The Aviation Herald Last Update: Friday, Sep 18th 2020 18:15Z

26002 Articles available

Events from Jun 19th 1999 to Sep 17th 2020 www.avherald.com Incidents and News in Aviation List by: Filter: The Aviation Herald Android App

All Android devices

Version 1.01



Your easy and simple access to The Aviation Herald on Android Devices

The App permits full offline reading, tracking of already read articles, ad free. Crash: Ethiopian B38M near Bishoftu on Mar 10th 2019, impacted terrain after departure

By Simon Hradecky, created Monday, Mar 9th 2020 18:19Z, last updated Tuesday, Mar 10th 2020 17:59Z On Mar 9th 2020 a second interim report was transmitted to ICAO, the NTSB and the BEA by Ethiopia's Aircraft Accident Investigation Bureau (EAAIB). The interim report contains 136 pages (the preliminary report had 33 pages).



At the first look the interim report now contains a lot more detail about the conversations in the cockpit though a transcript has not been included. One of the most glaring additions is what the crew did after selecting the cut out switches to CUTOUT. The report also becomes clear that the cut out switches were returned to NORMAL position after failed attempts to manually trim the aircraft.



On Page 93 and 94 the EAAIB reports the manufacturer computed the trim forces that would have been necessary to move the trim wheel according to the FDR data, which according to the EAAIB ranged between 42 and 53lbs while the first officer attempted to trim manually. The EAAIB writes quoting the CVR:



The stabilizer position values used to compute the force were synchronized with the recorded stabilizer positions values. With this synchronization, the FDR UTC time 5 h 41 min 50 s corresponds to the time value of 1,225.5 s (time used by the airplane manufacturer for its computation).



Taking into account the force applied on the control column, it was possible to assess that the copilot was pulling the control column until 5 h 41 min 49 s



From the CVR transcript:

- At 5 h 41 min 50 s, the captain requested the F/O to try moving the trim manually.

- At 5 h 41 min 50.5 s: a sound similar to the trim wheel handle extension was detected.

- At 5 h 41 min 51 s, the copilot confirmed Trim up

- At 5 h 41 min 55.5 s, the captain used an expression of expectation

- At 5 h 41 min 56 s, the copilot stated: it is not working.

The time during which the F/O tried to manually move the trim was then between 5 h 41 min 51 s and 5 h 41 min 56 s.



The narrative of the sequence of events was significantly enhanced leading to this revised summarizing narrative:



The aircraft accelerated for takeoff from runway 07R. Following normal acceleration the aircraft reached V1 39 seconds after TOGA was selected, 2 seconds later the first officer called rotate. 9 seconds after the rotate call the first officer called out "positive climb", the aircraft was climbing through about 50 feet AGL, the flight director roll mode changed to LNAV.



One second after the "positive climb" call the EAAIB continues:



At 05:38:44, shortly after liftoff, the left and right recorded AOA values began deviating. Left AOA decreased to 11.1° then increased to 35.7° while value of right AOA indicated 14.94°. Then after, the left AOA value reached 74.5° in ¾ seconds while the right AOA reached a maximum value of 15.3°, the difference between LH and RH AOA was greater than 59°and continued to be until the final loss of control.



The left stick shaker began operating and the red/black stripe exceeded the displayed speed on the left hand PFD. Left and right airspeed and altitude indications began to deviate from each other as the left hand values were affected by the erroneous left hand AoA values) with the left hand airspeed being lower than the correct ones displayed at the right hand PFD, left hand and right hand Flight Director Bars began indicating different commands.



2 seconds after the stick shaker activated, at 05:38:46, the flight director bars were removed on both left and right PFD due to the threshold of the pitch comparator of left and right F/D was exceeded. The AIB wrote: "On the LH PFD, invalid operational speeds, corrupted by the erroneous left AOA value, were displayed (LH stick shaker speed and LH minimum operation speed were always greater than the LH computed airspeed).The current LH airspeed was inside the barber band of the speed tape (black and red stripes underlying a dangerously too low speed)."



At 05:38:48, another 2 seconds later, the crew received a master caution and anti-ice indication.



At 05:38:56 the captain instructed "Command" (to engage the autopilot), the autopilot disconnect warning sounded for 2 seconds.



At 05:38:59 the aircraft climbed through 400 feet radio altitude, the flight directors engaged in VNAV mode, the pitch comparator became inactive and the flight director bars re-appeared.



At 05:39:01 the captain again called "Command", and the autopilot warning sounded again for about 2 seconds.



At 05:39:12 the first officer contacted ATC reporting they were climbing through 8400 feet, the left hand altitude were indicating 400 feet lower however. The flight directors were engaged in heading select at 072 degrees (consistent with runway heading).



The AIB then detailed the sequence of events:



During this first phase of the flight, the airplane was kept in trim through the use of the manual electrical trim commands, there was limited force required on the control column.



Before CMD A engaged, the stabilizer trim position was around 5.6 units, with elevator positions around 4° (consistent with the elevator neutral position for the stabilized flight condition).



Phase 2: During Autopilot control (from 5h 39 min 23 s until 5h 39 min 56s)



At 05:39:23, at about 1,000 feet Radio Altitude, the crew attempted a third auto-pilot engagement. CMD A (LH autopilot) engaged in HDG/VNAV modes. The pitch trim position decreased to 4.6 units. Six seconds after the autopilot engagement, there were small amplitude roll oscillations (± 5° of bank) accompanied by lateral acceleration, rudder oscillations and slight heading changes. This was most likely the result of reduced yaw damper gains due to erroneous LH AOA values.These oscillations also continued after the autopilot was disengaged.



While the autopilot was engaged,systems continued to be suppliedby the erroneous LH AOA values. As a result, SMYDC4-1 computed erroneous LH minimum operational speed values higher than the current LH computed airspeed and the FMC selected airspeed. As the LH minimum operational speed was greater than the FMC selected speed at that time, speed reversion occurred (selection of the erroneous minimum operational speed as target speed) and autopilot commanded a pitch down to accelerate towards the erroneous minimum operating speed.



At 05:39:30, the radar controller identified ET-302 and instructed to climb FL 340 and when able to turn right direct to RUDOL.



At 05:39:37, the F/O read back the clearance to the ATC.



At 5:39:38: 800 ft above field elevation was reached with the reference of the LH barocorrected altitude reference. As per automatic takeoff and climb sequence design, the A/T switched to the ARM mode.



At 05:39:42, the crew engaged Level Change mode and set MCP speed to 238kt.



At 05:39:45, flaps retraction was commanded by the captain and the F/O complied.



At 5:39:51, selected heading increased from 072° to 197°.



At the same time, the captain told the F/O to advise ATC that they were unable and request to maintain runway heading



At 05:39:56, A/P disconnected automatically after remaining engaged for 32 seconds as the following logic conditions were reached:



 Climb command with climb rate too low for five seconds

 Airspeed low relative to the minimum operating speed which was erroneously calculated by the SMYD-1.



At the beginning of this phase, the airplane was climbing with an increasing vertical speed and a trend to pitch up. Oncethe autopilot engaged the autopilot tried to increase the airspeed, because of the minimum speed reversion (erroneous LH minimum operational speed based on erroneous LH AOA value).



The A/P initially trimmed nose down 0.5 units. This nose-down trim stopped the increase in pitch at8.4°.Then pitch started to decrease. It also stopped the increase in vertical speed at 1,500 ft/min which then also started to decrease. A/P commanded a second nose-down trim.



The engagement of the LVL CHG mode and the selection of a new target speed most probably led to several transient AP mode computations leading to the decrease in vertical speed to stop at around 450 ft/min and the pitch values to stabilize at around 4°. After that, the erroneous excessive minimum speed related to the erroneous AOA triggered again an AP pitch down order to increase the speed. After reaching a maximum altitude of around 9,100 ft (RH baro corrected altitude) during this phase, the airplane started descending.



At the end of this phase, the pitch angle was around 1°, the stabilizer was at 4.6 units and the vertical speed was around -1,400 ft/min but Flaps were still moving up.



Phase 3: From A/P disconnect to stabilizer trim cutout (from 5h 39 min 56 s until 5h 40 min 38s)



At the time A/P disconnected, LH pitch F/D bar disappeared due to the same logic conditions that caused the AP disconnect.The LH pitch F/D bar appeared and disappeared several times as the climb rate varied above and below the minimum threshold.The PF applied an increasing force towards pitch up.



Between 5:39:59 and 5:40:02 the captain said:Request to maintain runway heading; We are having flight control problems ».



During this transmission:



At 5:40:00:As the flaps reached the up position and the autopilot was OFF, the FCC activated the 1st automatic nose down trim for a duration of 9 seconds triggered by erroneous left AOA value. Three seconds after the automatic nose-down trim:



o On the LH PFD, red and black stripes band was displayed all along the speed tape. It stayed displayed until the end of the recording. The LH computed airspeed was 246 kt while the RH computed airspeed was 267 kt.

o GPWS DONT SINK warning sounded for 3 seconds.

o PULL UP message appeared on both PFD for 14 seconds.



At 5:40:06, the F/O advised ATC that they are unable to maintain SHALA 1A and the captain reminded him to request runway heading. This request was approved by ATC.



At the end of the first automatic nose-down trim activation; the stabilizer position was 2.1 units with the PF pulling to pitch up the airplane, with a force greater than 90lbs.



At 5:40:14, the crew trimmed up for about 2 seconds. The trim reached 2.3 units.



At 5:40:22, the second automatic nose-downtrimactivated. Following nose-down trim activation, GPWS DONT SINK sounded for 3 s and PULL UP also displayed on PFD for 3 s.



At 5:40:29, the captain asked the F/O to trim up with him. Manual electrical trim up were recorded (from 5 h 40 min 28 s) for 9 s, which stopped the second automatic nose-down trim activation before its expected end (automatic nose-down trim activated for around 7 s instead of 9 s). During manual electrical trim up, GPWS DONT SINK warnings triggered twice for around 3 s each time. After 9 s of manual electric trim up, the crew discussed to cutout the stab trim, which is done at about 5 h 40 min 38 s.



During this phase:



- At the beginning, FMC detected a significant difference between the RH and LH True Airspeed (erroneous LH ADIRUcomputed values due to erroneous LH AOA value). From this time, FMC did not send any valid commandto A/T. The A/T stayed in the Arm Mode. The loss of valid FMC commanddid not triggerany alert or mode reversion.

