Boeing 737 Max MCAS System

198
28
That's if the pilot understood what was going on and hit the "disengage" button. However, you make a valid point that a "disengage autopilot" button is not the same as a "disengage MCAS" button, or a "stop everything automatic you're doing and let me fly the freaking airplane myself" button. It would be worth looking into what information is available about Boeing's system and what overrides are available to the pilot for the latter two cases. (AFAIK Airbus has the first button--which every autopilot has--and the third, which they call "Direct Law" and which disables even automatic stall prevention. I'm not sure what Boeing's equivalent of Direct Law is or whether it would disable MCAS--if there isn't such a switch, I would agree with you that there ought to be.)
This seems like a laymen conclusion, but sometimes the obvious escapes the experts when they are burdened with the abundance of complexities of a system. When I replay what happened in my mind in these flights, not a pilot myself, I imagine the stall and I think, OK we're stalling, we're falling, let's increase thrust, hell let's max out the power of these engines, let's get level and get the heck out of this situation. Perhaps, though simplistic, this is what the pilot wished to do, but the systems and I say plural, system(S), would not allow him to execute such a maneuver. It's evident in our discourse that the flight controls are incredibly complex, and necessarily so but in some use cases, complexity is a burden and the pilot just needs to "fly the plane". I think with all the complexity inherent in these modern aircraft, there should be a standardized, "direct law" lever (not a button), a big lever, that's typically in the same spot, like an emergency break on a car, that allows the pilot to enable the "direct law" control, you allude to. I think every passenger would feel better knowing that such a circumvent exists.
 
Last edited:

fresh_42

Mentor
Insights Author
2018 Award
9,490
6,502
https://www.nytimes.com/2019/03/13/world/africa/boeing-ethiopian-airlines-plane-crash.html
At least two pilots who flew Boeing 737 Max 8 planes on routes in the United States had raised concerns in November about the noses of their planes suddenly dipping after engaging autopilot, according to a federal government database of incident reports.

The problems the pilots experienced appeared similar to those preceding the October crash of Lion Air Flight 610 in Indonesia, in which 189 people were killed. The cause of that crash remains under investigation, but it is believed that inaccurate readings fed into the Max 8’s computerized system may have made the plane enter a sudden, automatic descent.

In both of the American cases, the pilots safely resumed their climbs after turning off autopilot. One of the pilots said the descent began two to three seconds after turning on the automated system.

“I reviewed in my mind our automation setup and flight profile but can’t think of any reason the aircraft would pitch nose down so aggressively,” the pilot wrote.

A pilot on a separate flight reported in November a similar descent and hearing the same warnings in the cockpit, and said neither of the pilots on board was able to find an inappropriate setup.

“With the concerns with the MAX 8 nose down stuff, we both thought it appropriate to bring it to your attention,” the pilot said.

The complaints were listed in a public database maintained by NASA and filled with thousands of reports, which pilots file when they encounter errors or issues. The database does not include identifying information on the flights, including airline, the pilot’s name or the location.

Another pilot wrote of having been given insufficient training to fly the Max 8, a new, more fuel-efficient version of Boeing’s best-selling 737.

“I think it is unconscionable that a manufacturer, the F.A.A., and the airlines would have pilots flying an airplane without adequately training, or even providing available resources and sufficient documentation to understand the highly complex systems that differentiate this aircraft from prior models,” the pilot wrote.

The pilot continued: “I am left to wonder: what else don’t I know? The Flight Manual is inadequate and almost criminally insufficient.”
 
6,112
3,354
When I replay what happened in my mind in these flights, not a pilot myself, I imagine the stall and I think, OK we're stalling, we're falling, let's increase thrust, hell let's max out the power of these engines, let's get level and get the heck out of this situation.
No. No. No. When the plane stalls you must put the nose down to increase airspeed, not get level. As a glider pilot, I'm used to flying at the edge of stall speed for prolonged periods. Adding an engine changes the parameters, but it does not change the basic physics of flight.

It is counter-intuitive at first. If you stall close to the ground, you must immediately push the stick forward to put the nose down. But after training, the counter-intuitive becomes intuitive.
 
