Ethiopian plane crash
Discussion
captain_cynic said:
The stall prevention part of MCAS is there to cover for a design flaw where the AoA can increase without input from the pilots (or flight control computers)... Trying to code that out in software is what lead to two fatal crashes in six months.
I haven't followed this really, but if that's what they've done, it's messed up. Something came up in another thread about criminal negligence being a thing and I was struggling to think how you'd manage it as a software engineer, but that would fit the bill for me.HughG said:
pushthebutton said:
Lemming Train said:
The Max airframe flies absolutely fine as proven by tens of thousands of uneventful flights all over the world since it entered commercial service a few years ago. The issue is a software issue. Wire up the other AoA sensor, recode the software so that MCAS doesn't activate if there's a mismatch between the sensor readings and add an additional big manual 'OFF' button, flight test the changes, recertify it, problem over.
Agree with this.George Smiley said:
Push the button why are you still on the agenda that this was a survable crash if only the pilots did something different?
Because it should have been, why in both this accident and the lion air one they didn't move the trim back as far as MCAS had moved it is a pretty important question.If they'd reacted to 2.4whatever it measures it in of AND with 2.4 of ANU they'd have been fine, confused, annoyed at the aircraft, a bit scared and saying lots of entirely deserved things about Boeing and the FAA but very much not dead.
Step 2 in the runaway trim checklist is to put the trim back where it should be. They got to step 5 and turned it off but why did they never get it where it was supposed to be first?
Having not moved it back all the way to where it should have been they rapidly got into a situation where there wasn't anything much they could do about it and then the aircraft killed them
768 said:
captain_cynic said:
The stall prevention part of MCAS is there to cover for a design flaw where the AoA can increase without input from the pilots (or flight control computers)... Trying to code that out in software is what lead to two fatal crashes in six months.
I haven't followed this really, but if that's what they've done, it's messed up. Something came up in another thread about criminal negligence being a thing and I was struggling to think how you'd manage it as a software engineer, but that would fit the bill for me.What they have done is implemented MCAS so that airlines don't have to re-certify all their 737 pilots, who would then be taught to fly the new plane within it's new envelope, and the danger of going outside that, and what to do about it.
Unfortunately the software in MCAS isn't good enough to identify a faulty sensor and try's to crash the plane. At which point the plan is to then fly around without allowing MCAS to do it's thing. Which kinda shows it's not a physical design issue. Because if you can remove the software that's trying to take control, and still fly about and land etc. Physically the thing is just fine. But the software is junk.
Munter said:
HughG said:
pushthebutton said:
Lemming Train said:
The Max airframe flies absolutely fine as proven by tens of thousands of uneventful flights all over the world since it entered commercial service a few years ago. The issue is a software issue. Wire up the other AoA sensor, recode the software so that MCAS doesn't activate if there's a mismatch between the sensor readings and add an additional big manual 'OFF' button, flight test the changes, recertify it, problem over.
Agree with this."Boeing fanboys".
What's your username on airliners.net, captain_cynic? Please tell me it's keesje. Edited by Lemming Train on Wednesday 10th April 10:53
George Smiley said:
Push the button why are you still on the agenda that this was a survable crash if only the pilots did something different?
It was definitely a survivable crash. It’s just a question of how difficult it was to sort it out based on the situation at the time.
The fault still rests squarely with Boeing and the FAA in my mind though.
El stovey said:
George Smiley said:
Push the button why are you still on the agenda that this was a survable crash if only the pilots did something different?
It was definitely a survivable crash. It’s just a question of how difficult it was to sort it out based on the situation at the time.
The fault still rests squarely with Boeing and the FAA in my mind though.
I work in high stress environments that have zero bearing on life and death but company failure. Completely different and yet even there the best run books and procedures can fail. f
k doing it with all the stuff these guys had to deal with. El stovey said:
George Smiley said:
Push the button why are you still on the agenda that this was a survable crash if only the pilots did something different?
It was definitely a survivable crash. It’s just a question of how difficult it was to sort it out based on the situation at the time.
The fault still rests squarely with Boeing and the FAA in my mind though.
Survivable crash? Into the ground like a dart...I doubt it .
JuniorD said:
El stovey said:
George Smiley said:
Push the button why are you still on the agenda that this was a survable crash if only the pilots did something different?
