The Wall Street Journal reports that the crew on ET302 used the stabilizer trim cutout switches in response to MCAS commands, but appeared to be unable to raise the nose. They then released the cutout switches to use electric trim, but encountered MCAS commands again without recovering.
One possible explanation is that the loads on the jackscrew due to the severe stabilizer nose down out-of-trim situation were too great for the pilot to overcome using the trim wheel with folding handle. The pilots restored electric trim as a means to trim.
Boeing published a technique in the past that discussed this issue and the need to release the column briefly in a series of "roller coaster" or "yo yo" maneuvers, by cranking in stabilizer trim alternatively with large column commands.
This is in a 737NG Flight Crew Ops Manual
This is in the 737NG training manual:
MCAS nose down trim command is likely to be opposed by aft column elevator nose up command, which is an out-of-trim or mistrim condition. A pilot using the cutout switch to disable MCAS must resort to using the manual trim wheel for restoring the stabilizer to a suitable position and will encounter high opposing forces if they do not release the column.
One possible explanation is that the loads on the jackscrew due to the severe stabilizer nose down out-of-trim situation were too great for the pilot to overcome using the trim wheel with folding handle. The pilots restored electric trim as a means to trim.
Boeing published a technique in the past that discussed this issue and the need to release the column briefly in a series of "roller coaster" or "yo yo" maneuvers, by cranking in stabilizer trim alternatively with large column commands.
This is in a 737NG Flight Crew Ops Manual
This is in the 737NG training manual:
Manual Stabilizer TrimIf manual stabilizer trim is necessary, ensure both stabilizer trim cutout switches are in CUTOUT prior to extending the manual trim wheel handles.Excessive airloads on the stabilizer may require effort by both pilots to correct the mis-trim. In extreme cases it may be necessary to aerodynamically relieve the airloads to allow manual trimming. Accelerate or decelerate towards the in-trim speed while attempting to trim manually.Anticipate the trim changes required for the approach. Configure the airplane early in the approach. When reaching the landing configuration, maintain as constant a trim setting as possible. If a go-around is required, anticipate the trim changes as airspeed increases.This is in a 737 QRH (Ref 9.15)
This is from the Airworthiness Directive. It seems quite pertinent to emphasize using the electric trim to get the stabilizer near to an in-trim condition before hitting the cutout switch.
REVISED 11:40pm 3 Apr - Added discussion at end regarding cutout switch change
REVISED 7:43pm 4 April - Adjusted the Stab Nose Down trim representation to be zero lift
REVISED 9:20am 5 Apr - Added Stab Nose Down trim at Autopilot travel limit
The aero loads (or lift) from the elevator translate to the jackscrew across the horizontal stabilizer pivot point. The stabilizer and elevator work together to minimize the loads on the jackscrew. Under severe stabilizer airplane nose down out-of-trim conditions, the high elevator and stabilizer loads combine to present high loads on the jackscrew, making manual nose-up trim very difficult.MCAS nose down trim command is likely to be opposed by aft column elevator nose up command, which is an out-of-trim or mistrim condition. A pilot using the cutout switch to disable MCAS must resort to using the manual trim wheel for restoring the stabilizer to a suitable position and will encounter high opposing forces if they do not release the column.
The following drawings are for 737NG, but are believed to be representative of the 737MAX.
The 737 requires positive longitudinal stability which requires that the center of gravity is in front of the center of lift from the wing. CG can shift slightly behind center of lift, under extreme aft CG condition. To trim the airplane, the stabilizer generally provides a downwards force. By modulating the stabilizer force (by moving the stabilizer), the airplane can be commanded to pitch up, pitch down, or trim.
The 737 requires positive longitudinal stability which requires that the center of gravity is in front of the center of lift from the wing. CG can shift slightly behind center of lift, under extreme aft CG condition. To trim the airplane, the stabilizer generally provides a downwards force. By modulating the stabilizer force (by moving the stabilizer), the airplane can be commanded to pitch up, pitch down, or trim.
The horizontal stabilizer and elevator assembly make up the horizontal tail. The stabilizer operates on a jackscrew installed on the leading edge of the stabilizer and a pivot point about 1/3 of the way back. The jackscrew raises and lowers the stabilizer leading edge to effect an airplane nose down or airplane nose up command. The elevator is installed well aft of the pivot point.
A simple model will be used to evaluate the loads that are presented in the horizontal tail. The airflow from right to left roughly along the body (flaps up only). The leading edge of the stabilizer is attached to a jackscrew. The stabilizer pivots up and down from the hard pivot point.
For flaps up, electric trim operates over a limited range of about 3.9 degrees to 14.5 degrees. 3.9 degrees is nearly level, 14.5 degrees is leading edge down. Under pilot controlled electric trim, flaps up, the horizontal stabilizer does not move appreciably into the leading edge up regime. The additional leading edge travel is reserved for flaps down, where the airflow is shifted downwards due to downwash from the wing. Autopilot trim command is allowed across nearly the full range without regard to flaps up or down.
With the stabilizer trimmed Airplane Nose Up, the leading edge of the stabilizer is lowered by the jackscrew. The large negative incidence creates a large downward lift force which is what will drive the Airplane Nose Up. The lift force is split between the pivot point and the jackscrew. The result is a upwards force on the jackscrew, making trimming the stabilizer leading edge up less difficult, leading edge down more difficult.
With the pilot command to the stabilizer trimmed Airplane Nose Down limit, the jackscrew raises the leading edge of the stabilizer creating less incidence, creating almost no appreciable lift component, which is what drives the nose down. With no resultant force pushing on the jackscrew, trimming the stabilizer is easy leading edge down (airplane nose up).
With the autopilot command to the stabilizer trimmed Airplane Nose Down limit, the jackscrew raises the leading edge of the stabilizer into positive incidence, creating an upwards lift component, which is what drives the nose down. The resultant down force pushing on the jackscrew, trimming the stabilizer is easy leading edge down (airplane nose up).
The elevator is mounted off the back of the stabilizer, well behind the pivot point.
