Boeing How Safe is the Boeing 737 Max's MCAS System?

[cyboman]

A heck of a lot of engineering goes into these systems and I'm sure engineers will say they have thought of all the failure modes and have written procedures for pilots to follow, but when accidents happen we scratch our heads and wonder why the pilots didn't do x or y. Perhaps things are just too complicated?

I think this alludes to the somewhat fuzzy line between these control systems which are computer aided, due to forces required / hydraulics and in turn for force feedback compared to pure fly-by-wire systems. I would suggest the more complex the computer intermediary in the control systems, the closer it is becoming fly-by-wire. Add an autopilot and more complex systems like MCAS (that in this case pilots are not even aware of) and the line is quite blurry indeed.

 

[cyboman]

A very interesting article by a pilot giving good details on not just the 737 MAX MCAS system but the more general subject of automated trim adjustments, how a plane feels to the pilot, certification requirements for systems, and the impact of fly-by-wire systems on all this:

https://airfactsjournal.com/2019/03/can-boeing-trust-pilots/

Note: AFAIK the 737 series as a whole does not have fly-by-wire (FBW). However, MCAS on the 737 MAX introduces some of the issues of FBW by automating the trim adjustment, which makes what is said about FBW in this article relevant to the MCAS discussion.

This was a fascinating article. A pilot in the comment section notes that the articles concise description of MCAS is good: "That pitches the nose down and gives the pilot the stick force to know that he is pulling too close to the stall margin." So it does seem MCAS is closely related to protecting the plane from entering a stall scenario.

The pilot goes on with an interesting comment: "Boeing contends that the standard runaway stabilizer trim procedure is valid; this is not entirely true, since the first step in that procedure is to firmly oppose the control column forces, using the column cutout switches to disable the runaway. However, all of us flying the bird know exactly where the master trim cutout switches are, and I guarantee that at the first indication of an MCAS malfunction, those switches will be shut off in a nanosecond."

It seems here that there is no clear way to clear way to disable the MCAS in the event of a failure. Am I reading this right?

 

[cyboman]

You can see the AMT feature and separate elevators in this photo from Google Images...

https://upload.wikimedia.org/wikipedia/commons/3/3a/Qantas_Boeing_737-800_Registration_on_tail.jpg

View attachment 240254

Is the AMT what looks like flaps on the elevators?

 

[anorlunda]

I think this is a very important debate regarding human machine interaction. But I hate conducting it while the actual causes of these accidents are speculative.

Think how foolish all this talk will sound if the final report cites a cause that has nothing to do with MCAS or trim or handling or FBW or autopilot. It reminds me of TWA 800.

 

[cyboman]

I was researching a bit about AI and commercial flight, thinking about the lack of a good interface / verbal / visual feedback to the pilot from MCAS or other systems.
There is an interesting article I came across by wired here: https://www.wired.com/2017/03/ai-wields-power-make-flying-safer-maybe-even-pleasant/

Autopilots ace basic piloting tasks in non-emergency conditions, but outside the straight and level stuff, they suffer.

It seems existing autopilots are fairly limited in the scenarios they can deal with and engineers are looking to AI to build better more robust systems.

My interest however as I alluded to earlier in the thread, is less in making a better autopilot or smarter automated systems, which of course is a necessary development. But instead in AI taking a role in communicating to the pilot the current status of the vehicle, both in a emergency and non-emergency scenarios. This would help ease the information overload burden on the pilot, especially as more and more complex systems are added to the airplane like MCAS. The article seems to suggest this somewhat:

Baomar wants to build an AI-based autopilot that can respond reliably and correctly to whatever's happening, while ensuring the human in the cockpit knows what’s going on.

It closes on this point, which seems relevant to our thread:

Assuming these systems someday clear those regulatory hurdles and roll out to commercial airlines, they could provide a stepping stone between the eras of human pilots and what comes next. The days of stick-and-rudder piloting are rapidly fading as cockpit automation ramps up, and the benefits of flying absent the threat of human fallibility might prove too appealing to resist.

But getting there is half the battle, and the in-between period, with some automation going on and some manual control, will need to be deftly controlled to ensure that pilots can still manage their aircraft well. AI could prove invaluable to plugging that gap.

