Don Hudson

Donating Member
  • Content Count

  • Joined

  • Last visited

  • Days Won


Don Hudson last won the day on December 12

Don Hudson had the most liked content!

Community Reputation

676 Excellent


About Don Hudson

  • Rank

Profile Information

  • Gender

Recent Profile Visitors

3,737 profile views
  1. Don Hudson

    Lion Air Down

    Wall Street Journal By Andy Pasztor and Andrew Tangel Updated Nov. 13, 2018 1:56 p.m. ET . . . . "Boeing marketed the MAX 8 partly by telling customers it wouldn’t need pilots to undergo additional simulator training beyond that already required for older versions, according to industry and government officials. One high-ranking Boeing official said the company had decided against disclosing more details to cockpit crews due to concerns about inundating average pilots with too much information—and significantly more technical data—than they needed or could digest. " . . . .
  2. Don Hudson

    Lion Air Down

    When I joined AC a hundred years ago, we got a day's groundschool, (initial course) on snag-writing. Garth emphasized the importance of clear communication and taking the time. Sometimes hanging around for a conversation with maintenance is a good thing. Here, a thoroughly-written snag almost certainly would have saved lives.
  3. The representations by pilot groups, study groups, scientists and even laymen are to be congratulated on 40 years of tireless presentations, negotiations and dogged persistence. While other countries dealt with the problem by recognizing and developing fatigue risk management processes, Canada was increasingly, embarassingly alone with its inappropriate regulations. Minister Garneau, it is a good start.
  4. Don Hudson

    Lion Air Down

    Hi conehead; It is difficult to accept that a primary flight-control system would have only one sensor and that a run-on failure mode associated with bad data hadn't been envisioned in the original design of the MCAS. That's fundamental so there has to be more to this than that.
  5. Don Hudson

    Lion Air Down

    Blues - and the poor log-book snag writing led, in my view, to not communicating the entire problem, in turn diagnosing the fault thoroughly enough and permitted release of the airplane without the perceived need for a test flight. The behaviour of the trim system probably in this accident likely did not resemble anything the crew had experienced in recurrent sim sessions. Normally, you see the trim wheel rotating, (generally at the faster, 'manual' rates than the slower autopilot trim rates). Either way, the rotating wheel with its white marks going round and round without obvious input is an eye-catcher. Here, the wheel rotated for about 2.5 seconds then stopped. A slight control heaviness would have been felt and manually trimmed out. That scenario repeated itself and was moderately under control, (the confusion & question & likely cockpit conversation would be, "Why does it keep doing that?, or "What's it doing now?"), until a handover of control, (Capt. to F/O) took place. Manual trimming to counter the MCAS "subtle runaway") was not applied and physical control forces got too heavy. Likely they split the control columns (as designed, to cater to an elevator jam), in the last few moments. If they had known about the MCAS system, and how it behaved and how it was controlled, (apparently single-source, No. 1 pitot), they may have made the leap to using the cut-out switches, but it wasn't "a loud bang", so to speak and there was no attention-getting warning to indicate how serious the problem really was. The previous crew will be interviewed extensively I should think. We may find out what they thought and why, when they decided to use the cut-out switches. Probably a quiet, insightful moment that was responding to a system that wasn't behaving so they stopped it, probably without going through any checklist. I've looked in NG & Max FCOMs. Very little information in Boeing manuals generally - even below a minimum NTK level in my view. To that point, there isn't a single mention of how the MCAS system actually works and why it exists, such that a crew could make an informed decision about the system. Their control columns just got heavier and heavier until they couldn't hold them back anymore.
  6. Don Hudson

    Remembering Concorde

    If the mods will forgive me for a transgression, (advertising another thread! ;-), for those who are fascinated with Concorde, there is a long-standing, great discussion on PPRuNe at by some of the people who were there at the beginning - engineers, pilots...
  7. Don Hudson