- As a result of the erroneous LH AOA value and the increasing airspeed, SMYDC 1 computed LH minimum operational speed and LH stick shaker speed greater than VMO (340 kt) without any alert or invalidity detection.



At the end of this phase:



- the stabilizer position was at 2.3 units,

- The airplane was 1,500 ft above the airfield elevation (computed from the RH pressure altitude). But, the LH pressure altitude was 1,000 ft lower.

- The actual computed airspeed was 332 kt (value displayed on RHPFD) while the erroneous value displayed on the LH PFD was 308 kt.

- Pitch attitude was around 2.5° with a vertical speed of 350 ft/min.

- Roll oscillations continued and the heading slightly increased. At the end of the phase, the aircraft heading was around 080°.



Phase 4: flight while the stab trim cutout switches were in the cutout position (from 5h 40 min 38 s until 5h 43 min 11 s)



During this whole phase, the crew applied an average force value of 94lbs on the control column.



At 05:40:43: approximately five seconds after the end of the crew manual electrical trim up inputs, a third automatic nose-downtrim triggered. There was no corresponding motion of the stabilizer, which is consistent with the stabilizer trim cutout switches beingin the cutout position.



At the beginning of this phase, the captain succeeded in pitching up the airplane, the vertical speed value was 1,800 ft/min, increasing.



At 5:40:45, the captain requested the F/O to pull up with him (Pull with me). Both pilots applied force on the control column.



From that time until the end of this phase, pitch values oscillated between 7° nose up and -2° nose down. Pitch increased when both pilots applied forces, pitch decreased when a single pilot applied force (force oscillated between 80 lbs and 110 lbs). The vertical speed variations followed the variations of the pitch angle, with vertical speeds oscillating between -2,500 ft/min and + 4,400 ft/min. Crossing 9,500 ft (RH Baro corrected altitude  erroneous LH baro corrected altitude: 8,500 ft), the crew requested to stop climb at 14,000 ft.



At 05:40:50, the captain told the F/O:advise we would like to maintain one four thousand. We have flight control problem. The F/O complied. The request was approved by ATC. Following the approval of ATC, the new target altitude was set on the MCP.



At 5:41:21 the RH speed exceeded 340kts and the over speed clacker sounded. It remained active until the end of the recording as RH airspeed remained above Vmo. The RH speed values stabilized between 360 kt and 375 kt and on the LH PFD, the LH computed airspeed oscillated between 335kt and 350kt.



At 05:41:23, the selected altitude reached 14,000 ft. The captain called out speed, which was acknowledged by the F/O.



From 05:41:31 until 05:41:40, the captain asked the F/O to pitch up with him.



At 05:41:47, the Captain asked the F/O if the trim was functional. The First-Officer replied that the trim was not working and asked if he could try it manually. The Captain told him to try.



At 5:41:56 the F/O stated It is not working. The captain replied keep with me at several occasions and said that they should go up to 14,000 ft.



At 5:42:12, the crew requested a vector to return to the airport.



At 5:42:15, the F/O requested Radar Ethiopian three zero two request vector to return to home » Following ATC instruction to turn to 260°, a new target heading of 262 ° was set.The aircraft heading at that time was 102 degrees.



At 5:42:47, the captain said « Ok, what was it? Master Caution? The F/O says« Master caution? » The captain asked the F/O to verify. The F/O answered Master Caution Anti Ice. The captain said Left Alpha Vane. The F/O acknowledgedLeft Alpha Vane the FDR data at this time is consistent with the crew pressing the MASTER CAUTION recall button to review the existing faults.



During this phase, the crew was applying an average force of 94 lbs for a long time.



From 5 h 41 min 25 s, bank angle progressively increased to the right and heading increased towards the new selected heading.



At the end of the phase:



- The airplane was at an altitude of 6,200 ft above the airfield elevation (computed from the RH pressure altitude). LH altitude values were 1,250 ft lower.

- Computed airspeed was around 367 kt (RH value), LH erroneous value was 344 kt.

- The pitch angle of the airplane was lower than 1°

- The vertical speed was around + 125 ft/min and decreasing

- The bank angle was around 21° right, with a slight trend to increase.



Phase 5: Stab trim cut out switches back in normal position until the end of the flight (from 5h 43 min 11 s until 5h 43 min 44 s)



At 5:43:11, the crew tried to engage the A/P. A/P warning sounded for 3 s.



At the time of the A/P engagement attempt, 2 short-time manual electrical trim up inputs were recorded , from which it can be concluded that the stabilizer cutout switches had been restored to the normal position6; at this time, the stabilizer position was 2.3 units.



At 05:43:21, approximately five seconds after the last manual electric trim up input, automatic nose-down trim triggered for about 5 s. The stabilizer moved from 2.3 to 1 unit. 3 seconds after the automatic nose-down trim activation, the vertical speed decreased and became negative.



One second before the end of the automatic trim nose-down activation, the average force applied by the crew decreased from 100 lbs to 78 lbs in 3.5 seconds.



In these 3.5 seconds, the pitch angle dropped from 0.5° nose up to -7.8° nose down and the descent rate increased from -100 ft/min to more than -5,000 ft/min.Following the last automatic nose-downtrim activation and despite recorded force of up to 180 lbs, the pitch continued decreasing. The descent rate and the airspeed continued increasing.



At 05:43:36 the EGPWS sounded: Terrain, Terrain, Pull Up, Pull up

The recordings stoped 23 seconds after the activation of the 4th automatic nose down trim.



At the end of the recording:



- Computed airspeed values reached 500 kt

- Pitch values were greater than 40° nose down

- Vertical speed values were greater than 33,000 ft/min.



Both recorders stopped recording at around 05 h 43 min 44 s.



The report (chapter 1.6.3.3) states that speed tape and altitude tape are being withdrawn from the respective PFD and the corresponding SPD and ALT flags appears on the PFD if the ADIRU (Air Data and Inertial Reference Unit) detects the failure of the corresponding AoA (left AoA and left PFD).



The EAAIB wrote:



The ADIRU performed a limited monitoring of the AOA sensor, based on the signal received from the resolver. The ADIRU generates AOA signal failed information if it detects one or more of the following conditions:



- the resolver output is zero volts

- the combined amplitude is outside the acceptable range

- The calculated AOA vane shaft angle is outside the range defined by the mechanical stops.



The ADIRU generates AOA failed information when it detects any of the above conditions or if the reference (excitation) voltage signal provided to the AOA sensor from the aircraft 28VAC power bus is out of range.



Impact of AOA failure on ADIRU



ADIRU is advertised of AOA vane heating failure. In this case, ADIRU goes on providing its parameters without any information of failure. ADIRU only records a failure code inside its BITE memory.



If the ADIRU detects any failure through its AOA monitoring the ADIRU provides its output data with invalidity information (NCD  No Computed Data or FW  Failure warning).



The EAAIB described the MCAS system:



As originally delivered, the MCAS became active during manual, flaps-up flight (autopilot not engaged) when the AOA value received by the master FCC exceeded a threshold based on Mach number. When activated, the MCAS provided a high rate automatic trim command to move the stabilizer towards Aircraft Nose Down. The magnitude of the aircraft nose down command was based on the AOA and the Mach. After the non-normal maneuver that resulted in the high AOA, and once the AOA fell below a reset threshold, MCAS would move the stabilizer to approximately the original position and reset the system. At any time, the stabilizer inputs could be stopped or reversed by the pilots using their yoke-mounted electric stabilizer trim switches, and then the MCAS system will reset after a 5 second delay.



The latter behavior is based on the assumption that flight crews use the trim switches to completely return the airplane to neutral trim. In the FCC software version current at the time of the accident, if the original elevated AOA condition persists for more than five seconds following an MCAS flight control law reset, the MCAS flight control law will command another stabilizer nose down trim input (with the magnitude based on the AOA and Mach sensed at that time).



Editorial note: In other words: if the flight crew does not fully return the trim to the previous position (or more nose up) before the MCAS trim down input, MCAS accumulates more and more nose down trim (with the failed AoA sensor) whenever the manual electric trim has been operated and released for 5 seconds or more.



The EAAIB stated with respect to recording of the CUTOUT switches on the FDR.



No discrete parameter records the positions of the stab trim cutout switches. However, some recorded parameters provide information on these positions:



- The discrete parameter of the manual electric trim command records command (up or down) only when both stab trim cutout switches are in the normal position.

- The discrete parameter of the FCC trim command records command whatever the positions of the stab trim cutout switches are. When FCC commands are recorded, if no stabilizer motion is recorded, it means that at least one stab trim cutout switch is in the CUTOUT position.



The EAAIB reported they performed tests regarding the trim forces at the Boeing Engineering Simulator (ECAB) in Seattle configured for the 737-8 MAX. Additional tests were also performed at the Flight Controls Test Rig (FCTR). After reporting several scenarios on the FCTR the EAAIB wrote.



The fourth test was conducted at 15,000 ft and 340kts (VMO), -1.5 units (mist-rim)14, expected 35 lbs force.



- It was noted that it was impossible to turn the wheel with one hand confirming the first officers statement it was not working meaning "hard to move". Some participants expressed surprise at the difficulty. It was possible to turn the wheel with two hands although not convenient at all. The level of force for this condition was found to be between 30 and 40 lbs. It was agreed that difficulty would increase further outside the normal operating envelope (as in the accident case).



The mistrim level on the event flight was 2.5 units at 340 Kts but since the FCTR is limited to 1.5 unit of miss trim, the actual event flight condition could not be tested.





By Simon Hradecky, created Wednesday, Sep 16th 2020 13:30Z, last updated Wednesday, Sep 16th 2020 13:30Z



Time for a Culture Change



Both Boeing and the FAA share responsibility for the development and ultimate certification of an aircraft that was unsafe. Both must learn critical lessons from these tragic accidents to improve the certification process, and the FAA must dramatically amplify and improve its oversight of Boeing. While the changes that the FAA and Boeing have proposed will be the start of a long process, changing the fundamental cultural issues that led to an environment that permitted Boeing to build, and FAA to certify, a technologically faulty aircraft will take much longer.