If the pilot column is pulled back to command elevator nose up, the elevator surface pivots upwards (by hydraulic actuators), presenting a downwards lift component, which is what drives the nose up. The elevator load is translated to the jackscrew in the opposite direction, making it easier to trim stabilizer leading edge up, but much harder to trim the stabilizer leading edge down.
If the column is pushed forward, commanding airplane nose down, the elevator pivots downwards creating a lift component upwards, which is what drives the nose down. The elevator load is translated to the jackscrew in the opposite direction, making it easier to trim stabilizer leading edge up or down.
Elevator neutral shift is a function that moves the elevator in response to the stabilizer position.
For the case where the pilot trims the stabilizer to the airplane nose down limit, the elevator is rigged slightly nose down as well. The reduced elevator loads at the jackscrew favor moving the stabilizer leading edge down (airplane nose up).
For the case where the autopilot trims the stabilizer to the airplane nose down limit, the elevator is rigged slightly nose down as well. The resultant loads at the jackscrew favor moving the stabilizer leading edge down (airplane nose up)
For the case where the stabilizer is trimmed nose up, the elevator is rigged slightly nose up as well. The resultant loads from the stabilizer lift and the elevator lift combine at the jackscrew, but the elevator contribution is minimized. The forces on the jackscrew aid trimming leading edge up (airplane nose down).
A mistrim or out-of-trim situation can result if the stabilizer is trimmed nose up and the elevator is commanded nose down. The opposing lift components combine at the jackscrew to create a minimal downward force, making trimming stabilizer less difficult in either direction, but hardest leading edge up (airplane nose down). This fights the direction of available trim travel.
A mistrim situation can result if the stabilizer is trimmed nose down (pilot limit shown) and the elevator is commanded nose up. Load is dominated by the elevator upwards force at the jackscrew, making trim leading edge down (airplane nose up) difficult.
While electric trim motor is designed to not stall out under severe out-of-trim conditions, the loads may make trimming leading edge down by the manual trim wheel very difficult. Under these circumstances, it is preferable to release the column and let the elevator return to the neutral position, lowering the jackscrew loads in favor of trimming leading edge down (airplane nose up).
While electric trim motor is designed to not stall out under severe out-of-trim conditions, the loads may make trimming leading edge down by the manual trim wheel very difficult. Under these circumstances, it is preferable to release the column and let the elevator return to the neutral position, lowering the jackscrew loads in favor of trimming leading edge down (airplane nose up).
The horizontal stabilizer moves over a range of 17.1 degrees, 4.2 leading edge up and 12.9 degrees leading edge down. However, Boeing limits the trim range of stabilizer motion by pilot command of the electric trim motor to a lesser amount. The full range of stabilizer motion is available by manual trim (using the trim wheel).
The elevator is driven by two hydraulic actuators. The control force from these actuators should be sufficient to hold the elevator in the commanded position regardless of the expected aerodynamic loads that are pushing the elevator back.
737NG Pitch Control
Blowdown is when the aero loads overcome the actuator and the elevator is pushed back.
After some research in my aviation library I think I have found the answer to my original questions of the meaning of the Boeing term "relieving aerodynamic loads."
Extract from the Boeing 737-200 Pilot Training Manual February 1982 page 04.80.31. Edited for brevity. Runaway and Manual Stabiliser - Recovery from Severe Out-of-Trim
"In an extreme nose-up out-of-trim condition, requiring almost full forward control column, decelerate, extend the flaps and/or reduce thrust to a minimum practical setting consistent with flight conditions until elevator control is established. Do not decrease airspeed below the minimum maneuvering speed for the flap configuration. A bank of 30 degrees or more will relieve some force on the control column. This, combined with flap extension and reduced speed should permit easier manual trimming.
If other methods fail to relieve the elevator load and control column force, use the "roller coaster" technique. If nose-up trim is required, raise the nose well above the horizon with elevator control. Then slowly relax the control column pressure and manually trim nose-up. Allow the nose to drop below the horizon while trimming. Repeat this sequence until the airplane is trim.
If nose-down trim is required, slowing down and extending the flaps will account for a large degree of nose-up pitch. If this does not allow manual trimming then the reverse "roller coaster" can be performed to permit manual trimming." (I read somewhere it was called the Yo Yo manoeuvre)
Boeing "Airliner" magazine published in May 1961 discussed the above subject as it applied to the Boeing 707 by stating: "To trim the stabilizer manually while holding a high stick force on control column. As the airplane changes altitude, crank in the desired trim change. Correct airplane attitude after a few seconds with elevators. Relax stick force again and crank in more trim. Repeat this procedure as necessary until proper 'trim' position of stabilizer is established."
D.P. Davies
Copyright 1967
"if a tail needs to be used in a manoeuvre it should be slowly and carefully"
"a stalled stabilizer drive can occur...with a very high elevator hinge moment"
"keeping the trim button engaged, slowly ease off the stick force"
The two 737NG trim cutout switches served different purposes. One cutout switch just stopped autopilot trim commands, the other cutout switch removes power from the trim motor.
The autopilot trim command on 737NG is either the trim while the autopilot is engaged, or the trim command from the Speed Trim System (STS).
For the 737MAX, MCAS issues commands on the same autopilot interface as STS and when engaged. MCAS would be inhibited by this cutout switch if it were on 737MAX.
For reasons I have yet to understand, Boeing changed the cutout switches on 737MAX to PRI and B/U. In this configuration, both cutout switches are thrown in any runaway situation,
With an autopilot cutout switch, MCAS runaway is stopped, leaving electric trim fully operable. Tha autopilot cutout switch could be a surrogate for an MCAS OFF switch.
With the 737MAX cutout switches, MCAS runaway is stopped by throwing both switches, losing electric trim altogether. In this case, the flight crew must rely on manual trim via turning the trim wheel/crank. As discussed above, the manual crank can bind up, making flying much more difficult.
Any hazard classification would distinguish between having electric trim and having to use the manual crank, due to workload and conditions where the crank can become difficult to operate and by managing speed carefully.
