Lion Air crash: Jakarta Boeing 737 'had prior instrument error'

[KL27x]

If that were the only reason for MCAS, why does it have to rely on a single AOA sensor, rather than the combination of sensors that create the stall warning / stick shake? If it only has to be in effect in near stall conditions, then it should not need to be active unless near a stall.

I'm also struggling with the plane going full throttle. Multiple sources suggest MCAS has control over the elevator with no mention of the throttle. 

There are multiple tidbits that suggest to me the MCAS was created to make the ride smoother, which requires a very fast and frequent input to perhaps the throttle in addition to the elevator. Boeing didn't want to offer the 737 MAX and have airliners complain that the ride is bumpier than the old planes?

[KL27x]

^The US Airforce did experiments with reverse raked wings. This was inherently instable and required active electronic management of some of the control surfaces. This is kind of along the lines of what I am thinking that MCAS was actually made to do... to make faster than human adjustments to reduce the effects of inherent instability. Unlike the reverse wing fighter jets, which had complete runaway instability, perhaps the change in engines created some undesired oscillations between 2 or 3 points of shared stability which were not fatal (until incorrectly MCAS'd) but uncomfortable.

[chickenHeadKnob]

If that were the only reason for MCAS, why does it have to rely on a single AOA sensor, rather than the combination of sensors that create the stall warning / stick shake? If it only has to be in effect in near stall conditions, then it should not need to be active unless near a stall.

That the MCAS in default only use a single Angle of attack vane was a mistake by boeing. That stall warning is done with angle of attack sensors (and not "other" sensors) is because it is an aerodynamic phenomenon, not something to do with engines, a common misconception of non-pilots. From what I have read about MCAS, and the Mentourpilot video linked below, you are mistaken if you think MCAS is constantly trimming and flying the plane. It is constantly monitoring the angle of attack but only adding pitch down when it thinks the aircraft is approaching stall. It the recent crashes it looks like the system incorrectly initiated trim down when it didn't need to, and was fighting the pilots.

Have a look at Mentourpilot's video, he dumbs it down too much for my taste but it might help:

[djacobow]

Actually, the MCAS was needed in part *because* of those powerful engines. They are more powerful and mounted farther forward than the engines on other 737s, so their power generates a higher turning moment that wants to push the nose up, so the danger of a stall is increased. Furthermore, once you the AOA very high, the nacelles themselves generate some lift (again, with a large moment because of the forward placement relative to the center of rotation), and that pushes for an even higher AOA. This is really only a problem once you are already at high AOA, but essentially the engines themselves become a destabilizing force once you get out of the safe zone.

I'm struggling with this description. It makes it seem like the new engine placement has a tendency to push the nose of the plane up, and that is the main reason for MCAS.

Two separate phenomena that I intermingled. Adding power on a 737 when it is in/near a stall will generally make things worse. This is a generic problem with all airplanes with the engines below the wings, but it is certainly a bigger problem with more power at your disposal, and it is a bigger problem with the increased moment of the MAX engine position.

Furthermore, the reason MCAS was specifically designed for the MAX is that the *nacelles* themselves generate lift. (Almost any object in an airstream can generate lift if you hold it the right way.) They are designed to have neutral lift when in level flight, but as you turn the nose of the plane up, the engines actually want to push it up even more, and this is very pronounced at high angles of attack. I'm sure simulations showed that this instability is hard to recover from if not dealt with immediately, hence MCAS.

[djacobow]

It's a Boeing design error and the S/W patch allowing "the option" of using two sensors stinks of cover-up. AOA DISAGREE alert indicator is also an "option"?! 

Using two sensors is still shitty because you have now doubled the probability of MCAS failure due to a sensor failure.
Multiple sensors iced up for the AF447 disaster. Would MCAS register a discrepancy with two sensors reading similar yet both are out to lunch?
I'll repeat the old adage "with two clocks you can never know the correct time". This MCAS system is never going to be stellar, even adding a third (sensor) opinion because the other pair can malfunction. It's just getting a slightly lower probability of failure, this is all Boeing can accomplish. Unless there was a gross S/W bug that is being fixed too.

In other industries with safety-critical design, you do fault-tree analysis and FMEDA to ensure you have coverage of a sensor problem, among other scenarios.
Clearly, Boeing bungled this and is showing a repeat bungle with their hasty "software fix" that cannot meet basic functional safety requirements even after piling on the algorithm smartness.
I've seen this before - a bad design safety-critical system is out there, sold in numbers and a corporation has a massive panic to fix it ASAP without changing any hardware.
Adding complex S/W algorithms (which can never be proven correct) is very dangerous.

