I live very close to Luke Air Force Base in Litchfield, AZ. F-35s fly over my home every day. I have met some of the young pilots flying these electronic aircraft in the local supermarket (See my EDN article on the F-35 here) These “kids”, but I must clarify---very talented and well-trained “kids”, were not too long ago playing action video games with advanced joysticks. This “training” has prepared the new generation of pilots to fly electronically-enhanced aircraft like the F-35 with a skill that has never before been seen. Boeing’s new 737 Max 8 is an electronically-enhanced aircraft, not anywhere near the high tech of an F-35, but still has far more electronic control and complexity than something like an “auto pilot”.
In light of the two recent tragic air crashes and the tragic loss of life on Ethiopian Airlines and Lion Air, we are all trying to make sense of what happened. I actually flew on the 737 Max 8 a couple of times and had no second thought about safety. It is too early to know what actually happened right now, but my ‘gut feel’ as an Electronics Engineer tells me that the need for more adequate and intensive pilot training is a strong possibility. Again, I do not say that is actually the cause, but in my experience, training on new electronic systems needs to typically be intense.
Food for Thought: Much of the following has been taken from NY Times articles to enhance this discussion:
The 737 Max 8 has a new Maneuvering Characteristics Augmentation System (MCAS) which is an automated safety feature on the 737 Max 8 designed to prevent the plane from entering into a stall, or losing lift.
MCAS was introduced by Boeing on the 737 Max 8 because of the heavier, more fuel-efficient engines that have changed the aerodynamic qualities of the workhorse 737 aircraft and can cause the plane's nose to pitch up in certain conditions during manual flight. Angle of attack sensors on the aircraft notify the MCAS to automatically point the nose of the aircraft down if it is in danger of going into a stall. This is achieved through horizontal stabilizers on the aircraft's tail which are activated by the aircraft's flight control computer.
According to Boeing, MCAS does not control the plane during normal flight but "improves the behavior of the airplane" during "non-normal" situations. The "non-normal" situations could be steep turns or just after takeoff, when the aircraft is climbing with flaps up, at speeds that are close to stall speed.
Lion Air Flight recorder
Data from the flight data recorder of Lion Air Flight 610, indicates that the pilots struggled to control the aircraft as the automated MCAS system repeatedly pushed the plane's nose down following takeoff. The pilots of the Ethiopian Airlines aircraft reported similar difficulty before the aircraft plunged into the ground shortly after takeoff.
It is said that after the Lion Air crash, Boeing issued a bulletin, to airlines operating the 737 Max 8, advising pilots how to override the MCAS system. Boeing also said it was working on software updates to the MCAS system which would be deployed across the 737 Max fleet. The company said procedures already exist to "safely handle the unlikely event of erroneous data coming from an angle of attack (AOA) sensor." "The pilot will always be able to override the flight control law (MCAS) using electric trim or manual trim," Boeing said.
An added piece of the puzzle is that the stabilizers on older models could have moved in unpredictable and dangerous ways as well, because of factors like electrical shorts, bad sensor data or computer problems. Boeing reasoned, according to people the company has briefed, as well as a bulletin it sent airlines after the crash, that the emergency procedure for malfunctioning speed trim and other stabilizer problems on the earlier 737s would work on the Max for problems related to MCAS as well.
The main body of that procedure is to switch off two “stabilizer trim cutout” switches on the central console of the cockpit, and then flip open the handles on wheels near the knees of the captain and first officer. By cranking those wheels, the pilots can adjust the stabilizers manually in an effort to keep the plane from pitching up or down.
In the Lion Air crash, one of the primary theories is that the system was receiving erroneous data about the angle of the plane from what is known as an angle of attack sensor. These are vane-like devices on either side of the fuselage which measure to what degree the plane’s nose is pointing upward or downward. Preliminary findings from the investigation suggested that the sensor on the pilot’s side of the plane was generating erroneous data.
It is said that in designing the 737 Max, Boeing’s design decision was to feed MCAS with data from only one of the two angle of attack sensors at a time, depending on which of two, redundant flight control computers — one on the captain’s side, one on the first officer’s side — happened to be active on that flight. That decision kept the system simpler, but may have possibly left it vulnerable to a single malfunctioning sensor, or data improperly transferred from it — this is reported to occur on the day of the crash.
Pilot training and information
Boeing updated the software for the flight control system. After the Lion Air crash, some American aviation authorities said that the change had not been adequately explained to pilots.
But in light of the Indonesian disaster, pilots have since been informed by Boeing and regulatory agencies of the Max’s new system, and airlines have provided training classes on it.
