Sign in to follow this  
Malcolm

Lion Air Down

Recommended Posts

Probably works at all altitudes.

Remember those shrimp fishermen that saw it go in. They said it was almost vertical.

Makes me wonder how so many of us  flew for so many hours without an "angle of attack" indicator......5268.gif

 

Share this post


Link to post
Share on other sites
9 minutes ago, Kip Powick said:

Probably works at all altitudes.

Remember those shrimp fishermen that saw it go in. They said it was almost vertical.

Makes me wonder how so many of us  flew for so many hours without an "angle of attack" indicator......5268.gif

 

Or perhaps how lucky you were that there was no computer on your aircraft that would take over from you even in Manual?

Share this post


Link to post
Share on other sites
12 hours ago, conehead said:

That’s the way most Stall Protection Systems work that I’m familiar with. I guess we’ll learn more in time...

This seems to be more that just stall protection.  The design of the MAX changed the geometry of the engine and pylon moving the engine forward and canted upwards.  This changes the pitching moments when thrust is applied hence the need for some system to counter it.  Apparently applying high thrust setting will pitch the nose up noticeably which would require a forward imput on the elevator to counteract.  This is different from previous models.  The system trims the stab to counteract the pitch.  2.5 degrees per minute I believe.

Boeing however will be in a world of hurt if it is found that this was not trained from the outset as a difference in the aircraft.

This is also a good reason to put this airframe to bed and do a clean slate design for this category.  Fumbling bits together to build an airplane never works out well.  The MAX is best described as a hybrid of old and new technologies that are not integrated well at all.

  • Like 2

Share this post


Link to post
Share on other sites
2 hours ago, boestar said:

This is also a good reason to put this airframe to bed and do a clean slate design for this category.  Fumbling bits together to build an airplane never works out well.  The MAX is best described as a hybrid of old and new technologies that are not integrated well at all.

Good point. 

Share this post


Link to post
Share on other sites

I think others have asked these questions:

What within the Boeing machine broke so badly that a new system with fatal side effects was incorporated so invisibly? 

Is there a comparison to be made with the Challenger accident?  Did someone within the design team identify this threat and get shut down, or was it missed completely?

What other 'undocumented features' are lurking out there as a result of this same, or a similar, process flaw?

Vs

 

Share this post


Link to post
Share on other sites

The cause of this crash is focused on a faulty AOA sensor. So Boeing may have a supplier realiability problem to deal with and not necessarily a design problem. The 737 has been stretched and raised a couple of times since the 1960’s and this latest version is a money maker when fully serviceable.

Although it is unusual in 2018 for a plane maker to find an after the fact flaw in their designs, it has been addressed by all parties involved.  

Edited by blues deville

Share this post


Link to post
Share on other sites

nut had they done a clean sheet design from the ground up rather than lipstick on  a pig there wouldnt be an issue.  The system is designed to compensate for a design compromise to fit a bigger engine on the same airframe.

  • Like 1

Share this post


Link to post
Share on other sites
3 hours ago, boestar said:

This seems to be more that just stall protection.  The design of the MAX changed the geometry of the engine and pylon moving the engine forward and canted upwards.  This changes the pitching moments when thrust is applied hence the need for some system to counter it.  Apparently applying high thrust setting will pitch the nose up noticeably which would require a forward imput on the elevator to counteract.  This is different from previous models.  The system trims the stab to counteract the pitch.  2.5 degrees per minute I believe.

Boeing however will be in a world of hurt if it is found that this was not trained from the outset as a difference in the aircraft.

This is also a good reason to put this airframe to bed and do a clean slate design for this category.  Fumbling bits together to build an airplane never works out well.  The MAX is best described as a hybrid of old and new technologies that are not integrated well at all.

Well, with more than 4,500 outstanding orders there's nary a snowballs chance that Boeing will "put this airframe to bed". It does prove though that the basic wing, fuselage, engine position is fundamentally sound. The only real gains made in commercial aviation in the last 50 years has been engine design and aerodynamic tweaking. The A220 proves that, it's probably the most efficient commercial aircraft out there but if you blur the edges it could just as easily be identified as a 737, A320 or any other narrow body twin.

Should Boeing have gone with a clean sheet? Probably but the next breakthough of design hasn't happened yet. I do suspect though that the MAX and NEO will both prove to be the final iterations of these models.

Share this post


Link to post
Share on other sites

I do agree however when you look at what they are doing with the air frame and systems as well as engines then you will see that they are trying to fit 10 pounds of fish into a 5 pound sack.

The avionics and electrical systems are piecemeal of classic and modern technologies that do not fully integrate like a clean slate would have so compromises are made.

The efficient engines diameter was too large to be accommodated by the existing air frame so the pylon pushes the engine forward and up on an angle.  Again a compromise.

QUESTION:  What happens when you move a couple of tons forward on an aircraft?

Now add in the angle the engines are mounted at.  The thrust vectors cause the aircraft to pitch upward when thrust is applied due to the angle and location of the engine. (see aforementioned compromise).  So now Boeing engineers have to compensate for the compromise.  They add a system that is supposed to be invisible to the pilot that pitches the nose down when certain conditions are met, the main one being angle of attack.  Throttle goes forward, nose goes up, newfangled compromise mitigation system engages and trims the stab nose down.  Cool, but a little more effort would have negated the need.

Now Boeing has a swollen order list for the Max.  Great but NO ONE new of all the compromises.  Same old 737 just more efficient.

IMHO Boeing took the cheap and fast way out to deliver something that would compete with the C-Series (at the time) and the A320 NEO.  It was the best bang for the buck but not the right decision, again IMHO.

