Evidence found that the Ethiopian airliner’s nose was being pushed down
The wreckage of the doomed Ethiopian flight of a Boeing 737 Max is starting to tell the tale:
A screwlike device found in the wreckage of the Boeing 737 Max 8 that crashed last Sunday in Ethiopia indicates the plane was configured to dive, a piece of evidence that helped convince U.S. regulators to ground the model, a person familiar with the investigation said late Thursday night…
The piece of evidence was a so-called jackscrew, used to set the trim that raises and lowers the plane’s nose, according to the person, who requested anonymity to discuss the inquiry.
A preliminary review of the device and how it was configured at the time of the crash indicated that it was set to push down the nose, according to the person, who wasn’t authorized to speak publicly about the investigation.
The jackscrew, combined with a newly obtained satellite flight track of the plane, convinced the FAA that there were similarities to the Oct. 29 crash of the same Max model off the coast of Indonesia. In the earlier accident, a safety feature on the Boeing aircraft was repeatedly trying to put the plane into a dive as a result of a malfunction.
All airplane crashes are horrific tragedies. If this preliminary report turns out to be true, then both 737 Max crashes would be especially and ironically heartrending, because an element that was supposed to protect the planes would have ended up destroying them and everyone aboard.
This is similar to an Alaska Airlines crash in 2000.
https://en.wikipedia.org/wiki/Alaska_Airlines_Flight_261
I think I’ll just drive.
It’s similar except that it is a different plane from a different manufacturer probably using different software code. Other than that both planes crashed, thus similar.
Configuring any safety system so that the pilot cannot override it is just stupid. But, par for the course nowadays. We are all surrounded by products designed by people who are convinced we are too stupid to manage things, so they have to do it for us. After the bunch of Airbus crashes caused by a similar phenomenon – computer systems overriding the pilot inputs – you would expect Boeing to know better, but apparently they just couldn’t resist.
A passenger sitting in my car cannot fiddle with the sound system while the car is moving, because I can’t be trusted not to mess with it while driving, and the controls are locked out. Infuriating. I’d say I won’t buy another Subaru, but it’s probably just a matter of time before federal regs require all car radios to be programmed that way.
Splendid.
Article by a former Lufthansa pilot who doesn’t much like the 737, in *any* of its recent versions. Seems a little over-the-top to me.
https://www.veteranstoday.com/2019/03/15/737-max-finally-the-scrap-from-seattle-has-to-stay-on-the-ground/
His statement about the difficulty of shutting off the trim motor…a requirement to turn off the entire bus bar from which it is powered…doesn’t seem consistent with the description and photo of relevant 737 Max 8 systems in a recent NYT article. Oldflyer, can you shed any light on this?
NYT article link is here:
https://www.nytimes.com/interactive/2018/11/16/world/asia/lion-air-crash-cockpit.html?mtrref=undefined&gwh=4E3B29D785A2CB3380092954D957DC27&gwt=pay
…picture shows trim shutoff switches on central console.
Asked for clarification at the Lufthansa guy’s article, hopefully will hear back.
This is similar to an Alaska Airlines crash in 2000.
No, that was poor maintenance. The jackscrew had striped threads.
computer systems overriding the pilot inputs – you would expect Boeing to know better, but apparently they just couldn’t resist.
There is switch that shuts off the override. It’s on the pedestal for the yoke.
This video shows it. The pilots were probably not trained how to do this.
“A preliminary review of the device and how it was configured at the time of the crash indicated that it was set… ”
“set” by whom or by what seems to me to be the critical question. If it’s “by whom”, then it’s a personnel issue – somebody either did it deliberately or was incompetent. If it’s “by what”, then the mechanics/computer is the problem and it rightly goes back to Boeing.
Either way it doesn’t minimize the tragedy, but maybe an answer will prevent future incidents.
The MCAS system “set it” but the pilots may not have know how to turn the MCAS off.
More likely, they *did* know how to turn it off, in principle…if asked “how do you interrupt a runaway-trim situation?”, they would have answered correctly…but did not identify the problem quickly enough.
https://youtu.be/zfQW0upkVus
A big or dominant factor in the Lion Air crash was an MCAS automated nose down response to a single faulty angle of attack sensor, and the pilots did not have training on disabling the system.
There were two big problems in that case. One, the MCAS system only looks at one angle of attack sensor even though there are at least two on the plane. Sensors are generally not 100% reliable and that one failed. This has long been a sore point with Boeing’s automation. Boeing likes the simplicity of automating around a single sensor even when others exist. Birgenair Flt 301, a Boeing 757, crashed in part because the auto-throttle used only one air speed sensor that failed.
