stall. ATC is informed of "flight control problem". (The issue could be due to the airspeed indicators, not sure)

    4. Crew was able to deal with that correctly. But as the airplane reaches sufficient altitude at 23:22:05 and the configuration changes as it should (move to flaps 0). At that point the crew is hit with a second problem, i.e., the MCAS believes it needs to trim the nose down (this could be a consequence of issue 1 above, possibly combined with design that does not detect a major discrepancy between sensors)

    5. After a descent, the crew is able to deal with the second issue by countering with the stick and with their own trimming actions. Configuration changes again 43 seconds later at 23:22:48, and the second issue disappears.

    6. Crew flies along and successfully deals with the first issue during that time. At 23:25:18, three minutes later the configuration changes again to flaps 0. The second issue re-appears.

    7. In the next 6 minutes, the crew needs to deal with both issues (stick shaker/airspeed and trimming/AoA). They also get six different headings from the ATC, and may have performed a PF/PNF switch, and are making turns. In the last turn, for some reason they do not adequately counter the trimming action or cut the system, and in just a few seconds the system trims the plane to a state where it cannot be recovered, or cannot be recovered with the altitude they have left (see below for the potential reasons for this)

    8. The aircraft impacts water.


The big question marks are about why item 7 above lead to loss of control, and why were they not able to recover. Some potential reasons for this include: task saturation due to overwhelming number of issues and imperfect CRM, e.g., being unable to counter the trim and fly a turn and change PF at the same time. Or the inability to understand that they had a runaway trim situation or lack of knowledge on what to do if you had one. Or perhaps they momentarily started to believe they had a stall... they did have stick shaker and automatic nose trim, so maybe they believed them for a moment. Or maybe there was a control breakout due to heavy forces they applied on the controls, as suggested by Ferpe. Or a combination of some of these reasons. But we don't really know in detail. I think the FDR as a whole has most of the answers, but we don't have all the parameters.

Anyway, no matter what specific thing happened on this specific flight, some of the questions I'd like to ask are:


    * How well were and are the 737 pilots aware of the _different_ situations that might indicate a problem in STS and MCAS?

    * How well training and procedures deal with multiple emergencies?

    * Why is the MCAS system feeding off only one sensor, and could it be redesigned to automatically shut down upon major disagreements between sensors?

    * Are maintenance procedures sufficient to detect the kinds of errors experienced by this aircraft?

    * Are instructions and procedures clear enough that non-normal situations (e.g., stick shaker on all flight) should cause an immediate return to the airport and a more thorough investigation?

 
User avatar
PixelFlight
Posts: 97
Joined: Thu Nov 08, 2018 11:09 pm

Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

Thu Nov 29, 2018 7:58 am

stratclub wrote:
PixelFlight wrote:
stratclub wrote:
I could not find any reference for "relay sticking" in regards to mission critical aircraft systems, mostly hobbyist type design stuff like building non critical automation and control circuits.

Anything used on an aircraft is well past the design phase and is thoroughly tested for reliability and failure modes at an individual component and systems level prior to being used on an aircraft then the aircraft design has to proven to the FAA by Flight Test validation prior to being put into service.

Spanair Flight 5022 (JK5022) McDonnell Douglas MD-80
"When the R2-5 relay was recovered from the wreckage it was subjected to detailed examination. Two stuck contacts within the relay were identified"

1 chance of how many billions of aircraft relays manufactured?

This simply prove that this is possible on a aircraft rated relay. As I have say early, it doubt something like this could happen to a relay only a couple of months old.

stratclub wrote:
The cause of the accident was determined to be that the crew took off with the flaps fully retracted and if they had followed correct and mandatory cockpit checklist procedure, they would have never taken off with the flaps not properly configured.

I never say that the relay is the direct cause of the crash. But read the report and you will find a very tricky chain of events where this relay malfunction have a important place in why the protection against wrong takeoff configuration (TOWS) was unintentionally disabled by the maintenance.

stratclub wrote:
Automation should never be a solution for sloppy CRM. TOWS did not work, so what? Mandated proper CRM would have caught that before peoples lives were lost. During T/O, why is it that the PF and the PO cross check IAS at 100 Knots every single time? I I really doubt that is because they are bored.

Sorry but the very reason why protections, like TOWS in this case, exists in the first place is precisely because humans pilots are not immune to error. The JK5022 report contain some information about what could have affected the pilots work.
 
User avatar
PixelFlight
Posts: 97
Joined: Thu Nov 08, 2018 11:09 pm

Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

Thu Nov 29, 2018 8:28 am

sgrow787 wrote:
So the AOA sensor, being a Arinc429 device, might include it's own data validity checker.

According to the findings by valuable contributors on this forum, in the 737 (including MAX) the left AoA link to the SMYD1 (that contain the MCAS function) is a analog connection of 3 wires labeled SIN, COS and COM, indicating a 2 phases 90° resolver. Please read the schematic posted before on this thread.
 
User avatar
PixelFlight
Posts: 97
Joined: Thu Nov 08, 2018 11:09 pm

Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

Thu Nov 29, 2018 8:50 am

AirlineCritic wrote:
So what happened here?


