Flight Safety Information April 8, 2019 - No. 071 In This Issue How excess speed, hasty commands and flawed software doomed an Ethiopian Airlines 737 MAX Boeing's 'single point failure': Why was there no backup system on 737 Max jet? American Airlines extends Max-caused cancellations to June 5 Incident: United B738 at Chicago on Apr 7th 2019, could not retract gear Incident: Klasjet B735 at Madrid on Apr 5th 2019, navigation malfunction Incident: Finnair A319 at Vaasa and Helsinki on Apr 6th 2019, burst tyre Incident: Eurowings B738 near Stuttgart on Apr 5th 2019, defective instrument display Incident: Expressjet CRJ2 near Dallas on Apr 4th 2019, overheating cockpit displays Incident: Austrian DH8D at Innsbruck on Apr 4th 2019, tail strike on landing. Boeing 737-8GJ (WL) - Hail Damage (India) Fly Safely | Fly With AvSax MITRE - SMS Course - June 2019 Call for Nominations For 2019 Laura Taber Barbour Air Safety Award How excess speed, hasty commands and flawed software doomed an Ethiopian Airlines 737 MAX Adds Boeing CEO quote, former United exec • Engines left at full take-off power throughout flight, data show • Sensor possibly damaged by bird strike shortly after take-off • Pilots left jet pointed down before cutting MCAS, data show • Boeing says software fix will prevent similar accidents By Tim Hepher, Eric M. Johnson and Jamie Freed PARIS/SEATTLE/SINGAPORE, April 5 (Reuters) - Minutes after take-off, the pilots of an Ethiopian Airlines 737 MAX were caught in a bad situation. A key sensor had been wrecked, possibly by a bird strike. As soon as they retracted the flaps and slats, it began to feed faulty data into the Maneuvering Characteristics Augmentation System (MCAS), designed to prevent stalls. Flying faster than recommended, the crew struggled with MCAS. But the high speed and the jet's forward-leaning posture made it nearly impossible to use the controls to pull the nose up. Moments later, the Boeing Co jet hit the ground, killing all 157 people onboard after six minutes of flight. Ethiopian authorities said on Thursday that the pilots followed all the correct procedures in trying to keep MCAS from sending the plane into a fatal dive. But the full picture of what happened in the cockpit of Flight 302 on March 10 is emerging from the sparse commentary of a preliminary report and especially a newly released data plot showing how crew and technology interacted. The airline's youngest-ever captain, a 29-year-old with an impressive 8,100 hours flying time, and his rookie 25-year-old co-pilot may have gone against procedures by leaving the engines at full take-off power, according to data and other pilots. By the end, the aircraft was travelling at 500 knots (575 mph, 926 kph), far beyond its design limits. That and some other potential missteps may have left them unable to fight flawed Boeing software that eventually sent the jet into an uncontrollable dive, experts said after studying the data. "Power being left in take-off power while levelling off at that speed is not a normal procedure," said one U.S. pilot, who declined to be named because he was not authorised to speak to the media. "I can't imagine a scenario where you'd need to do that." The Ethiopian Airlines crash, and another in Indonesia five months earlier, have left the world's largest planemaker in crisis as its top-selling jetliner is grounded worldwide, and Ethiopia scrambling to protect one of Africa's most successful companies. Boeing is working on an MCAS software fix and extra training that it says will prevent a repeat of such accidents. Chief Executive Dennis Muilenburg said on Friday that both accidents were caused by a chain of events, "with a common chain link being erroneous activation of the aircraft's MCAS function." BIRD STRIKE Sources who reviewed the crash data said the problems started barely 12 seconds after take-off. A sudden data spike suggests a bird hit the plane as it was taking off and sheared away a vital airflow sensor. As with the Lion Air crash in Indonesia, the damaged 'angle of attack' sensor, which tells pilots what angle the aircraft has relative to its forward movement, may have set off a volatile chain of events. In both cases, the faulty sensor tricked the plane's computer into thinking the nose was too high and the aircraft was about to stall, or lose lift. The anti-stall MCAS software then pushed the nose down forcefully with the aircraft's "trim" system, normally used to maintain level flight. The first time the MCAS software kicked in, the Ethiopian Airlines pilots quickly countered the movement by flicking switches