How Safe is the Boeing 737 Max's MCAS System?

[cyboman]

I am not sure, but I always assumed that they had engineering degrees. I believe that most AF pilots have engineering degrees and test pilots are at the top. Their technical engineering skills might have gotten a little rusty because they worked with teems of full-time engineers who had all types of specialties. But they had a good working knowledge of the subjects. They certainly seemed smart enough and fit in perfectly. Their opinion was the one that managers really trusted and respected.

PS. A test pilot at a company like Boeing would have impressive credentials.

Right, I imagine the test pilots need that sort of vocabulary and understanding to communicate to the engineers the feedback they have. I guess as I think you and perhaps others have suggested, it seems surprising while testing stall scenarios that feedback about MCAS from the test pilots wouldn't of prompted direct changes to the system or annunciations, or at the least significant added training / sim time to deal with these scenarios when MCAS is active.

 

[Ken G]

And now this: "This is ridiculous," said Captain Dennis Tajer, a representative of the Allied Pilots Association, which represents 15,000 American Airlines pilots. "If you're going to have equipment on the airplane that we didn't know about, and we're going to be responsible for battling it if it fails, then we need to have hands-on experience."

The very fact that he described the situation as "battling" the features added to the MAX shows that the pilots do feel like it sounded to me as well. If someone is flying that plane with insufficient training, and something goes wrong, they end up feeling like the plane has a mind of its own and is trying to crash. What an awful feeling that must have been for those pilots who did not have the crucial information they needed, like a bad dream. How can Boeing explain not being more forthcoming with information about the MCAS, was it just carelessness or were they actively trying to slip something under the rug? I guess that's what the investigation will try to determine, but it's not clear which is worse, incompetence or deception. But if I had a family member on those flights, and was hearing what we're hearing now, I'd be irate.

 

[cyboman]

What an awful feeling that must have been for those pilots who did not have the crucial information they needed, like a bad dream.

Bad dream indeed. When you look at the vertical airspeed graphs, it would of been an absolutely terrifying experience, for both the crew and passengers.

 

[cyboman]

Take a gander at this:

It looks like there is perhaps a dangerous incentive to push the CoG aft as much as possible in order to "max"imize efficiency. However, the aircraft becomes less stable. Is this relevant to our discussion?

Also, pretty funny joke if you watch the entire video.

 

[FactChecker]

It looks like there is perhaps a dangerous incentive to push the CoG aft as much as possible in order to "max"imize efficiency. However, the aircraft becomes less stable. Is this relevant to our discussion?

Yes, it is relevant. Apparently, the engine position of the MAX changed and moved the CG so that the MCAS system was required for preventing a stall. There should be a mandated stability margin that would make a commercial airplane safe. The location of stored luggage is also a concern.

 

[jim hardy]

They must have test pilots who flew and evaluated all the new features -- both in piloted simulations with all scenarios and in test flights. I can't believe that they did not complain about a system that would ignore their inputs and fight them for such a long time.

The test pilots knew MCAS was there and to either switch it off or kill power to the jackscrew motor.

Apparently the Lionair and Erhiopian pilots did not.
https://jalopnik.com/a-pilot-who-bummed-a-ride-on-a-boeing-737-max-saved-the-1833441974

...it seems the very same plane narrowly avoided disaster the day before its crash, thanks to the input of an off-duty pilot who bummed a ridein the plane’s cockpit.

But the next day, staffed with a different crew that reportedly did not know how to respond to the malfunction, the same plane crashed into the Java Sea and killed all 189 people aboard.

Anyhow it goes to the basic idea of overconfidence in machine intelligence,
...see my signature.

Were i the "man behind the curtain" in that program
and i sensed pilot calling for a lot of up elevator after i'd just given him down trim
i'd back off my down trim
on the premise it's my job to assist him not think for him.

https://www.pprune.org/rumours-news...ware-fixes-due-lion-air-crash-delayed-16.html

Runaway(Stabilzer Trim-_jh! Stop and think what that's really meant to 737
pilots over time. Whrrr...Whrr... of the trim wheels
spinning away without input. EASY, we have a recall to
fix that.

This is DIFFERENT! Because of the component fault situation
AOA, the stick is shaking... a whole different and scary event,
especially because the plane seems to be in a routine flight
condition. Nobody would really notice that in such an unexpected
time the trim wheels are ever so discretely moving, and PAUSING...
due to inputs, but then relentlessly resuming their travel. Very
sneaky while a another perceived crisis is unfolding.