 

 

Share this post


Link to post
Share on other sites
8 minutes ago, boestar said:

I do agree however when you look at what they are doing with the air frame and systems as well as engines then you will see that they are trying to fit 10 pounds of fish into a 5 pound sack.

The avionics and electrical systems are piecemeal of classic and modern technologies that do not fully integrate like a clean slate would have so compromises are made.

The efficient engines diameter was too large to be accommodated by the existing air frame so the pylon pushes the engine forward and up on an angle.  Again a compromise.

QUESTION:  What happens when you move a couple of tons forward on an aircraft?

Now add in the angle the engines are mounted at.  The thrust vectors cause the aircraft to pitch upward when thrust is applied due to the angle and location of the engine. (see aforementioned compromise).  So now Boeing engineers have to compensate for the compromise.  They add a system that is supposed to be invisible to the pilot that pitches the nose down when certain conditions are met, the main one being angle of attack.  Throttle goes forward, nose goes up, newfangled compromise mitigation system engages and trims the stab nose down.  Cool, but a little more effort would have negated the need.

Now Boeing has a swollen order list for the Max.  Great but NO ONE new of all the compromises.  Same old 737 just more efficient.

IMHO Boeing took the cheap and fast way out to deliver something that would compete with the C-Series (at the time) and the A320 NEO.  It was the best bang for the buck but not the right decision, again IMHO.

 

 

I agree on all points.

Share this post


Link to post
Share on other sites

Boeing should maybe have been more forthcoming about the design change, but the system itself seems pretty simple and sound.

While common type ratings might be good for the balance sheet, this crash really makes the point that 'differences' between models, pilot familiarity with those variations and their response to stimulus in a crisis event may not be entirely predictable.

 

 

Edited by DEFCON

Share this post


Link to post
Share on other sites

If the accident aircraft pilots disconnected the stab trim AFTER using the control column stab switches to counter act the MCAS stab trim pitch up movements, they may have ended up with a stab trim position that could not be counteracted using elevator input only so close to the ground.

Think of Rostov. All related to pilot input stab trim response to thrust/pitch changes in manual flight on the 737.

Share this post


Link to post
Share on other sites
2 hours ago, J.O. said:

MCAS primary function is to provide a pitch down movement.

Thanks.... so similar logic is what then happens if MCAS runs the prescribed 10 seconds trimming the stab trim 2.5 units and then the pilots select the stab cutout switches? Is there enough elevator travel to override the pitch down moment? 

Share this post


Link to post
Share on other sites
On 11/16/2018 at 8:10 AM, Vsplat said:

What other 'undocumented features' are lurking out there...

I'm curious about why the rudder pedal travel appears to be different between the MAX and NG.  Or is it just me?

Share this post


Link to post
Share on other sites

A new 'Temporary Non - Normal Checklist - EAD 2018 - 23 - 51 9.1' has been added to the 737 Flight Manual.

The operation of the 'Cutout Switches' has been moved up and is now action #5 on the list of 'memory' items.

Boeing still hasn't updated the manual to include a description of the MCAS and no one seems to have an answer to the question posed by Rudder above.

 

Edited by DEFCON

Share this post


Link to post
Share on other sites

I imagine Air Canada and the other 737 operators have done the same?

Quote

WestJet updates training in response to plane issues linked to Lion Air crash

 
‎Today, ‎November ‎19, ‎2018, ‏‎34 minutes ago | Peter Muir

News provided by Travelweek.ca

Monday, November 19, 2018 Posted by The Canadian Press

CALGARY —WestJet Airlines Ltd. says it has updated its training in response to revelations of a design issue in the Boeing 737 Max, the aircraft at the centre of a deadly crash off the coast of Indonesia last month.

 

A Lion Air Max 8 passenger jet plunged into the Java Sea on Oct. 29 just minutes after taking off from the Indonesian capital of Jakarta, killing all 189 people onboard. Moments earlier, the pilot had requested permission to return to the airport because of a problem controlling the plane.

WestJet, which has 10 737 Max aircraft in its fleet, says it worked with Transport Canada and other airlines over the past two weeks to revise its flight manual and increase training on a part of the anti-stall system, a feature that pilots at WestJet and other airlines were unaware existed.

On Thursday, the Air Line Pilots Association, which represents 61,000 pilots at American and Canadian airlines including WestJet, voiced their concern in a letter to the U.S. Federal Aviation Administration (FAA) and the National Transportation Safety Board.

Union president Tim Canoll said pilots were “concerned” about news reports that stated flight crews and technicians were not told about the anti-stall system that investigators have linked to the Lion Air crash, and which was absent from previous versions of the 737 Max.

Canoll cited a “significant potential security deficiency” in the new system, and called for more system information from the FAA and the safety board as an investigation by Boeing and the FAA looks into whether software or design changes are required.

 

Share this post


Link to post
Share on other sites

Boeing shares fall after cancelling airline conference call on 737 issues

 
Published 8 Mins Ago CNBC.com
     
     
     
     
     

Boeing shares fell 3.1 percent in premarket trading Tuesday after the company canceled conference call with airlines to discuss systems on the 737 MAX model which crashed in Indonesia in October.

A 737 MAX operated by Lion Air crashed on Oct. 29, killing all 189 people on board. It was the first major accident involving the Boeing's latest version of its popular narrow-body plane.

Instead of a conference call, the aerospace giant will continue contact with individual airlines on a regular basis, CNBC has learned. Boeing has steadily spoken with different operators of the 737 MAX airplane over the last two weeks.