under their thumbs - they had recognised the movements as the same type all flight crews had been warned about after the Lion Air flight. Safety officials say aviation accidents are rarely pinned entirely on either pilots or their technology, and a timeline showed the crew fully engaged in trying to save the aircraft. But data suggests they did not hold the buttons down long enough to fully counteract the computer's movements. At that point, they were a mere 3,000 feet above the airport, so low that a new warning - a computerised voice saying "don't sink" - sounded in the cabin. When MCAS triggered again, the jetliner's trim was set to push the nose down at almost the maximum level, while the control yoke noisily vibrated with another stall warning called a "stick shaker." This time, the pilots countered MCAS more effectively. But when they turned off the system - as they were instructed to do by Boeing and the U.S. Federal Aviation Administration (FAA) in the wake of the Lion Air disaster - the nose was still pointed downward, leaving the jetliner vulnerable. The combination of excess speed and cutting off the system while the plane was still leaning downwards meant up to 50 pounds of force would be needed to move the control column, and moving the manual trim wheels was impossible. 'PULL UP, PULL UP' The captain called out "pull up" three times. The co-pilot reported problems to air traffic control. In the meantime, the aircraft's speed remained abnormally high. The bird strike and loss of airflow data would have affected airspeed information too. In such cases, pilots know to turn off automatic engine settings and control thrust manually. But the report says "the throttles did not move," without elaborating. Data confirms the engines stayed at nearly full power. Other 737 pilots say that made the crew's job tougher by making the controls much harder to move. "You would never ever have full power for the whole flight," said Hart Langer, a veteran former senior vice president for flight operations at United Airlines. He and some other experienced pilots said there was an array of stressful factors sapping the pilots' attention, which Muilenburg addressed on Thursday. "As pilots have told us, erroneous activation of the MCAS function can add to what is already a high-workload environment," Muilenburg said. "It's our responsibility to eliminate this risk. We own it and we know how to do it." Among the distractions was a "clacker" warning telling the pilots their aircraft was going too fast. As the nose gradually fell, the pilots turned to a last-resort device to adjust the plane's trim. The captain asked the young co-pilot to try to trim the plane manually using a wheel in the centre console to lift the nose and make it easier to recover from the dive. But it was too hard to move the wheel. Both men then tried to pitch the nose up together. The captain, according to the report, said it was not enough. MCAS RE-ACTIVATES In a possible last-ditch attempt to level the plane, data suggests the pilots turned MCAS-related systems back on. That would also reactivate the electric trim system, and perhaps make it easier for the pilots to force the reluctant nose higher. Reactivating MCAS is contrary to advice issued by Boeing and the U.S. Federal Aviation Administration after Lion Air. The report did not address that. The pilots managed to lift the nose slightly using the electric thumb switches on their control yokes. But the data readout suggests they flicked those switches only briefly. With its power restored, a final MCAS nose-down command kicked in, eventually pushing the nose down to a 40 degree angle at an airspeed of up to 500 knots, far beyond the plane's operating limits. This is when the jet would inherit the risk of maintaining high take-off thrust, as it dived "way too fast," Langer said. As the 737 MAX plunged, G-forces turned negative, pulling occupants out of their seats and possibly inducing a feeling of weightlessness as the plane hurtled toward the ground. Just six minutes after take off, the plane crashed into a field. (Additional reporting by Jason Neely in Addis Ababa, Tracy Rucinski in Chicago, David Shepardson in Washington, and Allison Lampert in Montreal; Editing by Gerry Doyle and Daniel Wallis) Back to Top Boeing's 'single point failure': Why was there no backup system on 737 Max jet? Boeing Company CEO Dennis Muilenburg is apologizing after two deadly 737 MAX plane crashes. Muilenburg says Boeing has teams of experts "working tirelessly" to prevent anymore accidents. USA TODAY When it comes to safety, modern