The Committee continued the conclusions:



Do Things Right and Do the Right Thing



One of the fundamental canons for engineers is that they hold paramount the safety, health, and welfare of the public. Or as Texas State University Engineering Professor Karl Stephan says, A good engineer both does things right, and does the right thing. In the case of the 737 MAX, unfortunately, Boeing failed to meet both criteria. It did not do things right when it designed MCAS, for instance. It failed to build in essential redundancies by permitting MCAS to rely on a single AOA sensor. It allowed MCAS to activate repetitively, although at least one Boeing engineer had raised concerns about that capability. And it did not appropriately address the question of faulty AOA data and the negative implications for MCAS because a Boeing engineer falsely assumed that MCAS would not allow that to happen and shut down. That did not happen in either of the MAX crashes.



Furthermore, Boeing did not do the right thing when it removed references to MCAS from the pilots Flight Crew Operations Manual (FCOM). Without question, it was not right for Boeing to fail to share with the FAA Boeings own test data showing that it had taken a test pilot more than 10 seconds to respond to uncommanded MCAS activation, and the test pilot believed the condition was catastrophic[.] Nor did Boeing do the right thing when it became aware that the AOA Disagree alert was not functioning on more than 80 percent of the 737 MAX fleet and then failed to alert the FAA, its customers, and MAX pilots while it continued to both manufacture and deliver an estimated 200 airplanes with this known nonfunctional component.



In the weeks after the Lion Air crash, Boeing defended its development and certification of MCAS to the FAA, writing that there was no process violation or non-compliance regarding the inconsistencies in the systems development and Boeings actions, including (1) removing reference to MCAS from the FCOM, (2) determining repeated unintended MCAS activation to be no worse than a single unintended activation, (3) determining the loss of one AOA sensor followed by erroneous readings from the other AOA sensor to be extremely remote and not analyzing this scenario in its failure assessments, and (4) not reassessing failure analyses following the MCAS design change.



The FAAs own draft review of MCAS in the wake of the Lion Air crash also found no non-compliances with FAA regulations on the part of Boeing.1370 The fact that multiple technical design missteps or certification blunders were deemed compliant by the FAA points to a critical need for legislative and regulatory reforms. That Boeing was able to show that its new transport category commercial aircraft met the FAAs certification criteria, yet was involved in two fatal crashes within the span of just two years and two days after the FAA granted certification, is disconcerting. The FAAs aviation oversight system failed in dramatic fashion. This sentiment is underscored by Tommaso Sgobba, Executive Director of the International Association for the Advancement of Space Safety (IAASS), who recently observed: The Boeing B-737 MAX accidents represent a major failure of the aviation regulatory system . Indeed, producing a compliant aircraft that proved unsafe should have been an immediate wake-up call to both Boeing and the FAA that the current regulatory system that certified the MAX is broken. Unfortunately, serious questions remain as to whether Boeing and the FAA have fully and correctly learned the lessons from the MAX failures.



The Once Great Engineering Firm



The beginning of this report quoted Harry Stonecipher, the Chief Executive Officer of McDonnell Douglas who became the President and Chief Operating Officer of Boeing, who in 2004 told the Chicago Tribune: When people say I changed the culture of Boeing, that was the intent, so its run like a business rather than a great engineering firm. It is unfortunate that many current and former Boeing employees the Committee has spoken to during this investigation believe Boeing has succeeded in meeting that goal. They understand they once worked for a great engineering firm, and many hope that they will again in the future. But they realize this will happen only if Boeing begins to refocus its engineering expertise on building great, safe aircraft, and that this endeavor will be a long-term challenge.



This reports main investigative findings point to a company culture that is in serious need of a safety reset. Boeing has gone from being a great engineering company to being a big business focused on financial success. Continuing on the same path it followed with the 737 MAX, where safety was sacrificed to production pressures, exposes the company to potentially repeating those mistakes and to additional reputational damage and financial losses. One of the first steps on a new path is understanding and acknowledging the problems that did occur, the technical mistakes that were made, and the management missteps that led to the 737 MAX tragedies and the preventable death of 346 people.



However, the Committees investigation leaves open the question of Boeings willingness to admit to and learn from the companys mistakes. In a transcribed interview with Committee staff, Keith Leverkuhn, the former senior-most official on Boeings 737 MAX program, who is now Vice President of Supply Chain Propulsion for Boeing Commercial Airplanes, appeared unable or unwilling to either take responsibility for any of the problems that occurred on the MAX program or to even acknowledge that any problems existed at all.



T&I Committee staff: "In light of the two crashes and the fact that

the MAX has been grounded for more than a year, would you

consider the development of the MAX a success?"

Mr. Leverkuhn: "Yes, I would. ...

... I do challenge the suggestion that the development [of the 737

MAX] was a failure."



Several weeks before this report was finalized, multiple news stories suggested that Boeing was endeavoring to change the name of the 737 MAX to the 737-8 in an effort to combat the indelible image problems now surrounding the aircraft. If the Committees investigation offers any lessons for Boeing, it is that a name change and a public relations effort will not address the cultural issues at Boeing that hampered the safety of the 737 MAX in the first place and ultimately led to two fatal accidents and the death of 346 people. A name change may help confront a public relations problem, but only a genuine, holistic, and assertive commitment to changing the cultural issues unearthed in the Committees investigation at both Boeing and the FAA can enhance aviation safety and truly help both Boeing and the FAA learn from the dire lessons of the 737 MAX tragedies.



The Committee summarized the sequence of events leading to the crash of JT-610:



The day before the crash of Lion Air flight 610, a mechanic in Denpasar, Indonesia, replaced the AOA sensor on the left side of the accident airplane, prior to its 90-minute flight from Denpasar to Jakarta.30 The mechanic used a refurbished AOA sensor that had previously been used on a Boeing 737-900ER (NG) aircraft operated by Lion Airs Malaysian sister company, Malindo Air, and rebuilt in late 2017 by Xtra Aerospace in Miramar, Florida.



On the flight to Jakarta, MCAS activated based on an erroneous reading from the newly installed AOA sensor and commanded the airplanes horizontal stabilizer33 to push the nose down while the pilots struggled against it to stabilize the airplane.34 In this case, a third deadheading pilot who occupied the jump seat inside the flight deck35 recognized what was occurring and provided instructions to the two active pilots that enabled them to regain control of the airplane and fly it safely to Jakarta by depressing two stabilizer trim cutout switches, thereby removing electrical power from the flight control that MCAS was erroneously activating.



Upon landing in Jakarta, the captain made entries in the airplanes maintenance log about cautions and warnings that appeared during the flight. However, he did not report the flight crews use of the stabilizer trim cutout switches to address the unexpected horizontal stabilizer movement.



On the following day, October 29, 2018, Lion Air flight 610 departed Jakarta. Again, the AOA sensor provided inaccurate information to the flight control computer which triggered MCAS to move the horizontal stabilizer which pushed the airplanes nose down.38 This occurred more than 20 times as the pilots fought MCAS while struggling to maintain control of the aircraft. Unfortunately, because the previous flight crew did not document its use of the stabilizer trim cutout switches to address the same condition, the new flight crew did not have an important piece of information that could have helped them to identify and respond to the problem. Amid a cacophony of confusing warnings and alerts on the flight deck, the horizontal stabilizer ultimately forced the airplane into a nose-down attitude from which the pilots were unable to recover.



THe Committee summarized the events leading to the crash of ET-302:



Nearly five months later, on March 10, 2019, once again a faulty AOA sensor and subsequent triggering of MCAS led to the downing of Ethiopian Airlines flight 302. As opposed to the Lion Air accident airplane on which cautions and warnings on its earlier flights had given some indication of a problem, the 737 MAX operated by Ethiopian Airlines had no known technical troubles.42 However, after a normal takeoff, the left AOA sensor began producing erroneous readings.



Over the approximately six minutes that Ethiopian Airlines flight 302 was airborne following its departure from Addis Ababa, Ethiopia, MCAS triggered four times as a result of the false AOA readings and caused the airplanes horizontal stabilizer to force the airplane into a nose down attitude from which the pilots were unable to recover. Faulty AOA data that erroneously triggered MCAS to repeatedly activate played critical roles in both MAX crashes.



The Committee adressed concerns over maintenance and training of pilots as follows:



There have been some allegations made against both Lion Air and Ethiopian Airlines regarding poor maintenance and even cover-ups. For example, investigators determined that photos provided by the Lion Air mechanic that purported to document the AOA sensor repair on the accident airplane depicted a different airplane and dismissed the photos as invalid evidence. In addition, a whistleblower with knowledge of Ethiopian Airlines actions in the aftermath of the March 2019 crash alleged that staff of the carrier accessed the airplanes maintenance records the day after the accident.



Such action is contrary to protocols that call for records to be immediately sealed following a crash. However, while it is not known how, if at all, the records were altered, the whistleblower contends that this action was part of a pattern of faulty repairs and erroneous records that call into question the reliability of Ethiopian Airlines maintenance practices.



In addition to maintenance concerns, some negative aspersions have arisen about the abilities of the pilots who commanded the ill-fated Lion Air and Ethiopian Airlines flights. While Lion Air has a reputation for hiring inexperienced pilots and quickly promoting them, the 31-yearold captain of Lion Air flight 610 had accumulated over 5,100 hours of flight time on Boeing 737 airplanes, and the 41-year-old first officer had more than 4,200 hours on Boeing 737 models, indicating that they were seasoned pilots. Further, while the 29-year-old captain of Ethiopian Airlines flight 302 had reportedly not received training on the airlines 737 MAX simulatoreven though Ethiopian Airlines was one of the first airlines worldwide to purchase a 737 MAX specific simulatorthe young pilot had amassed over 5,500 flying hours on Boeing 737 airplanes, including 103 hours on the 737 MAX. Even the 25-year-old first officer of flight 302who was the least experienced of the pilotshad accumulated 207 hours flying Boeing 737 airplanes since obtaining his commercial pilots license in December 2018, just three months before the fatal crash.



Addressing the qualifications of these pilots at a June 2019 Subcommittee on Aviation hearing, Captain Dan Carey, a 35-year career pilot and then president of the Allied Pilots Association, which represents 15,000 American Airlines pilots, said in his written statement:



"To make the claim that these accidents would not happen to U.S.-

trained pilots is presumptuous and not supported by fact. Vilifying non-U.S. pilots is disrespectful and not solution-based, nor is it in line with a sorely needed global safety culture that delivers one standard of safety and training. Simply put, Boeing does not produce aircraft for U.S. pilots vs. pilots from the rest of the world."



