Boeing presents MCAS fix to pilots, regulators and media

By Bjorn Fehrm

March 27, 2018, © Leeham News.: Boeing presented the software fix to the MCAS problem in a press briefing ahead of meeting 200 Pilots and Regulators in Seattle today for a briefing around the 737 MAX update.

Here is what Boeing presented in its briefing to media:

Figure 1. Pilot’s Primary Flight Display with modifications after the software update. Source: Wikipedia and Leeham Co.

MCAS gets improved functions

Boeing has been developing an improved version of MCAS since the Lion Air accident. According to Vice President of Product Development and Product Strategy Mike Sinnett, the development started when Boeing understood the MCAS function could play a role in the accident.

“We always analyze operational events and accidents which are customer experience with our aircraft and we work on improvements as we understand how these can be made” said Mike Sinnett. We have been testing a new version of MCAS in our labs and simulators since months and we have conducted test flights with it, also with the FAA present. We have now flown our production 737 MAX test flights since two weeks with this improved software load.”

Here is what has changed regarding MCAS, said Boeing:

MCAS is designed to activate in manual flight, with the airplane’s flaps up, at an elevated Angle of Attack (AOA).

Boeing has developed an MCAS software update to provide additional layers of protection if the AOA sensors provide erroneous data. The software was put through hundreds of hours of analysis, laboratory testing, verification in a simulator and two test flights, including an in-flight certification test with Federal Aviation Administration (FAA) representatives on board as observers.

The additional layers of protection include:

  • Flight control system will now compare inputs from both AOA sensors. If the sensors disagree by 5.5 degrees or more with the flaps retracted, MCAS will not activate. An indicator on the flight deck display will alert the pilots.
  • If MCAS is activated in non-normal conditions, it will only provide one input for each elevated AOA event. There are no known or envisioned failure conditions where MCAS will provide multiple inputs.
  • MCAS can never command more stabilizer input than can be counteracted by the flight crew pulling back on the column. The pilots will continue to always have the ability to override MCAS and manually control the airplane.

These updates reduce the crew’s workload in non-normal flight situations and prevents erroneous data from causing MCAS activation.

The key points of the update

The Angle of Attack signal, coming from the sensor to the ADIRU (Air Data Inertia Reference Unit) on each side of the aircraft will be compared before sending it on to the Flight Control Computer (FCC) to trigger the MCAS function.

If the AoA disagrees by more than 5.5° when the flap is retracted, MCAS will be disabled for the flight. To warn the pilots of the missing MCAS, an AoA disagree will be displayed on the Pilots Primary Flight Display (PFD), Figure 1.

MCAS will also be disabled and if the AoA Disagree displayed with the AoA differs more than 10° for over 10 seconds during flight.

When a valid Angle of Attack passes a set threshold close to stall, with the threshold dependent on speed and other data, the MCAS function will trigger. But it won’t repeat if the Pilot trims during or after the MACS intervention. It will just trim once nose down for every passing of the AoA threshold. Today’s function repeated over 20 times in the Lion Air case as the pilots trimmed against a faulty AoA signal.

Finally, the amount of trim the MCAS function is allowed to trim will not pass the limit where the aircraft is fully controllable in pitch even if the pilots do nothing to stop MCAS to trim nose down. Today’s function will run to max trim nose down if the pilots trim against but not long enough to compensate for the aggressive MCAS nose down trimming.

Implementation of the fix

Boeing will now work to have the software update, which takes about one hour to install on the 737 MAX, approved by the world’s Airworthiness authorities. As the authorities are in the drivers’ seats for when the update gets approved to install, it’s impossible to say when the individual airline’s 737 MAX will fly again. It all depends when their local regulator approved the fix and allow the MAX to return to operation.

Before the 737 pilots are allowed to fly the updated 737 MAX, they will be obliged to pass a training curriculum which Boeing has produced and the aircraft’s manuals need updating. Here Boeing’s statements regarding training and changed manuals:

To earn a Boeing 737 type rating, pilots must complete 21 or more days of instructor-led academics and simulator training. Differences training between the NG and MAX includes computer-based training (CBT) and manual review.

Boeing has created updated CBT to accompany the software update. Once approved, it will be accessible to all 737 MAX pilots. This course is designed to provide 737 type-rated pilots with an enhanced understanding of the 737 MAX Speed Trim System, including the MCAS function, associated existing crew procedures and related software changes.

