(1) The third report says that MCAS only operates in manual flight. The second report appears to confirm that since the pilot says he engaged autopilot sooner than usual to remove the possible MCAS threat.
(2) However, both the first and second reports describe uncommanded pitch down events while in autopilot. That means there is another problem in addition to the MCAS issue, since the latter should not be engaged at all when in autopilot. (If the root problem is an unreliable angle of attack sensor, that would explain both issues, since the AoA sensor would be used by the autopilot as well as by the MCAS.)
(3) We have an aircraft type that is known to have repeated uncommanded pitch down events while in autopilot, and it's still flying. Unfortunately, we already have other aircraft types (from Airbus, not Boeing) that have the same known issue that have not been grounded either. So the system as a whole simply seems to accept the risk of this happening without warning, and hoping that pilots will be able to respond as these pilots did (well done to them) and avoid an actual incident.
A330 has figured in the incidents, but AFAIK the flight control software and angle of attack sensors that are implicated in those incidents are the same in all of the Airbus models.
> They never quite figured out the root cause of the un-commanded dives
Yes, they did. Read the "Conclusion" under the "Final Report" section. The "design limitation" they're referring to is that, first, the autopilot is not driven by an average or majority vote of the three angle of attack sensors, but by one of them only (which one depends on whether the captain or first officer's position engaged the autopilot), and second, the other two angle of attack sensor inputs are not used to check the sensor that is driving the autopilot, so if that sensor gives faulty input (the "multiple spikes" described), the faulty input is allowed to trigger uncommanded events such as the violent pitch down that happened on Quantas Flight 72.
What should happen is that the input from all three angle of attack sensors should be combined: as long as all three of them are within some tolerance, the average of the three becomes the angle of attack used to drive the autopilot. If one goes out of tolerance compared to the other two, its input is discarded until it comes back into tolerance (so "multiple spikes" from one sensor would simply be ignored). If it takes too long for the one sensor to come back into tolerance compared to the other two, that sensor gets ignored for the remainder of the flight and the pilots get notified. If it gets to a point where no two of the sensors are within tolerance of each other, the autopilot gets disengaged and a big red light goes on in the cockpit. I am unable to understand why that is not how the system is designed, but the investigation reports make clear that it isn't.
From the reports:
Synopsis
B737MAX Captain reported an autopilot anomaly in which led to an undesired brief nose down situation.
Synopsis
B737 MAX First Officer reported that the aircraft pitched nose down after engaging autopilot on departure. Autopilot was disconnected and flight continued to destination.
Regardless of the usual tone, I find this particular paragraph a fairly terrifying indictment of cockpit human factors across the board. Apparently it's not unusual for aircraft behave unusually with the pilots not understanding why - and the poor pilots "generally" blame themselves!
Aircraft have many states, and there is a lot of information to process to fly an aircraft, even in normal flight. When situations develop in real time, it takes a lot of mental horsepower to understand the situation and react appropriately. Despite all this, aviation is safer than driving a car.
It is one of the reasons I find aviation to be inspiring. Conscientious humans have mastered this unforgiving domain through effort and power of will. When you talk to a real pilot, there are certain mannerisms that they share that tend to show that the practice of flying really makes you a thoughtful person.
"The fact that this airplane requires such jury rigging to fly is a red flag"
I'm wildly speculating here, but since wing loading is also a factor in calculating the angle of attack at which a potential stall condition could occur, I'm also wondering if it relies on the accuracy of the weight and balance the pilots enter into the flight computer. Pilots have missentered such critical information before.
But I know that for instance there are plenty of alarms warning the pilots about the proximity to terrain.
Besides, there were excellent visibility conditions at the time of the accident so, even if the autopilot were able to drive the plane into ground, the pilots would have realized that not only by seeing the other instruments but looking through the window as well.
The available radar data also shows there's been a struggle to keep the airplane flying. An autopilot-controlled flight into terrain wouldn't show such pattern.
The MAX family has more powerful engines, and they are a bit projected ahead under the wings. This makes the plane susceptible to point its nose up during full throttle, which could lead to a stall.
This system shouldn't be confused with the regular autopilot. It plays a completely different role and, the way it's designed, it should engage only under very specific conditions.
