Advertisement

Blog

Boeing MAX 8: Technological advances and pilot training

I live very close to Luke Air Force Base in Litchfield, AZ. F-35s fly over my home every day. I have met some of the young pilots flying these electronic aircraft in the local supermarket (See my EDN article on the F-35 here) These “kids”, but I must clarify—very talented and well-trained “kids”, were not too long ago playing action video games with advanced joysticks. This “training” has prepared the new generation of pilots to fly electronically-enhanced aircraft like the F-35 with a skill that has never before been seen. Boeing’s new 737 Max 8 is an electronically-enhanced aircraft, not anywhere near the high tech of an F-35, but still has far more electronic control and complexity than something like an “auto pilot”.

In light of the two recent tragic air crashes and the tragic loss of life on Ethiopian Airlines and Lion Air, we are all trying to make sense of what happened. I actually flew on the 737 Max 8 a couple of times and had no second thought about safety. It is too early to know what actually happened right now, but my ‘gut feel’ as an Electronics Engineer tells me that the need for more adequate and intensive pilot training is a strong possibility. Again, I do not say that is actually the cause, but in my experience, training on new electronic systems needs to typically be intense.

Food for Thought: Much of the following has been taken from NY Times articles to enhance this discussion:

MCAS

The 737 Max 8 has a new Maneuvering Characteristics Augmentation System (MCAS) which is an automated safety feature on the 737 Max 8 designed to prevent the plane from entering into a stall, or losing lift.

MCAS was introduced by Boeing on the 737 Max 8 because of the heavier, more fuel-efficient engines that have changed the aerodynamic qualities of the workhorse 737 aircraft and can cause the plane's nose to pitch up in certain conditions during manual flight. Angle of attack sensors on the aircraft notify the MCAS to automatically point the nose of the aircraft down if it is in danger of going into a stall. This is achieved through horizontal stabilizers on the aircraft's tail which are activated by the aircraft's flight control computer.

According to Boeing, MCAS does not control the plane during normal flight but “improves the behavior of the airplane” during “non-normal” situations. The “non-normal” situations could be steep turns or just after takeoff, when the aircraft is climbing with flaps up, at speeds that are close to stall speed.

Lion Air Flight recorder

Data from the flight data recorder of Lion Air Flight 610, indicates that the pilots struggled to control the aircraft as the automated MCAS system repeatedly pushed the plane's nose down following takeoff. The pilots of the Ethiopian Airlines aircraft reported similar difficulty before the aircraft plunged into the ground shortly after takeoff.

It is said that after the Lion Air crash, Boeing issued a bulletin, to airlines operating the 737 Max 8, advising pilots how to override the MCAS system. Boeing also said it was working on software updates to the MCAS system which would be deployed across the 737 Max fleet. The company said procedures already exist to “safely handle the unlikely event of erroneous data coming from an angle of attack (AOA) sensor.” “The pilot will always be able to override the flight control law (MCAS) using electric trim or manual trim,” Boeing said.

Stabilizers

An added piece of the puzzle is that the stabilizers on older models could have moved in unpredictable and dangerous ways as well, because of factors like electrical shorts, bad sensor data or computer problems. Boeing reasoned, according to people the company has briefed, as well as a bulletin it sent airlines after the crash, that the emergency procedure for malfunctioning speed trim and other stabilizer problems on the earlier 737s would work on the Max for problems related to MCAS as well.

The main body of that procedure is to switch off two “stabilizer trim cutout” switches on the central console of the cockpit, and then flip open the handles on wheels near the knees of the captain and first officer. By cranking those wheels, the pilots can adjust the stabilizers manually in an effort to keep the plane from pitching up or down.

Theories

In the Lion Air crash, one of the primary theories is that the system was receiving erroneous data about the angle of the plane from what is known as an angle of attack sensor. These are vane-like devices on either side of the fuselage which measure to what degree the plane’s nose is pointing upward or downward. Preliminary findings from the investigation suggested that the sensor on the pilot’s side of the plane was generating erroneous data.

It is said that in designing the 737 Max, Boeing’s design decision was to feed MCAS with data from only one of the two angle of attack sensors at a time, depending on which of two, redundant flight control computers — one on the captain’s side, one on the first officer’s side — happened to be active on that flight. That decision kept the system simpler, but may have possibly left it vulnerable to a single malfunctioning sensor, or data improperly transferred from it — this is reported to occur on the day of the crash.

