32
$\begingroup$

Recently we've had the 737-MAX debacle, where it increasingly appears that the MAX on-board MCAS system repeatedly would issue nose-down events, leading to the Lion Air crash, and possibly another

On the Lion Air flight, when the MCAS pushed the jet’s nose down, the captain pulled it back up, using thumb switches on the control column. Still operating under the false angle-of-attack reading, MCAS kicked in each time to swivel the horizontal tail and push the nose down again.

Apparently there is a notification light for MCAS that was an optional package but will now be required.

It reminds me of two other incidents that lead to crashes

  1. Air France 447 A330 - A frozen pitot tube caused the computer to switch to Alternate Law 2, which meant that the computer would no longer prevent dangerous flight inputs. While not the same as the MCAS issue, it lead to confusion of the cockpit crew (who had been making maximum nose-up inputs while at TOGA power), and thus the plane crashed due to stall. It was noted that there was nothing direct to alert the pilots that the switch had occurred.
  2. Scandanavian Air 751 MD81 - Ice accumulated on the wings. When the plane took off, the ice fell off, striking the engines. The pilots noted the engines were surging and reduced the throttle, but an auto-throttle system not disclosed to the pilots kept increasing power back to full, thus causing engine failure and a crash landing.

Has anyone ever stated why aircraft systems are allowed to make changes without notifying the pilots? Is it something that just hasn't been a large enough problem to address until now?

Improve this question
$\endgroup$
8
  • 33
    $\begingroup$ The AF447 flight had an alternate law indication available to the pilots, as well as many other (too many in fact) warnings that caused further confusion. In automation systems, the key is to present the appropriate information without overwhelming the operator with too many conflicting or confusing warnings. AF447 showed that a pilot in the face of too much information will ignore everything the system is telling them and fly with how they think the aircraft should be flown. $\endgroup$
    – Ron Beyer
    Commented Mar 25, 2019 at 15:45
  • 8
    $\begingroup$ For most modern aircraft, it is a design feature that some intervention is invisible to pilots. The rudder has automatically made invisible small adjustments to maintain symmetrical flight and dampen yaw oscillations for at least half a century, and more modern aircraft alleviate turbulence or other small disturbance from trimmed flight without announcing this either, as that would quite quickly become a nuisance... $\endgroup$
    – Cpt Reynolds
    Commented Mar 25, 2019 at 17:33
  • 15
    $\begingroup$ I guess the question to ask is rather not “why don’t all automatic inputs get announced” (as quite often that’s actually OK) but “why would anyone design an automatic that is associated with a risky edge of the flight envelope and then not tell crew about its existence” (because that’s not OK). $\endgroup$
    – Cpt Reynolds
    Commented Mar 25, 2019 at 17:45
  • 8
    $\begingroup$ @Ed999 the requirements for the MCAS system would have come from someone with experience designing aviation systems. Plus, most people working in DO-178 driven projects are quite aware of the domain in which the software is running. Whether the indication of operation is provided to the pilot is a human factors decision, not one of software. $\endgroup$
    – selectstriker2
    Commented Mar 26, 2019 at 13:59
  • 9
    $\begingroup$ Indeed. In AF447, the fool copilot that got them all killed was pulling all the way back on the stick. Normally you do that to maliciously stall the aircraft and kill everyone, and had he done that in a Boeing it would've been considered mass murder. But the copilot had learned that if you do that on an Airbus, Normal Law will intervene to stop you. He had become trained to avert stall by inducing stall to force Normal Law to fix it. Unfortunately his plane was in Alt Law 2. $\endgroup$
    – Harper - Reinstate Monica
    Commented Mar 26, 2019 at 17:59

3 Answers 3

Reset to default
52
$\begingroup$

There is a general design principle, that some, but not all, of the behavior of the flight guidance system or autopilot should be visible to the pilot. Usually automatic engagement or disengagement of a control system is indicated, but sub-modes of these controls or manual changes might be unindicated. That sounds simple and logical, but in reality it's a complex and tricky human factors issue. Displaying too much information to the pilots is just as bad as displaying too little, as too much information can cause them to ignore the most important indicators, like a stick shaker warning about a impending stall.

I know this isn't a very satisfying answer, but it's hard for anyone other than a human factors expert to answer a very general question like this with hard-and-fast rules.

For example, many autopilots will skip the aural warning about disengagement if the disengagement was directly caused by a pilot action. The pilot in this situation only gets a visual indication that AP has changed behavior. This sounds perfect, but on Aeroflot Flight 593 a pilot let his child into the cockpit, who then applied enough pressure on the yoke to disengage the automatic aileron control. There was no warning chime because the disengagement was considered intentional by the autopilot. This was unlike previous planes the pilot had flown, which contributed to the pilot's confusion when the plane began to turn and then go into a sharp bank.

The indicator light you mention for the 737 Max Lion Air crash is for "AoA disagreement", not MCAS engagment as you suggest. While these kinds of AoA indicators are generally considered good ideas, it's still an area of debate how much they'd help confused pilots like in the Lion Air crash or the Air France 447 crash.

Similarly, the quality of indication was not the biggest cause to the accidents you've listed. For example, the Scandinavian Airlines Flight 751 could probably have returned to the airport successfully, but a compressor stall due to ice striking both engines at low altitudes is a bad situation no matter the auto-thrust behavior. Bad sensors and confused pilots can crash a plane with perfectly designed indicators.