No reasonable person should just casually roll off their tongue,
This is a runaway stab, they should have selected cut out.

Was MCAS written by the same programmer who came up with Cortana ?

old jim

 

[berkeman]

Do you think any of the test pilots are actually engineers? I mean I guess that's being pretty idealistic. It just seems maybe that would help bridge a sort of cognitive gap.

Maybe software engineers...

https://www.cnn.com/2019/03/22/us/m...s-lion-air-ethiopian-airlines-intl/index.html

 

[FactChecker]

The test pilots knew MCAS was there and to either switch it off or kill power to the jackscrew motor.

I wonder if the test pilots flew it without the AOA indicators or the AOA mis-compare light. If a pilot doesn't have those, I wonder how long would it take to distinguish between a MCAS problem versus turbulance or other possible problems. I have trouble believing that the test pilots and pilot-vehicle-interface experts would approve of that situation.

 

[cyboman]

Maybe software engineers...

https://www.cnn.com/2019/03/22/us/m...s-lion-air-ethiopian-airlines-intl/index.html

View attachment 240646

Actually I think they need some good HCI software engineers moving forward. And ideally some that fly.

 

[cyboman]

The test pilots knew MCAS was there and to either switch it off or kill power to the jackscrew motor.

I wonder if they would of let the test pilots fly the plane first, without telling them specifically about MCAS. If it's purpose is to work flawlessly behind the scenes it appears that would make good sense. Have them induce 20 or 30 stalls under different scenarios, come back with their feedback, then brief them on what MCAS is doing.

Perhaps the'd be like, "Ohhh, I was wondering what the heck was going on! What's it called? MCAS? Well why the heck would you do that?"

I guess time will tell if the investigations make such internal conversations or disputes public.

 

[berkeman]

I wonder if they would of let the test pilots fly the plane first, without telling them specifically about MCAS. If it's purpose is to work flawlessly behind the scenes it appears that would make good sense. Have them induce 20 or 30 stalls under different scenarios, come back with their feedback, then brief them on what MCAS is doing.

Being a test pilot doesn't work like that. They want to know *everything* about a plane before test flying it. Have you not read any of Chuck Yeager's books?

https://images.gr-assets.com/books/1503287911l/1586034.jpg

 

[cyboman]

Being a test pilot doesn't work like that. They want to know *everything* about a plane before test flying it. Have you not read any of Chuck Yeager's books?

https://images.gr-assets.com/books/1503287911l/1586034.jpg

View attachment 240661

Nope. I've seen The Right Stuff and logged a ton of hours playing Chuck Yeager's Air Combat back in the day. Man I should try to fire that game up again. The audio would be hilarious now. It used the internal PC speaker I think.

Is that autobiography a good read?

 

[jim hardy]

Engineering skill doesn't equate with good pilot skills.

An engineer analyzing something needs the ability to focus in on one train of thought and follow it to a conclusion without getting distracted.
A pilot can't afford that degree of mental lockup - he has to keep situational awareness .

There are people like "Borderline-OCD-Me" .
I might make a decent Flight Engineer but I know better than to trust myself to maintain that presence of mind requisite for good piloting.
That's why i stayed in maintenance instead of operations .
I was a useful tool that operators could sic on a problem to get it fixed.
Their "Big Picture" grasp always amazed me, just as my knowledge of the instrument system details amazed them. I was the Details guy in that symbiotic relationship..

Eastern 401 is what happens when that "Mental Lockup" takes over a cockpit.

The crash occurred while the entire cockpit crew was preoccupied with a burnt-out landing gear indicator light. They failed to notice that the autopilot had inadvertently been disconnected and, as a result, the aircraft gradually lost altitude and crashed. It was the first crash of a widebody aircraft and, at the time, the second-deadliest single-aircraft disaster in the United States.[1][2]

You can't take psychology out of the picture.

Not saying an engineer can't make a good pilot, just it's not a given that he will.

old jim

 

[berkeman]

Is that autobiography a good read?

Yes, it's an excellent read, with many lessons to be learned. I had no idea how much work went into test flights before reading that book.

 

[cyboman]

Yes, it's an excellent read, with many lessons to be learned. I had no idea how much work went into test flights before reading that book.

Cool, I'll add it to my list. Cheers!

 

[cyboman]

Engineering skill doesn't equate with good pilot skills.

An engineer analyzing something needs the ability to focus in on one train of thought and follow it to a conclusion without getting distracted.
A pilot can't afford that degree of mental lockup - he has to keep situational awareness .