commercial aircraft are known not only for having backup systems, but in some cases, backups of their backups. So even as Boeing has taken responsibility for a fatal flaw in a key anti-stalling system in its 737 Max 8, mystery still surrounds why the software was designed to be dependent on a single outside sensor though it was equipped with two, triggering a chain of events that led to the crashes of Lion Air and Ethiopian Airlines jetliners less than five months apart. Boeing "violated a basic principle of aircraft design by allowing a single point failure to trigger a sequence of events that could result in a loss of control," said Brian Alexander, an attorney for a law firm specializing in aviation accidents, Kreindler & Kreindler in New York, that is contemplating lawsuits on behalf of victims' families in the Ethiopian Airlines crash. Based on an initial report from crash investigators, Boeing CEO Dennis Muilenburg acknowledged Thursday that erroneous data sent to the system led to the Lion Air crash off Indonesia in October that killed 189 passengers and crew and the Ethiopian Airlines disaster in Africa that took 157 lives on March 10, both in the 737 Max 8. He vowed Boeing would fix the problem. Boeing CEO Dennis Muilenburg said Thursday the company accepts responsibility for the two 737 MAX crashes that killed 346 people and that the company will have a fix for the problem within weeks. Others, however, aren't so sure that Boeing can find an adequate repair and say the twin crashes are proof that the plane's problems run deeper than flawed sensors. They say the design itself has created inherent problems that simple fixes won't solve. "You go to the source of the problem, not the symptom," said consumer advocate Ralph Nader, who lost a niece in the Ethiopian Airlines crash. "An aircraft has to be designed stall-proof, not stall-prone." For now, all Boeing 737 Max 8 and 9 aircraft around the world have been grounded amid investigations into the source of the problem. Boeing, on the basis of inquiries into the two crashes, has focused on the Maneuvering Characteristics Augmentation System, or MCAS. The system is supposed to automatically push down the plane's nose when either of two angle-of-attack sensors, one mounted on each side of the fuselage, detects that the plane had pointed upward so steeply that it can stall. MCAS was added because of the possibility the nose can pitch up as a result of the larger, heavier engines that were added to the Max. But in an unusual move, engineers designed MCAS to initiate when it detected too steep of an ascent from either sensor. The sensors didn't work in tandem. In a statement to USA TODAY, a Boeing spokesman said the commercial aircraft giant followed established industry "assumptions and processes" in creating the fight control systems. "Single sources of data are considered acceptable in such cases by our industry, and additional changes to the system were not deemed warranted," spokesman Peter Pedraza said. The company felt safe in adding MCAS because if there was a malfunction, "a pilot would be able to counteract erroneous system input" using either of two methods, Pedraza said. One way would be to use switches on the control wheel to adjust the plane's trim, which adjusts control surfaces to make the plane easier to fly, like cruise control in a car. Or the same task can be done manually. Either way, the goal would have been to control the angle of the aircraft. Crash aftermath: Boeing to slow production of 737 Max as it continues working on software fix Yet apparently those procedures didn't work for the Lion Air and Ethiopian Airlines crews. In the case of Ethiopian, which encountered problems soon after takeoff from Addis Ababa, pilots tried Boeing's procedures for an MCAS malfunction repeatedly and still couldn't control the plane, Ethiopian Minister of Transport Dagmawit Moges said Thursday. The single source of data seems unusual given the lengths Boeing has gone to build redundancies into its jetliners. For the 777, Boeing's twin-aisle intercontinental jet, engineers created triple redundancy for its computers, hydraulics, communications and electrical power. Perhaps the best illustration of the lengths the company was willing to go on backups was found in the plane's primary flight computer. It was built with three microprocessors instead of one, and each came from a different manufacturer: Intel, AMD and Motorola, according to an account by a Boeing engineer. The decision on how many backups to have isn't easy, said Peter Seiler, an associate professor of aerospace