 

But the reaction among shareholders in the stock Tuesday furthers the perception that Boeing has not been forthright with its customers. However, CEO Dennis Muilenburg adamantly denied in an email to employees on Monday that Boeing has withheld information.

Share this post


Link to post
Share on other sites

Sunwing 737 Max suffers spurious indication incident

  • 21 November, 2018
  • SOURCE: Flight Dashboard
  • BY: David Kaminski-Morrow

Canadian investigators have disclosed that engineers replaced an air data computer on a Sunwing Airlines Boeing 737 Max 8 after the crew received spurious indications from the aircraft’s instruments.

The aircraft (C-GMXB) is less than six months old, having been delivered to Sunwing at the end of May.

It had been operating to Toronto from Punta Cana, in the Dominican Republic, when the incident occurred on 14 November.

Transportation Safety Board of Canada says the aircraft had been cruising at 35,000ft when the crew received “erroneous” indications on the captain’s side.

The first officer’s instruments, and the standby indicators, were functioning normally and the first officer took control of the aircraft.

It descended to 25,000ft as a precaution, in order to clear instrument meteorological conditions, but – as it passed 28,000ft – the weather radar and collision-avoidance system both failed. The aircraft was some 50nm north-west of Washington DC at the time.

The crew transmitted a ‘pan pan’ urgency call. The safety board says a left-side inertial reference system fault light also illuminated.

Investigators state that the flight proceeded to Toronto and landed without further incident, with no injuries among the 182 occupants.

Sunwing’s maintenance service replaced the left-side air data inertial reference unit (ADIRU) before returning the aircraft to operation.

 

 

Share this post


Link to post
Share on other sites

Malcolm, thanks for posting this and the previous one with the link to the MCAS Video. I have heard that it is an 'excellent' explanation of this system. I don't know enough about the aircraft to verify that judgement.

Something's up, I think.

Vsplat, as we know from the Boeing info and the FAA AD, a failed AoA vane that is sending high-AoA data to the FCC will result in a number of downstream failures, (Disagree messages), including the MCAS. The Boeing documentation (and likely the FCTM) specifies what to do with a continuously-trimming horizontal stabilizer. The documentation I've seen indicates that the stabilizer cut-off switches will stop all signals.

There is no information for public consumption that settles the question whether these switches control the MCAS inputs. Given that the MCAS is installed to enhance stability in certain flight regimes, I think the question is now a reaonable one.

In fact there is no information for our consumption that indicates whether this is just a software change or whether there exists a separate THS / elevator control system in addition to the STS, (controlling the FCC, taking pitot-static from the sensors located on the nose) and the Elevator Feel system, (nothing to do with the FCC, the system applies pressure similar, I believe, to the MCAS system, (meaning "opposite trim" to provide a heavier 'feel' on the column rather than the normal "relieving of pressure"), and takes pitot-static data from the sensors on either side of the vertical stabilizer and static ports located just forward & below the left horizontal stabilizer).

For a number of reasons, the real issue here may not be that pilots didn't know about the system because it wasn't in the manual, but that sufficient knowledge, testing or thought was brought to bear on what results could be anticipated from the failure of one of the three AoA vanes. Might it be a single point of failure in rare though possible conditions causing the MCAS to move in unanticipated ways which could if uncorrected, lead to loss of the aircraft? Is this only a training issue?

Again, we don't know if this is mechanical or software and we don't know what kind of testing was done, so it's all just a SCWAG at the moment. First thing that has to be settled is, Can one shut off the THS using the cut-off switch(es) on the Max?

As far as Challenger, (and Columbia) and organizational accidents go, I wonder that too. I have heard/read comments that there has been a gradual culture change at Boeing since McDonnell-Douglas, primarily a military contractor, took them over many years ago. I have seen comments that their 787 difficulties may have been a symptom of this. Remember, they were given permission to use "special conditions", the details which I can't recall as I write, regarding the aircraft batteries and they came close to losing a hull due to fire.

The other aspects of organizational behavour factor here and I think it is quite serious, immediately for Lion Air and longer term for Boeing.

With a larger brush...there is a growing discourse regarding technology's complexity and how even a department cannot know everything there is to know about complex systems under their management. This phenomenon is excacerbated by proprietary requirements and data security issues. Sharing system information can be hazardous to one's company's bottom line. Two systems interracting, (different chip manufacturers, software engineers, coding differences, etc.), may be placed in opposition to one another making decideability (which sensor is the correct one?) and correct outcomes less than 100% reliable).

Clearly, aircraft perform well and the safety record is evidence that the system is resilient and it's working.

Watching this one carefully though. There have been previous accidents similar to this one involving pitot-static systems and sensor/software issues, but none as concerning as this.

Don

 

Edited by Don Hudson

Share this post


Link to post
Share on other sites

From AW&ST posted in the interests of flight safety & broader awareness

Credit: Sean Broderick and Guy Norris

Lion Air Probe Expands To 737 MAX Design, Pilot Training

The Lion Air Flight 610 (JT610) investigation is revitalizing discussions on how to safely integrate automation onto aircraft while keeping pilots both in the loop and prepared to take over when systems designed to help them do not work as intended.

The link between JT610 and automation was made Nov. 6 when Boeing warned that erroneous sensor data—such as faulty angle-of-attack (AOA) and airspeed readings that investigators say JT610 experienced—can trigger automatic nose-down stabilizer trim on the 737 MAX, the newest 737 family member.