    Lion Air Down

    This now needs a Root Cause Analysis I think.
  8. Don Hudson

    Lion Air Down

    Sorry conehead, shoulda mentioned that...probably lots of traffic.
  9. Don Hudson

    Lion Air Down

    Preliminary (30-day) report is out: - 035 - PK-LQP Preliminary Report.pdf
  10. Don Hudson

    Lion Air Down

    Hi DEFCON; Re, It is indeed a big question, for the FAA, for Boeing, for Lion Air management & maintenance personnel. The MCAS was introduced on the Max for aerodynamic reasons and affects primary flight controls. So robust testing including behaviour during all potential failure modes as part of the engineering process of various failure modes would be expected. Anticipating single-points-of-failure which carry with them the potential for "loss of the mission" is part of such a process. A swapping of AoA sensors following a flight on which the stall warning system was activated for the entire flight, both systems which involve primary flight controls, would require a test flight. I see that the validity of the CofA is now under examination.
  11. Don Hudson

    Lion Air Down

    Hi DEFCON; Thanks, much appreciated. They are in reference only to the MCAS I believe, as there is no AoA input to the STS. The cut-off switch(es) are required by the QRH if the stabilizer continues to move after resisting movement with the control column, (there is a cut-off switch on the control columns beneath the cockpit floor that senses physical force/resistance and stops electrical power to the larger electric trim motor). #6 makes sense as one would not re-engage, (use the electrics) for a system that has proven faulty. The QRH also uses the word "continuously" regarding movement of the stabilizer. As you say, the movement here wasn't continuous or at manual rates which is what one normally sees in the sim when practising the abnormal. The trim-wheel would be moving with the MCAS as we would know.
  12. Don Hudson

    Lion Air Down

    Hi DEFCON; The CVR is crucial to the investigation. It needs to be determined if, and how quickly the crew reached their overload point, and whether the cut-off switches were actually mentioned. Discussion with the previous crews who flew the aircraft are equally crucial. If the only thing stopping the STS/MCAS from trimming was the use of the cut-off switches, it appears as though the crew on the previous day's flight in which the problem re-occurred, may have used them. If they did, and the accident crew did not, that places different emphasis and focus on what happened, at least until it is determined what the accident crew did. There is the more serious question in my opinion, of what appears to be a very subtle single-point-of-failure regarding the loss of AoA data. One failure should not render a system incapable of working normally. A discussion about "decideability" in computer systems is appropriate. Why should two sensors out-vote one in every case? There is no "Occam's Razor" algorithm! The industry has not really dealt with the question and usually accepts that two out of three sensors/inputs will satisfy most failures because of the humans in the cockpit for one thing, (a separate argument against autonomous flight), but in truth, it is at least 7. (There is a reason for this but it's borrrring). Seven is of course impractical and with 98.6F still warming the seats perhaps a long way off. But QF72, AF447 and this accident is evidence that that three may not be. The report on the Lion Air land-short incident a while back indicates some training-and-standards issues. The captain received an "SB" for not going around on an approach that demanded the GA, and he pressed on after taking control from the F/O at low altitude when the F/O lost visual contact with the runway in a squall, (if I recall all this correctly... )
  13. Don Hudson

    Lion Air Down

    VP, I don't thing the "corporate-leadership world" is either new, or brave. We don't know whether this is an organizational failure, a training issue, or a technical, (software drives the MCAS which uses the STS system, (which is FCC-driven), or design & certification issue. There just isn't sufficient information so all pleadings have to be taken as such, and not as data. Below is a detail of one of the recorder traces now available. Based on the assumption that this is real data from a reliable source, one can see that the crew's manual trim inputs appeared to be working to counter the MCAS/STS system inputs, with a degrading trend towards ND stabilizer trim. The actual behaviours of the crew in terms of cut-out switches or holding the actual trim wheel remain unknown. An interim report is to be published next week on the 28th.
  14. Don Hudson