Retired airline captain Chesley B. Sully Sullenberger III, who landed U.S. Airways flight 1549 on the Hudson River in 2009 saving all 155 people on board in what came to be known as the Miracle on the Hudson, also testified at that hearing. He offered similar sentiments about the qualifications of these pilots as part of his remarks about the two crashes. In his prepared testimony Captain Sullenberger wrote:



"These crashes are demonstrable evidence that our current system of aircraft design and certification has failed us It is obvious that grave errors were made that have had grave consequences, claiming 346 lives Accidents are the end result of a causal chain of events, and in the case of the Boeing 737 MAX, the chain began with decisions that had been made years before, to update a half-century-old design We owe it to everyone who flies, passengers and crews alike, to do much better than to design aircraft with inherent flaws that we intend pilots will have to compensate for and overcome. Pilots must be able to handle an unexpected emergency and still keep their passengers and crew safe, but we should first design aircraft for them to fly that do not have inadvertent traps set for them."



For two brand-new airplanes, of a brand-new derivative model, to crash within five months of each other was extraordinary given significant advances in aviation safety over the last two decades. While certain facts and circumstances surrounding the accidents differed, a common component in both of the accident airplanes was the new flight control feature: MCAS. Boeing developed MCAS to address stability issues in certain flight conditions induced by the planes new, larger engines, and their relative placement on the 737 MAX aircraft compared to the engines placement on the 737 NG. On March 13, 2019, the FAA grounded the 737 MAX three days after the Ethiopian Airlines crash, following similar actions taken by China, the EU, and Canada, among others. Despite optimistic predictions at the timethat a simple software fix for MCAS would allow the 737 MAX to return quickly to service the aircraft has been grounded for 18 months, with even more, newly discovered safety issues emerging since. (See New Issues Emerge below).

On Sep 16th 2020 the Committe on Transportation and Infrastructure of the United States House of Representatives released their final report of 238 pages into the safety cultures of both Boeing and FAA which led to the crashes of both Lionair's Boeing 737-8 Max and Ethiopian Airlines' Boeing 737-8 Max. The Committee concluded:The Committee continued the conclusions:The Committee summarized the sequence of events leading to the crash of JT-610:THe Committee summarized the events leading to the crash of ET-302:The Committee adressed concerns over maintenance and training of pilots as follows: By Simon Hradecky, created Tuesday, Aug 4th 2020 19:24Z, last updated Tuesday, Aug 4th 2020 19:28Z



The FAA states:



The data from the flight data recorders, as summarized in reports of the Ethiopian Airlines Flight 302 accident and the Lion Air Flight 610 accident, indicated that if a single erroneously high AOA sensor input is received by the flight control system, the maneuvering characteristics augmentation system (MCAS) can command repeated airplane nose-down trim of the horizontal stabilizer. This unsafe condition, if not addressed, could cause the flightcrew to have difficulty controlling the airplane, and lead to excessive airplane nose-down attitude, significant altitude loss, and impact with terrain.



To address the unsafe condition, the FAA proposes to require four design changes:



(1) installing updated flight control software (with new control laws) for the FCC operational program software (OPS),



(2) installing updated MDS display processing computer (DPC) software to generate an AOA disagree alert,



(3) revising certain AFM flightcrew operating procedures,



and (4) changing the routing of horizontal stabilizer trim wires.



The first design change is intended to prevent erroneous MCAS activation. The second design change alerts the pilots that the airplanes two AOA sensors are disagreeing by a certain amount indicating a potential AOA sensor failure. The third design change is intended to ensure that the flightcrew has the means to recognize an respond to erroneous stabilizer movement and the effects of a potential AOA sensor failure. The fourth design change is intended to restore compliance with the FAAs latest wire separation safety standards.



In addition to these four design changes, the FAA also proposes to require operators to conduct an AOA sensor system test and perform an operational readiness flight prior to returning each airplane to service. Finally, operators with an existing FAAapproved MEL would be required to incorporate more restrictive provisions to dispatch the airplane with certain inoperative equipment. The new master minimum equipment list (MMEL), approved by the FAA, was published on April 10, 2020, after undergoing a public notice and comment process.



The FAA further details the proposed modifications:



To ensure that an erroneous signal from a failed single AOA sensor does not prevent continued safe flight and landing, and specifically that it does not generate erroneous MCAS activation, the FAA proposes to require installation of updated FCC software with revised flight control laws associated with MCAS. These revised flight control laws would use inputs from both AOA sensors to activate MCAS. This is in contrast to the original MCAS design, which relied on data from only one sensor at a time, and allowed repeated MCAS activation as a result of input from a single AOA sensor.



The updated FCC software would also compare the inputs from the two sensors to detect a failed AOA sensor. If the difference between the AOA sensor inputs is above a calculated threshold, the FCC would disable the speed trim system (STS), including its MCAS function, for the remainder of that flight, and provide a corresponding indication of such deactivation on the flight deck.



To ensure that MCAS will not command repeated movements of the horizontal stabilizer, the revised flight control laws would permit only one activation of MCAS per sensed high AOA event. A subsequent activation of MCAS would be possible only after the airplane returns to a low AOA state, below the threshold that would cause MCAS activation.



The updated FCC software would also limit the magnitude of any MCAS command to move the horizontal stabilizer, such that the final horizontal stabilizer position (after the MCAS command) would preserve the flightcrews ability to control the airplane pitch by using only the control column. The original design allowed MCAS commands to be made without consideration of the horizontal stabilizer position  before or after the MCAS command.



An undesired MCAS activation could prompt the flightcrew to perform a nonnormal procedure. To ensure that after any foreseeable failure of the stabilizer system, safe flight is not dependent on the timeliness of the flightcrew performing a non-normal procedure, the FAA proposes multiple changes.



First, as previously discussed, the flight control laws would be changed to instead use inputs from two AOA sensors for MCAS activation, so that there would not be an undesired MCAS activation due to a single AOA sensor failure that could lead a flightcrew to perform a non-normal procedure.



Second, in the event that MCAS is activated as intended (i.e., during a high AOA event), the updated flight control laws software would limit the number of MCAS activations to one per high AOA event, and limit the magnitude of any single activation so that the flightcrew could maintain pitch control without needing to perform a nonnormal procedure.



The FAA also proposes requiring an additional software update that would alert the flightcrew to a disagreement between the two AOA sensors. This disagreement indicates certain AOA sensor failures or a significant calibration issue. The updated MDS software would implement an AOA DISAGREE alert on all 737 MAX airplanes. Some 737 MAX airplanes were delivered without this alert feature, by error. While the lack of an AOA DISAGREE alert is not an unsafe condition itself, the FAA is proposing to mandate this software update to restore compliance with 14 CFR 25.1301 and because the flightcrew procedures mandated by this AD now rely on this alert to guide flightcrew action. As a result of the changes proposed in this AD, differences between the two AOA sensors greater than a certain threshold13 would cause an AOA DISAGREE alert on the primary flight displays (PFDs). Also, as a result of the installation of this revised MDS software, operators would be required to remove INOP markers, if present, from the electronic flight instrument system (EFIS) panel of the airplane, because the markers would no longer be necessary, due to other changes in the updated MDS software that are unrelated to this unsafe condition. These markers, labeled INOP, indicate that one of the positions on the dial that selects display settings is inoperative.



To facilitate the flightcrews ability to recognize and respond to undesired horizontal stabilizer movement and the effects of a potential AOA sensor failure, the FAA proposes to mandate revising and adding certain operating procedures (checklists) of the AFM14 used by the flightcrew for the 737 MAX. All transport category airplanes have non-normal checklists to aid the pilots in responding to airplane failures.



In addition the FAA proposes changes to a number of checklists as well as addition of a number of checklists in order to reduce the workload of the crew in case of system malfunctions.



Finally the FAA states: "Since this NPRM proposes to supersede AD 2018-23-51, the procedural information required by that AD would be outdated when the final rule is effective and therefore would be removed." and later also writes:



On March 13, 2019, the FAA issued an Emergency Order of Prohibition, which prohibits the operation of Boeing Model 737-8 and 737-9 airplanes by U.S.-certificated operators or in U.S. territory.



The FAA plans to amend the Emergency Order of Prohibition in conjunction with adopting the final rule. The amended Emergency Order of Prohibition will address the actions that the Administrator deems appropriate to return the affected airplanes to service.

On Aug 3rd 2020 the FAA released Notice of Proposal for Rule Making (NPRM) 2019-NM-035-AD introducing four new requirements for the Boeing 737 MAX aircraft (compare also our letter to the FSB/FAA of Apr 25th 2019 in the part of this coverage created on May 1st 2019 13:15z).The FAA states:The FAA further details the proposed modifications:In addition the FAA proposes changes to a number of checklists as well as addition of a number of checklists in order to reduce the workload of the crew in case of system malfunctions.Finally the FAA states: "Since this NPRM proposes to supersede AD 2018-23-51, the procedural information required by that AD would be outdated when the final rule is effective and therefore would be removed." and later also writes: By Simon Hradecky, created Thursday, Sep 26th 2019 21:35Z, last updated Tuesday, Aug 4th 2020 19:28Z



The seven safety recommendations issued to the FAA are derived from the NTSBs examination of the safety assessments conducted as part of the original design of Boeings Maneuvering Characteristics Augmentation System (MCAS) on the 737 MAX and are issued out of the NTSBs concern that the process needs improvement given its ongoing use in certifying current and future aircraft and system designs.



We saw in these two accidents that the crews did not react in the ways Boeing and the FAA assumed they would, said NTSB Chairman Robert Sumwalt. Those assumptions were used in the design of the airplane and we have found a gap between the assumptions used to certify the MAX and the real-world experiences of these crews, where pilots were faced with multiple alarms and alerts at the same time. It is important to note that our safety recommendation report addresses that issue and does not analyze the actions of the pilots involved in the Lion Air and Ethiopian Airlines accidents. That analysis is part of the ongoing accident investigations by the respective authorities.



The NTSB notes in the report that it is concerned that the accident pilots responses to unintended MCAS operation were not consistent with the underlying assumptions about pilot recognition and response that were used for flight control system functional hazard assessments as part of the Boeing 737 MAX design.



