\n<\/p>\n
THE AOA PROBLEM<\/strong><\/p>\n WHAT WE CAN DO ABOUT IT\u00a0<\/strong><\/p>\n \u00a0 \u00a0\u00a0<\/strong><\/p>\n By Captain Shem Malmquist<\/strong><\/p>\n AN FSI COMMENTARY<\/strong><\/p>\n The following is based only on an analysis and implications of the FAA airworthiness directive (AD) issued in the wake of the accident and is not intended to be speculative on the accident itself. Other factors unknown to me may be involved.<\/strong><\/p>\n \u00a0 \u00a0 \u00a0 \u00a0In the wake of the October 29 Indonesian crash of a brand new Boeing 737 MAX 8 that took the lives of 189 passengers, the FAA has issued\u00a0Emergency Airworthiness Directive (AD) 2018-23-51. The 737 is the most widely flown aircraft in the world, This tragedy opens an important conversation between regulators, operators and pilots.<\/p>\n \u00a0 \u00a0 \u00a0 Lion Air, an experienced 737 operator, was the launch carrier last year for the 737 MAX 8 and the MAX 9 in March. While it will take a long time to analyze the Lion Air 610 accident, the AD points out that current system architecture has created vulnerabilities.<\/p>\n \u00a0 \u00a0 \u00a0 Anyone who flies modern jet aircraft, as I do, also knows that in some ways this conversation applies to every plane and every pilot. Attempts to assign blame to anyone at any point in this investigation sidesteps a much more important issue, one that is the essential to the future of ever more automated cockpits.<\/p>\n \u00a0 \u00a0 \u00a0As described in the Seattle Times,\u00a0\u201cThe system called MCAS, for\u00a0Maneuvering Characteristics Augmentation System, is activated when a sensor on the side of the fuselage indicates a dangerously high angle of attack (AOA), the angle between the air flow and the wing.<\/p>\n \u00a0 \u00a0 While the Seattle Times article incorrectly implies that the system is based on speed or \u201chigh stress on the air frame, \u201d the system description appears to be essentially correct. Low airspeed or a higher load factor (which can occur in a steep turn or pull up from a dive) are among the possible reasons the angle of attack can approach a stall.<\/p>\n \u00a0 \u00a0 As with erroneous airspeed or altitude readings, the loss of the sensor itself leads to loss of secondary systems and\/or can trigger other warning systems. Even on the most advanced state of the art aircraft there is no direct feedback to the pilots when the AOA sensor itself has failed. Pilots must quickly infer a faulty AOA sensor from other faults or indications.<\/p>\n \u00a0 \u00a0 Underlying this problem is the fact that a computer software system does not \u201cfail\u201d like a mechanical system.\u00a0 It can be incorrectly coded, or it can be incorrectly designed, but the system does not \u201cfail\u201d like a turbine blade that rips apart in flight. Generally, what we see is that the software was coded correctly based on the requirements provided to the people coding the software but the problem lies in the requirements and specifications provided to them. If a certain scenario was not considered in the requirements it is unlikely to find its way into the final computer coding.<\/p>\n \u00a0 \u00a0 The AD describes an emergency scenario where a sensor reads an erroneously high AOA and the software reacts as its designers intended. The software responds to the erroneous indication in a manner similar to the way a human might react.\u00a0However, all the pilot sees is the final result. How the computer came to take an action is opaque.\u00a0 This makes it very difficult to crosscheck the computer\u2019s process model (decision making process).<\/p>\n \u00a0 \u00a0 As\u00a0Boeing and the FAA AD explain, the bad AOA sensor leads to several problems. The erroneously high indication of AOA first leads to an autopilot disconnect. The system then works to prevent a stall by adding nose-down trim.\u00a0 So how does this affect the process model (mental model) for the pilots?<\/p>\n \u00a0 \u00a0 It is standard in the Boeing aircraft that the stabilizer trim can be stopped by moving the control column in the opposite direction. Aircraft designers assume that no pilot would intentionally trim the aircraft nose up while also pushing forward on the controls to pitch the aircraft down or vice versa.