Confusion with Boeing 737 MAX: analysis of possible causes of accidents

“ Controlled Flight into Terrain ” is an aviation term for a crash in a normally functioning aircraft due to pilots being distracted or disoriented. A real nightmare. According to my estimates, a collision with the ground in an automated flight is even worse , when the aircraft control system makes it dive into the ground, despite the desperate attempts of the crew to save the situation. This is the alleged cause of two recent crashes of the new Boeing 737 MAX 8. I tried to figure out how these incidents could have happened.

Note: the study of MAX 8 disasters is at an early stage, so much of the article is based on data from indirect sources, in other words, on leaks and rumors, as well as on the reasoning of those people who know or don’t know what they are talking about. So consider this if you decide to continue reading.

Crashes

On the early morning of October 29, 2018, Lion Air’s 610 flight departed from Jakarta, Indonesia, with 189 people on board. It was the new 737 MAX 8, which lasted only four months, the latest model in the Boeing line of aircraft created back in the 1960s. Take-off and ascent to a height of approximately 1,600 feet (480 meters) was normal, after which the pilots removed the flaps (wing elements that increase lift at low speeds). At this point, the aircraft suddenly dropped to 900 feet (270 meters). In radio conversations with air traffic controllers, pilots reported a “problem with the control system” and asked for data on their altitude and speed displayed on the screens of controllers' radars. Equipment in the cockpit gave volatile readings. Pilots pulled out flaps and climbed to 5,000 feet (1,500 meters), but after retracting the flaps, the nose of the plane dropped and he again began to lose altitude. Over the next six to seven minutes, the pilots fought with their own aircraft, they tried to maintain the level of the nose, but the flight control system constantly lowered it down. In the end, the car won. The plane crashed into the water at high speed and all those on board died.

The second crash occurred on March 8, when Ethiopian Airlines flight 302 crashed six minutes after taking off from Addis Ababa, killing 157 people. The aircraft was another MAX 8, which was operated only two months. Pilots reported problems with control, and satellite observation data showed sharp fluctuations in altitude. Due to its similarity to the Lion Air accident, an alarm was raised: if the same malfunction or design defect was the cause of both incidents, then there could be other accidents. In a few days, the 737 MAX fleet around the world was suspended from flying. The data recovered from the accident on Flight 302 reinforced the suspicion that the two cases were closely related.

The sad fate of flight 610 Lion Air can be traced to the data extracted from the black box. (The chart was published in November as part of the preliminary report of the National Transport Safety Committee of Indonesia.)


A general idea of ​​the history is provided by the height tracking curve at the bottom of the graph. The initial ascent is interrupted by a sharp descent; further climb is followed by a long, erratic rollercoaster ride. At the end, there is a dive, a little more than 10 seconds the aircraft descends 5,000 feet (1,500 meters). (Why are there two height curves on the graph, separated by several hundred feet? I will return to this question at the end of my long article.)


All these ups and downs were caused by the movements of the horizontal stabilizer - a small wing-like surface at the rear of the fuselage. The stabilizer controls the pitch angle of the aircraft, i.e. to where the nose is directed. On the 737, he does this in two ways. The elevator trimmer mechanism tilts the entire stabilizer, while the movement of the pilot control wheel (the steering wheel toward and away from you) moves the elevator - a movable steering wheel at the rear of the stabilizer. In both cases, moving the back of the surface up causes the nose of the aircraft to rise, and vice versa. Here we are mainly interested in changes to the trimmer, not the elevator movement.

The commands given to the elevator trimmer system and their effect on the aircraft are shown by three curves from the flight data, which I will repeat here for convenience:


The line marked "trim manual" (blue) reflects the actions of pilots, "trim automatic" (orange) shows commands from the electronic systems of the aircraft, and "pitch trim position" (blue)shows the slope of the stabilizer; a higher position on the graph indicates a command to raise the nose. This is where the struggle between man and machine is evident. In the second half of the flight, the automatic balancing system repeatedly sent commands to lower the nose at intervals of about 10 seconds. In between these automated teams, the pilots, using the buttons of the control wheel, raised their nose with a trimmer. In response to these conflicting commands, the position of the horizontal stabilizer fluctuated with a period of 15-20 seconds. The sawtooth movement lasted about 20 cycles, but toward the end, the implacable, automated nose-lowering commands took precedence over the shorter pilots' nose-raising commands. In the end, the stabilizer went into its maximum dive deviation down and remained in it,

Attack angle

What should be blamed for the misbehavior of the automatic pitch balancing system? The allegations are directed towards MCAS - the new system of the 737 MAX model series. MCAS stands for Maneuvering Characteristics Augmentation System, a surprisingly polysyllabic name that does not give us any idea of ​​what this system does. As I understand it, MCAS is not a hardware device; in the compartments of the electronic equipment of the aircraft do not find the case labeled MCAS. MCAS is completely software-based. This is a program that runs on a computer.

MCAS has only one feature. It is designed to prevent aerodynamic stalling - a situation in which the nose of a plane is raised relative to the surrounding air flow so high that the wings cannot keep it in the air. Stalling is a bit like a situation when a cyclist climbs a hill, which becomes more and more steep: sooner or later, a person runs out of power, the bicycle becomes unstable, and then it rolls back down. Pilots are trained to get out of stall, but they do not practice such a skill on airplanes filled with passengers. In commercial aviation, emphasis is placed on avoidancestalls, so to speak, on their warning. Airliners have mechanisms for recognizing impending stalls and they inform the pilot about this with light and sound indicators, as well as with a stick shaker vibration alarm. On flight 610, the captain's helm vibrated almost from the very beginning to the end.

Some aircraft with the threat of stall are not limited to simple warnings. If the bow of the vessel continues to rise, the automated system intervenes and lowers it, intercepting manual control from the pilot if necessary. MCAS is designed for just that. It is armed and ready for battle, subject to two criteria: the flaps are removed (and they are extended only during take-off and landing) and the aircraft is in manual control (not autopilot). Under these conditions, the system is triggered when an aerodynamic value called the angle of attack (AoA) rises to a range of dangerous values.

The angle of attack is a rather obscure concept, so I will draw a diagram:


Adapted from Review of Research on Angle-of-Attack Indicator Effectiveness Lisa R. Le Vie.