 

[cyboman]

I think this is a very important debate regarding human machine interaction. But I hate conducting it while the actual causes of these accidents are speculative.

Think how foolish all this talk will sound if the final report cites a cause that has nothing to do with MCAS or trim or handling or FBW or autopilot. It reminds me of TWA 800.

I think no matter how both investigations come out, the discussions we are having in this thread will still be very relevant. The overwhelming thesis of this thread is the dynamic between the automated systems and how those are communicated to the pilot, both during flight in feedback and made aware to the pilot via training or accurate bulletins before flight. Further, the ability for the pilot to circumvent these systems easily and whether or not that is continuing to be feasible as these aircraft become more and more dependent on autonomous or fly-by-wire systems. I think those issues are very relevant even if MCAS wasn't at fault.

 

[berkeman]

Is the AMT what looks like flaps on the elevators?

No. The AMT is the whole horizontal tail airfoil. There is an axle that runs down the middle of the airfoil from the plane fuselage to the tip of the tail airfoil, and if you look at the leading edge of the tail airfoil there is a slot in the fuselage for the moving front support. You can see marks painted on the fuselage at the leading edge showing three AMT angles (probably nominal, max up and max down).

 

[anorlunda]

I think those issues are very relevant even if MCAS wasn't at fault.

I agree with that. I just prefer to see them in a thread that is not linked to a recent accident.

 

[berkeman]

The AMT is the whole horizontal tail airfoil.

Check out this video. You can see the AMT on these F-14 fighter aircraft during takeoff and landings and other maneuvers. See the land-based takeoff at the beginning of the video, and the carrier launches at 3:00, and the carrier landing at 0:55. Feel free to enjoy the rest of the video as well...

 

[cyboman]

Check out this video. You can see the AMT on these F-14 fighter aircraft during takeoff and landings and other maneuvers. See the land-based takeoff at the beginning of the video, and the carrier launches at 3:00, and the carrier landing at 0:55. Feel free to enjoy the rest of the video as well...

Weird, I just watched this movie for the first time a few days ago. A little cheesy and definitely a Navy recruitment video in some ways, but it has some really amazing flight and carrier footage and a neat sci-fi premise.

I see the AMT fluctuating at 0.55. Is that under computer control or is that the pilot or a mixture?

 

[cyboman]

I agree with that. I just prefer to see them in a thread that is not linked to a recent accident.

I understand your sentiment. Let's keep in mind that while the incidents raise these concerns and inquiries, they are not closed cases, and while there is some compelling initial evidence that implies there is something wrong with the plane, it's definitely not conclusive. Whether the aircraft is at fault or not, no one should be prematurely assigning any culpability.

 

[cyboman]

All 737 Max grounded !

Looks like something nasty has shown up in the flight data...

Truly, advances in safety are too-often bought in blood...

To clarify, I don't think it was the data from the FDR. It seems unclear whether the FAA did this from public pressure and optics or it is in fact from the same data Canada received about the plane altitude during the flight via satellite. The odd thing to me is that I saw the graphs for the erratic rate of decent and climb almost immediately after the crash, which would show the similarity to Lion Air. Perhaps the satellite data confirmed this previous early data or perhaps indeed it was more about optics.

 

[PeterDonis]

Is that under computer control or is that the pilot or a mixture?

On the F-14 that would be pilot control. The F-14 never got any kind of fly-by-wire. They're all out of service now; I believe the F/A-18, which is the Navy's main jet aircraft now, does have some fly-by-wire controls with computer software involved.

 

[PeterDonis]

It seems here that there is no clear way to clear way to disable the MCAS in the event of a failure. Am I reading this right?

Not as far as I know. As I understand it, the "master trim cutout switch" referred to disables all automatic trim control, including MCAS. What the pilot is saying is that, now that pilots know about the risks involved with MCAS, at the first sign of any anomaly, instead of going through the steps Boeing says, which they don't trust to actually be effective, they're just going to disable automatic trim control entirely and adjust it by hand, since that way they know what they're dealing with.

 

[cyboman]

All 737 Max grounded !

Looks like something nasty has shown up in the flight data...

Truly, advances in safety are too-often bought in blood...