There are people like "Borderline-OCD-Me" .
I might make a decent Flight Engineer but I know better than to trust myself to maintain that presence of mind requisite for good piloting.
That's why i stayed in maintenance instead of operations .
I was a useful tool that operators could sic on a problem to get it fixed.
Their "Big Picture" grasp always amazed me, just as my knowledge of the instrument system details amazed them. I was the Details guy in that symbiotic relationship..

Eastern 401 is what happens when that "Mental Lockup" takes over a cockpit.You can't take psychology out of the picture.

Not saying an engineer can't make a good pilot, just it's not a given that he will.

old jim

Some good points. You need both the detail oriented and those that see the big picture. Perhaps airline companies also get so huge that like other companies some of the communications between all the different teams can become complex and breaks down. I hope these latest incidents result in both the airlines and the FAA taking a close look at how these things can be improved.

 

[cyboman]

I wonder if the test pilots flew it without the AOA indicators or the AOA mis-compare light. If a pilot doesn't have those, I wonder how long would it take to distinguish between a MCAS problem versus turbulance or other possible problems. I have trouble believing that the test pilots and pilot-vehicle-interface experts would approve of that situation.

This is what I reiterated in a recent post. I didn't realize you basically say it here.

What I'm wondering, is why is a test pilot having more information than they are providing to the actual pilots, at least initially for the first phases of test piloting. It would seem to me, they should recreate the exact scenario of a pilot flying the new plane for the first time. The test pilots should only be privy to what they plan on revealing / training / briefing the actual airline pilots. So they can see how the airliner pilots will interact with the new plane and it's changed systems and aerodynamics.

This appears to not be the case. Which seems nonsensical to me.

 

[jim hardy]

What I'm wondering, is why is a test pilot having more information than they are providing to the actual pilots, at least initially for the first phases of test piloting.

Oh c'mon.
You don't knowingly set a trap for a guy. That's videogame stuff not real life. What would you learn from a dead test pilot?
You ask him to evaluate "Is this thing manageable by the average bear?"

 

[cyboman]

Oh c'mon.
You don't knowingly set a trap for a guy. That's videogame stuff not real life. What would you learn from a dead test pilot?
You ask him to evaluate "Is this thing manageable by the average bear?"

You shouldn't be setting any traps for anyone if you're confident in your engineering. If you don't ask the test pilot to enter the exact same scenarios that you're going to ask your final client, which is an airline pilot, then you're not "testing" what a pilot could encounter.

 

[jim hardy]

I don't think i'd work in one of your test programs.

 

[cyboman]

I don't think i'd work in one of your test programs.

This is the inherent risk involved in test piloting.

 

[cyboman]

I don't think i'd work in one of your test programs.

In effect, this is the definition of a test pilot, they are going to take those risks (before the client or airline pilot has to), to show how a pilot interacts with those new systems and the changed aerodynamics of the craft.

 

[cyboman]

Oh c'mon.
You don't knowingly set a trap for a guy. That's videogame stuff not real life. What would you learn from a dead test pilot?
You ask him to evaluate "Is this thing manageable by the average bear?"

Much has been learned from many "dead" test pilots. It's not a risk free profession. It is a risk high profession. Outside of computer simulation (which didn't exist for a long time) we needed these brave souls to provide real "test" scenarios. And even now with simulation, we still need them, as much as we originally did. Because as much as we trust our simulations, the real deal - actual real flight experiments cannot be replaced by computer simulation.

 

[FactChecker]

Test pilots are not expendable; they are friends. Initial test flights would have everything to make it as safe as possible. There may be later test flights with the configuration as it would be sold. Professional pilot-vehicle-interface experts should work with pilots (many are pilots) to make sure that the final product is safe.

 

[PeterDonis]

What I'm wondering, is why is a test pilot having more information than they are providing to the actual pilots, at least initially for the first phases of test piloting.

Because the test pilot's job is not to simulate exactly what a normal pilot would experience. The test pilot's job is to test the airplane and all of its systems, not just under the conditions an ordinary pilot will experience, but out to the limits of the airplane's performance. The test pilot has to know more than an ordinary pilot, because the test pilot is going to do things to the airplane that an ordinary pilot will never do, and he has to understand what the plane is supposed to do during those things.