    -2. A design error allow "if an erroneously high single angle of attack (AOA) sensor input is received by the flight control system, there is a potential for repeated nose-down trim commands of the horizontal stabilizer" (official EAD).

    -1. Safety assessment activity failed to spot the design error. Documentation about the MCAS possible malfunction not included into the manuals.

    0. Certification process failed to detect that the safety assessment activity was not covering the design error. Pilots not trained on MCAS malfunction.

    AirlineCritic wrote:
    1. A mechanical or electrical error somewhere leads to bad data (could be sensor or computer issue, we don't know; we also don't know if there were multiple sensors in error but some information seems to point to it)

    2. Maintenance does not succeed in correcting the issues and several crews are exposed to them (could be due to insufficient 737 maintenance or testing procedures or perhaps the maintenance made an error)

    3. Accident crew takes off and is immediately exposed to the first problem as the plane's system believe it is about to stall. ATC is informed of "flight control problem". (The issue could be due to the airspeed indicators, not sure)

    4. Crew was able to deal with that correctly. But as the airplane reaches sufficient altitude at 23:22:05 and the configuration changes as it should (move to flaps 0). At that point the crew is hit with a second problem, i.e., the MCAS believes it needs to trim the nose down (this could be a consequence of issue 1 above, possibly combined with design that does not detect a major discrepancy between sensors)

    5. After a descent, the crew is able to deal with the second issue by countering with the stick and with their own trimming actions. Configuration changes again 43 seconds later at 23:22:48, and the second issue disappears.

    6. Crew flies along and successfully deals with the first issue during that time. At 23:25:18, three minutes later the configuration changes again to flaps 0. The second issue re-appears.

    7. In the next 6 minutes, the crew needs to deal with both issues (stick shaker/airspeed and trimming/AoA). They also get six different headings from the ATC, and may have performed a PF/PNF switch, and are making turns. In the last turn, for some reason they do not adequately counter the trimming action or cut the system, and in just a few seconds the system trims the plane to a state where it cannot be recovered, or cannot be recovered with the altitude they have left (see below for the potential reasons for this)

    8. The aircraft impacts water.

     
    fadecfault
    Posts: 129
    Joined: Mon Nov 05, 2007 8:44 pm

    Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

    Thu Nov 29, 2018 8:52 am

    PixelFlight wrote:
    sgrow787 wrote:
    So the AOA sensor, being a Arinc429 device, might include it's own data validity checker.

    According to the findings by valuable contributors on this forum, in the 737 (including MAX) the left AoA link to the SMYD1 (that contain the MCAS function) is a analog connection of 3 wires labeled SIN, COS and COM, indicating a 2 phases 90° resolver. Please read the schematic posted before on this thread.

    Channel "A" resolver of the left AOA feeds smyd 1 which operates the captains stick shaker.
    Channel "B" resolver feeds the left adiru which feeds the FCC aoa data for speed trim. On inital power up FCC "A" commands speed trim until it lands and FCC "B" will command on the next flight.
    Mcas function is contained within the FCC but there is no documentation which channel the FCC is using for mcas AOA.
    The views and opinions written here are my own and do not reflect those of my employer.
     
    User avatar
    AirlineCritic
    Posts: 1487
    Joined: Sat Mar 14, 2009 1:07 pm

    Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

    Thu Nov 29, 2018 8:55 am

    PixelFlight wrote:
    -2. A design error allow "if an erroneously high single angle of attack (AOA) sensor input is received by the flight control system, there is a potential for repeated nose-down trim commands of the horizontal stabilizer" (official EAD).


    Yes. I did my list slightly differently, but a design error was one of the potential causes of what happened in step 4.
     
    User avatar
    PixelFlight
    Posts: 97
    Joined: Thu Nov 08, 2018 11:09 pm

    Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

    Thu Nov 29, 2018 9:27 am

    2175301 wrote:
    PixelFlight wrote:
    There is only two possibles outcomes about the validity of the EAD statement: True or False.
    * If True, the described unsafe condition IS the cause of why the operating manual have to tell how to recognize and disable MCAS to avoid immediate crash, and IS the cause of the pilot load increase to learn, train, recognize and implement the procedure in less than a few dozen of seconds to save all on board life. A such mode of failure will inevitably directly impact the safety assessment activity.
    * If Flase, then the "analysis performed by the manufacturer" lost credibility and will also inevitably directly impact the safety assessment activity as the AD is produced by this precise activity.
    I see no way to escape the safety question of the design. If you see and other solution, please explain.


    There are 2 major possibilities that you are apparently not seeing: Please keep in mind that we are likely seeing and hearing about 1% (or less) than the information that the investigation board sees at this stage.

    The investigators are not the question here. Boeing HAVE ALL the information that forced them to publish the EAD: "by analysis performed by the manufacturer". How hard it that to understand ?

    2175301 wrote:
    1) The AD is correct; but, for various reasons we have not seen there is not considered to be a design defect (although I am leaning that there is possibly a documentation defect - please note that I do not personally know exactly what level of documentation is required and at what level of detail).