It looks like indeed the early information was radar / land based. The new information that lead to Canada and then the FAA grounding the plane was from satellite data from Aireon. Not sure why the early radar data wasn't enough when other authorities felt it was, probably multiple factors involved, but it's safe to say it doesn't look good on Canada or the FAA to not lead on this.

 

[PeterDonis]

t does seem MCAS is closely related to protecting the plane from entering a stall scenario.

Only in the sense that it is giving the pilots the feedback, through the stick force, about how close the plane is to a stall, that the pilots are used to from previous 737 models. The point of MCAS is that without it, the stick force feedback as a function of angle of attack would be different from what the pilots were used to, so they might misjudge how close to a stall they were.

 

[cyboman]

Only in the sense that it is giving the pilot the feedfback

Is it not also adjusting the pitch in addition to providing feedback?

 

[PeterDonis]

Is it not also adjusting the pitch in addition to providing feedback?

They aren't two separate things. Giving the feedback means adding more nose down trim, which, if the pilot does not compensate by increasing the force he uses on the yoke, will pitch the nose down. Any adjustment of trim does the same thing: it changes the force the pilot needs to exert on the yoke to maintain a particular pitch attitude.

 

[cyboman]

Not as far as I know. As I understand it, the "master trim cutout switch" referred to disables all automatic trim control, including MCAS. What the pilot is saying is that, now that pilots know about the risks involved with MCAS, at the first sign of any anomaly, instead of going through the steps Boeing says, which they don't trust to actually be effective, they're just going to disable automatic trim control entirely and adjust it by hand, since that way they know what they're dealing with.

This is somewhat confusing. The pilot commenting also says:

Second, for obvious reasons, the control column cutout switches do not disable MCAS, which is different from a runaway stabilizer. In that case, simply opposing the control column force kills the trim motor. There wouldn’t be much point in having the MCAS if the control column switches could disable it.

Is he not implying that MCAS is not effected by the bypass cutouts? When he says "trim motor" is he saying that if the pilot opposes the force by pulling on the yoke it disables MCAS? This seems like it couldn't of been the case looking at what we know from the flight data available. It's pretty clear the pilots were fighting against the pitch down maneuvering by the computer. And we see MCAS continuing to pitch down in spite of continued pilot input.

 

[cyboman]

They aren't two separate things. Giving the feedback means adding more nose down trim, which, if the pilot does not compensate by increasing the force he uses on the yoke, will pitch the nose down. Any adjustment of trim does the same thing: it changes the force the pilot needs to exert on the yoke to maintain a particular pitch attitude.

Wait but then are they not indeed completely correlated and not separate? MCAS adding more nose down trim provides the feedback and also literally is pitching the nose down. It provides feedback, but it also effects the actual pitch / attitude of the plane.

 

[PeterDonis]

Is he not implying that MCAS is not effected by the bypass cutouts?

Hm, you're right, that is confusing. I think we probably would need to have the specifications of the trim control and adjustment system to know for sure.

 

[PeterDonis]

MCAS adding more nose down trim provides the feedback regardless of whether the pilot changes the force he's exerting on the yoke or not and also literally is pitching the nose down if the pilot does not change the force he's exerting on the yoke.

See the bolded statements I added. (And note that they apply for any method of adjusting the trim, not just MCAS. The same things would be true if the pilot manually added nose down trim using the trim wheel, or whatever manual trim adjustment system the aircraft has.)

 

[cyboman]

See the bolded statements I added. (And note that they apply for any method of adjusting the trim, not just MCAS. The same things would be true if the pilot manually added nose down trim using the trim wheel, or whatever manual trim adjustment system the aircraft has.)

OK, but isn't it safe to say that in these cases, the pilot would see the plane pitching down and indeed, exerted force on the yoke to correct it? In which case the MCAS should of disabled / trim motor. And perhaps it did, but the faulty sensor or perhaps some other error may have allowed the system to execute the pitch down trim again and again?

 

[cyboman]

Hm, you're right, that is confusing. I think we probably would need to have the specifications of the trim control and adjustment system to know for sure.

Is this helpful? http://www.b737.org.uk/mcas.htm

 

[PeterDonis]

isn't it safe to say that in these cases, the pilot would see the plane pitching down and indeed, exerted force on the yoke to correct it?