    Lion Air Down

    From AW&ST posted in the interests of flight safety & broader awareness Credit: Sean Broderick and Guy Norris Lion Air Probe Expands To 737 MAX Design, Pilot Training The Lion Air Flight 610 (JT610) investigation is revitalizing discussions on how to safely integrate automation onto aircraft while keeping pilots both in the loop and prepared to take over when systems designed to help them do not work as intended. The link between JT610 and automation was made Nov. 6 when Boeing warned that erroneous sensor data—such as faulty angle-of-attack (AOA) and airspeed readings that investigators say JT610 experienced—can trigger automatic nose-down stabilizer trim on the 737 MAX, the newest 737 family member. • 737 MAX’s new stabilizer auto-trim system was not detailed to operators • Failure mode may create confusion for pilots Four days later, Boeing issued a Multi-Operator Message (MOM) explaining that the MAX’s Maneuvering Characteristics Augmentation System (MCAS) “commands nose-down stabilizer” using “input data and other airplane systems.” The MCAS, one of several MAX auto-trim functions, is operated by the flight-control computer and “activated without pilot input and only operates in manual, flaps-up flight,” Boeing says. The MCAS is not on previous 737 designs, and until recently few pilots knew it existed. “This is the first description you, as 737 pilots, have seen,” the Allied Pilots Association (APA) told American Airlines pilots, adding the MCAS is not in the flight crew operations manual (FCOM). The Air Line Pilots Association called the lack of transparency “a potential, significant aviation system safety deficiency.” Boeing has said little publicly. In an internal memo, President/CEO Dennis Muilenburg pushed back against claims that Boeing “intentionally withheld” MCAS details, calling them “simply untrue.” He also said the MCAS’ “relevant function is described in the FCOM.” Manuals did not mention the MCAS before the JT610 accident, but they did cover electric trimming. Surprise over the MCAS led the FAA to issue an emergency airworthiness directive Nov. 7 ordering MAX operators to update their flight manuals with Boeing’s bulletin. “[A]nalysis performed by the manufacturer [showed] that if an erroneously high single angle of attack (AOA) sensor input is received by the flight control system, there is a potential for repeated nose-down trim commands of the horizontal stabilizer,” the FAA stated. The directive points operators to existing runaway-trim procedures in the FCOM and quick reference handbook (QRH). If the runaway continues when the autopilot is disengaged—which would be the case if the MCAS is moving the stabilizers—pilots are to flip “cutout switches,” just as on the 737 Next-Generation (NG). As a last resort, pilots are told to “grasp and hold” the stabilizer trim wheel. The FAA has not ordered any changes to how pilots are trained or how the MCAS operates. Not everyone is expressing dismay over the way Boeing handled MCAS information. The United Airlines Master Executive Council (MEC) says that while the MCAS may be new, its function is not, and pilots already knew how to manage an MCAS-linked problem. Image: United Airlines says that while the 737 MAX’s Maneuvering Characteristics Augmentation System is new, pilots are trained for scenarios it presents. Credit: United Airlines “Despite the omission of the MCAS description in the initial 737 MAX differences training, United pilots are properly trained in handling an MCAS malfunction,” Capt. Bob Sisk, chairman of the MEC’s safety committee, wrote to members. “[W]hen working properly, the system helps us avoid stalls. If it faults or activates due to a related system fault (like an AOA sensor), it presents itself to pilots as runaway stabilizer trim . . . something we can recover from using existing QRH procedures with the flip of the cutout switches.” One MAX pilot who has flown all three generations of 737s suggests that how the MCAS works is not relevant, so long as it works as designed. “You can make the argument that the flight crews don’t need this level of information on the differences in the models, since it doesn’t affect how the aircraft is operated,” he says. “The presence of the system is news to me, and I assume this failure mode is news to everyone.” The expectation that pilots easily identify a new failure mode on a largely familiar aircraft will be closely scrutinized. Boeing achieved its aim of reproducing the same basic pilot handling characteristics as the 737NG, but the adoption of the MAX’s larger CFM Leap 1B engine produced changes, notably in pitch behavior, that required flight-control system modifications. Like all turbofan-powered airliners in which the thrust lines of the engines pass below the center of gravity (CG), any change in thrust on the 737 will result in a change in flightpath angle caused by the vertical component of thrust. This is a moment resulting from the horizontal thrust component caused