“…it’s generally accepted that the aircraft seized control from the frantic pilots and dove themselves into the ground at near supersonic speeds.”
Not at all. It’s generally recognized that two foreign aircrews couldn’t manage to flip two toggle switches on their center pedestals.
The MCAS is a sorry piece of design engineering, but runaway trim is runaway trim - something that ANY competent crew should be able to manage.
2 replies
As I understand it, the Ethiopian crew DID deactivate the electric trim, but then found the forces so high that the manual trim could not be used to save the situation.
Not saying a ‘better’ crew could not have saved it (by identifying the problem and intervening sooner?), but you’ll note that 737NGs are not falling from the sky for similar reasons, so what Boeing made with the MAX was a human factors trap.
I’ve said it before and I’ll say it again. Manufacturers and operators need to decide who they want to have in control, the pilots or the computer. Having computers doing things in the background while the pilot is ‘in control’ will always have negative human factors ramifications. Either give full control to the computer (and the pilot can direct rather than fly the machine, like an onboard drone operator) or stop having computers providing uncommanded inputs at all.
5 replies
After reading all of this – plus remembering the numerous same subject matter blogs – I just can’t believe that a pilot would walk away from this airplane because they didn’t know enough about the onboard systems to deal with a runaway trim problem. Did a poorly designed single point failure mode contribute … sure. But there WAS a way around the problem. This was a lack of systems knowledge on the part of the crews and a training problem on the part of the airlines and a problem with the low bidder subcontractor MCAS design. The magic “three” in aviation. I can’t see how anyone couldn’t now fly this thing and still have a problem with the knowledge now available and the impending improvement changes coming.
One of my dearest aviation friends – a retired high time airline pilot, now 86 (who has stories that’d make the hair on your neck stand at attention) – just sent me a pic of him standing next to a Fairchild F-227 which he said he has 3,521 hours in from 1966-72. That airplane had NO AUTOPILOT, the flaps ran on electric but the gear, brakes and steering all ran on bleed air. He told me that there was a switch that’d use the MLG as speed brakes but keep the NLG up – it had no MLG speed limit. Only when the gear handle was down did the NLG come down. They could manually move fuel around and regularly did. He told me that his airline had unique FAA approval to fly something called a “Crowbar VFR approach” into JFK over the top of LGA from 7.5K’ by dumping it in while hand flying. I can imagine the wimps you’re referring to trying to fly such a machine. But I’d bet they’re pretty good at running all the computers; switches, not so much?
Is THIS where commercial aviation has gone? No wonder automated flight is just over the horizon. NOW you’re scaring me.
The 737-200 Pilot Training Manual 1982 describes the recovery maneuver where excessive airloads may prevent the pilot from operating the manual stabilizer trim quickly enough to recover from a severe electrical mis-trim condition.
Quote: if other methods fail to relieve the elevator load and control column force, use the “roller coaster” technique. if nose up trim is required, raise the nose well above the horizon with elevator control. Then slowly relax the control column pressure and manually trim nose-up. Allow the nose to drop to the horizon while trimming. Repeat this sequence until the airplane is in trim. Unquote
This paragraph was changed in the Boeing 737 Classic series to read: “Excessive airloads on the stabilizer may require effort by both pilots to correct mis-trim. In extreme cases it may be necessary to aerodynamically relieve the airloads to allow manual trimming.”
However, Boeing did not explain what was meant by the term “aerodynamically relieve” the airloads. It assumed the flight crew could work it out for themselves. The success of combatting an un-commanded runaway stabilizer trim depends very much how quickly the pilot can recognize a runaway electrically powered stabilizer trim and cut electrical power to the stabilizer trim system before control forces became too strong to be contained manually by the roller coaster technique.
It would have been more prudent to leave the original explanation (roller coaster) in succeeding flight crew training manuals. To this day there are pilots who have never heard of the roller coaster technique because it is not described in Boeing manuals anymore.
> …it’s generally accepted that the aircraft seized control from the frantic pilots and dove themselves into the ground at near supersonic speeds.