The NTSB reported the sequence of events on the accident flight:



On March 10, 2019, Ethiopian Airlines flight 302, a Boeing 737 MAX 8, Ethiopian registration ET-AVJ, crashed near Ejere, Ethiopia, shortly after takeoff from Addis Ababa Bole International Airport, Ethiopia. The flight was a scheduled international passenger flight from Addis Ababa to Jomo Kenyatta International Airport, Nairobi, Kenya. All 157 passengers and crew on board died, and the airplane was destroyed. The investigation is being led by the Ethiopia Accident Investigation Bureau.



The airplanes DFDR data indicated that shortly after liftoff, the left (captains)AOAsensor data increased rapidly to 74.5° and was 59.2° higher than the right AOA sensor; the captains stick shaker activated. Concurrently, the airspeed and altitude values on the left side disagreed with, and were lower than, the corresponding values on the right side; in addition, DFDR data indicated a Master Caution alert. Similar to the Lion Air accident flight, a 9-second automatic AND stabilizer trim input occurred after flaps were retracted and while in manual flight (no autopilot). About 3 seconds after the AND stabilizer motion ended, using the stabilizer trim switches, the captain, who was the pilot flying, partially countered the AND stabilizer input by applying ANU electric trim. About 5 seconds after the completion of pilot trim input, another automatic AND stabilizer trim input occurred. The captain applied ANU electric trim and fully countered the second automatic AND stabilizer input; however, the airplane was not returned to a fully trimmed condition. Cockpit voice recorder data indicated that the flight crew then discussed the STAB TRIM CUTOUT switches, and shortly thereafter DFDR data were consistent with the STAB TRIM CUTOUT switches being moved to CUTOUT.



However, because the airplane remained in a nose-down out-of-trim condition, the crew was required to continue applying nose-up force to the control column to maintain level flight. About 32 seconds before impact, two momentary pilot-commanded electric ANU trim inputs and corresponding stabilizer movement were recorded, consistent with the STAB TRIM CUTOUT switches no longer being in CUTOUT. Five seconds after these short electric trim inputs, another automatic AND stabilizer trim input occurred, and the airplane began pitching nose down.



On Oct 11th 2019 the Joint Authorities Technical Review (JATR), having formed a panel to look into the FAA's oversight and certification procedures and having been commissioned by the FAA in April 2019, reported: "The JATR team found that the MCAS was not evaluated as a complete and integrated function in the certification documents that were submitted to the FAA." The JATR continued: "The lack of a unified top-down development and evaluation of the system function and its safety analyses, combined with the extensive and fragmented documentation, made it difficult to assess whether compliance was fully demonstrated."



Also added Oct 11th 2019: In the meantime it became known to The Aviation Herald that maintenance in Ethiopian Airlines was not up to standard. The FAA had conducted an inspection of Ethiopian Airlines' maintenance in 2016 and issued a letter on May 13th 2016 listing more than 60 findings identifying a systemic failure of the whole quality management and training management systems. The certification by FAA was restored in 2017 after the airline had provided evidence that the findings had been addressed. However, "there was no committment from the upper management to sustain the changes made and similiar violations started to appear almost within 6 months after FAA restored the suspended approval", Yonas Yohannes Yeshanew wrote in his submission to Authorities. Yonas Yohannes Yeshanew had worked his way up within Ethiopian Airlines over 12 years and became Director of Aircraft Engineering and Planning in March 2017, resigning this post in August 2019 over concerns over ethnic based grouping and nepotism, unsafe aircraft maintenance practise, hostile work environment, developing politically oriented decisions and corrupted management cultures. The report states, that EASA conducted a similiar review in 2016, EASA still does not consider the issues fully resolved and to date continues heightened monitoring of Ethiopian Airlines.



One of the ongoing maintenance issues is man power available for maintenance. Analyses produced by Ethiopian Airlines for various maintenance departments demonstrate, that available man power to conduct the necessary maintenance activities was insufficient and partly lacked 75% of the man power required to perform the jobs.



The documents provided by Yonas Yohannes Yeshanew show for example, that task cards were signed off without executing the required maintenance actions. Investigation reports by various investigation bodies identify maintenance errors as root cause of incidents like windshield cracks or engine oil leaks.



Yonas Yohannes Yeshanew also produces records of a maintenance task TSFN8004RX0R of ET-AVJ that was opened on Dec 7th 2018, when a crew reported the aircraft rolled to the right at 1000 feet AGL with autopilot engaged. The maintenance task does not show corrective action had been applied, on Feb 5th 2019 the task was shown still open, "corrective action was activated" and the "fault has been certified". No further entry occurred until Mar 11th 2019, one day after the crash, when a manual entry was added "certifying" something (details unclear). At that time however, the tech log should have been sealed already and no access be possible anymore.



Bernd Kai von Hoesslin TRI B737/Ret. (former B738 and B38M Captain for Ethiopian Airlines having left the company in April 2019, who asked specifically to be identified as source) had contacted Boeing with his observation of common practise within the company, that the gear pins, after being removed from the landing gear, were just thrown into the E & E Bay and were left unsecured in the compartment during flight. Boeing followed up on this topic and instructed Ethiopian Airlines to stop that practise, on Jun 5th 2019 Ethiopian Airlines issued job instruction cards (JIC) to maintenance to "fabricate and install a new landing gear down-lock pin holder assembly to the aft P8 panel in the flight compartment" and explained in the JIC: "Failure to secure the landing gear pins presents FOD hazard if there is turbulence during flight."



Video of gear pin storage (Video: Bernd Kai von Hoesslin):

https://www.youtube.com/watch?v=vJfd-vwoY8A



Maintenance Task TSFN8004RX0R Overview (Screenshot: Bernd Kai von Hoesslin):





Maintenance Task TSFN8004RX0R Detail (Screenshot: Bernd Kai von Hoesslin):





Maintenance Man Power Analysis for Boeing 737NG (Screenshot: Yonas Yohannes Yeshanew):





On Sep 26th 2019 the NTSB released seven safety recommendations to the FAA reporting:The NTSB reported the sequence of events on the accident flight:On Oct 11th 2019 the Joint Authorities Technical Review (JATR), having formed a panel to look into the FAA's oversight and certification procedures and having been commissioned by the FAA in April 2019, reported: "The JATR team found that the MCAS was not evaluated as a complete and integrated function in the certification documents that were submitted to the FAA." The JATR continued: "The lack of a unified top-down development and evaluation of the system function and its safety analyses, combined with the extensive and fragmented documentation, made it difficult to assess whether compliance was fully demonstrated."Also added Oct 11th 2019: In the meantime it became known to The Aviation Herald that maintenance in Ethiopian Airlines was not up to standard. The FAA had conducted an inspection of Ethiopian Airlines' maintenance in 2016 and issued a letter on May 13th 2016 listing more than 60 findings identifying a systemic failure of the whole quality management and training management systems. The certification by FAA was restored in 2017 after the airline had provided evidence that the findings had been addressed. However, "there was no committment from the upper management to sustain the changes made and similiar violations started to appear almost within 6 months after FAA restored the suspended approval", Yonas Yohannes Yeshanew wrote in his submission to Authorities. Yonas Yohannes Yeshanew had worked his way up within Ethiopian Airlines over 12 years and became Director of Aircraft Engineering and Planning in March 2017, resigning this post in August 2019 over concerns over ethnic based grouping and nepotism, unsafe aircraft maintenance practise, hostile work environment, developing politically oriented decisions and corrupted management cultures. The report states, that EASA conducted a similiar review in 2016, EASA still does not consider the issues fully resolved and to date continues heightened monitoring of Ethiopian Airlines.One of the ongoing maintenance issues is man power available for maintenance. Analyses produced by Ethiopian Airlines for various maintenance departments demonstrate, that available man power to conduct the necessary maintenance activities was insufficient and partly lacked 75% of the man power required to perform the jobs.The documents provided by Yonas Yohannes Yeshanew show for example, that task cards were signed off without executing the required maintenance actions. Investigation reports by various investigation bodies identify maintenance errors as root cause of incidents like windshield cracks or engine oil leaks.Yonas Yohannes Yeshanew also produces records of a maintenance task TSFN8004RX0R of ET-AVJ that was opened on Dec 7th 2018, when a crew reported the aircraft rolled to the right at 1000 feet AGL with autopilot engaged. The maintenance task does not show corrective action had been applied, on Feb 5th 2019 the task was shown still open, "corrective action was activated" and the "fault has been certified". No further entry occurred until Mar 11th 2019, one day after the crash, when a manual entry was added "certifying" something (details unclear). At that time however, the tech log should have been sealed already and no access be possible anymore.Bernd Kai von Hoesslin TRI B737/Ret. (former B738 and B38M Captain for Ethiopian Airlines having left the company in April 2019, who asked specifically to be identified as source) had contacted Boeing with his observation of common practise within the company, that the gear pins, after being removed from the landing gear, were just thrown into the E & E Bay and were left unsecured in the compartment during flight. Boeing followed up on this topic and instructed Ethiopian Airlines to stop that practise, on Jun 5th 2019 Ethiopian Airlines issued job instruction cards (JIC) to maintenance to "fabricate and install a new landing gear down-lock pin holder assembly to the aft P8 panel in the flight compartment" and explained in the JIC: "Failure to secure the landing gear pins presents FOD hazard if there is turbulence during flight."Video of gear pin storage (Video: Bernd Kai von Hoesslin):Maintenance Task TSFN8004RX0R Overview (Screenshot: Bernd Kai von Hoesslin):Maintenance Task TSFN8004RX0R Detail (Screenshot: Bernd Kai von Hoesslin):Maintenance Man Power Analysis for Boeing 737NG (Screenshot: Yonas Yohannes Yeshanew): By Simon Hradecky, created Wednesday, May 1st 2019 13:15Z, last updated Thursday, May 2nd 2019 11:16Z



The Aviation Herald had already submitted a number of questions to the FAA in the aftermath of the crash of LionAir's flight JT-610, see



Overall at least a total of three Boeing 737 MAX flights were affected by wrong values delivered by the left hand AoA sensor prompting the MCAS system to provide automatic, repeated and large nose down trim inputs: LionAir's JT-43 (which did not crash), JT-610 and Ethiopian Airlines' ET-302.