engineering at the University of Minnesota who used to work at Honeywell, a subcontractor for Boeing. It depends on how critical to safety the system is considered, how much it will distract an already-busy flight crew if it fails, and the odds of it failing, among other factors. "I spent four years working on the 787, and I spent all my time thinking about every possible way things can go wrong," he said. It may be that Boeing didn't consider MCAS crucial enough to warrant a backup. It was designed, after all, as part of an overall goal of making Max jets fly and feel like the previous 737 version, the Next Generation or NG, and the ones before it. "If the MCAS fails, the crew loses a little bit of stall protection, but stall protection is primarily the responsibility of the crew," said Clint Balog, a 42-year pilot and an associate professor at Embry-Riddle Aeronautical University. With the 737 update, Boeing saved time by not having to create an all-new jet. It also could sell the 737 to airlines on the basis that because Max was just an update, pilot training costs would be limited. Boeing's proposed fix of the problem to the FAA involves requiring that MCAS constantly monitor readings from the two sensors and disengage if they differ widely from each other, and to make standard a cockpit warning light that used to be an option. "Whenever there is an accident or incident, our industry has a history of going back and challenging the basic assumptions, and when appropriate, making changes," Boeing spokesman Pedraza said. "This process has led to over 50 years of continuous safety improvement." https://www.usatoday.com/story/news/nation/2019/04/06/boeings-737-max-8-jet-mystery-why-there-no-backup-system/3378703002/ Back to Top American Airlines extends Max-caused cancellations to June 5 WASHINGTON - American Airlines is extending by over a month its cancellations of about 90 daily flights as the troubled 737 Max plane remains grounded by regulators. American said Sunday it is extending the cancellations through June 5 from the earlier timeframe of April 24. The airline acknowledged in a statement that the prolonged cancellations could bring disruption for some travelers. The Boeing-made Max jets have been grounded in the US and elsewhere since mid-March, following two deadly crashes in Ethiopia and Indonesia. Airlines that own them have been scrambling other planes to fill some Max flights while canceling others. American Airlines Group Inc., the largest US airline by revenue, has 24 Max jets in its fleet. The Dallas-based airline said it is awaiting information from US regulators, and will contact customers affected by the cancellations with available re-bookings. Boeing and the US Federal Aviation Administration said last week the company needs more time to finish changes in a flight-control system suspected of playing a role in the two crashes. That means airlines could be forced to park their Max jets longer than they expected. American said Sunday that by canceling the flights in advance, "we are able to provide better service to our customers with availability and re-booking options," and to avoid last-minute flight disruptions. American's reservations staff will contact affected customers directly by email or phone, the airline said. "We know these cancellations and changes may affect some of our customers, and we are working to limit the impact to the smallest number of customers," the statement said. Boeing said Friday that it will cut production of the Max jet, its best-selling plane, underscoring the mounting financial risk it faces the longer the airliner remains grounded. Starting in mid-April, Boeing said, it will cut production of the plane to 42 from 52 planes per month so it can focus on fixing the flight-control software that has been implicated in the two crashes. Preliminary investigations into the deadly accidents in Ethiopia and Indonesia found that faulty sensor readings erroneously triggered an anti-stall system that pushed down the plane's nose. Pilots of each plane struggled in vain to regain control over the automated system. In all, 346 people died in the crashes. Boeing faces a growing number of lawsuits filed by families of the victims. The announcement to cut production came after Boeing acknowledged that a second software issue has emerged that needs fixing on the Max - a discovery that explained why the aircraft maker had pushed back its ambitious schedule for getting the planes back in the air. https://thenypost.files.wordpress.com/2019/04/boeing-aircraft.jpg?quality=90&strip=all&w=618&h=410&crop=1 