How Safe is the Boeing 737 Max's MCAS System?

[Klystron]

NOVA did an excellent documentary on this crash. It shows how terribly wrong things can go with extreme weather conditions, failed sensors and reliance on too much automation.

Very instructive video that emphasizes several important issues:

• crew members received multiple warning messages and erroneous data contributing to
  
• missed accurate readings such as engine power readouts.
• limitations of on-board weather radar and traffic avoidance systems.
• stall defined as interrupted smooth air flow on wing surfaces leading to loss of lift.
• air speed must be maintained in a critical envelope, neither too fast nor too slow.

Noticed an interesting crew factor during the simulated flight. The Nova narrator mentions throttle control several times after the pitot failure but neither pilot manages or handles the A-330 throttle levers or adjusts the automatic throttle (ATS) after the message cascade until later.

Notice also the lack of visual horizon at night; indeed any visual cues except for instruments.

 

[Andrew Mason]

NOVA did an excellent documentary on this crash. It shows how terribly wrong things can go with extreme weather conditions, failed sensors and reliance on too much automation.

The NOVA documentary was made before they recovered the cockpit voice recorder and flight data recorder from the bottom of the Atlantic. The Mayday episode on this crash was made after recovery of the CVR and FDR and is much more interesting because it is able to tell us what was happening in the cockpit.

AF 447 problem started with frozen pitot tubes that gave false speed readings, making the pilots think the plane was going too fast, so they kept trying to throttle back and put the nose up. This led to a stall and the plane stopped flying and fell into the ocean. The pilot had been sleeping and it took some time before they could get him into the cockpit. When he arrived, they were already in a stall but no one seemed to realize it (despite the "stall, stall" warnings all around). They still thought they were going too fast. If the Boeing MCAS system uses speed indicators to determine whether the air craft is about to stall, which it would seem it must do, it is possible that there could be a connection to incorrect speed input and the recent 737 8x crashes. But they seem quite different. AF 447 was a high altitude stall long after take-off that pilots did not realize was happening. The recent crashes appear to be low altitude stalls soon after take-off.

AM

 

[PeterDonis]

If the Boeing MCAS system uses speed indicators to determine whether the air craft is about to stall, which it would seem it must do

It uses angle of attack indicators, which are not pitot tubes like airspeed indicators, they are vanes that sense the direction of the relative wind. The failure modes of AoA indicators appear to be different from those of airspeed indicators.

 

[PeterDonis]

The recent crashes appear to be low altitude stalls

It does not appear that the planes in the recent crashes were stalled at any point; the airspeed was if anything too high, not too low. But erroneous AoA sensor input could have made the MCAS think the plane was stalling when it wasn't.

 

[Andrew Mason]

It uses angle of attack indicators, which are not pitot tubes like airspeed indicators, they are vanes that sense the direction of the relative wind. The failure modes of AoA indicators appear to be different from those of airspeed indicators.

I don't understand is how stall detection can be based only on angle of attack. A low speed and low angle of attack can still result in a stall. A high speed steep climb can be perfectly ok.

AM

 

[PeterDonis]

I don't understand is how stall detection can be based only on angle of attack.

The MCAS is not doing stall detection. It's adjusting nose down trim based on angle of attack to compensate for the new engines. This has already been discussed in multiple posts in this thread.

 

[Klystron]

The NOVA documentary was made before they recovered the cockpit voice recorder and flight data recorder from the bottom of the Atlantic.

Still the Nova team analysis was very accurate. Perhaps the only contradiction from the CVR was that the Air France crew saw the larger storm but decided not to divert around it. With less data Nova kindly suggested the larger storm could have been concealed.

The Mayday episode on this crash was made after recovery of the CVR and FDR and is much more interesting because it is able to tell us what was happening in the cockpit.