The angles shown in the figure are the turns of the aircraft body relative to the axis of the pitch - a line parallel to the wings, perpendicular to the fuselage and passing through the center of gravity of the aircraft. If you are sitting in a row with the exit, then there is a chance that the pitch axis passes under your seat. Rotation along the pitch axis raises and lowers the nose. The pitch angle (Pitch attitude) is defined as the angle of the fuselage relative to the horizontal plane. The flight path path angle (flight-path angle) is measured between the horizontal plane and the speed vector of the aircraft, that is, it shows how smoothly it rises or descends.Angle of attack is the difference between the pitch angle and the angle of inclination of the flight path. This is the angle at which the aircraft moves through the air surrounding it (assuming that the air itself is stationary, i.e. there is no wind).

AoA affects both lift (upward and inverse gravity) and drag (dissipative force, opposed to forward and engine thrust). As AoA increases above zero, lift increases because air collides with the bottom of the wings and fuselage. But for the same reason, resistance is increasing. With a further increase in the angle of attack, the air flow through the wings becomes turbulent; after this moment, the lifting force decreases, but the resistance continues to increase. And here the stall begins. The angle critical for stalling depends on speed, weight and other factors, but usually it is no more than 15 degrees.

Lion Air and Ethiopian flights were not at risk of stall, so if the MCAS was activated, this should have happened by mistake. According to the working hypothesis mentioned in many press releases, the system received erroneous data from the failed AoA sensor and acted in accordance with its readings.

Conceptually, a sensor for measuring the angle of attack is simple. In fact, it’s just a weather vane protruding into the air stream. In the photo below, the angle of attack sensor is a small black ledge located directly in front of the 737 MAX. Fastened in front, the vane rotates, aligning with the local air flow, and generates an electrical signal that describes the angle of the vane relative to the axis of the fuselage. The 737 MAX has two angle of attack sensors, one on each side of the nose. (The devices above the AoA sensor are pitot tubes used to measure air velocity. Another device under the word MAX is most likely a temperature sensor.)


The angle of attack was not displayed on the instruments of the Lion Air 737 pilots, but the flight recorder recorded the signals received from two AoA sensors:


And here something terribly wrong happens. The left sensor indicates that the angle of attack is about 20 degrees steeper than on the right sensor. This is a huge discrepancy. These two separate indicators could in no realistic way reflect the true state of the aircraft’s movement in the air: the left side of the nose showed that it was directed toward the sky, and the right side that it was approximately horizontal. Some of the measurements must be erroneous, and higher ones are suspected. If the true angle of attack reached 20 degrees, then the plane would already be in a state of deep stall. Unfortunately, Flight 610's MCAS only read data from the left AoA sensor. She interpreted these meaningless measurements as a sure indicator of the position of the aircraft, and tirelessly tried to correct them until the very moment the flight collided with water.

Cockpit automation

The tragedies in Jakarta and Addis Ababa turned into a warning story about the dangers of excessive automation, in which computers usurp the power of pilots. The Washington Post stated :

The second fatal plane crash involving Boeing 737 MAX 8 may be the result of a struggle between man and machine. This failure indicates that regulators should carefully examine systems that take control away from people when safety is at stake.

The Belgian journalist Tom Dyuzaer, often writing articles about aviation and computing, offers the following opinion :

There is no denying that the Boeing of the JT610 had serious computer problems. And in the high-tech computerized world of aircraft manufacturers, in which the role of the pilot is often reduced to pressing buttons and passive monitoring, such incidents may well become more frequent in the future.

In particular anger, the pilots pushing the buttons. Pilot and software developer Gregory Travis summarized his feelings with a brief comment:

"Lift your nose, HAL."
"Sorry, Dave, I'm afraid I can't do this."

Even Donald Trump wrote a tweet on the subject:

Aircraft are becoming too complex to fly. Now they need not pilots, but computer scientists from MIT. I observe such a picture with many products. There is always a desire to take another optional step forward, although often older and simpler solutions are much better. Decisions must be made in fractions of a second, and complexity poses a threat. All this requires a huge price, but it gives very little. I don’t know about you, but I would not want Albert Einstein to be my pilot. I need excellent professionals who can quickly and easily take control of an airplane!

The complaints of excessive automation 737 have considerable irony; in many aspects, this plane is actually surprisingly old-fashioned. The basis of the design was created more than 50 years ago, and even in the latest MAX models quite a lot of technology of the 1960s is preserved. The main controls in it are hydraulic, a web of pipes under high pressure passes directly from the control wheels in the cockpit to the ailerons, elevator and steering wheel. If the hydraulic systems fail, then there remains a completely mechanical backup system of cables and blocks to control various control planes. The main mover of the stabilizer trimmer is the electric motor, but it has a mechanical replacement with a manual flywheel, pulling the cables running to the tail.

Another aircraft is much more dependent on computers and electronics. The main competitor of 737, the Airbus A320 is a vehicle in which the principle of electronic control is implemented comprehensively. The pilot controls the computer, and the computer controls the aircraft. The pilot chooses where to move - up, down, right or left - but the computer decides how to achieve this, which control planes to reject and how much. More modern Boeing models - 777 and 787 - also use digital control. In fact, the latest models of both companies have taken another step from “wire management” to “network management”. The main part of data transmission from sensors to computers and then to control planes consists of digital packets sent over one of the Ethernet network versions. An airplane is the periphery of a computer.

So if you want to lament the dangers and insult of pilots caused by aircraft automation, then 737 is not the most obvious goal. A Luddite campaign to destroy all avionics and regain power to the pilots will be a dangerously erroneous reaction to the current situation. There is no doubt that the 737 MAX has a critical issue. This is a matter of life and death for those who will fly on them, and possibly for Boeing. But the problem did not start with MCAS. It began with previous decisions that made MCAS necessary. Moreover, the problem may not be solved by the method proposed by Boeing - a software update that limits the capabilities of MCAS and leaves pilots with more authority.

Squeeze the maximum out of 737

The first passengers 737 began to transport in 1968. He was (and still is) the smallest jet airliner from the Boeing family, and also the most popular. More than 10 thousand copies were sold, and Boeing has orders for another 4,600. Of course, over the years, changes were made to the aircraft, in particular they touched engines and devices. The updated model of the 1980s became known as the 737 Classic, and the 1997 model is called the 737 NG (next generation). (Now, after the release of MAX, the NG model has turned into the previous generation.) But despite all these modifications, the basic structure of the airframe has not changed much.

