[davepage]

It does not appear to be "precisely" the procedure, in that sufficient nose up trim was not selected by the yoke manual trim switch prior to pulling the trim cutouts. And then they did not work the mechanical trim wheel hard enough to reset the residual nose down trim.

And, the crew left the power setting at climb throughout almost the entire sequence, so they oversped the airframe.

And, when they (against procedure) (apparently) turned the electric trim system back on, they did not use the yoke manual trim switch to fix the nose down trim problem -- which is a big mystery.

The MCAS design inhibits its FCC trim down output when manual trim is utilized. So, if they had just continuously pushed the nose up manual trim switch on the yoke until they got the trim to neutral, then pulled the cutout (either the first time or second time), the accident could have been avoided.

History shows this is not a good human factors design on the part of Boeing, but the crew does not look good, either, IMO.

[cjbprime]

> sufficient nose up trim was not selected by the yoke manual trim switch prior to pulling the trim cutouts

The EAD/service bulletin doesn't talk about sufficient nose up trim or caution against performing the cutout with even a slight mistrim.

> And then they did not work the mechanical trim wheel hard enough to reset the residual nose down trim.

It's possible that aerodynamic load (of the stabilizer opposing the elevator) made it physically impossible to manually trim given any mistrim at the time the cutout happened, given the airspeed they had. And, the captain is pulling back on the yoke as hard as he can, so he's unavailable to let go of it and grab a trim wheel instead without immediately losing altitude.

> And, when they (against procedure) (apparently) turned the electric trim system back on

It seems sensible to assume -- and the report states -- that they did this because they found that manual trim was impossible in these circumstances.

[calecon323]

You're right that the service bulletin doesn't talk about selecting selecting a sufficient nose up trim because control of the aircraft using manual trim is a continuous action performed in combination with the pitch up command of the control yoke. Just pulling up on the control column and activating momentary manual trim isn't sufficient or intended. I understand why people think the checklist implies that performing a STAB TRIM cutout occurs instantly after the autopilot is disengaged because of the "if runaway continues" language.

[davepage]

The Boeing/Ethiopian ETH-2 bulletin quoted in the above linked AAIB preliminary report on page 33 says "Initially, higher control forces may be needed to overcome any stabilizer nose down trim already applied. Electric stabilizer trim can be used to neutralize control column pitch forces before moving the STAB TRIM CUTOUT switches to CUTOUT ..."

[msbarnett]

> Electric stabilizer trim can be used to neutralize control column pitch forces before moving the STAB TRIM CUTOUT switches to CUTOUT ..

Which really under explains the situation. In reality the STAB TRIM CUTOUT must be switched to CUTOUT within 5 seconds of using the electronic stabilizer trim, or the MCAS will re-establish the forces.

[verytrivial]

Wow. This sub-thread is making the images of the grounded MAXs look a whole lot less like an overabundance of caution. If accurate this failure dynamic sounds more like some nasty boss at the end of an escape room game than standard fault diagnostics.

[cjbprime]

Yeah, I think that's fairly put. The MCAS system was pretty straightforwardly trying to kill them, and the only way to disable it also disabled their method of recovering from what it was doing.

[kayfox]

> It's possible that aerodynamic load (of the stabilizer opposing the elevator) made it physically impossible to manually trim given any mistrim at the time the cutout happened, given the airspeed they had.

Its been noted in previous discussions that while it would be difficult, the load can be overcome if both pilots were to operate the manual trim wheel at the same time.

Not that its a good situation to be in.

[cjbprime]

> Its been noted in previous discussions that while it would be difficult, the load can be overcome if both pilots were to operate the manual trim wheel at the same time.

I haven't seen that noted anywhere, and have seen it theorized as impossible without motor assist, given their airspeed and with the elevator opposing. Got a link?