            737 MAX’s new stabilizer auto-trim system was not detailed to operators

            Failure mode may create confusion for pilots

Four days later, Boeing issued a Multi-Operator Message (MOM) explaining that the MAX’s Maneuvering Characteristics Augmentation System (MCAS) “commands nose-down stabilizer” using “input data and other airplane systems.” The MCAS, one of several MAX auto-trim functions, is operated by the flight-control computer and “activated without pilot input and only operates in manual, flaps-up flight,” Boeing says.

The MCAS is not on previous 737 designs, and until recently few pilots knew it existed. “This is the first description you, as 737 pilots, have seen,” the Allied Pilots Association (APA) told American Airlines pilots, adding the MCAS is not in the flight crew operations manual (FCOM). The Air Line Pilots Association called the lack of transparency “a potential, significant aviation system safety deficiency.”

Boeing has said little publicly. In an internal memo, President/CEO Dennis Muilenburg pushed back against claims that Boeing “intentionally withheld” MCAS details, calling them “simply untrue.” He also said the MCAS’ “relevant function is described in the FCOM.” Manuals did not mention the MCAS before the JT610 accident, but they did cover electric trimming.

Surprise over the MCAS led the FAA to issue an emergency airworthiness directive Nov. 7 ordering MAX operators to update their flight manuals with Boeing’s bulletin. “[A]nalysis performed by the manufacturer [showed] that if an erroneously high single angle of attack (AOA) sensor input is received by the flight control system, there is a potential for repeated nose-down trim commands of the horizontal stabilizer,” the FAA stated.

The directive points operators to existing runaway-trim procedures in the FCOM and quick reference handbook (QRH). If the runaway continues when the autopilot is disengaged—which would be the case if the MCAS is moving the stabilizers—pilots are to flip “cutout switches,” just as on the 737 Next-Generation (NG). As a last resort, pilots are told to “grasp and hold” the stabilizer trim wheel. The FAA has not ordered any changes to how pilots are trained or how the MCAS operates.

Not everyone is expressing dismay over the way Boeing handled MCAS information. The United Airlines Master Executive Council (MEC) says that while the MCAS may be new, its function is not, and pilots already knew how to manage an MCAS-linked problem.

Image: United Airlines says that while the 737 MAX’s Maneuvering Characteristics Augmentation System is new, pilots are trained for scenarios it presents. Credit: United Airlines

“Despite the omission of the MCAS description in the initial 737 MAX differences training, United pilots are properly trained in handling an MCAS malfunction,” Capt. Bob Sisk, chairman of the MEC’s safety committee, wrote to members. “[W]hen working properly, the system helps us avoid stalls. If it faults or activates due to a related system fault (like an AOA sensor), it presents itself to pilots as runaway stabilizer trim . . . something we can recover from using existing QRH procedures with the flip of the cutout switches.”

One MAX pilot who has flown all three generations of 737s suggests that how the MCAS works is not relevant, so long as it works as designed. “You can make the argument that the flight crews don’t need this level of information on the differences in the models, since it doesn’t affect how the aircraft is operated,” he says. “The presence of the system is news to me, and I assume this failure mode is news to everyone.”

The expectation that pilots easily identify a new failure mode on a largely familiar aircraft will be closely scrutinized. Boeing achieved its aim of reproducing the same basic pilot handling characteristics as the 737NG, but the adoption of the MAX’s larger CFM Leap 1B engine produced changes, notably in pitch behavior, that required flight-control system modifications.

Like all turbofan-powered airliners in which the thrust lines of the engines pass below the center of gravity (CG), any change in thrust on the 737 will result in a change in flightpath angle caused by the vertical component of thrust. This is a moment resulting from the horizontal thrust component caused by a CG offset and a trim stability change.

Image: Boeing added the MCAS to help manage flight-performance changes introduced by design updates. Credit: Boeing

Although the Leap 1B is designed to have thrust levels similar to the 737NG’s CFM56-7B, the newer engine is heavier and has a larger fan. Because of its greater size, Boeing had to maintain adequate ground clearance by cantilevering the engine farther forward on a heavier strut, adding to the offset. The Leap 1B’s 18-blade composite fan is 69.4-in. in diameter, compared to 61 in. for the CFM56-7’s 24-blade titanium fan.

Each Leap 1B weighs 6,129 lb., 849 lb. more than a CFM56-7B. For the 737-8, the added structure of heavier struts and nacelles, beefed-up main landing gear and supporting structure add 6,500 lb. to the green aircraft weight, but operating weights are boosted by 7,000 lb. to preserve full-fuel and payload capability.

MAX pilots are therefore trained to know that although the aircraft has natural speed stability through much of its flight envelope, there is also inevitable thrust-versus-pitch coupling at low speeds. The 737-8 has a speed-stability augmentation function that helps compensate for the coupling by automatically trimming the horizontal stabilizer according to indicated speed, thrust-lever position and CG. Boeing advises that pilots still must be aware of the effect of thrust changes on pitching moment and make purposeful control-wheel and pitch-trim inputs to counter it.

During flight tests of the first MAX to fly, the 737-8, Boeing says flight crews encountered “interesting” stall-onset characteristics because of the powerplant changes. The MCAS is thought to have been added as a mitigation.

One question that JT610 investigators will explore: Does the MCAS add complexity that pilots need to understand, or did the Lion Air pilots face other problems?

