Ethiopian Airlines Crash/ B737MAX grounding

theguzman · 14-03-2019 12:02AM

Dante7 wrote: »

Following the revelation that Lion Air hadn't purchased the option that would have alerted the flight crew to the dodgy sensor, I was wondering whether Ryanair had purchased this option. On one hand, Ryanair get lambasted as being a cheap no frills airline, but on the other hand they have a superb safety and maintenance record. I doubt if Ryanair skimped on that option with their order.

The very fact that something as important as that is classified as an pption shows up Boeing in a very bad light. Imagine a modern day Lada equivalent car (Dacia) having Airbags or crumble zones as optional extras. There would be uproar, Aviation safety features like this should be mandatory as it is far more serious as you can't recover when in the Sky.

Irish Steve · 14-03-2019 12:42AM

It's far from all over for the Max, but Boeing are going to have to work very hard to remedy the damage caused to their reputation by these 2 losses, and the underlying issues around the updates to make it similar to the earlier generations, even more so, as it seems that Southwest are already making changes to the AOA information displays that are not standard on pretty much all other Max versions. It's a link embedded in an earlier post,

https://theaircurrent.com/aviation-safety/southwest-airlines-is-adding-new-angle-of-attack-indicators-to-its-737-max-fleet/

Boeing had already stated that there were software changes coming, and I suspect that they already know a lot more about the Lion accident than they wanted to admit, clearly Southwest have pushed Boeing very hard to make changes that make the AOA issues easier to recognise and manage, and I suspect that before this is played to a conclusion, there will be other changes mandated that will make the system less vulnerable to errors, and some of the optional systems that have been mentioned may well be mandated as compulsory.

What's worrying at the moment is that there were also reported problems with unreliable airspeed from the Ethiopian aircraft. That might be as a result of chasing a wrong AOA indications, but the other possible worry is that there is another (possibly unrelated) issue that when combined with the AOA issue made it very hard to determine what was going on, and how to manage it.

At this stage, in answer to some of the people asking why they didn't just operate the appropriate switches, the answer to that may be very simple, if the pitch trim system has wound in a lot of out of trim change, the physical effort required to maintain the correct flight profile will be high, possibly very high, and if the pilot flying was having to fight high control loads, the ability of that pilot to do anything else, like lean sideways to operate switches on the floor, is simply not there, just maintaining the correct yoke position to stay in stable flight is going to require pretty much 100% of the flying pilot's ability, it may not be even possible to remove one hand from the control yoke to make changes the throttles if the loads are high enough. Yes, the second crew member should be able to make such a change, or operate switches or throttles, but that requires the crew to be in a position to communicate that requirement, and in theory, in the middle of a major crisis, the second crew member will be trying to deal with the appropriate check list and operating procedure checks to try and determine what's wrong, and how to fix it.

It doesn't have to be a big aircraft for that sort of thing to happen. In a small 6 seater twin, (PA39) I had a problem with the elevator trimmer, where it wound a lot of nose down trim in due to an electrical sensor fault, and it was only after a while that the autopilot could no longer hold the correct yoke position, so the aircraft started to descend at a higher rate than was wanted, and this happened during an approach, so the ground wasn't far away. When it became apparent that there was something wrong, the first move was to disconnect the autopilot to regain the correct descent rate. What actually happened was that as the autopilot disconnected, the yoke went to full nose down with a bang, and a massive 2 hand pull was then required to get it back to the position needed, and once the correct profile had been regained, it was then a case of getting back into trim. That wasn't easy, as the electric trimmer was the problem, and the circuit breaker for it had tripped as the disconnect was done, so it couldn't be used to correct the problem. The reason for the control loads was that it was an all flying tailplane, so incredibly powerful and capable of exerting a significant control load on the yoke if it was badly out of trim, which in this case, it now was.