Not under normal conditions. Under normal conditions, the pilot would feel the feedback and increase the force he exerts on the yoke before there was time for the plane to pitch down. The feedback is a continuous process; it's not a series of discrete events. Under normal conditions, the pilot expects the feedback force to increase as angle of attack increases, so if he wants to pitch the plane up, he will be automatically adjusting the force he exerts on the yoke based on the feedback he expects to receive. The increase in the feedback force as the plane gets near a stall is what he would expect; the fact that it's the MCAS causing it, because he's flying a 737 MAX, instead of the natural pitch moment of an older 737, doesn't make a difference in what he feels or what he does, under normal operation.

This assumes, though, that the system is working properly and has accurate sensor data. The difference with MCAS is what failure modes the system has: if MCAS goes wrong because of faulty sensor data, it could suddenly dial in a large nose down trim while the plane is flying level, or climbing at a constant rate at a stable pitch attitude, when the pilot does not expect any sharp change in the feedback force. Under those conditions, yes, the plane would pitch down, because the pilot would not be expecting the change and wouldn't be adjusting the force he exerts on the yoke to compensate. And "adjusting the feedback force" isn't really a good description of what the MCAS is doing under this failure condition, because the plane's pitch attitude is not actually changing, so the feedback force should not be changing either.

 

[berkeman]

or a mixture?

Fly-by-wire plus some enhancement by the computer probably.

For example, as I understand it, in launch mode off a carrier, fighter jets are put into an automatic launch mode, where the computer flys the jet for the first few seconds. That's because the g-forces from the launch can possibly compromise the pilot's ability to control the takeoff well. In-cockpit videos often show the pilot grabbing onto handles near the baseline of the canopy for the launches.

So in general, fly-by-wire computers take the pilots' inputs and process them to best control the aircraft. Some advanced aircraft are too unstable to control with just human control (not commercial aircraft).

 

[PeterDonis]

Is this helpful?

This says "Using electric pitch trim will only pause MCAS, to deactivate it you need to switch off the STAB TRIM SUTOUT switches." This seems to indicate that the cutout switch the pilot comment we were discussing referred to does disable MCAS.

 

[berkeman]

OK, but isn't it safe to say that in these cases, the pilot would see the plane pitching down and indeed, exerted force on the yoke to correct it?

"See" it how? What if they are climbing out through clouds, and there is no visible horizon? What do pilots use to keep their situational awareness (SA or Sierra Alpha) with no visible horizon?

https://upload.wikimedia.org/wikipe..._Horizon.jpg/184px-VMS_Artificial_Horizon.jpg

 

[cyboman]

This says "Using electric pitch trim will only pause MCAS, to deactivate it you need to switch off the STAB TRIM SUTOUT switches." This seems to indicate that the cutout switch the pilot comment we were discussing referred to does disable MCAS.

Right, it also has a note underneath that that says, "High control forces may be needed to correct any stabilizer nose down trim already applied." Then it says to use electronic trim control to correct it first, then cutout, then manual can be used after.

This sounds ridiculously cumbersome in the event of the MCAS operating in error, where the plane can literally be in a dive at fast airspeed. Really I think what we're going to see is a complete revamp of the MCAS system if it can even be redesigned effectively.

In fact this is alluded to in the March 11, Continued Airworthiness Notification to the International Community (CANIC):

Reviewed Boeing’s production processes related to the AOA vane and Maneuvering Characteristics Augmentation System (MCAS)

Ongoing oversight activities by the FAA include:

- Boeing’s completion of the flight control system enhancements, which provide reduced reliance on procedures associated with required pilot memory items. The FAA anticipates mandating these design changes by AD no later than April 2019.

- Design changes include:

 MCAS Activation Enhancements
 MCAS AOA Signal Enhancements
 MCAS Maximum Command Limit

The last design change is something I suggested along with the minimum altitude threshold, basically that if the pilot is continually pitching upward and MCAS keeps sending a pitch down command it should be smart enough to know something is wrong. Hence "MCAS Maximum Command Limit"

It may be the design of the MAX 8 was so aggressive to save on fuel that software or MCAS can't reliably create safe dependable flight controls in all scenarios. For Boeing sake, hopefully that's not the case. But given their revenue yearly, it's a cost they could afford and recover from.