Concur. The voice playback is compelling while the data confirms most of the Nova suppositions gleaned from the wreckage. While highly emotional, I question the value of repeatedly showing photos and family testimonials of crew members, how they met in San Francisco, vacationed in Rio, and expired tragically. Otherwise, Mayday raises interesting questions of why the captain leaves the flight deck for sleep break after entering the storm and why the first officer keeps the right side stick controller pulled back despite numerous stall warnings.

To paraphrase the final line of the Nova documentary "The aircraft flight safety community deplores mysteries.".

 

[russ_watters]

I don't understand is how stall detection can be based only on angle of attack. A low speed and low angle of attack can still result in a stall. A high speed steep climb can be perfectly ok.

No. Angle of attack is the *only* direct contributor to a stall. In light planes, the stall warning horn is literally an acoustic horn attached to the leading edge of the wing. It only responds to high aoa, which causes the horn to sound when airflow is interrupted because air is hitting the leading edge at the wrong angle.

By your description, you may be confusing aoa and pitch angle. Pitch angle is the angle with respect to the ground. Aoa is the angle with respect to the airflow.

The reason planes have a "stall speed" is that is the minimum speed the plane can maintain level flight without stalling. But stalls can happen at higher speed during a turn when the aoa is consistently high because the wings [need to] produce more lift to hold altitude. When climbing, you are at high power and low speed and can also stall due to a rapid change in pitch.

 

[CWatters]

+1

When you exit a spin (usually in a nose down attitude) its possible to enter a high speed stall just by trying to recover to level flight too fast (too much back stick). Have felt the buffeting myself.

 

[cyboman]

reading those pilot's reports at ycombinator that Peter Donis linked in post# 2

i note randmoness in just when this occurs
and pilots report it happens with autopilot ON , and to my understanding MACS is supposed to be OFF when on autopilot.

https://news.ycombinator.com/item?id=19373707
my guess is some little software routine is not re-entrant and occasionally corrupts a global variable someplace
that's only a guess... my only basis is the randomness of the occurrence. It just looks like software to me.

Time will tell.

old jim

I would have to agree old jim. It seems like it cannot even be isolated to the MCAS system itself, as you've pointed out and has been before, it's not supposed to be active with autopilot on. There is likely something very wrong with the flight laws in the plane, this may of happened when they integrated the new MCAS.

Reading some of the other reports made by pilots it looks like there may be some very real quality control issues in the manufacturing. It's also interesting that it's reported the plane isn't as fuel efficient as it claims. It's painting a picture of corporate negligence caused by cutting corners and expediency and ultimately greed. That's harsh but it's definitely evident in the lack of training and poor documentation.

EDIT: After some push back by experts in this forum, I think I was too emotional in my judgement here on Boeing. Pilot reports and speculation are not enough for me to use the language I did here.

 

[cyboman]

No. Angle of attack is the *only* direct contributor to a stall. In light planes, the stall warning horn is literally an acoustic horn attached to the leading edge of the wing. It only responds to high aoa, which causes the horn to sound when airflow is interrupted because air is hitting the leading edge at the wrong angle.

By your description, you may be confusing aoa and pitch angle. Pitch angle is the angle with respect to the ground. Aoa is the angle with respect to the airflow.

The reason planes have a "stall speed" is that is the minimum speed the plane can maintain level flight without stalling. But stalls can happen at higher speed during a turn when the aoa is consistently high because the wings produce more lift. When climbing, you are at high power and low speed and can also stall due to a rapid change in pitch.

I still think the MCAS and stall prevention shouldn't only look at AoA. If pitch attitude is detected to be literally pointing into the ground or even below the horizon for that matter, no system should be sending nose down commands in that scenario. It also shouldn't be sending repeated commands if it has sent N commands after all being overridden by pilot input. I realize perhaps they may have not wanted to over-engineer the system, but honestly looking at the possible failure modes, it seems this system is rather dumb.

