MCAS No Longer Repeats After 5 sec. If electronic Trim Inputs Are Made - B737-8 MAX

CLICK ON IMAGE FOR ENLARGEMENT VIEW

MCAS no longer repeats after 5 sec. if electronic trim inputs are made

Pilots always retain pitch control authority over MCAS input to stabilizer


Boeing emphasizes that the MCAS is not an anti-stall or stall-prevention system, as it often has been portrayed in news reports.
MCAS has three new layers of protection:

Compares inputs of both AOA sensors

Pilots always retain pitch control authority over MCAS input to stabilizer

MCAS no longer repeats after 5 sec. if electronic trim inputs are made

The new software load [P12.1] has triple-redundant filters that prevent one or both angle-of-attack (AOA) systems from sending erroneous data to the FCCs that could falsely trigger the MCAS. It also has design protections that prevent runaway horizontal stabilizer trim from ever overpowering the elevators. Boeing showed pilots that they can always retain positive pitch control with the elevators, even if they don’t use the left and right manual trim wheels on the sides of the center console to trim out control pressures after turning off the trim cut-out switches.

Most important, the MCAS now uses both left and right AOA sensors for redundancy, instead of relying on just one. The FCC P12.1’s triple AOA validity checks include an average value reasonability filter, a catastrophic failure low-to-high transition filter and a left versus right AOA deviation filter. If any of these abnormal conditions are detected, the MCAS is inhibited.
Three secondary protections are built into the new software load. First, the MCAS cannot trim the stabilizer so that it overpowers elevator pitch control authority. The MCAS nose-down stab trim is limited so that the elevator always can provide at least 1.2g of nose-up pitch authority to enable the flight crew to recover from a nose-low attitude. Second, if the pilots make electric pitch trim inputs to counter the MCAS, it won’t reset after 5 sec. and repeat subsequent nose-down stab trim commands. And third, if the MCAS nose-down stab trim input exceeds limits programmed into the new FCC software, it triggers a maintenance message in the onboard diagnostics system.

Pilots during their sim training they had never been exposed to extreme and continuous AOA indication errors, they’ve not experienced AOA induced airspeed and altitude deviations on PFDs and have not had to deal with continuous stall-warning stickshaker distractions. 

They also note that they have never been required to fly the aircraft from the point at which a runaway stab trim incident occurred all the way to landing using only the manual trim wheels. “We’re just checking boxes for the FAA".