    Factually impossible per EAD "(e) Usafe Condition" wording: there is no documentation in the causality between the AoA malfunction and the MCAS malfunction. (According to others findings, this link look more like a obsolete 2 + 1 wires from the left AoA analog resolver to the SMYD1)

    2175301 wrote:
    2) The investigation concludes that there is in fact a design defect; but, that it is not of major significance to the crash as the CVR could indicate that the reason (or major reason) for the crash had little, if anything, to do with the MCAS system. In which case, whatever MCAS issue is found to exist does get discussed somewhat briefly in the report as a contributing factor that should be addressed. Please keep in mind that no individual malfunctioning system should result in a crash of an aircraft.

    Don't try to bend more the analysis: you wrote yourself that there is a design defect in this case...

    So as I have said before: the is a design defect or there is a design defect. I still see no way to escape this already officially published fact.
    I don't ignore that the investigators have more facts, I point out that the design defect fact is unavoidable already.
     
    markno
    Posts: 3
    Joined: Sat Nov 24, 2018 10:02 pm

    Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

    Thu Nov 29, 2018 9:39 am

    I have a few questions from my perspective as a passenger. Will the investigators also question the crew of the previous flight? Would they ask them about their training, and their thoughts that they had in their flight? And do investigators eventually read source code of the planes computer system, or is it closed source and the plane manufacturer gives the investigators something like a diagram and test protocol to show how the plane must have behaved?
     
    User avatar
    PixelFlight
    Posts: 97
    Joined: Thu Nov 08, 2018 11:09 pm

    Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

    Thu Nov 29, 2018 9:55 am

    fadecfault wrote:
    PixelFlight wrote:
    sgrow787 wrote:
    So the AOA sensor, being a Arinc429 device, might include it's own data validity checker.

    According to the findings by valuable contributors on this forum, in the 737 (including MAX) the left AoA link to the SMYD1 (that contain the MCAS function) is a analog connection of 3 wires labeled SIN, COS and COM, indicating a 2 phases 90° resolver. Please read the schematic posted before on this thread.

    Channel "A" resolver of the left AOA feeds smyd 1 which operates the captains stick shaker.
    Channel "B" resolver feeds the left adiru which feeds the FCC aoa data for speed trim. On inital power up FCC "A" commands speed trim until it lands and FCC "B" will command on the next flight.

    Thanks for the correction.
    Channel "A" malfunction is observable in the FDR by the STICKSHAKERLEFTFDR signal.
    Channel "B" malfunction is observable in the FDR by the ANGLEOFATTCKINDICATEDLFDR signal.
    Can we conclude that only the AoA malfunction can produce the two observations ? I mean if it was a ADIRU malfunction only, would the captains stick shaker still be possibly activated ?

    fadecfault wrote:
    Mcas function is contained within the FCC but there is no documentation which channel the FCC is using for mcas AOA.

    Obviously, per EAD and FRD, the FCC's MCAS function can use the left AOA. I agree it's still not clear if the FCC's MCAS function only use a single sensor, failed to reject the wrong sensor, or use an average value of the two sensors. In any case the outcome is the same: a single AOA error can make the MCAS function generate AND, a major safety concern.
     
    User avatar
    PixelFlight
    Posts: 97
    Joined: Thu Nov 08, 2018 11:09 pm

    Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

    Thu Nov 29, 2018 10:22 am

    markno wrote:
    And do investigators eventually read source code of the planes computer system, or is it closed source and the plane manufacturer gives the investigators something like a diagram and test protocol to show how the plane must have behaved?

    The code is closed, Otherwise please post the open source repository where I can read it :-)
    The QF72 report is an example of deep investigation into the algorithm executed on the flight computers.

    Update: it's QF72, not QF32, sorry.
     
    fadecfault
    Posts: 129
    Joined: Mon Nov 05, 2007 8:44 pm

    Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

    Thu Nov 29, 2018 10:48 am

    PixelFlight wrote:
    fadecfault wrote:
    PixelFlight wrote:
    According to the findings by valuable contributors on this forum, in the 737 (including MAX) the left AoA link to the SMYD1 (that contain the MCAS function) is a analog connection of 3 wires labeled SIN, COS and COM, indicating a 2 phases 90° resolver. Please read the schematic posted before on this thread.

    Channel "A" resolver of the left AOA feeds smyd 1 which operates the captains stick shaker.
    Channel "B" resolver feeds the left adiru which feeds the FCC aoa data for speed trim. On inital power up FCC "A" commands speed trim until it lands and FCC "B" will command on the next flight.

    Thanks for the correction.
    Channel "A" malfunction is observable in the FDR by the STICKSHAKERLEFTFDR signal.
    Channel "B" malfunction is observable in the FDR by the ANGLEOFATTCKINDICATEDLFDR signal.
    Can we conclude that only the AoA malfunction can produce the two observations ? I mean if it was a ADIRU malfunction only, would the captains stick shaker still be possibly activated ?

    fadecfault wrote:
    Mcas function is contained within the FCC but there is no documentation which channel the FCC is using for mcas AOA.