23,846
5,796
It seems that if a system like MCAS engages at a higher altitude there is substantial time and altitude to react and correct any error the system may execute by the pilot. The issue as we see in these cases is the system is engaging at mission critical maneuvers like take-off.
Thinking of the system as "engaging" is misleading. The MCAS system is always adjusting the trim in manual flight to compensate for the pitch up moment of the engines. Its purpose is not "spot some particular condition we don't want and adjust to get out of it". Its purpose is "change the way the plane feels to the pilot to make it like previous 737s". If the system were only active part of the time in manual flight mode, the "feel" of the plane would change from one flight regime to another. That would not be good.

I wonder too if there needs to be a better interface between the pilot and the system. A sort of intelligent HUD of sorts that communicates to the pilot exactly what the plane / computer is executing and how to override if need be.
I agree this would be a good idea. I don't know what information Boeing's cockpit communicates currently, but I know that in several previous Airbus incidents, one of the findings of the investigation was that the cockpit information system was not communicating information well to the pilots.

That's again presupposing that an event of total sensor failure could not happen.
No, it isn't. If a total sensor failure happens, the odds of all three sensors agreeing with each other to within the required tolerance are too remote to worry about. The system I've described would see a total sensor failure as all three sensors disagreeing, and would stop believing any of them and light up a big red light in the cockpit that says "automatic systems disabled because of bad sensors", and the pilot would take over.
I am personally less trust worthy in our ability to program all potential use cases into an algorithm that is completely bulletproof for mission critical maneuvers.
It's not a matter of "use cases" not being known; they are known. Remember we're not talking about aerobatics or military flying or recreation; we're talking about commercial airliners flying between known airports on known routes with known flight profiles. That's a much narrower requirement than "be able to deal with anything that could ever be done with an airplane, better than a human does". But the algorithms do require accurate sensor data, so making sure all sensor data is checked for accuracy before acting on it seems like an obvious design requirement.
 
23,846
5,796
When I replay what happened in my mind in these flights, not a pilot myself, I imagine the stall
Then you're imagining wrong. None of these planes stalled. (See further note below.) That's not the problem.

What you should be imagining is the plane doing its normal thing--climbing out after takeoff, or cruising at altitude--and then the automatic system suddenly doing something different--pitching the nose down, or putting in a lot more nose down trim that makes your control effort much greater to keep the plane's nose up--for no reason because of faulty sensor data. That's the problem.

Perhaps, though simplistic, this is what the pilot wished to do, but the systems and I say plural, system(S), would not allow him to execute such a maneuver.
No. That's not what happened. See above.

Note: Here I am talking about the incidents I've described where we know what happened, and where MCAS issues were observed, or where uncommanded pitch down events happened in autopilot. We don't know enough yet about the Ethiopian Airlines incident to know what caused it. With Lion Air I think we know more, but I'm not sure MCAS has been definitely fingered as the only root cause--but we know from the flight profile that "the plane stalled and the automatic system prevented the pilot from recovering properly" is not what happened; the plane wasn't stalled at any point.
 
23,846
5,796
@fresh_42, re post #22, these look like the same group of incidents that were being discussed in the Hacker News thread I linked to. The pilots' comments are very good information.
 

CWatters

Science Advisor
Homework Helper
Gold Member
10,473
2,279
Some thoughts and questions for experts. Please correct me if I have anything wrong. I only ever flew gliders..

1) Inherent stability: Most cambered airfoils have a negative pitching moment (a tendency to pitch the nose down). This is usually countered by a combination of a rearward centre of gravity position and down force on the tail. Problem is down force on the tail creates drag and the wing has to create more lift to compensate which creates more drag. So to improve efficiency and reduce fuel consumption, you ideally want as little downforce on the tail as possible. You can reduce this by moving the centre of gravity further back but that can create stability issues. These stability issues can be fixed using computers.

