Boeing 737 Max 8 crashs

[MartinT]

[Martin Taylor 2019.03.24.11.07]

The first and subsequent newspaper reports on the Lion Air and Ethiopian
Air crashes have focused on the lack of pilot training on the modified
737, and in particular its MCAS software system. Some have suggested
that a sensor for the plane's attitude malfunctioned similarly in both
cases. I believe the problem lies elsewhere, in the time-constants of an
unnecessary feedback loop between the control of the perceptions of the
plane's attitude by the software and the pilot, coupled with the fact
(as reported in one paper today) that the MCAS system cuts in when the
plane pitches nose-up beyond a threshold.

It happens that I discussed an analogous problem and its solution from a
PCT viewpoint at a Symposium of the NATO Advisory Group on Aviation
Research and Development in 1992. The actual talk was about how best to
integrate the use of voice interaction with other means of interacting
with the aircraft, but previously several speakers had talked about the
general distrust of automated systems by pilots. Accordingly, I
discussed the issue, but could not include it in the previously
submitted text of the talk, which had been required by the interpreters.
My addendum to the talk was, however, published in the final Symposium
publication (attached). It starts on page 11.

The essence of the problem is that the pilot and the automation both are
attempting to control the same environmental variable (aircraft nose-up
angle). They are trying to control it to the same reference value, but
they do not have the same time-scale of their feedback loops through the
plane's flight dynamics. In a linear system, this would not matter, but
in a non0linear system the result is a newly introduced "beat frequency"
in the actual pitch angle that is the difference between the inverses of
the two individual loop transport lags (there's also a beat frequency
that is the sum, but I would not think the loop gain for that one would
exceed unity). If the loop gain through the two controllers is positive
and greater than unity, the effect would be an exponentially increasing
attitude (and altitude) oscillation of the kind reported in the newspapers.

But that's not all. If it is true that MCAS only cuts in when the
nose-up attitude is beyond some criterion value and then cuts out again
when the plane's pitch angle becomes safe, the effect would be like that
of a simple conflict such as a tug-of-war when one of the competitors
suddenly drops the rope. In a real tug-of-war, the team still holding
the rope would stagger backward and fall down as if they had been
suddenly pushed with the same force with with the other party had been
pulling. In the MCAS situation, there is no overt conflict since both
pilot and MCAS had the same reference value, but there would be a sudden
change in the loop gain, which the pilot would sense as "jerk" (rate of
change of acceleration of a variable) for which he would be likely to
experience as a new disturbance that reduced the pitch control loop
acceleration at the root of his pitch control hierarchy. His
compensating action would be to add a compensating increase in the pitch
acceleration (the elevator flap angle), driving the nose of the plane
down faster than would allow for stopping the change of pitch when the
plane reached its reference attitude (a climb out of the airport).

The effect of such an MCAS threshold would be similar to the effect of
the small pushes a parent gives a child's swing, increasing the
amplitude of the swing over several swings back and forth. In the MCAS
situation, however, the "parent" would be giving a harder push each time
the threshold was passed for it to come into action, leading again to an
exponential increase in the amplitude of the pitch excursion.

My 1992 solution to this problem was twofold. Firstly, I assumed that
the automated system would have no threshold, but the pilot could have
control over his/her own loop gain, while the automated system would
adjust its own loop gain by sensing the control force being applied by
the pilot, reducing .its own gain as the pilot's applied force
increased. A side-benefit of this arrangement is that by changing a
parameter the same arrangement could be used for training new pilots.
You can read what I actually said about it in 1992 in the attachment.

I assume Boeing engineers understand the nature of the problem very well
by now, and it may well not be as the newspapers describe. If it is,
they understand dynamics a lot better than I do, and should b able to
solve it in their own way. But I though it might be useful here to
suggest how PCT could anticipate and solve a potential problem a quarter
of a century before it actually happened and killed so many people.

Martin

PS. There is a "mental typo" in the middle of the first paragraph of the
"Feedback" section on p21-7, where "reference belief" should have been
"perceptual belief".