The second obvious problems with Lion Air was the pilot’s lack of training on the MCAS. So all pilots would know this stuff by now, wouldn’t they?
Brett Velicovich, an Army drone expert and TV commentator, said that he flew that exact same Ethiopian flight that crashed many times, though not very recently. He claimed that the flight made him nervous because the entire airline operation seemed sketchy and unprofessional to him. Others have said the accident record of the airline is actually good. But it seems possible that those pilots did not get the extra instruction or training that they should have gotten.
Last I heard on the business news was that Boeing had given themselves a quick time schedule to provide a new MCAS software package to airlines. Initially it was two weeks, then there was a backtrack to an ill defined but longer schedule.
I am concerned that the fly by wire with computer control cars will one day get us. Maybe a massive, simultaneous hack. My old 1994 S-10 pickup with around 500,000 miles- I mainly worry that it is wearing out. Driving a truck that old can be good for one’s prayer life, however. “Let it keep running just a little longer, Lord, please.”
This is a tragic AI inevitable issue — how to make decisions. Any expert system / AI depends on training. Then, in real time, it depends on sensors.
Future pilot decisions should probably be based on at least 3 sensors, so that the “majority wins”, plus an ID to check the sensor out.
I haven’t seen that there is any signal, to the pilots, that the MCAS (autopilot) is taking any action. Letting the humans know what the autopilot is doing, and why, is a big issue in AI. Deep learning AI neural nets often can’t say exactly why they do what they do, their patter recognition ability is based on training where they’ve been “successful” the most.
On the more limited expert systems, with specific sensors indicating that the autopilot should do something, the sensor input and the action being taken should be clear. Perhaps especially to the co-pilot, while the pilot is busy trying to compensate.
Human error and mechanical failure seem far more acceptable reasons for a plane or car to crash, rather than a software/ sensor/ autopilot bad decision.
For every AI system, there will come situations where their training does not lead them to makre the optimal decision.
This is obvious in cars, where their is a choice of high probability – kill drunk pedestrian but very low probability of injuring car driver or passenger, vs. low probability of killing drunk, but high probability of injuring or killing driver. How should it be programmed?
Who is going to drive if they know the program will kill them over the drunk?
Is it fair to kill the drunk just to keep the driver “in the safe zone”?
Expert systems are dangerous, AI can be even more dangerous.
A friend who is a check pilot for United tells me his company requires a lot of experience “hand-flying” the aircraft at the beginning and end of the flight. His experience with foreign airlines is that they rely more on autopilots from the earliest moment of the flight to the very end, including “auto land” flying, which was the apparent cause of the Asiana Airlines crash at San Francisco several years ago. I have read reports that the Ethiopian Airlines cockpit crew were low time pilots. That would be a significant deviation from my experience when I lived in Africa, about 25 years ago. In those days, Ethiopian Airlines was considered one of the best on the continent.
“I have read reports that the Ethiopian Airlines cockpit crew were low time pilots.”
I have now read all kinds of reports now one way or the other about EA, including your later statement that it is or was once considered “one of the best on the continent”. At the risk of sounding ray-ciss I am somewhat suspicious of third world airlines. But the two crashes on a fairly new aircraft raise concerns especially because they now appear to be similar.
I’m not sure I have all the facts as to these accidents, but from reading the NYTs article linked by David Foster, I can say this: All Boeing jets (I have about 20,000 hours in various models) have a stabilizer trim system that is controlled by trim switches on the yokes, stabilizer cutout switches on the center console, and trim wheels on either side of the center console. These trim wheels offer direct indication of the movements of the stabilizer and a means to trim the stabilizer manually should the need arise. All pilots are trained on what to do in the case of a runaway stabilizer. !. Try to over come the runaway with the normal yoke switches. 2. If 1. doesn’t work, move the stabilizer cutout switches to off. 3. If 2. doesn’t work, use the emergency stabilizer brake, which is on the back side of the center console. 4. Trim the stabilizer manually using the trim wheels. For a competent pilot this sequence of actions would take about a minute or two.
Recognizing a runaway stabilizer trim is relatively straight forward. The stabilizer trim wheel is moving without input from the yoke switches or is moving much faster than commanded by the yoke switches. At the same time the nose is moving beyond the attitude desired by the pilots and the yoke pressure is heavy in trying to maintain the desired flight path.
My question is: Do the trim wheels move when the stabilizer is being trimmed by the MCAS? If not, it could be more difficult to diagnose trim runaway. The only indicator would be the heavy yoke pressure in trying to maintain the desired flightpath. For inexperienced pilots that could lead to not diagnosing the problem and following the procedures to regain control of the stabilizer. But we won’t know until more information is obtained.