Setting aside the atrocious grammar, this statement is true only because of the relentless barrage of ignorance from reporters repeating lies, half-truths, and rumors as fact. It’s really frustrating to see a professional aviation journal piling on. You don’t have to excuse Boeing’s idiotic design choices to say there was far, far more involved in the chain of events than just that.
They deactivated the trim after allowing MCAS to put the aircraft so far out of trim as to make it almost uncontrollable. Allowing the airspeed to exceed Vmo while the aircraft was out of trim is what eventually made the aircraft uncontrollable.
If you read the transcript it shows that the first two MCAS activations resulted in some 5 units of nose-down trim movement. The pilot used the yoke-mounted trim switch to move the trim approximately 2 units nose-up, but then MCAS reactivated and trimmed back in the nose-down direction. THAT’S when the crew deactivated the electric trim.
What they SHOULD have done (per the emergency AD they were purportedly award of) is use the electric trim switch on the control yoke to get the aircraft in a trimmed condition, THEN deactivate the electric trim. The way the system was set up, activating the trim switches on the yoke deactivated MCAS for five seconds after the trim switch was released, which gave the crew more than enough time to deactivate the trim after manually trimming using the switch, and before MCAS reactivated. All of this was covered in the emergency AD, but pointing that out has somehow become “victim blaming” or something…
1 reply
For the proponents of mandatory simulator training before Max flights resume (I’m talkin’ to you, Sullenberger), I ask this: Exactly what scenarios are you wanting the pilots to experience in that sim session? Do you think that flying the accident scenario (MCAS v1.0) is going to be of any value? It won’t, because MCAS v2.0 will be mandatory before the aircraft are released for flight. So you want them to fly an MCAS v2.0 scenario? That is … normal flight. The version 2 design solves the accident chain seven ways to Sunday. Those scenarios will never happen again. So what exactly is in this mandatory sim training that you imagine? The only item I can imagine is the manual trim wheel force in an out-of-trim condition. But this is apparently common from the Max to the NG to the Classic to the Jurassic. So a ride in ANY sim could get the job done. It isn’t a “difference” to be trained for the Max.
“Roller Coaster.” That’s it, thanks. Once again, they’re relying on computers to do what they should be doing for themselves. Your comment could save lives (sic) and ought to be in the MAX manuals.
One time – after I did an annual on my 172 – I flew it and immediately recognized that something wasn’t ‘right’ with the elevator forces. Playing the ‘tapes’ back in my mind, I decided that maybe I had forgotten the 4" inspection plate on the R horiz stab lower skin in front of the trim tab (my knee was hurting and I didn’t bend under it to catch it). Sure enough, that was it. I calculated that ~11% of the airflow over the tab could have been disturbed and because I’ve been flying THAT airplane for decades, I recognized it right away. Doesn’t take much to put things awry.
1 reply
Agreed. I am still struggling with this logic: 1) We need a pitch override system because our pilots can’t be trusted to not stall the aircraft. 2) Any competent crew should easily wade thru the ‘where’s waldo’ disengage procedure during a rogue engagement of MCAS. Which crew? The incompetent ones from #1, of course?!?!
From what I read in the accident report, the Ethiopian pilots didn’t retard the throttles, essentially cruising at full thrust. The resulting overspeed compounded the problems. Perhaps they were too dependent upon automation, expecting the autothrottles to do some magic while they worked the problem.
Correction to Larry S. (from above)
The Fairchild uses a bottle of compressed air for various functions, not bleed air.
Also, Certified aircraft can not transfer fuel between tanks as mentioned. “They could manually move fuel around and regularly did”. NOT TRUE
Otherwise, you are spot on about the use of the MLG as speed brakes.
This MCAS problem reminds me of the “unintended acceleration” of the Audi 5000 from the 1980s. From most of the press reports, it sounded like the car would go full speed on its own, with the brakes failing to work at all, the drivers rendered as helpless passengers as the cars went completely out of control.