ACN: 1597286
"Day 3 of 3 departing in a MAX 8 after a long overnight. I was well rested and had discussed the recent MAX 8 MCAS guidance with the Captain. On departure, we had strong crosswinds (gusts > 30 knots) directly off the right wing, however, no LLWS or Micro-burst activity was reported at the field. After verifying LNAV, selecting gear and flaps up, I set "UP" speed. The aircraft accelerated normally and the Captain engaged the "A" autopilot after reaching set speed. Within two to three seconds the aircraft pitched nose down bringing the VSI to approximately 1,200 to 1,500 FPM. I called "descending" just prior to the GPWS sounding "don't sink, don't sink." The Captain immediately disconnected the autopilot and pitched into a climb. The remainder of the flight was uneventful. We discussed the departure at length and I reviewed in my mind our automation setup and flight profile but can't think of any reason the aircraft would pitch nose down so aggressively."
ACN: 1597380
"It was day three of six for me and day three with very good FO (First Officer). Well rested, great rapport and above average Crew coordination. Knew we had a MAX. It was my leg, normal Ops Brief, plus I briefed our concerns with the MAX issues, bulletin, MCAS, stab trim cutout response etc. I mentioned I would engage autopilot sooner than usual (I generally hand fly to at least above 10,000 ft.) to remove the possible MCAS threat.
Weather was about 1000 OVC drizzle, temperature dropping and an occasional snow flake. I double checked with an additional personal walkaround just prior to push; a few drops of water on the aircraft but clean aircraft, no deice required. Strong crosswind and I asked Tug Driver to push a little more tail east so as not to have slow/hung start gusts 30+.
Wind and mechanical turbulence was noted. Careful engine warm times, normal flaps 5 takeoff in strong (appeared almost direct) crosswind. Departure was normal. Takeoff and climb in light to moderate turbulence. After flaps 1 to "up" and above clean "MASI up speed" with LNAV engaged I looked at and engaged A Autopilot. As I was returning to my PFD (Primary Flight Display) PM (Pilot Monitoring) called "DESCENDING" followed by almost an immediate: "DONT SINK DONT SINK!"
I immediately disconnected AP (Autopilot) (it WAS engaged as we got full horn etc.) and resumed climb. Now, I would generally assume it was my automation error, i.e., aircraft was trying to acquire a miss-commanded speed/no autothrottles, crossing restriction etc., but frankly neither of us could find an inappropriate setup error (not to say there wasn't one).
With the concerns with the MAX 8 nose down stuff, we both thought it appropriate to bring it to your attention. We discussed issue at length over the course of the return to ZZZ. Best guess from me is airspeed fluctuation due to mechanical shear/frontal passage that overwhelmed automation temporarily or something incorrectly setup in MCP (Mode Control Panel). PM's callout on "descending" was particularly quick and welcome as I was just coming back to my display after looking away. System and procedures coupled with CRM (Resource Management) trapped and mitigated issue."
ACN: 1593017
"The recently released 737 MAX8 Emergency Airworthiness Directive directs pilots how to deal with a known issue, but it does nothing to address the systems issues with the AOA system.
MCAS (Maneuvering Characteristics Augmentation System) is implemented on the 737 MAX to enhance pitch characteristics with flaps UP and at elevated angles of attack. The MCAS function commands nose down stabilizer to enhance pitch characteristics during steep turns with elevated load factors and during flaps up flight at airspeeds approaching stall. MCAS is activated without pilot input and only operates in manual, flaps up flight. The system is designed to allow the flight crew to use column trim switch or stabilizer aisle stand cutout switches to override MCAS input. The function is commanded by the Flight Control computer using input data from sensors and other airplane systems.
The MCAS function becomes active when the airplane Angle of Attack exceeds a threshold based on airspeed and altitude. Stabilizer incremental commands are limited to 2.5 degrees and are provided at a rate of 0.27 degrees per second. The magnitude of the stabilizer input is lower at high Mach number and greater at low Mach numbers. The function is reset once angle of attack falls below the Angle of Attack threshold or if manual stabilizer commands are provided by the flight crew. If the original elevated AOA condition persists, the MCAS function commands another incremental stabilizer nose down command according to current aircraft Mach number at actuation.
This description is not currently in the 737 Flight Manual Part 2, nor the Boeing FCOM, though it will be added to them soon. This communication highlights that an entire system is not described in our Flight Manual. This system is now the subject of an AD.
I think it is unconscionable that a manufacturer, the FAA, and the airlines would have pilots flying an airplane without adequately training, or even providing available resources and sufficient documentation to understand the highly complex systems that differentiate this aircraft from prior models. The fact that this airplane requires such jury rigging to fly is a red flag. Now we know the systems employed are error prone--even if the pilots aren't sure what those systems are, what redundancies are in place, and failure modes.
I am left to wonder: what else don't I know? The Flight Manual is inadequate and almost criminally insufficient. All airlines that operate the MAX must insist that Boeing incorporate ALL systems in their manuals."