 

[cyboman]

"See" it how? What if they are climbing out through clouds, and there is no visible horizon? What do pilots use to keep their situational awareness (SA or Sierra Alpha) with no visible horizon?

https://upload.wikimedia.org/wikipe..._Horizon.jpg/184px-VMS_Artificial_Horizon.jpg

View attachment 240271

Right, that's the wrong verbiage. A better term would be "determine".

Yes, I imagine that is a very mission critical instrument to a pilot. Not many failure modes for that sucker I imagine.

 

[Tom.G]

Here are a couple excerpts from the Los Angeles Times newspaper published Thur. Mar 14, 2019, FAA relents, grounds 737Max planes, pg1 continued on pg5. These excerpts are from pg5. I couldn't find the article online, hence no link given.

Referring to the grounding of the 737 Max.
Daniel K. Elwell, acting administrator of the FAA, told CNBC that the decision was made based on enhanced satellite data that showed the track of the Ethiopian Airlines flight was "very close" to that of the Lion Air 737 Max flight that crashed off Indonesia in October.
"We don't make decisions about grounding aircraft... without actionable data. In this case the actionable data did not arrive until today."

Initial data about the Ethiopian Airlines flight were "very incomplete" and "raw" he said. The flight took place in an area that is not served by radar, so the FAA used satellite data that had to be enhanced.
...
The FAA is now awaiting data from the black box of the Ethiopian Airlines plane as the agency decides how long to keep the 737 Max airliners grounded.

 

[cyboman]

The flight took place in an area that is not served by radar, so the FAA used satellite data that had to be enhanced.

Interesting, I don't think this statement is accurate. As I posted earlier with the youtube link from CBC, they said initial flight data was from ground radar.

 

[Tom.G]

And excerpts from the New york Times. https://www.nytimes.com/2019/03/14/world/boeing-737-max-ethiopian-airlines.html


Pilots were abuzz over publicly available radar data that showed the aircraft had accelerated far beyond what is considered standard practice, for reasons that remain unclear.

“The thing that is most abnormal is the speed,” said John Cox, an aviation safety consultant and former 737 pilot.

“The speed is very high,” said Mr. Cox, a former executive air safety chairman of the Air Line Pilots Association in the United States. “The question is why. The plane accelerates far faster than it should.”
...
Flight 302 was just three minutes into its flight, the person said, and appeared to have accelerated to even higher speeds, well beyond its safety limits.


The article also shows a map indicating that radar visibility was available only for the first half of the flight, about three minutes.

 

[cyboman]

And excerpts from the New york Times. https://www.nytimes.com/2019/03/14/world/boeing-737-max-ethiopian-airlines.html


Pilots were abuzz over publicly available radar data that showed the aircraft had accelerated far beyond what is considered standard practice, for reasons that remain unclear.

“The thing that is most abnormal is the speed,” said John Cox, an aviation safety consultant and former 737 pilot.

“The speed is very high,” said Mr. Cox, a former executive air safety chairman of the Air Line Pilots Association in the United States. “The question is why. The plane accelerates far faster than it should.”
...
Flight 302 was just three minutes into its flight, the person said, and appeared to have accelerated to even higher speeds, well beyond its safety limits.


The article also shows a map indicating that radar visibility was available only for the first half of the flight, about three minutes.

Ahh I see so the satellite looks like it filled in the 3 minute gap. Still it is inaccurate for the FAA to say the flight took place where there was no radar available, it just wasn't for the final 3 minutes of the flight.

This is from 4 days ago: https://www.theguardian.com/world/2...ght-et302-visual-guide-to-what-we-know-so-far

The graph shows unstable vertical airspeed, much like Lion air. This is likely what had other authorities ground the planes before the FAA.

 

[cyboman]

Reading here: https://www.washingtonpost.com/worl...-common/?noredirect=on&utm_term=.10ad37d7d68b

The initial findings from the preliminary Aircraft Accident Investigation Report on the Lion Airflight 610 crash states that the AoA sensor was replaced and tested on October 28th. That's a day before the fatal flight. That means the sensor failed a day after being replaced. That seems like a pretty high failure rate, especially if we trust that it was indeed tested as stated. Is that not extremely unlikely for the AoA sensor to fail after one day of use? Unfortunately, they didn't test the sensor the next day. Likely because it was just replaced.