I was single crew, so no one to help, and it needed a LOT of pull to keep the yoke in the right place, the only solution was a knee under the yoke and a foot on to the bottom of the instrument panel to free up one hand in order to be able to operate the manual trim handle, which was mounted in the roof above the centre of the cockpit, and it needed a good few turns of the handle to get things back to a more manageable setting. The few seconds of descent and dealing with the issue meant a rapid loss of about 300 Ft, which ATC noticed on their radar return, they asked if there was a problem, and at that stage, I was able to reply "not any more, just had a pitch trim runaway to deal with, it's sorted now", so they were happy to let me continue the approach. For a few seconds, working out the "what" and "why" and then the right fix was a very definite and significant increase in heart rate, in that you're not expecting something like this to happen.

If the Lion and Ethiopian crews were faced with multiple issues, and were unprepared for what was happening, and didn't know that it was an aircraft system that was causing it to repeat, I can fully understand why they were both confused and unable to resolve the situation. From what's coming out of the woodwork now, it seems that Boeing know a lot more than they've openly acknowledged, which is why the software modifications are already well advanced, and that's why Southwest are making the changes they are making, to ensure that no one is caught out by this scenario in future.

In one respect, if it's a software issue, that will be a good thing, we already know how long it took to get to the bottom of the rudder hard over issue on the earlier generation of 737's, and if you want a sobering read, then an article about those issues from the time will for sure get your attention, a friend of mine posted a link to it earlier today, and it was seriously thought provoking.

https://www.airspacemag.com/flight-today/probable-cause-29233123/

The 737 has been around a very long time, and has been a fundamentally good aircraft, but there are now concerns that it may have been stretched and pushed just a little too far, and while the latest iteration is visually very similar, it's not really a 737 any more, so they've done things to it to make it seem like a 737, and fly like the earlier versions, to avoid all sorts of certification and training issues for the airlines. It's looking like they may not have got it right at the moment, and how that will be resolved is very much uncertain, which I suspect is why they have agreed with the worldwide grounding.

There can be no doubt that this will hurt Boeing. There is now going to be a cloud over their current 737 models, and none of their customers will be taking delivery of Max models any time soon, depending on what the findings of the various investigations come out with. At best, there will be a short term hole in deliveries, but if the investigation of the 2 hull losses finds other issues, it may take a while before the fleet starts moving again. Longer term, there will be pressure on Boeing to come up with a new design of narrow body, but that's not going to be quick or easy, or cheap, a lot is going to depend on what is found over the next few months, and how both the FAA and EASA respond to the results of the findings.

They make somewhere around 50 a month, it won't be long before they stop the lines if a fix and lifting the flight ban is not short term, if nothing else, they won't have the space to park them all in, among other issues.

The next few weeks are definitely going to be interesting!

prinzeugen · 14-03-2019 01:32AM

Shn99 wrote: »

Crazy that people are making statements such as “it’s all over for the MAX” ect. If you think this is the end of the MAX, trust me it’s not

I doubt the public will agree. The 737 MAX might suffer the same fate as the Comet.

You can fix the problem but the PR damage has been done.

gctest50 · 14-03-2019 01:48AM

theguzman wrote: »

The very fact that something as important as that is classified as an pption shows up Boeing in a very bad light. Imagine a modern day Lada equivalent car (Dacia) having Airbags or crumble zones as optional extras. There would be uproar, Aviation safety features like this should be mandatory as it is far more serious as you can't recover when in the Sky.

Why does it show them in a bad light ?

To use your example :

"Dacia bosses expect the new Duster to retain the old model’s three-star Euro NCAP safety rating. However, an optional safety pack will be made available, bringing autonomous braking and active safety tech, which will likely add another star to its score."

murphaph · 14-03-2019 06:53AM

gctest50 wrote: »

Why does it show them in a bad light ?

To use your example :

"Dacia bosses expect the new Duster to retain the old model’s three-star Euro NCAP safety rating. However, an optional safety pack will be made available, bringing autonomous braking and active safety tech, which will likely add another star to its score."

