CurtainTwitcher

Boeing made a deliberate design decision to NOT compare AoA signals or do any other processing of the data. The reasons has been fully documented on pprune.org and the Wall Street Journal, search for Rick Ludtke.
The bullet points are:

• Comparing AoA signals could generate a warning.
• AoA warning would be outside an iPad training path for 737NG--->737MAX and could possibly involve a simulator session.
• A simulator session would incur a $1 million penalty per aircraft for Southwest airlines.
• Boeing choose to categorise an uncommanded MCAS runaway as only "major" and not hazardous
• Therefore Boeing choose not compare AoA

The design failures between a single faulty AoA sensor and continuous MCAS activation have not been fully revealed.

WillowRun 6-3

On some distant sideline of the 40th ICAO Assembly, two very interesting events. One, a discussion with a rising, young leader of a Member State delegation, whose combined diplomatic and flight-training career exemplifies, by all accounts, how to get things in pilot training right - and though saying this ventures somewhat of an educated guess (I don't claim specific factual background knowledge) - getting things right within that country's system for training generally, not just her individually.
Second, a presentation by the DG of EUROCONTROL. In which the increasing role of automation was prominent.
Extraction of thread-related comment: as to the second event, the aviation safety ecosystem better get goin' on the advancement and refinement of the human factors subparts. Which aren't going away. Especially with the management and/or cultural issues laid bare at Boeing, and in the certification process.
As to the first, on one hand ICAO IATA ACI and the rest cheerily forecast large, large gains in traffic, and of course advocate for the capacity building needed to sustain it. But the pioneering spirit, and dedication, this young leader has needed to sustain just to establish a rightful place in international aviation diplomacy is telltale, perhaps. It reveals, I sometimes worry, that the flood of new pilots needed for that doubling of traffic will consist way too much of rote checklist types (to reiterate: the leader is highly well-trained) of any and all the many demographics involved. And saying, "oh you old weeping willow, don't fret none, it'll all be computerized." In Zuckerberg We Trust, I guess....thanks, but no thanks.

ST Dog

A bit out of order. The FHA said it was a major hazard so didn't need the comparison. That came first.

The AoA miscompare alert was already there* but MCAS didn't need to use it per the FHA. You don't just add stuff with no requirement and the FHA didn't support adding the requirement.

*I know the alert was not enabled. As discussed it was supposed to be. But again, it wasn't considered serious enough (FHA again) to rush the update.

fdr

Unfortunately, the design change from the original MCAS to the accident MCAS variant resulted in the hidden trim rate change, where the MCAS rate at high speed was much greater than the trim rate using the normal trim system by the pickle switches. That alone altered the potential impact of a failure, and if it had been evaluated in the sim it is reasonable to expect that the analysis would have increased the categorisation above major.

alf5071h

Tomaski

Not only that, but the designed run time for the MCAS input (9 seconds), far exceeded the assumed pilot reaction time to runaway trim (3 seconds). Yet there was no attempt to educate the pilots that some new system might be trying to activate the trim system for this length of time while at the same time bypassing the control column cutout switches. I realize with the new software that MCAS will only activate if both AOA's indicate an approach to stall, but this still seems very questionable from a design standpoint.

Grebe

FWIW from this SLF engine-ear

OK - but 9 seconds at .27= 2.43 degrees - Thats a lot- thats outrageous at almost any speed- welcome to significant negative G ...

But initial MCAS used described as .06 per second giving .54 degrees max or per activation - thats still a lot but apparently within ' allowable"

seems that the higher math involved was beyond the management involved...

Octane

"OK - but 9 seconds at .27= 2.43 degrees - Thats a lot- thats outrageous at almost any speed- welcome to significant negative G ..."

Not to mention at low level. A system that is unknown to the crew which aggressively and repeatedly tries to dive the aircraft at low level is insane and diabolical however which way people choose to look at it. Arguably, it is criminal..

All the rhetoric by some re pilot training/ incompetence/ error is just a smokescreen to cover the obvious. Poor management decision making/ leadership, poor aircraft design/ sloppy system design (MCAS), poor communication to Airlines/ pilots and complete fixation re the iPad training only mandate are among the causes of these tragedies.
Boeing designed a pig and the lipstick didn't work. The Swiss cheese had so many holes, it's not surprising they lined up..

CurtainTwitcher

These numbers telling, valid 1959 to 2017, as compiled by Boeing.

