Friday, November 23, 2018

First Look at JT610 Flight Data

Partial release of flight data from JT610 (h/t to Don Thompson). In short summary, the left Angle of Attack (AoA) vane was substantially offset from the right vane from taxi out. The left stick shaker activated on liftoff and stayed on for most of the accident flight. MCAS trimmed nose down when flaps were up. In a deadly game of tag, the Pilot stopped MCAS by manual trim nose up, but MCAS would start again five seconds later.  In each excursion, the stabilizer was held roughly in trim. There are 26 occurrences of MCAS trim down, pilot trim up.

It may have been the point when the captain transferred control to the first officer that MCAS was successful in two successive cycles, trimming the stabilizer nose down over four units without opposition.

The captain seems to have taken control back in the end, and pulls the column hard aft. MCAS is able to trim yet another one unit nose down before the captain stops it, but there is no subsequent  significant command to trim stabilizer nose up. The airplane dive exceeded 450 knots by the point of impact.

The prior flight showed similar behavior. But on that flight, the flight crew appear to have quickly cutout the electric trim altogether, and completed the flight trimming the stabilizer with the wheel.

Search for the CVR continues.
REVISED 11:50pm 27 Nov 2018 (noted airspeed disagree)
Here is a google translation of the slides

In accordance with Law No. 1 of 2009, article 357, the state investigated the Lion Air, JT 610 aircraft accident that had an accident in Tanjung Karawang on October 29, 2018. 

According to article 359, paragraph 1, "The results of the investigation cannot be used as evidence in the judicial process "Paragraph 2," The results of the investigation as referred to in paragraph (1), which are not classified as confidential information, can be announced to the public".

LEGAL BASIS Investigation is carried out by the National Transportation Safety Committee (NTSC) and aims to find causes and provide safety recommendations. Investigation also follows international provisions contained in the International Civil Aviation Organization (ICAO), Annex 13, which one of them gives rights to the aircraft designer and aircraft-making countries, in this case the United States represented by the National Transportation Safety Board (NTSB) by the Federal Aviation Administration (FAA) and Boeing.

In addition to NTSB, those involved in the investigation were Australia (ATSB) and Singapore (TSIB) 

Two investigators from the Kingdom of Saudi Arabia (AlB) also came as observers to learn about investigations in Indonesia; 

Bentos USA sent the tool and its operator for pinker detectors from black box (CVR) for the efforts of BPPT. 

On November 1, the FDR was successfully found and on November 4 FDR data was successfully downloaded. 

From FDR, 1790 parameters were obtained, for 69 hours, consisting of 19 flights including those who had an accident. 

FDR data has been processed for analysis purposes.

ACTIVITIES THAT ARE RUNNING ON THE SITE 
The NTSC team continues its search for CVR with several methods using high resolution side scan sonar, sub bottom profiling, magneto, desludging and work class ROV equipped with 4 cameras and robotic arms and dives. 

The location of the crash of the aircraft is very close to Pertamina's oil pipelines and submarine cables, for this ship is needed with Dynamic Positioning. 

For this purpose the search program requires preparations that are not simple and take several days.

ACTIVITIES THAT WERE CONTINUOUS 
NTSC had issued a recommendation to Boeing to improve the procedure. 

The NTSC recommendations have been followed up by Boeing and the FAA by publishing "Boeing, Flight Crew operation Manual Bulletin and FAA, Emergency Advisory Directive"

ACTIVITIES THAT ARE CONTINUOUS
The engine evacuated from the sea has been damaged by collisions. 

Next investigation process: 
Data collection on aircraft maintenance, flight crew training 

Components of Angle of Attack sensors released in Bali, received by NTSC and will be inspected in Minneapolis and inspection of repair workshops in Florida Request data to repair AOA sensors installed at DPS from repair station in Florida and will be discussed at NTSB. 

It is planned that on November 28, 2018, the NTSC will issue a 'Preliminary Report'. Previously the NTSC together with the Ministry of Transportation (or other government agencies) and Lion Air, will deliver the results of the interim investigation to the families of the victims.

Subsequent investigations:
This accident is the first time this has happened in the world for B 737-8 MAX aircraft, so it is necessary to do flight simulations using engineering simulators and algorithms, especially MCAS systems and others at Boeing facilities, Seattle and reconstructing flights that have accidents see the impact on the plane for the damage.

NTSC INVESTIGATION CHALLENGES do not yet have sufficient resources in major accident investigation handlers. 