Pilot training and information

Boeing updated the software for the flight control system. After the Lion Air crash, some American aviation authorities said that the change had not been adequately explained to pilots.

But in light of the Indonesian disaster, pilots have since been informed by Boeing and regulatory agencies of the Max’s new system, and airlines have provided training classes on it.

Boeing installed the system on the new 737s as part of the “control law” — commands issued by the plane’s flight-control computer that bypass the pilots. On the Lion Air flight, the swings up and down may have come about as pilots repeatedly tried to keep that system from pushing the nose of the aircraft down and putting it into a fatal dive. Whatever happened, the pilots lost their battle after about 12 minutes of flight.

Experts speak

Robert Stengel, an expert on flight control systems and a professor of engineering and applied science at Princeton University, said it was not clear whether the rocking trajectory of the Ethiopian jet was caused by a malfunctioning control system or pilots trying to fly the plane manually while distracted by some other, as yet unknown, emergency.

It is said that it was the determination by Boeing and the F.A.A. that pilots did not need to be informed about a change introduced to the 737’s flight control system for the Max, some software coding intended to automatically offset the risk that the size and location of the new engines could lead the aircraft to stall under certain conditions.

That judgment by Boeing and its regulator was at least in part a result of the company’s drive to minimize the costs of pilot retraining. And it may have left the Lion Air crew without a full understanding of how to address a malfunction that seems to have contributed to the crash: faulty data erroneously indicating that the plane was flying at a dangerous angle, leading the flight control system to repeatedly push the plane’s nose down.

Understanding how the pilots could have been left largely uninformed leads back to choices made by Boeing as it developed the 737 Max more than seven years ago, according to statements from Boeing and interviews with engineers, former Boeing employees, pilots, regulators and congressional aides.

Would the pilots would have responded differently if they knew the plane’s nose was being forced down specifically by MCAS?

Information from the flight data recorder shows that the Lion Air plane’s nose was pitched down more than two dozen times during the brief flight, resisting efforts by the pilots to keep it flying level. If MCAS was receiving faulty data indicating that the plane was pitched upward at an angle that risked a stall — and the preliminary results of the investigation suggest that it was — the system would have automatically pushed the nose down to avert the stall.

Boeing is said to have stated that the pilots on the next-to-last flight of the same Lion Air aircraft that crashed encountered a similar, if less severe, nose-down problem. They addressed it by flipping off the stabilizer cutout switches, in keeping with the emergency checklist. Indonesian investigators found, the pilots broke from the checklist by flipping the switches back on again before turning them off for the rest of the flight. That flight, with different pilots from the flight that crashed, landed safely.

Previous 737 designs

Older 737s had another way of addressing certain problems with the stabilizers: Pulling back on the yoke, or control column, one of which sits immediately in front of both the captain and the first officer, would cut off electronic control of the stabilizers, allowing the pilots to control them manually.

That feature was disabled on the Max when MCAS was activated — another change that pilots were unlikely to have been aware of. After the crash, Boeing told airlines that when MCAS is activated, as it appeared to have been on the Lion Air flight, pulling back on the control column will not stop so-called stabilizer runaway.

In preliminary results of the investigation, based on information from the flight data recorder, it was suggested that the pilots of the doomed flight tried a number of ways to pull the nose back up as it lurched down more than two dozen times. That included the activating of switches on the control yoke that control the angle of the stabilizers on the aircraft’s tail — and when that failed to stop the problem, pulling back on the yoke was the next step. It is said that there is no indication that the pilots tried to flip the stabilizer cutout switches, as the emergency checklist suggests they should have. Findings from the cockpit voice recorder could reveal in more detail what culpability, if any, rests with the Lion Air pilots.

Boeing’s position, that following the established emergency checklist should have been sufficient, understates the complexity of responding to a crisis in real time, pilots have said.

Referring to Boeing’s focus on the need for pilots to flip the stabilizer cutout switches, Dennis Tajer, the spokesman for the American Airlines pilots union and a 737 pilot, said, “They are absolutely correct: Turning those two switches off will stop that aggressive action against you.”

Mr. Tajer added, a pilot needs to know what systems are aboard so that they become “a part of your fiber as you fly the aircraft.”

What are your thoughts? Please share them with us.

My prayers go out to the families and the loved ones of those who perished on the planes that crashed.

