Hacker News Reader

MCAS problems weren't a memory item for any pilot, the memory item is Runaway Stabilizer and exhibits different behaviour to MCAS.

Which is to say that they'll be receiving sim training for Runaway Stabilizer, learn what to expect (wheel moves continuously, hard nose down, etc), and then in real life have MCAS cause the same issue but in a substantively different way (change, delay, change, delay, etc).

Without the benefit of hindsight why not try the Memory Item: Engine Surge / Stall or Uncommanded Roll? Both of which could exhibit as an uncommanded nose down.

The reality of the situation is that some pilots immediately went straight for Runaway Stabilizer whereas others did not. That's a problem. That's a TRAINING problem. The type rating should have included additional training against the Runaway Stabilizer Memory Item for MCAS so "I've seen this before" is second nature.

> That's a problem. That's a TRAINING problem.

Isn't the root problem still related to the fact that the AoA sensors were returning wrong information and the MCAS was simply reacting to that in a dangerous and non-obvious way?

I guess the pilots should be aware of this type of system reaction but still it seems like something that should be fixed at a higher level than training (indicators, backup AoA sensors, detecting dangerous descent after trigging nose down, etc).

There's problems at multiple distinct levels. Regulatory/oversight, unsafe design, lack of information/training, and potentially poor maintenance practices.

If you'll excuse the expression, everyone is going to get poop on them after this one is over.

There's never just one cause of an airline accident. That was one of the causes, but alone it wouldn't have been sufficient. Fixing the problems at all levels is how you achieve high reliability.

Exactly - Defense in depth.

Seems like it would have been sufficient to cause the crash, or are you saying that if the pilots let MCAS do its thing that the plane would not have crashed?

Crash causes:

1. Faulty MCAS

2. Insufficient pilot training

3. Boeing design changes (MCAS used to be disabled automatically if the pilot applied sufficient counter-input, this feature was removed in the -MAX series, requiring the pilot to explicitly disable the system using a separate button)

Take away any 1 of those causes and the plane doesn't crash. They all had to happen at the same time for these two tragedies to occur.

The Swiss cheese model of accident causation.

https://en.wikipedia.org/wiki/Swiss_cheese_model

additionally

4. Insufficient regulatory over site

5. Failed safety analysis

FAA pushed much of the safety analysis to Boeing engineers due to lack of funding and external pressures to help Boeing speed through certification.

The safety analysis was performed on incorrect data. The initial safety report said the MCAS system could lower the nose by 0.6 degrees. After flight testing, that value was increased to 2.5 degrees but the safety analysis was never updated to reflect the new parameters. Additionally, the MCAS system could reset each time the pilot attempted to override, and it could change 2.5 degrees for each reset. So effectively it was unbounded. The numbers on the safety report did not reflect the actual system. If the real numbers had been updated, the problem likely would have been caught sooner.

>MCAS used to be disabled automatically if the pilot applied sufficient counter-input, this feature was removed in the -MAX series

What was the reasoning behind this change?

Presumably so that the pilot can be blamed for not knowing the procedure to manually disable the automatic system that is flying the plane into the ground.

Those fixes are inarguably lower level than training. Not just to be pedantic but the whole reason Boeing is in this mess is because they figured all the lower level things could sort out issues, without engaging higher level fixes.

I'm skeptical of the amount of automation the big manufacturers are pushing. They're creating wildly more complex system interactions in the process.

> skeptical of the amount of automation the big manufacturers are pushing

We need to come to terms with automation as a civilization, lots of things that had a human in the loop will no longer have that person in 0-15 years. We don't realize how important these people are, esp their inaction and delay are very important at damping oscillations. As these automated systems start interacting they will have similar results as the MCAS but without pilot agency.

Look at the panic stops built into financial markets, what systems should have similar that currently do not?

Yes, you're right. Lower level is a more accurate description.

I agree it is a training problem, but it also seems the case that some pilots understand the fundamentals of flight and how a plane operates than others. So when a plane misbehaves, some pilots may have an intuitive sense of what to do, while others are stuck pattern matching and running through checklists.

To make a terrible analogy that trivializes the complexity of flying a jet (because I can't think of a better one), it's like the difference between a chef who knows how to combine ingredients to get the desired result and a cook who only knows how to follow a recipe.

I agree with this and want to expand: Following a recipe == auto pilot; reacting to deviations from the expected / working with new realities == chef (not cook).

