Boeing software fix for 737 Max

Factual Questions
61

A couple of additional data points to the above:

[ul]
[li]From a posting on airliners.net, quoting from the AA 737 flight manual (emphasis mine): * Manual stabilizer control is accomplished through cables which allow the pilot to position the stabilizer by rotating the stabilizer trim wheels. The stabilizer is held in position by two independent brake systems. Manual rotation of the trim wheels can be used to override autopilot or main electric trim. The effort required to manually rotate the stabilizer trim wheels may be higher under certain flight conditions.*[/li][/ul]

[ul]
[li]The maximum permitted airspeed of most models of B737 is 340 knots CAS (Calibrated Airspeed) or Mach 0.82, whichever is slower. At low altitudes CAS/IAS is about the same as true airspeed. 340 kts is less than 400 mph. Due to the power dives the Ethiopian flight was said to be doing close to 600 mph at the time the pilots were trying to operate the trim wheels – far far above its maximum rated airspeed in terms of dynamic pressure on the control surfaces.[/li][/ul]

62

The full preliminary report is now available. Best source I could find is the Washington Post, which allows you to download a PDF in addition to the web display.

63

It’s possible by the time they tried the trim wheel, airspeed made turning this by hand difficult or impossible. In think in some cases both pilot and co-pilot must flip out their handles and combine their strength.

If by that time they were pulling back on the yoke with both hands, they might not have had the time or strength to do that plus turn a trim wheel almost frozen by aero forces. It’s possible in desperaation they re-enabled stab trim to use the thumb switch to move the stabilizer electrically. I don’t know why that didn’t work. The preliminary report did not release data traces for the trim thumb switch.

64

They woudn’t have to use both hands to pull back on the yoke. It’s an artificial input and not a P-51 Mustang approaching mach 1. And we’re talking about 2 different systems, the MCAS and electrical trim. the MCAS is a computer that controls trim. Turning off MCAS does not turn off trim.

The MCAS is set up to reengage if interrupted by pilot induced trim. This is a flaw if it isn’t getting the right signal from the angle of attack indicator. It sounds like they never turned off the MCAS system and it continued to reengage until the trim of the horizontal stabilizer exceeded the elevator input of the pilots. At that point the only option would be to roll the plane 180 degrees and climb to altitude for another shot at getting control of the trim setting.

65

I don’t think your speculation is correct. “Turning off the MCAS” can mean a number of things – merely operating the electric trim buttons would do it temporarily – but the specific procedure that Boeing and the FAA set out as a response to MCAS pitching the nose down due to a faulty AOA sensor was to engage the STAB TRIM cutout switches. And the point is that this is exactly what the pilots are reported to have done, exactly in accordance with the recommendations and the runaway trim checklist.

The problem appears to have been that they were unable to operate the manual trim wheels because of the extremely excessive overspeed at that point, and consequent dynamic pressure on the horizontal stabilizer. This is speculation, but plausible given the details cited above. It also explains why the pilots appear to have re-enabled the electric trim: to be able to use the electric trim buttons again. But that also re-enabled the MCAS, which after five seconds of allowing the electric trim override, would have forcefully engaged the nose-down pitch again.

66

If the crew disabled the trim system instead of the MCAS then they very well could have disabled the one thing needed to quickly correct the situation. You can’t operate in a nose-down attitude for very long before things get out of control. Speed begins to increase immediately.

Maybe some aircraft engineers can explain this but I don’t understand why they’re not using accelerometers and pressure sensors to calculate impending stall situations.

67

Instructions to turn off the electric trim in an overspeed situation make no sense for the reasons you stated.

68

I agree that the flight info I’d seen prior to today suggested that the crew didn’t execute the runaway stab trim procedure, which would turn off the MCAS system. But the preliminary report released by the Ethiopian aviation authorities says that they did execute it.

The report doesn’t go into much detail about how they determined that the crew executed the procedure properly, but between the flight data recorder and the cockpit voice recorder, it should be pretty unambiguous. (Also, I only skimmed the report, so please correct me if the report explains this conclusion in detail).

Of course, it’s possible to flip the wrong switch and think you’ve executed the procedure when you haven’t, but the data recorder should cover that possibility. I’d love to hear what the NTSB and Boeing have to say about the stab trim procedure and whether the crash happened in spite of its proper execution. The Ethiopian authorities may well be in the same competence league as the NTSB, but they amount to a single sensor, if you will. I’m curious about whether the other two “sensors” agree with the first.

69

I admit I like this idea partly because the username/post content resonance is unusually strong.

But also: as skillfully executed as Chesley Sullenberger’s Hudson river ditching was, it was the clean, one-chance-only execution that was so impressive (at least to me). His decision to ditch in the Hudson was kind of obvious; if you’re climbing out of an NYC airport and suddenly lose both engines, you’re going down in a major urban area. The only control you really have is where you touch down and (to a slightly lesser degree) how hard. That’s why I’m calling a decision to ditch in the Hudson “obvious.” (And lots of obvious things become significantly less obvious in crises like that).

