Sunday, March 31, 2019

Flight Data Results from Ethiopia 302 and the MCAS System - Smoking Gun or False Lead?



737 MAX throttle quadrant showing trim wheel and stab trim cutout switches (lower right).



The Wall Street Journal is reporting that, after preliminary analysis of flight data from the downed Ethiopian 737 (ET302), investigators now believe the controversial Maneuvering Characteristics Augmentation System (MCAS) activated and may have played a part in the accident.  This finding is significant because the MCAS system has now been implicated in both this crash and the Lion Air crash which occurred last year.

MCAS - What is It?


To recap, the MCAS system was installed on the 737 Max aircraft to mitigate some unique handling characteristics of the new model which differed from older 737s. Boeing originally chose not to document this new system in the aircraft flight manual, but has since briefed all Max operators on the existence and function of the system in the aftermath of the Lion Air crash.

Among the reasons Boeing engineers may have had for not including the system in the flight manual are that the system was only supposed to ever activate during aerodynamic stall conditions in manually controlled flight, which in normal operations would never be seen. Entire careers are flown without ever seeing an actual stall, so this rationale might have been thought sound.

The problem for the MCAS system wasn't necessarily its intended operation, which was to be rarely if ever seen, but rather any potential failure modes. Unintended activation of the system due to a mechanical fault has now been suggested as a factor in both Max crashes. Flight data from the Lion Air crash show the pilots repeatedly fighting the inputs from a misfiring MCAS system, and according to latest reports, the MCAS system also activated on the mishap Ethiopian airliner.

Adding to the controversy of the existence of an undocumented system is the revelation that the system can be activated by a single angle of attack (AOA) sensor. Angle of attack sensors measure the angle of the relative wind over the wings. Too great of an angle between the wing and the airflow over it will result in an aerodynamic stall wherein the wing stops producing lift.

The questions being asked involve the engineering decision to use the input of a single AOA sensor to trigger the MCAS system to operate. There are two (or more) AOA sensors installed on all airliners which among other things are used to provide "stick shaker" stall warning to pilots if they get too slow or approach a stall. Again, a stall is something that most airline pilots will never see outside of a training simulator where stall recovery is practiced routinely.

What Did the ET302 Pilots Know about the MCAS System?


Lion Air JT-610 crashed on October 29, 2018. The investigation of that crash first brought the MCAS system and a malfunctioning AOA sensor to light. On November 7th, Boeing released an Operations Manual Bulletin (OMB) to all 737 Max operators. This bulletin mentioned that erroneous AOA signals can cause the trim to run uncommanded by the pilot. The directed remedy is to apply the runaway stabilizer trim checklist which directs the use of the center pedestal mounted stabilizer trim cutout switches. The text of the bulletin is as follows:

The Indonesian National Transportation Safety Committee has indicated that Lion Air flight 610 experienced erroneous AOA data. Boeing would like to call attention to an AOA failure condition that can occur during manual flight only.

This bulletin directs flight crews to existing procedures to address this condition. In the event of erroneous AOA data, the pitch trim system can trim the stabilizer nose down in increments lasting up to 10 seconds. The nose down stabilizer trim movement can be stopped and reversed with the use of the electric stabilizer trim switches but may restart 5 seconds after the electric stabilizer trim switches are released. Repetitive cycles of uncommanded nose down stabilizer continue to occur unless the stabilizer trim system is deactivated through use of both STAB TRIM CUTOUT switches in accordance with the existing procedures in the Runaway Stabilizer NNC. It is possible for the stabilizer to reach the nose down limit unless the system inputs are counteracted completely by pilot trim inputs and both STAB TRIM CUTOUT switches are moved to CUTOUT.
Additionally, pilots are reminded that an erroneous AOA can cause some or all of the following indications and effects:

- Continuous or intermittent stick shaker on the affected side only.
- Minimum speed bar (red and black) on the affected side only.
- Increasing nose down control forces.
- Inability to engage autopilot.
- Automatic disengagement of autopilot.
- IAS DISAGREE alert.
- ALT DISAGREE alert.
- AOA DISAGREE alert (if the AOA indicator option is installed)
- FEEL DIFF PRESS light.