Q. How far down this path have we gone in passenger aircraft?

2) "The balance of power": On something like a light aircraft pitch trim is effected by a small trim tab, typically much smaller than the elevator. As I understand it most large passenger aircraft have both elevators and a "all moving tail plane" or AMT. Typically the pilot controls pitch via the elevators, trim and flight systems control pitch via the AMT. I understand the AMT has and needs to have quite a large range of movement to cope with different flight configurations (with/without flaps extended for example). In some aircraft if the pilot holds in up elevator flight systems interpret this as an out of trim condition and move the tail to reduce the stick forces the pilot has to apply. I believe this may have been a factor in AF447? In the Lion Air accident MCAS appears to have applied repeated nose down inputs (trim runaway) presumably also via the powerful AMT.

Q. Is anyone else a little uneasy that electronic flight systems have a more powerful control surface (AMT) under their command than the human pilot (Elevator)? I'm sure aircraft designers will say there are systems in place to ensure pilots have full control at all times - but it just feels wrong.
 

Klystron

Gold Member
281
296
[snip] Automation such that it is, if it exceeds the limits of a pilots ability to take over with manual control, leaves us at the whims of software that is at this point not as dependable and rigorous as human experience.[snip]
Crew factors have been a focus for research since the dawn of aviation, indeed one of the founding reasons for NACA, now NASA. Airline flight crews have shrunk over time. For instance Flight Engineers have been replaced by automation and advanced engine designs. Navigators, almost always trained pilots, have been mostly if not entirely replaced on commercial flights by enhanced navigation and communication. Relief pilots and Training pilots ("third seaters") are specific to regulations and airlines but have proved vital in alleviating problems with advice, also available if a pilot becomes incapacitated.

No matter what the cause of the accident, consider the composition of the Ethiopian Airlines crew. Airliner.net reports a 29 year old captain supervising a first officer with ~200 hours flight experience. While a common on-the-job training (OJT) scenario, what happens if the captain is unable to perform?

Managing crew costs are a major economic factor for successful airlines. While analogies with ground transportation are common, even long-haul trucks only have one driver. Transportation unions fight for reasonable hours and relief operators. Autonomous ground vehicles soon followed by surface vessels are rapidly becoming reality. Transport crew sizes have reduced while information to pilots and drivers has increased. As airliner automation improves, two trained pilots may seem economically redundant. Triple redundancy, an important engineering principle, may not have an economical counterpart.
 
198
28
No. No. No. When the plane stalls you must put the nose down to increase airspeed, not get level. As a glider pilot, I'm used to flying at the edge of stall speed for prolonged periods. Adding an engine changes the parameters, but it does not change the basic physics of flight.

It is counter-intuitive at first. If you stall close to the ground, you must immediately push the stick forward to put the nose down. But after training, the counter-intuitive becomes intuitive.
Ahh, right. That makes sense, so you can increase airspeed by pitching down and then increase lift as well.
 
198
28
Thinking of the system as "engaging" is misleading. The MCAS system is always adjusting the trim in manual flight to compensate for the pitch up moment of the engines. Its purpose is not "spot some particular condition we don't want and adjust to get out of it". Its purpose is "change the way the plane feels to the pilot to make it like previous 737s". If the system were only active part of the time in manual flight mode, the "feel" of the plane would change from one flight regime to another. That would not be good.
Right, to clarify, when I say engage, what I mean is the when the MCAS activates erroneously. Such that as we see in the Lionair case, it repeatably tries to pitch down and the pilot fights it trying to climb. My point is that when this system is in error, say during take-off, there very likely is not time to bypass it before the system has pitched the aircraft into an irrecoverable dive. I sounds to me that the MCAS is basically a sub system of the fly-by-wire system, since as you said under manual control it is always active. If that's the case then it looks like we're moving too far from "direct law" with sub systems that make the plane "easier" to fly or more like previous aircraft. It seems that was a very expensive mistake and training for the different flight characteristics would of been a way better direction, irregardless of cost or convenience. I also find it hard to believe that with all the reports we see (including those that didn't result in crashes) it's always a faulty sensor causing MCAS to fail. I think the code should take into account pilot input and altitude. If it detects the pilot is constantly pitching up and the altitude is falling to a dangerously low level, it should automatically shut down without the need for the pilot to deliberately bypass.