Then I read this:
"MCAS is implemented within the two Flight Control Computers (FCCs). The Left FCC uses the Left AOA sensor for MCAS and the Right FCC uses the Right AOA sensor for MCAS. Only one FCC operates at a time to provide MCAS commands. With electrical power to the FCCs maintained, the unit that provides MCAS changes between flights. In this manner, the AOA sensor that is used for MCAS changes with each flight."

How do you come up with something so stupid?

The problem with "MCAS disagree" is that it does not necessarily mean there is a sensor problem. There are aerodynamic situations, such as a steep turn where correctly operating sensors can disagree. Hence, it is a reason to indicate something to the pilot, not a reason for the system to punt. I suspect, though, that the software patch will make it so MCAS will not activate on either sensor indicating high AOA, but only if both indicate high AOA. Well, that's just a guess.

[KL27x]

That the MCAS in default only use a single Angle of attack vane was a mistake by boeing. That stall warning is done with angle of attack sensors (and not "other" sensors) is because it is an aerodynamic phenomenon, not something to do with engines, a common misconception of non-pilots.

Thanks but I understand that, already. In this case, other sensor could have told the MCAS system that the plane was not stalled. The fact that the plane is going 600 mph in the direction the nose is pointed should be a pretty good indicator of this. I don't know what all sensors that the plane has, but it seems like there are some other ways to detect a stall than the AOA. And the fact the stick shaker did not activate means that the malfunctioning AOA did not fool the stick shaker, right?

Furthermore, the reason MCAS was specifically designed for the MAX is that the *nacelles* themselves generate lift. (Almost any object in an airstream can generate lift if you hold it the right way.) They are designed to have neutral lift when in level flight, but as you turn the nose of the plane up, the engines actually want to push it up even more, and this is very pronounced at high angles of attack. I'm sure simulations showed that this instability is hard to recover from if not dealt with immediately, hence MCAS.

Thanks for this. I think you explained it in your previous post just fine, in hindsight, but I think I understand it better, now. It sounds like the MAX is inherently more prone to getting away from the pilot and stalling at high AOA maneuvers, and it harder to recover from, requiring much greater input to the elevator and less ability to add useful thrust? Essentially, without electronic help, the MAX has less maneuverability. And any electronic aid should only ever need to be fleeting, to bring the plane back from the "runaway" edge of maneuverability. Jacking the elevator full down for 30 seconds seems like a scenario that would be helpful... never? If a pilot is pushing a passenger jet carrying 200 people to the utmost limit, you'd think he has a really, really good and really, really imminent reason... like to avoid hitting something (including the ground).

I am curious why the plane was on full throttle. Do any pilots have a theory here? The plane was supposedly going 600mph and on full thrust. Maybe this is a normal pilot response.

[Nusa]

A stupid question here: why is MCAS needed in the first place? Isn't the pilot trained to push when the stick shaker is activated? There are some certain scenarios where the pilot must respond without referring the handbook, and they get well trained and well paid for executing those memory checklists well.

What's the problem trusting the pilot? Military planes don't have as much "safety" BS, and they don't fall from the sky for no reason.

Actually they do, quite regularly, not counting combat losses:
https://en.wikipedia.org/wiki/List_of_accidents_and_incidents_involving_military_aircraft_(2010%E2%80%93present)

The difference is in the number of casualties and who investigates. In fixed wing combat aircraft, generally all seats are ejection seats, so survival rates are high. In transport aircraft and helicopters, there are still far fewer people involved in most cases.

[Nusa]

I am curious why the plane was on full throttle. Do any pilots have a theory here? The plane was supposedly going 600mph and on full thrust. Maybe this is a normal pilot response.

Well if you know that engine thrust on the aircraft tends to push the nose up, and one is desperately trying to get the nose up, it makes some sense to pour on the throttle to get the nose up.

[Kjelt]

And another question: if there is a huge structural error in this plane, why did "only" two planes crash in half a year time ?
Are there more incidents, reports from pilots that just in time got the plane under control by disabling the computer and take manual control? Haven't heard about them ?

[GeorgeOfTheJungle]

And another question: if there is a huge structural error in this plane, why did "only" two planes crash in half a year time ?
Are there more incidents, reports from pilots that just in time got the plane under control by disabling the computer and take manual control? Haven't heard about them ?

Yes, there are reports of at least two other pilots that have had to deactivate MCAS during takeoff.

Edit: Not the MCAS, had to disable the autopilot it seems:
http://time.com/5550449/pilots-boeing-737-max-issues/

[Daixiwen]

And another question: if there is a huge structural error in this plane, why did "only" two planes crash in half a year time ?