In the event an uncommanded nose down stabilizer trim is experienced on the 737 - 8 / - 9, in conjunction with one or more of the above indications or effects, do the Runaway Stabilizer NNC ensuring that the STAB TRIM CUTOUT switches are set to CUTOUT and stay in the CUTOUT position for the remainder of the flight.

A subsequent Emergency Airworthiness Directive (EAD) directed this information to be included in the flight manual of all Max aircraft within three days.

In my view, it is reasonable to assume that the ET302 pilots were well aware of the MCAS system, its possible failure mode due to an erroneous AOA sensor, and the steps to be taken to remedy the malfunction.

Why Didn't They Just Turn it Off?


The investigation of the Lion Air crash has revealed that on the flight immediately preceding the mishap flight, an off-duty 737 qualified pilot was occupying the jumpseat. That aircraft also suffered the same malfunction of the AOA sensor resulting in uncommanded nose down trim. On that flight, however, the guest pilot recommended that the operating pilots use the stabilizer trim cutout switches, which they did. That flight landed uneventfully.

The pilots on the subsequent Lion Air flight fought against the nose down trim commands continually, but never did deactivate the electric stabilizer trim with the cutout switches. The errant automated trim commands eventually trimmed the aircraft into an unflyable condition.

It would seem easy to Monday morning QB the actions of the Lion Air mishap pilots, but it must be remembered that there were many other things happening at the same time. One important thing to note is that the stick shaker activated right at liftoff and continued for the entire flight. The stick shaker is a device that literally vibrates the control yoke when an aircraft approaches an actual stall. It is loud and disconcerting when activated. The pilots were no doubt startled and distracted.

Another point to note is that the MCAS inputs would not "present" like a traditional runaway trim situation. Typically, a runaway trim malfunction in a simulator would simulate a stuck switch where the trim wheel would run continuously in one direction. During the mishap Lion flight, the flight data recorder showed the pilot actively trimming back against the MCAS inputs followed by a few seconds delay when the MCAS system would reactivate and start trimming forward again.

Another system called "speed trim" installed on earlier and subsequent 737 models can also run the electric trim with the autopilot disengaged, so it is not completely unusual to see the trim wheel spinning by itself with the autopilot off. This "negative training" may have contributed to the pilots not focusing on the uncommanded movement of the trim wheel even though speed trim only functions with flaps extended while the MCAS system only functions with the flaps retracted.

What Happened Then on ET302?


The flight data recorder and cockpit voice recorders from ET302 have been recovered and sent to France where they were downloaded and decoded by the BEA, the French equivalent of the NTSB. The data from the recorders have not been released to the public, however investigators have an "emerging consensus" that the MCAS system activated and contributed to the accident. The story also noted that this preliminary finding is subject to revision.

The pilots of ET302, however, had something that the Lion pilots did not, and that is a detailed description and knowledge of the MCAS system and the procedure to disable it by throwing two easily reached switches. Without more information from the accident investigation, it is simply too early to reach any definitive conclusions about the fate of that airliner.



Thursday, March 14, 2019

What's Next for the Max?






As an aviation blogger, the past few days have been simultaneously hope inspiring and depressing. Hope inspiring as many people understand, or make a good faith attempt to understand, the underlying issues surrounding the 737 Max. But also depressing as random fanbois, trolls, and low information, yet self proclaimed experts, happen by my comments section to disgorge their dubious wisdom on things about which they know little or nothing.

Mencken was Right: No One Ever went Broke Underestimating the Intelligence of the Public


One commenter offered, based on no information other than two 737s had crashed, that all of them should be grounded. I pointed out that by that logic, it would be even more beneficial to ground all airplanes everywhere as it would be safer still. The response was "I didn't say all airplanes should be grounded" displaying an ironclad grip on logical fallacies.