The Flight Standardization Board acknowledged the new cutout switches without making note of the different situations under an autopilot/STS runaway.
The FSB did not acknowledge MCAS as a difference, it has been entirely vacant regarding MCAS until the FSB has issued draft 17, which does evaluate MCAS).
Another key feature that would have come out if MCAS were evaluated is that MCAS nose down trim commands are not stopped by aft column cutout. Aft column cutout is designed to stop the stabilizer from a mis-trim. Human factors favor the aft column cutout as that is the natural reaction to a nose down runaway. The FSB recommends review of MCAS malfunction.
The entire series on 737 MCAS
Movable Stabilizer737 Pitch Trim Incidents
The Beat Goes OnWhat Happened on ET302?
AoA Vane must have Failed, the Boeing Fix is In, Senate Grills FAA
How Did MCAS Get Here and What Hurdles Remain?
Taking the Next Steps while Awaiting on the Preliminary Report from ET302
Ethiopian ET302 similarities to Lion Air JT610
What have we learned this week?
Comparing Ethiopian ET302 to Lion Air JT043, JT610
Angle of Attack Vane Failure Modes
First Look at JT610 Flight Data
737 FCC Pitch Axis Augmentation - Command Integrity Mandate for Dual Channel, Fail-Safe
737 MCAS - Failure is an Option
Stabilizer Trim
Stay tuned!
Peter Lemme
peter @ satcom.guru
Follow me on twitter: @Satcom_Guru
Copyright 2019 satcom.guru All Rights Reserved
Peter Lemme has been a leader in avionics engineering for 38 years. He offers independent consulting services largely focused on avionics and L, Ku, and Ka band satellite communications to aircraft. Peter chaired the SAE-ITC AEEC Ku/Ka-band satcom subcommittee for more than ten years, developing ARINC 791 and 792 characteristics, and continues as a member. He contributes to the Network Infrastructure and Interfaces (NIS) subcommittee developing Project Paper 848, standard for Media Independent Secure Offboard Network.
Peter was Boeing avionics supervisor for 767 and 747-400 data link recording, data link reporting, and satellite communications. He was an FAA designated engineering representative (DER) for ACARS, satellite communications, DFDAU, DFDR, ACMS and printers. Peter was lead engineer for Thrust Management System (757, 767, 747-400), also supervisor for satellite communications for 777, and was manager of terminal-area projects (GLS, MLS, enhanced vision).
An instrument-rated private pilot, single engine land and sea, Peter has enjoyed perspectives from both operating and designing airplanes. Hundreds of hours of flight test analysis and thousands of hours in simulators have given him an appreciation for the many aspects that drive aviation; whether tandem complexity, policy, human, or technical; and the difficulties and challenges to achieving success.
With the bulk of the swept stab area behind the hinge line it would apply reverse loading on the jackscrew - that is a stab-nose-up/plane-nose-down position should see a load tending to move the stab to a stab-nose-down/plane-nose-up position. Likewise, elevator loads should tend to force the stab to match. If the pilots are inputting nose-up elevator it will apply a load to the stabilizer that will be most easily relieved by using nose-up trim.
ReplyDeleteWhat is missing in the diagram is that the airflow over the stab should always have negative angle of attack as long as the aircraft wing is producing lift. Pitch down moment on the entire airplane occurs under any wing positive lift production; there should never be a case when the airflow is directed up to the bottom of the stab in most flying conditions. This is largely because the wing ahead of the stab produces a large down-wash, but also because if the the stabilizer adds to the pitch-down moment the aircraft will increasingly diverge, tumbling over and over.
In reviewing the Lion Air accident FDR, it looks like the yoke trim switches continued to have uninterrupted authority but the pilots stopped using them for long enough to make a difference. Trim was repeatedly brought to zero the yoke forces and never to build any trim margin. And then they stopped using them to do so, choosing to try to counter trim with elevator even though counter trim remained effective.
If the CG is far enough back then the pitch-down torque is resisted by the weight of the plane. If the weight is far enough back then the trim loads will be reversed, making trim quite difficult. As the plane pitches up the acceleration of the mass will produce a higher pitch load raising the nose further and exposing the stabilizer to a local angle of attack that tries to amplify the problem. It's interesting, but there is no evidence that this was the case in the Lion Air accident.
Thank you!!!! for your observations. I have updated the figures and text based on moving the pivot point ahead of the stabilizer center of lift and showing the airflow as coming downwards rendering the stabilizer lift component as downward in all cases.
DeleteAfter further investigation, I have reverted the airflow to be along the body line, for flaps up only. Further, I have limited the leading edge up travel of the stabilizer to "level" as the electric trim range precludes appreciable leading edge up.
DeleteDoes the 737 MAX have a stab trim cutout switch as did the earlier models. If so, wouldn't it help to activate that switch in order to use electric trim (assuming of couse that the cutout switches were still in normal)? It seems likely that a force applied to the control column would likely be sufficient to render the trim unusable (that was its designed purpose was it not - - to be able to counter a run away trim with force applied to the control column until the stab trim cutout switches could be disengaged). But, if the pilot(s) applied strong aft control column force (with the nose being pitched down) and perhaps not initially disengaging the stab trim cutout switches (Usually trim and autopilot both) then the electric stab trim would be inoperative unless the stab trim bypass switch was activated - - correct?
ReplyDeleteHere lies the greatest tragedy! On the 737NG, there is one cutout switch for the electric trim and another cutout switch for "autopilot". The autopilot cutout includes autopilot trim while in command as well as Speed Trim System commands. MCAS would have been caught up with the autopilot cutout switch. So with the 737NG autopilot cutout switch, you could have turned off MCAS and retained electric trim via yoke switches. BUT on the 737 MAX, they changed the cutout switches into PRI and B/U, and the instruction is to throw both, which means for MCAS runaway, you lose electric trim altogether. The FSB did not note any issue with the new cutout switches, especially nothing about losing electric trim with an autopilot runaway.