?
It's looking increasingly like Boeing designed MCAS to rely on a single sensor of a pair. The least they could do would be to warn the crew that the pair disagree. That warning system should never have been optional.

Nijmegen · 14-03-2019 06:54AM

I wonder why (apart from cost?) they don’t just have 3 of every critical sensor, so they can poll them if one fails and keep going safe in the knowledge that 2 are usually going to be in agreement.

plodder · 14-03-2019 07:24AM

vectorvictor wrote: »

I would imagine they did - they know there's no price on safety. Quite why something so important is "optional" is another question.

An obvious simple win for Boeing is to make it standard and retrofit it to the fleet. I presume it's just a software update anyway.

Shn99 · 14-03-2019 07:35AM

prinzeugen wrote: »

I doubt the public will agree. The 737 MAX might suffer the same fate as the Comet.

You can fix the problem but the PR damage has been done.

The rudder hardcover issues in the 1990s didn’t spell the end for the 737 did it? No. It’s the most popular jet in the world.

It might suffer the same fate as the comet? Pfft.

As for the public, in a months time they’ll have moved onto who Kim kardashian has bedded next.

vicwatson · 14-03-2019 07:40AM

prinzeugen wrote: »

I doubt the public will agree. The 737 MAX might suffer the same fate as the Comet.

You can fix the problem but the PR damage has been done.

People in general have short memories and this is not the same as the comet as we live in a very different time of aviation where flying is two a penny, no longer a luxury item.

L1011 · 14-03-2019 08:10AM

It depends on how long it takes to resume service and how much of an event the media make out of it. If they can sort of quietly resume during a busy news period it'll get forgotten

Worst case scenario is huge media attention and another incident, even if recovered, shortly afterwards

Bob24 · 14-03-2019 09:24AM

Dante7 wrote: »

Following the revelation that Lion Air hadn't purchased the option that would have alerted the flight crew to the dodgy sensor, I was wondering whether Ryanair had purchased this option. On one hand, Ryanair get lambasted as being a cheap no frills airline, but on the other hand they have a superb safety and maintenance record. I doubt if Ryanair skimped on that option with their order.

Am I the only one thinking Boeing will have no choice but making this a feature on all the planes rather than offering it as part of an optional package?

I mean, assuming it is confirmed the feature would have prevented one (maybe 2) crashes, can they really let any plane operate without it? (not only in the interest of safety, but also in their own selfish interest as planes crashing is obviously not good for their business)

Brennus335 · 14-03-2019 09:33AM

Bob24 wrote: »

Am I the only one thinking Boeing will have no choice but making this a feature on all the planes rather than offering it as an optional package?

I mean, assuming it is confirmed the feature would have prevented one (maybe 2) crashes, can they really let any plan operate without it?

Just to clear this up. The optional AoA indicator on the PFD is not designed as a warning system. It's just an extra piece of information, a bit like the Flight Path Vector indicator. All it shows is the current indicated angle of attack.
Yes, it could be useful info in diagnosing an erroneous signal, but that is not its primary purpose.

plodder · 14-03-2019 09:38AM

I've seen reference to an optional "AOA disagree warning light" which sounds more than just the indicator mentioned above.

Two separate options apparently.

Bob24 · 14-03-2019 09:58AM

plodder wrote: »

I've seen reference to an optional "AOA disagree warning light" which sounds more than just the indicator mentioned above.

Two separate options apparently.

Yeah, of course journalists could be misunderstanding the issue, but this tallies with what you are saying: https://www.reuters.com/article/us-indonesia-crash-boeing-aoa/optional-warning-light-could-have-aided-lion-air-engineers-before-crash-experts-idUSKCN1NZ0QL

The are saying “Lion Air did not install the AOA DISAGREE alert, which warns pilots when the angle of attack (AOA) readings do not match, because it is optional”. If this is correct, it doesn’t seem to be a current AOA indicator we are talking about but rather a warning that AOA readings might be erroneous?

Irish Steve · 14-03-2019 10:12AM

Bob24 wrote: »

Am I the only one thinking Boeing will have no choice but making this a feature on all the planes rather than offering it as an optional package?