From what we know so far the MCAS becomes a problem if the angle of attack sensor gives a false reading. I sure hope the sensor is not *that* bad.

A sensor meeting the "major failure" safety requirement must have a failure rate less than 1/100000. Are there any statistics of how many total 737 MAX flights have occurred since its launch?

[Kjelt]

Yes, there are reports of at least two other pilots that have had to deactivate MCAS during takeoff.

Ok 5 incidents in a half year for 350 planes flying at least two flights a day , so 5 incidents over 127000+ flights.

EDIT: the plane has been in service since 2016 so that would be miliions of flights and only now it occurs.

Don't get me wrong it is good to get to the bottom of this, but it looks like it will be pretty hard to exactly determine the cause if it only happens under certain very specific conditions.
Good that the flightrecorders are there, otherwise it would be a needle in a haystack.

There are approximately 350 Boeing 737 Max 8 aircraft in operation worldwide, being flown by 54 operators, according to the US Federal Aviation Administration (FAA).5 days ago

[KL27x]

it looks like it will be pretty hard to exactly determine the cause...

Or... maybe not.

https://www.seattletimes.com/business/boeing-aerospace/failed-certification-faa-missed-safety-issues-in-the-737-max-system-implicated-in-the-lion-air-crash/

Apologies if someone else has already linked this. It seems like it was published within the last 18 hours. It seems pretty clear, so far. It contains almost all the important details in this thread but without the faff.

1. FFA let Boeing approve its own plane, in some ways.
2. The MCAS was said to move the elevator only 0.6 degrees. But Boeing increased it to 2.5 degrees after test flights. No one told this to the FAA.
3.  After the elevator is manually moved by the pilot, the MCAS can re-trigger. Doing a full 2.5 degrees again. (In the Ethiopian Airlines flight, the captain corrected the plane 21 times, then he handed the plane to the FO. The FO made only a tiny, partial correction after MCAS triggered. Then it triggered again. This put the elevator to full nose down, and the plane crashed shortly after.)
4. Boeing didn't include info about MCAS to its customers, at all.
5. MCAS was probably incorrectly classified. FFA approved the original classification based on 0.6 degrees of elevator adjustment. That changed to 2.5 (and was actually unlimited, due to retriggering). And even they way it was initially classified, it still needed to have two sensors, not just one.
6. They didn't consider the human factor of what happens to a pilot when 2.5 degrees of elevator adjustment is made out of the blue and repeatedly retriggers and no one told them this could even happen. 5 degrees is basically maximum nose dive; so I think "panic" might be on the menu. I wonder how many 737 commercial (not test) pilots have ever intentionally used even 2.5 degree downward angle on a flight.

So basically, this MCAS system, in the hands of a pilot who has spent 6,000 hours of flight time living by very small and gradual adjustments and essentially "not messing up", becomes a shoddy encoder wheel, where you manage to turn the volume up by 1, then it goes down by 10, then up by 1, then down by another 10. And then the music stops playing.

[Nusa]

Yes, there are reports of at least two other pilots that have had to deactivate MCAS during takeoff.

Ok 5 incidents in a half year for 350 planes flying at least two flights a day , so 5 incidents over 127000+ flights.

EDIT: the plane has been in service since 2016 so that would be miliions of flights and only now it occurs.

Don't get me wrong it is good to get to the bottom of this, but it looks like it will be pretty hard to exactly determine the cause if it only happens under certain very specific conditions.
Good that the flightrecorders are there, otherwise it would be a needle in a haystack.

There are approximately 350 Boeing 737 Max 8 aircraft in operation worldwide, being flown by 54 operators, according to the US Federal Aviation Administration (FAA).5 days ago

The first 737 MAX commercial flight was in May, 2017. Wherever you got 2016 from was probably publicity about the aircraft making test flights.

You might find these easy-to-find numbers more useful: https://en.wikipedia.org/wiki/List_of_Boeing_737_MAX_orders_and_deliveries

[chickenHeadKnob]

Thanks but I understand that, already. In this case, other sensor could have told the MCAS system that the plane was not stalled. The fact that the plane is going 600 mph in the direction the nose is pointed should be a pretty good indicator of this. I don't know what all sensors that the plane has, but it seems like there are some other ways to detect a stall than the AOA. And the fact the stick shaker did not activate means that the malfunctioning AOA did not fool the stick shaker, right?

Other sensors might inform the MCAS software that the the aircraft is in a "this can't happen" situation but then what. I suspect the flight law software would choose to believe the angle of attack indicator over  conflicting information as they should be more reliable than the rest. For what it is worth the stall horn  in piston aircraft is  a very simple reliable device, it roughly forms the same function. As the angle of attack approaches stall the vane rotates and a noise is made, then the pilot needs to take action and lower the nose.