    Obviously, per EAD and FRD, the FCC's MCAS function can use the left AOA. I agree it's still not clear if the FCC's MCAS function only use a single sensor, failed to reject the wrong sensor, or use an average value of the two sensors. In any case the outcome is the same: a single AOA error can make the MCAS function generate AND, a major safety concern.

    The stick shaker can not be activated solely by the adiru according to Boeing schematics.
    I have to correct myself, according to the schematics left adiru feeds FCC A and right adiru feeds FCC B for speedtrim AOA data. Left and right are separated starting at the aoa.
    The views and opinions written here are my own and do not reflect those of my employer.
     
    User avatar
    PixelFlight
    Posts: 97
    Joined: Thu Nov 08, 2018 11:09 pm

    Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

    Thu Nov 29, 2018 11:15 am

    fadecfault wrote:
    The stick shaker can not be activated solely by the adiru according to Boeing schematics.

    Ok, so in that scenario, this would be the left AoA internal malfunction (before the two resolvers) that produced the "erroneously high single angle of attack (AOA) sensor input is received by the flight control system". Even if there is a ADIRU between the left AoA and the FCC, the ADIRU malfunction scenario would not produce the actual FDR record (the pilot shaker would not be activated).

    This again rise the question about the replacement of AoA sensor... (right AoA instead of left AoA ? two successive defect AoA ? A other common mode failure ?). Not easy to figure out.

    I don't understand why the FDR data of the Tianjin Binhai to Manado, Denpasar to Manado, and Manado to Denpasar flights are not published as there claim to have 19 flights on the record. The interim report only show the AFML and don't correlate with the FDR data. What the AoA sensors values look like on those flights (before the replacement) ?
     
    ferpe
    Posts: 2667
    Joined: Tue Nov 30, 2010 7:44 am

    Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

    Thu Nov 29, 2018 11:16 am

    fadecfault wrote:
    Channel "A" resolver of the left AOA feeds smyd 1 which operates the captains stick shaker.
    Channel "B" resolver feeds the left adiru which feeds the FCC aoa data for speed trim. On inital power up FCC "A" commands speed trim until it lands and FCC "B" will command on the next flight.
    Mcas function is contained within the FCC but there is no documentation which channel the FCC is using for mcas AOA.

    Thanks fadecfault, you are always providing good factual information. We could infer the MACS function in the FCC is fed of the captains AoA as MCAS was triggered for both flights where we have FDR traces and the left AOA signal was 20° displaced.

    There is a lot of talk about the STS. With the reservation I got it wrong:

    - STS is a low speed pitch trim helper for takeoff, climb after takeoff and landing TOGA for example. In these cases, there is Thrust coupling in pitch and trimming against helps the pilot. STS does not change the center point of the EFS (synthetic Elevator Feel System working with roller and cam to give stick feel for 100% power boosted elevators) AFAIK. Trimming will change the center point to the new trim but there is no artificial nose down EFS AFAIK.

    - The increased stick force nose down the pilots feel and complain about as "STS trimming against" is the stall warning increasing the stick force for nose up stick by increasing roller pressure against the cam of the EFS. Does it also move the cam center point stick foward? Don't know. What the manuals say is it does increase the cam ball pressure like four times.

    - A stall situation has a described nose down trim action defined, similar to MCAS, nose down in increments. We can assume this is using the same trim loops as the MCAS, with parameters adjusted to the situation (actually MCAS is then reusing the trim loops of the Stall trim as the Stall trim was present before the MAX). As the AoA was well above Stall ( stall is around 14° for a clean NG or MAX) why are we talking about MCAS all the time? It's working between an approach to stall and established stall as a stand-alone pitch augmentation. As regards the AoA the aircraft is in the stall regime practically all the time. This triggers Stick shaker from the SYMD, EFS increased stick force from SYMD (or FCC, have to look) and trim nose down from FCC.

    Is the FCC stall trim nose down working of other parameters like speed, altitude and computed load factor? If it's working of the Stall Warning AoA the trim commands we talk about are not MCAS but defined anti Stall measures, equal for NG and MAX. The consequence is the same thing could happen to an NG 737 as we are above stall AoA with actual AoA+20°. In fact we are seldom in MCAS AoA range.

    The absence of actions on the NG side points to the stall trim nose down being triggered by other parameters than one side AoA.
    Last edited by ferpe on Thu Nov 29, 2018 11:33 am, edited 3 times in total.
    Non French in France
     
    markno
    Posts: 3
    Joined: Sat Nov 24, 2018 10:02 pm

    Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

    Thu Nov 29, 2018 11:20 am

    PixelFlight wrote:
    markno wrote:
    And do investigators eventually read source code of the planes computer system, or is it closed source and the plane manufacturer gives the investigators something like a diagram and test protocol to show how the plane must have behaved?

    The code is closed, Otherwise please post the open source repository where I can read it :-)
    The QF72 report is an example of deep investigation into the algorithm executed on the flight computers.

    Update: it's QF72, not QF32, sorry.


    I see. The QF72 Wikipedia article says a data word was processed the wrong way. So I assume, if there had been a software defect, the symptoms of it and circumstances would make the manufacturer show enough source code to someone, and there's no way for a defect to stay hidden.

    Seeing the code would be fun for me, too.
     
    User avatar
    PixelFlight
    Posts: 97
    Joined: Thu Nov 08, 2018 11:09 pm

    Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

    Thu Nov 29, 2018 12:29 pm

    markno wrote:
    I see. The QF72 Wikipedia article says a data word was processed the wrong way. So I assume, if there had been a software defect, the symptoms of it and circumstances would make the manufacturer show enough source code to someone, and there's no way for a defect to stay hidden.

    QF72 report is at this link: https://www.atsb.gov.au/media/3532398/ao2008070.pdf
    The 42 pages long chapter 2 about "factual information: electrical flight control system" is an example of what kind of investigation must be done on the JT610.
    The QF72 is a chain of events that includes a insanely evil (and still not understood) ADIRU failure producing erratic data spike, and a FCPC algorithm design error that was unable to reject the erratic data spikes from the foolish ADIRU.
     
    patplan
    Posts: 15
    Joined: Sun Nov 11, 2018 1:38 pm

    Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

    Thu Nov 29, 2018 12:41 pm

    PixelFlight wrote:
    fadecfault wrote:
    The stick shaker can not be activated solely by the adiru according to Boeing schematics.

    Ok, so in that scenario, this would be the left AoA internal malfunction (before the two resolvers) that produced the "erroneously high single angle of attack (AOA) sensor input is received by the flight control system". Even if there is a ADIRU between the left AoA and the FCC, the ADIRU malfunction scenario would not produce the actual FDR record (the pilot shaker would not be activated).

    This again rise the question about the replacement of AoA sensor... (right AoA instead of left AoA ? two successive defect AoA ? A other common mode failure ?). Not easy to figure out.

    I don't understand why the FDR data of the Tianjin Binhai to Manado, Denpasar to Manado, and Manado to Denpasar flights are not published as there claim to have 19 flights on the record. The interim report only show the AFML and don't correlate with the FDR data. What the AoA sensors values look like on those flights (before the replacement) ?


    Speaking of that notorious left AOA sensor, I found an interesting segment from NY times article "In Indonesia Lion Air Crash, Black Box Data Reveal Pilots’ Struggle to Regain Control". It reads...

    ...The plane that crashed on Oct. 29 had experienced days of incorrect data readings, according to Indonesian officials. In fact, before the penultimate flight, engineers had replaced one of the angle-of-attack sensors.

    Why the plane recorded incorrect angle-of-attack data after the sensor had been changed is not clear. Soerjanto Tjahjono, the head of Indonesia’s National Transportation Safety Committee, said that the replacement part was not new but was “serviceable” and had certification from the F.A.A. of the United States...


    full article: https://www.nytimes.com/2018/11/27/worl ... rash-.html


    Curiouser...curiouser...
     
    User avatar
    PixelFlight
    Posts: 97
    Joined: Thu Nov 08, 2018 11:09 pm

    Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

    Thu Nov 29, 2018 12:52 pm

    fadecfault wrote:
    Channel "B" resolver feeds the left adiru which feeds the FCC aoa data for speed trim. On inital power up FCC "A" commands speed trim until it lands and FCC "B" will command on the next flight.

    fadecfault wrote:
    according to the schematics left adiru feeds FCC A and right adiru feeds FCC B for speedtrim AOA data. Left and right are separated starting at the aoa.


    Wooow! This is a clear path from the left AoA erratic value down to the FCC's A MCAS protection authority function without any redundancy.

    What the options at this point:
    1) It's ok to flight an aircraft without any redundancy on the sensor used by a required protection authority over the pilots. Seriously ?
    2) The protection authority over the pilots is not required, so remove it. Stuck in the past.
    3) The sensors redundancy is required for a protection authority over the pilots. Grounding.
    I am missing something ?
     
    kalvado
    Posts: 1045
    Joined: Wed Mar 01, 2006 4:29 am

    Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

    Thu Nov 29, 2018 1:10 pm

    PixelFlight wrote:
    fadecfault wrote:
    Channel "B" resolver feeds the left adiru which feeds the FCC aoa data for speed trim. On inital power up FCC "A" commands speed trim until it lands and FCC "B" will command on the next flight.

    fadecfault wrote:
    according to the schematics left adiru feeds FCC A and right adiru feeds FCC B for speedtrim AOA data. Left and right are separated starting at the aoa.


    Wooow! This is a clear path from the left AoA erratic value down to the FCC's A MCAS protection authority function without any redundancy.

    What the options at this point:
    1) It's ok to flight an aircraft without any redundancy on the sensor used by a required protection authority over the pilots. Seriously ?
    2) The protection authority over the pilots is not required, so remove it. Stuck in the past.
    3) The sensors redundancy is required for a protection authority over the pilots. Grounding.
    I am missing something ?