When I noted that the MCAS system could be completely deactivated using two switches mounted on the center console, a commenter replied that well, "maybe the switches reconnected themselves". Other than the testing of those switches being a mandatory preflight item, this commenter has obviously confused the Boeing 737 with the SkyNet model T-1000 Terminator which can rewire itself automatically.

Lastly, when one commenter [Hi Scott!] boldly opined that the 737 was the worst airplane he'd ever flown on, I replied that my passenger experience is usually more dependent upon the particular airline and class of service rather than the aircraft type. This big brained person assured me, however, that no, none of that mattered. He apparently would rather sit in a non reclining 28 inch pitch economy seat on a Spirit A320 than a first class seat on a JAL 737.  [Sigh]

Public Relations and Marketing Wins


So the FAA bowed to international and media pressure and grounded all Max aircraft, which is proving to be a minor inconvenience to most operators of the aircraft. I was personally walking out to a Max to fly to Phoenix when the announcement came. Someone somewhere had done some preparations and an -800 was towed to the gate by maintenance about 10 minutes later for a slightly delayed departure.

We of course are now treated to the circular logic of all the "I told you so" stories. The process starts as media sensationalism whips up a gullible and credulous public followed by outraged calls for the aircraft to be grounded. After weather-vaning politicians cave into public pressure, preening media talking heads then get to state that something must have been really been wrong. And so it goes.

Make no mistake: this grounding has more to do with public relations and marketing than safety. As of yet, there is very little evidence that the two Max crashes are in any way related other than the most superficial of circumstances. But the tsunami of media scare stories and sensationalism showed no signs of abatement, so this was the correct decision. 

The FAA cited "newly" discovered satellite data which finally swayed their decision.They are referring to the ADS-B tracking system which relays flight parameters to air traffic control through satellite. This information, however, was publicly available shortly after the crash and it does show some minor altitude excursions, though nothing is conclusive.

The cockpit voice recorder and flight data recorder from the Ethiopian crash have been recovered and sent to France for analysis. Again, prescient commenters noted that this was a good thing because, of course, had they been sent to the US, American investigators would falsify any result finding the US producer of the aircraft at fault. I actually agree with this decision in spite of the slander against the integrity of the NTSB and other US investigators. Having French investigators analyze the data will deflect the inevitable cries of bias should the investigation find fault in anything except the aircraft itself.

What Next?


What happens next is we wait for the data from ET302 to be downloaded and released. When that happens and a likely cause of the accident can be discerned, the Max will be cleared to fly. Notice that I didn't say that this clearance will in any way be dependent on the outcome of the investigation. The aircraft will be flying again in a matter of weeks regardless of the findings.

Why you ask? Should the MCAS system be implicated in this crash (unlikely in my opinion), there will be software fixes and training updates offered. As I've noted many times, the system can be deactivated completely through the use of two center console mounted switches. Even then, the system should only activate in the case of gross pilot negligence resulting in an aerodynamic stall or, as in the case of the Lion crash, an errant sensor input due to a mechanical malfunction. 

The software fixes will preclude the activation of the system due to the failure of a single sensor. The training updates will reemphasize to all operators that undesirable electric trim inputs can be inhibited through the use of the center console mounted stab cutout switches. 

Should the MCAS system not be implicated in the ET302 crash, the Max will be back in the air that much sooner. Make no mistake, all airline crashes are tragedies of the highest order for everyone involved. The object of any investigation is to find out what happened and to take measures to prevent any future recurrence. Commercial aviation is one of the safest, if not the safest means of transportation available. 

What will be left is a mopping up by the lawyers.