“Black-box data released by Indonesian investigators showed that the pilots were pulling back on the control column, attempting to raise the plane’s nose, with almost 100 pounds of pressure before they crashed,” The Post reported.

That sounds incredible, I suppose it was both pilots pulling on their yokes together as hard as they could. I read elsewhere that in the Lion Air flight the MCAS (allegedly) pitched the nose down 26 times during the climb.

 

[cyboman]

And excerpts from the New york Times. https://www.nytimes.com/2019/03/14/world/boeing-737-max-ethiopian-airlines.html


Pilots were abuzz over publicly available radar data that showed the aircraft had accelerated far beyond what is considered standard practice, for reasons that remain unclear.

“The thing that is most abnormal is the speed,” said John Cox, an aviation safety consultant and former 737 pilot.

“The speed is very high,” said Mr. Cox, a former executive air safety chairman of the Air Line Pilots Association in the United States. “The question is why. The plane accelerates far faster than it should.”
...
Flight 302 was just three minutes into its flight, the person said, and appeared to have accelerated to even higher speeds, well beyond its safety limits.


The article also shows a map indicating that radar visibility was available only for the first half of the flight, about three minutes.

I'm going to hypothesize that the high air speed was due to repeated pitching down maneuvers. As the pilot struggled to regain control of the plane I would guess he was more concerned with the negative pitch attitude pointing the plane into the ground rather than correcting the air speed. Keep in mind this is all happening within a few minutes.

 

[cyboman]

On another note, why would the MCAS only look at the AoA sensor when performing such a flight critical control correction?

Should it not be comparing attitude pitch or artificial horizon data as well? If it did, it surely would be able to calculate that the AoA sensor is in error.

 

[jim hardy]

reading those pilot's reports at ycombinator that Peter Donis linked in post# 2

i note randmoness in just when this occurs
and pilots report it happens with autopilot ON , and to my understanding MACS is supposed to be OFF when on autopilot.

https://news.ycombinator.com/item?id=19373707

ACN: 1597286

"Day 3 of 3 departing in a MAX 8 after a long overnight. I was well rested and had discussed the recent MAX 8 MCAS guidance with the Captain. On departure, we had strong crosswinds (gusts > 30 knots) directly off the right wing, however, no LLWS or Micro-burst activity was reported at the field. After verifying LNAV, selecting gear and flaps up, I set "UP" speed. The aircraft accelerated normally and the Captain engaged the "A" autopilot after reaching set speed. Within two to three seconds the aircraft pitched nose down bringing the VSI to approximately 1,200 to 1,500 FPM. I called "descending" just prior to the GPWS sounding "don't sink, don't sink." The Captain immediately disconnected the autopilot and pitched into a climb. The remainder of the flight was uneventful. We discussed the departure at length and I reviewed in my mind our automation setup and flight profile but can't think of any reason the aircraft would pitch nose down so aggressively."

ACN: 1597380

"It was day three of six for me and day three with very good FO (First Officer). Well rested, great rapport and above average Crew coordination. Knew we had a MAX. It was my leg, normal Ops Brief, plus I briefed our concerns with the MAX issues, bulletin, MCAS, stab trim cutout response etc. I mentioned I would engage autopilot sooner than usual (I generally hand fly to at least above 10,000 ft.) to remove the possible MCAS threat.

Weather was about 1000 OVC drizzle, temperature dropping and an occasional snow flake. I double checked with an additional personal walkaround just prior to push; a few drops of water on the aircraft but clean aircraft, no deice required. Strong crosswind and I asked Tug Driver to push a little more tail east so as not to have slow/hung start gusts 30+.

Wind and mechanical turbulence was noted. Careful engine warm times, normal flaps 5 takeoff in strong (appeared almost direct) crosswind. Departure was normal. Takeoff and climb in light to moderate turbulence. After flaps 1 to "up" and above clean "MASI up speed" with LNAV engaged I looked at and engaged A Autopilot. As I was returning to my PFD (Primary Flight Display) PM (Pilot Monitoring) called "DESCENDING" followed by almost an immediate: "DONT SINK DONT SINK!"