DeleteIF you have a runaway trim the quickest way to eliminate it cut both. If the autopilot is not on, then you don't know where the problem is: manual electric path or speed trim path. Since there are separate switches one could enable manual electric to test a thesis. Don't know for a fact that MCAS trim commands from the autopilot bypass the CSM (column switching module) on the MAX, but it sort of makes sense. It would potentially have to trim against a ham fist pulling to a high AOA.
DeleteWhat are Pri & B/U abbreviation for? I'm guessing "Priority" & "Back Up"?
ReplyDeletePrimary and Backup. But I have no information as to what they refer to.
DeleteSorry - - I meant to say "Stab Trim Bypass Switch" which on the classic and NG aircraft when activated - would allow the pilot to run the trim even when the force on the control column was interrupting the power to the stab trim motor - - such as would be desired during a stab trim run away. Apologies.
ReplyDeleteThe purpose of the bypass switch is for a failed column cutout switch that would prevent stab trim in one direction.
DeleteOne point for the future that at least I haven't seen discussed much:
ReplyDeleteWe unfortunately found out about the trouble that the AOA-MCAS buddies can cause and how likely it is that this can happen.
What we don't know: How likely is it that the situation occurs that MCAS is supposed to alliviate? In other words, if MCAS is automatically switched off in certain situations (one of the things the new software will do), will we see a MAX stall in a critical flight phase once in a while?
I agree, the benefit from MCAS is elusive, as the flight condition is improbable, and the pitch up can be managed by column travel even if not compliant.
DeleteFrom above 'Peter LemmeApril 4, 2019 at 8:11 PM"
Delete"I agree, the benefit from MCAS is elusive, as the flight condition is improbable, and the pitch up can be managed by column travel even if not compliant". I agree if the pitch can be handled by column travel. It seems to me the system can cause more damage than help. According to Hoyle the engine, nacelle, and wing combination is new and should be recertified in flight test as in stalls aerodynamic flow prediction is insufficient. They seem to have lost sight of the original purpose in the melee over the miss designed MCAS. Does the new fix not engage and also cut off if Mach > .69? Can they definitely ensure there will be no loss of elevator control due to MACS because of stabilizer position? Should not there be a stabilizer limit? Precisely what regulation is MCAS supposed to resolve (stick force per g?) and how is this done in flight test. It was found in flight test according to Boeing. Is testing done with and with sensor failures and with and without MCAS? Who is the final go no-go arbitrator? Note that the Airbus A320NE has two main alpha sensors and an alternate if one fails and if two fails the system shuts down. It is a warning system only. This is what I might expect in a modern transport aircraft. Also I think the system has its own on off switch in the cockpit.
"With the 737NG cutout switches, MCAS runaway is stopped by just throwing the autopilot cutout switch, leaving electric trim fully operable." I believe this to be in error.
ReplyDeleteI know this is confusing. I was trying to say if you had the 737NG switches on the 737MAX, then you could stop MCAS with the autopilot cutout and leave electric trim available.
DeleteI don't get it. Why did Boeing change the functions of the STAB cutout switches on the MAX? For the life of me, I can't dream up any good reason why they should do so. Moreover, it was revealed a few hours ago that Boeing was aware of a second software issue, outside of MCAS, and that the FAA wants both MCAS and this other software issue fixed and tested at the same time.
ReplyDeleteI cannot understand the change to the cutout switches, a design that has stood the test of time.
DeleteHere's a somewhat black theory on the reason of the change to the switches: Maybe Boeing felt they would have had to mention MCAS in the manuals, in the list of trim inputs affected by the autopilot switch?
DeleteThanks Peter for collecting these in-depth insights!
For the life of me, I can't think of one good reason why Boeing changed the functions of the STAB cutout switches on the MAX. Today it was revealed that Boeing was aware of another software issue (not MCAS) which the FAA wanted fixed concurrently along with MCAS. I also am not entirely sure that throwing the STAB cutout switches entirely disables MCAS. What if MCAS, in its feedback loop which is based on faulty AOA data, continues to update the AOA control law which the FCC sees even after the cutout switches are thrown? If so, then temporarily releasing the control column would not allow pilots to Yo Yo in order to manually crank the STAB.
ReplyDeleteThe cutout switches remove power from the trim motor, it cannot move.
DeletePeter, do you have any insight as to whether the Elevator Feel Shift (EFS) module might have had a role in these accidents? One of the functions of the EFS is to increase the forces on the control column when there is a stall warning. Our manuals say it could double the effective force, but it does not say whether it takes one or two stall signals to activate. Activation on one side would result in a "ELEV FEEL DIFF" warning which apparently the Lion Air aircraft experienced.
ReplyDeleteEverything I have says the forces are four times as great in aft travel. YES, elevator feel shift module is commanded by the SMYD reading the high AOA and triggering stick shaker. It only takes one discrete to activate.
DeleteDo you have a specific reference for the "four times as great" statement, or is this the result of a calculation?
Delete[Note to readers not familiar with hydraulic flight controls - the aerodynamic "feel" of higher control forces at higher airspeed is artificially generated. When parked at the gate and all hydraulics are off, the 737 control column just kind of flops around with no loading.]
Specifically, my aircraft manual states: "The EFS module increases system A pressure to the elevator feel and centering unit during a stall. This approximately doubles control column forces."
Elsewhere, the manual states: "The elevator feel computer provides simulated aerodynamic forces using airspeed (from the elevator pitot system) and stabilizer position. Feel is transmitted to the control column by the elevator feel and centering unit."
I'm pretty sure that the elevator pitot system is independent of the ADIRU's and FCC's (so it would continue sensing the correct airspeed even if the failed side was reading low due to the failed AOA vane). As a result, in the accident scenario the baseline control column forces generated by the Elevator Feel system would already be high due to the high airspeed. However, if the Elevator Feel Shift module activates in response to a false stall warning, it is unclear from our manuals as to whether the increased forces are additive. I do not know if there is an upper limit to how much control forces the Elevator Feel system can generate or if the pilots can easily oppose this force.
In the accident scenario, we appear to have an aircraft entering a dive while both pilots are exerting maximum back pressure on the control column. How much of this is due to the stab overcoming the elevator, and how much is due to excessive forces generated by the Elevator Feel system is unclear to me.
should have said "up to four times as great". This is from the 737NG AMM
DeleteAt stall onset, either SMYD sends a signal to energize the dual coil solenoid valve on the EFSM. The EFSM operation occurs when all of these conditions occur:
• Stick shaker is active
• AOA is 8 to 11 degrees more than thermal anti-ice (TAI) biased stick
shaker AOA
• EFSM is not inhibited due to low altitude or the airplane is on the ground.
When all of these conditions occur, the SMYDs energize the dual coil solenoid valve. The solenoid valve sends 3000 psi system A pressure to the pressure-operated mode valve.
The mode valve opens and sends pressure between 820 psi to 880 psi from the pressure reducer to the system A side of the dual feel actuator. This increases the control column feel forces up to four times nominal feel. The increased feel force makes sure the pilots cannot easily override automatic stabilizer movement to nose down pitch of the airplane.
Agree that's how it works in normal operations, but in this case we have a malfunction. My concern was that the EFS module logic (described above) may have been additive to the Elevator Feel computer logic (increasing control forces due to the increasing airspeed) to create excessive control forces that the crew had difficulty overcoming.
DeleteI can't even begin to imagine the desperate feeling of the crew pulling on the yoke with all their strength as the aircraft continues to nose over.
Everything I have read says EFSM was engaged in both Lion Air and Ethiopian.
DeleteOne last question... Do you know if the 737 stab trim motor has some kind of internal circuit breaker? I've been having trouble getting my head around the fact that the DFDR seems to show that the flying pilot initially trimmed ANU to oppose the MCAS input, but he never returned to a neutral trim state (probably about 4-5 units). The trim motor was working against a highly loaded jackscrew, so I'm wondering if it might have stalled or tripped an internal breaker.
Deletethere are circuit breakers, but not in the actuator as far as i know.
DeleteThe actuator worked fine for MCAS, which was leading edge up travel and helped by the elevator nose up command. I believe that the trim actuator would have trimmed airplane nose up if they had let it.
The 737 has a single stab trim motor that operates at two speeds. The MCAS appears to work off the low-speed mode while the yoke trim switch operates the motor in the high-speed mode. Could it be that the low-speed mode can deliver more torque than the high-speed mode? That is, is it possible that in an extreme high load environment, the MCAS could function normally while the high-speed trim could not?
DeleteFor example, I have a two-speed electric drill. At the high-speed setting, it is torque limited. When it stalls at that setting, I can switch to low-speed and it will continue to operate. I realize that drills are not trim motors, but I'm curious if there might be a similar phenomenon going on.
This is common to all electric motors—their peak torque is their stall torque, decreasing as motor speed increases.
DeleteFrom the NG,
ReplyDelete"ensure both stabilizer trim cutout switches are in CUTOUT prior to extending the manual trim wheel handles"
From the MAX,
"manual stabilizer trim can be used before and after the cutout switches"
This seems somewhat contradictory.
"
Keeping the handle folded in while the trim is powered seems prudent, as unexpected motion could yield injury. There is nothing preventing manual crank trim in any case, even if the motor runs, as you can stall the motor with the crank.
DeleteJust a correction - there is a clutch that will favor the manual trim (cable) and disengage the trim actuator - it is not stalling the actuator.
DeleteHi Peter, thanks for your ongoing contribution to the MAX issues which have become a great go-to. But I have a slight disagree with your diagram on the requirements for longitudinal static stability (CG in front of CP, tail always lifting). My understanding is that an aircraft is stable when CG is in front of the fixed neutral point (also termed as vehicle aerodynamic center). But on a cambered wing, centre of lift moves. As a counter-example to your diagram, a 737NG operating at absolute rear CG limit (36%MAC) is trimmed to high but nonstalling AoA. It's center of pressure will be close to (but not reaching) the wing aerodynamic centre of 25%MAC, so will be < 30%MAC. The centre of lift is in front of the CG, the tail is necessarily lifting to maintain trim, but the aircraft is still longitudinally stable. This stability is possible as although the tail is lifting, it has less effective AoA than the wing. However in general tails of airliners will be in reverse lift to maintain desired stability margins at typical CG loadings.
ReplyDeleteHi Wayne,
DeleteI developed these figures to depict the jackscrew forces. It has turned out to be quite difficult to get them correct; I have redone them three times now. I appreciate your comment about severe aft cg operation, and the accompanying reasons for why it remains stable. I found that horizontal stabilizer barely has any positive inclination in the most nose down position using electric trim. I left it as not producing any lift in this position, but as you surmise it can be upwards a little bit. In either case, the force that translates to the jackscrew is minimal, which is what I was seeking. I hope you will give me a little latitude for simplicity. I don't want to ignore your points either, nor make something wrong or misleading. I hope your comments will be as instructive to other readers, as it was to me. Thank you.
Has anyone compared A320neo trim design with 737 max design. Does the pilot have pitch authority throughout the envelope ?
ReplyDeleteDiggdog in Austin (Bill)
A320 is has full flight envelope protection, fly by wire. The flight controls take pilot input and decide what they will do with it.
DeleteRon Belt on 5 April 2019
ReplyDeletePeter, your explanation of the trim cutout switches above may provide an explanation for why the pilot of the Ethiopian jet inexplicably turned back on the trim cutout switches, causing MCAS to turn back on and immediately issue a trim down command that started the fatal dive. After trying to use the electric trim switch on the yoke and finding it inoperable because the trim cutout switches were off, and after finding out that the trim wheel was inoperable due to dynamic loading, he may have thought based on this 1417 hours as a 737NG pilot that he could turn back on the electric trim without turning back on MCAS by turning back on the LHS cutoff switch (PWR) while keeping the RHS cutoff switch (B/U) off. Unfortunately, this is didn’t work because Boeing had changed the operation of the two switches on the 737 MAX. MCAS is not an autopilot function.