Pilots will also be required to review:

  • Flight Crew Operations Manual Bulletin
  • Updated Speed Trim Fail Non-Normal Checklist
  • Revised Quick Reference Handbook

As of now, the MCAS is classified as a sub-function of the Speed Trim System which 737 pilots have been flying with since decades. Speed Trim enhances the pilots feel for the 737 at speed changes at low speeds. It trims in a schedule somewhat similar to MCAS but has some distinct differences:

  1. Speed Trim works with extended and retracted flaps. It trims when the speed of the aircraft is increased or decreased. Mostly it trims in the opposite direction to what MCAS would have done in a certain flight situation.
  2. Speed Trim is inhibited by the yoke trim hold switches, which stop Speed Trim if the pilot pulls against. MACS ignores the pilot if he doesn’t agree with what MCAS is doing; Speed Trim takes account of the pilot holding against Speed Trim.
  3. Speed Trim doesn’t trim on Angle of Attack data, it triggers after several flight data values, among them speed change, have fulfilled certain criteria. It is not as hooked on a single value as MCAS and by it not prone to errors.

In summary, Boeing now starts the long road of getting the improved MCAS function accepted and approved by all the countries Airworthiness authorities where 737 MAX airlines operate. It used to be a swift and smooth process; no longer. The dominant FAA, which other regulators followed without much discussion, has lost authority and this will take time to regain.

 

 

111 Comments on “Boeing presents MCAS fix to pilots, regulators and media

  1. For more than 300 people, this seems too little, too late.
    Hope that it really solves the problem, but still thinking: wouldn’t it be better to wait untill the Ethiopian Crash is better known? Perhaps more things could be learned with that fatal crash. If MCAS was involved in that crash too, do they know if this fix could prevent it?

      • I believe so. They have all but neutered it (maybe left a couple of glass balls in for appearance)

        Sans a true stall approach it can’t and won’t rear its ugly head (two AOA going off the reservation and reading 5 deg or less is the one opening I see)

        You could write some more code but worst case its very limited even if it does activate.

  2. Why has there been no significant discussion on the reason(s) for the erronious AOA sensor readings?

    • “Why has there been no significant discussion on the reason(s) for the erroneous AOA sensor readings?”

      Good point. I would also suggest that someone should study if two sensors are enough. Airbus has three sensors doing a similar function.

      • You only need a third sensor to resolve a disagreement if the automation will continue to operate in in the face of that disagreement. If you disable the automation when there is a disagreement no third sensor is needed.

        • There has been discussion with the more informed forums.

          Its not hit the headlines but new people are not tech people so they don’t realize the other part of this.

          It is getting addressed.

          As it logs into the maint system now it will not only inactivate the MCAS it will be a fix it item.

        • But if one is in a flight condition where MCAS has activated, how does one know, necessarily,
          that it’s a spurious activation? To my mind three
          sensors are needed, as with the Airbuses.

          • Bill: The design basis of hte 737 does not work well for that.

            One is older relay based logic, it has two computers not three. Each one is programed separately by two different teams.

            Both flying sides has its own and the pilots determined which is in control.

            There is a separate system without AOA that feeds backup instrumentation system.

            That said, if two sensors fail then yo9u have the same problem, there is no longer two out of three and if they both fail the same then you have two out of three and bad data being accepted (and it has happened)

            None of it is slam dunk easy for reliable. Neither is wrong. Both work.

            Don mistake a crappy implementation with the need for something that is not there in the first place.

            I continue to feel the Airbus system has its holes as well, stuff that should stay automated does not and per AF447, pilots then screw up the response.

            Automated right would assume at that speed and altitude the pitots froze up and maintain as is while putting an alert up.

            Instead it shut down to the second state of automation which gives part control to pilots not expecting it and alarms went off.

            Pilots are now proven in many cases to screw it up (or did, training is much better now in US and Europe in that regard and getting better)

            All you need to do is program the logic to announce pitots are temporary gone, maintain or revert to the known longer term solution’s (5 deg snows up and 85% power)

            The logic in dumping it off to the pilots is as dumb as the MCAS was.

    • Because that will be fixed out of direct (over)sight.
      Just like the algorithm overcharging the 787 batteries.

  3. “There are no known or envisaged failure conditions where MCAS will provide multiple inputs”

    And,

    “it will only provide one input for each elevated AOA event”

    Hmmm, I hope their high AOA event detector is up to snuff. Like, safety critical up to snuff. Afterall we all know what happens when that goes wrong, and MCAS keeps firing.