The whole point of still having humans in the cockpit, aside from being slightly cheaper than automation right now, is the ability to react to and correct for the unexpected. I agree that this is a terrible engineering design, but that it's only one of the contributing factors. Disasters (nearly always) happen when a string of things go wrong, and safety is about making sure every one of them goes right so that the chances of failure are as close to eliminated as possible.

One of the issues I'm perceiving with the Strings Of Things that Go Wrong / Swiss Cheese model is that as we fix more and more of the ~more likely~ faults to appear, the faults that will continue to appear will be of the less likely variety, so to say more obscure corner cases.

The problem is that training cannot efficiently prepare somebody to identify and fix obscure corner cases while under pressure.

Maybe not plausible, but why not give the pilot a single switch to disable all automation so they can fly the plane without interference.

The reason some of this automation exists is because modern airplanes have, extremely rough corner cases.

In particular, the very thing that is causing the MAX incidents is one of those features that is designed to ADD stability.

The main issue however is that the system is both reading too few external sensors, and is also not reacting to contradictory human inputs.

An ideally designed system might have the following features:

  * Read data from ALL installed sensors that might be applicable.
  * If data from sensors is not within a reasonable bound,
    scream bloody murder about that for a human to make a decision.
  * If human input contradicts the intended direction of the plane,
    scream bloody murder about that for a human to make a decision.

Potential decisions might include designating one or more inputs as faulty, or entirely disabling the function in question. Such an operating mode SHOULD be an exception and should be very obvious for anyone looking at the plane / systems.

Are the logs you're referencing a public resource? Would be interesting to look at.

>This implies it took almost three minutes for the previous crew to figure out the STAB TRIM needed to be CUT OUT after finding the trim is so wrong that they can’t hold the stick back.

I've seen a number of references to difficulty that pilots encounter managing forces of the flight controls in airliners. It seems strange to me that modern aircraft of that size would be designed in a way that aerodynamic forces on control surfaces would be allowed to translate back to control inputs in a manner that could overpower a pilot. I would think there would be some kind of scaled assist mechanism (ala power steering) in scenarios where there is a mechanical/hydraulic link. I'm guessing fly by wire scenarios wouldn't have this problem?

The scaled assistance you're referring to is the hydraulic system.

Airplanes are supposed to be light-touch because you need very fine movement control to balance the aircraft while landing. Think of the work required to move a pencil. That's about the level of effort a plane is supposed to require. But with the trim working against the pilot, the control required could be more like lifting a 50lb sack.

Yes, most pilots can lift a 50lb sack. Can you lift and hold a 50lb sack for, say, an hour? Not many people can.

(Without hydraulics, the forces would simply toss the pilot's body around. No possibility of control.)

Also worth noting that the reason we don't simply scale the forces down to the point a pilot could easily handle them is that above manouvering speed an aircraft can be damaged by full control deflection.

Good point. This is something I bet most non-pilots don't know. A pilot can actually damage or destroy an airplane through control inputs alone. In fact there was a case of a pilot intentionally destroying his airliner by rapidly slamming the rudder back and forth, but I can't find the flight reference now. And there are other examples, such as AA flight 587 where the large control inputs were causal in the crash that killed all aboard.

It probably is a memory item, but it's not something they got to immediately, and I'm guessing here because runaway trim symptoms are slightly different to what MCAS was doing.

This happened to me a while ago involving trim, and I'll try and go through my thought process and why it takes a little while in the cockpit to figure things out:

- Autopilot is engaged, holding a heading of X, altitude of Y and I've got a power setting for speed Z

- My hands are off the stick, and I'm planning the next 20 mins of the flight.

- The nose has slowly started creeping downwards, I don't notice until I look up a few seconds later

- I glance at the altimeter and see we're now Y-300ft, and descending at 500ft/min.

- I check the altitude hold on the autopilot flight director; see yes, it is still set to Y, and am rather confused, as the stick is fairly pulled back to pull the airplane up (autopilot), so the pitch hasn't changed that much.

- Airspeed is slow, and I'm even more confused - how are we both descending and slowing down.

- Glance over to the passenger, she's fast asleep, a bit restless but not touching the yoke or rudder.

- ATC comes over the radio asking if we're descending and what our intentions are.

- It's only been about 30 seconds but we're now Y-900feet, at a decent rate of of -1400ft, the AoA indicator is starting to beep as we're now in the warning arc, speed is Z-20kts.