I agree this would be a good idea. I don't know what information Boeing's cockpit communicates currently, but I know that in several previous Airbus incidents, one of the findings of the investigation was that the cockpit information system was not communicating information well to the pilots.
It almost sounds like a good fit for an AI. A CGI human face that is reporting to the pilot what the computer is doing at the time. Almost like another member of the flight crew. I was watching some coverage and they said in the one of the reports of the problem the computer was saying "Don't Sink, Don't Sink". If that's true that seems like a pretty ridiculous verbal feedback to a pilot. But maybe I'm wrong and that's following best practices? I mean I would expect that sort of verbiage in a videogame sim. An actual airliner I would expect to say something more specific like, Stall risk, or MCAS pitching down, push to deactivate...etc...

No, it isn't. If a total sensor failure happens, the odds of all three sensors agreeing with each other to within the required tolerance are too remote to worry about. The system I've described would see a total sensor failure as all three sensors disagreeing, and would stop believing any of them and light up a big red light in the cockpit that says "automatic systems disabled because of bad sensors", and the pilot would take over.
Right, I'm still not convinced with all the reports it's always a sensor failure. It could be in the code itself and how it's interpreting that input. Also, "too remote to worry about" sounds like something an engineer might regret stating, but I get your point.

It's not a matter of "use cases" not being known; they are known. Remember we're not talking about aerobatics or military flying or recreation; we're talking about commercial airliners flying between known airports on known routes with known flight profiles. That's a much narrower requirement than "be able to deal with anything that could ever be done with an airplane, better than a human does". But the algorithms do require accurate sensor data, so making sure all sensor data is checked for accuracy before acting on it seems like an obvious design requirement.
I see your point. I do still think you're underestimating the variables and complexity of landing and take-off, weather, unsecured cargo load, possible mechanical failure all with aerodynamically unstable vehicles that need MCAS like systems.
 
Last edited:
198
28
Note: Here I am talking about the incidents I've described where we know what happened, and where MCAS issues were observed, or where uncommanded pitch down events happened in autopilot. We don't know enough yet about the Ethiopian Airlines incident to know what caused it. With Lion Air I think we know more, but I'm not sure MCAS has been definitely fingered as the only root cause--but we know from the flight profile that "the plane stalled and the automatic system prevented the pilot from recovering properly" is not what happened; the plane wasn't stalled at any point.
Right, I'm getting confused with how the MCAS is trying to prevent a stall and what's actually happening is that there is no risk of stall and instead there's basically a battle between the MCAS input and the pilot input, where unfortunately the MCAS prevailed.
 
198
28
Q. Is anyone else a little uneasy that electronic flight systems have a more powerful control surface (AMT) under their command than the human pilot (Elevator)? I'm sure aircraft designers will say there are systems in place to ensure pilots have full control at all times - but it just feels wrong.
To confirm, are you saying there is a mechanical device, AMT, that controls pitch which the pilot has no control over?
 
198
28
Crew factors have been a focus for research since the dawn of aviation, indeed one of the founding reasons for NACA, now NASA. Airline flight crews have shrunk over time. For instance Flight Engineers have been replaced by automation and advanced engine designs. Navigators, almost always trained pilots, have been mostly if not entirely replaced on commercial flights by enhanced navigation and communication. Relief pilots and Training pilots ("third seaters") are specific to regulations and airlines but have proved vital in alleviating problems with advice, also available if a pilot becomes incapacitated.

No matter what the cause of the accident, consider the composition of the Ethiopian Airlines crew. Airliner.net reports a 29 year old captain supervising a first officer with ~200 hours flight experience. While a common on-the-job training (OJT) scenario, what happens if the captain is unable to perform?