    Let’s think of more things that could go wrong. An electronic fault which keeps triggering MCAS inputs to trim. An incomplete analysis of the failure modes of all the sensors and wiring involved. Possible rates of real high AOA events in turbulence. A software bug that has escaped notice in the reviews and testing.

    It beggars belief that they’re going down this route. For this to be safe, Boeing have to prove a negative (ie it won’t do what it’s designed to do too often) for a single channel non redundant unvoted system. This is logically impossible.

    Well, I await the reaction of the EASA, and everyone else. But in my opinion this is far from a proper fix.

    • Goofy stabilizer behavior will be an auto shut off the Stab motors.

      You can try to put illogicals into the system but if the program is good (done by two different groups for each side computer) then its virtually impossible and putt is into the realm of Sully and two engines gone.

      Time to earn your pay and training and stabilize it.

      • So you agree that detecting goofy stabiliser behaviour is something that is safely critical?

        • I never said otherwise.

          I have always said the programing was crap and the lack of training on a new system is an atrocity .

          Yes well trained pilots should be able to handle it and equably they should have been trained and this is not something that should occur they should have to handle.

          Boeing FLCH Trap is also garbage.

          • Ok, fair enough.

            If it is to be safety critical, its implementation is going to take a whole lot more than a software patch.

    • Don’t forget MCAS could develop self awareness and decides it needs to kill the crew.

      • Hmm, well so far it’s not needed self awareness to do that, seems quite capable of doing so already.

        What we’re really looking for is Boeing becoming aware of what they’re doing, and how it looks.

        • Now that is something that should be burned over the door at Boeing HQ

          • I have a picture in my mind of military drones with AI taking off to bomb the enemy, but on the way deciding the best thing they can do for their country is turning around and bombing their own Parliment/Congress/The White House/The Kemlin/Canberra /No 10, take you pick.

  4. Quote:
    It will just trim once nose down for every passing of the AoA threshold.
    unquote.

    Question. What if the AoA get high, MCAS trim down once, then the AoA gets normal, but before MCAS has unwound -say after only one sec of normal AoA- AoA gets high again, will it then trim down once more, or does it remember it had recently trimmed down and have not unwound all of the first trim down cycle?

    I could ask many more similar questions, so I really hope there is A LOT more to the MCAS v.2 than is explained in this post by Bjørn.

  5. @Ramiro
    There seems to be an understandable overriding push to get the MAX back in the air for economic reasons. Let’s hope that this is a better call than leaving the MAX flying after the Lion Air crash.

    @Trooper
    There has been at least one instance that I am aware of where the three sensors in an Airbus were almost not enough. The flight crew had to turn two systems off so that the aircraft switched to alternate law to enable the crew to control the aircraft.

    It would cost too much money to retro fit all the MAX aircraft with a third AOA sensor ? Safety still does seem to have a monetary value. The AOA disagree option of the PFD was allegedly $80,000, how much extra would another AOA sensor system cost per aircraft ?

    Personally I would be tending towards over-engineering, rather than doing just enough. Three is likely a lot better than two, which is a great deal better than one.

    “MACS ignores the pilot if he doesn’t agree with what MCAS is doing; Speed Trim does.” regarding the yoke trim hold switches, from a human factor / ergonomic aspect, I still think it would be better if pulling back on the yoke stopped the trim full stop.

    I wonder why it’s so necessary for MCAS to ignore the pilot. I’ve seen it said on this forum that MCAS is purely there for certification, to improve the pitch moment curve. It’s starting to feel very much like an anti-stall device.

    • Perhaps, it is some Paranoia, but I’m still not very confident with “The Fix”. If MCAS was put there in the first place, with such an extraordinary authority to override the Pilot’s decision, why do you change it now?
      There must be a reason it was used that way, even to get some people killed. Now, they are defusing it, but then, it seems to be a real necessity to have it working. So, perhaps one should ask: what if this new fix produces the other problem: A nose up pitch that provokes a deep stall?

      • And how much attention an AoA disagree alarm will get from a third world LCC maintenance crew? They will reason, hey if the plane could fly this flight with this sensor fault just fine, it must not be that important, Let’s ignore it for now we dont have the spare parts anyway. Next thing you know, they have some strong low altitude turbulence on descent one day and MCAS 2.0 equipped 737-MAXs are back flipping to yet another couple of “humbling” crashes.

        • MEL, short for Minimum Equipment List. If something is broken and it is in the MEL, the aircraft cannot fly. One would hope that AOA sensors are part of the MEL.