Currently supported by various parties such as BASARNAS, BPPT, Ministry of Transportation, Pertamina, Ministry of Energy and Mineral Resources, TNI dil. 

Especially regarding facilities, such as ships, diver workers, fuel, etc. 

The number of investigative human resources for 10 people is not enough to carry out all investigative activities that have taken place in Indonesia. 

For example, in the same week there were 2 other accidents that the NTSC could not send NTSC investigators did not yet have storage facilities for aircraft parts that had been appointed for further evaluation. 

Meeting rooms with other country teams and existing coordination rooms are not adequate. 

Airplane B 737 Max 8, including a new type of aircraft and most of the system uses digital, so to understand this new system we KNKT need time to study the aircraft system and to be able to analyze the problems that exist.

FLIGHT DATA
A small amount of flight recorder data has been released.  I have annotated it below for step-by-step review.

The data plotted, from top to bottom includes:

Manual Trim Command  - Nose Up is positive, Nose Down is negative

Stabilizer position - Nose up is 10, Nose Down is zero

Autopilot Trim Command - Nose Up is positive, Nose Down is negative

Stick (column) shaker - Up is activated - note only the left shaker activates

Column Force - Positive is aft column (nose up), Negative is forward column (nose down)

Angle of Attack - Positive is higher AoA. Noe the left (red) trace diverges from the right (green) trace

Flap Handle Position - Flaps up is the lowest value.

Altitude and Airspeed


Accident Flight Data

The airplane taxi included setting flaps.

The left AoA vane started out showing a much higher reading than the right AoA vane. As the airplane taxi proceeded, the left AoA vane continued to migrate to higher and higher reading, while the right AoA vane remained constant.

On the commencement of the takeoff roll, the right vane began to show some activity that was also reflected in the left vane.  But the left vane was offset substantially above the right vane values.

AOA Vane Disagree - Captain AoA about 20 degrees higher the First Officer AoA

The data shows good agreement for airspeed throughout the flight.
REVISED: the data shows about a 15 knot disagreement between airspeeds.

Airspeed Disagree on Accident Flight - Captain Airspeed read about 15 less than First Officer

(1) As soon as the airplane rotated and lifted off, the left stick shaker activated.

The right stick shaker remained off.

It should be apparent to any pilot, having the stick shaker go off, even if only on one side, would be uncomfortable. Taking no action for such a long time would be a significant distraction.

(2) As the airplane accelerated in the initial climbout, speed trim (autopilot function) add small nose-up trim commands, as expected.

(3) Flaps were commanded sequentially to flaps up.

(4) As soon as flaps up, MCAS kicks in and trims stabilizer down.

Column is pulled back in response.

Pilot trims nose up, stopping MCAS trim command.

Altitude briefly descends and then resumes climb.

(5) Pilots select flaps down, for reasons unknown, perhaps because they thought the anomaly was related to raising flaps. This inhibits MCAS.

The airplane slows down a bit and speed trim adds a bit of nose down trim in response.

Everything seems OK, except for left stick shaker activation.

(6) Stick shaker stops briefly when flaps are at the first detent, and then resumes as flaps continue to deploy.

The left stick shaker stays on to the end of the flight.

(7) Flaps are commanded back to Flaps UP.

(8) Flaps up. Nothing happens right away.

(9) MCAS trims stabilizer nose down. Captain trims nose up to stop MCAS.

(10) MCAS resumes nose down trim about five seconds later.

Captain trims nose up to stop MCAS.

(11) MCAS trims stabilizer nose down about five seconds later.

Captain trims nose up to stop MCAS.

(12) MCAS trims stabilizer nose down about five seconds later.

Captain trims nose up to stop MCAS.

(13) MCAS trims stabilizer nose down about five seconds later.

Captain trims nose up to stop MCAS.

(14) MCAS trims stabilizer nose down about five seconds later.

Captain trims nose up to stop MCAS.

(15) MCAS trims stabilizer nose down about five seconds later.

Captain trims nose up to stop MCAS. 

(16) MCAS trims stabilizer nose down about five seconds later.

Captain trims nose up to stop MCAS.

(17) MCAS trims stabilizer nose down about five seconds later.

Captain trims nose up to stop MCAS. 

(18) MCAS trims stabilizer nose down about five seconds later.

Captain trims nose up to stop MCAS.

(19) MCAS trims stabilizer nose down about five seconds later.

Captain trims nose up to stop MCAS. 

(20) MCAS trims stabilizer nose down about five seconds later.