Prior to flight JT-43 the left AoA sensor (which was still the one mounted by Boeing during aircraft assembly) was replaced by LionAir maintenance due to repetitive similiar malfunctions on the flights before JT-43, the new AoA sensor on flights JT-43 and JT-610 however showed repetitive malfunctions again, on JT-43 the crew was able to correct, on JT-610 the crew however was not able to correct and crashed. And ET-302 shows a similiar pattern which the crew was not able to correct resulting in the crash of the aircraft, too. Neither of the three crews would have been forced to react under time pressure in order to prevent a crash, e.g. to find out what to do or identify the correct procedures to follow, without the technical malfunctions and the nose down trim inputs.



In order to ensure, that the questions not only reach the FAA press office (and may perhaps not make their way further to the relevant decision makers within the FAA for possible consideration), we decided to also submit our questions as comment to that draft in order to ensure, the FSB at least gets to know the questions (and thoughts behind them) for possible consideration.



Here is the quote of our submission to the FSB transmitted on April 25th 2019:



Dear Ladies and Gentlemen!



We have raised numerous questions with respect to the design, certification, production, manuals, pilot training, maintenance procedures etc. immediately after the crash of Lionair's flight JT-610 already, a few others were added in the aftermath of the crash of ET-302. Questions in no particular order, just as they came up during our editorial research.



I don't see them all covered in the draft published at:



https://www.faa.gov/aircraft/draft_docs/media/afx/FSBR_B737_Rev17_draft.pdf (Editorial note: original file removed, copy available via http://avherald.com/files/FSBR_B737_Rev17_draft.pdf )



hence I'd like to resubmit all my questions I already transmitted to the FAA press office in the past couple of months for a review and proper answers by the FSB in order to make sure that all those safety considerations have been taken into account:



With respect to the certification of the 737 MAX aircraft, in particular the MCAS system, I'd like to raise following questions:



1 - when was the certificate for the 737 MAX 8 requested, and when was the certification issued?



2 - what risk assessments were done within the certification procedures, in particular again with respect to the AoAs and MCAS?



3 - were the ADR (Air Data Reference) algorithms reviewed with respect to AoA?



4 - was the risk assessed that one of the AoA sensors could be damaged by a bird strike, hail strike or similiar and could show a substantially too high angle of attack?



5 - did the certification deem not necessary that an "AoA Disagree" message was to be introduced?



6 - Why was the MCAS permitted to operate on the base of a single AoA value showing too high angle of attacks? Why does the MCAS not consider the other AoA value?



7 - Was the risk assessed according to Boeing's last sentence in the notice to operators: "If the original elevated AOA condition persists, the MCAS function commands another incremental stabilizer nose down command according to current aircraft Mach number at actuation.", in particular what possibilities existed for that conditions to persist?



8 - what should the system response have been in case the AoA values disagree? How would the systems determine which value is plausible and which is erroneous? Is there any such check at all? Would MCAS not need to be prohibited if left and right AoA disagree?



9 - considering the scenario that happened to Airbus twice (the crash in Perignan and the Lufthansa A321 near Bilbao losing 4000 feet), that at least two AoA sensors froze in same positions during climb, was the risk of such a scenario on the 737s assessed, too?



10 - Did the certification consider a massive change in the function of the AoA when MCAS (as actor in the flight controls) was introduced in addition to stick shaker (monitoring only)?



11 - What is the reasoning behind the certification permitting to allow a system modify the aircraft's equilibrium (via trim) in manual flight in a way that the trim could run to the mechanical stop and thus overpower the elevator?



12 - Was the AoA input to the MCAS (or in general) ever being cross checked, e.g. by taking into account altitude, IAS, vertical speed to compute TAS via altitude, density and IAS and the angle of the airflow by computing the angle of the flight trajectory with TAS and vertical speed? Could such an crosschecking algorithm not even detect if two or more AoA sensors were frozen/faulty?



13 - is the FAA going to review the certification of the 737 MAX family (and perhaps previous 737 versions) following the findings by the KNKT so far?



14 - Russia's MAK revoked the certificate of airworthiness for the entire 737 family (from 737-100 to 737-900) three years ago claiming they found an issue in the pitch/altitude control system of the aircraft (suggesting that at least the Tatarstan crash in Kazan as well as the Flydubai crash in Rostov may have been the result of that weakness) but did not receive a satisfactory response by the FAA and Boeing, also see News: Russia suspends airworthiness certification for Boeing 737s, but does not prohibit operation of 737s. What was the issue they found?



15 - How the certification deal with spurious faults and spurious functions, in particular during maintenance? The maintenance manuals define a test to be run, then list maintenance steps one by one, the test is to be repeated after each step. If the system is found to be working during the test the maintenance task aborts with the message "You have solved the issue", which may trigger a wrong analysis and premature end of troubleshooting without removing the fault if the test apparently works correctly by random chance.



16 - Why do the FIM procedures for airspeed disagree, altitude disagree, feel difference light, inexplicable stick shaker activation etc. not reference the possibility of an AoA issue although AoA has a crucial influence onto all these error conditions, thus not guiding the AME to verify proper action of this input in each of these error conditions?



17 - On the 737 NG aircraft any autotrim can be stopped by just moving the control column in opposite direction (e.g. an autotrim nose down is stopped by a nose up control input). However, on the 737 MAX aircraft this stop has been completely disabled for MCAS to operate, hence, a trim movement can no longer be stopped by opposite control column movement causing substantial startle effects on flight crew (based on sim instructor experience). In addition, the MCAS on MAX can not be stopped by the control column trim cut out switches, only the cut out switches at the center console, while on NG autotrim could also be permanently stopped by the cut out switches at the control column without disabling manual electric trim on NG aircraft. Would the FAA not agree, that this is a very significant difference between the aircraft, that could cause a crew to lose control in time critical stages of flight? Was this risk assessed during certification of the MAX systems?



18 - The 737 MAX has been put into operation as basically identical to the 737 NG in all its characteristics, hence it was also possible to train pilots on the NG simulators. However, MCAS is not available on NG simulators disabling pilots to ever see and experience this system in real and thus recognize the condition in case of cases in flight (in addition to the issue in the previous question). Does the FAA not agree that this new type of trim runaway (with interruptions) would deserve a lot of attention and practise to recognize that condition and deal with it properly especially in time critical phases of flight? Was this risk assessed during certification of the MAX systems?



19 - have the new systems and their risks been assessed with respect to the training sylabus for flight crew? Have the recognition of such fault conditions and the reaction of flight crew to such fault conditions ever been assessed and the sylabus according been adjusted?



20 - The Australian TSB investigated two accidents and released a common accident report on two A330s that were (almost) a carbon copy of the 737 MAX AoA problems (invoking the MCAS induced crashes) near Learmonth and Perth in 2008 resulting in severe upsets and injuries induced by the Fly by Wire:



http://www.atsb.gov.au/media/3532398/ao2008070.pdf



Why have the lessons of these occurrences been ignored in both design and certification of the Boeing 737 Max 8? Are the procedures not robust enough to take such accident reports into account?



21 - Any software programmer and developer gets told in his very first hour of lessons to NEVER EVER use any input data without validation, and if he makes the same mistake again later on throughout his training, he's out of the job. So why was it possible, that such mistakes were made during design and certification of the MCAS and ADR systems?



22 - How does the design of the MCAS, the ADIRU, the AoA, the stickshaker and the TRIM CUTOUT switches match the requirements of CRM (Cockpit Resource Management), I wrote in our editorial at : "Over the more than 100 years of aviation and aircraft accident investigations one of the principles deemed most important today emerged: the Cockpit Resource Management (CRM). The principle that everybody in the cockpit as well as anything in the cockpit should ensure that all available resources in the cockpit are being used. Is it thus not a gross violation of the CRM, committed already by the designers of the aircraft, when a system does not take a second available resource into account, like the right hand AoA? How can it be argued to be in compliance with CRM when a crew can not de-activate a stick shaker that has been identified to operate erroneously, except by pulling the circuit breaker? How can it be argued, that other than on NG aircraft, where the TRIM CUTOUT switches disable automatic trim inputs and electrical manual trim inputs separately, either of the TRIM CUTOUT switches disables ALL electrical trim inputs, both manual and automatic ones depriving the crew of possibly still well functioning, available and needed resources?"



23 - With the left AoA modifying the left IAS, ALT and related data, with the right AoA modifying the right IAS, ALT and related data, with the standby data being NOT modified by AoA, however, any explanation for this missing the aircraft, flight crew operating, maintenance manuals etc., would the crew not need to invoke the unreliable airspeed procedures due to disagreeing left/right and standby data if the aircraft approaches stall or is otherwise in unusual attitudes?



24 - with the recent revelations, that cleanliness in the Boeing production facilities may not be completely ensured and metallic particles may be around, is it possible that metallic particles entered the ADIRU and caused shorts on that PCB? The malfunction of the AoA at JT-43 and JT-610 is consistent with a bit flip of bit 20 of the AoA value at some stage at or after the analog/digital conversion of the AoA sensor (and is not consistent with any mechanical malfunction of the sensor). The malfunction of the AoA at ET-302 is consistent with a bit flip of bit 22 of the AoA value at or after the analog/digital conversion except for the brief periods where the aircraft as a whole (but not the AoA sensor head) experienced negative G-loads, theories like the counter weight of the AoA vane dropped can not explain the sudden switch from about 5 to 85 degrees of AoA (in a flying aircraft with the air flow keeping the vane/flag aligned with the wind flow irrespective of what that counter weight would be doing). Is there any detection of such an electronic malfunctions by an independent system (see also the ATSB reports explaining that a system can not test itsself with any reliability - a mathematical proof is available for this!)?



25 - we hear there is common practise to just throw the gear pins into the electronics bay before departure, unsecured (yes, unsecured), hence moving freely around in the electronics bay. Is it possible, there is any link to the failures of the AoA sensors (in 5 known trouble flights always the #1/left hand AoA sensor)?



Many thanks for consideration to all this questions intended to improve the safety of aviation and the 737 Max in general.