          • If something is in the MEL then it CAN fly; sometimes with operational restrictions or maintenance actions and usually for periods not to exceed 3, 10 or 120 days.

            If it’s not in the MEL, then the aircraft can’t fly.

          • The software has been in development for 5 months, its not like it sprouted out of thin air.

            Aircraft can fly with broken system, pilots then have to know what the revert backup is.

            That too is an interesting burden to put on a pilot that is off routine and questionable.

    • Good comments. Boeing….ru listening? Many minds better than a few…Hard to believe a single sensor (single point of failure) would ever have passed muster. Is there published data out there for the reliability / repeatibility of results from these sensors? What % time is there 5 deg disagreement in aircraft with two sensors? Logs will have this data. Is the AOA the best device to sense impending stall? Just asking… comments please..

      • There are many very good comments here. If only the so-called mainstream media would ask some of the responders here to edit their (mainstream) articles. But there’s one point that I haven’t seen raised:

        In all the certification testing of the MAX what scenarios were used to check on MCAS activation? How many unexpected activations were there, in what circumstances, and what was done about them? Pre-cert testing is supposed to bring out such concerns; what actually happened?

  6. Quote:
    If the AoA disagrees by more than 5.5° when the flap is retracted, MCAS will be disabled for the flight.
    MCAS will also be disabled and if the AoA Disagree displayed with the AoA differs more than 10° for over 10 seconds during flight.
    unquote.

    I read this as if the AoA disagrees with more than 5,5 degrees at the MOMENT the flaps are retracted then MCAS will be disabled for the duration of the flight. Furter MCAS will be disabled after ten seconds of AoA disagree of ten degrees or more, but here it doesnt state if the disabling is only active as long as the AoA disagree stays at more than ten seconds or if it will be for the duration of the flight.

    So, another imagined scenario… Maneuvering at lowish heights and lowish speeds, flaps up. True AoA 4 degrees, faulty sensor 8 degrees more, no deactivation of MCAS, faulty sensor indicating 4+8=12 degrees. MCAS kiks in, applying 2,5 degrees nose down. Pilots in bank, not visual, slow to react….
    Variation to the scenario: MCAS kiks in, pilots countering with manual trim up, but not enough, MCAS stops for 5 sec, pilots still not visual, in a bank, faulty sensor goes below treshold, then above before MCAS are unwound, kiks in another time with a full 2,5 degrees, pilots still not visual, stick heavy, speed increases….

    There is so many questions and fault modes. To be able to assume MCAS v.2 is fault tolerant and safe one need to know every little detail of how its logic is set up. I would say it have to be fairly advanced with hundreds of if>then, else, and, or, not, greater then, less then, compare, go to, wait, jump and all the other logic funktions and other maths.

    • One thing I don’t understand is, if it’s somehow deemed acceptable for the pilots to fly the aircraft with MCAS disabled due to a fault as a default aircraft mode, why is MCAS needed at all?

      Boeing seem to be proposing that they won’t be flight or sim trained for this, thus saving training money. But pilots will then be forced to learn in the air how to fly it the first time it disables itself? And what’s acceptable about that, given that MCAS is somehow deemed necessary?

      What’s MCAS actually for, either then, or now, or sometimes when it’s working now? I sense a confusion of purpose. In which case, surely it’s pretty hard to come up with an actual safety case that holds water?

      We systems engineers now have a wealth of examples on How Not To Do It coming out of Boeing. Interestingly, Airbus seem to be a shining paragon of virtue…

      Is there any indication that the FBI, DoT or DoJ are going to intervene? It’s going to descend into farce if the EASA et al reject the mods, and the DoT stops it too. Boeing and FAA seem to be betting what’s left in the kitty on a quite risky strategy, one where there’s multiple parties (all the world’s authorities) any one of which could scupper it.

      • Agree just what is it really for ?
        “MCAS will be disabled for the duration of the flight” so if that’s the case, do the flight crew then look for their closest alternate, and land the aircraft, or isn’t it that critical ?

        In https://www.msn.com/en-us/news/world/in-test-of-boeing-jet-pilots-had-40-seconds-to-fix-error/ar-BBVetZK?li=AA59G2 and other similar articles “One of the people involved in the training said MCAS was surprisingly powerful once tested in the simulator”

        When the MAX approaches a stall, does it progress so rapidly that we can’t trust the pilot’s reactions, and need MCAS to push the nose down ?

        I would have thought the minimum of extra training would be for the pilots to experience MCAS activation at both low, and high altitudes in a simulator.
        A bit of extra iPad training is not giving me a warm feeling.