 

[cyboman]

Still the Nova team analysis was very accurate. Perhaps the only contradiction from the CVR was that the Air France crew saw the larger storm but decided not to divert around it. With less data Nova kindly suggested the larger storm could have been concealed.Concur. The voice playback is compelling while the data confirms most of the Nova suppositions gleaned from the wreckage. While highly emotional, I question the value of repeatedly showing photos and family testimonials of crew members, how they met in San Francisco, vacationed in Rio, and expired tragically. Otherwise, Mayday raises interesting questions of why the captain leaves the flight deck for sleep break after entering the storm and why the first officer keeps the right side stick controller pulled back despite numerous stall warnings.

To paraphrase the final line of the Nova documentary "The aircraft flight safety community deplores mysteries.".

What's really sad is Air Asia 8501 months later had very similar characteristics. An airbus also but a different model. The co-pilot, with much less experience than the captain, pitched the nose up by pulling back continually on the side-stick, all through the stall.

 

[russ_watters]

I still think the MCAS and stall prevention shouldn't only look at AoA. If pitch attitude is detected to be literally pointing into the ground or even below the horizon for that matter, no system should be sending nose down commands in that scenario. It also shouldn't be sending repeated commands if it has sent N commands after all being overridden by pilot input. I realize perhaps they may have not wanted to over-engineer the system, but honestly looking at the possible failure modes, it seems this system is rather dumb.

I think you're still misconstruing the failure behavior for the design behavior. Again, MCAS does not lower the nose of the plane when functioning properly. It only makes the plane feel like other planes, which require a progressively increasing force to achieve higher and higher angles of attack.

When the MCAS system failed, it evidently didn't just progressively add down trim, but instead rapidly went to full down. Being much more aggressive than it is supposed to be is what is believed to have caused the plane to drop.

A caveat to that though is that evidently some part of the stall prevention system was active at least for Lion Air, as the "stick shaker" stall notification system was active throughout the flight. So it is possible that both the MCAS and the stall prevention system were active; a 1-2 punch of down nose. This part is somewhat speculative though. I don't think it was mentioned in the preliminary Lion Air report.

Both this system and stall prevention - which *does* lower the nose against the pilot's command - must operate throughout the entire flight envelope (caveat: MCAS does not operate with flaps down). If the nose is pointed down and the pilot pulls up too hard, the plane will stall, and the situation will be worse than if the pilot hadn't pulled up as hard. I believe that was a factor once in a crash where the pilot survived, but I don't remember which one (I feel like it has been discussed recently on PF...); the pilot believed the anti-stall system contributed to the crash by not allowing him to raise the nose, but he was probably wrong; the system probably prevented him from stalling, which would have made the plane drop even faster. I believe the argument we had was about whether or not the pilot could keep the plane closer to stall without stalling than the computer could. I think that's unlikely.

 

[russ_watters]

Caveat to some of the previous info:
https://theaircurrent.com/aviation-...aracteristics-augmentation-system-mcas-jt610/

There are a couple of ambiguous things in descriptions of MCAS:

1. I believe, but am not certain, that the anti-stall system is separate from the MCAS. But it could be that they are two different functions of the same system. That wouldn't change the logic, only the grouping of the terminology.
2. Some sources, such as the above, say the MCAS moves the entire stabilizer, not just adjusts the trim tab (the graphic doesn't match the text of the article). That seems incongruous with other sources. I don't think it is correct, but I am not certain.

 

[russ_watters]

More analysis; somewhat speculative, so take with a grain of salt:

My interpretation of Boeing's/the FAA's interpretation of the MCAS system's criticality is that failure of the system is not an emergency situation. This is evidenced by the previous day's Lion Air flight, which had the same failure and continued on to its destination after effectively dealing with it. The flight manual doesn't describe it as an emergency requiring an immediate landing, so they didn't. This is probably because "runaway trim" is a thing that happens from time to time. Any plane that has automation or even just electronic trim controls could have this, and it does happen from time to time. It can be overridden and the flight continued...but it does sometimes result in crashes, so it is a tough call as to whether or not it should be considered an emergency.