Back to Top Incident: United B738 at Chicago on Apr 7th 2019, could not retract gear A United Boeing 737-800, registration N27205 performing flight UA-848 from Chicago O'Hare,IL to Orlando,FL (USA), was climbing out of Chicago's runway 09R when the crew stopped the climb at 15,000 feet reporting they were unable to retract the landing gear. They'd maintain 250 KIAS and would return to Chicago. The aircraft landed safely back on Chicago's runway 28C about one hour after departure. A replacement Boeing 737-800 registration N35236 reached Orlando with a delay of 2.5 hours. https://flightaware.com/live/flight/UAL848/history/20190407/1635Z/KORD/KMCO http://avherald.com/h?article=4c6652c0&opt=0 Back to Top Incident: Klasjet B735 at Madrid on Apr 5th 2019, navigation malfunction A Klasjet Boeing 737-500, registration LY-KLJ performing flight KLJ-125 from Madrid,SP (Spain) to Kaunas (Lithuania), was climbing out of Madrid's runway 14L when the crew stopped the climb at about 5000 feet due to problems with their navigation systems. The crew decided to return to Madrid, the aircraft entered a climb at more than 3000 fpm followed by a descent with more than 2500 fpm, misaligned with their assigned runway 18 aborting the approach early, positioned for a second approach but again were left of both runways 18 and went around. Due to weather the crew subsequently decided to divert to Getafe Airport Base,SP (Spain where the aircraft managed a safe landing about 40 minutes after departure. Klasjet reported the passengers were never in danger, the crew put flight safety as first priority and therefore decided to divert to Getafe. The aircraft was carrying the basketball team of Zalgiris, who had won their match against the Euroleague team of Real Madrid and had earned their qualification for the Euroleague Playoff (which the club stated was "unthinkable"), and were returning to their home in Kaunas. The aircraft is still on the ground in Getafe about 33 hours after landing. http://avherald.com/h?article=4c65913a&opt=0 Back to Top Incident: Finnair A319 at Vaasa and Helsinki on Apr 6th 2019, burst tyre A Finnair Airbus A319-100, registration OH-LVA performing flight AY-322 from Vaasa to Helsinki (Finland) with 86 people on board, was on approach to Helsinki's runway 04R when the crew advised of a possibly burst tyre, they would be able to vacate the runway however. The aircaft landed safely, vacated the runway and stopped. Examination revealed the outboard left main tyre had burst. The aircraft was towed to the apron. Finland's Onnettomuustutkintakeskus (AIBF) reported they have opened a preliminary investigation into an airliner landing with a broken tyre on Helsinki's runway in the morning of Apr 6th, there were no injuries. The airline reported the aircraft landed safely, it needs to be seen whether the passengers actually noticed anything in the cabin. The aircraft vacated the runway and was towed to the apron. It not known exactly how the tyre was damaged, however, the left outboard main tyre was quite badly damaged, obviously already during departure from Vaasa. http://avherald.com/h?article=4c658d12&opt=0 Back to Top Incident: Eurowings B738 near Stuttgart on Apr 5th 2019, defective instrument display A Eurowings Boeing 737-800, registration D-ABKN performing flight EW-7520 from Hamburg (Germany) to Barcelona,SP (Spain) with 174 people on board, was enroute at FL370 about 30nm southwest of Stuttgart (Germany) when the crew decided to turn around and divert to Hanover (Germany) due to a failed insturment display. The aircraft landed safely in Hanover about 90 minutes after departure. The display was replaced, the aircraft departed again after about 2 hours on the ground and reached Barcelona with a delay of about 3.5 hours. http://avherald.com/h?article=4c64e9b8&opt=0 Back to Top Incident: Expressjet CRJ2 near Dallas on Apr 4th 2019, overheating cockpit displays An Expressjet Canadair CRJ-200 on behalf of United, registration N909EV performing flight UA-4390 from Knoxville,TN to Houston Intercontinental,TX (USA), was enroute at FL320 about 60nm northeast of Dallas Ft. Worth,TX (USA) when the crew decided to divert to Dallas reporting two of their displays in the cockpit had failed. The aircraft landed safely on Ft. Worth's runway 36L about 20 minutes later. Passengers reported the captain announced two of their cockpit displays had failed due to insufficient cooling, there was tremendeous heat behind those screens, if they kept flying they'd lose all screens. They were rebooked onto another flight to