        • I’ve asked the same questions.

          There is a stabilize acquirement in that envelope of flight. So they fix it.

          As elevator blow down they can’t fix they ignore it.

          Grab you hand wheel and start craning.

          Welcome to the world if reality.

          • Gibberish. In what language are you trying to comment?

          • Yea, I don’t have the edit function.

            I type 38 mistakes a minute

            Start Cranking (the trim wheeel)

      • Excellent questions. I’m interested to see, in particular, how
        the non-FAA regulators handle these issues.

        Imagine a third 737MAX falling out of the sky…

      • “We systems engineers now have a wealth of examples on How Not To Do It coming out of Boeing. Interestingly, Airbus seem to be a shining paragon of virtue…”

        How soon we forget Air France 447…

        • On AF 447 the system detected a malfunction in sensor input correctly and did shut off autopiloting systems.

          AF 447 is quite the opposite of the two MAX incidents.

          • Sort of: the automation couldn’t handle the situation, so it disconnected and you had not 1, not 2, but 3 international widebody pilots manually stall an airplane from 38,000 ft into the ocean killing everyone, with no idea what they were doing until that last few seconds. It was a spectacular failure of pilot training and effective flight deck CRM. Northwest Airlines had more than one incident similar to Air France on their 330s, and yet they were able to set a known pitch and power and fly the airplane until the situation cleared itself. Air France… they were unable to conceive of such a thing and execute it. Everyone is quick to blame an airplane, but at some point you HAVE to have pilots who know how to turn everything off and fly the d@mn thing like an airplane. You can’t engineer every problem out of an airplane to compensate for an air carrier’s inexperienced and poorly trained pilots. Yes, safety has a cost. EVERY company in EVERY industry has to evaluate safety against cost and come up with an acceptable balance. Otherwise we, as a species, would have walked away from fire when it was first discovered due to fears of being burned. Boeing made a HUGE mistake in the way the code for MCAS was written, and they will pay dearly for it, but you can’t discount the importance of the quality of the people you have sitting in the pointy end of the airplane. Countries are going to have to figure out how to train and make general aviation more available to their people to gain more experience before they jump in a large jet transport aircraft and take hundreds of lives in their hands and go fly.

          • Brian:

            Re: AF447

            To be fair to the Captain, he wasn’t summoned to the flight deck until it was too late. The senior first officer was the culprit. He was transfixed in holding the stick back. The junior first officer did try and push the stick forward, but couldn’t overrule the senior first officer. It was the junior first officer who summoned the Captain, but not enough height left.

            But as you say, it was a pilot induced stall from 38,000 ft. Daft.

          • if the FO had just fainted all would be alive..

          • Philip,

            True, but if one knew the other guy was making the situation worse… if he knew it before he finally realized what was going on, which was when it was too late, he probably would have cracked the other guy over the head if necessary to get him off the stick. The Capt took a long time to resume command and figure it out himself. The CVR transcript reads of complete confusion and inability to understand the current predicament. The absence of CRM, of basic communication, was a terrifying reality on that flight deck, even when the Captain came in. Set a known attitude and known thrust setting and then evaluate. When the rubber meets the road (did I just use a cliché?!), it’s basic aviating that ultimately is responsible for caring for the unsuspecting people in the back. Regardless, you and I agree. This is a very complicated industry; one in which we play for keeps. Rarely will one get a “re-do” to make up for mistakes. Could I go out and make the same mistake one day? The scary part is yes. The less scary part is that I am willing to admit it and do everything I can to mitigate it, including the new training we all have for pitot icing and airspeed disagree. The basic skill set is present, but sometimes things can get too much, and we have to be able to communicate and come together as a team on a flight deck. That is one of the primary factors in whether a crew successfully returns an airplane to the ground safely, or it becomes a situation where many innocent people perish. Basic aviating to maintain aircraft control in ALL instances, and effective communication and resource management to sort out the root of the problem and come up with a workable solution.
            I’m long-winded… my apologies.

      • MCAS is maily to meet certification requirements and might be essential for a wrongly loaded aircraft with too much aft c.g.
        But if the AoA sensor are wrong you can fly without MCAS with some training how to handle the aircraft without MCAS. I guess FAA&co say it is required for certification but if you disable it and are aware of what you are doing it is ok for one flight. Elevators with 2″ longer chord and updated software should delay the MCAS trigger and give better elevator authority.