[swhitt]

Manual Stabilizer Trim

Excessive airloads on the stabilizer may require effort by both pilots to correct the mis-trim. In extreme cases it may be necessary to aerodynamically relieve the airloads to allow manual trimming. Accelerate or decelerate towards the in-trim speed while attempting to trim manually.

https://www.pilot18.com/wp-content/uploads/2017/01/B737NG_FC... page 312 (8.16)

[cjbprime]

To be clear, that's a link that agrees with me that it can be impossible, not a link that says they just needed to work harder.

It's also from a 20 year-old manual, and isn't present on newer manuals, and pilots haven't trained on it in decades. Not appropriate to expect pilots to know, and possibly not helpful here: the pilots were low altitude, so allowing the nose to drop even further (to relieve aerodynamic load) may have been deadly too.

[swhitt]

https://www.satcom.guru/2019/04/stabilizer-trim-loads-and-ra... does a pretty good job of summarizing it I think. It sounds incredibly difficult to do.

[3JPLW]

Is it still possible at or near VMO? And when the trim is maxed out? I don't think I've seen an authoritative answer on that, and that's the situation they faced.

[cjbprime]

Another commenter pointed out that the captain is pulling back as hard as he possibly can on the yoke; releasing it to turn a trim wheel instead may have been just as deadly.

[VBprogrammer]

If my reading of the graphs is correct they are above Vmo for most of the episode. I'm surprised the flight surfaces weren't torn from their hinges.

[na85]

Vmo incorporates a factor of safety in its specification, so exceeding it is not a "parts fall off the aircraft" event.

Vne is where things start to get scary because it's usually based on flutter, which can catastrophically damage/destroy the aircraft in very short order.

[msbarnett]

> And, the crew left the power setting at climb throughout almost the entire sequence, so they oversped the airframe.

I believe that's correct given that they had an Unreliable Airspeed Indicator warning (due to the malfunctioning AoA sensor), per the memory items on the UAI checklist.

It makes the forces on the trim wheel much worse, which explains why they couldn't turn it, but it's the correct checklist response to the conditions observed, and the Boeing/FAA directive completely failed to take the impact of this response into account.

[VBprogrammer]

> I believe that's correct given that they had an Unreliable Airspeed Indicator warning (due to the malfunctioning AoA sensor), per the memory items on the UAI checklist.

The idea that a pilot would knowingly leave thrust at climb power while in modestly level flight at low altitude and expect not to overspeed is very strange to me, checklist or no checklist.

I think they were too busy fighting the controls to worry about that.

[acqq]

They followed Boeing instructions (provided in the report, Appendix 2, and also here: https://theaircurrent.com/wp-content/uploads/2018/11/B737-MA... ).

Note IAS DISAGREE alert:

"In the event of an uncommanded horizontal stabilizer trim movement, combined with any of the following potential effects or indications resulting from an erroneous Angle of Attack (AOA) input, the flight crew must comply with the Runaway Stabilizer procedure in the Operating Procedures chapter of this manual:

- Continuous or intermittent stick shaker on the affected side only.

- Minimum speed bar (red and black) on the affected side only.

- Increasing nose down control forces.

- IAS DISAGREE alert.

- ALT DISAGREE alert.

- AOA DISAGREE alert (if the option is installed)"

About which was written here:

https://leehamnews.com/2019/04/03/et302-used-the-cut-out-swi...

"the high speeds observed" ... "were logical. It’s a consequence of following the Emergency checklist for “IAS disagree” (IAS is Indicated Airspeed, i.e. the dynamic air pressure experienced by the aircraft) after takeoff."

In short, seeing that Boeing indeed wrote about the IAS alert being activated when the sensor fails, and MCAS gets activated, I can only conclude that Boeing indeed knew that the pilots would make the plane uncontrollable if they followed Boeing's instructions. It seems they just gambled on the chance that the second crash won't happen so soon after the first.

Either that, or we'd have to believe that what a single pilot manage to do for his Youtube video a company which is to deliver the planes in worth of hundreds of billions (!) of USD wasn't able to do.