Captain trims nose up to stop MCAS.

(21) MCAS trims stabilizer nose down about five seconds later.

Captain trims nose up to stop MCAS.

(22) MCAS trims stabilizer nose down about five seconds later.

Captain trims nose up to stop MCAS.

(23) MCAS trims stabilizer nose down about five seconds later.

Captain trims nose up to stop MCAS.

(24) MCAS trims stabilizer nose down about five seconds later.

Captain trims nose up to stop MCAS.

(25) MCAS trims stabilizer nose down about five seconds later.

Captain trims nose up to stop MCAS.

(26) MCAS trims stabilizer nose down about five seconds later.

Captain trims nose up to stop MCAS.

(27) MCAS trims stabilizer nose down about five seconds later.

Captain trims nose up to stop MCAS.

(28) MCAS trims stabilizer nose down about five seconds later.

Captain trims nose up to stop MCAS.

(29) MCAS trims stabilizer nose down about five seconds later.

Captain trims nose up to stop MCAS.

(30) The column forces, if I interpret correctly, show that the First Officer (F/O) (green) assumes control.

MCAS trims stabilizer nose down 2 units without interruption.

F/O trims nose up to stop MCAS.

F/O does not trim the stabilizer back nose up.

F/O applying more aft column. 

(31) MCAS trims stabilizer nose down about five seconds after interruption.

F/O applies nose up trim quickly to oppose MCAS and minimizes any additional nose down trim.

(32) MCAS trims stabilizer nose down about five seconds after interruption.

MCAS applies another 2 units of nose down trim, nearing the limit.

The F/O trims vainly in response to stop MCAS, but does not appreciably trim the stabilizer nose up.

(33) It appears, Captain takes control and pulls back on column with high forces. 

(34) MCAS trims stabilizer nose down about one unit about five seconds after interruption.

Captain (?) trims nose up to stop MCAS, but does not manage to move the stabilizer appreciably nose up.

At this point the airplane is in a dive, with airspeed exceeding 450 knots.

Engine data was provided which seems to be consistent with expectations, except at the point of the final dive, the engines are throttled up. Normally one would expect the engines to be brought to idle to avoid overspeed in an uncontrolled dive.

Accident Flight - Engine Data


Date from a prior flight was also provided.

Prior Flight

The left stick shaker activated on liftoff and stayed on until landing.

Once flaps were up, it appears that MCAS trimmed nose down, the pilot trimmed nose up, and that repeated at least ten times.  Then the trimming stopped for a while.  Perhaps the crew used the cutout switch.

Then there was another MCAS excursion, stopped by manual trim. The airplane was trimmed manually and the stabilizer did not move for the rest of the cruise leg. Maybe the crew switched off the cutout to see if it was OK, but when it moved adversely, they engage the cutout again, and leave it off.

Stabilizer moves during the descent, but there is no trim command. I would presume the flight crew were trimming using the manual wheel.

Conclusion
The flight data shows that MCAS (presumably) was triggered persistently.

In the prior flight, the crew fought MCAS for a while and then appear to have cutout the electric trim, and finished the flight manually trimming the wheel.

In the accident flight, the crew repeatedly fought MCAS, only to have it activate again and again. Tragically, one time they let it get away from them. Why they were not able to trim nose up in the dive is uncertain, but the aft column forces were very high.

The left AoA vane is offset substantially from the right AoA vane.


Stay tuned!

Peter Lemme

peter @ satcom.guru
Follow me on twitter: @Satcom_Guru
Copyright 2018 satcom.guru All Rights Reserved

Peter Lemme has been a leader in avionics engineering for 37 years. He offers independent consulting services largely focused on avionics and L, Ku, and Ka band satellite communications to aircraft. Peter was chairman of the SAE-ITC AEEC Ku/Ka-band satcom subcommittee, developing ARINC 791 and 792 characteristics and contributes to the Network Infrastructure and Interfaces (NIS) subcommittee developing Project Paper 848, standard for Media Independent Secure Offboard Network.

Peter was Boeing avionics supervisor for 767 and 747-400 data link recording, data link reporting, and satellite communications. He was an FAA designated engineering representative (DER) for ACARS, satellite communications, DFDAU, DFDR, ACMS and printers. Peter was lead engineer for Thrust Management System (757, 767, 747-400), also supervisor for satellite communications for 777, and was manager of terminal-area projects (GLS, MLS, enhanced vision).