  7. “Boeing has developed an MCAS software update to provide additional layers of protection”

    Sweet, as MCAS had no layer of protection before it now has ??????

    Revise that to read “layers of protection?”

    And the question arises, if other input was good enough for speed trim, why was that not part of MCAS as well?

  8. No comment thusfar has addressed what I see is the root problem. Neither country involved is going to address the root problem. Boeing has the deep pocket and it’s expedient to blame them. The root problem?? Third world airline pilots do NOT think outside their memorized flight manual. When the auto-magic presents a problem outside the parameters of their memorized flight manual, hand flying is not a normal function for these pilots. Yes, thinking outside the memory items can be as simple as switch off the power to the offending system.
    There is definite reason third world pilots get 6 months of concentrated ground and flight training before they get to fly passengers. Such training for the same airliner by a Brit, German, or American pilot (yes a few others) takes a max of 5 weeks before the competent pilot is then assigned to fly passengers. It takes 6 months training so that every possible abnormality is MEMORIZED. They then rely upon the airplane’s computers to handle the thinking. Too bad if something unforeseen occurs, outside abnormalities.
    Thinking ahead of the airliner and outside the box is a prerequisite for any competent pilot. Thinking outside the box (the memorized flight manual) is NOT a option for third world plots.
    My comment is not trying to be a Monday morning quarterback. My background is 20,000 incident free hours in Boeing jets: 707, 727, 747, and 757, plus Lockheed, Douglas, and Airbus airliners. I was an instructor pilot on the 727 & 747.

    • Captain M:

      AF447? (oh thats the French)

      Air Canada: Trying to land on the taxiway at SFO (waived off by the aircraft sitting in harms way)

      SW miscluate runway

      6 or 7 US pilots landing on the wrong ruanyw

      Great Britian. BAE goes to the wrong city and worng country.

      UPS: A300, goes visual and descends into the top of a hill.

      FedEx MD-11: Too high and forces it down and destroys the aircraft in a rolling ball. All survive.

      FedEx MD-11: Nariita, bad landing, kills all on board

      FedEx Subic: Off the end of the runway.

      • I looked at a list of accidents and incidents involving commercial aircraft and the numbers were staggering. Not counting terrorist incidents going back to the year 2000….

        Western airlines (US, Jap, Can, Aus, NZ,Europe) were involved in 88 accidents and incidents

        Rest of the world were involved in 253 accidents and incidents.

        That is a stark difference.

        11 accidents and incidents belong to Lion Air alone.

        Before the latest accident Ethiopian Airlines had only one major accident this century. In 2010, a 737-8 crashed killing everyone aboard.
        The investigation found…
        “the probable causes of the accident were the flight crew’s mismanagement of the aircraft’s speed, altitude, headings and attitude through inconsistent flight control inputs resulting in a loss of control and their failure to abide by CRM [Crew Resource Management] principles of mutual support and calling deviations.”
        EA contested the conclusion.

        https://tinyurl.com/y68mfsnb
        https://en.wikipedia.org/wiki/Lion_Air
        https://tinyurl.com/yxuhu9qy
        https://en.wikipedia.org/wiki/List_of_accidents_and_incidents_involving_commercial_aircraft

    • I’m afraid that you’re being more than a Monday morning quarterback: you clearly are biased against pilots from “Third World” nations. No country has a premium on creativity or “thinking out of the box”, and like TransWorld pointed out, “First World” pilots have made rather egregious blunders. Pilots, no matter where they come from, are human, and human beings make mistakes, sometimes with catastrophic consequences.

      The Batik Air pilot in the jump seat on the flight previous to JT610 was able to do some pretty out-of-the-box thinking when he observed and pointed out, on his own initiative, that the trim wheel was going in the wrong direction(which the pilots weren’t able to notice) and suggested turning it off. As has been pointed out elsewhere, the MCAS trim going backwards isn’t immediately noticeable, because of the high level of cockpit noise in a 737, the quieter trim wheels on newer 737 models, and the fact that 737 pilots are used to speed trim working all the time. Trim isn’t something a pilot would turn to if the aircraft was misbehaving – and that applies to *any* pilot, western or not.

      If you have objective, recorded proof that an American, British, or German pilot is capable of rapidly correctly diagnosing a problem from a system that they don’t know about or whose operation they can’t recognize and a pilot from elsewhere is not, I’d like to see that.