It was definitely a survivable crash. It’s just a question of how difficult it was to sort it out based on the situation at the time.
The fault still rests squarely with Boeing and the FAA in my mind though.
Survivable crash? Into the ground like a dart...I doubt it .
hutchst said:
pushthebutton said:
The pitch, roll and heading indications were most probably functioning as intended and so could've been relied on. They wouldn't have been affected by the AoA sensor.
Except that the extract from the report that you quoted earlier (at 5:38.44) noted that the left and right directors were deviating from one another. We know that the captain was PF, so in the absence of any other evidence should assume (at least at this stage) that he was following the left side, with outside references perhaps confirming accuracy. There is no indication that the captain was aware of the deviation, and he would certainly not be aware of the AoA disagree. The reason I mentioned it was that they were not flying in northern European clag with nothing but grey soup outside the windows.Pitch, AoA and speed are all related and so it's possible to fly a defined pitch and power setting and derive a speed from that. In effect, you're reversing the concept of flying using speed as a parameter, but achieving the same result. This is the concept of the UA checklist and is an equally valid method of flying the aircraft, as is using AoA and Power to achieve the desired speed (I think). The 737's pitch attitude information comes from the Inertial Reference Units:
"The IR component of an ADIRU gives attitude, flight path vector, ground speed and positional data.[1] The ring laser gyroscope is a core enabling technology in the system, and is used together with accelerometers, GPS and other sensors to provide raw data.[10] The primary benefits of a ring laser over older mechanical gyroscopes are that there are no moving parts, it is rugged and lightweight, frictionless and does not resist a change in precession."
...and is independent of the speed inputs. This is why it's used in the AU checklist. Roll is also derived from the IRUs in the same way - which is why I said that the aircraft was flyable in Pitch and Roll - so a visual reference wasn't necessary in this case. If you lose the IRUs in some way then you have a bigger problem and a visible horizon is very useful.
My terminology and system descriptions aren't 100% correct. I could make them so, but that would've meant this post would take me 3 times as long as it has.
George Smiley said:
Push the button why are you still on the agenda that this was a survivable crash if only the pilots did something different?
I believe I've backed up everything I've said.Do you have a particular part you disagree with?
It'd be useful if you could provide reasons why you disagree and show your workings.
pushthebutton said:
George Smiley said:
Push the button why are you still on the agenda that this was a survivable crash if only the pilots did something different?
I believe I've backed up everything I've said.Do you have a particular part you disagree with?
It'd be useful if you could provide reasons why you disagree and show your workings.
You’re focusing solely on the MCAS aspect of the accident and ignoring the initial failure, which was related to AoA.
60s elapsed between lift off and the beginning of the Flap retraction which ultimately led to MCAS activating incorrectly. There were several warnings that there was a problem with one of the AoA vanes including stick shaker activation. In any other 737 variant this was an Airspeed Unreliable scenario. Any pilot would be completely unable to deal with the MCAS intervention unless they had promptly and effectively dealt with the UA.
You seem to be entirely skipping the initial failure and appropriate actions and focusing on the consequence of not responding effectively to the secondary related failure. I’m not sure why? This was an UA airspeed scenario with a secondary related failure. Not responding in an appropriate and timely manner to UA will end in exactly the same way as this accident, MCAS or not.
As before, the above does not preclude a further unknown response from MCAS outside of the Boeing service bulletin. This remains to be seen and will hopefully form a part of any impartial investigation.
That last sentence just reminded me of the Fly Dubai crash in Rostov-on-Don. Was a report ever released? It’s over 3 years now.
60s elapsed between lift off and the beginning of the Flap retraction which ultimately led to MCAS activating incorrectly. There were several warnings that there was a problem with one of the AoA vanes including stick shaker activation. In any other 737 variant this was an Airspeed Unreliable scenario. Any pilot would be completely unable to deal with the MCAS intervention unless they had promptly and effectively dealt with the UA.
You seem to be entirely skipping the initial failure and appropriate actions and focusing on the consequence of not responding effectively to the secondary related failure. I’m not sure why? This was an UA airspeed scenario with a secondary related failure. Not responding in an appropriate and timely manner to UA will end in exactly the same way as this accident, MCAS or not.
As before, the above does not preclude a further unknown response from MCAS outside of the Boeing service bulletin. This remains to be seen and will hopefully form a part of any impartial investigation.