The reality was much more nuanced. First off, most of the affected drivers were of shorter-than-average stature. Many were new to the Audi, having come from bigger American cars. Right away that showed the driver was part of the problem, as how could the car know who was driving and react accordingly? In ALL cases the brakes worked just fine, and there was nothing wrong with the fuel system. Yet every driver insisted they were pressing hard on the brake pedal to no avail. If modern car computers were present with their data history, it would’ve showed the driver pressing hard on the gas pedal, and never pressing the brake pedal.
The problem? These drivers were mistakenly pressing the gas pedal, thinking it was the brake. The pedals were in not quite the same position as cars they’ve driven before, hence the confusion. It was compounded by an idle speed that, under some conditions, was higher than usual. When the driver shifted from Park to Drive, the forward lurch would startle the driver, and they would stab the ‘brake’ pedal but hit the gas instead. As the car lunged forward, adrenaline and panic would flow in equal measure.
Note that this only happened to automatic transmission vehicles, not manuals. And that provided a clue to the solution. In a manual, both feet are positioned on the pedals to shift from a standing start - there was no “pedal misapplicationl (NTSB terminology). So, In addition to adjusting the pedal positioning and idle-speed programming, Audi invented the process of stepping on the brake pedal before one can shift out of Park. This feature is now standard on all automatic-transmission-equipped vehicles.
So, was the Audi at fault? Or was it bad drivers? Lots of owners thought the cars were just fine; they hated the drop in resale value. Or was it a combination of the two?
PS - Audi renamed the 5000 to the A5. Perhaps Boeing will have to do the same.
My friend was telling the story to me yesterday so … I likely didn’t probe deep enough or didn’t understand it fully. Still … my point was that the airplane required real pilots to fly it like … real pilots, not computer jocks. I’m certain he said that they could move fuel around … I’ll have to ask that Q again.
So what happens when the Fairchild ran out of compressed air ??
I have another old dear aviation friend who passed on at age 104 last year who made 221 crossings of the Pacific in the Boeing 314 Clipper. HIS expertise was celestial navigation … hence why they flew at night.
1 reply
Bob B, Because I like to understand systems, I verified through my friend that the compressed air systems that ran everything but the flaps did indeed come from a compressed air bottle which – itself – was refreshed from engine compressors. I forgot to ask him about the fuel.
I believe that the term “aerodynamically relieve the airloads” is self explanatory.
Yes, computer reliance enables airlines to put less experienced (and lower-paid of course) pilots in the front seats. Automation dependence breeds lax pilots. Not saying they all are - many do take the initiative to ensure they stay current hand-flying etc etc. But many don’t.
As demonstrated in your story here, experience can go a long way, a less experienced low-time pilot might not have noticed the issue at all.
There is no substitute for stick-time.
Why was the MCAS software installed in the first place? Boeing has put forth various answers: so the 737 MAX would handle like earlier 737 models; to relieve airlines of the expense of flight simulator training for MAX pilots; to prevent stall under “unusual” flight conditions; to address a stability problem that manifests only under those “unusual” flight conditions.
History might be a clue. The original B737 was unstable in pitch. That too took Boeing by surprise in the late 1960’s, and airlines had to restrict passenger loading to the front of the cabin. They did so with a yellow ribbon tied between seats to block the rear of the cabin. I remember it well, because I worked at Boeing at the time and often flew 737’s from Seattle to Los Angeles.
The technical term is “longitudinal instability”. An airplane is longitudinally unstable when the center of gravity is behind the “neutral point”, which is the point about which changes in angle of attack produce no changes in pitch moment. Think of it as the point where lift changes caused by changes of angle of attack are concentrated . Boeing got the pitch instability sorted out with the B737-200 and subsequent models.
Until the B737 MAX. There are two obvious ways pitch instability may have been revived. One is the enlarged and forward engine nacelles, which must have moved the neutral point forward. The other is the distribution of fuel below the cabin floor, which may have allowed the center of gravity to shift behind the neutral point with heavy fuel loads, as at takeoff. The fuel is distributed in tanks each holding in excess of 1 metric ton. The B737-500 had four such tanks, and the B737-8 MAX has nine. Whether the aircraft is stable or not could depend on which tanks are filled and in which order they empty.