Ten years ago, it seemed that 737 had finally reached the end of its life. Boeing has announced that it will begin to develop a completely new design to replace it, the body of which will not be made of aluminum, but of lightweight composite materials. Of course, competition has made adjustments. Airbus had the advantage of the A320neo, an updated model that, when launched in the same market segment, will have more efficient engines. The modified Airbus was supposed to come out around 2015, while the development of the Boeing project from scratch would take ten years. There was a risk of customer churn. In particular, American Airlines' long-standing dedicated partner, American Airlines, has been negotiating a large order for the A320neo.

In 2011, Boeing abandoned the plan to create a completely new design and decided to do the same as Airbus: to attach new engines to the old glider. This would make it possible to abandon most of the preliminary design, as well as the need to build enterprises for equipment and production. Inspections and certification by the FAA (Federal Aviation Administration of the United States) would also be accelerated, and the first deliveries could begin after five to six years, not too late from Airbus.

Model 737-800 (manufactured before MAX) burns about 800 gallons of jet fuel (3 thousand liters) per hour of flight. That is, the cost is about $ 2,000 at a price of $ 2.50 per gallon. If the plane flies 10 hours a day, then it spends 7.3 million dollars annually. Fourteen percent of this amount is more than 1 million dollars.

It was promised that the new 737 engines will provide fuel efficiency of 14 percent, which will allow the airline to save a million dollars in operating costs per year. Greater fuel economy will also increase the flight range of the aircraft. And in order to sweeten the deal, Boeing suggested leaving such a part of the airframe unchanged so that the new model could be operated with the same “type certificates” as the old one. A pilot with 737 NG control clearance could take control of the MAX without long re-training.


The first 737 model of the 1960s had two cigar-shaped engines, long and narrow, located under the wings (pictured above left) . Since then, jet engines have become thick and short. They get more traction not from the jet exhaust from the exhaust pipe, but from the air flow in the outer circuit, moved by a large diameter fan. When mounted under wings 737, such engines would scratch the ground; therefore, they are mounted on pylons that are pulled forward from the front edge of the wing. The engines on the MAX models (pictured above right) are the thickest of the existing engines , and their fan has a diameter of 69 inches (175 cm). Compared to the NG series, MAX engines are pushed a few inches forward and hang a few inches lower.

INA New York Times article written by David Gells, Natalie Kitroef, Jack Nikas, and Rebecca R. Ruiz, the development of this aircraft is described as hasty and messy.

Being late from the Airbus for months, Boeing was forced to catch up. According to former and current employees who spoke to The New York Times , the pace of work on the 737 Max was insane ... Former employees say engineers were forced to take technical drawings and designs about twice as fast as usual.

The Times article also notes: “Although the project was chaotic, current and former employees say they completed it, being confident in the safety of the aircraft.”

Pitch instability

At some stage in the development of the MAX series, Boeing found an unpleasant surprise. Under certain flight conditions, new engines caused an undesirable increase in pitch angle. When I first read about this issue shortly after the Lion Air flight crashes, I found the following explanation in an article by Sean Broderick and Guy Norris in Aviation Week and Space Technology (Nov. 26 – Dec. 9, 2018, pp. 56–57):

As with all turbofan airliners in which the engine thrust lines extend below the center of gravity, any changes in the thrust 737 will lead to changes in the inclination angle of the flight path caused by the vertical thrust component.

In other words, low-hanging engines not only push the aircraft forward, but also tend to rotate it about the pitch axis. It looks like a motorcycle doing a rear wheel trick. Since the MAX engines are mounted even lower and in front of the center of gravity, they act as a rather long lever arm and cause much more serious pitch increase movements.

I found a more detailed description of this effect in an earlier Aviation Week article , pilot Fred George's 2017 report, which describes his first flight at the helm of the new MAX 8.

The aircraft has sufficient natural speed stability in most flight modes. But with as much as 58,000 pounds of thrust provided by engines located well below the center of gravity, there is a clear link between the thrust and pitch at low speeds, especially with back centering and low overall weight. Boeing equips the aircraft with a function of increasing speed stability, which allows you to compensate for the connection by automatically deflecting the horizontal stabilizer in accordance with the speed indicators, the position of the engine control lever and the center of gravity. Nevertheless, pilots should be aware of the effect of thrust changes at the time of pitch and counteract it using the control wheel and elevator trimmer.

Mention of the “boost function” performing the “automatic horizontal stabilizer deviation” sounds terribly familiar, but it turns out that this is not MCAS. A system that compensates for traction and pitch is called speed-trim . Like MCAS, it works “without the knowledge” of the pilot, making changes in the control plane without direct commands. There is another similar system called mach-trim, which without warning corrects another pitch anomaly that occurs when the plane reaches transonic speeds, about Mach 0.6. None of these systems were new to the MAX series; they have been part of the control algorithm since at least the 1997 release of the NG series. MCAS runs on the same computer as speed-trim with mach-trim, and is part of the same software system, but its separate function. And according to what I read over the past few weeks, it is designed to solve another problem, which seems much more sinister.

Most aircraft have a convenient property of static stability. When the plane is correctly aligned for horizontal flight, you can let go of the helm — at least temporarily — and it will continue to move along a stable path. Moreover, if you pull the steering wheel towards yourself to raise your nose up and then release it again, the pitch angle will return to neutral. The location of the various aerodynamic surfaces of the aircraft takes into account this behavior. When the nose rises, the tail drops, pushing the bottom of the horizontal stabilizer into the air stream. The air pressure on this tail tail provides a restoring force that returns the tail up and the nose down. (That is why it is called the stabilizer!) This negative feedback loop is built into the aircraft structure, so any deviation from the equilibrium creates a force that prevents it from breaking.


However, the surface of the tail with its useful stabilization property is not the only design that affects the balance of aerodynamic forces. Jet engines are not designed to give the aircraft lift power, but at large angles of attack they can create it, because the air flow collides with the lower surface of the outer shell of each engine (nacelle). When the engines are far ahead of the center of gravity, the lifting force creates a torsion moment that increases pitch. If this moment exceeds the balancing force from the tail, then the aircraft becomes unstable. Standing upside down creates forces that lift the nose even further and positive feedback wins.