Boeing installed the system on the new 737s as part of the “control law” — commands issued by the plane’s flight-control computer that bypass the pilots. On the Lion Air flight, the swings up and down may have come about as pilots repeatedly tried to keep that system from pushing the nose of the aircraft down and putting it into a fatal dive. Whatever happened, the pilots lost their battle after about 12 minutes of flight.
Robert Stengel, an expert on flight control systems and a professor of engineering and applied science at Princeton University, said it was not clear whether the rocking trajectory of the Ethiopian jet was caused by a malfunctioning control system or pilots trying to fly the plane manually while distracted by some other, as yet unknown, emergency.
It is said that it was the determination by Boeing and the F.A.A. that pilots did not need to be informed about a change introduced to the 737’s flight control system for the Max, some software coding intended to automatically offset the risk that the size and location of the new engines could lead the aircraft to stall under certain conditions.
That judgment by Boeing and its regulator was at least in part a result of the company’s drive to minimize the costs of pilot retraining. And it may have left the Lion Air crew without a full understanding of how to address a malfunction that seems to have contributed to the crash: faulty data erroneously indicating that the plane was flying at a dangerous angle, leading the flight control system to repeatedly push the plane’s nose down.
Understanding how the pilots could have been left largely uninformed leads back to choices made by Boeing as it developed the 737 Max more than seven years ago, according to statements from Boeing and interviews with engineers, former Boeing employees, pilots, regulators and congressional aides.
Would the pilots would have responded differently if they knew the plane’s nose was being forced down specifically by MCAS?
Information from the flight data recorder shows that the Lion Air plane’s nose was pitched down more than two dozen times during the brief flight, resisting efforts by the pilots to keep it flying level. If MCAS was receiving faulty data indicating that the plane was pitched upward at an angle that risked a stall — and the preliminary results of the investigation suggest that it was — the system would have automatically pushed the nose down to avert the stall.
Boeing is said to have stated that the pilots on the next-to-last flight of the same Lion Air aircraft that crashed encountered a similar, if less severe, nose-down problem. They addressed it by flipping off the stabilizer cutout switches, in keeping with the emergency checklist. Indonesian investigators found, the pilots broke from the checklist by flipping the switches back on again before turning them off for the rest of the flight. That flight, with different pilots from the flight that crashed, landed safely.
Previous 737 designs
Older 737s had another way of addressing certain problems with the stabilizers: Pulling back on the yoke, or control column, one of which sits immediately in front of both the captain and the first officer, would cut off electronic control of the stabilizers, allowing the pilots to control them manually.
That feature was disabled on the Max when MCAS was activated — another change that pilots were unlikely to have been aware of. After the crash, Boeing told airlines that when MCAS is activated, as it appeared to have been on the Lion Air flight, pulling back on the control column will not stop so-called stabilizer runaway.
In preliminary results of the investigation, based on information from the flight data recorder, it was suggested that the pilots of the doomed flight tried a number of ways to pull the nose back up as it lurched down more than two dozen times. That included the activating of switches on the control yoke that control the angle of the stabilizers on the aircraft’s tail — and when that failed to stop the problem, pulling back on the yoke was the next step. It is said that there is no indication that the pilots tried to flip the stabilizer cutout switches, as the emergency checklist suggests they should have. Findings from the cockpit voice recorder could reveal in more detail what culpability, if any, rests with the Lion Air pilots.
Boeing’s position, that following the established emergency checklist should have been sufficient, understates the complexity of responding to a crisis in real time, pilots have said.
Referring to Boeing’s focus on the need for pilots to flip the stabilizer cutout switches, Dennis Tajer, the spokesman for the American Airlines pilots union and a 737 pilot, said, “They are absolutely correct: Turning those two switches off will stop that aggressive action against you.”
Mr. Tajer added, a pilot needs to know what systems are aboard so that they become “a part of your fiber as you fly the aircraft.”
What are your thoughts? Please share them with us.
My prayers go out to the families and the loved ones of those who perished on the planes that crashed.
After a Lion Air 737 Max Crashed in October, Questions About the Plane Arose, NY Times
Data and Voice Recorders Are Recovered in Ethiopian Airlines Crash, NY Times
Ethiopian Airlines Crash Updates: Holdout U.S. Grounds Boeing Plane, NY Times
A Simple Guide to the Aftermath of the Ethiopian Airlines Crash, NY Times
Ethiopian Airlines Plane Is the 2nd Boeing Max 8 to Crash in Months, NY Times
Max Flights Banned by U.S. After Other Countries Ground PlanesBoeing 737
, NY Times