Managing crew costs are a major economic factor for successful airlines. While analogies with ground transportation are common, even long-haul trucks only have one driver. Transportation unions fight for reasonable hours and relief operators. Autonomous ground vehicles soon followed by surface vessels are rapidly becoming reality. Transport crew sizes have reduced while information to pilots and drivers has increased. As airliner automation improves, two trained pilots may seem economically redundant. Triple redundancy, an important engineering principle, may not have an economical counterpart.
Very interesting. I for one would pay more for a ticket from an airline that embraces human redundancy and a little over-engineering in the name of robustness and safety.
 
6,112
3,354
In this thread alone there seems to be different opinions about failures of AOA sensors in the Lion Air Crash.

Had anybody seen claims of sensor failure on Lion Air that are based on the FDR data rather than speculation by journalists?
 
198
28
In this thread alone there seems to be different opinions about failures of AOA sensors in the Lion Air Crash.

Had anybody seen claims of sensor failure on Lion Air that are based on the FDR data rather than speculation by journalists?
I have not seen the data but on a press conference a ministry of transportation safety or something stated that in the Lion Air case, the MCAS was in error due to a faulty AOA sensor. As I understand the investigation may still be ongoing however.
 
198
28
In this thread alone there seems to be different opinions about failures of AOA sensors in the Lion Air Crash.

Had anybody seen claims of sensor failure on Lion Air that are based on the FDR data rather than speculation by journalists?
Even if the AOA sensor was the cause in the Lion air case, it seems hard to believe that all reported problems with the MCAS is due to sensor failure. For example like the article referenced earlier:
See heading: Pilots on U.S. routes had reported concerns about the Max 8
 
23,846
5,796
The more I read about these reports the more I'm less inclined to believe it's always a faulty sensor. I think there is a much deeper flaw in the design of the MCAS system.
You have to be careful to distinguish MCAS issues from autopilot issues. The reports referenced in the NY Times article were about uncommanded pitch down events with autopilot engaged. That's not an MCAS issue. Based on the similarity with the Airbus incidents of uncommanded pitch down, I suspect those autopilot incidents were due to faulty AoA sensor data not being spotted as faulty. But it's true that, since those pilot reports have not been investigated to pin down a root cause, we don't know that for sure. It's possible that your suspicions about other flaws somewhere in the automated systems are correct.
 
23,846
5,796
I'm getting confused with how the MCAS is trying to prevent a stall
It's not. Again, there are different automated functions involved that it's important to keep distinguished. We've talked about three of them in this thread:

(1) Autopilot, which basically means getting the plane to a desired altitude, airspeed, and heading and keeping it there. This includes climb to cruise altitude, cruise, and descend to landing.

(2) Automatic stall prevention, which means detecting when the angle of attack is too high and automatically pitching the nose down.

(3) MCAS, which is a manual system designed to constantly input some amount of nose down trim to make the 737 MAX feel to the pilot like previous 737 models.

All three of these functions rely on accurate AoA sensor data, but the functions themselves are separate and are there for different purposes.
 
198
28
It's not. Again, there are different automated functions involved that it's important to keep distinguished. We've talked about three of them in this thread:

(1) Autopilot, which basically means getting the plane to a desired altitude, airspeed, and heading and keeping it there. This includes climb to cruise altitude, cruise, and descend to landing.

(2) Automatic stall prevention, which means detecting when the angle of attack is too high and automatically pitching the nose down.

(3) MCAS, which is a manual system designed to constantly input some amount of nose down trim to make the 737 MAX feel to the pilot like previous 737 models.

All three of these functions rely on accurate AoA sensor data, but the functions themselves are separate and are there for different purposes.
Right, that helps. Thank you for that clarification. I was conflating 2 and 3.

It does seem that MCAS pulls the nose down if the AOA is too high, thereby preventing a stall. So doesn't MCAS overlap with stall prevention in that way?
 

Want to reply to this thread?

"Boeing 737 Max MCAS System" You must log in or register to reply here.

Physics Forums Values

We Value Quality
• Topics based on mainstream science
• Proper English grammar and spelling
We Value Civility
• Positive and compassionate attitudes
• Patience while debating
We Value Productivity
• Disciplined to remain on-topic
• Recognition of own weaknesses
• Solo and co-op problem solving

Top Threads

Top