Is the 737 MAX susceptible to similar pitch angle increases? This probability was not obvious to me until I read onBoeing 737 tech site commentary on MCAS is a web publication written by former 737 pilot and flight instructor Chris Brady. He's writing:

MCAS is a system for improving longitudinal stability. It is not needed to prevent stalling and not to ensure that MAX is controlled in the same way as NG; it was introduced to counteract the nonlinear lifting force caused by engine nacelles of the LEAP-1B engine and creates a stable increase in helm effort with increasing AoA. LEAP motors are larger and higher and closer to the front than older NG CFM56-7 motors to provide space for larger fans. This new arrangement and size of the engine nacelle causes turbulent flow near the engine nacelle body and creates lift at high AoA; since the nacelle is located in front of the center of gravity, this lifting force causes a small effect of increasing the pitch angle (i.e., reduces the effort on the helm), which can lead to that the pilot will further increase the pulling force at the helm and bring the aircraft closer to stall. Such non-linear / reducing steering force is not permitted in accordance with FAR §25.173 “Static longitudinal stability”. (FAR - Federal Air Regulations).Part 25 shows the airworthiness standards for aircraft in the transport category). Therefore, MCAS was created, which provides stabilizer commands for lowering the nose during sharp turns with high load factors (high AoA) and during flights with closed flaps at speeds close to the occurrence of stall.

Brady does not confirm his claims by any sources, and as far as I know, Boeing has not confirmed or refuted this statement. But the Aviation Week mentioned above , which I referred to, explaining the relationship between traction and pitch, in a newer issue ( March 20 ) supported the hypothesis of the instability of the lift caused by nacelles:

The larger MAX CFM Leap 1 engines provide greater lift at high AOA and provide the aircraft with a higher pitch angle than NG with CFM56-7 engines. MCAS has been added due to certification requirements in order to minimize management differences between MAX and NG.

Assuming Brady's point of view is correct, an interesting question arises: when did Boeing notice the instability? Have designers been aware of this danger from the very beginning of the project? Was it manifested during computer simulations, or during tests in aerodynamic tests on scale models? The story of Dominic Gates in the Seattle Times gives us a hint that Boeing might not have realized the seriousness of the problem before the flight tests of the first instance of the aircraft, which began in 2015.

According to Gates, the FAA security analysis protocol passed to Boeing’s management indicated that the MCAS will be able to move the horizontal stabilizer by no more than 0.6 degrees. In an aircraft launched on the market, MCAS can deflect it by as much as 2.5 degrees, and is able to act repeatedly until it reaches a mechanical limit of movement of about 5 degrees. Gates writes :

This limit was further increased because flight tests showed that to avoid stalling at high speeds, more tail travel is required when the aircraft is at risk of loss of lift and a spiral decrease.

The behavior of the aircraft in the event of stalling at a high angle of attack is difficult to model analytically, therefore, when test pilots perform procedures for exiting stall on a new aircraft, control software is often tuned to improve the characteristics of a jet flying vehicle.

It seems that the instability of MAX at high AoA is a property of the aerodynamic shape of the entire aircraft, and a direct way to suppress it would be to change this shape. For example, to restore static stability, you can increase the surface of the tail. But such modifications of the airframe would slow down the release of the aircraft, especially taking into account the fact that their need was discovered after the flights of the first prototypes. In addition, design changes could jeopardize the possibility of flying a new model with old-type flight rights. It must have been that changing software instead of modifying the aluminum structure seemed like an attractive alternative. Perhaps we will someday find out how this decision was made.

By the way, according to Gates, the FAA document with a safety analysis, which specifies a limit of 0.6 degrees, should be revised to reflect the true range of possible MCAS commands.

Instability

Instability is not necessarily a black mark for an airplane. There have been at least a few successful unstable designs in history since the 1903 Wright Flyer. The Wright brothers intentionally placed a horizontal stabilizer in front of the wing, and not behind it, because their previous experiments with kites and gliders showed: what we call stability can also be called slowness. Flyer front control planes (called front horizontal controls) reinforced any slight upward and downward movements of the nose. Maintaining a stable pitch required a high concentration from the pilot, but at the same time allowed the aircraft to react faster when the pilot wanted to increase or decrease pitch. (The pros and cons of a similar design are discussed in the article1984 Fred E.S. Sandpiper and Henry R. Jacks.)


Orville rules, Wilbur runs nearby, Kitty Hawk, December 17, 1903. In this picture we see the plane from the side of the tail. Front horizontal control - dual adjustable horizontal surfaces in front - seems to trigger a nose uplift. (Photo by WikiMedia .

Another seriously unstable aircraft was the Grumman X-29, a research platform designed in the 1980s. The X-29 wings were located at the rear; moreover, the main pitch control planes are installed in front of the wings, as in the Wright Flyer .


The goal of this bizarre project was to investigate extreme screwdriver designs sacrificing static stability for faster maneuvering. Not a single pilot could cope with such a jerky vehicle without support. It required a digital electronic control system, which sampled the state and regulated the control plane with a frequency of up to 80 times per second. The controller was successful, perhaps even too much. He allowed the plane to fly safely, but taming the instability, he left the aircraft with rather limited control characteristics.

I personally had some connection with the X-29 project. In the 1980s, I worked as an editor for a short time with members of a group at Honeywell who designed and built the X-29 control system. I helped prepare publications according to management rules, and also contributed to their implementation in hardware and software. This experience gave me enough information to understand that the MCAS has something strange: it is too slow to suppress the aerodynamic instability of a jet aircraft. While the X-29 had a response time of 25 milliseconds, the MCAS took 10 seconds to move the 737 stabilizer 2.5 degrees. At this pace, the system probably could not cope with the forces that lift the nose up in the loop of positive feedback.

There is a simple explanation for this. MCAS was not supposed to fly an unstable aircraft. She was supposed to restrict him from entering a regime in which he becomes unstable. The same strategy is used by other mechanisms to prevent stalling - they intervene even before the angle of attack reaches a critical point. However, if Brady is right about the instability of the 737 MAX, then this task becomes more urgent for MCAS. Instability means abrupt and dangerous descent. MCAS is a road fence that takes you back to the road when you are ready to tear off a cliff by car.

Which brings us to the issue of the announced Boeing MCAS fix plan. Reportedly, the modified system will not activate itself so steadily and will automatically shut down if it detects a large difference between the readings of the two AoA sensors. These changes should prevent the recurrence of recent accidents. But do they provide adequate protection against the fault that MCAS should have dealt with in the first place? When you turn off the MCAS, either manual or automatic, nothing will stop the reckless or misleading pilot from moving to that part of the flight mode area in which the MAX becomes unstable.