Houston. https://flightaware.com/live/flight/UAL4390/history/20190404/2250Z/KTYS/KIAH http://avherald.com/h?article=4c64d9ae&opt=0 Back to Top Back to Top Incident: Austrian DH8D at Innsbruck on Apr 4th 2019, tail strike on landing An Austrian Airlines de Havilland Dash 8-400, registration OE-LGM performing flight OS-903 from Vienna to Innsbruck (Austria), landed on Innsbruck's runway 08 but struck its tail onto the runway. The aircraft rolled out without further incident and taxied to the gate. The return flight was cancelled. The airline confirmed the tail strike commenting the passengers did not become aware of it. Trails were visible on the tail section of the aircraft. At the time of landing there was a strong foehn storm which probably contributed to the occurrence. The aircraft is being examined, the damage is to be assessed. The return flight OS-904 needed to be cancelled, the passengers were rebooked onto other flights. The occurrence aircraft is still on the ground about 31 hours after landing. http://avherald.com/h?article=4c64c3ce&opt=0 Back to Top Boeing 737-8GJ (WL) - Hail Damage (India) Date: 07-APR-2019 Time: c. 09:30 UTC Type: Boeing 737-8GJ (WL) Owner/operator: Spicejet Registration: VT-SGH C/n / msn: 36369/3363 Fatalities: Fatalities: 0 / Occupants: Other fatalities: 0 Aircraft damage: Minor Location: Chennai - India Phase: Approach Nature: Domestic Scheduled Passenger Departure airport: Bagdogra Airport (IXB/VEBD) Destination airport: Chennai Airport (MAA/VOMM) Narrative: Spicejet flight SG462 suffered damage after entering a severe hailstorm on a flight from Bagdogra Airport to Chennai, India. https://aviation-safety.net/wikibase/wiki.php?id=223747 Back to Top Back to Top Back to Top Call for Nominations For 2019 Laura Taber Barbour Air Safety Award ALEXANDRIA, Va. -- The Laura Taber Barbour Air Safety Foundation is now accepting nominations for the 2019 Laura Taber Barbour Air Safety Award, honoring a leader in global aviation safety. The Award will be presented during the 72nd Annual International Air Safety Summit, taking place Nov 4-6 in Taipei, Taiwan. Presented since 1956, the Laura Taber Barbour Air Safety Award recognizes notable achievement in the field of civil or military aviation safety in method, design, invention, study or other improvement. The Award's recipient is selected for a "significant individual or group effort contributing to improving aviation safety, with emphasis on original contributions," and a "significant individual or group effort performed above and beyond normal responsibilities." Mechanics, engineers and others outside of top administrative or research positions should be especially considered. The contribution need not be recent, especially if the nominee has not received adequate recognition. Nominations that were not selected as past winners of the Award can be submitted one additional time for consideration. Please note that self-nominations will not be considered. The Laura Taber Barbour Air Safety Award's story dates back 74 years. On April 14, 1945, after visiting family in Pittsburgh, Laura Taber Barbour was aboard a Pennsylvania Central Airlines DC-3 when it crashed into the rugged terrain of Cheat Mountain near Morgantown, West Virginia. All passengers and crew were killed. In the years following, her husband, Dr. Clifford E. Barbour and son, Clifford E. Barbour, Jr., established the Laura Taber Barbour Air Safety Award in her honor. The Award Board, composed of leaders in the field of aviation, meets each year to conduct a final review of nominees and selection of the current year's recipient. Please help us honor this year's most deserving recipient. Nominations, including a 1-2-page narrative, can be submitted via the Laura Taber Barbour Foundation website at http://ltbaward.org/the-award/nomination-form/. Nominations will be accepted until May 10, 2019. For more information, including a complete history of Award recipients, see www.ltbaward.org. ABOUT THE LAURA TABER BARBOUR AIR SAFETY AWARD: The Award was established in 1956 through early association with the Flight Safety Foundation and from its founding has enjoyed a rich history of Award Board members, nominees and Award recipients. In 2013, the non-profit Laura Taber Barbour Air Safety Foundation was formed from members of the Award Board, the aviation community and the Barbour family. As the foundation plans to broaden the scope of its intent, with great purpose, the Laura Taber Barbour Air Safety Award will continue to spotlight those champions who pioneer breakthroughs in flight safety. CONTACT: Philip Barbour, 205-939-1700, 205-617-9007