For example, in order to test MCAS, a test pilot would, I expect, be asked to simulate a failure of the AoA sensor (the test aircraft might have a special switch or button that provides the simulated failure input) and watch what happens. If he doesn't understand how MCAS works, he won't know if what's happening is what's supposed to happen based on how MCAS works. (In one of the online discussions I've seen on this, a test pilot was describing a typical test procedure for certifying stability trim--not specific to MCAS, but any stability trim system--and what he described was, first you introduce the failure, then you wait the prescribed time that the certification rules allow for an ordinary pilot to notice, then you check the instrument indications to see if they meet the certification criteria for identifying a failure, then if they do, you take the specified corrective action and see whether it does what it is supposed to do. There is no way to do this safely if the test pilot doesn't understand how the system works and how it might fail, so he can take the right action if the simulated failure does not lead to the right indications that an ordinary pilot would use to detect the failure.)

Once the test pilot is finished with that job, there will (or should) indeed be a time when non-test pilots, ordinary pilots, will be flying the plane to evaluate how an ordinary pilot experiences the plane. But that won't happen during "the first phases of test piloting". It will happen when that phase of test piloting is done. And the test pilot at that point might well be acting as an instructor for the ordinary pilots.

In short, as others have pointed out, test piloting is not supposed to be game between the test pilot and the engineers, to see whether the test pilot can figure out whether MCAS, or any other system, has failed.

 

[FactChecker]

In effect, this is the definition of a test pilot, they are going to take those risks (before the client or airline pilot has to), to show how a pilot interacts with those new systems and the changed aerodynamics of the craft.

A test pilot will be the first to fly a new, untested system. There are almost always surprises and problems that must be corrected. The flight tests are done in a very systematic, cautious, way so that every facet of prior test flights is understood before the next one is attempted. In fact, the first "flight" of a new airplane is usually just a high-speed taxi down the runway. Even on those tests, ugly surprises happen. A normal pilot of a commercial flight would not be expected to do anything experimental.

 

[Klystron]

Keep in mind that airplane manufacturers provide air frames to a variety of customers with different requirements. The end user specifies the deliverable within a wide range of options. An airline may decide not to install optional systems. A freight carrier might order "737's" without seats much less ancillary equipment such as supplementary oxygen. Certainly flight crew training falls under the purview of the customer to fit their requirements. Airlines also change and configure pilot checklists.

Airline "SA" might purchase every possible safety feature and mandate so many crew hours in full motion flight simulators including failure and inclement weather scenarios. Airline"EA" might not purchase what it considers redundant systems and mandate less simulator training to reduce costs. Airline "IA" might purchase minimalist or no upgrade systems and require minimum individual crew member training on part-task simulators. While the manufacturer strives to deliver safe maintainable aircraft, the end user bears responsibility for daily flying, maintenance, and training decisions.

 

[anorlunda]

Apparently, the engine position of the MAX changed and moved the CG so that the MCAS system was required for preventing a stall.

A TV talking head (sorry no link) says this is a consequence of the 737 (all 737s) having so little ground clearance. The newest most efficient engines have a larger fan diameter. They don't fit under the wing in the old position, so new pylons were designed to move the engines forward and up. That alters pitch torque.

We are voicing many opinions in this tread about how Boeing should design, but are we aware of the totality of the design complications and trade offs? I imagine an engineering report on these issues would require 300 or more pages to explain everything.

 

[gmax137]

Keep in mind that airplane manufacturers provide air frames to a variety of customers with different requirements. The end user specifies the deliverable within a wide range of options.

I think it goes further than this, with certain airlines being such big customers that they can "push" for certain attributes more basic than "options." Things like the new model must "feel" exactly like the previous models (so we don't have to re-qualify all of our pilots), or the height of the doors above the apron must be the same (so we don't have to re-adjust all of our gate equipment). The airline industry is fiercely competitive and every dollar a carrier can drop their ticket price is crucial to their survival.

 

[FactChecker]

We are voicing many opinions in this tread about how Boeing should design, but are we aware of the totality of the design complications and trade offs? I imagine an engineering report on these issues would require 300 or more pages to explain everything.

We do know that important indicators of AOA and AOA mis-compare were available for a price, so I think that the engineering solutions were available. Furthermore, even without 300 pages of analysis, I will go out on a limb and say that a system which would fight the pilot inputs for several minutes should raise some concern.

 

[cyboman]

Test pilots are not expendable; they are friends. Initial test flights would have everything to make it as safe as possible. There may be later test flights with the configuration as it would be sold. Professional pilot-vehicle-interface experts should work with pilots (many are pilots) to make sure that the final product is safe.