I mean, assuming it is confirmed the feature would have prevented one (maybe 2) crashes, can they really let any plane operate without it? (not only in the interest of safety, but also in their own selfish interest as planes crashing is obviously not good for their business)

I think we can assume that the issue here is that the testing plan was flawed, I've seen it on many occasions, a piece of software is written, and then tested for correct operation, and when it produces the expected result, it's approved. All good you may think, but the fact that it produces the expected result does NOT mean it's been tested, in that (as has been so graphically shown) the testing scenario has to also be run using invalid, or worse, data, to ensure that the result does not cause massive problems as a consequence of spurious data going in.

In some cases, additional parallel inputs are used to provide a health check, and if one of the 3 inputs is out of line with the other 2, then the system can ignore the wrong input, or other inputs are used to provide a similar check of the sanity of the input.

This sort of error is not new, (do a search on 737 radalt crash for more details, and you'll find reports of a 737-800 crash at Amsterdam as a result of a single source failure that the crew missed) it's happened before, where following the information on one instrument or display resulted in catastrophic results.

I find it more than incredible that Boeing still considered it safe to rely on one source for a system that has the ability to significantly upset the aircraft, and less than credible that the FAA did not raise a warning flag about doing so, I don't know if it was deemed insignificant, or if someone "nodded it through" and it never actually came up as a potential issue. Even more incredible is that a warning system to raise crew awareness of a problem was "an option". How do you assign the blame for an accident on a bean counter that decided the cost of an optional system on the flight deck was not justified? In that scenario, it will be all too easy to find "pilot error" as the cause, but if the pilots were kept in the dark by an absence of a warning of a problem, should they be blamed if things go wrong? I'd not like to have to deal with the legal implications of such a decision, and I suspect that somewhere along the line, a court somewhere is going to be having to do exactly that over these accidents.

This pair of accidents has the potential to be a game changer for the industry, in as significant a way as Kegworth did.

Either way, there are some questions to be answered here that may produce uncomfortable answers over a period of time.

Anteayer · 14-03-2019 10:17AM

L1011 wrote: »

It depends on how long it takes to resume service and how much of an event the media make out of it. If they can sort of quietly resume during a busy news period it'll get forgotten

Worst case scenario is huge media attention and another incident, even if recovered, shortly afterwards

The biggest difference between this and similar incidents in the past is public perception isn't driven by the sensible side or the media and convincing journalists about facts, rather it's all about social media and something like this can very easily cause a panic about a particular brand.

Unfortunately, even in the highly regulated, risk adverse and safe world of commercial aviation, you will still get the very odd incident that from something unforseen.

cnocbui · 14-03-2019 10:37AM

It's rather shocking to think all those people might well be alive today if Boeing hadn't actively hidden the MCAS system from the pilots by burying it in the maintenance manuals. It would seem to me that if the pilots on the Lion Air flight had just deployed 10° of flaps, the MCAS would have been turned off and the plane could have just returned to the airport.

Brennus335 · 14-03-2019 11:12AM

plodder wrote: »

I've seen reference to an optional "AOA disagree warning light" which sounds more than just the indicator mentioned above.

Two separate options apparently.

Possibly. I haven't heard of that option before though.
My type is a bit more modern and uses a voting system to vote out any erroneous signals. There's no AoA Disagree caution though.

plodder · 14-03-2019 12:26PM

Brennus335 wrote: »

Possibly. I haven't heard of that option before though.
My type is a bit more modern and uses a voting system to vote out any erroneous signals. There's no AoA Disagree caution though.

I guess if there are only two sensors then you would need a disagree alert. If there are three, then you can use a voting procedure.

I'm not actually sure now whether this was one option or two though. It hardly makes sense to have the alert, but not the indicator.