Image: Canadian carriers worked with Transport Canada to update manuals and training based on details provided by Boeing. Credit: Air Canada

JT610 took off early on Oct. 29 from Jakarta in good weather. The three-month-old 737-8 crashed about 13 min. later, descending at high speed into the Java Sea. Preliminary analysis of the flight-recorder data suggests the crew struggled to control the aircraft, Indonesia National Transportation Safety Commission investigators said. Data captured by automatic dependent surveillance-broadcast ground stations show the flight never climbed above 5,000 ft. Investigators also confirmed the 737-8 experienced issues such as AOA mismatches and unreliable airspeed readings on previous flights.

Understanding why JT610 crashed depends heavily on tracing the crew’s actions. If the aircraft received erroneous AOA data and detected it was at the point of stall, the stall/stick shaker system would almost certainly have commanded the control column forward to reduce the AOA. Assuming this occurred, two main questions emerge: When the crew experienced the uncommanded input, did they disconnect the autopilot? And if they disconnected the autopilot and were still experiencing uncommanded inputs, did they throw the switches as the QRH directs?

Recognizing unintended aircraft states and reacting appropriately is a growing challenge for pilots as aircraft become more complex. A 2013 FAA-led study on the topic highlighted the degradation of manual flying skills and difficulties transitioning from auto-flight to manual flight. A rulemaking advisory committee suggested the FAA develop training guidance in response.

“With regard to undesired flight states, it is always preferable to prevent an occurrence,” the committee says. “If prevention fails, early recognition of a developing undesired state with immediate correction is the second most preferred action. If both prevention and early recognition/correction fail, then recognition and recovery from the undesired state are required. A high level of competency in hand-flying (both the physical and cognitive aspects) is necessary for safe flight operations, regardless of the level of autoflight equipment installed, or used, in the aircraft.”

Image: The FAA is working on the guidance.

Meanwhile, investigators are digging into the JT610 information they have. The cockpit voice recorder has not been found, meaning key information about the pilots’ perceptions and reactions remains unknown. This information, coupled with the FDR data, will get to the heart of whether the 737 MAX faces a serious issue. One certainty: Any crew would be challenged by a nose-trimmed-down aircraft shortly after takeoff.

“The most insidious problem is the trimming, which could go unnoticed with the stick shaker activating,” says the MAX pilot. “The extended forward trim makes the aircraft much more difficult to control. If you realize what is going on and take steps to address it, this shouldn’t be that hard to handle. But it could be a very confusing and challenging situation close to the ground.”

-----------------------------------------

Share this post


Link to post
Share on other sites

Received this. It summarizes the current situation as well as possible at this point IMHO.

 

 

 

THE AOA PROBLEM
WHAT WE CAN DO ABOUT IT 
    
By Captain Shem Malmquist
AN FSI COMMENTARY
 
Editor's Note: Thank you for your response to the many articles we have published in the wake of the Lion Air 610 crash. This one suggests a hopeful way forward that will benefit our industry. Captain Malmquist's analysis offers the perspective of a veteran line pilot and accident investigator who is also the coauthor of a book we recently co-published, Angle of Attack. As always FSI welcomes your comments on this important issue. 
 
 
In the wake of the October 29 Indonesian crash of a brand new Boeing 737 MAX 8 that took the lives of 189 passengers, the FAA has issued Emergency Airworthiness Directive (AD) 2018-23-51. The 737 is the most widely flown aircraft in the world, This tragedy opens an important conversation between regulators, operators and pilots. 
      
Lion Air, an experienced 737 operator, was the launch carrier last year for the 737 MAX 8 and the MAX 9 in March. While it will take a long time to analyze the Lion Air 610 accident, the AD points out that current system architecture has created vulnerabilities. 
      
Anyone who flies modern jet aircraft, as I do, also knows that in some ways this conversation applies to every plane and every pilot. Attempts to assign blame to anyone at any point in this investigation sidesteps a much more important issue, one that is the essential to the future of ever more automated cockpits. 
The FAA says its AD was "prompted by analysis performed by the manufacturer showing that if an erroneously high single angle of attack (AOA) sensor input is received by the flight control system, there is a potential for repeated nose-down trim commands of the horizontal stabilizer[1]. This condition, if not addressed, could cause a flight crew to have difficulty controlling the airplane, and lead to excessive nose-down attitude, significant altitude loss, and possible impact with terrain[2]." 
         
As described in the Seattle Times, "The system called MCAS, for Maneuvering Characteristics Augmentation System, is activated when a sensor on the side of the fuselage indicates a dangerously high angle of attack (AOA), the angle between the air flow and the wing.
      
"If the plane is in an abnormally steep turn that puts high stress on the air frame, or when its speeds fall so low it's about to stall, MCAS will kick in and swivel the horizontal tail to push the nose of the airplane down in an effort to avert the danger".[3]
      
While the Seattle Times article incorrectly implies that the system is based on speed or "high stress on the air frame, " the system description appears to be essentially correct. Low airspeed or a higher load factor (which can occur in a steep turn or pull up from a dive) are among the possible reasons the angle of attack can approach a stall.
 
Unlike other critical components such as air speed indicators or altimeters which have comparator systems that cross check each other for spurious indications and alert the pilot that there is a mismatch, pilots have no way to quickly determine if they are being misled by a faulty AOA sensor[4]
      
As with erroneous airspeed or altitude readings, the loss of the sensor itself leads to loss of secondary systems and/or can trigger other warning systems. Even on the most advanced state of the art aircraft there is no direct feedback to the pilots when the AOA sensor itself has failed. Pilots must quickly infer a faulty AOA sensor from other faults or indications. 
 