Without additional information from Boeing, one cannot say how serious instability can be, if it really exists. Brady's article on the Boeing 737 technical website claims that the problem is partially caused by pilots. In the normal state, for a long nose lift it is necessary to pull the control wheel more and more. However, in the field of instability, the pulling resistance suddenly drops, so the pilot may inadvertently pull the helm to a more extreme position.

Is human exposure a necessary part of instability, or is it just a reinforcing factor? In other words, if you remove the pilot from the feedback loop, will positive feedback still cause an uncontrollable nose lift? I haven’t found an answer yet.

One more question: if the root of the problem is a deceptive change in the force that resists the steering wheel movements that raise the nose up, then why not directly solve this problem?

The elevator boot mechanism transfers “false” forces to the pilot’s control wheel. Image taken from presentation of B737 NG flight controls by theoryce . The presentation was created for the 737 NG series, not MAX; perhaps the architecture has changed.

In 737 (and most other large aircraft), the force “felt” by the pilot through the control wheel is not a simple reflection of the aerodynamic forces acting on the elevator and other control planes. The feedback forces are mainly synthesized, they are generated by the elevator feel and centering unit - a device that monitors the state of the aircraft and generates the appropriate hydraulic pressure, pushing the helm in one direction or another. These systems could be given the additional task of maintaining or increasing the pulling force at the helm, when the angle of attack approaches the values ​​of instability. Artificially enhanced resistance is already part of the stall prevention system. Why not expand it to MCAS? (Perhaps there is a reasonable answer to this, but I do not know him.)

Where is his power button?

Even after the MCAS was accidentally turned on on the Lion Air 610, crashes and casualties could have been avoided if the pilots had simply turned this thing off. But why didn’t they? It seems like they never heard of MCAS, didn’t know that it was installed on the aircraft they controlled, and did not receive any instructions on how to disable it. There are no switches or buttons marked “MCAS ON / OFF” in the cockpit The system is not mentioned in the flight manual ( with the exception of the list of abbreviations ), and no transitional training programs were conducted for pilots switching from 737 NG to MAX. The training consisted of one or two hours (information varies) of working with the application for the iPad.

Boeing explains these omissions in historyWall Street Journal :

One senior Boeing official said the company decided not to divulge details to the crews because of fears of overloading ordinary pilots with too much information, as well as significantly more technical data than they could have learned.

To call this statement “hypocritical” means to say nothing. It is simply absurd. Boeing not only withheld the “details”, it basically did not mention the very existence of MCAS. And the argument about "too much volume" is simply stupid. I do not have a MAX flight manual, but the NG edition contains more than 1300 pages, plus another 800 pages of quick reference manual. A few paragraphs about MCAS would not overload a pilot who has already mastered the operation manual. Moreover, the manual describes in detail the speed-trim and mach-trim systems, which most likely belong to the same category with MCAS: they operate autonomously and do not provide the pilot with a direct interface for monitoring and regulation.

As a result of the Lion Air incident, Boeing stated that the MCAS shutdown procedure was described in the manual, although MCAS itself is not mentioned there. This procedure is indicated in the map for eliminating the problem of “getting out of control of the stabilizer trimmer”. It is not very complicated: you need to hold on to the helm, turn off the autopilot and traction control, if they are on; then, if the problem persists, turn the two switches marked “STAB TRIM” to the “CUTOUT” position. In the event of a malfunction, the MCAS was really only the last step.

This control card is a “memory action”; pilots must be able to complete these steps without looking at the manual. The Lion Air crew certainly should have known her. But could he understand that this card needs to be applied on an airplane whose behavior did not resemble what they saw when training and flying on the previous 737? According to the manual, the condition under which it was necessary to use a card to eliminate the problem of the stabilizer trimmer was “constant spontaneous movement of the stabilizer trimmer”. MCAS commands were not constant, but repeated, therefore, to diagnose the problem, it was necessary to make a leap in reasoning.


By the time of the Ethiopian crash, 737 pilots around the world knew about MCAS and its shutdown procedure. A preliminary report released earlier this month by Ethiopian Airlines showed that after a few minutes of fighting the control wheel, pilots of flight 302 nevertheless took advantage of the procedure from the control card and turned the STAB TRIM switches to CUTOUT. After that, the stabilizer stopped responding to MCAS commands about lowering the nose, but the pilots were not able to regain control of the aircraft.

It is not yet completely clear why they failed and what happened in the cockpit for the past few minutes. One of the possible factors is that the Cutout switch disables not only the automatic movement of the pitch trimmer, but also the manual ones, which are controlled by the buttons on the control wheel. The switch turns off all power to the electric motor that moves the stabilizer. In such a situation, the only way to move the trimmer is to turn the handwheels located next to the knees of the pilots. During the crisis of flight 302, this mechanism could be too slow to adjust the angle in time, or the pilots were too focused on pulling the helm back with maximum force that they did not try to use the handwheels. It’s also possible that they turned the switches back to NORMAL, by restoring power to the stabilizer motor. Such a possibility is not mentioned in the report, but the chart from the flight recorder hints at it(see below) .

Component causing system failure

One can argue about whether MCAS is a good idea when it works correctly, but when it turns on erroneously and directs the plane into the sea, no one dares to defend it. Apparently, the uncontrolled behavior in the Lion Air and Ethiopian disasters was caused by a single sensor malfunction. This should not happen in aviation. It is impossible to explain why any of the manufacturers of aircraft would intentionally create an airplane in which failure of a single part would lead to a fatal accident.

Protection against single failures is provided by redundancy, and this principle is so fully embodied in the 737 design that the machine can almost be considered two aircraft in one building.

В воздушных судах, которые используют автоматизацию в большем объёме, все элементы (датчики, компьютеры, приводы) обычно дублируются трижды.

In the cockpit there is room for two pilots looking at two different sets of instruments and using separate sets of controls. The left and right dashboards receive signals from different sets of sensors, the signals of which are processed by different computers. Each side of the cockpit has its own inertial control system, its own navigation computer, and its own autopilot. The aircraft has two power supplies and two hydraulic systems, plus mechanical backup systems in case of double hydraulic failure. Two control wheels in the normal state move in unison - they are connected under the floor - but if one wheel gets stuck, this connection can be broken, which will allow the second pilot to continue controlling the aircraft.