- Unsure of what's actually happening, I push in full mix/throttle to keep our airspeed up.

- I grab the stick (already fairly back) and attempt to get us level.

- Tell ATC over the radio I'm having difficulties with the autopilot as I disengage it.

- Feel an immediate / tremendous force on the stick pulling it forwards, have to use both hands to keep it back.

- I'm now wondering if the elevator control is broken.

- Try to start trimming it back (electronic trim), but a warning flashes on the instrument panel.

- Electronic trim usage also immediately disables the autopilot completely, so the wings are now rocking too, giving a weird sensation as I feel like I'm fighting the controls.

- Reach over to the trim wheel, realise the passengers knee is propped on it.

- Move her leg out of the way, and start wheeling it back and feel pressure easing on the stick.

- Keep trying to use the electronic trim and it kicks in, and I can see the trim position on the panel (set pretty far forward).

- Aircraft is now finally level, airspeed is increasing. Elevators / pitch control feels normal.

- Set airspeed for best rate of climb, and tell ATC I'll level off at my previous altitude. Put us into a climb.

- Re-engage the autopilot and all seems well

That was about a minute and a half. I went from 8500ft to around 6800ft in what felt like a few seconds, and it's only after I was in the climb that I realised her shuffling was knocking the trim wheel around. She had been probably doing it for the better part of an hour, and the autopilot had been opposing her inputs. I didn't pick up on the airspeed changes as we're a slow plane flying into a strong headwind so I expected to not be flying the usual speeds.

I pored over the Pilot Operating Handbook that day, and also the Garmin G3X/GFC500 to figure out what was happening and to understand the systems. The trim wheel itself doesn't disengage the autopilot, only the electric trim control does. When the servo motors can't engage (too much force), the system just shows a red X on the instrument display where the control display would be. Etc etc.

The 737MAX pilots don't have that luxury, as they're told it's just a 737 type.

Go through the above scenario, but have no knowledge of the fact that theres something moving the trim. You do not have the luxury of altitude, nor airspeed. The sensors are providing weird inputs. Plus, everything is happening around 10x faster, not a slow build up. You reset the trim, all is well for a few seconds and bam, nose down again. Reset again, it happens again. If I don't know about the MCAS, the 5 sec delay etc, my immediate thought is a faulty computer and I'll try and restart it. And so forth.

Thank you for a pilot's perspective. Here's my bit of confusion though. Once you realized the stab trim was the issue, you were able to reset it and get back to normal flight. Had the problem recurred that flight, you'd probably have recognized it immediately.

In the Lion flight, the pilots realize the stab trim is off because they correct it. Once they realize that, regardless of what keeps setting the stab trim to pitch down, and even if they've forgotten there's cut-out switches, why don't they keep resetting the stab back to 0? And how do they not eventually notice the stab wheels turning?

It's almost as if the pilots weren't even aware of the stab wheels and stab indicator, and how those related to the electronic trim switch and the stabilizer itself. But I can't beleive that.

The thing that would be most helpful is knowing what their mental model of the plane was, but I'm not sure the investigation will be able to tell us that.

I think context is what helps -

- I’ve just taken off, and am going through the after take off checklist: Set the airspeed, power, climb rate, heading, talking to ATC, planning the next stage of the flight

- Perhaps I’ve just raised the flaps and the plane starts behaving erratically

- My first / immediate thought is that my previous action led to an undesired aircraft state.

- I work from that point on

- I touch the electronic trim as habit, which resets the system briefly, and all seems well for a few seconds. I don’t know that the system reset itself.

- It goes all weird again all on its own

- Now I’m even more confused

Etc

Edit: I'm a low time private pilot flying a LSA, I genuinely don't know the procedures or processes in place for a 737, but I can empathise with their situation as I know how quickly things can go start going amiss in a plane.

I think that, not being a pilot, I can't really understand, but thank you again for the perspective.

Edit: one last thing though - when the plane isn’t behaving as expected, why isn’t the first thing to check that all the control surfaces and the throttle are where you expect them to be?

Of course - generally the expectation is that control surfaces will not move on their own accord, unless specifically asked to; either directly by the pilot by moving the yoke/stick, trim wheel, rudder etc, or indirectly by setting the autopilot, which in turn moves those controls.