Reati · 14-03-2019 01:01PM

Irish Steve wrote: »

I

if you want a sobering read, then an article about those issues from the time will for sure get your attention, a friend of mine posted a link to it earlier today, and it was seriously thought provoking.

https://www.airspacemag.com/flight-today/probable-cause-29233123/

A sobering view is in the first few lines given what I've read was similar response to the Lion air crash.

Boeing claimed the crash—which killed all 132 people on board—was caused by pilot error.

A series of clues unearthed through meticulous detective work pointed to a problem in Flight 427’s power control unit, a hydraulic device that controls the movement of the rudder.

Jaggo · 14-03-2019 05:22PM

Many of the changes introduced to the Max, were to ensure that pilots didn't need new training and the plane wouldn't need recertification. If the corrections are significant will the plane need to be recertified etc? Would the delays bot be extensive?

MJohnston · 14-03-2019 05:27PM

A pretty technical dive into the similarities in the ADS-B data between the two 737MAX crashes here (although they don't note the AGL/MSL discrepancy that FlightRadar is bad at displaying):
https://arstechnica.com/information-technology/2019/03/faa-acting-chief-says-satellite-data-provided-link-between-boeing-crashes/

Widdensushi · 14-03-2019 09:04PM

Are the pilots flying the planes at all ?I realise that the autopilot does the majority but surely when something looks /feels wrong the pilot flicks a switch and flies manually till the problem is found. They were high enough for the pilots to have time to take control ?

ED E · 14-03-2019 09:11PM

Widdensushi wrote: »

Are the pilots flying the planes at all ?I realise that the autopilot does the majority but surely when something looks /feels wrong the pilot flicks a switch and flies manually till the problem is found. They were high enough for the pilots to have time to take control ?

My understanding is MCAS is independent of AP. If a pilot flying resumes manual control that does not disable MCAS.

Simply dropping out of autopilot mode does not instantly solve such problems, Air France 447 showed that.

Irish Steve · 14-03-2019 09:41PM

Widdensushi wrote: »

Are the pilots flying the planes at all ?I realise that the autopilot does the majority but surely when something looks /feels wrong the pilot flicks a switch and flies manually till the problem is found. They were high enough for the pilots to have time to take control ?

What is becoming increasingly the case, if the pilots are operating the aircraft, rather than the automation, the automation takes the input made by the pilots, and then the automation makes their requirements happen, while making sure that what they are trying to do does not put the aircraft in an unsafe operation mode.

Direct unaided control of the aircraft would be very rare these days, due to the changes that have happened over time, and that is very much the case with the Max, in that it has a new system (MCAS) that is specifically there to modify the way the aircraft flies, and that is the case in automatic flight, and even more so in pilot controlled flight, to make it operate in the same way as the earlier generations of 737.

Where the problems are apparently occurring at the moment with the Max is that the new MCAS system (not previously used on the 737) is still operating, and if the AOA sensor(s) are providing incorrect input, that is then resulting in MCAS attempting to prevent a stall by winding in nose down trim, which is causing the aircraft to descend. That is a very undesirable situation, even more so if the aircraft is only 1000 Ft above terrain.

Depending on how much trim it winds in, the control loads that the crew have to apply to overcome the MCAS error may be significant, due to the design of the aircraft. That may then significantly limit their ability to operate any other controls or switches, simply because of the physical effort needed to overcome the MCAS.

While it's not yet been confirmed, that would seem to be the reason for the grounding, it seems that the MCAS error is making it impossible for the crew to continue to fly the aircraft safely. It was mentioned that "new information from the crash site" has been significant in guiding the decision to ground.

I am going to suggest that one of the things the people on the ground were looking at was the relative positions of the trimming system of the elevator, and if it was significantly nose down, that will have provided a big clue as to what may have caused the crash.

NH2013 · 14-03-2019 09:44PM

Widdensushi wrote: »

Are the pilots flying the planes at all ?I realise that the autopilot does the majority but surely when something looks /feels wrong the pilot flicks a switch and flies manually till the problem is found. They were high enough for the pilots to have time to take control ?

The problem with this MCAS is that it is not stopped by turning off the Autopilot, and still works away in the background as the pilots are hand-flying and fighting against it. There are separate switches to turn it off, switches that typically pilots would go entire careers without using on the real aircraft, but may have to use in a split second in order to stop the MCAS before the situation becomes unrecoverable, and typically pilots don't like quickly jumping on switches and flicking them at the drop of a hat but are instead typically instructed and practise taking time to make decisions and agreeing on an outcome between them before just jumping in and flicking switches, so it's counter intuitive.

The regulator has decided by grounding the aircraft that this procedure for recognising the MCAS acting on false signals and applying full nose down trim and then cutting it out is not sufficient and that the average pilot would not be able to carry out the procedure quick enough to avoid loss of control, therefore the risk is too high to keep the aircraft in the air.

keroseneboy · 15-03-2019 12:43AM

I was suprised to see 737 MAX8 aircraft in the air over continental US this evening. Some in Canada too. The airlines concernes were American, Southwest and Air Canada.

Shn99 · 15-03-2019 07:27AM

keroseneboy wrote: »

I was suprised to see 737 MAX8 aircraft in the air over continental US this evening. Some in Canada too. The airlines concernes were American, Southwest and Air Canada.

They are allowed to position back home without pax

Quin_Dub · 15-03-2019 09:12AM

Irish Steve wrote: »

What is becoming increasingly the case, if the pilots are operating the aircraft, rather than the automation, the automation takes the input made by the pilots, and then the automation makes their requirements happen, while making sure that what they are trying to do does not put the aircraft in an unsafe operation mode.

Direct unaided control of the aircraft would be very rare these days, due to the changes that have happened over time, and that is very much the case with the Max, in that it has a new system (MCAS) that is specifically there to modify the way the aircraft flies, and that is the case in automatic flight, and even more so in pilot controlled flight, to make it operate in the same way as the earlier generations of 737.

Where the problems are apparently occurring at the moment with the Max is that the new MCAS system (not previously used on the 737) is still operating, and if the AOA sensor(s) are providing incorrect input, that is then resulting in MCAS attempting to prevent a stall by winding in nose down trim, which is causing the aircraft to descend. That is a very undesirable situation, even more so if the aircraft is only 1000 Ft above terrain.

Depending on how much trim it winds in, the control loads that the crew have to apply to overcome the MCAS error may be significant, due to the design of the aircraft. That may then significantly limit their ability to operate any other controls or switches, simply because of the physical effort needed to overcome the MCAS.

While it's not yet been confirmed, that would seem to be the reason for the grounding, it seems that the MCAS error is making it impossible for the crew to continue to fly the aircraft safely. It was mentioned that "new information from the crash site" has been significant in guiding the decision to ground.

I am going to suggest that one of the things the people on the ground were looking at was the relative positions of the trimming system of the elevator, and if it was significantly nose down, that will have provided a big clue as to what may have caused the crash.

Looks like your suggestion was fairly accurate.

Piece Found at Boeing 737 Crash Site Shows Jet Was Set to Dive

A screw-like device found in the wreckage of the Boeing Co. 737 Max that crashed last Sunday in Ethiopia indicates the plane was configured to dive, a piece of evidence that helped convince U.S. regulators to ground the model, a person familiar with the investigation said late Thursday night.

deandean · 15-03-2019 10:05AM

Ouch. More similarities with the Lion Air crash... https://www.breakingnews.ie/world/pilot-of-stricken-ethiopian-plane-called-in-emergency-soon-after-take-off-911153.html

Friday’s report cites “a person who reviewed air traffic communications” from Sunday’s flight saying controllers noticed the plane was moving up and down by hundreds of feet, with its speed appearing unusually fast.
Satellite-based data showed that both the Ethiopian Airlines and Lion Air planes flew with erratic altitude changes that could indicate that the pilots were struggling to control the aircraft. Both crews tried to return to the airport.

Ethiopian Airlines Crash/ B737MAX grounding

Comments