Kind regards

Simon Hradecky

The Aviation Herald

http://avherald.com

The FAA via their Flight Standardization Board (FSB) had invited for comments until April 30th 2019 regarding their draft for certification of the Boeing 737 MAX aircraft (and differences to Boeing 737 aircraft in general).The Aviation Herald had already submitted a number of questions to the FAA in the aftermath of the crash of LionAir's flight JT-610, see Crash: Lion B38M near Jakarta on Oct 29th 2018, aircraft lost height and crashed into Java Sea, wrong AoA data , the number of questions increased in the aftermath of the crash of ET-302 and subsequent research.Overall at least a total of three Boeing 737 MAX flights were affected by wrong values delivered by the left hand AoA sensor prompting the MCAS system to provide automatic, repeated and large nose down trim inputs: LionAir's JT-43 (which did not crash), JT-610 and Ethiopian Airlines' ET-302.Prior to flight JT-43 the left AoA sensor (which was still the one mounted by Boeing during aircraft assembly) was replaced by LionAir maintenance due to repetitive similiar malfunctions on the flights before JT-43, the new AoA sensor on flights JT-43 and JT-610 however showed repetitive malfunctions again, on JT-43 the crew was able to correct, on JT-610 the crew however was not able to correct and crashed. And ET-302 shows a similiar pattern which the crew was not able to correct resulting in the crash of the aircraft, too. Neither of the three crews would have been forced to react under time pressure in order to prevent a crash, e.g. to find out what to do or identify the correct procedures to follow, without the technical malfunctions and the nose down trim inputs.In order to ensure, that the questions not only reach the FAA press office (and may perhaps not make their way further to the relevant decision makers within the FAA for possible consideration), we decided to also submit our questions as comment to that draft in order to ensure, the FSB at least gets to know the questions (and thoughts behind them) for possible consideration.Here is the quote of our submission to the FSB transmitted on April 25th 2019: By Simon Hradecky, created Tuesday, Apr 16th 2019 15:28Z, last updated Wednesday, May 1st 2019 13:44Z



On Apr 19th 2019, as result of the initial assessment released on Apr 16th 2019, The Aviation Herald received pages out of the 737-8 System Schematic Manual showing the circuitry involving the TRIM PRI CUTOUT and TRIM B/U CUTOUT Switches more clearly. The TRIM PRI CUTOUT switch appears under various different names on several pages of the manual, always being referenced as S272 however, the TRIM B/U CUTOUT switch also appears under different names in different locations always being references as S149 however. The graphics of chapter 27-41-11 page 101 makes clear both CUTOUT switches have more than one contact. One set of contacts delivers a signal to both FCC A and FCC B named "AUTO STAB TRIM CUTOUT" and thus would seem to support a possible re-activation of the Trim, however, a second set of contacts switches power supply to both control columns' Trim Up/Trim Down swiches (effectively disabling those switches with either of the CUTOUT Switches in CUTOUT position) as well as the power supply to relay R64, which in turn disconnects the TRIM MOTOR Unit from its power supply (three phases of 115V) leaving the trim motor without any power if either of the CUTOUT Switches is in position CUTOUT. Unless this schematic diagram does not agree with the actual wiring or another fault exists in the electrical wiring, it thus appears impossible the trim motor gets energized or could re-activate with either of the CUTOUT switches in CUTOUT position. For ease of understanding we have marked the 28V signal path in magenta and the power path to the trim motor (115V) in green on the system schematic diagram provided below.



Coverage released on Apr 16th:



On Apr 11th 2019 The Aviation Herald received a full copy of the Flight Operations Manual (FOM), Revision 18B released on Nov 30th 2018, which is currently being used by Ethiopian Airlines (verified in April 2019 to be current). Although Boeing had issued an operator's bulletin on Nov 6th 2018, which was put into



Quite the opposite, in section 2.6 of the FOM "Operational Irregularities" the last revision is provided as Revision 18 dated "Nov 1st 2017".



According to information The Aviation Herald had received in March 2019, the Airline Management needed to be reminded to distribute the Boeing Operator's Bulletin as well as the EAD to their pilots, eventually the documents were distributed to the flight crew. However, it was never verified, whether those documents had arrived, were read or had been understood. No deeper explanation of the MCAS, mentioned but not explained in both documents, was offered.



It turned out, that only very cursory knowledge about the stab trim runaway procedure exists amongst the flight crew of Ethiopian Airlines even 5 months after the EAD was distributed. In particular, none of the conditions suggesting an MCAS related stab trim runaway was known with any degree of certainty. In that context the recommendation by the accident flight's first officer to use the TRIM CUTOUT switches suggests, that he was partially aware of the contents of the EAD and reproduced some but not all of the provisions and not all of the procedure, which may or may not explain some of the obvious omissions in following the procedure in full.



It also came to the knowledge of The Aviation Herald, that is is possible, that the manual (and even electrical) trim may require excessive forces, so that trimming becomes impossible, in case of a full elevator pull at higher speeds. Boeing even recommended a special procedure for this out-of-trim condition with full back pressure on the yoke requiring the pilots to temporarily release back pressure on the column, and while the nose is pitching downwards and altitude changes, trim as much as possible, then pitch up again and repeat until the out of trim condition is resolved. In chapter 8.18 of Boeing's MAX Flight Crew Training Manual Boeing writes: "If manual stabilizer trim is necessary, ensure both stabilizer trim cutout switches are in CUTOUT prior to extending the manual trim wheel handles. Excessive airloads on the stabilizer may require effort by both pilots to correct the mis-trim. In extreme cases it may be necessary to aerodynamically relieve the airloads to allow manual trimming. Accelerate or decelerate towards the in-trim speed while attempting to trim manually." This procedure was first mentioned in Boeing's publication "Airliner" published in May 1961 stating (in relation to other Boeing aircraft, the 737 first flew in 1967): "To trim the stabilizer manually while holding a high stick force on control column. As the airplane changes altitude, crank in the desired trim change. Correct airplane attitude after a few seconds with elevators. Relax stick force again and crank in more trim. Repeat this procedure as necessary until proper 'trim' position of stabilizer is established."



The FDR data show that following the first MCAS activations the trim had rolled to nearly 0 units and was returned to 2.1 units by manual trim input, then the TRIM CUTOUT switches were obviously used (however, this is not fully confirmed by the preliminary report), the elevator control was fully deflected aft (nose up) throughout that period of time. In the following 3 minutes no change on the stab trim position can be observed until 2 manual electric nose up trim inputs are being recorded, the stab trim position changed to 2.3 units. The preliminary report does not provide any half way sufficient information on crew discussions or activity during these 3 minutes: did they try manual trim? If yes, wouldn't they talk to each other asking for assistance, for example? The only however ambiguous statement available: "At 05:41:46, the Captain asked the First-Officer if the trim is functional. The First-Officer has replied that the trim was not working and asked if he could try it manually. The Captain told him to try. At 05:41:54, the First-Officer replied that it is not working." Is the sentence, spoken by Ethiopia's Transport Minister, that the crew was unable to control the aircraft although following the emergency procedures, meant to indicate that the crew did attempt to manually trim the aircraft but could not move the trim wheel?



Why does the preliminary report leave entirely open as to why the electrical manual trim input moved the stab trim from 2.1 to 2.3 units at 05:43:11 although the preliminary report states: "At 05:40:35, the First-Officer called out stab trim cut-out two times. Captain agreed and First-Officer confirmed stab trim cut-out. At 05:40:41, approximately five seconds after the end of the ANU stabilizer motion, a third instance of AND automatic trim command occurred without any corresponding motion of the stabilizer, which is consistent with the stabilizer trim cutout switches were in the cutout position"? Did the crew turn the TRIM CUTOUT switches back to NORMAL? Or did the electrical trim re-activate otherwise?



In the training manual for the Boeing 737-7,-8 and -9 aircraft Boeing provides two sketches showing the schematics of the stab trim, combining the electrical automatic (including MCAS) and manual electrical trim. Both sketches are incomplete and raise several questions. The sketch on page 165 indicates the TRIM PRI CUTOUT Switch is in series with the TRIM LIMIT switches which ensure the stabilizer can never be moved beyond the mechanical limits and as such prevents any further trim command to reach the trim motor. The sketch on page 167 explains how the TRIM COLUMN CUTOUT (not be confused with the TRIM PRI CUTOUT) works: in general an electrical trim input with the control column moved into opposite direction (e.g. nose down trim with the column aft/nose up) is being disabled by according switches. However, if MCAS activates, the TRIM CUTOUT switch in the first officer's control column is being overridden by the COLUMN CUTOUT OVERRIDE relay thus enabling the MCAS nose down trim to continue even if the control column is pulled aft (nose up). On page 166 Boeing writes: "The FCC supplies the MCAS signal to enter high speed mode on the stab trim motor and bypass the aft column cutout switches for trim down commands." In Boeing's EASA training manual for the MAX-8 Boeing states the CUTOUT position of both TRIM PRI CUTOUT and TRIM B/U CUTOUT Switches read: "deactivates main electric and autopilot trim operation", it can be assumed from this write up, that the two switches are in series as well as in series with the TRIM LIMIT Switches (according to sketch page 165 of Boeing training manual) to disconnect the trim signals, either of the switches disconnecting the electric trim signals entirely.



Given the current partly heated discussions in aviation communities, all of which I feel do not take the human factors as well as cockpit resource management into account, I am about to provide my current understanding of the situation and my assessment based on the preliminary report as well as the additional documentation (relaxing my own editorial principles for a moment, that my personal opinion should not become visible in or influence my coverages):



Besides inviting you to review my questions submitted to the FAA on Nov 28th 2018 in relation to the crash of the Lionair, see



Primary cause of the accident:

- MCAS activation based on a single faulty AoA sensor input without cross check or plausibility check of the incoming AoA value, which caused the stabilizer to reach a position that could no longer be compensated by elevator inputs



Primary contributing factors int the accident:



- A false AoA value, probably produced by the Air Data Reference unit rather than a mechanical fault, which activated the stick shaker and MCAS.

- aircraft systems not adhering to principles of Cockpit Resource Management CRM (MCAS, Stick Shaker, Air Data Reference Unit, AoA, Trim CUTOUT switches)



Possibly contributing factors into the accident:

- Corporate Culture within Boeing in designing aircraft

- Corporate Culture within FAA in certifying aircraft

- Corporate Culture in Ethiopian Airlines, which did not ensure their flight crew were fully aware of the implications of the LionAir Crash and the related EAD as well as Boeing and FAA approved emergency procedures

- Less than optimal crew performance, e.g. loss of situational awareness with respect to speed and thrust



The takeoff run was entirely normal, both AoA sensors were in agreement. Shortly after becoming airborne the left AoA sensor however began to deviate and reached a position of about 85 degrees nose up, which obviously triggered the left hand stick shaker motor (and provides a very noisy and distracting cockpit environment), which in turn, different to the 737 NG behaviour (where the AoA does NOT correct the pitot data), also caused the IAS and ALT data to differ from the right hand system, in particular the left IAS became 12 knots higher than the right hand IAS (the preliminary report does not mention that the IAS DISAGREE warning activated however, which would invoke the unreliable airspeed procedures). The captain was pilot flying and focussed to keep the aircraft on track (via the flight director) due to terrain around while at the same time trying to understand why the stick shaker activated. Several required callouts by the first officer did not occur (e.g. speed, ...), as result the crew lost speed as well as thrust control completely out of sight.