    • Your comment seems to be fully right but I think that it would have been by far better and more useful…to include some clear and simple statements or examples!
      I still enjoy flying and consider the aircraft the best invention ever made but recent facts lead me to think that somebody is exaggerating.
      And, last but not least, (no hindsight or reference to mcas or, more simply …a dangerous unbalance between a worsened c.g. and engines thrust/weight/size) ….Boeing bet on a dated airframe is, under any point of view, very questionable.
      Making a very easy comparison…..who would launch a new car…on an old chassis?
      The 737 was a wonderful, very reliable jet plane when initially made for Lufthansa, but to see it now with that…overweight silhouette…it looks like (as +/- already written by somebody) a Ferrari engine on a dune buggy!
      Last curiosity: I would appreciate an answer to what (being a simple graduated engineer…) seems a nonsense to me:
      – when Mcas triggers to lower the nose…what happens to the engines?
      – same speed?
      It sounds like a fight between 2 contrasting, opposing actions: pitching momentum still on and a forced dive……
      I cannot explain it….! (unless the engines speed is reduced)
      Many thanks in advance.
      Bruno

  9. “A man with one watch always knows what time it is. A man with two watches is never sure.”

    • A man with a watch thinks he knows what time it is.

      He hopes it does not trigger MCAS when its wrong.

    • Even a broken watch shows the correct time two times a day.

      One measurment is no measurement. Two measurements are half a measurement.

      With the second watch a man knows something is wrong.

      Now the question is on how many occasions does a MAX needs MCAS and how many times the system will be off due to the update?

  10. @Björn
    In days or hours, how much training does a pilot have to do to go from NG to MAX?

  11. Bjorn:

    On the AOA display, is that the AOA for the flying side?

  12. Not that I’m an expert, but the description doesn’t really give me a feeling of total fail proof.

    – Why restrict a system so much that was deemed required in the first place?
    – How does the aircraft behave at real high AoA? Will the MCAS successfully prevent a true stall?
    – Is the additional pilot training really enough? Does it train both (wrong MCAS activation and a real stall) cases in enough details?
    – Are there any other possible scenarios which have not been considered?

    I do hope the relevant authorities do have a very good and close look at this. Personally, I’d rather wait before I’ll consider a MAX and want to see it fly a couple of years trouble free.

      • That was my option many times in the past and I always took it, got to fly all manner of exotica and to my mind they were no more at risk of failure than some very tired B737/757 or DC10. ‘Die in comfort’ was my maxim. BTW my daughter flew on SSJ two days ago, got to love it.

        • People are sorely mistaken if they think Russian is as good or better than our system as flawed as it can be.

          Of course its your life and good luck.

          • Last I knew DVT was still a big killer, maybe safer flying Russian when it is all added up. I’ve not seen any recent studies on DVT, done since the seats got so small and the padding so thin.

  13. Do the crew have to undergo additional training where MCAS becomes non-operational? It is there for a reason right? What if they encounter that specific event and don’t have the MCAS protection?

    • MCAS was introduced to modify the handling characteristics close to a stall. MCAS should not be active unless things are already wrong, and it is designed to prevent things from getting very wrong. Disabling it for a flight will not be relevant unless the pilots on that flight come close to stalling the aircraft, which is a very rare occurrence.

      • Since MCAS is required to meet FAR requirements for longitudinal stability, and I assume those requirements apply to each flight, then an AOA disagree light would mean the plane is no longer airworthy and would require landing at the nearest airport. Just my guess. Would be great if FAA or Boeing could clarify.

  14. It seems that a complex “solution” is being offered to a complex problem.
    Surely the simple solution would be along the lines of:

    AOA vane fail = MCAS disable.

    • No, they are doing the right think, you can have dual failures and the logic allows to stop it

      You might consider this is while critical, one small part of an inextricably complex operating system.

  15. How does one determine that the AoA sensor has failed, in your
    scenario, and if in fact the airplane is at a high AoA at that time,
    should MCAS then be disabled? Boeing didn’t put MCAS there
    willy-nilly…

    • Actually they did put it there “willy-nilly” and that is part of the problem.
      A simple algorithm could determine the failed AoA sensor or simply an AoA disagree would suffice to inhibit the system along with an EICAS message MCAS fail and associated checklist.

  16. Can you expand a little more on your first sentence, but I don’t think I’m getting its gist.

    Thanks

  17. Lots of technical stuff here which is interesting, a 3rd sensor seems the way to go. But, I won’t book a ticket for my family if I know its a MAX, will you?

    • Good luck! In a few years that would preclude half the world’s short haul routes.