AGARD92_IntegratingVoice.pdf (1.52 MB)

[FredNickols]

Fred Nickols 2019.03.25.0515 ET

Martin. You should share this with Boeing, the FAA and The NY Times.Â

···

Fred Nickols
Solution Engineer & Chief Toolmaker
Distance Consulting LLC
“Assistance at A Distanceâ€?
www.nickols.us

[wmansell]

You must!!

···

Fred Nickols
Solution Engineer & Chief Toolmaker
Distance Consulting LLC
“Assistance at A Distance�
www.nickols.us

[MartinT]

[Martin Taylor 2019.03.25.10.59]

Fred Nickols 2019.03.25.0515 ET

    Martin. You should share this with Boeing, the FAA

and The NY Times.

Two problems. When someone comes out of nowhere and says "I can

solve your problem" the usual perception (unless you are Donald
Trump or our own Provincial Premier) is that the person is just one
of those very abundant crazies, and the idea is not considered or
even looked at. (The same applies to Bagno’s prediction of and
solution for, the long-term decline of the North Atlantic economies
that ha led to the rise of both income inequality and populism, a
solution that also follows without the maths directly from PCT. Who
would listen to the revolutionary idea coming from people with no
credentials in economics that Federal and National deficits have
been insufficient on average since around 1980, when Nobel Prize
winning economists think government budgets should be balanced on
average, and people keep saying that our descendants are being
loaded with intolerable debt?

It would be much more likely to be received and considered if

someone else submitted the idea saying “This idea came from a
colleague. It seemed to me to be worthy of passing on to you for
consideration.”

Secondly, as a practical matter, how would one make serious contact

with people with the ability to understand critique the idea at
those places? I have never been able to do that on the occasions
when I have had what I thought would be ideas of interest to people
involved with proposing policy. Or even in letters to the editor,
for that matter.

Martin

···

Fred Nickols

    Solution Engineer & Chief Toolmaker

    Distance Consulting LLC

    “Assistance at A Distance�

    [www.nickols.us](http://www.nickols.us)

[wmansell]

Yes, but you are an eminently published academic on human-machine interfaces? Maybe you could as Phil Farrell to suggest it as he’s currently in the industry?Â
Warren

···

Dr Warren Mansell
Reader in Clinical Psychology

School of Health Sciences
2nd Floor Zochonis Building
University of Manchester
Oxford Road
Manchester M13 9PL
Email: warren.mansell@manchester.ac.uk
Â
Tel: +44 (0) 161 275 8589
Â
Website: http://www.psych-sci.manchester.ac.uk/staff/131406

Check www.pctweb.org for further information on Perceptual Control Theory

[rsmarken]

[Rick Marken 2019-03-26_12:22:16]

[Martin Taylor 2019.03.24.11.07]

MT: The first and subsequent newspaper reports on the Lion Air and Ethiopian

Air crashes have focused on the lack of pilot training on the modified

737, and in particular its MCAS software system. Some have suggested

that a sensor for the plane’s attitude malfunctioned similarly in both

cases. I believe the problem lies elsewhere, in the time-constants of an

unnecessary feedback loop between the control of the perceptions of the

plane’s attitude by the software and the pilot, coupled with the fact

(as reported in one paper today) that the MCAS system cuts in when the

plane pitches nose-up beyond a threshold.

RM: Gary Cziko recently led a great discussion on Facebook of the possible reasons of the two 737 MAX crashes. I learned a bit from these discussions and from some discussions with two friends who are private pilots. I think it’s a bit too early to come to conclusions about the causes of the crash. Â

MT: The essence of the problem is that the pilot and the automation both are

attempting to control the same environmental variable (aircraft nose-up

angle).