    4) Publish more information on these issues and continue flying the fleet as the fix is designed, certified and implemented. Pilots should be able to handle the issue with all new knowledge.
    My bet is on (4)
     
    2175301
    Posts: 1294
    Joined: Wed May 16, 2007 11:19 am

    Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

    Thu Nov 29, 2018 1:28 pm

    PixelFlight wrote:
    markno wrote:
    And do investigators eventually read source code of the planes computer system, or is it closed source and the plane manufacturer gives the investigators something like a diagram and test protocol to show how the plane must have behaved?

    The code is closed, Otherwise please post the open source repository where I can read it :-)
    The QF72 report is an example of deep investigation into the algorithm executed on the flight computers.

    Update: it's QF72, not QF32, sorry.


    You are incorrect. For this type of investigation - the code will be provided to the investigation board if there are any reasons to suspect a coding issue (it would certainly be on my personal list of questions at this point). It would be reviewed by independent experts; who sign appropriate (but modified) non-disclosure agreements. The modification from a standard non-disclosure agreement is that the experts (through the investigation board) are allowed to report and publish if a problem is found with the coding; including if determined necessary the specific coding error. I've executed these kinds of agreements personally in the nuclear field; and seen the cooperation of the supplier and the results for the review (no problem/problem). It's part of the basic regulatory requirements that all equipment and suppliers of certified parts and software has to provide this kind of information to a properly assembled investigation board. It's routine practice.

    A reality is that many people on this forum are jumping to a lot of conclusions with only scraps of information. I have no idea what the final root cause (or causes) will be. I am aware of the approximate number of factors that will have to be looked at, and the kind of detailed analysis done, to sort it out as I've run root cause investigations in the nuclear field. I am aware of the most common causes; but, have seen enough really rare things not to rule anything out without being part of the root cause team after all the facts and analysis is conducted.

    Have a great day,
     
    User avatar
    BaconButty
    Posts: 742
    Joined: Tue Aug 06, 2013 3:42 pm

    Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

    Thu Nov 29, 2018 1:32 pm

    PixelFlight wrote:
    What the options at this point:
    1) It's ok to flight an aircraft without any redundancy on the sensor used by a required protection authority over the pilots. Seriously ?
    2) The protection authority over the pilots is not required, so remove it. Stuck in the past.
    3) The sensors redundancy is required for a protection authority over the pilots. Grounding.
    I am missing something ?


    Thinking the same. My concern is that everybody's chipper about the MAX because next time this happens the pilots will know to hit the switch to disable the trim. Fair enough, but MCAS is there for a reason - if Ferpe is to be believed (I'm sure he is) it's a stability augumentation system designed to counter the instability of the Max in pitch at high speeds and angles of attack due to the mounting of the new engines. So let's say the next time it happens at cruise - AF447 style. The pilot hits the switch the moment the nose starts pitching down - good so far. But now he's flying an aircraft without those protections right at the point he would probably need them - when he's lost indications of airspeed and/or AOA. He pulls back too far on the yoke, the engines start generating lift and the nose starts pitching up uncontrollably, he enters a stall.... This looks to me to be a prima facie case for grounding? MCAS looks like a cheap and nasty way of dealing with the instability issue - heads need to roll on this, perhaps the inevitable civil cases will be the catalyst.
    Down with that sort of thing!
     
    fadecfault
    Posts: 129
    Joined: Mon Nov 05, 2007 8:44 pm

    Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

    Thu Nov 29, 2018 1:44 pm

    Finn350 wrote:
    scbriml wrote:
    From a Leeham update:

    https://leehamnews.com/2018/11/28/indon ... more-28725
    I think it’s safe to say; it wasn’t a clear-cut “execute the Trim Runaway” checklist situation for the crew. All 737 MAX crews now know this is the thing to do in the above situation. But these crews didn’t have this information. Secondly, MCAS operating off a single AoA signal will not be for long.



    Thanks! It seems that Leeham has identified a possible reason for the final dive: Yoke breakout mechanism

    The 737 has two independent mechanical elevator flight controls; the left side which has its own cables to control a hydraulic PCU actuator which controls the left elevator (Red trace CCFORCE_PITCHCWSLOCAL_FDR in Figure 5) and an identical system on the right (Green trace CCFORCE_PITCHCWSREMOTE_FDR in Figure 5). The systems are joined in the cockpit via a torque tube with a breakout mechanism to get one elevator free, through a very high stick force, in case of an elevator control jam on one side.

    At Figure 5 (A) the traces are no longer following each other. The First Officer has taken over and his Yoke exerts a higher force to counter MCAS trimming. The Left pitch force remains the same as before. The two sides of the mechanical flight control system are now independent. It seems a Yoke breakout has occurred.


    The problem with this belief is that it would make it seem the Investigators are 1) holding back information or 2) incompetent
    The reason is there are position sensors in the left and right elevators. These Elevator sensors are dual channel with one channel reporting to the Flight Data recorder. The Investigators will have seen a split if a breakout occurred and it should have been on the chart and reported.
    Considering that the Leeham author didn't mention the elevator position sensors I would side with the Investigators.
    The views and opinions written here are my own and do not reflect those of my employer.
     