by a CG offset and a trim stability change. Image: Boeing added the MCAS to help manage flight-performance changes introduced by design updates. Credit: Boeing Although the Leap 1B is designed to have thrust levels similar to the 737NG’s CFM56-7B, the newer engine is heavier and has a larger fan. Because of its greater size, Boeing had to maintain adequate ground clearance by cantilevering the engine farther forward on a heavier strut, adding to the offset. The Leap 1B’s 18-blade composite fan is 69.4-in. in diameter, compared to 61 in. for the CFM56-7’s 24-blade titanium fan. Each Leap 1B weighs 6,129 lb., 849 lb. more than a CFM56-7B. For the 737-8, the added structure of heavier struts and nacelles, beefed-up main landing gear and supporting structure add 6,500 lb. to the green aircraft weight, but operating weights are boosted by 7,000 lb. to preserve full-fuel and payload capability. MAX pilots are therefore trained to know that although the aircraft has natural speed stability through much of its flight envelope, there is also inevitable thrust-versus-pitch coupling at low speeds. The 737-8 has a speed-stability augmentation function that helps compensate for the coupling by automatically trimming the horizontal stabilizer according to indicated speed, thrust-lever position and CG. Boeing advises that pilots still must be aware of the effect of thrust changes on pitching moment and make purposeful control-wheel and pitch-trim inputs to counter it. During flight tests of the first MAX to fly, the 737-8, Boeing says flight crews encountered “interesting” stall-onset characteristics because of the powerplant changes. The MCAS is thought to have been added as a mitigation. One question that JT610 investigators will explore: Does the MCAS add complexity that pilots need to understand, or did the Lion Air pilots face other problems? Image: Canadian carriers worked with Transport Canada to update manuals and training based on details provided by Boeing. Credit: Air Canada JT610 took off early on Oct. 29 from Jakarta in good weather. The three-month-old 737-8 crashed about 13 min. later, descending at high speed into the Java Sea. Preliminary analysis of the flight-recorder data suggests the crew struggled to control the aircraft, Indonesia National Transportation Safety Commission investigators said. Data captured by automatic dependent surveillance-broadcast ground stations show the flight never climbed above 5,000 ft. Investigators also confirmed the 737-8 experienced issues such as AOA mismatches and unreliable airspeed readings on previous flights. Understanding why JT610 crashed depends heavily on tracing the crew’s actions. If the aircraft received erroneous AOA data and detected it was at the point of stall, the stall/stick shaker system would almost certainly have commanded the control column forward to reduce the AOA. Assuming this occurred, two main questions emerge: When the crew experienced the uncommanded input, did they disconnect the autopilot? And if they disconnected the autopilot and were still experiencing uncommanded inputs, did they throw the switches as the QRH directs? Recognizing unintended aircraft states and reacting appropriately is a growing challenge for pilots as aircraft become more complex. A 2013 FAA-led study on the topic highlighted the degradation of manual flying skills and difficulties transitioning from auto-flight to manual flight. A rulemaking advisory committee suggested the FAA develop training guidance in response. “With regard to undesired flight states, it is always preferable to prevent an occurrence,” the committee says. “If prevention fails, early recognition of a developing undesired state with immediate correction is the second most preferred action. If both prevention and early recognition/correction fail, then recognition and recovery from the undesired state are required. A high level of competency in hand-flying (both the physical and cognitive aspects) is necessary for safe flight operations, regardless of the level of autoflight equipment installed, or used, in the aircraft.” Image: The FAA is working on the guidance. Meanwhile, investigators are digging into the JT610 information they have. The cockpit voice recorder has not been found, meaning key information about the pilots’ perceptions and reactions remains unknown. This information, coupled with the FDR data, will get to the heart of whether the 737 MAX faces a serious issue. One certainty: Any crew would be challenged by a nose-trimmed-down aircraft shortly after takeoff. “The most insidious problem is the trimming, which could go unnoticed with the stick shaker activating,” says the MAX pilot. “The extended forward trim makes the aircraft much more difficult to control. If you realize what is going on and take steps to address it, this shouldn’t be that hard to handle. But it could be a very confusing and challenging situation close to the ground.” -----------------------------------------
  15. Don Hudson