If Boeing opted (so as to keep the MCAS operation out of sight) to not have the trim wheels moving during the MCAS operation, that would, IMO, be a big mistake because it would reduce the ques about a runaway stabilizer trim.
This Seattle Times article (which looks a lot better-researched than the typical media coverage of almost anything) says that the trim wheels do move when MCAS activates.
https://www.seattletimes.com/business/boeing-aerospace/black-box-data-reveals-lion-air-pilots-struggle-against-boeings-737-max-flight-control-system/
What I’d like to understand is *why* Boeing chose to use single-sensor data to trigger the action, and what this really means?…MCIS is software, and it seems likely that both sensors are continually feeding the computer on which it resides, so no additional cost or wiring complexity involved in considering both. Does single-sensor mean that only one of them (say, the left one) is ever used…or is MCAS implemented such that *either* sensor showing out-of-range would trigger MCAS action? If the latter, then someone might have actually viewed this approach as *increasing* safety, since then if one sensor failed completely the other one would still react to a genuine nose-too-high situation.
David, that the Lion Air crew that flew the aircraft before the fatal flight didn’t ground the aircraft because of the trim malfunction is amazing to me. You can fly the airplane with manual trim, but it’s not a normal operation.
That the new crew didn’t recognize that they had a runaway trim even though the trim wheel was activated during the MCAS operation speaks poorly of the training.
The trim system (in this case the AOA needed to be repaired and tested so the trim would not run away. ) should have been fully operational before the next dispatch. Bad maintenance procedures also. At least that’s how it looks to me.
Bad maintenance procedures also. At least that’s how it looks to me.
Me too and that is at least as important as the pilots. The Alaska Airlines crash that was a jackscrew issue was totally the maintenance at fault.
David:
To say there is no additional cost or consequence for additional sensors is naive.
The cable harnesses don’t assemble themselves or install themselves. Is there only one sensor used or are there two? Every part of an engineered system has costs and changes have risks. Almost always there are tradeoffs involved. Where I work one of the products we make is used for testing avionic and marine cable harnesses used for radar and electromechanical control systems. It’s a big deal to keep such systems functional and reliable.
Lots of good comments here (and thanks for the information to us non-pilot types) but it seems to boil down finally to what many of you said: “The pilots were probably not trained how to do this.”
om…my point was that there are already two at least sensors. Odds are that they are *already* connected to whatever computer systems runs MCAS; otherwise, the one that is not connected would be of no use.
This will hopefully all be clarified when the fix is released and approved.
David Foster:
Thanks for the clarification. The Oldflyer rule I think is best (have to wait for the report).
“I think I’ll just drive.”
Wait until self-driving cars take over. Then it’ll be like flying airplanes to the 10th power.
Read it and weep…
…and/or get very, very angry (or dismiss it altogether):
https://www.zerohedge.com/news/2019-03-17/best-analysis-what-really-happened-boeing-737-max-pilot-software-engineer
BTW:
https://www.facebook.com/737handbook/posts/stabiliser-trim-system-and-runaway-stabiliserhorizontal-stabiliser-controls-the-/1074500519285886/
From Barry Meislin’s link:
“* Pilot expertise problem. If the pilots had correctly and quickly identified the problem and run the stab trim runaway checklist, they would not have crashed.”
That’s looking more and more likely.
Pingback:Neo – National Emergency, Veto, Airline Crash, New Zealand Massacre, “sorry”, Dylan & Byrds, Earth from Space – Tom Grey – Families, Freedom, Responsibility
The jackscrew, combined with a newly obtained satellite flight track of the plane, convinced the FAA that there were similarities to the Oct. 29 crash of the same Max model off the coast of Indonesia. In the earlier accident, a safety feature on the Boeing aircraft was repeatedly trying to put the plane into a dive as a result of a malfunction.
Pilots aren’t used to nosing down airplanes when the gyro reports flat horizon, since only on a flat horizontal plane does an airplane work. If the airplane starts nosing down for some odd reason and they don’t notice it, then it would be an airsphere that it would operate on, constantly nosing down. Airplanes do not work on airspheres, only horizontal fixed planes of air.
It would be ironic of Boeing’s safety feature was coded by someone who was taught to use atmospheric Earth based models to calculate how airplanes should work, as nobody told them airplanes only work on fixed horizontal planes of air, not on the prototypical Earth sphere model.
Y provides comedy from a tragedy. He/She/It couldn’t comprehend physics and a frame of reference (Physicsguy tried).