<\/p>\n \u00a0 \u00a0 This gets a lot more complicated when you consider how the FAA defines a stall condition for a transport category airplane (adapted from Title 14 CFR 25.201):<\/p>\n Full stall condition \u2013 any one, or combination, of the following:<\/p>\n \u2013\u00a0\u00a0\u00a0\u00a0A nose-down pitch that cannot be readily arrested, which may be accompanied by an uncommanded rolling motion<\/p>\n \u2013\u00a0\u00a0\u00a0\u00a0Buffeting of a magnitude and severity that is a strong and effective deterrent to further increase in angle of attack<\/p>\n \u2013\u00a0\u00a0\u00a0\u00a0The pitch control reaches the aft stop for 2 sec and no further increase in pitch attitude occurs when the control is held full aft, which can lead to an excessive descent rate<\/p>\n \u2013\u00a0\u00a0\u00a0\u00a0Activation of a stall identification device (e.g., stick pusher)<\/p>\n \u00a0 \u00a0 As can be seen, the condition described in the AD would present at least two of the criteria. First is the \u201cnose-down pitch that cannot be readily arrested\u201d (because the pilots were not previously aware that the system was intentionally doing that due to the erroneous sensor) and second is the \u201cactivation of a stall identification device,\u201d in this case, a stick shaker, also due to the same erroneous sensor.\u00a0The pilot could effectively be misled as to what is actually going on by the software system.<\/p>\n \u00a0 \u00a0 The AD also implies that it is possible that the trim cutout switches (guarded switches that disconnect electrical power from the trim system) may not work, stating:<\/p>\n \u201cIf relaxing the column causes the trim to move, set stabilizer trim switches to CUTOUT. If runaway continues, hold the stabilizer trim wheel against rotation and trim the airplane manually.\u201d<\/p>\n \u00a0 \u00a0 Pilots are often our own worst enemy, with some contending that the situation should have been obvious, the aircraft attitude was nominal and airspeed normal. Such Monday morning quarterbacking suggests hindsight bias. The pilot placed in the middle of this situation does not have the benefit of knowing the outcome. They see the aircraft pitching down and are getting a stall warning.\u00a0\u00a0\u00a0\u00a0\u00a0There has been considerable emphasis on stall recovery in the wake of the Air France 447 accident. In the aftermath of that training, pilots are being trained that a stall in a transport airplane is not always apparent nor do all stalls provide the kind of cues pilots might expect based on previous experience. Simulators are not able to fully replicate a real stall in a transport airplane, hence the training emphasizes respecting the stall warning system.<\/p>\n \u00a0 \u00a0 Of course this creates a new quandary. Consider a crew who incorrectly believes they are in a stall situation analogous to the Air France 447 accident, with the nose attitude at a nominal state but the actual AOA is quite high. They might try to recover by pushing over.\u00a0In other words, the system is tricking the pilot into believing they might be in a non-existent deep stall. Absent any flight deck indication that the information they are relying on is wrong, it would be difficult to pass judgment on a pilot that is following their training.<\/p>\n \u00a0 \u00a0 Perhaps we need to consider adding a flight display alert that prominently shows an AOA failure with a mismatch AOA alert. This approach would parallel similar alerts for airspeed or altitude indication failures.\u00a0 Accomplishing this would be fairly straight forward. Most transport airplanes have at least two, sometimes three, AOA vanes and sensor systems. A system such as outlined by Ossmann and Joos (2017) would be one possible solution:<\/p>\n \u00a0 \u00a0 Such an alerting system would provide the pilots with the information they need to disconnect flight computers or other actions as appropriate. This should be combined with ensuring pilots understand all of the functionality of the system so they would recognize all a particular sensor failure might impact.<\/p>\n \u00a0 \u00a0 Every flight depends on pilots to \u201cfix\u201d problems that designers did not anticipate, be they in aircraft design, procedures or the entire system design.\u00a0 Give the pilot the information and skills to do that. Give the pilot information that the system has an erroneous input via its sensing system.<\/p>\n