Longitudinal instability, center of gravity, and neutral point were entirely familiar to aeronautical engineers in the last century, but now I am not so sure. Boeing paid an engineer to address the stability of the B737 MAX, but he confused two modes of longitudinal oscillations: the low-frequency “phugoid” mode, and the “short-period” mode which alone can cause pitch instability. Evidence from the flight recordings of the two crashed B737 MAX’s indicates that they underwent violent short-period pitch oscillations.
I cannot know for sure, but I suspect that Boeing pilots flew close to pitch-unstable load conditions during early flight tests of the B737 MAX. I further suspect (based on years of teaching aerodynamics in the last century) that Boeing engineers had no knowledge of short-period pitch instability and instead became concerned about stall. The stated purpose of MCAS was to prevent stall, not instability. Of course an unchecked pitch instability can cause stall when the aircraft pitches nose up, or a high-speed dive when the aircraft pitches down. Either way the end result is a crash. Solutions also date from the last century: increase the stabilizer area, move the fuel forward, or incorporate a proper stability augmentation system that actuates the stabilizer both up and down.
What concerns me is that it appears that a major design goal was reduced training costs.
The training they wanted to avoid was, from my piston pilot point of view, something that really shouldn’t take that much training.
Instead, a lot of time and money was spent on software and engineering so the marketing and sales guys could make a “cheap and quick transition” pitch.
Said transition now included some button flipping in case of system failure rather than adjusting pitch to compensate for thrust changes?
It all smells bad to me. If their pilots had flown a dozen plus types before becoming big jet jockeys would this really be a thing? Not to pick on ERAU, but it seems to me that they and their competitors might be producing the graduates the airlines thought they wanted rather than the ones they needed.
My solution is the airlines somehow get their pilots out flying gliders, aerobats, float planes, light twins, and/or bush planes. They can start by using light planes to transfer crews when it makes sense rather than bumping pax.
Lastly, we are talking about a life and death situation here. How about we not discourage ideas by complaining too harshly about grammar?
What I fail to understand is why Boeing didn’t install two angle of attack sensors on EVERY airplane and why a warning light saying “MCAS ON” wasn’t installed. It also sounded to me as if there was a problem WITH the sensor … has that ever been determined? In the F-16 fly-by-wire airplane, four flight control computers are in the loop plus a polling computer that’ll turn off errant commands pronto I don’t know if that’s still true of the current versions of that airplane but … it was in the beginning. How a single point failure mode could have been allowed into the design is Boeings fault. But there’s fault to spread all around
This sort of blog is superb! I learn much from it all.
“This sort of blog is superb! I learn much from it all.” Ditto.
Richard P. - No, “aerodynamically relieve the airloads” is NOT self explanatory. There is more than one way to do that.
My comment had more to do with redundancy and the reliability of multiple channels for critical systems. I was using the F-16 as an example of same. That Boeing didn’t just install two AOA sensors befuddles me. Also, there’s a system that’s recently been NORSEE approved to determine rough AOA from pitot and static pressures without a AOA vane. Why couldn’t they have used such a design as a backup or cross-check? Finally, I question why motorized stab trim required MCAS to be on is likewise nutty. Why couldn’t MCAS be turned off but electric trim remain on to overpower the thing? Lotsa questions.
1 reply
If Boeing is to be believed, MCAS was created to provide pilots with a pitch control feel that mimicked that of earlier models of the 737. Consequently, pilots who were 737-rated would NOT require (costly) MAX-specific training - up to and potentially including a MAX type rating.
Unfortunately, the combination of (IMWO) very poor design and two incompetent flight crews proved deadly.
The 737 HAS two AOA vanes, but the MCAS design made use of only one of them per flight. To your point, redundancy can be a false surrogate for reliability - two is better than one; three is better than two, etc.
Redundancy is just one means of attempting to achieve reliability - which is the actual objective. But redundancy of like apparatus (multiple instances of the same sensor) leaves a system vulnerable to common-mode failures.
Example:
A four-engine aircraft is loaded with contaminated fuel.
Example:
A four-AOA-vane aircraft ices up all of them in trecherous weather.
YARS-ism: “A properly-designed control system employs multiple TYPES of sensors, to DERIVE reliable information.”