References

After a Lion Air 737 Max Crashed in October, Questions About the Plane Arose, NY Times

Data and Voice Recorders Are Recovered in Ethiopian Airlines Crash, NY Times

Ethiopian Airlines Crash Updates: Holdout U.S. Grounds Boeing Plane, NY Times

A Simple Guide to the Aftermath of the Ethiopian Airlines Crash, NY Times

Ethiopian Airlines Plane Is the 2nd Boeing Max 8 to Crash in Months, NY Times

Max Flights Banned by U.S. After Other Countries Ground PlanesBoeing 737

, NY Times

9 comments on “Boeing MAX 8: Technological advances and pilot training

  1. Bob_D
    March 14, 2019

    Great article Steve with great insight. Training, training, training!

  2. Steve Taranovich
    March 16, 2019

    Check out this link http://www.b737.org.uk/mcas.htm

    It looks like a valid site. Please let me know what you think?

     

    To me, I still say that more intensive training is needed on this kind of aircraft and lots of simulator time. And where is the big, glaring “ON/OFF” switch to activate manual control? Although, you should not need that with adequate training before a pilot actually flies this aircraft

  3. UD-00001
    March 18, 2019

    These crashes remind me of the Lufthansa Flight 2904 crash at Warsaw (1993)
    ( https://en.wikipedia.org/wiki/Lufthansa_Flight_2904 ) plus some other crashes that could be backtracked to automated systems with less-than-optimum requirements specifications.

    We'll all be able to see the outcome of the recent crashes…

  4. DaveR1234
    March 18, 2019

    This is the best article I've read on the subject.  I think 99% of the fault lies with Boeing.  They took away the usual method of disabling the automated stabilizer, pulling on the stick, for no good reason.  1% for the pilot for not remembering the new method.

  5. Finleythewombat
    March 20, 2019

    Three thoughts:

    1) Commercial flight procedures need a complete re-think. A pilot isn't necessarily going to have encyclopedic knowledge of these increasingly-complex aircraft, so he needs access to something like the Mission Control team associated with spaceflight, and they in turn need access to his aircraft telemetry. From the preliminary reports, it seems the accident was an “SCE to aux” scenario (read about that here: https://en.wikipedia.org/wiki/John_Aaron) that might have been averted if the pilot had had instant access to expert technical support.  

    2) Aircraft designers seem to be ignoring the most basic rules of design. If you're going to implement redundant systems, then you need THREE (in this case three angle-of-attack sensors). Two is pointless, because in the event of failure, you don't know which one is malfunctioning. Related to that, they're not asking: what's the worst that can happen if this fails? 

    3) The system under discussion strikes me as pointless. Aircraft have been fitted with stall warning systems since forever. Why close the loop? Give the pilot the warning, and let him make the decision.

     

     

  6. Tom Maz
    March 20, 2019

    Since the MAX 8 is an upgrade to the venerable 737, many foreign airlines have decided that intensive training is not required in the new aircraft.  This will, I believe, be a reason that the final verdict will be largely attributed to pilot error.  

    The MCAS can be disabled if the pilots decide it is not performing correctly – the Lion Air incident the day before the crash shows this.  Apparently a third pilot who was 'dead heading' was in the cockpit, and told the pilots what was happening.  They made the correct decisions and prevented a crash.  This detail was not included in the official writeup of the accident, but was published within the last 24 hours.  No details on the third pilot were made available, but he either had been properly trained, or had an incident himself and so knew what to do.

    The MCAS is an integral part of the airplane, so the pilots MUST be trained on it and learn it in order to fly safely.  While planes are getting more complex they are still understandable by those who are properly trained.

     

     

  7. formationinfo
    March 20, 2019

    Great article, but I got a question:

    what does it meant that a specific country blocks the Max 8 flights in his territory?

    Does this include international routes that fly above that country?

    thanks,

  8. David Ashton
    March 20, 2019

    A lot of good comments above.  Bad design, using 2 sensors rather than 3, remove the usual method of disabling the MCAS, not taking into account airspeed as an additional stall warning….and insufficient training of pilots on a new and very different system.

    Comes back to the old saying.  “To err is human, to really stuff things up takes a computer.”

    The computer REALLY stuffed up here….

     

  9. DavidHamilton
    April 3, 2019

    The tragedies were really devastating but hopefully they can become a learning point to improve every single aspect of flying the affected boeing series. In my personal opinion, I do believe lack of crucial training influenced the outcome of the past incidences and future courses need to be more intense. This isn't solely about knowing how to fly an aircraft, but it is also knowing what to do should an emergency situation happens again.

Leave a Reply