[wazoox]

Part of the procedure is to keep thrust or augment it, after disengaging auto-throttle. Remember that they were in stall warning, too (stick shaker), which certainly shouldn't incite anyone to throttle down.

[msbarnett]

Setting it to climb is literally a memory item, pictured here: https://aviation.stackexchange.com/questions/24739/what-is-t.... That’s pitch 5 degrees up, thrust at climb at their altitude.

Why? Because your instruments disagree about your airspeed. You want to have a large margin to keep your speed high enough that you won’t accidentally stall while you try to establish what’s reliable.

[VBprogrammer]

Sure, and you then hold that until the aircraft stalls at 45000ft? Of course not.

You can't point at a memory item and treat it like the pilots can only apply what's in there in exclusion to everything else. The structural limits of the aircraft are there for a reason.

Aside from anything else the pilots were trying to maintain altitude by their communication with ATC.

Not that I'm blaming them. I think they had too much going on to even consider moving the throttles, and thats 100% on Beoing, but it probably didn't help their chances of recovery.

[cjbprime]

I think they couldn't turn the trim wheel because STAB TRIM CUTOUT unpowers it.

[msbarnett]

No, the wheel has an extendable crank handle and is meant for manual use precisely when the electronic stabilizer trim is cutout.

But aerodynamic forces can conspire to make it very hard or physically impossible for human force to rotate it if the elevator is being used to combat the stabilizer at high speeds. See here for more discussion of the physics behind it: https://www.satcom.guru/2019/04/stabilizer-trim-loads-and-ra...

[cjbprime]

Thanks, that makes sense. When the report says that the pilots found manual trim impossible after STAB TRIM CUTOUT, do you think it's referring to an attempt at manual electric trim (expected to fail) or both pilots manually moving the trim wheels with the handle?

[msbarnett]

My (non-expert) reading is that the co-pilot couldn't move the wheel, while the pilot was engaged in fighting to to keep the stick pulled back (a Swedish pilot tried this scenario in a simulator last week and literally had to keep both arms locked around the stick towards the end).

Counter-intuitively, letting go of the stick in brief increments might have been the correct move. Letting the nose pitch down would take force off the jackscrew and let both pilots crank hard on the stabilizer. Boeing manuals once covered this, but apparently they haven't since the 1980s, and their directive after the Lion Air accident made no mention of the necessity of such a procedure. Also they were only 7,000 feet above the ground so whether or not they'd have recovered in time is hard to say. Quite possibly the MCAS had already doomed the flight.

[cjbprime]

> they were only 7,000 feet above the ground

No, it's worse: the origin airport is at 7000ft elevation. They only had around 1000ft height AGL for all of the flight. So I agree that releasing the elevator at all seems surely suicidal.

[phire]

The flight data graph shows no manual electric trim inputs at that time.

So must be manual trim wheel movements.

[WalterBright]

The trim wheel is mechanically connected via cables to turn the jackscrew.

[Rooster61]

It cuts out any electronic input, namely autopilot influence and the electric trim control present on the yoke. The trim wheel is not electric, and is the intended control when electric stabilizer control is either unavailable or intentionally disabled.

[makomk]

The thing is, it looks like they did try and use the manual trim switch to get the trim correct prior to pulling the breaker - they just didn't do it for quite long enough to fully correct for the misbehaving MCAS system's actions. If they hadn't I suspect the plane would've crashed several minutes earlier than it did. And remember, if they take more than a few seconds to consider whether the trim is correct before pulling the breaker, the MCAS system activates again, undoes their manual trimming, and tries to kill everyone on board.

This entire report is frankly terrifying.

[nutjob2]

So the procedure is too complex or otherwise lacking. It should reasonably accommodate pilot workload and stress under the situation it would be used.

It's interesting that the flight with three pilots in the cockpit survived.

[js2]

You can still point back to Boeing for not recommending flight simulator training of this failure scenario.

