3 April 2019 – On 29 October 2018, Lion Air flight 610 crashed soon after takeoff from Soekarno–Hatta International Airport in Jakarta, Indonesia. This is not the sort of thing we report in this blog. It’s straight news and we leave that to straight-news media, but I’m diving into it because it involves technology I’m quite familiar with and I might be able to help readers make sense of what happened and judge the often-uninformed reactions to it.

I claim to have the background to understand what happened because I’ve been flying light planes since the 1990s. I also put two years into a post-graduate Aerospace Engineering Program at Arizona State University concentrating on fluid dynamics. That’s enough background to make some educated guesses at what happened to Lion Air 610 as well as in the almost identical crash of an Ethiopian Airlines Boeing 737 MAX in Addis Ababa, , Ethiopia on 10 March 2019.

First, both airliners were recently commissioned Boeing 737 MAX aircraft using standard-equipment installations of Boeing’s new Maneuvering Characteristics Augmentation System (MCAS).

How to Stall an Aircraft

In aerodynamics the word “stall” means something quite unlike what most people expect. Most people encounter the word in an automobile context, where it refers to “stalling the engine.” That happens when you overload an internal-combustion engine. That is pull more power out than the engine can produce at its current operating speed. When that happens, the engine simply stops.

It turns from a power-producing machine to a boat anchor in a heartbeat. Your car stops with a lurch and everyone behind you starts swearing and blowing their horns in an effort to make you feel even worse than you already do.

That’s not what happens when an airplane stalls. It’s not the aircraft’s engine that stalls, but it’s wings. There are similarities in that, like engines, wings stall when they’re overloaded and when stalled they start producing drag like a boat anchor, but that’s about where the similarities end.

When an aircraft stalls, nobody swears and blows their horn. Instead, they scream and die.

Why? Well, wings are supposed to lift the aircraft and support it in the air. If you’ve ever tried to carry a sheet of plywood on a windy day you’ve experience both lift and drag. If you let the sheet tip up a little bit so the wind catches it underneath, it tries to fly up out of your hands. That’s the lift an airplane gets by tipping its wings up into the air stream as it moves forward into the air.

The more you tip the sheet up, the more lift you get for the same airspeed. That is, until you reach a certain attack angle (the angle between the sheet and the wind). Stalling begins suddenly at an attack angle of about 15°. Then, all of a sudden, the force lifting the sheet changes from up and a little back to no up, and a lot of back!

That’s a wing stall.

The aircraft stops imitating a bird, and starts imitating a rock.

You suddenly get a visceral sense of the concept “down.”

‘Cause that’s where you go in a hurry!

At that point, all you can do is point the nose down (so the wing’s forward edge starts pointing in the direction you’re moving: down!

If you’ve got enough space underneath your aircraft so the wing starts flying again before you hit the ground, you can gently pull the aircraft’s nose back up to resume straight and level flight. If not, that’s when the screaming starts.

Wings stall when they’re going too slowly to generate the required lift at an angle of attack of 15°. At higher speeds, the wing can generate the needed lift with less angle of attack, and worries about stalling never come up.

So, now you know all you need to know (or want to know) about stalling an aircraft.

MCAS

Boeing’s MCAS is an anti-stall system. It’s beating heart is a bit of software running on the flight-control computer that monitors a number of sensor inputs, like airspeed and angle of attack. Basically, in simple terms, it knows exactly how much attack angle the wings can stand before stalling out. If it sees that for some reason, the attack angle is getting too high, it assumes the pilot has screwed up. It takes control and pushes the nose down.

It doesn’t have to actually “take control” because modern commercial aircraft are “fly by wire,” which means it’s the computer that actually moves the control surfaces to fly the plane. The pilot’s “yoke” (the little wheel he or she gets to twist and turn and move forward and back) and the rudder pedals he pushes to steer (push right, go right) just sends signals to the computer to tell it what he wants to have happen. In a sense, the pilot negotiates with the computer about what the airplane should do.

The pilot makes suggestions (through the yoke, pedals and throttle control – collectively called the “cockpit flight controls”); the computer then takes that information, combines it with all the other information provided by a plethora (Do you like that word? I do!) of additional sensors; thinks about it for a microsecond; then, finally, the computer tells the aircraft’s control surfaces to move smoothly to a position that it (the computer) thinks will make the aircraft do what it wants it to do.

That’s all well and good when the reason the attack angle got too high is just that something happened that broke the pilot’s concentration, and he (or she) actually screwed up. What about when the pilot actually wants to stall the aircraft?

For example, on landing.

To land a plane, you slow it way down, so the wing’s almost stalled. Then, you fly it really close to the ground so the wheels almost touch the runway. Then you stall the wing so the wheels touch the ground just as the wings lose lift. You hear a satisfying “squeak” as the wheels momentarily skid while spinning up to match the relative speed of the runway. Finally, the wheels gently settle down, taking up the weight of the aircraft. The flight crew (and a few passengers who’ve been paying attention) cheer the pilot for a job well done, and the pilot starts breathing again.

Anti-stall systems don’t do much good during a landing, when you’re trying to intentionally stall the wings at just the right time.