I immediately disconnected AP (Autopilot) (it WAS engaged as we got full horn etc.) and resumed climb. Now, I would generally assume it was my automation error, i.e., aircraft was trying to acquire a miss-commanded speed/no autothrottles, crossing restriction etc., but frankly neither of us could find an inappropriate setup error (not to say there wasn't one).

With the concerns with the MAX 8 nose down stuff, we both thought it appropriate to bring it to your attention. We discussed issue at length over the course of the return to ZZZ. Best guess from me is airspeed fluctuation due to mechanical shear/frontal passage that overwhelmed automation temporarily or something incorrectly setup in MCP (Mode Control Panel). PM's callout on "descending" was particularly quick and welcome as I was just coming back to my display after looking away. System and procedures coupled with CRM (Resource Management) trapped and mitigated issue."

my guess is some little software routine is not re-entrant and occasionally corrupts a global variable someplace
that's only a guess... my only basis is the randomness of the occurrence. It just looks like software to me.

Time will tell.

old jim

 

[jrmichler]

Here's some more information: http://knkt.dephub.go.id/knkt/ntsc_aviation/baru/pre/2018/2018 - 035 - PK-LQP Preliminary Report.pdf.

 

[jedishrfu]

Example:
Air France 447 crashed because the flying pilot held full back-pressure on the control stick and stalled the plane from cruise until it hit the ocean about 4 minutes later. The flight control system had a stall-prevention system, but it was receiving faulty airspeed indication, so it disconnected that feature. It's difficult to know what the pilot was thinking, but it is possible he didn't realize it was possible to stall the plane.

NOVA did an excellent documentary on this crash. It shows how terribly wrong things can go with extreme weather conditions, failed sensors and reliance on too much automation.

 

[Klystron]

NOVA did an excellent documentary on this crash. It shows how terribly wrong things can go with extreme weather conditions, failed sensors and reliance on too much automation.

Very instructive video that emphasizes several important issues:

• crew members received multiple warning messages and erroneous data contributing to
  
• missed accurate readings such as engine power readouts.
• limitations of on-board weather radar and traffic avoidance systems.
• stall defined as interrupted smooth air flow on wing surfaces leading to loss of lift.
• air speed must be maintained in a critical envelope, neither too fast nor too slow.

Noticed an interesting crew factor during the simulated flight. The Nova narrator mentions throttle control several times after the pitot failure but neither pilot manages or handles the A-330 throttle levers or adjusts the automatic throttle (ATS) after the message cascade until later.

Notice also the lack of visual horizon at night; indeed any visual cues except for instruments.

 

[Andrew Mason]

NOVA did an excellent documentary on this crash. It shows how terribly wrong things can go with extreme weather conditions, failed sensors and reliance on too much automation.

The NOVA documentary was made before they recovered the cockpit voice recorder and flight data recorder from the bottom of the Atlantic. The Mayday episode on this crash was made after recovery of the CVR and FDR and is much more interesting because it is able to tell us what was happening in the cockpit.

AF 447 problem started with frozen pitot tubes that gave false speed readings, making the pilots think the plane was going too fast, so they kept trying to throttle back and put the nose up. This led to a stall and the plane stopped flying and fell into the ocean. The pilot had been sleeping and it took some time before they could get him into the cockpit. When he arrived, they were already in a stall but no one seemed to realize it (despite the "stall, stall" warnings all around). They still thought they were going too fast. If the Boeing MCAS system uses speed indicators to determine whether the air craft is about to stall, which it would seem it must do, it is possible that there could be a connection to incorrect speed input and the recent 737 8x crashes. But they seem quite different. AF 447 was a high altitude stall long after take-off that pilots did not realize was happening. The recent crashes appear to be low altitude stalls soon after take-off.

AM

 

[PeterDonis]

If the Boeing MCAS system uses speed indicators to determine whether the air craft is about to stall, which it would seem it must do

It uses angle of attack indicators, which are not pitot tubes like airspeed indicators, they are vanes that sense the direction of the relative wind. The failure modes of AoA indicators appear to be different from those of airspeed indicators.