RM: This is not necessarily true. The MCAS system controls the angle of attack (AoA) of the wing relative to air flow by varying the angle of the horizontal stabilizer and, thus, the pitch angle of the plane. The pilot could also have been controlling AoA but I believe there was no display of AoA to the pilots in the versions of the 737 MAXs that crashed. I think the pilot was controlling the pitch angle as the means of controlling some other variable(s), such as rate of climb or descent. Pitch and AoA ore different variables, as can be seen in this chart:

RM: The conflict between pilot and MCAS was over the setting of the horizontal stabilizer. It resulted from the fact that MCAS and the pilot had two different references for pitch; MCAS wanted nose down, the pilot wanted nose up. Apparently MCAS wanted to move the stabilizer so as to pitch the nose down in order to reduce reduce sensed AoA; the pilot wanted to move the stabilizer in the opposite direction, to pitch the nose up in order to control some other variable, such as pitch angle itself. The solution to this conflict would have been to disengage MCAS, which can be done but the pilots were apparently not trained on how to do it. That’s why training is being suggested as the probable solution to the problem. But a software upgrade to MCAS is also being made so that such an emergency problem is unlikely to happen again. But I’m sure they will train the pilots on how to disengage MCAS even with the software upgrade.

BestÂ

Rick

···

They are trying to control it to the same reference value, but

they do not have the same time-scale of their feedback loops through the

plane’s flight dynamics. In a linear system, this would not matter, but

in a non0linear system the result is a newly introduced “beat frequency”

in the actual pitch angle that is the difference between the inverses of

the two individual loop transport lags (there’s also a beat frequency

that is the sum, but I would not think the loop gain for that one would

exceed unity). If the loop gain through the two controllers is positive

and greater than unity, the effect would be an exponentially increasing

attitude (and altitude) oscillation of the kind reported in the newspapers.

But that’s not all. If it is true that MCAS only cuts in when the

nose-up attitude is beyond some criterion value and then cuts out again

when the plane’s pitch angle becomes safe, the effect would be like that

of a simple conflict such as a tug-of-war when one of the competitors

suddenly drops the rope. In a real tug-of-war, the team still holding

the rope would stagger backward and fall down as if they had been

suddenly pushed with the same force with with the other party had been

pulling. In the MCAS situation, there is no overt conflict since both

pilot and MCAS had the same reference value, but there would be a sudden

change in the loop gain, which the pilot would sense as “jerk” (rate of

change of acceleration of a variable) for which he would be likely to

experience as a new disturbance that reduced the pitch control loop

acceleration at the root of his pitch control hierarchy. His

compensating action would be to add a compensating increase in the pitch

acceleration (the elevator flap angle), driving the nose of the plane

down faster than would allow for stopping the change of pitch when the

plane reached its reference attitude (a climb out of the airport).

The effect of such an MCAS threshold would be similar to the effect of

the small pushes a parent gives a child’s swing, increasing the

amplitude of the swing over several swings back and forth. In the MCAS

situation, however, the “parent” would be giving a harder push each time

the threshold was passed for it to come into action, leading again to an

exponential increase in the amplitude of the pitch excursion.

My 1992 solution to this problem was twofold. Firstly, I assumed that

the automated system would have no threshold, but the pilot could have

control over his/her own loop gain, while the automated system would

adjust its own loop gain by sensing the control force being applied by

the pilot, reducing .its own gain as the pilot’s applied force

increased. A side-benefit of this arrangement is that by changing a

parameter the same arrangement could be used for training new pilots.

You can read what I actually said about it in 1992 in the attachment.

I assume Boeing engineers understand the nature of the problem very well

by now, and it may well not be as the newspapers describe. If it is,

they understand dynamics a lot better than I do, and should b able to

solve it in their own way. But I though it might be useful here to

suggest how PCT could anticipate and solve a potential problem a quarter

of a century before it actually happened and killed so many people.

Martin

PS. There is a “mental typo” in the middle of the first paragraph of the

“Feedback” section on p21-7, where “reference belief” should have been

“perceptual belief”.

–
Richard S. MarkenÂ

"Perfection is achieved not when you have nothing more to add, but when you
have nothing left to take away.�
                --Antoine de Saint-Exupery

[MartinT]

[Martin Taylor 2019.03.26.16.00]

[Rick Marken 2019-03-26_12:22:16]

Thanks for these comments.