If they move on their own accord - usually via autopilot - it's because they are trying to maintain a reference point the pilot asked them to.

When they move on their own accord, outside of any pilot inputs or settings, without the pilot knowing / understanding why, that's where the issues start happening.

Air France AF447 entering Alternate Law, Lion Air MCAS activating etc.

The initial course of action is always to return to stable flight, disabling whatever systems you perceive to be changing the control surfaces. When you just don't know which system is causing the issue, then you're just fighting the end result (eg nose down), not the underlying system issue (eg MCAS preventing stall by enforcing trim).

To find the cause of the end result (eg nose down), you work backwards to see what happened - because, chances are, you as a pilot made an erroneous setting / configuration somewhere to cause an undesirable aircraft state, not the system itself, as you are taught the system works under your command, plus no system acts to down an aircraft - they are all there to prevent an aircraft from getting into an undesirable state. You go back to the last known working configuration, and work from there to diagnose.

Long winded answer, but yes, you do check control surfaces, but they only show an undesirable aircraft state which can be corrected (eg pull back on the stick), but it doesn't solve for the what and why, and thus preventing getting back into that undesirable state. Trim is also one of those ones right at the bottom to check, as it's for fine-tuning an aircrafts pitch - where an elevator can move an aircraft up or down tens of degrees in a seconds, trim usually only moves the pitch tenths of degrees.

This is also where SOP's and training come in too - some airlines would have "set landing trim" on the final leg of the approach, others might have it on the base leg. Some companies require stall training in the sim once a year, other airlines don't even have sims. Some airlines are okay with reverse thrust on landing, others want to avoid wear and tear on the engine and want you to slam the brakes. The aircraft manufacturer would have their "recommended" training, and modify it in accordance to company practices / requirements, legal / regulatory frameworks etc.

From what I understand, and this is just from reading the news and forums, there was no knowledge or training about the MCAS system. The closest thing is a runaway trim, and again this probably differs from airline to airline.

All aircraft, pilots have a checklist of things - takeoff, landing, recovering from various undesirable aircraft states etc. Occasionally you do hit an edge case where a lack of knowledge and training collide with a background-running aircraft system acting out of the ordinary.

Again - I'm just a private pilot so do take the above with a grain of salt, Airline Transport Pilots have far more training and experience, and can probably provide a far better insight to the behaviour of larger jets, difference between companies, SOP's etc.

> - My first / immediate thought is that my previous action led to an undesired aircraft state.

FYI This is shown in the Lion air preliminary report.

They select flaps 0 (from flaps 5) and a few seconds later reselect flaps 5. Unfortunately a while after that they decide to go to flaps 0 again. With any flaps selected the MCAS system is disabled.

This must have been mighty confusing without knowing about MCAS. It’s like trying to fly a black box instead of flying a plane.

Yeah, I can imagine. I mentioned elsewhere, the previous flight managed to develop a reasonable mental model (they thought that the Mach Trim System was responding to a wrong airspeed input). Saying that, failing to guess what's going wrong shouldn't result in a big hole in the ground.

This is pretty interesting if you haven't seen it before:

https://vimeo.com/159496346

For the curious, it's a presentation on "Automation Dependency" in flying, done by someone from American Airlines.

I had an autopilot/trim issues once on the approach right after FAF in solid IMC (later turned out that one of wires got loose). Similar symptoms as above. I didn’t debug anything, simply killed AP, and hand flew the rest of the approach. It was exactly the response my instrument instructor trained me to do and he was very happy when I discussed it with later.

I haven't checked but I'd bet STS is speed trim system (Aka Mach trim). Interesting that he came up with a reasonable mental model of what was wrong even though Boeing hadn't given them any details.

You are confusing things here. This article is about the crash that happened 6 months ago. You are comparing one and the same crash here.

The recent crash is by Ethiopian Arilines. NOT Lion Air.

One wonders, when the prior flight landed with the stab trim system switched off, who switched it back on before the next departure? And was there no question raised as to why it was off?

It's not normal to have that system switched off at any time. There are even guards over the switches to ensure they are only operated deliberately.

Maintenance attempted a repair between those two flights. They flushed the AoA system after replacing it previously.

They should have given the incoming pilots a thorough briefing of: this is what went wrong, this is how the previous pilots worked around it, this is what we did to remedy.

That's what this comment chain is about, the log book. Maintenance would have added comments after the previous pilot's above.