That last sentence just reminded me of the Fly Dubai crash in Rostov-on-Don. Was a report ever released? It’s over 3 years now.
Edited by pushthebutton on Wednesday 10th April 13:18
George Smiley said:
Why, if aoa canes are so reliable, are max ones failing so frequently
A valid question for sure. We don't know yet. Maybe there are some QC issues with the ones used on the Max that need addressing. We see this reduction in quality on items and products in many aspects of our lives where we discover they are not built to last but instead to a price point and designed to expire the day after the warranty runs out so you go out and buy a new one. Obviously that's not directly comparable to a 737 airframe, but it would be naive to think that Boeing hasn't pressured it's suppliers to reduce costs over the years and this generally translates into a reduction in quality. We already know from JT that they've used a company in Florida to "repair" at least one of theirs but whether that's because it just stopped working or whether it's because JT bent it remains unknown.Munter said:
It's not what they have done.
Figures, thanks.Munter said:
What they have done is implemented MCAS so that airlines don't have to re-certify all their 737 pilots, who would then be taught to fly the new plane within it's new envelope, and the danger of going outside that, and what to do about it.
Unfortunately the software in MCAS isn't good enough to identify a faulty sensor and try's to crash the plane. At which point the plan is to then fly around without allowing MCAS to do it's thing. Which kinda shows it's not a physical design issue. Because if you can remove the software that's trying to take control, and still fly about and land etc. Physically the thing is just fine. But the software is junk.
Not sure that quite follows for me - if hardware says the plane's going to stall, I'm don't how the software's supposed to know it's not telling the truth. Having software fly a plane with a dependency on hardware that isn't redundant seems like an obviously bad idea now matter how awesome your software is.Unfortunately the software in MCAS isn't good enough to identify a faulty sensor and try's to crash the plane. At which point the plan is to then fly around without allowing MCAS to do it's thing. Which kinda shows it's not a physical design issue. Because if you can remove the software that's trying to take control, and still fly about and land etc. Physically the thing is just fine. But the software is junk.
768 said:
Not sure that quite follows for me - if hardware says the plane's going to stall, I'm don't how the software's supposed to know it's not telling the truth. Having software fly a plane with a dependency on hardware that isn't redundant seems like an obviously bad idea now matter how awesome your software is.
I think you answer your own question there. Safety critical software shouldn't ever be written to act on the output of a single sensor. There are no infallible sensors (or pilots).The hardware did actually have a sensor providing the truth. It was just being ignored. That's really stupid given the 2nd sensor is right there, doing the same job, giving enough information to say something is wrong. The sensor that went wrong, also provided enough information over a short period of time to show it was faulty. Combined with information from other sensors, all of this should be enough to trip out the system and let the pilot deal with it. If the software was written sensibly. Which it wasn't. Hence it's being patched/rewritten.
AoA sensors might be very reliable. But Boeing have to have assumed they can fail, but then made some odd decisions on how the systems should work at the point one of two AoA sensors gives spurious readings.
pushthebutton said:
You’re focusing solely on the MCAS aspect of the accident and ignoring the initial failure, which was related to AoA.
60s elapsed between lift off and the beginning of the Flap retraction which ultimately led to MCAS activating incorrectly. There were several warnings that there was a problem with one of the AoA vanes including stick shaker activation. In any other 737 variant this was an Airspeed Unreliable scenario. Any pilot would be completely unable to deal with the MCAS intervention unless they had promptly and effectively dealt with the UA.
You seem to be entirely skipping the initial failure and appropriate actions and focusing on the consequence of not responding effectively to the secondary related failure. I’m not sure why? This was an UA airspeed scenario with a secondary related failure. Not responding in an appropriate and timely manner to UA will end in exactly the same way as this accident, MCAS or not.
As before, the above does not preclude a further unknown response from MCAS outside of the Boeing service bulletin. This remains to be seen and will hopefully form a part of any impartial investigation.
That last sentence just reminded me of the Fly Dubai crash in Rostov-on-Don. Was a report ever released? It’s over 3 years now.