        [Martin Taylor

2019.03.24.11.07]

        MT: The first and subsequent newspaper reports on the Lion

Air and Ethiopian

        Air crashes have focused on the lack of pilot training on

the modified

        737, and in particular its MCAS software system. Some have

suggested

        that a sensor for the plane's attitude malfunctioned

similarly in both

        cases. I believe the problem lies elsewhere, in the

time-constants of an

        unnecessary feedback loop between the control  of the

perceptions of the

        plane's attitude by the software and the pilot, coupled with

the fact

        (as reported in one paper today) that the MCAS system cuts

in when the

        plane pitches nose-up beyond a threshold.

        RM: Gary Cziko recently led a great discussion on

Facebook of the possible reasons of the two 737 MAX crashes.
I learned a bit from these discussions and from some
discussions with two friends who are private pilots. I think
it’s a bit too early to come to conclusions about the causes
of the crash.Â

Yes, especially since none of us has any more information about it

beyond personal experience and what we read in the various news
reports. I don’t think that affects whether a 17-year-old PCT
analysis of a related problem, with a PCT-based solution, should not
be mentioned. It’s a general point about avoiding problems
associated with the joint control of aircraft by automation and
human, of which these crashes are said to be examples.

        MT: The essence of the

problem is that the pilot and the automation both are

        attempting to control the same environmental variable

(aircraft nose-up

        angle).

RM: This is not necessarily true.

Thanks for what follows, which all seems quite sensible. But it

doesn’t change the point the a PCT analysis and solution might have
been, and still might be, a generic way of avoiding such
“unforeseen” ways of killing people.

        The MCAS system controls the angle of attack (AoA) of the

wing relative to air flow by varying the angle of the
horizontal stabilizer and, thus, the pitch angle of the
plane. The pilot could also have been controlling AoA but I
believe there was no display of AoA to the pilots in the
versions of the 737 MAXs that crashed. I think the pilot was
controlling the pitch angle as the means of controlling some
other variable(s), such as rate of climb or descent. Pitch
and AoA ore different variables, as can be seen in this
chart:

        RM: The conflict between pilot and MCAS was over the

setting of the horizontal stabilizer. It resulted from the
fact that MCAS and the pilot had two different references
for pitch; MCAS wanted nose down, the pilot wanted nose up.
Apparently MCAS wanted to move the stabilizer so as to pitch
the nose down in order to reduce reduce sensed AoA; the
pilot wanted to move the stabilizer in the opposite
direction, to pitch the nose up in order to control some
other variable, such as pitch angle itself. The solution to
this conflict would have been to disengage MCAS, which can
be done but the pilots were apparently not trained on how to
do it.

If you read my presentation addendum, you know that I would not ask

the pilot to cut the automation off abruptly, or at all. The gain of
the automation should be influenced by the output force applied by
the pilot, including bringing it smoothly to zero.

        That's why training is being suggested as the probable

solution to the problem. But a software upgrade to MCAS is
also being made so that such an emergency problem is
unlikely to happen again. But I’m sure they will train the
pilots on how to disengage MCAS even with the software
upgrade.

I'm sure they will, and that would be fine until a scared novice

pilot forgets that to turn off MCAS would allow control of the plane
to be regained.

But there is indeed a problem with my solution of allowing the

automation to retire gently from the conflict when the pilot asserts
that s/he wants control. In 1963 or thereabouts there were at least
two crashes of (as I remember) DC-8’s that nosedived into the ground
while attempting a climbing turn out of an airport, one of them in
Montreal. Our institute was involved in finding the solution, which
turned out to be that a certain combination of rotary acceleration
forces reversed the pilot’s sense of which way to make a correction,
with the result that if the plane was banking left and gaining
altitude, the pilot’s action made it bank further left and nose down
(toward the left wing) in a positive feedback loop.