An instrument-rated private pilot, single engine land and sea, Peter has enjoyed perspectives from both operating and designing airplanes. Hundreds of hours of flight test analysis and thousands of hours in simulators have given him an appreciation for the many aspects that drive aviation; whether tandem complexity, policy, human, or technical; and the difficulties and challenges to achieving success.

21 comments:

  1. SLF here (& frequent Max flyer transatlantic). From what I've read I thought that MCAS was deactivated when the Autopilot was switched off? Is that the case? Was JT610 being flown manually or by autopilot when it crashed?

    ReplyDelete
    Replies
    1. MCAS is only active when autopilot not engaged.
      Confusing this is that MCAS command comes from the autopilot.

      Delete
  2. Hello Peter, thanks for sharing your expert insights on the doomed flight behavior. May I ask a question, perhaps, an ill-informed one? I am curious to know the structural strength and integrity of commercial airliners like Boeing. The Lion Air doomed flight did not achieve crushing altitude of the standard 35,000 ft. I don’t know the exact altitude achieved but due the MCAS triggering, I believe the jet didn’t reach cruising altitude. Why did the jet disintegrate upon impact from a mid level altitude? I know it plummeted at 400 MPH but is there no structural strength to absorb the impact? Are jetliners not constructed to withstand high volume impact? I am unable to fathom why there were no survives. As if the plane fell off from cruising altitude. Apologies if my question is misinformed. Seeking your expert thoughts if you may..
    - Rakesh Ghatvisave

    ReplyDelete
    Replies
    1. No, the forces in a high speed dive literally obliterate the structure. Aviation is a matter of compromise, where weight is the enemy. the aircraft is built with the lightest structure possible.

      Delete
  3. The only question I have is why the aircraft has not been grounded.

    ReplyDelete
  4. Trimming the stabilizer nose down as a stall recovery technique is a new one for me.
    Most modern autoflight systems, when they disagree, disconnect, and/or display a caution or warning light.
    There's more to this.

    ReplyDelete
    Replies
    1. MCAS is not a stall recovery function. Its purpose is to offset the pitch up tendency so that the pilot does not have to push the yoke to stop it pitching up. It is important for handling qualities that the column forces remain "positive".

      Delete
    2. Peter, thanks for your blog.

      Most media reports refer to the 737 MAX being longitudinally unstable. However, the behavior is more that of a "pitch up" or unbalanced flight.

      An unstable airplane will pitch up if disturbed upwards and pitch down, if disturbed downwards. Here, that does not seem to be the case.

      Delete
  5. Thank you for the article. So when Lion Air dive to the ocean, the nose was up or down?

    ReplyDelete
  6. Very interesting. What is your guess of the most common cause of AoA disagreeing? Incorrect wiring? Software run-away?

    ReplyDelete
  7. Great analysis, Peter, of this tragic accident.

    ReplyDelete
  8. Great analysis, Peter, of this tragic accident.

    ReplyDelete
  9. True brilliance in your observations. As an investor of BA and other defense providers, this is wonderful commentary, as opposed to the knuckleheads on business news channels. Thank You Very Much

    ReplyDelete
  10. Hi! Thanks for very interesting analysis.
    I'm trying to find information on this topic: when MCAS is changing stabilizer position, does trim wheel indicate this stabilizer movement? Or is it using some other, less apparent mechanism? I mean, could pilot be unaware that stablizer is moving in opposite direction after they trim it manually?

    ReplyDelete
    Replies
    1. The challenge is that speed trim system (STS) trims the stabilizer all the time. MCAS command could easily be misinterpreted as STS. Yes, the wheel turns in all cases.

      Delete
  11. Dear Mr Peter
    Great explaination of awful disaster(s).My querry that is this first time MCAS IS USED IN PASSENGER AIRCRAFT.Such a critical feature but why since inception of 737MAX 8,problem is surfacing now.Is it that as such no harm in MCAS but due to specific instrument failure on particular plane,safety instrument turned into disaster.Seeking yr expert comment