Underlying this problem is the fact that a computer software system does not "fail" like a mechanical system.  It can be incorrectly coded, or it can be incorrectly designed, but the system does not "fail" like a turbine blade that rips apart in flight. Generally, what we see is that the software was coded correctly based on the requirements provided to the people coding the software but the problem lies in the requirements and specifications provided to them. If a certain scenario was not considered in the requirements it is unlikely to find its way into the final computer coding.
 
The AD describes an emergency scenario where a sensor reads an erroneously high AOA and the software reacts as its designers intended. The software responds to the erroneous indication in a manner similar to the way a human might react. However, all the pilot sees is the final result. How the computer came to take an action is opaque.  This makes it very difficult to crosscheck the computer's process model (decision making process). 
 
As Boeing and the FAA AD explain, the bad AOA sensor leads to several problems. The erroneously high indication of AOA first leads to an autopilot disconnect. The system then works to prevent a stall by adding nose-down trim.  So how does this affect the process model (mental model) for the pilots?
 
As Boeing and the FAA AD explain, the bad AOA sensor leads to several problems. The erroneously high indication of AOA first leads to an autopilot disconnect. The system then works to prevent a stall by adding nose-down trim. 
 
It is standard in the Boeing aircraft that the stabilizer trim can be stopped by moving the control column in the opposite direction. Aircraft designers assume that no pilot would intentionally trim the aircraft nose up while also pushing forward on the controls to pitch the aircraft down or vice versa. 
 
However, in the case of the B-737 MAX 8 and 9 there are reports that reversing the control column (pulling back) won't work to stop the stabilizer trim from trimming nose-down in the scenario described in the AD. Others have discussed the rationale behind this design decision[5], but suffice to say that this would be different than what a pilot would be expecting based on previous experience on other Boeing 737 models. The erroneous AOA could trigger both an erroneous stall warning and a pitch down (due to the MCAS trimming the horizontal stabilizer). 
 
This gets a lot more complicated when you consider how the FAA defines a stall condition for a transport category airplane (adapted from Title 14 CFR 25.201):
 
Full stall condition - any one, or combination, of the following:
-    A nose-down pitch that cannot be readily arrested, which may be accompanied by an uncommanded rolling motion
-    Buffeting of a magnitude and severity that is a strong and effective deterrent to further increase in angle of attack
-    The pitch control reaches the aft stop for 2 sec and no further increase in pitch attitude occurs when the control is held full aft, which can lead to an excessive descent rate
-    Activation of a stall identification device (e.g., stick pusher)
 
As can be seen, the condition described in the AD would present at least two of the criteria. First is the "nose-down pitch that cannot be readily arrested" (because the pilots were not previously aware that the system was intentionally doing that due to the erroneous sensor) and second is the "activation of a stall identification device," in this case, a stick shaker, also due to the same erroneous sensor. The pilot could effectively be misled as to what is actually going on by the software system.
 
The AD also implies that it is possible that the trim cutout switches (guarded switches that disconnect electrical power from the trim system) may not work, stating: 
 
"If relaxing the column causes the trim to move, set stabilizer trim switches to CUTOUT. If runaway continues, hold the stabilizer trim wheel against rotation and trim the airplane manually."  
 
Pilots are often our own worst enemy, with some contending that the situation should have been obvious, the aircraft attitude was nominal and airspeed normal. Such Monday morning quarterbacking suggests hindsight bias. The pilot placed in the middle of this situation does not have the benefit of knowing the outcome. They see the aircraft pitching down and are getting a stall warning.     There has been considerable emphasis on stall recovery in the wake of the Air France 447 accident. In the aftermath of that training, pilots are being trained that a stall in a transport airplane is not always apparent nor do all stalls provide the kind of cues pilots might expect based on previous experience. Simulators are not able to fully replicate a real stall in a transport airplane, hence the training emphasizes respecting the stall warning system.
 
Of course this creates a new quandary. Consider a crew who incorrectly believes they are in a stall situation analogous to the Air France 447 accident, with the nose attitude at a nominal state but the actual AOA is quite high. They might try to recover by pushing over. In other words, the system is tricking the pilot into believing they might be in a non-existent deep stall. Absent any flight deck indication that the information they are relying on is wrong, it would be difficult to pass judgment on a pilot that is following their training.
Perhaps we need to consider adding a flight display alert that prominently shows an AOA failure with a mismatch AOA alert. This approach would parallel similar alerts for airspeed or altitude indication failures.  Accomplishing this would be fairly straight forward. Most transport airplanes have at least two, sometimes three, AOA vanes and sensor systems. A system such as outlined by Ossmann and Joos (2017) would be one possible solution:
 
An advanced fault detection and diagnosis (FDD) system to monitor the triplex redundant angle of attack measurement of a commercial large transport aircraft has been presented. The FDD system incorporates signal- and model-based fault detection algorithms. Fault isolation is achieved by an individual monitoring of the three angle of attack sensors[6].
 
An alert would be valuable in any case. This is especially true when we consider what happened with other AOA failure events, such as occurred on the Airbus that led the system protection systems to make extreme maneuvers on Qantas 72. (https://en.wikipedia.org/wiki/Qantas_Flight_72).
 
Such an alerting system would provide the pilots with the information they need to disconnect flight computers or other actions as appropriate. This should be combined with ensuring pilots understand all of the functionality of the system so they would recognize all a particular sensor failure might impact. 
Every flight depends on pilots to "fix" problems that designers did not anticipate, be they in aircraft design, procedures or the entire system design.  Give the pilot the information and skills to do that. Give the pilot information that the system has an erroneous input via its sensing system.
 