Captain Rob Graves is a veteran airline pilot and retired Air Force officer. He currently flies a Boeing 737 for a major American airline where he has over 25 years of experience. His Air Force career included instructing future USAF pilots in the T-37 primary jet trainer, aerial refueling in the KC-135 Stratotanker, and conducting worldwide logistics in the C-5 Galaxy cargo aircraft. He is the author of This is Your Captain Speaking, an aviation blog. It can be found at robertgraves.com. He also writes for Avgeekery.com. 








Tuesday, March 12, 2019

Is the Boeing 737 Max 8 Safe?





737 Max 8


This past Sunday, an Ethiopian Boeing 737 Max 8 aircraft crashed shortly after takeoff from Addis Ababa to Nairobi with 157 passengers and crew. There were no survivors. This is the second crash of a Max 8 variant of the 737 in five months after the crash of a Lion Air Max 8 last October.

An undocumented system was brought under scrutiny in the Lion Air crash and now questions are being raised as to whether this same system, known as maneuvering characteristics augmentation system (MCAS), might have played a roll in this latest crash. If that is found to be the case, the safety of the aircraft itself will be called into question.

What We Know


At the current time, the cause of both accidents is unknown as the accident investigation is still underway on the Lion Air crash and the Ethiopian Air crash investigation is just getting under way. The flight data recorders and cockpit voice recorders have been recovered from both accidents and are being analyzed.

The flight recorder data from the Lion Air crash suggests that the pilots were having control difficulty due to erroneous inputs from the aircraft's MCAS system which itself received faulty inputs from a malfunctioning angle of attack (AOA) sensor. It is this errant sensor and its maintenance history that investigators are focusing on.

Initial reports from the Ethiopian Air crash suggest that the aircraft experienced control difficulties shortly after takeoff. Data from a flight tracking and reporting system known as ADS-B show highly unstable vertical velocity and airspeed readouts which were similar to the airspeed and altitude excursions of the Lion Air mishap aircraft.

Unconfirmed reports from listeners on the frequency reported that the Ethiopian pilots stated that they had unreliable airspeed indications and were declaring an emergency.

And right now, that's it. There are similarities, but no confirmation that the same system brought down both aircraft.

Is It Safe?


Given that we know little about the cause of the first accident and nothing about the cause of the second, a grounding of this model aircraft is premature. I am qualified and current in this model aircraft and am confident that it is as safe as any aircraft flying. Airplanes sometimes crash. It is always a tragedy when they do, but barring a definitive indictment of the design, there is no reason to overreact.

Even should the MCAS system be found primarily at fault, the system can be completely deactivated by two easily reached switches on the center console of the cockpit. Why the Lion Air pilots didn't take this action is unknown, but the investigation should eventually reveal the cause. A similar malfunction occurred on a previous flight of the mishap aircraft, and those pilots took the correct action and landed uneventfully. Questions as to why the aircraft flew again without being properly repaired should be asked.

In the event of unreliable airspeed, which can happen to any aircraft independent of model, routine practice of this malfunction in the simulator should make it a non-event. I recently underwent this training myself, but the basics of pitch and power date back to Wilbur and Orville. Recognition is the toughest part, but after that, known pitch and power settings will keep the aircraft from stalling and in control.

I don't mention these questions to cast blame, but rather to answer critics who don't understand aviation or engage in magical thinking. The Max is still a 737 at heart and flies nearly identically to the other four models of the aircraft that I have flown. So yes, it is safe, and I'd gladly put my family on one and fly it myself with no reservations.


Captain Rob Graves is a veteran airline pilot and retired Air Force officer. He currently flies a Boeing 737 for a major American airline where he has over 25 years of experience. His Air Force career included instructing future USAF pilots in the T-37 primary jet trainer, aerial refueling in the KC-135 Stratotanker, and conducting worldwide logistics in the C-5 Galaxy cargo aircraft. He is the author of This is Your Captain Speaking, an aviation blog. It can be found at robertgraves.com. He also writes for Avgeekery.com.