There is one exception to this list of duplicate systems: it seems that a device called a flight control computer (FCC) has been given special treatment. There are two FCCs on board, but according to Boeing 737 technical websiteOnly one of them works on each flight. All other duplicated components work in parallel, receive independent incoming commands, perform independent calculations, and transmit independent command actions. But in each flight, only one FCC performs all the work, and the second is in idle mode. The scheme for choosing an active computer looks strangely arbitrary. Every day, when you turn on the power of the aircraft, the FCC on the left side receives control in the first flight, then the device on the right side takes control in the second flight of the day, and so the two sides alternately change until the power is turned off. After reconnecting the power, alternate use starts again with the left FCC.

I am surprised at many aspects of such a scheme. I don’t understand why the relation to duplicated FCC devices is different than to other components. If one FCC fails, will the second automatically take control of the second? Can pilots switch between them in flight? If so, will this be an effective way to deal with MCAS failure? I tried to find the answers in the manuals, but I can’t trust my interpretations of what I read.

In addition, I had great difficulty finding information about the FCC itself. I do not know who produces it, how it looks and how it is programmed.


On the Closet Wonderfuls website, an item called “737 flight control computer” sells for $ 43.82 with free shipping. On the Airframer WebsiteThere are lists of many parts and materials suppliers for 737, but there is no information about the flight control computer. The device has a Honeywell nameplate. I was tempted to buy the device from the Closet Wonderfuls website, but I am pretty sure that the latest MAX models do not have such a device installed. I learned that earlier FCC was called FCE (flight control electronics, “flight control electronics”), and from this it can be understood that the device was analog, it performed integration and differentiation with the help of capacitors and resistors. I am sure that today the FCC has caught up with our digital era, but this may be specialized equipment made to order. Or a standard Intel processor in unusual packaging, perhaps even running on Linux or Windows. I just do not know.

В контексте катастроф MAX компьютер управления полётом важен по двум причинам. Во-первых, в нём находится MCAS; это компьютер, в котором запущено ПО MCAS. Во-вторых, любопытная процедура попеременного выбора FCC на каждом рейсе тоже повлияла на то, какой датчик AoA передавал входящие данные в MCAS. Левый и правый датчики присоединены к соответствующим FCC.

Если два FCC используются попеременно, это вызывает интересный вопрос об истории самолёта, потерпевшего крушение в Indonesia. Предварительный отчёт о катастрофе описывает проблемы с различными приборами и элементами управления на пяти рейсах на протяжении четырёх дней (в том числе и на рейсе, завершившемся аварией). Все проблемы возникали с левой стороны авиалайнера или вызывались рассогласованием между левой и правой сторонами.

The flight in the second line (Manado → Denpasar) is not mentioned in the preliminary report, but the plane had to fly from Manado to Denpasar in order to perform the flight the next day.


In which of the five flights was the left FCC the active computer? The last two, when MCAS was activated, were the first flights of the day, so they were supposedly driven by the left FCC. It’s hard to say about the rest, especially because the maintenance operations could be followed by complete power-offs of the aircraft, after which the sequence of alternate use of computers should start all over again.

It is reported that the upgraded MCAS software will take into account the signals from both AoA sensors. What will it do with additional information? So far, only one mention has been published: if the readings differ by more than 5.5 degrees, then MCAS will be turned off. But what if the readings differ by 4 or 5 degrees?

Примечание: в недавней статье Даниэля Оссманна из Германского центра авиации и космонавтики обсуждается вопрос алгоритмического обнаружения сбоев датчиков AoA.

How will MCAS choose a sensor to trust? Conservative (or pessimistic) engineering practices should give preference to higher readings in order to provide improved protection against instability and stall. But this choice also increases the risk of dangerous “fixes” caused by a faulty sensor.

The current MCAS system with alternate left and right sensor choices has a 50 percent chance of catastrophe when one accidental failure causes the AoA sensor to transmit erroneously high data. In the case of the same accidental failure on the one hand, the updated MCAS will have a 100% probability of ignoring pilot attempts to move to the stall area. Is this an improvement?

Broken sensor

Although the faulty sensor should not lead to an airplane accident, I would still like to know what happened to the AoA weather vane.

No one is surprised that AoA sensors may be malfunctioning. These are mechanical devices operating in an aggressive environment: winds exceeding 500 miles per hour and temperatures below –40 degrees Celsius.


A common type of malfunction is a stuck sensor, which is often caused by glaciation (despite having a built-in anti-icing heater). But a stationary weather vane will transmit constant data that does not depend on the actual angle of attack, and other symptoms were observed on flight 610. The flight recorder shows small fluctuations in the signals of the left and right instruments. Moreover, the oscillations of the two curves are closely aligned, and this makes us understand that they both tracked the same movements of the aircraft. In other words, it looks like the left sensor was working; he simply transmitted measurements shifted by a constant value of approximately 20 degrees.

Is there any other kind of failure capable of creating an observable bias? Of course: just bend the weather vane by 20 degrees. Perhaps he was touched by a passing truck or gangway. Another hunch: the sensor might not have been installed correctly, and the whole device turned out to be rotated 20 degrees. Several authors on the Professional Pilots Rumour Network website explored this possibility, but ultimately concluded that it was not possible. The manufacturer, who undoubtedly knew about such a danger, arranged the mounting screws and centering pins asymmetrically, so the device could be installed uniquely into the hole in the housing.

The same effect can be obtained with an assembly error during the manufacture of the sensor. The weather vane could have been improperly attached to the shaft, or the internal converter, which turns the angular position into an electrical signal, could have been incorrectly fixed. Did the designers ensure the impossibility of such errors? I do not know, I could not find drawings or photographs of the insides of the sensor.

While exploring other possible causes of the failure, I briefly reviewed the FAA's airworthiness standards for maintenance or replacement of AoA sensors. I found that there are several dozen, and some of them describe the same sensor installed on the 737 MAX ( Rosemount 0861 ). But not one of the reports I read describes a malfunction that can cause a permanent error of 20 degrees.

For a while I thought that the failure might have occurred not in the sensor itself, but somewhere further along the data transmission channel. It could be something simple, for example, a faulty cable or contact. Signals from the AoA sensor are transmitted to the Air Data and Inertial Reference Unit (ADIRU), in which the sine and cosine components are combined and digitized to produce a number representing the measured angle of attack. ADIRU also receives input from other sensors, including pitot tubes that measure air flow and static pressure receivers that measure air pressure. In addition, the device contains gyroscopes and accelerometers of an inertial control system that can track the movement of an aircraft without relying on external data.