Source: Boeing Statistical Summary of Commercial Jet Airplane Accidents Worldwide Operations | 1959 – 2017


Another source, Airsafe.com has compiled 737-MAX departures at 0.65 million, and quotes a hull loss rate of 3.08 per million departures.


source: Airsafe.com Plane crash rates by model

Even more dramatic is the accident rate by phase of flight:




Source: Boeing Statistical Summary of Commercial Jet Airplane Accidents Worldwide Operations | 1959 – 2017

Tomaski

Actually, not terribly outrageous - if you are really, truly recovering from a low-speed stall. More likely than not, the aircraft winds up in the low-speed stall region because the pilots were not paying enough attention to the airspeed and either the pilot or the automation was putting in nose up trim to compensate. In this situation, the pilot has to lower the nose to break the stall, level the wings, apply power (potentially generating a big nose up moment), and aggressively trim nose down to put the stab back where it should have been in the first place. And this for pretty much any airliner I have flown.

That being said, it was still a terrible design to have an unknown "background" system input this much stab trim. Assuming the MAX does fly again, this large MCAS input will still be needed in an actual low-speed stall to address the control force issue at high AOA. Keep in mind that in an actual stall, MCAS is offsetting a lightening of the control forces, and not forcing the nose down. However, as I currently understand the system, when the pilots reduce the AOA to break the stall there would no longer be a nose up moment generated by the engine nacelles and the MCAS input would then effectively convert to a large nose down moment. That seems to imply that the pilots would not need to put in nearly as much nose down trim as they would in a 737NG stall recovery and would thus change the look and feel of the maneuver.

Octane

"That seems to imply that the pilots would not need to put in nearly as much nose down trim as they would in a 737NG stall recovery and would thus change the look and feel of the maneuver."

If that is so, it would contradict the whole rationale for the existence of MCAS in the first place..

Fly Aiprt

What about this "not and anti-stall device" thing, implying the MCAS is supposed to activate before a stall AOA is reached ?

Tomaski

First, a historical note - in the past, airliner stall avoidance training in the sim was directed at the "approach to stall" region. We never actual put the aircraft in the stall because 1) recognition and recovery prior to the stall was the objective, and 2) the sims were never programmed to simulate a full stall in the first place. Thus all the various stall-related warnings and system responses would actually kick in before a full stall was reached. In the aftermath of AF 447 the FAA mandated full-stall training, but that is just now coming on line due to the time required to gather accurate real world data and reprogram the sims.

The whole debate about whether MCAS is an "anti-stall" system is part semantic and part technical. If you browse through FAR Part 25, the particular section dealing with transport category aircraft certification, you will not find any requirement for an "anti-stall" system. On the other hand, you will find requirements for stability and control feel response as the aircraft approaches the stall. The only reason MCAS exists is to meet these requirements. It just so happens that in meeting these requirements, MCAS does assist with control and recovery through the approach to stall region - but technically it is not an "anti-stall" device. That being said, MCAS and a host of other warning indications and system responses in this area of the flight envelope do aid in the stall recovery and could be informally referred to as "anti-stall" devices. While they are technically correct, Boeing and their helpmates have not done themselves any favors by trying to win this technical argument with a largely non-technical audience.

Smythe

It was first set at 0.6 for the high speed departure and maneuvering issues, which is reasonable.

THEN, in flight testing, the there was low speed stall issues identified. This when MCAS was blindly changed to 2.5 degrees, (which is reasonable at low approach speeds) but not at high speeds.
The change was made apparently without regard to the flight conditions...

This is why you have 2.5 degrees at high speeds.

DaveReidUK

Out of interest, how likely is a high speed/high AoA combination to be encountered ?

lomapaseo

In actual fact? or what the computer that's flying thinks?

Fly Aiprt

Coffin corner ?

Tomaski

I would rate the most likely case would be an aircraft upset followed by an nose-low recovery at a speed approaching Va (max maneuvering). Not sure how often this sort of thing has happened in the real world, but the FAR certification requirement that drove the need for MCAS cannot be waived because the possibility of such an event is deemed unlikely.

Smythe

Wasnt it on DEP, where, at a certain point, the nacelles added lift and pushed it close to the stall envelope?

I thought it was on DEP when there was a climbing turn?

CurtainTwitcher

satcom Guru: 737 MCAS - Failure is an Option