MCAS is implemented in the Flight Control Computer (FCC), along with Speed Trim.
DeleteMCAS, STS, and autopilot "command mode" stabilizer trim share the same output (autopilot).
What I have not figured out is how MCAS can trim 0.27 deg/sec with flaps up.
MCAS takes over the trim speed control line when activated.
DeleteIt is shown in the functional diagram, mcas engages relais K5.
page 749.
I too have been wondering why Boeing changed the wording on the Stab Trim Cut-out Switches from 'Main Electric' and 'Autopilot' to 'Prim' and 'B/U' on the MAX.
ReplyDeleteOn the series 200/300/400/500, and I believe the NG, there were 2 electric trim motors to drive the stabilizer jackscrew. 1 motor was used by the pilots electric trim switches, and the other was used by the autoflight system (including STS).
Reading the preliminary report into the Ethiopian accident it states on page 18 that a single electric motor, operated by the trim switches or autopilot, drives the stabilizer.
Did Boeing replace the 2 motors on the earlier series 737 with just 1 on the Max?
If so they removed a simple method of disabling a failed MCAS and AoA sensor and carrying on with the normal electric trim.
Thanks,
Dave.
the -100/-200 had two trim actuators (main electric and autopilot).
Deletefrom what I can gather, it went to one actuator with the 737 classics.
I am sure it is one actuator with the 737NG.
Couldn't it be that the separate Autopilot stzb trim cutout switch worked only on the 100/200 as it waas the only one to have two actuators. On the classic and ng this did not work any more, but they left the 2 switches and also the text (main elec /autopil) for compatibility reasons. On the MAX then they simply decided to adapt the text to PRI/BU.
DeleteAnyway in ALL procedures Boeing always said to move the two switches together.
Wouldn't that be a good explanation ?
I too have been wondering why Boeing changed the naming on the Stab Trim Cut-out Switches from 'Elect' and 'Autopilot' to 'Prim' and 'B/U' on the 737 MAX series.
ReplyDeleteOn the Classics (200/300/400/500) and (I believe, only worked on the Classics), the NG series there were 2 electric motors driving the Stabilizer jack screw, one for the electric trim and 1 for the autopilot and STS.
Reading the preliminary report into the Ethiopian accident it states (on page 18) that the stabilizer is driven by a single electric motor.
Did Boeing only fit a single trim motor to the MAX? It would account for the naming changes on the switches, and also prevent the crew disabling MCAS while continuing to trim normally.
Thanks,
Dave.
Too the best of my knowledge, both the 737NG and MAX use a single trim motor that operates at different speeds depending on the source of the command. Pilot yoke input produces fast trim. All others, slow trim.
Deletethe trim speed is set by flaps up or flaps down. The pilot speeds are 0.2/0.4 deg/sec.
DeleteThe autopilot is 0.09/0.27 deg sec. Somehow MCAS operates at 0.27 deg/sec, the flaps down speed (while flaps are up).
On the max the motor is a Eaton 6355D
DeleteI have been struggling to get this right all week, so bear with me.
ReplyDeleteIf the stab is in the positive range (0-4 units), flaps up, it has upwards lift.
->Force on jackscrew helps trim leading edge down (airplane nose up).
Faster means *more* benefit.
Elevator is the opposing force.
With the air speed increase and elevator up,the elevator force increase,so the elevator will apply a load to the stabilizer that will be most difficulty to nose-up trim.
I noticed today in the ET302 prelim DFR data chart that AOA-L's two intermittent recoveries towards the end of data recording seemed to correlate to negative G loading, suggesting the rotating part of the sensor potentially had become eccentrically weighted. Issue with either the internal counter-weight, or some sort of externally added-mass?
ReplyDeleteBe interesting to see if anything more might come out from the investigation on this. Although the chance of finding parts of the sensor intact is probably very improbable.
Byorn Fehrm made a similar observation to me. The final pitch over is revealing, as the vane "stub" appears to be a simple pendulum, it mimics the normal g's. The thinking is that the vane was completely gone, leaving the base with is weighted "nose light", which explains it going to +75 initially. I had thought the stop was at 90, but cannot confirm.
DeleteAll comments are greatly appreciated. One question for Peter: Do you know if Lion Air and Ethiopian Airlines were approved to adopt Boeing's 737 MAX flight crew training program or did they develop their own training programs?
ReplyDeleteThanks, Bob
the FSB sets the criteria, but after that I am not in a position to follow how it was adapted.
DeleteHi Peter, thanks for sharing your knowledge.
ReplyDeleteI am flying the 737NG and have 7.000+ hrs on the type. I have never heard of the blowdown feature, I guess Boeing believe the pilots dont need to know. Its make me wonder if this was activated in the Ethiopian accident, in their last attempt to arrest the descent, but they were unable to. Looking at the timeline at 05:40:30 Pitch Trim was less than 1, airspeed around 300 kts and the crew pulled back on the Control Column and managed to keep the aircraft from pitching down. But at 05:43:30 the Pitch Trim went to around 1, the airspeed was around 400 kts and the crew pulled even harder on the Control Column but still they were not able to stop the aircraft from pitching down. Could this be due to the elevator “activating blowdown” making it less effective?
Or could the aircraft have reached such a high mach number that they experienced a Mach Tuck?
Many Thanks
Mikkel
I believe that the stabilizer was far far more effective at the higher speed in applying pitch down command, and this got worse and worse in the dive. Without restoring the stabilizer trim nose up, they had no chance. the pilots appear to have been tossed about in the pitch down, remember the flight deck would have extra neg g because of the moment arm, and did not apply full elevator until already pitched down. Byorn Fehrm has pointed out the issue with blowdown, but there is no data to show this so far. Elevator position surely was recorded, so I would think without plotting it, there is no issue - but that remains to be seen.
DeleteA non-educated question: Given the desparate inability to bring the nose up, and the high speed, could a last minute roll avoid a collision with the ground?
ReplyDeleteA roll is a last ditch maneuver to break from a deep stall (nose high) where all other controls are not working.