Edit: since this answer is getting a lot of attention, I think it's important to note that I don't really cover any special considerations for the edge of the flight envelope, auto-trim vs auto-disengagement vs changing sub-modes, or idiot-proofing of flight systems. I'd love to see this covered in more detail by people with experience.

Improve this answer
$\endgroup$
3
  • 4
    $\begingroup$ That's a good point. Information overload is a very real problem. $\endgroup$
    – Machavity
    Commented Mar 25, 2019 at 18:20
  • 5
    $\begingroup$ I seem to recall a deluge of contradictory and confusing system messages being an issue in Qantas 32. Thankfully, the pilots were able to work through that one and get the plane in the ground mostly in tact (aside from the bits that had blown off the engine and wing when the turbine disc exploded,) but I seem to recall hearing the pilots talk about how many superfluous system messages they had to wade through in order to get to the important information of "an engine blew up, another is uncontrollable, and there's a hole in the wing." $\endgroup$
    – reirab
    Commented Mar 25, 2019 at 20:21
  • 9
    $\begingroup$ There’s an argument to be made for a flight engineer to wade through all of that stuff, but that stuff is there to replace the flight engineer in the first place. Go figure. $\endgroup$
    – MikeY
    Commented Mar 25, 2019 at 22:34
18
$\begingroup$

There are two types of autopilots, one for the behaviour around the CoG and one for control of the CoG, as mentioned in this answer. Also sometimes called Inner Loop and Outer Loop. In short:

  1. The F-16 is aerodynamically unstable and has a rapid control system that applies control surface deflections to provide artificial stability. This is done to make the aircraft extremely manoeuvrable. The pilot is deliberately kept unaware of all these rapid control deflections, to them it just appears as if the aircraft is stable. Inner Loop autopilots provide no feedback to the pilots, by design.

  2. The automatic pilots that can be set in order to fly to a certain setpoint are Outer Loop control systems. By design, they do provide feedback to the pilot as to what they are doing, so that the pilot can feel and see what sort of inputs are given and can override them if they deem them to be incorrect. The A320 has no means to move the stick, so this feedback cue is unavailable and attention is demanded by alerts.

This article explains the design philosophy of the MCAS system: it was meant as an auto-stabilising feature in a flight state outside the normal envelope - the circumstances Inner Loop control is normally applied in.

So to answer your question: yes, some flight computers do change control surface deflection without notifying the pilots.

Improve this answer
$\endgroup$
2
  • 4
    $\begingroup$ This is exactly the cause. The B737 used to be aerodynamically stable, but the forward re-positioning of the engines narrowed the space of stable flight parameters so much that a software interference was designed so that it would feel and behave the same even though its aerodynamics had changed. (For some context see latimes.com/local/california/…) The F16 comparison is spot-on. Hiding this interference is the whole point. Designing it to be invisible surely was the reason it was not even included in the training and manuals. $\endgroup$
    – Peter - Reinstate Monica
    Commented Mar 27, 2019 at 11:51
  • 5
    $\begingroup$ @PeterA.Schneider Fully agree there, and I can see the point of not including MCAS in the curriculum if it was designed for those circumstances. That leaves the question why one single faulty transducer can cause the system to engage in normal flight envelope states. $\endgroup$
    – Koyovis
    Commented Mar 27, 2019 at 12:59
3
$\begingroup$

In the case of MCAS and the stabilizer control, there is "notification" that the stabilizers are being automatically adjusted in the form of the two wheels on either side of the thrust controls. They spin, have markings, and are very noisy, so the pilots could not have been unaware of them acting. The problem was that the pilots were (apparently) unaware of the possibility of turning off the automatic stabilizer inputs from MCAS and kept trying to manual override the MCAS/stabilizer adjustments. The switches to turn off the stabilizer inputs are right in front of the thrust controls on the co-pilot side.

Improve this answer
$\endgroup$
4
  • 2
    $\begingroup$ They were also unaware of that specific trim function sponsored by MCAS which probably wasn’t particularly helpful in fault diagnosis. $\endgroup$
    – Cpt Reynolds
    Commented Mar 25, 2019 at 19:36
  • 1
    $\begingroup$ Well, the actual position of the trim surfaces is plainly displayed right next to the Annoying Clackey Thing. If they even looked to see where the sound was coming from, they'd be going "wow, that's an awful lot of up-trim", that explains the heavy yoke". Then when they trimmed it back, they'd hear Clacky Thing again and "Enough!" switch off or just stop the trimwheel with your knee. It really looks like more a problem of green pilots who have spent all their flying hours pushing buttons on highly automated airplanes. The automation cocks up at all, and they have no idea what to do. $\endgroup$
    – Harper - Reinstate Monica
    Commented Mar 27, 2019 at 4:55
  • $\begingroup$ @Harper "that explains the heavy yoke" I've had that happen to me during a training flight when the instructor (very likely inadvertantly; this was from rather touch-sensitive buttons on top of the shared control stick) changed the trim setting to, IIRC, full nose down. My first reaction when taking the controls back and trying to maintain level flight was along the lines of "damn, that's heavy!". Despite having only like 15-20 hours at the time, my first reaction beyond the immediate need of establishing positive control was to look over at the trim, and sure enough it indicated an extreme. $\endgroup$
    – user
    Commented Mar 27, 2019 at 10:20
  • $\begingroup$ "the pilots could not have been unaware of them acting". However, the Speed Trim System also adjusts the trim automatically. So they could have very well thought it was the STS adjusting the trim, which is relatively harmless. $\endgroup$
    – mike
    Commented Mar 27, 2019 at 21:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .