5 ms·

> If you know what's going on, MCAS is quite safe - there are two highly visible switches that kill electric trim completely (thus disengaging MCAS) and allow t

> If you know what's going on, MCAS is quite safe - there are two highly visible switches that kill electric trim completely (thus disengaging MCAS) and allow the pilots to take manual control. Activating these switches is a memory item (i.e. pilots have to memorize the checklist) for runaway trim and would be universal across 737 variants. > Unfortunately, it appears that both the Lion Air pilots and the Ethiopian Airlines pilots did not recognize that this was a runaway trim issue at all (or until it was too late). If the Ethiopian Airlines disaster turns out to have an identical cause to the Lion Air crash, one has to question why the pilots did not take this simple corrective action. Not quite: While the runaway trim checklist is a memory item, the symptoms that pilots train on in simulator presents runaway trim as a continuous event (the "classic" runaway trim being a relay becomes stuck and the trim just extends continuously). So while they've trained on the correct response to save the plane, they've never actually been exposed to the symptoms that an "MCAS runaway" presents (stick shaker on the AOA too steep side when the plane is patently not in stall combined with speed warnings and an uncommanded nose-down that goes away for several seconds when the stick is pulled back). The "backs off" part is critical when combined with the speed warning alerts and lack of continuous trim, because this makes the nose down easy to interpret as coming from the 737's speed trim system, which has existed for decades, and the net result is that the combination of symptoms seems to overload/confuse the pilots. We have, now, at least 3 documented examples of "MCAS runaway" -- the two downed flights, and the prior Lion Air flight in which a deadheading pilot in the jump seat did suggest to cut the automatic trim, but ONLY AFTER several minutes of confusion in the cockpit. And even after disabling it, they re-enabled the auto trim initially and only re-cut it out when symptoms re-occured. Which all boils down to: The MCAS system is in no way "quite safe". Safety is not a single line of defence, and the fact that at least 3 sets of pilots have struggled to identify the correct response to the MCAS issue indicates that the design of the system is flawed, because no system is safe when its sole and only fallback relies on humans 100% providing the correct response to a never-before-seen set of symptoms.

cal5k 8y ago
I understand, that's why I mentioned that the pilots didn't recognize that it was a runaway trim issue. After the Lion Air crash, however, this information was widely disseminated by the manufacturer. If the Ethiopian Airlines pilots were not properly trained on this new scenario then there was clearly a breakdown somewhere in the chain of communication.
- yason 8y ago
  There is some cognitive limit of how many variants of procedures pilots can be expected to memorise and execute. Detecting a classic constant runaway trim is an old drill for pilots. Detecting a trim that gradually runs away, then stops to make the situation look normal, then runs away again until the plane is way off level flight is a new failure pattern. It works for non-critical software where users can learn workarounds for only those problems they happen to encounter. But it doesn't, in the long run, work for cases like aviation where there is a known but growing set of special conditions that the pilots need to learn and remember even if they don't ever bump into them.
nas 8y ago
Some comments based on my understanding of the situation. I'm an engineer and I'm interested in the study of engineering failures. So, I have been following this. Initially I was thinking the blame was being unfairly placed on the MCAS system. However, now I understand more, I suspect it is a serious safety problem. The reason is as you say, MCAS runaway (e.g. due to a failed AoA sensor) does not behave like a normal runaway trim (e.g. continuous trim movement). That is key. Watching Youtube videos was helpful in understanding what the pilot experiences. I initially thought the pilot should easily notice the trim moving because of the large trim wheel beside them. However, in normal takeoff, the trim is being adjusted automatically and so pilots learn to ignore it changing. Second, I think with the 737 MAX, the sound made by the trim wheel has been changed (removed)? Using the stab trim cutout switches is a drastic measure (occurs as nearly last item on memory checklist) and, as I understand it, the only way to stop a misbehaving MCAS from doing its bad work. If the pilots are even a little slow in figuring out what's happening, I can easily imagine that leading to disaster. Also, if they to realize the problem and flick the switches off, manually cranking the trim wheel the other way takes time and it takes some serious physical strength to do it. I can imagine that if the MCAS moves the trim fully the wrong way, the pilots might not be able to fix it quickly enough.
- msbarnett 8y ago
  > The reason is as you say, MCAS runaway (e.g. due to a failed AoA sensor) does not behave like a normal runaway trim (e.g. continuous trim movement). That is key. Watching Youtube videos was helpful in understanding what the pilot experiences. I initially thought the pilot should easily notice the trim moving because of the large trim wheel beside them. However, in normal takeoff, the trim is being adjusted automatically and so pilots learn to ignore it changing. Yeah, that's the 737's Speed Trim system. Even before the MCAS, automatic trim adjustments to adjust for the '37s behaviour at different speeds were a constant thing in the cockpit. It seems like one possibility here is that pilots may be mistaking or unable to distinguish (since there's no real differentiation) the MCAS' trim adjustments from normal Speed Trim adjustments -- and keep in mind a speed warning is going off the entire time they're fighting the MCAS, due to the malfunctioning AOA, so they may be primed to think "Speed Warning + Automated Trim periodically occurring == Speed Trim" and over-focus on the stall & speed warnings and ignore the trim component. > Also, if they to realize the problem and flick the switches off, manually cranking the trim wheel the other way takes time and it takes some serious physical strength to do it. I can imagine that if the MCAS moves the trim fully the wrong way, the pilots might not be able to fix it quickly enough. It's actually worse than that. If the AOA sensor is misbehaving, then it will never show a recovery after the MCAS applies an automatic trim adjustment, leading to the MCAS continuing to apply trim adjustments until the trim is at maximum. At this point, the aircraft is basically in a nose dive, and if they hit the trim cutout, it can be physically impossible to manually trim the aircraft An Avionics engineer discusses the issue here: https://www.satcom.guru/2019/03/aoa-vane-must-have-failed-boeing-fix.html https://www.satcom.guru/2019/03/aoa-vane-must-have-failed-bo... > The standard response to just hit the stabilizer cutout switches and manually trim is actually flawed. If the nose has been pushed down by significant mistrim (nose down stabilizer, nose up elevator), and as airspeed increases, it may not be possible to trim the stabilizer manually nose up without letting the elevator go to a neutral position. The reality, under the MCAS runaway scenario, trimming nose up immediately stops MCAS as well as trims the stabilizer back towards an in-trim position. At that point, you would be best off to cutout the stabilizer. > Many flight crews may not know that you have to relax the elevator to manually trim the stabilizer if the loads is too high. It also mentions that the techniques needed to relieve the forces enough to make trimming manually possible are not necessarily covered in Boeing's current manuals -- because they completely ignored the possibility of the MCAS trimming to max downwards.

cal5k 8y ago

I understand, that's why I mentioned that the pilots didn't recognize that it was a runaway trim issue. After the Lion Air crash, however, this information was widely disseminated by the manufacturer. If the Ethiopian Airlines pilots were not properly trained on this new scenario then there was clearly a breakdown somewhere in the chain of communication.

yason 8y ago
There is some cognitive limit of how many variants of procedures pilots can be expected to memorise and execute. Detecting a classic constant runaway trim is an old drill for pilots. Detecting a trim that gradually runs away, then stops to make the situation look normal, then runs away again until the plane is way off level flight is a new failure pattern. It works for non-critical software where users can learn workarounds for only those problems they happen to encounter. But it doesn't, in the long run, work for cases like aviation where there is a known but growing set of special conditions that the pilots need to learn and remember even if they don't ever bump into them.

nas 8y ago

Some comments based on my understanding of the situation. I'm an engineer and I'm interested in the study of engineering failures. So, I have been following this. Initially I was thinking the blame was being unfairly placed on the MCAS system. However, now I understand more, I suspect it is a serious safety problem. The reason is as you say, MCAS runaway (e.g. due to a failed AoA sensor) does not behave like a normal runaway trim (e.g. continuous trim movement). That is key. Watching Youtube videos was helpful in understanding what the pilot experiences. I initially thought the pilot should easily notice the trim moving because of the large trim wheel beside them. However, in normal takeoff, the trim is being adjusted automatically and so pilots learn to ignore it changing. Second, I think with the 737 MAX, the sound made by the trim wheel has been changed (removed)? Using the stab trim cutout switches is a drastic measure (occurs as nearly last item on memory checklist) and, as I understand it, the only way to stop a misbehaving MCAS from doing its bad work. If the pilots are even a little slow in figuring out what's happening, I can easily imagine that leading to disaster. Also, if they to realize the problem and flick the switches off, manually cranking the trim wheel the other way takes time and it takes some serious physical strength to do it. I can imagine that if the MCAS moves the trim fully the wrong way, the pilots might not be able to fix it quickly enough.

msbarnett 8y ago
> The reason is as you say, MCAS runaway (e.g. due to a failed AoA sensor) does not behave like a normal runaway trim (e.g. continuous trim movement). That is key. Watching Youtube videos was helpful in understanding what the pilot experiences. I initially thought the pilot should easily notice the trim moving because of the large trim wheel beside them. However, in normal takeoff, the trim is being adjusted automatically and so pilots learn to ignore it changing. Yeah, that's the 737's Speed Trim system. Even before the MCAS, automatic trim adjustments to adjust for the '37s behaviour at different speeds were a constant thing in the cockpit. It seems like one possibility here is that pilots may be mistaking or unable to distinguish (since there's no real differentiation) the MCAS' trim adjustments from normal Speed Trim adjustments -- and keep in mind a speed warning is going off the entire time they're fighting the MCAS, due to the malfunctioning AOA, so they may be primed to think "Speed Warning + Automated Trim periodically occurring == Speed Trim" and over-focus on the stall & speed warnings and ignore the trim component. > Also, if they to realize the problem and flick the switches off, manually cranking the trim wheel the other way takes time and it takes some serious physical strength to do it. I can imagine that if the MCAS moves the trim fully the wrong way, the pilots might not be able to fix it quickly enough. It's actually worse than that. If the AOA sensor is misbehaving, then it will never show a recovery after the MCAS applies an automatic trim adjustment, leading to the MCAS continuing to apply trim adjustments until the trim is at maximum. At this point, the aircraft is basically in a nose dive, and if they hit the trim cutout, it can be physically impossible to manually trim the aircraft An Avionics engineer discusses the issue here: https://www.satcom.guru/2019/03/aoa-vane-must-have-failed-boeing-fix.html https://www.satcom.guru/2019/03/aoa-vane-must-have-failed-bo... > The standard response to just hit the stabilizer cutout switches and manually trim is actually flawed. If the nose has been pushed down by significant mistrim (nose down stabilizer, nose up elevator), and as airspeed increases, it may not be possible to trim the stabilizer manually nose up without letting the elevator go to a neutral position. The reality, under the MCAS runaway scenario, trimming nose up immediately stops MCAS as well as trims the stabilizer back towards an in-trim position. At that point, you would be best off to cutout the stabilizer. > Many flight crews may not know that you have to relax the elevator to manually trim the stabilizer if the loads is too high. It also mentions that the techniques needed to relieve the forces enough to make trimming manually possible are not necessarily covered in Boeing's current manuals -- because they completely ignored the possibility of the MCAS trimming to max downwards.