DeleteA roll inverted would accomplish what you seek. They had electric trim in the end, but never used it. Human factors rise again, in a steep dive, pilots just pull back on the stick.
The NG 800 has a single stab actuator.
ReplyDeleteSurface blowdown is an increasing fraction as airspeed goes up. Stabilizer 'windup' is a small twist when elevator is deflected.
Runaway stabilizer procedure in the (modified) Boeing manual includes:
...control airplane pitch attitude with control column and main electric trim as required.....
... Electric stabilizer trim can be used to neutralize control column pitch forces before moving the STAB TRIM CUTOUT switches to CUTOUT.
It's right there in the Ethiopian report. It also says the manual changes per the AD were in manual and the Airline received the FCOM bulletin.
Don't you wish it said
DeleteElectric stabilizer trim *MUST* be used to neutralize control column pitch forces before moving the STAB TRIM CUTOUT switches to CUTOUT.
I wish the MCAS didn't have a single input for AOA.
DeleteAn experienced pilot doesn't know about surface blow down and thinks it might be a feature. How much training should a pilot get? Should they be educated on surface blowdown?
If they read it and understood it maybe *MUST* might make a difference.
Hind sight is more perfect. Perhaps the new UPSET training regimen should cover more material.
There is no data to show blowdown occurred. I would have expected it to be revealed in the preliminary report from Lion Air and from Ethiopian if it was encountered.
DeleteBlowdown is a fact, but probably not a factor here. The fact that the throttles were not reduced and the airspeed allowed to increase to Vmo had to make any recovery more difficult due to the elevator feel schedule. Manual trim wasn't attempted until after Vmo was achieved. Flight 610 had a similar unreduced throttle. If your stick shaker was going off, announcing approaching stall, would you raise flaps (think Colgan Air)? The NG instruction for stick shaker includes "Do not change gear or flap configuration, except...During liftoff, if flaps are up, call for flaps 1." So that would be a pilot error, correct?
ReplyDeleteThese guys were engaging LNAV flight director and dialing selected altitudes. What the hell....stick shaker going, overspeed clacker and lets talk to ATC and dial selected heading?
So given the Lion Air Accident, the known issue with the MCAS, the flight manual update and the bulletin, and all the publicity regarding the software update.....should ET302 resulted in a crash from 14000 ft?
Lightening struck twice. Permit me to add a little balance to your great blog.
it is impossible to make good assessment of human factors and procedures without the CVR transcript. I share your perspective that the flight crew did not follow what I would have expected. What I hope is we can understand what led them to make these decisions and not the ones we would hope for. It seems clear that the event of a single AOA fault puts the crew into a much more difficult position than we would expect, and it is hard to fully relate to the situation without experiencing it. No doubt, the crew had much better options if they had kept speed in check, and if they had been more aggressive with restoring trim using the electric controls.
DeleteAlso, it's perhaps a blessing they got a heading from ATC after reporting flight control problems. They could of easily gone down in a very populated area.
DeleteReducing throttle is easy to see as a desired command in hindsight. I would guess that throttle was kept at liftoff power because all of this happened so fast during a critical maneuver - takeoff and initial climb. With everything going wrong I would assume the crew was focused on getting attitude control of the plane and trying to troubleshoot what the issue was, going through memory items. Imo, the main factor here is time / altitude. If this happened even a few thousand feet higher it may of been possible to recover.
Regarding aggressiveness on restoring trim. I thought the same looking at the data. But looking at the graph I see how easily MCAS is overriding pilot commands. Look at how long MCAS commands AND trim. It's incredibly long, up to 10 seconds. The way a pilot is used to commanding electric trim is like most other flight controls. Lightly, with small corrections. Understanding it is a massive airfoil with huge pitch authority. MCAS was very stupid in this sense. It operated way too long with way too much authority. I wish they would of been more aggressive with the electric trim. But I don't think that's how they are trained. I also wish MCAS was designed and implemented 300% better.
@Anon, ET302 never got more than a few thousand feet off the ground. Not sure where you got 14000 from. Worth noting the the left and right indicators deviated not just for AoA but also altitude and airspeed and flight director pitch bar. If you look at the maintenance log there were issues with the altimeter and an AP issue. Not sure how relevant that is but not great given the sensors had issues on the fatal flight.
DeleteThe preliminary report shows ET302 was at least 13,400 pressure altitude.
DeleteThe airspeed and altitude issues are the result of the erroneous AOA vane reading which drives the wrong compensation in the Air Data static pressure source. The fault history was clean (for relevant faults) going back to Dec.
Right but that's MSL so AGL with the elevation from the airport of 7625, Would give you 5775 feet right?. For some reason the wiki says it only reached 9000 MSL.
DeleteGiven the importance of the AoA vane for instrument reading and these auto systems. What's with them failing so much? It seems like a very high failure rate for new planes. In the Lion Air case it was brand new and replaced the day before.
I don't think I understand the design motive for allowing the AP (and thus MCAS) to command more stab deflection than the pilot can via the yoke. And that during auto trim commands pilot yoke commands are ignored. If I read what you have here right, Boeing states it's safer for an out of trim situation. But isn't that basically saying the AP is smarter than the pilot? It has more pitch authority. But we'll give the same to the pilot but he has to crank a wheel which is way slower and takes attention off the PFD, and takes one hand off the yoke.
DeleteWith the 737NG cutout switches, MCAS runaway is stopped by just throwing the autopilot cutout switch, leaving electric trim fully operable.
ReplyDelete[I thought MCAS was not present on a 737NG]
With the 737MAX cutout switches, MCAS runaway is stopped by throwing both switches, losing electric trim altogether. In this case, the flight crew must rely on manual trim via turning the trim wheel/crank. As discussed above, the manual crank can bind up, making flying much more difficult.