The difference with the MCAS system is that instead of just going full nose down trim and staying there until the pilot shuts off the system, it allows the pilot to override it with the trim levers -- and then repeats the full nose down trim a few seconds later. The apparent fixing of the problem and re-occurrence would cause a confused pilot to delay disabling the system, eat-up altitude and increase the likelihood of a crash.

 

[PeterDonis]

pilots report it happens with autopilot ON , and to my understanding MACS is supposed to be OFF when on autopilot.

Yes, this is a key observation, and, as @cyboman posted, it's a reason to think the issue is not just an MCAS issue.

 

[PeterDonis]

I still think the MCAS and stall prevention shouldn't only look at AoA. If pitch attitude is detected to be literally pointing into the ground or even below the horizon for that matter, no system should be sending nose down commands in that scenario. It also shouldn't be sending repeated commands if it has sent N commands after all being overridden by pilot input.

Bear in mind that we don't have access to the internal algorithms. So we don't know that these systems look only at AoA. Nor do we have access to the flight recorder data that shows what the sensor readings were. So we don't know on what basis the system did what it did. Nor do we know what it would do under other circumstances. We don't know exactly when it sends repeated commands or what exactly stops it from doing so. We're speculating based on what information is available, which is limited (and sometimes, as has been commented, contradictory).

 

[nsaspook]

More analysis; somewhat speculative, so take with a grain of salt:

My interpretation of Boeing's/the FAA's interpretation of the MCAS system's criticality is that failure of the system is not an emergency situation. This is evidenced by the previous day's Lion Air flight, which had the same failure and continued on to its destination after effectively dealing with it. The flight manual doesn't describe it as an emergency requiring an immediate landing, so they didn't. This is probably because "runaway trim" is a thing that happens from time to time. Any plane that has automation or even just electronic trim controls could have this, and it does happen from time to time. It can be overridden and the flight continued...but it does sometimes result in crashes, so it is a tough call as to whether or not it should be considered an emergency.

The difference with the MCAS system is that instead of just going full nose down trim and staying there until the pilot shuts off the system, it allows the pilot to override it with the trim levers -- and then repeats the full nose down trim a few seconds later. The apparent fixing of the problem and re-occurrence would cause a confused pilot to delay disabling the system, eat-up altitude and increase the likelihood of a crash.

That seems to be true as stability augmentation is not new or novel in aircraft and there are rules about how to handle failures.
https://www.law.cornell.edu/cfr/text/14/23.672

As usual it's all about trust. At MAX 8 introduction, if Boeing told the FAA "we've got this' stability 'defect' under control so pilots get what they expect from flight controls I think we all would have said OK two years ago. Today they have some 'splainin' to do.

 

[PeterDonis]

Some sources, such as the above, say the MCAS moves the entire stabilizer, not just adjusts the trim tab (the graphic doesn't match the text of the article).

If I'm reading some previous posts correctly, the automated trim system, which is what the MCAS is using, does move the entire stabilizers (both sides); the yoke moves a portion of them (the elevators).

 

[russ_watters]

If I'm reading some previous posts correctly, the automated trim system, which is what the MCAS is using, does move the entire stabilizers (both sides); the yoke moves a portion of them (the elevators).

Looks like you are correct. See:

Also, the following site provides a discussion (with photos) of the 737 flight control system clearly showing the all-moving stabilizer for pitch trim and the elevators for pitch control. The 737 elevators also have balance tabs, which look like trim tabs, but have a different purpose.
http://www.b737.org.uk/flightcontrols.htm
On the 737, Mach trim, speed trim, and MCAS all work through an all-moving stabilizer, not any sort of elevator trim tab.

https://leehamnews.com/2019/03/10/use-caution-about-ethiopian-737-8-crash/

The B737-700 is fitted with tabs on the trailing edges of the elevator control surfaces. These act as balance tabs to reduce the control forces required to move the elevators and are critical for manual control of the aircraft in the event of a double hydraulic system failure. Two control rods link each tab to the elevator control system such that when the elevators are deflected the tabs also deflect.

http://code7700.com/aero_balance_tabs.htm

https://www.pmdgsim.com/2016/10/why-does-boeing-use-balance-tabs-on-737_21.html

This doesn't necessarily change the interpretation of the crash, but it is good to get the terminology and parts correct...

This link is incredibly detailed, created after the Lion Air crash, though I haven't read through the whole thing yet:
https://www.satcom.guru/2018/11/stabilizer-trim.html

 

[PeterDonis]

It's painting a picture of corporate negligence caused by cutting corners and expediency and ultimately greed. That's harsh but it's definitely evident in the lack of training and poor documentation.

Again, bear in mind that we do not have all the facts yet. Also, bear in mind that this thread is focused on the technical aspects; allegations of "corporate negligence" and "greed" are off topic since those aren't technical judgments.

 

[cyboman]

Again, bear in mind that we do not have all the facts yet. Also, bear in mind that this thread is focused on the technical aspects; allegations of "corporate negligence" and "greed" are off topic since those aren't technical judgments.

Absolutely, that's why I said it's "painting a picture". And it'd say it's only fairly conclusive so far Boeing's documentation in the flight manuals for the new MCAS was fundamentally lacking as was adequate pilot training. You can gather that not just from the media but from the pilot reports.

I wouldn't say such suggestions are off topic. My original post started with technical questions but the ramifications of some of the light we shed on such technical considerations can lead to suggestions that the engineers or the company were potentially negligent in the name of profits. No one is suggesting we analyse the nature of corporate negligence and greed.

 

[PeterDonis]

I wouldn't say such suggestions are off topic.

That statement of mine was not a personal opinion; it was a reminder about our moderation policy. If we cannot keep this thread focused on technical questions and refrain from making allegations that are not technical, the thread will be closed. I don't want that to happen and neither do you. So please take heed.

some of the light we shed on such technical considerations can lead to suggestions that the engineers or the company were potentially negligent in the name of profits.

Regardless, such suggestions do not belong here, since this is a technical discussion. Negligence is a legal judgment, not a technical judgment.

 

[cyboman]

If I'm reading some previous posts correctly, the automated trim system, which is what the MCAS is using, does move the entire stabilizers (both sides); the yoke moves a portion of them (the elevators).

This is what you and and Russ I think are muddling and causing some confusion. From my understanding of the system, the MCAS and/or/with the automatic stall prevention system do pitch the nose of the aircraft down. MCAS is an augmentation system, it's not simply a force feedback system as you seem to imply. It was implemented in order to deal with the changed aerodynamics of the plane due to the larger engines which cause a positive pitch attitude - they cause the aircraft nose to rise. This can cause a stall under normal operating conditions with a pilot without special training for the changed aerodynamics of the plane. It may provide force feedback to warn the pilot as a secondary effect, but it's primary effect and role is to change the aerodynamics of the aircraft by adjusting trim and in effect pushing the nose down. This as has been pointed out was put in place as opposed to providing additional training to pilots certified to fly previous 737s, such that it's invisibly working behind the scenes to make the craft appear to handle like previous models. Truly invisible in the sense it wasn't even included or noted in the flight manuals.

 

[nsaspook]

Another jewel from the link of @russ_watters

https://www.satcom.guru/2018/11/737-mcas-failure-is-option.html

 

[cyboman]

That statement of mine was not a personal opinion; it was a reminder about our moderation policy. If we cannot keep this thread focused on technical questions and refrain from making allegations that are not technical, the thread will be closed. I don't want that to happen and neither do you. So please take heed.
Regardless, such suggestions do not belong here, since this is a technical discussion. Negligence is a legal judgment, not a technical judgment.

Fair enough. I don't see how saying the lack of documentation amounts to potential negligence is pushing the thread into some dangerous non-technical realm. To be fair, a good part of this thread has been speculation. In effect, that's all we can really do. But I understand your wish to reemphasize nothing is conclusive yet.

Further, I will steer clear of directly suggesting any negligence on Boeing's part if that is off limits.

 

[PeterDonis]

I don't see how saying the lack of documentation amounts to potential negligence is pushing the thread into some dangerous non-technical realm.

That's why I made it clear that, as far as PF's moderation policy is concerned, it does. PF's moderation policy might not agree with your personal judgment, but it is what it is, and I wanted to make sure it was clear to everyone.

 

[cyboman]

I will be careful not to suggest any possible negligence on Boeing's part as it's been pointed out to me this is seen as defamatory and not permitted on these forums.

 

[cyboman]

Bear in mind that we don't have access to the internal algorithms. So we don't know that these systems look only at AoA. Nor do we have access to the flight recorder data that shows what the sensor readings were. So we don't know on what basis the system did what it did. Nor do we know what it would do under other circumstances. We don't know exactly when it sends repeated commands or what exactly stops it from doing so. We're speculating based on what information is available, which is limited (and sometimes, as has been commented, contradictory).

That's a good point. Perhaps I am speculating too much here. In fact, I did read somewhere at one point, I believe, that the system is taking in other data, I believe it was altitude and air speed. It will be interesting to see as the investigations conclude, what changes they are proposing to the system. We know from the air authority memo I posted earlier that they are looking at a max command limit, as well as activation and sensor changes to MCAS. It seems to me pitch attitude with reference to the horizon would be very relevant data to such a system. Ideally, I would suggest GPS data should be used for redundancy.

 

[PeterDonis]

From my understanding of the system, the MCAS and/or/with the automatic stall prevention system do pitch the nose of the aircraft down.

I've already explained repeatedly what the system does and under what circumstances the nose will in fact go down. So have others. But I'll try once more.

The fundamental error you are making with regard to MCAS is to confuse trim adjustments with pitch commands. Trim adjustments are made for the purpose of changing the force required to hold the yoke at a particular point in its travel. They are not made for the purpose of changing the plane's pitch attitude. It is possible for the plane's pitch attitude to change as the result of a trim adjustment, if the pilot does not adjust the force he is exerting on the yoke. But that is a side effect of the trim adjustment; it's not the primary purpose of the trim adjustment.

It was implemented in order to deal with the changed aerodynamics of the plane due to the larger engines which cause a positive pitch attitude - they cause the aircraft nose to rise.

This is oversimplified. The pitch up moment due to the new engines (it's not just that they're larger, they're also further forward) is not constant; it depends on airspeed and angle of attack. We already know the MCAS trim adjustment depends on angle of attack; I would expect it to depend on airspeed as well. (And possibly on other conditions like angle of bank, since that will affect the stall speed.)

This can cause a stall under normal operating conditions with a pilot without special training for the changed aerodynamics of the plane. It may provide force feedback to warn the pilot as a secondary effect, but it's primary effect and role is to change the aerodynamics of the aircraft by adjusting trim and in effect pushing the nose down.

No, you have this backwards. The primary purpose is to provide force feedback to the pilot as a function of airspeed and angle of attack that is similar to previous 737s. That's how the need for special training was to be avoided. That's why it uses the trim system, since, as noted above, the trim system's primary purpose is to change the yoke force as a function of yoke travel. Pushing the nose down, if it happens, is a secondary effect, as I've already said.

If the primary purpose of MCAS were to "change the aerodynamics of the plane" (which I think is a misleading way of looking at it anyway) and force the nose down, it would function more like automatic stall prevention in a fly-by-wire system: if it detected that the plane was too close to a stall, it would simply override the pilot's input and use the yoke control system to force the nose down--i.e., it would force the yoke to a different position than the pilot wants to put it. But it doesn't do that.