But the information received in the future destroyed this idea. To begin with, the AoA sensor, dismantled by the Lion Air maintenance team on October 27, is now in the hands of the investigation. According to the news, he was “declared defective,” but I have not yet heard any mention of specific defects. In addition, it turns out that one of the elements of the control system, the Stall Management and Yaw Damper (SMYD) control computer, receives direct analog sine and cosine voltages from the sensor, rather than the digitized angle calculated by ADIRU. It is SMYD that controls the function of the steering wheel vibration alarm. On both the Lion Air and Ethiopian flights, the vibrator was active almost continuously, so these analog sine and cosine voltages should indicate a high angle of attack. In other words, the error already existed before the signal hit the ADIRU.

I am still confused by the constant angular offset in the Lion Air flight data, but now this question seems a little less important. From the preliminary report on Ethiopian flight 302, it follows that the left AoA sensor on this aircraft also crashed terribly, but in a completely different way. Here are the relevant graphs from the flight recorder:


The readings of the AoA sensors are at the very top, the red line is the left sensor, the blue line is the right one. On the left side of the graph, they are slightly different when the plane should have just begun to move, but when moving along the runway, the plane gained speed, their readings began to almost coincide. However, during takeoff, there was a significant discrepancy - the left weather vane began to show a completely impossible nose angle of 75 degrees. Later, it decreases by several degrees, but otherwise does not show signs of oscillations that would suggest a reaction to the air flow. At the very end of the flight, there are other unexpected deviations.

By the way, the blue graph of the automatic balancing commands gives another hint of what could have happened in the last moments of flight 302. Approximately in the middle of the graph, the STAB TRIM switches were pressed, which led to the fact that the automatic nose lowering command did not affect the position of the stabilizer. But in the rightmost one, another automatic nose-lowering command affected the trim position graph, and this suggests that the Cutout switches were turned on again.

Other puzzles

But there is still much that I still do not understand.

Riddle number 1. If Lion Air and Ethiopian accidents were caused by faulty AoA sensors, this means that the brand new aircraft had three parts with similar defects (including the spare sensor installed in the Lion Air plane on October 27). From recent news, it became known that the spare part was not new, but restored in a Florida workshop called XTRA Aerospace . This fact allows us to appoint another possible culprit, but the two sensors installed by Boeing were not supposedly restored, so only XTRA cannot be blamed for all of them.

There are currently approximately 400 MAX aircraft in operation with 800 AoA sensors installed. Is a 3/800 bounce rate unusual or unacceptable? Does this judgment depend on whether the defect was the same in all three cases?

Riddle number 2. Let's take a look at the pitch trim and angle of attack graphs in the Lion Air 610 data again. The conflict of manual and automatic commands attracted everyone's attention, but what happens in the first few minutes also puzzles me.


While driving on the runway, the pitch balancing system was set to almost the maximum position for increasing the pitch angle (blue line). Immediately after take-off, the automatic balancing system began to transmit commands for further movement to increase the pitch angle, and the stabilizer probably reached its mechanical limit. At this point, the pilots manually directed it towards decreasing the pitch angle, and the automatic system responded with a quick sequence of commands to increase the pitch angle. In other words, the "tug of war" between the pilots and the automation has already begun, but the pilots and automated control pulled in the opposite directions to those that they choose in the future. All this happened while the flaps were still open, that is, the MCAS could not be active. These commands to increase the pitch had to transmit some other element of the control system. Mysteriousness aggravates that the left AoA sensor was already transmitting its erroneously high readings to the left flight control computer. If the FCC acted in accordance with these data, then he should not have sent commands to increase the pitch.

Riddle number 3. AoA readings are not the most interesting data from the information in the Lion Air preliminary report. Here are the graphs of altitude and speed:


The altitude reading on the left (red line) is only a few hundred feet. It seems that the error is more likely to be multiplicative than additive, probably it is 10 percent. The left and right airflow rates are also inconsistent, but the graph is too tight to quantify the difference. It was these discrepancies that initially irritated the pilots of Flight 610; they could see them on their devices. (There were no indicators of the angle of attack in the cockpit, so these conflicts remained invisible to them.)

Altitude, airflow rate and angle of attack - they are all measured by different sensors. Could they fail simultaneously? Or is there some kind of common point of failure that can explain all this strange behavior? In particular, could one unreliable AoA sensor cause all this chaos? I guess yes. Altitude, airflow, and even temperature sensors are affected by the angle of attack. Therefore, the measured speed and pressure are varied to compensate for this inconsistent variable using the output from the AoA sensor. This output was erroneous, so the changes allowed one stream of erroneous data to infect all airborne measurements.

Man or car

Six months ago, I wrote about another disaster caused by an out of control control system. In that case, the problem was the Massachusetts natural gas distribution network, an improperly configured pressure regulating installation which caused fires and explosions in more than 100 buildings, as well as the death of one person and serious injuries in twenty. Then I lamented that the special pathos of technological tragedies lies in the fact that the machines that we construct and create ourselves are the driving forces of our destruction.

In a world where defective automatic controls explode at home and cause planes to fall down, it’s difficult to argue for moreautomation, adding new layers of complexity to control systems, providing machines with greater autonomy. Society is leaning in the opposite direction. Like President Trump, most of us trust pilots more than scientists. We do not want MCAS on board. We want to see Chesley Sullenberger, the hero of USAir flight 1549, sending his faulty A320 to land in the Hudson River and saving 155 passengers. No level of automation in the cockpit will not allow such a trick.

However, a cold, analytical look at statistics suggests a different reaction. Human participation does not always save the situation. In contrast, pilot error is responsible for the largest number of fatal accidents. In one studypilot errors are declared the root cause of 40 percent of the disaster, and equipment failure is only 23 percent. No one (so far) advocates an unmanned cockpit , but at the current stage of development of aviation technology this is a much closer prospect than a computer-free cockpit.

The MCAS Model 737 MAX is a particularly awkward compromise between fully manual and fully automatic control. Programs are given a large share of responsibility for flight safety, and they are even given the opportunity to block the decision of the pilot. Nevertheless, in the event of a system malfunction, the responsibility for finding out the causes and their correction lies entirely with the pilot - and the situation needs to be fixed quickly, otherwise MCAS will send the plane to the ground.