[Disaster might have been easily averted should the 737 Max had the autopilot cutout switch so that MCAS or a misunderstood automated flight control could be disabled without requiring manual trim wheel operation, and retaining thumb switch control. Also, wouldn't this change confuse pilots who were not fully trained on the 737 Max and who relied on earlier 737 systems configuration and who thought they could disable autopilot (or other automated) stabilizer inputs but retain electric trim?]
Sorry for any confusion- there is no MCAS on NG. I was postulating what if the MAX had retained the autopilot cutout switch.
Delete" With the 737NG cutout switches, MCAS runaway is stopped by just throwing the autopilot cutout switch, leaving electric trim fully operable.
ReplyDelete[I thought MCAS was not present on a 737NG]
I think the ref was to the STS system which is part of the Autopilot- but driven by ' an AOA - or both AOA sensors '-
And no one told the pilots that the MCAS system changed the switch functions !
Sorry for the confusion - I was postulating what if the MAX had retained the autopilot cutout switch.
DeleteBoeing changed the cutout switch functions for no good reason.
It is said the new engine moved the cg forward. How do nominal cg's in percent chord differ between the -8 and NG. Also what are the cg limits on the these aircraft. It seems that the MAX may need a larger tail volume.
ReplyDeleteLots of questions. I have no concern that the weight distribution was carefully analyzed and managed. It is not the issue at hand.
DeletePeter, I am trying to understand your description of the differences between cutout switches on the NG and the MAX, and I am left dumbfounded. I think you need to rewrite the whole section and separate NG from MAX.
ReplyDeleteYou say "With the 737NG cutout switches, MCAS runaway is stopped by just throwing the autopilot cutout switch", but the NG does not have MCAS! Maybe you wanted to say "WOULD BE stopped"? On the NG switching off the right switch leaves electric motor active to help in case of mis-trim, I guess this is why we have not seen any crashes caused by faulty STS. If I understand correctly, on the MAX, only the STS is turned off with the right switch, but MCAS turned off when both switches are off, and in this case the pilots need to use hand crank. But the trim button is supposed to override MCAS? I think we need more info whether using the trim button can stop already running correction by MCAS; whether momentarily releasing and then using the trim button can activate MCAS...
BTW, somewhere else I've read that STS is also controlled by only one AOA sensor similarly to MCAS, is this true?
Sorry for confusion. There is no MCAS on the NG, and the MAX does not have the cutout switch labeled Autopilot. But if only it did.
DeleteOn the MAX, either cutout switch disables all forms of electric trim.
Yes, the yoke switch trim will stop MCAS, it is in the data to confirm, but it will wake up again five seconds after releasing it.
STS operates on airspeed. Minspeed is calculated from AOA.
"either cutout switch disables all forms of electric trim" — um, on the MAX the right cutout turns off autopilot and STS, but leaves electric trim operational, MCAS is also operational. Turning off the left switch in addition to the right one turns off MCAS but also turns off electric trim. Is this correct? If the pilot re-engages electric trim within 5 seconds after releasing it, will MCAS activate or not?
DeleteGreetings to all, non-flying newbie here. I've spent 30 years as an electronics design engineer - for background.
ReplyDeleteOne report I read stated that (on one of these aircraft) a faulty AOA 'sensor' was reported and REPLACED prior to the accident flight. That stopped me cold, what are the odds that both a factory-fitted part, and a replacement part would produce identical faults.
In my experience, such a major anomaly would lead me to first check the serial number of the replaced part against the factory-fitted part.
Why? 'No fault found' test results leave the tester with a dilemma, does he replace it, leave it, or leave it but log it as changed? I've seen the latter many times, unfortunately.
Strict QA procedures should identify such a scenario, but are they looking at these records? Serial number checks should suffice.
Finding 2 parts displaying the same fault rings LOUD alarm bells with me - it suggests a far deeper analysis is required. This is based on the faulty AOA unit leading to the MCAS initiation.
The fault in the vane removed and the vane installed prior to JT043 were different. Possibly related, but different.
Delete'Boeing's CEO has acknowledged the role of the erroneous angle of attack sensor information triggering the MCAS system in the two crashes, calling it one link in a "chain of events" that caused the crashes.'
ReplyDeleteThat's 3 AOA units showing the same fault?
Looking at the FDR plots, the AOA output changes from an analogue to digital signal as the trace goes full-scale AND STAYS THERE. The software accepting this condition as 'real-world' is highly suspect at the very least, and not fit for purpose imnho.
Something [Rotation?] is physically maxing out the unit, with no immediate recovery.
the failed vane changed out prior to JT043 was "out of range", it must have been grossly in error.
DeleteThe failed vane in JT043 and JT610 suffered a large bias. It may have been mishandled or bent - damaged in some fashion.
The vane on ET302 appears to have broken off.
ET302 AoA sensor damage - could it possibly be ramp rash ? loading dock ? cockpit window washer/cleaner ? bird strike ?
DeleteMy heavens, if everything I have read here is accurate - as it seems to be - than Boeing is responsible. In many ways.
ReplyDeleteAs a non-pilot I appreciate all the time and effort by Peter and the contributors to this blog. My understanding is that there are two MCAS systems - each with its own AOA sensor. If so, why wasn't it possible to switch to the alternative system; the probability of two AOA sensors failing simultaneously is rather low.
ReplyDeleteThe LAC-C5B has double redundant controls for the stabilizer. Both the Nut and the Jackscrew can be moved independently. Do any commercial transports have this feature? I do appreciate the time and effort you have put into this very important endeavor. It seems to me that this is new area. Historically no aircraft has been modified so much as to essentially create a different airplane. It seems to me MCAS was created without intended negligence but in haste without regard to normal flight control design methods leading to a tragic circumstance. Regulations should not allow this to happen again. Oh I think there is only MCAS system. One is bad enough. The A320NEO has two stall warning systems and uses three AoA sensors which is what one would expect in a modern transport. This stall warning system is in a different context than MCAS.
ReplyDeleteOn A320, the manual trim wheel will override the electrical command of the Trim Actuator (THSA), the THSA will move under hydraulic power, not under human power, using one of the two hydraulic motors (attached to green and yellow circuits).
ReplyDelete