Ditching a plane in the water is always risky, and underwing engines don’t exactly help. Sullenberger chose the worst possible course of action available—except for all the others.

If Ethiopian 302 was not only diving but the angle of the dive was still increasing, then rolling until inverted might have worked (assuming enough altitude remained). If the pilot tried that and it did work, I suspect he’d have a movie deal waiting for him when he landed the plane. I mean, if it happened that way in a movie, it would be corny.

But if a roll to inverted flight prevented that crash, I imagine the pilot’s creative problem-solving would be regarded with the same reverence as that exhibited by the flight crew of UA 232, which essentially improvised and implemented the concept of flight control via differential thrust in real time.

Plus, they did this as they managed the aftermarh of a freak accident that started with an uncontained turbine disk failure and cascaded when fragments from the engine punched holes in all three redundant hydraulic systems, severing the connection between the pilot controls and the control surfaces. The crew had throttle authority over the remaining two engines, but I believe that’s about it. 112 people died, but the crew’s creativity saved the remaining 184 people on board.

I’m not a pilot, but I am an aerospace engineer. Maybe Magiver’s aerobatic-judo approach—if your plane insists on diving, roll until diving is climbing—is a well known concept among pilots. But if so, I’m not aware of it. Do any pilots with ATP, military or other relevant experience care to comment?

70

The short answer is that accelerometers and pressure transducers don’t work nearly as well for this as do several redundant angle-of-attack sensors. Of course, it seems that the 737 Max 8’s multiple AOA sensors weren’t configured to be redundant as that term is usually understood.

When you mention accelerometers, you’re probably referring to the plane’s inertial navigation system; it includes gyroscopes as well as accelerometers.

While INS systems are surprisingly capable, they drift over time, so they can’t be regarded as canonical. More importantly, while their position, orientation and velocity outputs are reasonably good relative to fixed points on the ground (at least before drift becomes a problem) they don’t tell you much about your orientation and velocity relative to the air around you, and it’s this latter information one needs to consider to detect a stall condition.

Pressure sensors are more helpful in some ways, and of course a pitot tube (which gives airspeed) is basically a pressure sensor designed for a very specific application. In theory, pressure sensors on the upper surface of the wing might detect a sudden pressure change, suggesting that flow has become detached near that sensor and a stall could be imminent.

But that’s a derived result…it’s inferred. Drivers often infer that their red traffic light has turned green because the cars around them start moving, but those cars could also just be trying to get out of the way of an emergency vehicle. The light probably turned green, but you really want to rely on the most direct result you have (seeing the green light yourself/detecting the AOA with a vane).

A properly functioning pressure sensor on a wing would likely pick up on buffeting due to crossing another aircraft’s wake or even just due to turbulence. The data would be noisy and you’d need lots of signal processing and lots of pressure sensors scattered over the plane in order to reliably detect a stall.

Meanwhile, an AOA vane picks up on these things much more directly, and with fewer spurious inputs than a pressure sensor would see. Plus, if your pitot tube is iced over and so can’t give you your airspeed because it’s iced over, you could theoretically use an AOA vane’s output to get a rough feel for your airspeed: if you’re lucky enough to be able to see the horizon and know you’re flying straight and level, a pivoting vane will tend to droop a little as airspeed falls.

I don’t know whether any avionics manufacturer uses AOA vanes this way, but it would be better than nothing under certain circumstances. You could also use the ram-air turbine (RAT) in a similar way.

71

when they were first dealing with the sound barrier pilots sometimes found themselves with controls that reversed.

Rolling an airliner is absolutely the last desperate act of a bad situation. There was at least one case where the elevator went full up and froze. The pilot had to make continuous turns in order to keep the plane from stalling in climb. they almost made it but could not judge the runway and lost control of it. It was a controlled crash that started a fire.

As for rolling a large plane, it’s been done. That’s how the military version of the 707 was demonstrated. A pretty gutsy move considering it was the early days of jet airlines and de Havilland had lost 2 passenger jets to unknown structural failure.

72

the accelerometer in my phone seems to work pretty well. I can mount it in the plane and use it to replicate many of the gauges. Even if it’s not perfect it should be consistent. And in this instance the idea is to recognize a nose-up attitude that will eventually lead to an engine induced pitch-up situation.

when I saw an image of the sensor my first thought was of all the bugs and crap I’ve scraped off the wings and fuselage of my plane. It wouldn’t take much to jam that thing with a bird or a mud wasp nest.

73

I think you are confusing two things. The “accelerometer” in your phone is only used for measuring the direction of gravity, i.e. the orientation of the phone relative to “down”. All it is is an electronic plumb bob. This isn’t very useful in an aircraft. It won’t even detect that the aircraft is banking.

An accelerometer could also measure position by taking the double integral of acceleration. That is, it senses the forward acceleration, and figure out how far you moved forward. That takes a whole lot more accuracy and precision than simply measuring the direction of gravity. An accelerometer designed for this application is called an IMU (inertial measurement unit). Your phone doesn’t have that.

Your phone also has a gyroscope. Which is how it can stitch a panoramic photo as you rotate your phone, for example. Of course airplanes already have that.

Angle of attack is not the attitude. It’s the relative angle between the attitude and the airflow. An aircraft with the nose pitched up and climbing is not stalled. An aircraft with the same nose-up angle but moving downward is in a stall.

74

My phone can display a turn and bank indicator. so whatever combination of accelerometer and gyroscope used it works. Or at least it displays something that appears to work. I’ve never tested it against a real gauge so I don’t know how close it gets. Logic dictates that if it were that easy they would do it.

The other thought I had is to fix a small wing surface to the fuselage at an angle that will provide a stall indication ahead of the engine nacelle lift.

75

A few points, mainly in response to Magiver.

  1. Yes you do have to use lots of physical strength to pull back on the control column at high speed. Yes the feel is artificial, but it is specifically designed to be very difficult to pull at high speeds and at high angles of attack so that you can’t accidentally exceed the g limits and so that you have a good feel for approaching stall. Artificial feel does not mean it feels like a computer joystick, it means feedback is generated artificially to make it physically difficult to over-stress the airframe while also being “nice to fly” while g-loading/speed is in the normal range. Something as simple as a “g-weight” can be used to make it very difficult to pull the column back when the g loading is near the limit. It’s just a weight attached to the elevator circuit. G forces make the weight heavier which increases the effort required to move the column.

  2. Yes MCAS is a system that uses the trim but there is no way to disable the MCAS other than disabling the electric trim. You are then left with the mechanical trim wheel which can be very difficult to use at high speeds if the aircraft is not already approximately in trim. See number 4.

  3. The investigators know the MCAS was disabled via the trim cutout switches because the FDR shows the MCAS sending AND (aircraft nose down) trim demands to the trim but the trim didn’t respond, therefore trim was disabled.

  4. No you can’t just roll an airliner on its back and push forwards to gain altitude. Sure you can roll one given enough speed and altitude but rolling while maintaining positive g is nothing like flying inverted with negative g. If you want a heroic move that may have saved ET302, try reading this PPRuNe thread. Centaurus is a B737 sim instructor with Ansett in Melbourne, Australia, a bit old-school but very knowledgeable and experienced nonetheless.

  5. AoA vanes are used because they are simple and reliable. Boeing’s problem wasn’t that they used AoA for MCAS, it’s that they didn’t bother to have a voting system. The jet already has two vanes, all Boeing had to do was require both of them give a high AoA signal in order for the MCAS to kick in. AoA vanes have flown a gazillion airline miles with very few serious incidents, there is no need to reinvent the wheel with regards to measuring AoA.

76

Some relevant bits from the prelim report quoted below (my bold):

To me, the report indicates the crew initially acted in accordance with the appropriate procedure but probably didn’t have the situational awareness or depth of knowledge to finesse it. For example prior to engaging the TRIM CUTOUT their life would have been a lot easier (and longer) if they had first completely counteracted the MCAS trim with the trim thumb switches. They also may have been better placed if they’d reduced thrust, BUT reducing thrust would drop the nose which would require more nose up trim to counter.

They did the best they could with the tools Boeing had given them.

77

Thanks for addressing my questions and for that link…I appreciate it.

One question: I’ve heard flying inverted with negative g is pretty uncomfortable, but you seem to be alluding to something more substantial than that. Am I being dense? Could you elaborate a bit?

This was more succinct than my post and probably clearer as well. Cheers!

Some staircase wit (well, thoughts) on AOA vanes: they use the same cutting-edge technology as weather vanes. If you want a more reliable AOA sensor, you’ll need to come up with a more reliable weather vane, and that’s not easy.

78

I do not fully understand what “direct law” is but I have a question about it. Would going to “direct law” (if possible for that jet configuration) have enabled the pilots of the Ethiopian or Lion Air jets to ward off the MCAS actions and possibly save their aircraft??

79

Is there any reason why a trim wheel would be designed to be inoperable at certain speeds? I understand that that jet was traveling at an improper speed but if it is physically possible to travel at that speed shouldn’t it be physically possible to turn the trim wheel in order to regain control of the aircraft?’

I look at pictures of trim wheels. They didn’t look designed to be able to be turned with any great force (I guess on a non-FBW jet because a FBW is only sending electrical signals to a servo motor???).

80

I think I read somewhere that Boeing didn’t require both vanes to activate MCAS because of (the usual) the extra cost.

Are both vanes on a 737MAX normally functioning and sending to the flight crew? If so, wouldn’t it be only a matter of software programming to have MCAS get info from both vanes instead of just one?