ETHIOPIAN FLIGHT ET302 CRASH - PRELIMINARY REPORT - AOA & STAB PITCH TRIM

CLICK ON IMAGE FOR ENLARGEMENT VIEW

FACTUAL INFORMATION
HISTORY OF FLIGHT
On March 10, 2019, at about 05:44 UTC1, Ethiopian Airlines flight 302, a Boeing 737-8 (MAX), Ethiopian registration ET-AVJ, crashed near Ejere, Ethiopia, shortly after takeoff from Addis Ababa Bole International Airport (HAAB), Ethiopia.  The flight was a regularly scheduled international passenger flight from Addis Ababa to Jomo Kenyatta International Airport (HKJK), Nairobi, Kenya.  There were 157 passengers and crew on board. All were fatally injured, and the Aircraft was destroyed.
The following is based on the preliminary analysis of the DFDR, CVR and ATC communications.  As the investigation continues, revisions and changes may occur before the final report is published.
At 05:37:34, ATC issued take off clearance to ET-302 and to contact radar on 119.7 MHz.
Takeoff roll began from runway 07R at a field elevation of 2333.5 m at approximately 05:38, with a flap setting of 5 degrees and a stabilizer setting of 5.6 units. The takeoff roll appeared normal, including normal values of left and right angle-of-attack (AOA). During takeoff roll, the engines stabilized at about 94% N1, which matched the N1 Reference recorded on the DFDR. From this point for most of the flight, the N1 Reference remained about 94% and the throttles did not move. The N1 target indicated non data pattern 220 seconds before the end of recording. According to the CVR data and the control column forces recorded in DFDR, captain was the pilot flying.
At 05:38:44, shortly after liftoff, the left and right recorded AOA values deviated. Left AOA decreased to 11.1° then increased to 35.7° while value of right AOA indicated 14.94°. Then after, the left AOA value reached 74.5° in ¾ seconds while the right AOA reached a maximum value of 15.3°. At this time, the left stick shaker activated and remained active until near the end of the recording. Also, the airspeed, altitude and flight director pitch bar values from the left side noted deviating from the corresponding right side values. The left side values were lower than the right side values until near the end of the recording.
At 05:38:43 and about 50 ft radio altitude, the flight director roll mode changed to LNAV.
At 05:38:46 and about 200 ft radio altitude, the Master Caution parameter changed state. The First Officer called out Master Caution Anti-Ice on CVR.  Four seconds later, the recorded Left AOA Heat parameter changed state. 
At 05:38:58 and about 400 ft radio altitude, the flight director pitch mode changed to VNAV SPEED and Captain called out “Command” (standard call out for autopilot engagement) and an autopilot warning is recorded.
At 05:39:00, Captain called out “Command”.
At 05:39:01 and about 630 ft radio altitude, a second autopilot warning is recorded.
At 05:39:06, the Captain advised the First-Officer to contact radar and First Officer reported SHALA 2A departure crossing 8400 ft and climbing FL 320.
Between liftoff and 1000 ft above ground level (AGL), the pitch trim position moved between 4.9 and 5.9 units in response to manual electric trim inputs.  At 1000 ft AGL, the pitch trim position was at 5.6 units.
At 05:39:22 and about 1,000 feet the left autopilot (AP) was engaged (it disengaged about 33 seconds later), the flaps were retracted and the pitch trim position decreased to 4.6 units.
Six seconds after the autopilot engagement, there were small amplitude roll oscillations accompanied by lateral acceleration, rudder oscillations and slight heading changes.  These oscillations continued also after the autopilot was disengaged.
At 05:39:29, radar controller identified ET-302 and instructed to climb FL 340 and when able right turns direct to RUDOL and the First-Officer acknowledged.
At 05:39:42, Level Change mode was engaged.  The selected altitude was 32000 ft.  Shortly after the mode change, the selected airspeed was set to 238 kt.
At 05:39:45, Captain requested flaps up and First-Officer acknowledged. One second later, flap handle moved from 5 to 0 degrees and flaps retraction began. 
At 05:39:50, the selected heading started to change from 072 to 197 degrees and at the same time the Captain asked the First-Officer to request to maintain runway heading.
At 05:39:55, Autopilot disengaged,
At 05:39:57, the Captain advised again the First-Officer to request to maintain runway heading and that they are having flight control problems. 
At 05:40:00 shortly after the autopilot disengaged, the FDR recorded an automatic aircraft nose down (AND) activated for 9.0 seconds and pitch trim moved from 4.60 to 2.1 units. The climb was arrested and the aircraft descended slightly. 
At 05:40:03 Ground Proximity Warning System (GPWS) “DON’T SINK” alerts occurred.