How can we prevent future problem like this?  A systems approach to analysis would be a good start.  Identifying the needs up front prior to writing the requirements for the software has to happen. Implementing System Theoretic Accident Models and Processes (STAMP) would likely be the best solution we have at present.  The majority of current risk analysis methods (FTA, Bow-Tie, FMEA, FMECA, PRA,, HFACS, ARP 4761, MIL-STD-882 etc.) are just not up to the task for finding complex system interaction problems as has been described here. Nor are those methods well suited to identify problems in systems that rely on humans and software.  STAMP (see http://psas.scripts.mit.edu/home/) can provide a way forward.
      
Knowledge can keep you alive.
 
Captain Shem Malmquist is a veteran 777 captain and accident investigator. He is coauthor of Angle of Attack: Air France 447 and The Future of Aviation Safety and teaches an online high altitude flying course with Beyond Risk Management and Flight Safety Information. He can be reached at shem.malmquist@gmail.com
 
Copyright © Shem Malmquist 2018.

Share this post


Link to post
Share on other sites

'Spend the minimum': How Lion Air hid equipment failures and beat regulators

 

Indonesian National Transportation Safety Commission officials examine a turbine engine from the Lion Air flight JT610 at Tanjung Priok port in Jakarta, on Nov 4, 2018.Indonesian National Transportation Safety Commission officials examine a turbine engine from the Lion Air flight JT610 at Tanjung Priok port in Jakarta, on Nov 4, 2018.PHOTO: REUTERS

PUBLISHED
NOV 22, 2018, 10:21 AM SGT

JAKARTA (NYTIMES) - The government safety inspector had spent all night at the Makassar airport, in eastern Indonesia, several years ago, poring over a Lion Air jet that suffered a hydraulic failure.

Telling airline employees that the plane was to be grounded until the problem was fixed, the inspector went back to a hotel for a quick shower.

When the inspector returned, the plane was on the runway, about to take off.

Furious, the inspector demanded that the passengers disembark. But a supervisor with Lion Air explained how the airline had gone over the inspector's head: Federal transportation officials in Jakarta, the Indonesian capital, had given permission for takeoff. The plane was in the air minutes later.

The notorious safety record of Lion Air, Indonesia's largest carrier and one of the world's fastest-growing airlines, is back in the spotlight after the crash of Flight 610, which hurtled nose-first into Indonesian waters with 189 people on board just minutes after takeoff on Oct 29.

Investigators are trying to figure out what deadly alchemy of factors caused a new Boeing jet to plunge into the water at more than 640kmh.

They are examining whether Boeing failed to adequately explain modifications to the plane, a new 737 Max 8 model; how Lion Air handled repeated failures with the plane's data readings for days before the crash; and how pilot training or confusion may have come into play in a case where only seconds may have been available to save the plane and its occupants.

But even as the mystery of Flight 610 is still being pieced together, one thing is clear, investigators and aviation experts say: Few airlines were less prepared to deal with crisis than Lion Air.

Interviews with dozens of Lion Air's management personnel and flight and ground crew members, as well as Indonesian investigators and airline analysts, paint a picture of a carrier so obsessed with growth that it has failed to build a proper safety culture.

As Lion Air Group, which owns several carriers including Lion Air, expands aggressively both at home and abroad, new questions are being raised about the company's stunning rise.

Even as Lion Air Group signed the two biggest aircraft deals in aviation history in recent years, its flagship carrier has suffered at least 15 major safety lapses, including a crash that killed 25 people, and hundreds more episodes that have escaped the public eye, aviation experts said.

Government safety investigators say the company's political ties have allowed it to circumvent their recommendations, as in the episode in Makassar, and to play down instances that would cause alarm elsewhere.

Lion Air became adept at passing malfunctioning equipment from plane to plane rather than fixing problems, former employees said.

Lion Air did not respond to repeated requests for comment regarding specific instances in which former employees and government investigators said the company had breached safety standards.

Mr Frank Caron, who was brought in as Lion Air's safety manager from 2009 to 2011 on orders from insurance firms, said the carrier had an average of one major engineering issue every three days, even though most of its fleet was new.

"Buying all the latest-generation, state-of-the-art engineering will be in vain if you don't have systems in place that prioritise safety," he said.

Mr Caron said that in his first month at Lion Air, insurance companies were shown logbooks that drastically understated the number of hours pilots worked.

"What I saw was a company, from the top down, that made saving money a motto - so spend the minimum on pilot training, salaries, management, everything," Mr Caron said.

Mr Edward Sirait, Lion Air Group's president director, denied that the company cut corners or dissembled in logbooks. In an interview in his sparsely furnished office, he said the company had twin priorities: growth and safety.

"When we expand, we think about all the markets we have to get," he said. "But we always develop in accordance with our fleet, human resources, crew and also the maintenance facilities."

Mr Sirait added that Lion Air pilots were "professional" and would not keep dual logbooks.

"If he was caught, his licence would get revoked," he said.

POLITICAL POWER

Lion Air, Indonesia's first low-cost private airline, was founded in 1999 by Mr Rusdi Kirana, a former typewriter salesman and pastry chef whose sole experience with the aviation industry was running a travel agency.

Today, Lion Air Group is South-east Asia's largest carrier in terms of fleet size, according to the Centre for Asia Pacific Aviation, a consultancy, and the airline has 458 planes on order.

To cater to some of its 30,000-strong workforce, the company built its own suburb on the outskirts of Jakarta, called Lion City.

Yet from the start, the airline was shrouded in secrecy. Lion Air Group released few financial details. It paid for all those jets by borrowing heavily from foreign banks and aircraft leasing companies.