 

[PeterDonis]

The recent crashes appear to be low altitude stalls

It does not appear that the planes in the recent crashes were stalled at any point; the airspeed was if anything too high, not too low. But erroneous AoA sensor input could have made the MCAS think the plane was stalling when it wasn't.

 

[Andrew Mason]

It uses angle of attack indicators, which are not pitot tubes like airspeed indicators, they are vanes that sense the direction of the relative wind. The failure modes of AoA indicators appear to be different from those of airspeed indicators.

I don't understand is how stall detection can be based only on angle of attack. A low speed and low angle of attack can still result in a stall. A high speed steep climb can be perfectly ok.

AM

 

[PeterDonis]

I don't understand is how stall detection can be based only on angle of attack.

The MCAS is not doing stall detection. It's adjusting nose down trim based on angle of attack to compensate for the new engines. This has already been discussed in multiple posts in this thread.

 

[Klystron]

The NOVA documentary was made before they recovered the cockpit voice recorder and flight data recorder from the bottom of the Atlantic.

Still the Nova team analysis was very accurate. Perhaps the only contradiction from the CVR was that the Air France crew saw the larger storm but decided not to divert around it. With less data Nova kindly suggested the larger storm could have been concealed.

The Mayday episode on this crash was made after recovery of the CVR and FDR and is much more interesting because it is able to tell us what was happening in the cockpit.

Concur. The voice playback is compelling while the data confirms most of the Nova suppositions gleaned from the wreckage. While highly emotional, I question the value of repeatedly showing photos and family testimonials of crew members, how they met in San Francisco, vacationed in Rio, and expired tragically. Otherwise, Mayday raises interesting questions of why the captain leaves the flight deck for sleep break after entering the storm and why the first officer keeps the right side stick controller pulled back despite numerous stall warnings.

To paraphrase the final line of the Nova documentary "The aircraft flight safety community deplores mysteries.".

 

[russ_watters]

I don't understand is how stall detection can be based only on angle of attack. A low speed and low angle of attack can still result in a stall. A high speed steep climb can be perfectly ok.

No. Angle of attack is the *only* direct contributor to a stall. In light planes, the stall warning horn is literally an acoustic horn attached to the leading edge of the wing. It only responds to high aoa, which causes the horn to sound when airflow is interrupted because air is hitting the leading edge at the wrong angle.

By your description, you may be confusing aoa and pitch angle. Pitch angle is the angle with respect to the ground. Aoa is the angle with respect to the airflow.

The reason planes have a "stall speed" is that is the minimum speed the plane can maintain level flight without stalling. But stalls can happen at higher speed during a turn when the aoa is consistently high because the wings [need to] produce more lift to hold altitude. When climbing, you are at high power and low speed and can also stall due to a rapid change in pitch.

 

[CWatters]

+1

When you exit a spin (usually in a nose down attitude) its possible to enter a high speed stall just by trying to recover to level flight too fast (too much back stick). Have felt the buffeting myself.

 

[cyboman]

reading those pilot's reports at ycombinator that Peter Donis linked in post# 2

i note randmoness in just when this occurs
and pilots report it happens with autopilot ON , and to my understanding MACS is supposed to be OFF when on autopilot.

https://news.ycombinator.com/item?id=19373707
my guess is some little software routine is not re-entrant and occasionally corrupts a global variable someplace
that's only a guess... my only basis is the randomness of the occurrence. It just looks like software to me.

Time will tell.

old jim

I would have to agree old jim. It seems like it cannot even be isolated to the MCAS system itself, as you've pointed out and has been before, it's not supposed to be active with autopilot on. There is likely something very wrong with the flight laws in the plane, this may of happened when they integrated the new MCAS.

Reading some of the other reports made by pilots it looks like there may be some very real quality control issues in the manufacturing. It's also interesting that it's reported the plane isn't as fuel efficient as it claims. It's painting a picture of corporate negligence caused by cutting corners and expediency and ultimately greed. That's harsh but it's definitely evident in the lack of training and poor documentation.

EDIT: After some push back by experts in this forum, I think I was too emotional in my judgement here on Boeing. Pilot reports and speculation are not enough for me to use the language I did here.