At 05:40:05, the First-Officer reported to ATC that they were unable to maintain SHALA 1A and requested runway heading which was approved by ATC.
At 05:40:06, left and right flap position reached a recorded value of 0.019 degrees which remained until the end of the recording.
The column moved aft and a positive climb was re-established during the automatic AND motion. 
At 05:40:12, approximately three seconds after AND stabilizer motion ends, electric trim (from pilot activated switches on the yoke) in the Aircraft nose up (ANU) direction is recorded on the DFDR and the stabilizer moved in the ANU direction to 2.4 units.  The Aircraft pitch attitude remained about the same as the back pressure on the column increased.
At 05:40:20, approximately five seconds after the end of the ANU stabilizer motion, a second instance of automatic AND stabilizer trim occurred and the stabilizer moved down and reached 0.4 units.
From 05:40:23 to 05:40:31, three Ground Proximity Warning System (GPWS) “DON’T SINK” alerts occurred.
At 05:40:27, the Captain advised the First-Officer to trim up with him. 
At 05:40:28 Manual electric trim in the ANU direction was recorded and the stabilizer reversed moving in the ANU direction and then the trim reached 2.3 units.   
At 05:40:35, the First-Officer called out “stab trim cut-out” two times. Captain agreed and FirstOfficer confirmed stab trim cut-out.
At 05:40:41, approximately five seconds after the end of the ANU stabilizer motion, a third instance of AND automatic trim command occurred without any corresponding motion of the stabilizer, which is consistent with the stabilizer trim cutout switches were in the ‘’cutout’’ position
At 05:40:44, the Captain called out three times “Pull-up” and the First-Officer acknowledged.
At 05:40:50, the Captain instructed the First Officer to advise ATC that they would like to maintain 14,000 ft and they have flight control problem. 
At 05:40:56, the First-Officer requested ATC to maintain 14,000 ft and reported that they are having flight control problem. ATC approved.
From 05:40:42 to 05:43:11 (about two and a half minutes), the stabilizer position gradually moved in the AND direction from 2.3 units to 2.1 units. During this time, aft force was applied to the control columns which remained aft of neutral position.  The left indicated airspeed increased from approximately 305 kt to approximately 340 kt (VMO). The right indicated airspeed was approximately 20-25 kt higher than the left. 
The data indicates that aft force was applied to both columns simultaneously several times throughout the remainder of the recording.
At 05:41:20, the right overspeed clacker was recorded on CVR. It remained active until the end of the recording.
At 05:41:21, the selected altitude was changed from 32000 ft to 14000 ft.
At 05:41:30, the Captain requested the First-Officer to pitch up with him and the First-Officer acknowledged.
At 05:41:32, the left overspeed warning activated and was active intermittently until the end of the recording.
At 05:41:46, the Captain asked the First-Officer if the trim is functional. The First-Officer has replied that the trim was not working and asked if he could try it manually. The Captain told him to try. At 05:41:54, the First-Officer replied that it is not working.
At 05:42:10, the Captain asked and the First-Officer requested radar control a vector to return and ATC approved.
At 05:42:30, ATC instructed ET-302 to turn right heading 260 degrees and the First-Officer acknowledged.
At 05:42:43, the selected heading was changed to 262 degrees.
At 05:42:51, the First-Officer mentioned Master Caution Anti-Ice. The Master Caution is recorded on DFDR.
At 05:42:54, both pilots called out “left alpha vane”.
At 05:43:04, the Captain asked the First Officer to pitch up together and said that pitch is not enough.
At 05:43:11, about 32 seconds before the end of the recording, at approximately 13,4002 ft, two momentary manual electric trim inputs are recorded in the ANU direction.  The stabilizer moved in the ANU direction from 2.1 units to 2.3 units.
At 05:43:20, approximately five seconds after the last manual electric trim input, an AND automatic trim command occurred and the stabilizer moved in the AND direction from 2.3 to 1.0 unit in approximately 5 seconds.  The aircraft began pitching nose down. Additional simultaneous aft column force was applied, but the nose down pitch continues, eventually reaching 40° nose down.  The stabilizer position varied between 1.1 and 0.8 units for the remainder of the recording.
The left Indicated Airspeed increased, eventually reaching approximately 458 kts and the right Indicated Airspeed reached 500 kts at the end of the recording.  The last recorded pressure altitude was 5,419 ft on the left and 8,399 ft on the right. 