This however is not unique, a training video by BAA (Baltic Aviation Academy) proves the student pilot and to some extent even the instructor struggled with speed control as well as trim control while simulating a stab trim runaway on a NG aircraft with subsequent manual stab trim control only. It is to be noted, how often the instructor needed to call "SPEED", and the lack of instructions by the student to correct the out of trim situation (only after the instructor asked several times about the trim, the student replies "not good" but does not provide any indication in which direction, nose up or nose down, the trim should be corrected), as such the video is a real eye opener (see below) and could make more understandable the workload and task saturation that may have existed in the cockpit of ET-302 under the added stress of the permanent stick shaker noise and rattle (that could only be stopped by pulling the relevant circuit breaker). The ET-302 first officer nonetheless was able to conclude and the ET-302 captain to agree, after the third trim runaway initiated by MCAS (causing about 30 nose down turns of the trim wheel) and after the third (insufficient) correction of the trim, that the TRIM PRI CUTOUT and TRIM B/U CUTOUT switches were to be put into the CUTOUT position as indicated by the preliminary report. At that point the trim position was at 2.1 units with full backpressure on the elevator controls.



With the excessive forces needed in such a situation it thus appears possible, that the crew spent the following three minutes trying to manually move the trim wheel (however, the preliminary report does not provide a transcript nor does it provide a narrative of what the crew did according to the CVR during that time). Then two manual electrical nose up trim inputs occur, that change the stab trim position from 2.1 to 2.3 units. The preliminary report does not indicate how this happened. Did the crew turn the TRIM CUTOUT switches back to NORMAL? What did they discuss prior to that event? Was the manual electrical trim switch activation inadvertent based on habit to move the trim switches to remove any load from the control column? Could such an inadvertent electrical trim switch activation perhaps re-activate the electrical trim at all (the sketches and block diagrams showing a principle but not necessarily the implementation, leaving open the option that the signal of the switches connects to a computer inhibiting the trim commands and perhaps permitting them again upon manual trim switch activation)?



Shortly after those two manual electrical trim inputs, which rolled the trim to 2.3 units, whereas the trim should have been within the green band, at least at 4 units, most probably around about 5 units, MCAS came alive again and rolled the trim nose down, there was no reaction (on trim switches or yoke) visible anymore, the aircraft lowered its nose and impacted ground. Could the lack of reaction by the crew indicate, they were taken by total surprise and did not anticipate another uncommanded electrical trim, suggesting they had not put the TRIM CUTOUT switches back to NORMAL?



As I see it (also watching the heated discussions between people condemning Boeing for their MCAS system and lack of safety minded/fault tolerant implementation of that system and those folks claiming the crew could have averted the crash but did not follow procedures) we have to deal with a lot of human factors here, the first and foremost being the startle effect, in particular with a permanent stick shaker activation that does not stop despite lowering the nose in an instinctive reaction. The added stress of the continuous noise and rattle must have contributed to further confusion - and this scenario has never been trained for, no pilot has been prepared for such a scenario yet, in which a faulty AoA value could cause a permanent stick shaker. Therefore it appears likely to me, that the focus of the crew was to keep the aircraft flying and clear of terrain while trying to get rid of that noise and stress. I'll await a deeper insight by human factors experts with considerable interest to see, whether the oversight regarding speed and thrust control can be explained by this very stress, I regard it even possible that the crew suffered task saturation. Nonetheless, the crew continued to work as a crew and came up with the obvious solution according to the EAD: use the TRIM CUTOUT switches. It needs to be seen, whether the crew was aware of all 9 conditions and symptoms leading to the MCAS trim runaway as listed by the EAD and whether the crew had read and understood the sentence in the procedure: "Electric stabilizer trim can be used to neutralize control column pitch forces before moving the STAB TRIM CUTOUT switches to CUTOUT" buried in the middle of the last paragraph of the EAD.



In the aftermath of the LionAir crash I had already raised a good number of questions to the FAA about how it was possible to certify MCAS with its dependence on a single AoA etc. Over the more than 100 years of aviation and aircraft accident investigations one of the principles deemed most important today emerged: the Cockpit Resource Management (CRM). The principle that everybody in the cockpit as well as anything in the cockpit should ensure that all available resources in the cockpit are being used. Is it thus not a gross violation of the CRM, committed already by the designers of the aircraft, when a system does not take a second available resource into account, like the right hand AoA? How can it be argued to be in compliance with CRM when a crew can not de-activate a stick shaker that has been identified to operate erroneously, except by pulling the circuit breaker? How can it be argued, that other than on NG aircraft, where the TRIM CUTOUT switches disable automatic trim inputs and electrical manual trim inputs separately, either of the TRIM CUTOUT switches disables ALL electrical trim inputs, both manual and automatic ones depriving the crew of possibly still well functioning, available and needed resources?



In avition communities there are heated discussions about whether the crew should have invoked unreliable airspeed procedures or not. Arguments are being raised that the unexpected and inexplicable stick shaker activation should have triggered working both the memory items and checklists associated with the unreliable airspeed. Arguments contrary are raised that the "IAS DISAGREE" indication, according to the preliminary report, had not occurred, which is the official trigger to perform the unreliable airspeed memory items and checklists. The benefit of the unreliable airspeed procedures would have been that the first officer would have been handed control of the aircraft, the captain would have become pilot monitoring and he would have had capacity to read the checklists and troubleshoot their situation. In addition the unreliable airspeed procedures would have called for a thrust reduction and adopting a specific pitch, which would have avoided the excessive airspeed, which in turn may have reduced or prevented the excessive forces needed to trim the aircraft. However, arguments are also raised that although the captain may have had more experience the knowledge of the aircraft and aircraft systems by the first officers would have been up to date and fresher having completed the type rating rather recently. It has also been raised that as result of a thrust reduction the aircraft would take the nose down, which would have substantially worsened their situation in flight with the stab trim overpowering the elevators earlier. The discussions are ongoing with no side gaining advantage or raising arguments that would have been able to convince beyond each side. As this discussion now rumbles on for weeks without a decisive conclusion, how would a crew in distress and under severe stress due to the cockpit environment be able to consider all those arguments that even with hindsight can not be clarified? In addition, nobody at this time could estimate based on the facts known so far (through the preliminary report, the documentation available by Boeing, FAA and operators), whether those actions in the end could have made any difference to the outcome.



In short my view: It might have been possible to avoid the crash despite the false AoA value and despite MCAS activation, especially with plenty of time available and hindsight. However, without proper preparation and information available, under serious time pressure and a stressful cockpit environment it is well possible, that the humans were well overwhelmed with the scenario, fell victim to startle effect, tunnel view and task saturation and thus were unable to come up with the correct responses to this scenario. This needs a serious review by human factors experts as well as by procedures experts. In addition, I believe the corporate culture within the airline with respect to distribution of crucial flight safety information as well as verifying that such crucial flight safety information has been correctly understood needs a review.



The lack of a complete CVR transcript makes it extremely difficult to understand the sequence of events and just creates a lot of uncertainty and speculation, the release of a reliable transcript, including all sounds that occurred in the cockpit (e.g. the clack sounds of switches, the sounds of rotaries etc. besides the crew and ATC communication) would be necessary to develop a better understanding of what happened.



As a final remark: there may or may not be a link to actions taken by Russia's MAK to suspend the airworthiness certificate of all Boeing 737 family aircraft in 2015 due to suspected constructive deficiencies in the pitch control system, see



The BAA training video (Video: BAA Training)

https://www.youtube.com/watch?v=3pPRuFHR1co



The system schematic manual, magenta signal (28V) path, green power (115V) path with CUTOUT Switches in NORMAL (Graphics: The Aviation Herald/Boeing):





The sketch on page 165 (Graphics: Boeing):





The sketch on page 167 (Graphics: Boeing):







On Apr 27th 2019 it became known, that four independent whistleblowers, current and former Boeing employees, had called the FAA hotline for whistleblowers regarding aviation safety concerns on Apr 5th 2019. The concerns reported were wiring damage to the AoA related wiring as result of foreign object damage as well as concerns with the TRIM CUTOUT switches. The FAA believes these reports may open completely new investigative angles into the causes of the two crashes in Indonesia and Ethiopia.On Apr 19th 2019, as result of the initial assessment released on Apr 16th 2019, The Aviation Herald received pages out of the 737-8 System Schematic Manual showing the circuitry involving the TRIM PRI CUTOUT and TRIM B/U CUTOUT Switches more clearly. The TRIM PRI CUTOUT switch appears under various different names on several pages of the manual, always being referenced as S272 however, the TRIM B/U CUTOUT switch also appears under different names in different locations always being references as S149 however. The graphics of chapter 27-41-11 page 101 makes clear both CUTOUT switches have more than one contact. One set of contacts delivers a signal to both FCC A and FCC B named "AUTO STAB TRIM CUTOUT" and thus would seem to support a possible re-activation of the Trim, however, a second set of contacts switches power supply to both control columns' Trim Up/Trim Down swiches (effectively disabling those switches with either of the CUTOUT Switches in CUTOUT position) as well as the power supply to relay R64, which in turn disconnects the TRIM MOTOR Unit from its power supply (three phases of 115V) leaving the trim motor without any power if either of the CUTOUT Switches is in position CUTOUT. Unless this schematic diagram does not agree with the actual wiring or another fault exists in the electrical wiring, it thus appears impossible the trim motor gets energized or could re-activate with either of the CUTOUT switches in CUTOUT position. For ease of understanding we have marked the 28V signal path in magenta and the power path to the trim motor (115V) in green on the system schematic diagram provided below.Coverage released on Apr 16th:On Apr 11th 2019