Two destroyed planes and 346 deaths are convincing evidence that such a design is a bad idea. But what can we do about it? Boeing plans to move away from automatic control, returning more responsibility and power to the pilots:

• The flight control system will now compare incoming signals from both AOA sensors. If the sensors diverge by 5.5 or more degrees with the flaps closed, the MCAS will not be activated. An indicator in the cockpit will warn the pilots about this.
• If the MCAS is activated under abnormal conditions, then it will provide only one incoming signal for each transmitted event of increased AOA. There are no known or suspected failure conditions under which the MCAS will transmit multiple incoming commands.
• MCAS will never be able to transfer stabilizer commands more than those that can withstand the crew from the helm. Pilots will still always have the option of disabling the MCAS and manual control of the aircraft.

In a statement General Director Dennis Muilenberga Boeing says that the software update "guarantees 610 Lion Air impossibility of repetition flight accidents and flight 302 Ethiopian Airlines». I hope this is true, but what about the incidents that MCAS should prevent? I also hope that we will not be able to read about the stall and accident of the 737 MAX due to the fact that the pilots considered the MCAS to be malfunctioning and continued to pull the control wheels.

If Boeing chose the opposite approach - not to restrict MCAS, to improve it with new algorithms that work with the control system, then such a plan would be perceived with indignation and ridicule. It really seems like a terrible idea. MCAS was installed to prevent pilots from entering a hazardous area. A new surveillance system would monitor the MCAS, intervening with suspicious behavior. But wouldn’t we need another one looking after the one watching, and so on ad infinitum? Moreover, when each new layer of complexity is added, we get new side effects, unintended consequences and the possibility of breakdowns. The system becomes more difficult to test, and its correctness is impossible to prove.

These are serious objections, but the problem under consideration is also serious.

Assume that the 737 MAX would not have MCAS, but in the cockpit there was an indicator of the angle of attack. On a Lion Air flight, the captain would have felt that the helm vibration warning device warned him of impending stall and would see a dangerously high angle of attack on the instrument panel. His skills would tell him to do what MCAS did: lower his nose to make his wings work again. Would he continue to lower it until the plane collided with water? Of course not. He would look out the window, recheck the instrument readings on the other side of the cab, and after some terrible moments he would realize that it was a false alarm. (In the dark or in low visibility, when the pilot does not see the horizon, the result could be worse.)

I see two lessons in this hypothetical example. Firstly, erroneous sensor data is dangerous, no matter who controls the aircraft: a computer or Chesley Sullenberger. A intelligently designed instrumentation and control system would take steps to detect (and ideally correct) such errors. At the moment, the only protection against such failures is system redundancy, and in the unmodified version of MCAS even this protection was compromised. This is not enough. An important point that gives an advantage to live pilots is that they are reasonable and sometimes skeptical about the readings of the instruments. Such discretion is quite possible for automated systems. You can use many sources of information. For example, a mismatch between AoA sensors, pitot tubes,which of the sensors turned out to be malfunctioning. Inertial reference system provides independent control of the position of the aircraft; You can even use GPS signals. It is generally recognized that the main difficulty is the awareness of all these data and the extraction of the correct conclusions from them.

Secondly, the controller with feedback has another source of information: an indirect model of the controlled system. If you change the angle of the horizontal stabilizer, then you need to expect that the state of the aircraft will change in a known way - its angle of attack, pitch angle, air velocity, altitude and rate of change of all these parameters. If the result of the control action does not match the model, then something is wrong. Persistent transmission of identical commands when they do not produce the expected results is unreasonable behavior. In autopilots there are rules of conduct in such situations; similar health checks can also be implemented in low-level control rules that are performed during manual flight.

I am not saying that I have a solution to the MCAS problem. And I would not want to fly on an airplane that I designed myself. (Yes, and you don’t want to.) But there is a general principle, which, I think, must be taken with all my heart: if autonomous systems make decisions “between life and death” based on sensor data, then it is necessary to verify the correctness of these data.

April 11, 2019 update

Boeing continues to insist that MCAS “is not a stall protection function or a stall prevention function. This is a function of flight qualities. Opinions that this is something else are misconceptions. ” This statement was made by Boeing's vice president of product development and aircraft development, Mike Sinnett; The statement appeared in an article by Guy Norris in Aviation Week , published April 9th.

I don’t quite understand what “handling qualities” mean in this context. This expression seems to me to be something that can have more impact on comfort, aesthetics or convenience than safety. A plane with other flight qualities can be felt differently by the pilot, but can still be controlled without the risk of serious accidents. Does Sinnett allude to this statement? If yes, that is, if MCAS is not critical for flight safety, then I am surprised that Boeing does not want to just temporarily turn it off in order to return the planes back to the sky while the company is working on a final solution.

Norris’s article also quotes Sinnett’s words: “We are trying to avoid a situation where the pilot pulls the helm toward himself, suddenly it becomes easier to do, and he too lifts his nose up.” This situation, in which the nose is higher than the pilot wanted, reminds me of the state that precedes the stall.

The story , written by Jack Nikas, David Gells, and James Glantz in the New York Times , has a different perspective: it suggests that “flying qualities” were the motivation for creating the first version of MCAS, but the risks of stalling partially led to its further amplification.

Изначально система задумывалась для срабатывания только в редких условиях, а именно при высокоскоростных манёврах, чтобы обеспечить более плавное и предсказуемое управление для пилотов, привыкших летать на предыдущих 737. Это сообщили нам на условиях анонимности из-за ведущихся расследований два бывших сотрудника Boeing.

В таких ситуациях действия MCAS были ограничены перемещением стабилизатора — частью самолёта, меняющей вертикальное направление самолёта — примерно на 0,6 градуса за примерно 10 секунд.

Это было приблизительно на том этапе проектирования, когда FAA рассматривала первоначальную конструкцию MCAS. Самолёты ещё не прошли свои первые тестовые полёты.

После того, как в начале 2016 года начались тестовые полёты, пилоты Boeing обнаружили, что непосредственно перед сваливанием на разных скоростях MAX управлялся менее предсказуемо, чем им хотелось. Поэтому по словам бывшего сотрудника, находившегося в курсе переговоров, они предложили использовать MCAS и для таких ситуаций.

And finally, one more article in Aviation Week Guy Norris presents a convincing version of what happened to the sensor 302 Ethiopian Airlines flight angle of attack. According to Norris sources, the AoA weather vane was shot down seconds after take-off, possibly due to a blow about the bird. This hypothesis corresponds to the graphs extracted from the flight recorder, including strange-looking vibrations at the very end of the flight. I wonder if there is any hope of finding a lost weather vane, which was supposed to fall not so far from the end of the runway?