SOFTWARE Glitches - UPDATE for Boeing 737-800 MAX on AOA - On PFD AOA Indicator & Message Alert

http://www.boeing.com/commercial/737max/737-max-software-updates.page

Overview

The Maneuvering Characteristics Augmentation System (MCAS) flight control law was designed and certified for the 737 MAX to enhance the pitch stability of the airplane – so that it feels and flies like other 737s.

MCAS is designed to activate in manual flight, with the airplane’s flaps up, at an elevated Angle of Attack (AOA).

Boeing has developed an MCAS software update to provide additional layers of protection if the AOA sensors provide erroneous data. The software was put through hundreds of hours of analysis, laboratory testing, verification in a simulator and two test flights, including an in-flight certification test with Federal Aviation Administration (FAA) representatives on board as observers.

The additional layers of protection include:

·         Flight control system will now compare inputs from both AOA sensors. If the sensors disagree by 5.5 degrees or more with the flaps retracted, MCAS will not activate. An indicator on the flight deck display will alert the pilots.

·         If MCAS is activated in non-normal conditions, it will only provide one input for each elevated AOA event. There are no known or envisioned failure conditions where MCAS will provide multiple inputs.

·         MCAS can never command more stabilizer input than can be counteracted by the flight crew pulling back on the column. The pilots will continue to always have the ability to override MCAS and manually control the airplane.

These updates reduce the crew’s workload in non-normal flight situations and prevent erroneous data from causing MCAS activation.

We continue to work with the FAA and other regulatory agencies on the certification of the software update.

Training

To earn a Boeing 737 type rating, pilots must complete 21 or more days of instructor-led academics and simulator training. Differences training between the NG and MAX includes computer-based training (CBT) and manual review.

Boeing has created updated CBT to accompany the software update. Once approved, it will be accessible to all 737 MAX pilots. This course is designed to provide 737 type-rated pilots with an enhanced understanding of the 737 MAX Speed Trim System, including the MCAS function, associated existing crew procedures and related software changes.

Pilots will also be required to review:

·         Flight Crew Operations Manual Bulletin

·         Updated Speed Trim Fail Non-Normal Checklist

·         Revised Quick Reference Handbook

Key Definitions

Maneuvering Characteristics Augmentation System (MCAS) – flight control law implemented on the 737 MAX to improve aircraft handling characteristics and decrease pitch-up tendency at elevated angles of attack.

Angle of Attack (AOA) – the difference between the pitch angle (nose direction) of the airplane and the angle of the oncoming wind.

Angle of Attack Sensor / Vane – hardware on the outside of the airline that measures and provides angle of attack information to onboard computers; also referred to as an AOA vane.

Angle of Attack Disagree – a software-based information feature that alerts flight crews when data from left and right angle of attack sensors disagree. This can provide pilots insight into air data disagreements and prompts a maintenance logbook entry.

Angle of Attack Indicator – a software-based information feature that provides angle of attack data to the flight crew through the primary flight displays. It is an option that can be selected by customers.

Control law – a set of software that performs flight control function or task

FCOM (Flight Crew Operations Manual Bulletin) – supplementary operations information

FOTB (Flight Operations Technical Bulletin) – supplementary technical information

Speed trim system – a system that uses multiple components to provide additional speed or pitch stability when needed

Stick Shaker & AOA System Anomalies - RECOGNITION AND RECOVERY TECHNIQUES

Stick shaker. An artificial stall warning system is required for airplane certification if the natural prestall buffet characteristics of the airplane are insufficient to warn the flight crew of an impending stall. This warning must be in a form other than visual to be effective, even if the flight crew is not looking at the instrument panel. Beginning with early commercial jetliners, standard practice has been to equip these airplanes with a stick shaker as a means of stall warning. Some airplanes also have employed stick nudgers or stick pushers to improve stall avoidance and stall characteristics. All these indications have been driven by an AOA threshold, which is usually a function of flap configuration, landing gear configuration, or both.

Because of the effect of Mach number on stall AOA, the stall warning AOA typically was set at a conservative level to accommodate gross weight and altitude variations expected in the terminal area.

It should be noted that the stall warning schedule does not follow the buffet boundary at very high Mach numbers. The buffet here is caused by Mach buffet, or too high a speed. Setting the stall warning system to activate at this point may lead the flight crew to believe the airplane is near stall and increase, rather than decrease, speed.

The early stall warning system thresholds were not set to be effective at cruise altitudes and speeds because they did not correct for Mach number. This kept the system simple. The stick shaker was set at an AOA effective for low altitudes but at too high a value for cruise. Natural stall buffet was found to give satisfactory warning at higher Mach numbers.