Lion collected so many creditors that some banks were leery, even before the crash of Flight 610.

"A lot of the banks have full exposure or overexposure on them and are reluctant to lend more," said Mr David Yu, the managing director of Inception Aviation Holdings, a European aircraft leasing and investment company.

Back at home, the company tended to its political connections.

By 2014, Mr Kirana had ascended to the deputy chairmanship of the National Awakening Party, the largest Islamic political party in the world's biggest Muslim-majority nation. It was a curious position for an ethnic Chinese Christian businessman.

Mr Kirana, who declined to be interviewed, has served as an economic adviser to President Joko Widodo. Last year, Mr Kirana successfully lobbied to become the Indonesian ambassador to neighbouring Malaysia, where Lion Air Group is stepping up its competition with AirAsia, the region's other big low-cost carrier.

Indonesia's fortunate geography between India and China shaped Lion's ambitions, Mr Sirait said.

"We look at the radius between China and South Asia, and it will keep growing with extraordinary economic growth," he said.

"That is our dream. That's why we bought the aircraft."

For airplane manufacturers like Boeing and Airbus, low-cost carriers in the developing world are a boon, despite worries about lax safety standards.

"This is an example of a win-win situation where the people of the region are going to be able to benefit from an outstanding airline," then United States President Barack Obama said in 2011 when Lion Air Group signed a US$22 billion (S$30.2 billion) order for Boeing planes, the largest single order in the manufacturer's history.

Yet for all the ribbon-cutting jubilation, aviation experts worried the company had grown too fast for its own good.

Members of its flight and maintenance crews, speaking on the condition of anonymity to avoid losing their jobs, say they were pressured to keep double logs to hide overwork and inattention to safety.

Pilots said they resorted to using methamphetamine to survive the gruelling hours.

Over the years, Lion Air planes have collided with a cow, a pig and, most embarrassingly, one another.

Two days in a row in 2011, Lion planes skidded off the same airport runway.

In 2013, a Lion Air flight landed in the ocean rather than at the Bali airport. Official accident reports accused the 24-year-old first officer of lacking "basic principles of jet aircraft flying" and advised Lion Air to "ensure the pilots are properly trained".

"There are so many bad stories about Lion, it's hard to know where to start," said Ms Ruth Simatupang, a former investigator for Indonesia's National Transportation Safety Committee.

In the days since the crash of Lion Air Flight 610, Lion Group planes have been involved in two more episodes: one in which a plane's wing clipped an electricity pole and another in which a jet experienced a hydraulic failure.

Yet Lion has kept on growing.

"Everything that's bad about Indonesia, you can see in Lion," said Mr Alvin Lie, Indonesia's official ombudsman and an aviation expert. "Do we want this company representing us, making us look like just another third-world disaster?"

DANGER SIGNS

Captain Hasan Basri, a pilot for Lion Air, said that two years ago, he checked the logbook to find that the weather radar nestled in the nose of the plane he was to fly wasn't working.

The problem should have been fixed within 10 days. But Capt Hasan said the carrier had a habit of simply moving the faulty radar to another plane.

As the clock wound down on the next 10 days, the radar would then be switched to another plane, he said, in a dangerous game of hot potato.

Not being able to depend on the plane's hardware caused unnecessary stress on pilots, who were already overworked, former pilots for Lion Air said. Twenty-two-hour shifts weren't unusual.

Lion Air's pilots are hired on two-year contracts - a questionable practice under Indonesian labour law - and must pay the company large fines if they choose to leave the company.

Even by its own admission, Lion Air has skimped on pilot training compared with other airlines. When pilots for Garuda, Indonesia's national carrier, train to fly the Max 8, the same new model that crashed last month, they travel to Singapore to practice on a Max simulator. Lion Air pilots, by contrast, take a three-hour online-learning programme.

"For the aviation industry, safety should be No. 1," Capt Hasan said. "But the way the pilots and maintenance crews are treated, the overwork and the fatigue and the worries about the poor management of the airline, it creates an unsafe environment."

For two days before its final flight, the Lion Air plane that crashed into the Java Sea registered inaccurate data readings. Each one on its own might have seemed surmountable. But as the anomalies piled up, the plane kept on flying.

"As long as the priority is getting airplanes in the sky rather than safety, then you're going to have problems," said Ms Simatupang, the former government investigator.

Mr Sirait, Lion Air Group's president director, declined to discuss specifics of the crash of Flight 610.

Ms Laura Lazarus became a Lion Air flight attendant at 19 years old, breezing through a month of training even though she was supposed to undergo three. She flew up to six routes a day, she said.

In 2004, Ms Lazarus said, she was involved in her first accident, when a plane overshot the runway in the city of Palembang. Four months later, a jet landing in Surakarta again misjudged the runway and ploughed into a cemetery, killing 25 people.

Ms Lazarus fractured her arm, leg and hip. A chunk of her calf was ripped out.

For years, she wrangled over compensation, but she says she is done fighting.

"I have no more tears to spill over how Lion Air treated me," Ms Lazarus said. "It's best to leave all that in the past."

 

https://www.straitstimes.com/asia/se-asia/spend-the-minimum-how-lion-air-hid-equipment-failures-and-beat-regulators?utm_medium=Social&utm_campaign=STFB&utm_source=Facebook&fbclid=IwAR2xRtId_1BD0wweO0LsP175lBAhZSNSHgs7Xv8jN3SGwl__TixwsVBvX5o#Echobox=1542854327

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Sign in to follow this