My intention wasn't to suggest the test pilots are expendable. Heavens no. I think I may have poorly communicated. It was more refuting that putting pilots in the same scenarios you're asking the client to be in while operating, shouldn't be considered unfair or dangerous. But I now see I'm not seeing the actual test pilot phases accurately. In the first experimental stages, they need to know everything. But perhaps later, in a different stage the craft will be tested under scenarios I've suggested. Where the test pilot (maybe wrong word), pilot is asked to fly the craft with the same knowledge final airline pilots will be equipped with, without any passengers on board (but perhaps the same weight, and potential slight changes in CoG during flight to simulate passenger movement somehow). Maybe some fancy Roombas with weights on them?

 

[cyboman]

Because the test pilot's job is not to simulate exactly what a normal pilot would experience. The test pilot's job is to test the airplane and all of its systems, not just under the conditions an ordinary pilot will experience, but out to the limits of the airplane's performance. The test pilot has to know more than an ordinary pilot, because the test pilot is going to do things to the airplane that an ordinary pilot will never do, and he has to understand what the plane is supposed to do during those things.

For example, in order to test MCAS, a test pilot would, I expect, be asked to simulate a failure of the AoA sensor (the test aircraft might have a special switch or button that provides the simulated failure input) and watch what happens. If he doesn't understand how MCAS works, he won't know if what's happening is what's supposed to happen based on how MCAS works. (In one of the online discussions I've seen on this, a test pilot was describing a typical test procedure for certifying stability trim--not specific to MCAS, but any stability trim system--and what he described was, first you introduce the failure, then you wait the prescribed time that the certification rules allow for an ordinary pilot to notice, then you check the instrument indications to see if they meet the certification criteria for identifying a failure, then if they do, you take the specified corrective action and see whether it does what it is supposed to do. There is no way to do this safely if the test pilot doesn't understand how the system works and how it might fail, so he can take the right action if the simulated failure does not lead to the right indications that an ordinary pilot would use to detect the failure.)

Once the test pilot is finished with that job, there will (or should) indeed be a time when non-test pilots, ordinary pilots, will be flying the plane to evaluate how an ordinary pilot experiences the plane. But that won't happen during "the first phases of test piloting". It will happen when that phase of test piloting is done. And the test pilot at that point might well be acting as an instructor for the ordinary pilots.

In short, as others have pointed out, test piloting is not supposed to be game between the test pilot and the engineers, to see whether the test pilot can figure out whether MCAS, or any other system, has failed.

This is a good explanation thanks. It helped me explain what I meant originally in the previous post I just made.

 

[cyboman]

Keep in mind that airplane manufacturers provide air frames to a variety of customers with different requirements. The end user specifies the deliverable within a wide range of options. An airline may decide not to install optional systems. A freight carrier might order "737's" without seats much less ancillary equipment such as supplementary oxygen. Certainly flight crew training falls under the purview of the customer to fit their requirements. Airlines also change and configure pilot checklists.

Airline "SA" might purchase every possible safety feature and mandate so many crew hours in full motion flight simulators including failure and inclement weather scenarios. Airline"EA" might not purchase what it considers redundant systems and mandate less simulator training to reduce costs. Airline "IA" might purchase minimalist or no upgrade systems and require minimum individual crew member training on part-task simulators. While the manufacturer strives to deliver safe maintainable aircraft, the end user bears responsibility for daily flying, maintenance, and training decisions.

I think it goes further than this, with certain airlines being such big customers that they can "push" for certain attributes more basic than "options." Things like the new model must "feel" exactly like the previous models (so we don't have to re-qualify all of our pilots), or the height of the doors above the apron must be the same (so we don't have to re-adjust all of our gate equipment). The airline industry is fiercely competitive and every dollar a carrier can drop their ticket price is crucial to their survival.

Alas, the plot grows ever thicker.

 

[cyboman]

Latest version of the "STAS Display":

I don't think this is necessary on every airliner. I suppose it also depends on where the existing trim angle feedback is. I think this display would be beneficial in the Max because there is a new system, MCAS and other autonomous systems commanding the trim. So in an emergency scenario, it could be beneficial for the pilot to be able to know that information about the stab without directing their attention away from the primary flight display and the cockpit window.

 

[cyboman]

I don't think i'd work in one of your test programs.

I'd like to apologize Jim. You're right, test pilots need to know everything about the changes to the craft, which is critical to the experimental maneuvering they will be commanding the aircraft. I didn't understand the definition and primary role of a test pilot, and such my statements were speculative and not accurate.