    User avatar
    PixelFlight
    Posts: 97
    Joined: Thu Nov 08, 2018 11:09 pm

    Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

    Thu Nov 29, 2018 2:05 pm

    kalvado wrote:
    PixelFlight wrote:
    What the options at this point:
    1) It's ok to flight an aircraft without any redundancy on the sensor used by a required protection authority over the pilots. Seriously ?
    2) The protection authority over the pilots is not required, so remove it. Stuck in the past.
    3) The sensors redundancy is required for a protection authority over the pilots. Grounding.
    I am missing something ?

    4) Publish more information on these issues and continue flying the fleet as the fix is designed, certified and implemented. Pilots should be able to handle the issue with all new knowledge.
    My bet is on (4)


    Your 4) in in fact 1) now and then 3) later. The options is about the certification, once 1) is not allowed anymore, this must be 2) or 3).
     
    User avatar
    PixelFlight
    Posts: 97
    Joined: Thu Nov 08, 2018 11:09 pm

    Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

    Thu Nov 29, 2018 2:26 pm

    2175301 wrote:
    PixelFlight wrote:
    markno wrote:
    And do investigators eventually read source code of the planes computer system, or is it closed source and the plane manufacturer gives the investigators something like a diagram and test protocol to show how the plane must have behaved?

    The code is closed, Otherwise please post the open source repository where I can read it :-)
    The QF72 report is an example of deep investigation into the algorithm executed on the flight computers.

    You are incorrect. For this type of investigation - the code will be provided to the investigation board if there are any reasons to suspect a coding issue

    I am confident that I am correct about the code being closed source. If you can prove me wrong, just post the link where we all can read the code.
    I don't say that the investigators could not access the source code under NDA. NDA is common practice to read closed source code.
    Now for this JT610, I suspect that there is no need to go deep into the source code as a clear path without any redundancy have been identified from the left AoA sensor down to the FCC A MCAS required protection authority function and then the elevator trim actuator.
     
    User avatar
    Finn350
    Posts: 1328
    Joined: Tue Jul 09, 2013 4:57 am

    Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

    Thu Nov 29, 2018 2:45 pm

    PixelFlight wrote:
    2175301 wrote:
    PixelFlight wrote:
    The code is closed, Otherwise please post the open source repository where I can read it :-)
    The QF72 report is an example of deep investigation into the algorithm executed on the flight computers.

    You are incorrect. For this type of investigation - the code will be provided to the investigation board if there are any reasons to suspect a coding issue

    I am confident that I am correct about the code being closed source. If you can prove me wrong, just post the link where we all can read the code.
    I don't say that the investigators could not access the source code under NDA. NDA is common practice to read closed source code.
    Now for this JT610, I suspect that there is no need to go deep into the source code as a clear path without any redundancy have been identified from the left AoA sensor down to the FCC A MCAS required protection authority function and then the elevator trim actuator.


    Furthermore, it is very unlikely that the cause of the accident is related to a coding error. Based on the current information, the cause is related to the design of the MCAS under certain malfunctions, and no code is needed to review the design.
     
    JBirdAV8r
    Posts: 3456
    Joined: Sun Jun 24, 2001 4:44 am

    Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

    Thu Nov 29, 2018 3:47 pm

    To those wondering about why the pilots might have pushed the engines up to max thrust in the final seconds: it might have been a last-ditch and futile attempt to raise the nose. As the thrust line is below the CG on a 737, adding power creates a nose-up pitch moment. I don’t think it suggests disorientation; I think it could have been a last-ditch effort to regain some nose-up pitch authority.
    I got my head checked--by a jumbo jet
     
    Tristarsteve
    Posts: 3528
    Joined: Tue Nov 22, 2005 11:04 pm

    Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

    Thu Nov 29, 2018 3:47 pm

    Speaking of that notorious left AOA sensor, I found an interesting segment from NY times article "In Indonesia Lion Air Crash, Black Box Data Reveal Pilots’ Struggle to Regain Control". It reads...

    ...The plane that crashed on Oct. 29 had experienced days of incorrect data readings, according to Indonesian officials. In fact, before the penultimate flight, engineers had replaced one of the angle-of-attack sensors.

    Why the plane recorded incorrect angle-of-attack data after the sensor had been changed is not clear. Soerjanto Tjahjono, the head of Indonesia’s National Transportation Safety Committee, said that the replacement part was not new but was “serviceable” and had certification from the F.A.A. of the United States...

    full article: https://www.nytimes.com/2018/11/27/worl ... rash-.html



    Curiouser...curiouser...