Example:
An AOA vane MEASURES angle-of-attack.
But the COMBINATION of pitch attitude information (from the attitude-sensors) PLUS 3-D flight-path information (from GPS and/or inertial sources) permits a computer to DERIVE angle-of-attack information - which then can be compared with measured AOA from the vanes.
But Boeing wasn’t interested in re-inventing a wheel. IMWO, they still aren’t. They seek the simplest effective solution to a narrowly-defined problem.
But engineers need to be always vigilant of the peril that attends conflating the simple with the simplistic. Danger, Will Robinson.
1 reply
>>I have another old dear aviation friend who passed on at age 104 last year who made 221 crossings of the Pacific in the Boeing 314 Clipper. HIS expertise was celestial navigation … hence why they flew at night.
Sort of. The real reason they flew at night was because they were crossing big oceans in an airplane that couldn’t do much more than 130MPH. They flew day and night to get to a destination.
Celestial navigation does not require night-only operation. There is still one really good “star” sighting available to a celestial navigator during the day.
Gotta side with Kirk here. Can’t run around at full T/O thrust. They ran the correct checklist, but never pulled the power back, so the aerodynamic load was too great to manually trim against.
I think there should be a like option on here. good comments
That was my exact point, Yars. I thought about it this AM before I got vertical. When the trim system went crazy on those two airplanes, the very first thing the crews did was activate the yoke mounted trim switch. It got them relief until they let go of it whereupon the MCAS took over again. Had there been training ON the MCAS system – starting with its existence and purpose – the crews would have at least known about it. It could have been said the system is there to make it feel like all the rest of the 737’s. If – additionally – an “MCAS Activated” warning light would have come on with the capability to deactivate MCAS but leave electric trim ops normal, both flights would have ended safely … albeit with an underwear change for the crew.
Here we all sit opining how simple it would have been to do a better job. Meanwhile, in Seattle, the big B is doing damage control, their lawyers are trying to minimize damage, the FAA is working overtime to make it right (because of ODA) and tens of thousands of hours are being wasted … for what? And – as Eric W said – this is a life AND death situation. I sure hope someone from Boeing is reading all of this?
On a major weapon system I worked on, every other Tuesday we had to go before the engineering VP and “confess” issues. Had we done something like this … we’da been swimming with da fishes.
I remember reading recently that the design and purpose of the MCAS system evolved over time. Originally, its purpose was to prevent excessive pitch-up at high airspeed and low AoA. The AoA data from a single sensor was crossed-checked with G forces on the airframe - exactly the two independent data points Yars is talking about. Then they added the stall protection requirement. Problem is there’s no increase in G load as you approach stall, so the G force cross-check was removed, making MCAS input dependent on just the single AoA sensor.
It’s a classic case of all the engineers sitting in their office cubes, each looking at their square inch of the system. No one was looking at the big picture on an ongoing basis.
I also fault Boeing for their decision to completely omit MCAS from the MAX’s documentation and training. It’s not possible to provide scenario-based training for every possible failure, but flight crews need to be aware of the systems on the aircraft and how they can behave. A well-understood technique for stopping runaway trim on the older 737s is a firm yank or shove on the yoke (in the direction opposite to the runaway). This technique, however, did not work for a runaway MCAS event on the MAX. The Ethiopian pilots tried this technique repeatedly, indicating that they hadn’t gotten the memo. Calling the Malaysian and Ethiopian flight crews incompetent is unfair. Inadequately trained is a much better characterization.
Apart from sorry design, Boeing apparently presumed ( ? ) that aircrews would be able to deal with “uncommanded” trim issues, regardless of their origins.
Mac McClellen wrote a truly great piece titled “can Boeing trust pilots.” You still can access it at:
airfactsjournal dot com /2019/03/can-boeing-trust-pilots/
1 reply
Andy:
Politely, lack of training can be a major contributor to a crew’s incompetence.
“Boeing apparently presumed that aircrews would be able to deal with “uncommanded” trim issues…” This presumption, combined with the failure to document the behavior of MCAS, amounts to cognitive dissonance.