Later stall warning systems used Mach number from the pitot or static air data system to adjust the stall warning AOA threshold down as Mach number increased. This provided the flight crew with a stall warning related to the actual available performance. However, it also made the stall warning system dependent on good pitot and static data, a factor that will be considered in the next section on the dedicated AOA indicator.

SYSTEM ANOMALY RECOGNITION AND RECOVERY TECHNIQUES

Regardless of the nature of erroneous flight instrument indications, some basic actions are key to survival. The longer erroneous flight instruments are allowed to cause a deviation from the intended flight path, the more difficult recovery will be. Some normal procedures are designed, in part, to detect potential problems with erroneous flight instruments to avoid airplane upsets. Examples are the 80-kn call on takeoff and callouts for bank angle exceedances. In some cases the flight crew may need to recover the airplane from an upset condition: unintentional pitch greater than 25 deg nose high or 10 deg nose low, bank angle in excess of 45 deg, or flying at airspeed inappropriate for conditions. As the condition deteriorates, it becomes more dynamic and stressful. This stress increases the difficulty flight crews experience in determining, believing, and adjusting to using the correct instruments and ignoring the faulty instruments. Regardless of the situation, good communication between crewmembers is essential, and several basic actions are paramount:

Recognizing an unusual or suspect indication.

Keeping control of the airplane with basic pitch and power skills.

Taking inventory of reliable information.

Finding or maintaining favorable flying conditions.

Getting assistance from others.

Using checklists

ACCIDENT AND INCIDENT CASE STUDIES

Erroneous flight information such as the many and varied symptoms of pitot-static anomalies can confuse an unprepared flight crew. Because of the confusion caused by multiple and sometimes conflicting alerts and warnings, the flight crew may not recognize an air data error and may fail to respond appropriately. The following accidents and incidents show what can happen when a crew is confronted with unreliable or erroneous flight information.

In December 1974, a Boeing 727 crashed 12 min after takeoff while on a positioning flight from Buffalo, New York, in the United States. Three crewmembers were killed and the airplane was destroyed. The U.S. National Transportation Safety Board (NTSB) determined that the probable cause of the accident was flight crew failure to recognize and correct the airplane's high angle of attack and low speed stall. The stall was precipitated by the crew's reaction to erroneous airspeed indications caused by atmospheric icing blockage of the pitot probe. The pitot heat switch had not been turned to the ON position.

 In April 1991, the crew on a large corporate jet survived the following incident. On the previous leg, the captain's airspeed/Mach indicator and the standby airspeed/Mach indicator were erratic. The ground crew was unable to duplicate the problem. The next leg was at night in visual conditions. It was uneventful until the crew observed the first officer's airspeed/Mach indicator begin an uncommanded increase as the airplane climbed through FL310. Passing FL330, the captain's airspeed remained steady, but the first officer's airspeed pointer exceeded "barber pole," and the high-speed aural clacker activated. The autothrottles were disconnected, and at that point the captain's airspeed indicator began to show a decrease in airspeed that coincided with the standby airspeed/Mach indicator. Because of problems reported on the previous leg, the crew assumed that the captain's instruments were faulty. As the first officer's airspeed/Mach indicator kept increasing, the crew pulled the power back to silence the clacker, but the first officer's airspeed continued to increase and the captain's airspeed indicator continued to decrease. The airplane began to shake, which the crew assumed was high-speed Mach tuck. At FL340, the pitch was increased and stick shaker activated. The crew suddenly realized that they were entering a stall. While performing stall recovery procedures, they experienced severe vertigo, spatial disorientation, and confusion over determining the actual airspeed. Though the clacker was still sounding, fuel flow, attitude, and N1 were calculated for descent. Appropriate checklists were run and the circuit breakers were pulled to silence the clacker. Using calculated attitude and power settings, a descent, instrument landing system approach, and uneventful landing were accomplished. Maintenance later confirmed that the first officer's central air data computer had failed.