    ReplyDelete
  12. Good work Mr. Lemme. My name is John Knox. I worked in flight control design staff at Lockheed Georgia during 1967-1983. I am not conversant with Boeing aircraft. I agree with your analysis in regard to the Boeing fix. I have some questions. As you say fix 1 should have been there. The aircraft had two sensors. It is difficult to explain why both were not used. Where did the 5.5 deg. difference originate. What is the probability that MCAS can initiate with this difference?
    Fix 2. I agree with your comments.
    Fix 3 relieves the intermittent action that should never have been there. How did MCAS originate? It came from flight test I'm sure but what maneuvers? I can’t see how these intermittent actions would make the aircraft more like NG or do anything but confuse the pilot and design for a runaway trim. Where was the Failure Effects and Mode Analysis (FMEA) team? It seems to me failure effects analysis was severely lacking in the design process. Has the system ever actuated in operational flight? Stall rarely occurs in high speed flight. Reliability analysis may show that one is safer without MCAS. However I don’t think Boeing would have MCAS unless there was a critical need perhaps due to the forward cg and engine causing a critical fast stall condition that makes the system flight critical. Then you have to have a system that not only needs to have protection from sensor faults but also has a reliable sensor input at all times. I think the MIL spec. would require three sensors.
    Fix 4. Failure modes should be investigated.
    Fix 5. Why isn’t elevator and stab position used to indicate mistrim and limit stabilizer position so that 5 always will hold. Why is the stabilizer used in MCAS as opposed the elevator that one would normally use for stall prevention? The stabilizer has probably over twice the elevator control power and is slow to respond and can cause run away trim. I have never seen the stabilizer used for stall prevention.

    Fix 6. This is what Boeing first said. Also from Boeing on this subject,
    “The reason for this design decision being that providing the pilot a way to easily override would negate why MCAS was implemented, the Pilot pulling so hard on the Yoke that the aircraft is flying close to stall. In other words, MCAS is a mechanism installed to correct an already present pilot error. Logically, this corrective intervention by the flight computer can only be cancelled through a dedicated operating sequence. It's also worth mentioning that even extreme yoke action, working on the elevators only, is not able to fully compensate extreme stabilizer positions, the control surfaces MCAS uses (apart from, I suppose, creating unpleasant flight characteristics).
    Huh? Why does Boeing disable the column cutout when MCAS is on? The elevator lacks enough control power? Does the pilot have to use the control wheel? This can difficult or impossible under conditions. A forward cg is more stable but requires more contro power. Could it be that a forward cg shift due to the engine has caused the Max to have not enough horizontal control power in general? what is its cg range compared to other Boeing aircraft.

    ReplyDelete
  13. Hi Peter.
    Very good and informative description of the conditions, I really enjoyed reading such a technical based description.
    I have some questions on the conditions that can be seen on the FDR data both from Lion-Air and Ethiopia.

    1) When the pilots apply "corrective manual trim" they only do it for a short time , i.e 4 - 6 seconds; is this by purpose (i.e. is there a limit for the duration one is allowed to apply manual trim ?), or is it just 'common behaviour for pilots? i.e. Could they apply it for e.g. 15 seconds, or untill "trim balance" is obtained?

    2) From the information provided in the two preliminary report, it looks like that the "Flap-down" command will disable the MCAS, but still allow the pilot to fly under 'almost' normal conditions. If the pilots on Lion-Air had left the flap i T.O. position, had they then had the oportunity to make a go-around and land the plane (almost) normally?

    3) On the Lion-Air accident, it looks to me as if the AOA-probe is operating normally (i.e. tracking the right probe pretty good), but with 20 degree offset. Can you envisage a fault condition causing that fault mode, or is it probable that this 'offset' is applied somewhere downstream the AOA-probe itself.

    4) As it can be seen from both reports, then the present implementation of the MCAS has a "Single Point of Failure". If the implemementation was revised, such that both MCAS system had to be active before the trin was commanded "AND", i.e. changing it from OR-conditions to AND-conditions, for MCAS trim activation, would that make the MCAS Single Fail safe ?

    5) In both cases, the MCAS command is preceeded by an "asymmetrical shaker condition". Is such a condition "common", or should it be considered as a "AOA fault Warning" by pilots.

    Kind Regards
    Jan Bagge

    ReplyDelete
  14. Peter, Do you know if the 737-MAX has incorporated the ONS (Advanced Onboard Network System) mentioned in this Boeing Publication?
    https://www.boeing.com/commercial/aeromagazine/articles/2014_q3/pdf/AERO_2014q3.pdf
    Are the error codes mentioned in the Preliminary report of the Lion Air accident recorded and reported from the ONS maintenance system? They mention an "Engine Trim Balance" for 2014 being incorporated. Any ideas of what that is or does? I"ve heard very little about ONS and am not sure if the 737-MAX has this installed or was it not incorporated into the final design of the 737-MAX program. Thank you. Richard Davenport

    ReplyDelete