Similarly, the don’t do much good when you’re taking off, and the pilot’s just trying to get the wings unstalled to get the aircraft into the air in the first place.

For those times, you want the MCAS turned off! So you’ve gotta be able to do that, too. Or, if your pilot is too absent minded to shut it off when its not needed, you need it to shut off automatically.

When Things Go Wrong

So, what happened in those two airliner crashes?

Remember that the main input into the MCAS is an attack angle sensor? Attack angle sensors, like any other piece of technology can go bad, especially if it’s exposed to weather. And, airliners are exposed to weather 24/7 except when they’re brought into a hangar for repair.

The working hypothesis for what happened to both airliners is that the attack-angle sensors failed. They jammed in a position where they erroneously reported a high angle-of-attack to the MCAS, which jumped to the conclusion “pilot error,” and pushed the nose down. When the pilot(s) tried to pull the nose back up (because their windshield filled up with things that looked a lot like ground instead of sky), the MCAS said: “Nope! You’re going down, Jack!”

By the time the pilots figured out what was wrong and looked up how to shut the MCAS off, they’d actually hit the things that looked too much like ground.

Why didn’t the MCAS figure out there was something wrong with the sensor?

How’s it supposed to know?

The sensor says the nose is pointed up, so the computer takes it at it’s word. Computers aren’t really very smart, and tend to be quite literal. The sensor says the nose is pointed up, so the computer thinks the nose is pointed up, and tries to point it down (or at least less up). End of story. And, in the real world, it’s “end of aircraft” as well.

If the pilot(s) try to tell the computer to pull the nose up (by desperately pulling back on the yoke), it figures they’re screw-ups, anyway, and won’t listen.

Every try to argue with a computer? Been there, done that. It doesn’t work.

Mea Culpa

When I learned about the hypothesis of attack-angle-sensor failure causing the crashes that took nearly four hundred lives, I got this awful sick feeling that was a mixture of embarrassment and guilt. You see, a decade and a half ago my research project at ASU was an effort to develop a different style of attack-angle sensor. Several events and circumstances combined to make me abandon that research project and, in fact, the whole PhD. program it was a part of. In my defense, it was the start of a ten-year period in which I couldn’t get anything right!

But, if I’d stuck it out and developed that sensor it might have been installed on those airliners and might not have failed at all. Of course, it could have been installed and failed in some other spectacular way.

You see, the attack angle sensor that apparently was installed consisted of a little vane attached to one side of the aircraft’s nose. Just like the wind sock traditionally hung outside airports the world over, wind pressure makes the vane line up downstream of the wind direction. A little angle sensor attached to the vane reports the wind direction relative to the nose: the attack angle.

I got involved in trying to develop an alternative attack-angle sensor because I have a horror of relying on sensors that depend on mechanical movement to work. If you’re relying on mechanical movement, it means you’re relying on bearings, and bearings can corrode and wear out and fail. The sensor I was working on relied on differences in air pressure that depended on the direction the wind hit the sensor.

In actual fact, there were two attack-angle sensors attached to the doomed aircraft – one on each side of the nose – but the Boeing MCAS was paying attention to only one of them. That was Boeing’s second mistake (the first being not using the sensor I hadn’t developed, so I guess they can’t be blamed for it). If the MCAS had been paying attention to both sensors, it would have known something in its touchy-feely universe was wrong. It might have been a little more reluctant to override the pilots’ input.

The third mistake (I believe) Boeing made was to downplay the differences between the new “Max” version of the aircraft and the older version. They’d changed the engines, which (as any aerospace engineer knows) necessitates changes in everything else. Aircraft are so intricately balanced machines that every time you change one thing, everything else has to change – or at least has to be looked at to see if it needs to be changed.

The new engines had improved performance, which affects just about everything involving the aircraft’s handling characteristics. Boeing had apparently tried to make the more-powerful yet more fuel efficient aircraft handle like the old aircraft. There, of course, were differences, which the company tried to pretend would make no difference to the pilots. The MCAS was one of those things that was supposed to make the “Max” version handle just like the non-Max version.

So, when something went wrong in “Max” land, it caught the pilots, who had thousands of hours experience with non-Max aircraft, by surprise.

The latest reports are that Boeing, the FAA, and the airlines have realized what the problems are that caused these issues (I hope they understand them a lot better than I do, because, after all, it’s their job to!), and have worked out a number of fixes.

First, the MCAS will pay attention to two attack-angle sensors. At least then the flight-control computer will have an indication that something is wrong and tell the MCAS to go back in its corner and shut up ‘til the issue is sorted out.

Second, they’ll install a little blinking light that effectively tells the pilots “there’s something wrong, so don’t expect any help from the MCAS ‘til it gets sorted out.”

Third, they’ll make sure the pilots have a good, positive way of emphatically shut the MCAS off if it starts to argue with them in an emergency. And, they’ll make sure the pilots are trained to know when and how to use it.

My understanding is that these fixes are already part of the options that American commercial airlines have generally installed, which is supposedly why the FAA, the airlines and the pilots’ union have been dragging their feet about grounding Boeing’s 737 Max fleet. Let’s hope they’re not just blowing smoke (again)!