I think we're all at cross purposes. I agree with you that, had the unreliable airspeed memory items been followed, the outcome would most likely have been different - in no small part because flaps would have neutralised MCAS.60s elapsed between lift off and the beginning of the Flap retraction which ultimately led to MCAS activating incorrectly. There were several warnings that there was a problem with one of the AoA vanes including stick shaker activation. In any other 737 variant this was an Airspeed Unreliable scenario. Any pilot would be completely unable to deal with the MCAS intervention unless they had promptly and effectively dealt with the UA.
You seem to be entirely skipping the initial failure and appropriate actions and focusing on the consequence of not responding effectively to the secondary related failure. I’m not sure why? This was an UA airspeed scenario with a secondary related failure. Not responding in an appropriate and timely manner to UA will end in exactly the same way as this accident, MCAS or not.
As before, the above does not preclude a further unknown response from MCAS outside of the Boeing service bulletin. This remains to be seen and will hopefully form a part of any impartial investigation.
That last sentence just reminded me of the Fly Dubai crash in Rostov-on-Don. Was a report ever released? It’s over 3 years now.
Edited by pushthebutton on Wednesday 10th April 13:18
The problem, of course, is that the unreliable airspeed memory items would only have saved them because of the MCAS neutralising effect.
The question for me (as a lay person) is this - should the unreliable airspeed memory items have been followed?
On the face of it, unexpected stick shaker activation should be a prompt to check for unreliable airspeed.
Looking at the FDR traces, the airspeeds differed by very little. Airspeed was increasing. A quick scan of the instruments followed by a request for the FO to call out airspeed say, and given the time difference between the two readings, could have led the captain to (erroneously) conclude that the two airspeeds were in sync. Perhaps by not looking directly at the airspeed indicator whilst listening to the FO readout. Or perhaps because, at the moment the shaker started, the airspeeds were still in sync? I don't know, of course.
On an NG AIUI there is a "IAS DISAGREE" flag on the instruments. What's the tolerance on that? Did it trigger? It is supposed to kick in if a difference of more than 5 knots for more than 5 seconds (on the NG). If it did not trigger, would the crew have resorted to the standby instrument? The report graph axes make it hard to make out what the discrepancy actually was.
Once the airspeed issue was dealt with (or not) they seem to have followed the AD and the runaway trim checklist, but got nowhere.
pushthebutton said:
You’re focusing solely on the MCAS aspect of the accident and ignoring the initial failure, which was related to AoA.
60s elapsed between lift off and the beginning of the Flap retraction which ultimately led to MCAS activating incorrectly. There were several warnings that there was a problem with one of the AoA vanes including stick shaker activation. In any other 737 variant this was an Airspeed Unreliable scenario. Any pilot would be completely unable to deal with the MCAS intervention unless they had promptly and effectively dealt with the UA.
You seem to be entirely skipping the initial failure and appropriate actions and focusing on the consequence of not responding effectively to the secondary related failure. I’m not sure why? This was an UA airspeed scenario with a secondary related failure. Not responding in an appropriate and timely manner to UA will end in exactly the same way as this accident, MCAS or not.
As before, the above does not preclude a further unknown response from MCAS outside of the Boeing service bulletin. This remains to be seen and will hopefully form a part of any impartial investigation.
That last sentence just reminded me of the Fly Dubai crash in Rostov-on-Don. Was a report ever released? It’s over 3 years now.
Gonna disagree here, 60s elapsed between lift off and the beginning of the Flap retraction which ultimately led to MCAS activating incorrectly. There were several warnings that there was a problem with one of the AoA vanes including stick shaker activation. In any other 737 variant this was an Airspeed Unreliable scenario. Any pilot would be completely unable to deal with the MCAS intervention unless they had promptly and effectively dealt with the UA.
You seem to be entirely skipping the initial failure and appropriate actions and focusing on the consequence of not responding effectively to the secondary related failure. I’m not sure why? This was an UA airspeed scenario with a secondary related failure. Not responding in an appropriate and timely manner to UA will end in exactly the same way as this accident, MCAS or not.
As before, the above does not preclude a further unknown response from MCAS outside of the Boeing service bulletin. This remains to be seen and will hopefully form a part of any impartial investigation.
That last sentence just reminded me of the Fly Dubai crash in Rostov-on-Don. Was a report ever released? It’s over 3 years now.
Edited by pushthebutton on Wednesday 10th April 13:18
Had this NOT been a Max or any aircraft without MCAS, i believe they would have been Okay.
As has been said, this all went to s
t after the flaps were retracted and MCAS engaged... While i agree not responding correctly and swiftly to a UA could lead to an undesirable situation, in the ET case they had an ample thrust setting and a nose up attitude.
In any other 73 variant, they would have kept on flying, yes maybe they would have gone into the clacker,
But they would have kept on flying.
Without the helping hand of bucket loads of nose down trim from MCAS the ac would have continued to climb with any thrust over 60% and a normal take off trim setting. The aircraft would not be going anywhere near the big hard thing.
However, as you have said.... had the ET crew responded to the initial failure, and completed the qrh for UA, the flaps would not be retracted and MCAS would not have engaged.
But who knows what would or would not have happened next.
skwdenyer said:
All good stuff...
Once the airspeed issue was dealt with (or not) they seem to have followed the AD and the runaway trim checklist, but got nowhere.
Just this bit.Once the airspeed issue was dealt with (or not) they seem to have followed the AD and the runaway trim checklist, but got nowhere.
It really depends when and how the checklist was actioned, the state of trim of the aircraft at the time the switches were placed to cutout and the use of the electric trim up to that point. Too many variables to say that they got nowhere with the checklist as it does assume that you continue to fly with reference to valid datums.
montymoo said:
Gonna disagree here,
Had this NOT been a Max or any aircraft without MCAS, i believe they would have been Okay.
As has been said, this all went to st after the flaps were retracted and MCAS engaged...
I can live with that and it's fair. What level of knowledge did the crew have regarding the MCAS service bulletin? Did the relevant training department disseminate the information in a timely manner and was it digested appropriately by the crews? There exists for pilots a necessary responsibility to digest such bulletins and consider their implications. The time for what ifs is on the ground before you fly. Is it fair to suggest that if the crew were in posession of all of the technical information surrounding MCAS, that they shouldn't have retracted the flaps? Again, that's something you have to think through on the ground as part of a what if scenario.Had this NOT been a Max or any aircraft without MCAS, i believe they would have been Okay.
As has been said, this all went to s
t after the flaps were retracted and MCAS engaged...montymoo said:
While i agree not responding correctly and swiftly to a UA could lead to an undesirable situation, in the ET case they had an ample thrust setting and a nose up attitude.
In any other 73 variant, they would have kept on flying, yes maybe they would have gone into the clacker,
But they would have kept on flying.
Without the helping hand of bucket loads of nose down trim from MCAS the ac would have continued to climb with any thrust over 60% and a normal take off trim setting. The aircraft would not be going anywhere near the big hard thing.
The same could be said for a momentary blip of the electric trim to keep the aircraft in trim and at the desired pitch attitude - after MCAS did its thing - until you can figure out what's happening. As the control column pressure increases it's an indicator to trim and instinctive to 737 pilots IMO. Why wasn't the electric trim used, if only to relieve control column pressure as it built up? The crew from the Lion Air crash did this 20 times before, I believe, control was handed to the FO and the inputs stopped(?). The aircraft was airborne, but was it being flown?In any other 73 variant, they would have kept on flying, yes maybe they would have gone into the clacker,
But they would have kept on flying.
Without the helping hand of bucket loads of nose down trim from MCAS the ac would have continued to climb with any thrust over 60% and a normal take off trim setting. The aircraft would not be going anywhere near the big hard thing.
montymoo said:
However, as you have said.... had the ET crew responded to the initial failure, and completed the qrh for UA, the flaps would not be retracted and MCAS would not have engaged.
But who knows what would or would not have happened next.
I'd imagine that they'd complete an approach using manual trim if we assume everything else remains equal. As an aside, the UA checklist doesn't prevent crews from moving the flaps, it just suggest appropriate pitch and power settings dependent on their position. You may or may not elect to move them depending on the aircraft's configuration and location at the time of the failure.But who knows what would or would not have happened next.
All of your points are valid. What I'm attempting to show is that the statement by the ECAA, that said that the pilots followed Boeing's guidelines, is at best misleading. It really depends on when and how the appropriate checklists were actioned and, possibly, if even at all. What has happened is, as a result of the preliminary report, judge, jury and executioner have already acted and the actual causes are of little relevance: consequentially, the opportunity to learn from the accidents will potentially be diminished.
Gassing Station | News, Politics & Economics | Top of Page | What's New | My Stuff