    Why is that curious.??
    They replaced the AOA probe with a serviceable part from their store. The part was a rotable, so the item in the stores had been previously removed from a B737 NG, repaired and tested and put back in the store as a serviceable component.
    All serviceable components have a release form attached which is called an FAA Form 8130-3 or/and EASA form 1.
    Most rotable components in an airline store are not new but repaired.
     
    ferpe
    Posts: 2667
    Joined: Tue Nov 30, 2010 7:44 am

    Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

    Thu Nov 29, 2018 3:49 pm

    fadecfault wrote:
    The problem with this belief is that it would make it seem the Investigators are 1) holding back information or 2) incompetent
    The reason is there are position sensors in the left and right elevators. These Elevator sensors are dual channel with one channel reporting to the Flight Data recorder. The Investigators will have seen a split if a breakout occurred and it should have been on the chart and reported.
    Considering that the Leeham author didn't mention the elevator position sensors I would side with the Investigators.


    Of course, the investigators and also Boeing have more information. They have 69 hours with 1790 parameters from the aircraft. We have access to 40 of those for the last hours. We lack things like pitch and roll angles among a lot of other information.

    My reaction is at the same time as the counter trimming changes to short blips the pitch forces separate for the two channels for the first time during these two flights. I have since got a better schema on the pitch channel breakout mechanism, it's not a clutch, nor a no breakout or breakout mechanism.

    Image

    It's here described as a progressive cam and spring-loaded roller unit which allows progressive movements between the yokes and therefore a difference in the force the force transducers register at high differences in Yoke force in the two channels. The separation can mean the two pilots both pull on the Yokes and in different directions. What's disturbing is one stays put (red = Captain i interpret it as) while the other goes significantly higher from being the follower. Then the green stays at the put level while the red goes high. When one Yoke has moved before, the other has followed in force, not now. We can explain most other traces but not this part. Strange.

    At the same time the crew only counter trims for short blips, leading to full MCAS nose down trim and then they plunge. They could be in a turn and one doesn't normally trim in a turn but the separation of the traces are no explained by a turn unless the two pilots are in un-sync on the Yokes. The increased dynamic pressure to the Elevator Feel Shift Module which decides the hydraulic pressure to the Elevator Feel and Centering Unit at the elevator should be the same to both sides. It shouldn't cause the differences in forces we see IMO.
    Last edited by ferpe on Thu Nov 29, 2018 4:13 pm, edited 2 times in total.
    Non French in France
     
    User avatar
    PW100
    Posts: 3146
    Joined: Mon Jan 28, 2002 9:17 pm

    Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

    Thu Nov 29, 2018 4:07 pm

    JBirdAV8r wrote:
    To those wondering about why the pilots might have pushed the engines up to max thrust in the final seconds: it might have been a last-ditch and futile attempt to raise the nose. As the thrust line is below the CG on a 737, adding power creates a nose-up pitch moment. I don’t think it suggests disorientation; I think it could have been a last-ditch effort to regain some nose-up pitch authority.

    Thanks for bringing a plausible reason.
    Though one can wonder how much pitch change rate the engine could provide, especially considering the low altitude they at.
    Immigration officer: "What's the purpose of your visit to the USA?" Spotter: "Shooting airliners with my Canon!"
     
    kalvado
    Posts: 1045
    Joined: Wed Mar 01, 2006 4:29 am

    Re: Lion Air 737MAX8 Crashed Jakarta to Pangkal Pinang

    Thu Nov 29, 2018 4:38 pm

    PixelFlight wrote:
    kalvado wrote:
    PixelFlight wrote:
    What the options at this point:
    1) It's ok to flight an aircraft without any redundancy on the sensor used by a required protection authority over the pilots. Seriously ?
    2) The protection authority over the pilots is not required, so remove it. Stuck in the past.
    3) The sensors redundancy is required for a protection authority over the pilots. Grounding.
    I am missing something ?

    4) Publish more information on these issues and continue flying the fleet as the fix is designed, certified and implemented. Pilots should be able to handle the issue with all new knowledge.
    My bet is on (4)


    Your 4) in in fact 1) now and then 3) later. The options is about the certification, once 1) is not allowed anymore, this must be 2) or 3).

    There is a well established practice of MEL deferrals. Essentially same situation: a part required for safe operation is not working, but risk is low enough enough to allow operations with some limitations...

    Popular Searches On Airliners.net

    Top Photos of Last:   24 Hours  •  48 Hours  •  7 Days  •  30 Days  •  180 Days  •  365 Days  •  All Time

    Military Aircraft Every type from fighters to helicopters from air forces around the globe

    Classic Airliners Props and jets from the good old days

    Flight Decks Views from inside the cockpit

    Aircraft Cabins Passenger cabin shots showing seat arrangements as well as cargo aircraft interior

    Cargo Aircraft Pictures of great freighter aircraft

    Government Aircraft Aircraft flying government officials

    Helicopters Our large helicopter section. Both military and civil versions

    Blimps / Airships Everything from the Goodyear blimp to the Zeppelin

    Night Photos Beautiful shots taken while the sun is below the horizon

    Accidents Accident, incident and crash related photos

    Air to Air Photos taken by airborne photographers of airborne aircraft

    Special Paint Schemes Aircraft painted in beautiful and original liveries

    Airport Overviews Airport overviews from the air or ground

    Tails and Winglets Tail and Winglet closeups with beautiful airline logos