 In February 1996, a Boeing 757 crashed after takeoff from the International Airport of Puerto Plata, Dominican Republic. After climbing through 7,300 ft, the airplane descended until it crashed into the Atlantic Ocean about 5 mi off the coast of the Dominican Republic. All 189 people on board were killed, and the airplane was destroyed. Data from the cockpit voice recorder (CVR) and flight data recorder (FDR) indicate that the airspeeds displayed to the captain during the takeoff roll were incorrect and that the captain was aware of this during the takeoff roll. Nevertheless, the captain decided to continue the takeoff, and the first officer notified the captain when the airplane reached V1 and Vr. Shortly after takeoff, the captain commented that his airspeed indicator had begun to operate, even though it indicated unrealistic airspeeds. A normal climbout ensued, and the captain engaged the center autopilot. During the climb, at an altitude of 4,700 ft, RUDDER RATIO and MACH/SPD TRIM advisory messages appeared on the engine indication and crew alerting system display unit. For the next several minutes, the crewmembers discussed the significance of these advisory messages and expressed confusion about the airspeed. At an altitude of about 7,000 ft, the captain's airspeed indicator showed 350 knots, and an overspeed warning occurred, immediately followed by activation of the stall warning system stick shaker. Flight crew confusion about appropriate airspeed, thrust setting, and proper pitch attitude was evident as the airplane stalled, descended, and then crashed. The erroneous readings from the captain's airspeed indicator are consistent with a blocked pitot tube. Comments by the first officer recorded on the CVR suggest that his pitot probe was not obstructed, and he was seeing correct airspeed indications on his display.

 In October 1996, a Boeing 757 crashed into the Pacific Ocean about 30 mi off the coast of Lima, Peru. The flight crew declared an emergency immediately after takeoff because of erroneous airspeed and altitude indications and was attempting to return to Lima when the accident occurred. Data from the CVR and FDR revealed that the airspeed and altitude readings were normal during the takeoff roll. However, as the airplane began to climb, the flight crew noticed that the airspeed indications were too low and the altitude indications were increasing too slowly. Shortly after takeoff, the windshear warning activated, despite calm wind conditions and no significant weather activity. The flight crew declared an emergency and expressed confusion about the airplane's airspeed and altitude displays. Analysis of FDR data indicates that the airplane subsequently climbed to a maximum altitude of approximately 13,000 ft. When the airplane descended, the captain's altitude and airspeed displays were still erroneous, but at that point they indicated higher-than-actual conditions. During descent, the first officer's displayed airspeed slowed to the point of stall warning stick shaker activation. Meanwhile, the captain's airspeed read over 350 knots, and the overspeed warning was sounding. Flight crew confusion about airspeed and altitude was evident as the airplane continued its final descent. At impact into the Pacific Ocean, the captain's flight instruments were reading approximately 9,500 ft and 450 kn. The erroneous indications recorded by the FDR are consistent with a partial blockage of the captain's static ports.

 Three valuable lessons emerged from the investigations of these events. First, the effects of flight instrument anomalies appear during or immediately after takeoff. Second, flight crews must overcome the startle factor associated with rare anomalous events and immediately begin to implement specific corrective procedures and techniques. Finally, flight crews should acquire enough system knowledge to be able to determine the difference between valid and faulty display information.

AOA – Angle of Attack probe has been used as a primary performance parameter for years on some military aircraft, particularly on fighters. There are many good reasons for this.

In general, fighters operate more often at the extremes of the envelope, often flying at maximum lift for minimum radius turns. For other applications, AOA minimizes the pilot (usually single-place) workload by giving a simple target to fly. AOA is accurate enough for these applications. In addition, the higher sweep and lower aspect ratio of the wing reduce the sensitivity to AOA errors.

AOA has proved particularly useful for approach to aircraft carriers, where it is important to maintain a consistent approach attitude for each landing. In this case, 'backside' approach techniques are used, where glide path is controlled primarily by changes in thrust while the aircraft is held at a fixed AOA. Use of this technique during approach on commercial jet airplanes would be contrary to the pitch commands provided by the flight director bars, and to the speed hold mode of the autothrottle, which is often used during approach.

ETHIOPIAN FLIGHT ET302 and LION AIR FLIGHT 610 - Plunged After Nose Down and Up Repeatedly

STICK SHAKER ACTIVATION - After Lift Off - In Actual Case