The effect was demonstrated using our system for experiments on

people’s sensitivity to multiple rotary forces (a chair set on
gimbals and hung on the end of a long arm so that the unfortunate
subject could be rotated about any axis in the chair while being
swung on some track over the surface of a big sphere – the
experimenter guaranteed he could make anyone vomit within 15
seconds). Mimicking the changing rotary forces with respect to
gravity that would have been encountered by the pilots produced
exactly that “reversed-control” effect. From what the news reports
say, I doubt that this effect matters in the recent crashes, and I
don’t know how they avoid it now in passenger planes or
high-performance fighters.

The generic problem with my solution to the automation problem would

that a malfunctioning pilot could (intentionally or otherwise) drive
the plane into disaster, as apparently happened a few years ago to
an Egypt Air trans-Atlantic flight with a suicidal pilot, and to the
flight the was driven into an Alp a couple of years ago. I have no
idea how to solve that one once the plane is in the air.

Martin

···

BestÂ

Rick

        They are trying to

control it to the same reference value, but

        they do not have the same time-scale of their feedback loops

through the

        plane's flight dynamics. In a linear system, this would not

matter, but

        in a non0linear system the result is a newly introduced

“beat frequency”

        in the actual pitch angle that is the difference between the

inverses of

        the two individual loop transport lags (there's also a beat

frequency

        that is the sum, but I would not think the loop gain for

that one would

        exceed unity). If the loop gain through the two controllers

is positive

        and greater than unity, the effect would be an exponentially

increasing

        attitude (and altitude) oscillation of the kind reported in

the newspapers.

        But that's not all. If it is true that MCAS only cuts in

when the

        nose-up attitude is beyond some criterion value and then

cuts out again

        when the plane's pitch angle becomes safe, the effect would

be like that

        of a simple conflict such as a tug-of-war when one of the

competitors

        suddenly drops the rope. In a real tug-of-war, the team

still holding

        the rope would stagger backward and fall down as if they had

been

        suddenly pushed with the same force with with the other

party had been

        pulling. In the MCAS situation, there is no overt conflict

since both

        pilot and MCAS had the same reference value, but there would

be a sudden

        change in the loop gain, which the pilot would sense as

“jerk” (rate of

        change of acceleration of a variable) for which he would be

likely to

        experience as a new disturbance that reduced the pitch

control loop

        acceleration at the root of his pitch control hierarchy. His


        compensating action would be to add a compensating increase

in the pitch

        acceleration (the elevator flap angle), driving the nose of

the plane

        down faster than would allow for stopping the change of

pitch when the

        plane reached its reference attitude (a climb out of the

airport).

        The effect of such an MCAS threshold would be similar to the

effect of

        the small pushes a parent gives a child's swing, increasing

the

        amplitude of the swing over several swings back and forth.

In the MCAS

        situation, however, the "parent" would be giving a harder

push each time

        the threshold was passed for it to come into action, leading

again to an

        exponential increase in the amplitude of the pitch

excursion.

        My 1992 solution to this problem was twofold. Firstly, I

assumed that

        the automated system would have no threshold, but the pilot

could have

        control over his/her own loop gain, while the automated

system would

        adjust its own loop gain by sensing the control force being

applied by

        the pilot, reducing .its own gain as the pilot's applied

force

        increased. A side-benefit of this arrangement is that by

changing a

        parameter the same arrangement could be used for training

new pilots.

        You can read what I actually said about it in 1992 in the

attachment.

        I assume Boeing engineers understand the nature of the

problem very well

        by now, and it may well not be as the newspapers describe.

If it is,

        they understand dynamics a lot better than I do, and should

b able to

        solve it in their own way. But I though it might be useful

here to

        suggest how PCT could anticipate and solve a potential

problem a quarter

        of a century before it actually happened and killed so many

people.

        Martin



        PS. There is a "mental typo" in the middle of the first

paragraph of the

        "Feedback" section on p21-7, where "reference belief" should

have been

        "perceptual belief".

–
Richard S. MarkenÂ

                                "Perfection

is achieved not when you have
nothing more to add, but when you
have
nothing left to take away.�
   Â
            --Antoine de
Saint-Exupery