The problem in 737Max case is that MCAS kicks in and starts quietly adding downward trim before the stick shaker angle of attack. And as far as I know this only this happens in manual flight mode. This was poorly explained to the pilots who's first reaction would be to countermand that input with opposite trim with the trim hat on the yoke. That apparently is not the way you disable MCAS and it keeps on fighting your inputs.

[BradC]

3.  After the elevator is manually moved by the pilot, the MCAS can re-trigger. Doing a full 2.5 degrees again. (In the Ethiopian Airlines flight, the captain corrected the plane 21 times, then he handed the plane to the FO.

Fuck me drunk. I'm sorry. What ?? 21 times??
"Here, the thing is fucked and we're all going to die. You deal with it".

[Nusa]

3.  After the elevator is manually moved by the pilot, the MCAS can re-trigger. Doing a full 2.5 degrees again. (In the Ethiopian Airlines flight, the captain corrected the plane 21 times, then he handed the plane to the FO.

Fuck me drunk. I'm sorry. What ?? 21 times??
"Here, the thing is fucked and we're all going to die. You deal with it".

Wrong take on it. It was more likely something along the lines of, "My controls aren't working right, try yours!" Which is a perfectly reasonable thing to try. Redundancy on all the primary flight controls and instruments from side to side is deliberate, just in case one side breaks in some way.

[Towger]

Are the new engines so powerful that MCAS is needed or is it purely a bandaid because the weight of the new engines changed the CG too much

It can take off like a Vulcan bomber:

https://youtu.be/RyeqeqSNSgQ

[BradC]

Wrong take on it. It was more likely something along the lines of, "My controls aren't working right, try yours!" Which is a perfectly reasonable thing to try. Redundancy on all the primary flight controls and instruments from side to side is deliberate, just in case one side breaks in some way.

Yep. Not a pilot and done nothing more than a couple of (really fun) lessons in a Cessna, so happy to take that. Still, the difference between the Captain trying 21 times and the first officer pushing it into the dirt is peculiar.

[KL27x]

It can take off like a Vulcan bomber:

Wowzers. The video says the plane experiences zero gravity when it leveled off. If you could get all the passengers to sign a waiver, I'd be the first one to.... watch the cell phone videos.

[chickenHeadKnob]

It can take off like a Vulcan bomber:

Wowzers. The video says the plane experiences zero gravity when it leveled off. If you could get all the passengers to sign a waiver, I'd be the first one to.... watch the cell phone videos.

Getting to negative G is trivial to do in any aircraft, even a glider. It doesn't have anything to do with the climb rate.

[Nusa]

Standard airshow stuff for new planes. Light fuel load and a completely empty cabin. Even the passenger seats and cabin trim may be missing. Much bigger power to weight ratio than a normal commercial takeoff.

[Gyro]

It can take off like a Vulcan bomber:

Now that really was something to experience! I remember an airshow at RAF Finningley when I was a kid, back when they were still fully operational. One gently cruised in at low level and then, half way along the runway, just sat on its tail and went up almost vertically. The feeling of my chest being forcibly compressed completely overwhelmed the indescribable roar.

It left a lasting impression even after all these years, I've never experienced anything like it again. That level of noise exposure would never be allowed these days of course.

Sorry, OT.

P.S. I saw its last airshow at Yeovilton. Sadly, they were very gentle on the airframe and engines, they did deploy the parachute though.

[nfmax]

Standard airshow stuff for new planes. Light fuel load and a completely empty cabin. Even the passenger seats and cabin trim may be missing. Much bigger power to weight ratio than a normal commercial takeoff.

A long time ago, I flew in a British Midland 747 from San Diego to LHR. The aircraft had flown from LHR to LAX, then the little hop down to San Diego to drop off the last few passengers. It took off with about 30 passengers on board, and hardly any fuel. Whoosh....

[LapTop006]

Standard airshow stuff for new planes. Light fuel load and a completely empty cabin. Even the passenger seats and cabin trim may be missing. Much bigger power to weight ratio than a normal commercial takeoff.

A long time ago, I flew in a British Midland 747 from San Diego to LHR. The aircraft had flown from LHR to LAX, then the little hop down to San Diego to drop off the last few passengers. It took off with about 30 passengers on board, and hardly any fuel. Whoosh....

Qantas used to fly LAX->AKL->MEL, one day by chance I happened to hop on the AKL->MEL leg, after the vast majority of passengers & cargo had left, along with the light fuel load for such a short hop it took off like the proverbial bat out of hell.

One of my favourite flying memories.