One thing that I've wondered though as I've read more about MCAS. MCAS can't kick in till the flaps are fully retracted. Usually when something goes wrong in response to an action, the response is to undo the action. Why isn't the procedure or even the pilot instinct to re-extend the flaps when the nose down occurs just after having retracting the flaps?

[msbarnett]

> One thing that I've wondered though as I've read more about MCAS. MCAS can't kick in till the flaps are fully retracted. Usually when something goes wrong in response to an action, the response is to undo the action. Why isn't the procedure or even the pilot instinct to re-extend the flaps when the nose down occurs just after having retracting the flaps?

When the two AoA sensors began to disagree during takeoff, the left and right side airspeeds started disagreeing as a result. That leads the pilots to execute the Unreliable airspeed indicator checklist memory items, which include levelling off for troubleshooting and leaving the flaps in their current configuration (retracted), and to keep thrust high to avoid stalling due to the unreliable airspeed indicators.

It's precisely at this point that MCAS now kicks in and starts nosing them down. Extending flaps will cut it back out but: 1) they're now instinctually fighting the stabilizer with elevators to stay out a nose dive, 2) the checklist they were running when this started says not to extend flaps, 3) the Boeing/FAA directive tells them to hit the STAB CUTOUT, so they do that, but 4) the elevator/stabilizer fight + the high speed from the thrust being set to climb due to the checklist they were running when this started results in so much force on the manual stabilizer crank that the co-pilot can't turn it by hand and now they're so engaged in this stabilizer fight and trying to get the plane trimmed for landing that the flaps are the last thing on their mind, and the Boeing/FAA directive never instructed them to try re-extending them, airspeed disagree be damned. They're completely out of the manual and FAA/Boeing directive at this point. Nothing covers this (anymore, 30 year manuals would have had a procedure to ease the forces on the wheel here).

So lacking any other means of trimming for landing, they turn the electronic stabilizers back on, and trim electronically, which works...but they don't cut it again within 5 seconds (the FAA/Boeing directive didn't really spell out how crucial this timing is, or even consider that manual trim would have been made impossible by everything else going on), and the MCAS runs again, and the dive becomes fatal.

[cjbprime]

There's also a lot going on at that point in flight. It's within ten seconds of autopilot, for example. Would be hard to pinpoint. Besides, they have checklists to follow: airline piloting is not supposed to be creative and experimental.

[ominous_prime]

I would guess that the node down attitude quickly put them over VFE, so even it they could extend the flaps (I don't know if the flight system would prevent that or not) they would at least second guess doing so and continue other avenues of troubleshooting.

[tuna-piano]

Just to put their "mistakes" in context - Sully, America's favorite hero pilot, accidentally put his airplane into an almost stall as he was performing the Miracle on the Hudson (due to the A320's design philosophy, the airplane prevented the stall...). It goes to show- even great pilots doing good work in a stressful time can make critical oversights.

[cjbprime]

That's the opposite to the actual conclusion of this story! He intentionally tried to flare, but the Airbus flight envelope protections disallowed it, so they hit the water harder than they ought to have.

[bbojan]

Do you have a reference for that statement?

Because the story that I heard is that he purposefully commanded max pitch knowing that alpha protection would prevent the airplane from stalling, as his landing speed would be lowest at max AoA.

[cjbprime]

And I heard a third story, which is that the aircraft nearly botched his deliberate attempt at flaring for the water landing due to envelope protections he hadn't known about:

> I was commanding for more, pulling back full aft on the stick and the flight control computers prevented me from getting more lift therefore we hit harder than we would have (...) It turns out there's a little-known software feature known only then to a few Airbus software engineers, and to no pilots to no airlines that was the case. It's called a phugoid mode. And it was not the way we were trained the airplane should work, apparently it is the way the airplane does work. But that was not apparent to us.

https://aviation.stackexchange.com/questions/52147/why-cant-...