    Lion Air Down

    Malcolm, thanks for posting this and the previous one with the link to the MCAS Video. I have heard that it is an 'excellent' explanation of this system. I don't know enough about the aircraft to verify that judgement. Something's up, I think. Vsplat, as we know from the Boeing info and the FAA AD, a failed AoA vane that is sending high-AoA data to the FCC will result in a number of downstream failures, (Disagree messages), including the MCAS. The Boeing documentation (and likely the FCTM) specifies what to do with a continuously-trimming horizontal stabilizer. The documentation I've seen indicates that the stabilizer cut-off switches will stop all signals. There is no information for public consumption that settles the question whether these switches control the MCAS inputs. Given that the MCAS is installed to enhance stability in certain flight regimes, I think the question is now a reaonable one. In fact there is no information for our consumption that indicates whether this is just a software change or whether there exists a separate THS / elevator control system in addition to the STS, (controlling the FCC, taking pitot-static from the sensors located on the nose) and the Elevator Feel system, (nothing to do with the FCC, the system applies pressure similar, I believe, to the MCAS system, (meaning "opposite trim" to provide a heavier 'feel' on the column rather than the normal "relieving of pressure"), and takes pitot-static data from the sensors on either side of the vertical stabilizer and static ports located just forward & below the left horizontal stabilizer). For a number of reasons, the real issue here may not be that pilots didn't know about the system because it wasn't in the manual, but that sufficient knowledge, testing or thought was brought to bear on what results could be anticipated from the failure of one of the three AoA vanes. Might it be a single point of failure in rare though possible conditions causing the MCAS to move in unanticipated ways which could if uncorrected, lead to loss of the aircraft? Is this only a training issue? Again, we don't know if this is mechanical or software and we don't know what kind of testing was done, so it's all just a SCWAG at the moment. First thing that has to be settled is, Can one shut off the THS using the cut-off switch(es) on the Max? As far as Challenger, (and Columbia) and organizational accidents go, I wonder that too. I have heard/read comments that there has been a gradual culture change at Boeing since McDonnell-Douglas, primarily a military contractor, took them over many years ago. I have seen comments that their 787 difficulties may have been a symptom of this. Remember, they were given permission to use "special conditions", the details which I can't recall as I write, regarding the aircraft batteries and they came close to losing a hull due to fire. The other aspects of organizational behavour factor here and I think it is quite serious, immediately for Lion Air and longer term for Boeing. With a larger brush...there is a growing discourse regarding technology's complexity and how even a department cannot know everything there is to know about complex systems under their management. This phenomenon is excacerbated by proprietary requirements and data security issues. Sharing system information can be hazardous to one's company's bottom line. Two systems interracting, (different chip manufacturers, software engineers, coding differences, etc.), may be placed in opposition to one another making decideability (which sensor is the correct one?) and correct outcomes less than 100% reliable). Clearly, aircraft perform well and the safety record is evidence that the system is resilient and it's working. Watching this one carefully though. There have been previous accidents similar to this one involving pitot-static systems and sensor/software issues, but none as concerning as this. Don