      • I would have no problem with my wife (who is flying today) on a US MAX

        Not because US pilots are inherently better, but they Airline with the Union oversight have a much better system for training (Ethiopia and Lion pilots are subject to local standards that are not there yet) .

        We also lead the world in upset training and implemented the unusual failure training (now)

        Union pilots can refuse to go, Lion no. You won’t find a pilot with only 250 hours in a US aircraft. That co pilot is part of a system that should be a assist and not a lump of stone in working emergencies.

        I have 250 hours flying time, I sure as *&^% am not qualified to fly co pilot in commercial aircraft or any twin.

      • Safer to fly on the A220 (C Series) as an a/c built from the ground up…instead of the adulterated MAX!

  18. It sound strange that Lion Air aircrafft had the same problems 2 flights in a row when the system alternates Alfa probes between flights.
    The aircraft was used on a flight from Ngurah Rai International Airport, Bali to Soekarno-Hatta International Airport, Jakarta the night before the crash. Detailed reports from that flight revealed that the aircraft had suffered a serious incident, which left many passengers traumatized. Passengers in the cabin reported heavy shaking and a smell of burnt rubber inside the cabin. At one point, the aircraft had dropped more than 200 feet (61 m) in a few seconds. So it sounds it is not just one alfa probe that triggers the MCAS as 2 flights in a row had this problem unless the mechanics doing the troubleshooting reset the system so it used the same faulty alfa proba on the next and fatal flight. The Boeing solutions sounds logical but how couold they not be a certification requirement initially? Even the military KC-46A has a more redundant MCAS system than the original 737MAX version that FAA also certified.

  19. Much good comment on this very faulty MCAS system and the apparent ‘band-aid’ solution (turn it down),but nothing has been said about those who approved it in the first place-the FAA.

    Correction – they have,as it turns out – the very people who built it were asked to approve it Boeing.When asked about this the belligerent reply came back that it would cost too much ( taxpayers?) money to employ the relevant people.
    So clearly no change there!
    Furthermore I noted that rather than be humble about being the last authority in the world to ground the MAX,they throw ‘shade’ at all the other worlds authorities suggesting they moved too early!
    So clearly no change there either.
    As discussed above it is obvious that un unapologetic Boeing have no intention of changing their profits first creed.

    But relating to my post last week I did note that they had thrown in a couple of their ‘optional extras’ as standard -you know the ones that could have saved hundreds of lives.
    Thanks Boeing.

    • A couple of quotes,

      “I find it hard to believe that a safety company like an airline would save a couple thousand dollars on an option that might improve safety,” Elwell said – Reuters.

      “I find it hard to believe that BA would require an airline to pay a couple thousand dollars on an option that might improve safety” – Me.

      However, when asked about how he would have handled a plane that dropped 21 times in a matter minutes as the Lion Air flight in Indonesia did before it crashed last October, Mr Elwell, a trained pilot, said: “I’d have to get back to you on the specific.” – BBC

      “We may have been the last country to ground the aircraft, but the United States and Canada were the first countries to ground the aircraft with data for cause and purpose,” he said. – BBC

      But as BA were working on an MCAS software fix immediately after the Lion Air crash, what were they waiting for ? What was the compelling reason ALL the other authorities grounded the MAX ?

      The FAA were aware BA were working on this fix. If ET302 hadn’t crashed, and the software update had been approved, and installed would we have known anything about this ? Would the Lion Air crash have ended up being put down to maintenance issues, and inadequately trained pilots ?

      I can’t see the FAA changing, it appears they don’t yet realise there’s a problem.

      As far as the MAX goes, I can but hope that this software update will resolve the MCAS issue, and that we don’t see another major incident.

      As one pilot has been quoted as saying “I am left to wonder: what else don’t I know?”

      • I’d be curious to know if any American or Canadian flight crews had experienced an MCAS related issue on the flight deck?

        • NASA have a data base, but as far as I know no US pilots have reported MCAS trim issues, but they have reported a couple of unexplained nose down issues on autopilot instead. Related? Who knows? I hope, in the light of recent events, that somebody is looking into them.

  20. Some of the questions raised above.

    1. All Boeing aircraft have only two AoA sensors, including B777 and B787. Airbus use 3 sensors, but that is a fly by wire aircraft where the computers are always in control. The set up of computers is quite different to Boeing, and a simple comparison is not easy, and leads to wrong conclusion. To the question, will you put your family on an aircraft with only two sensors, Well you have then to avoid all Boeing.

    2. If after Mod, there is an MCAS fault, what to do. It is not on MEL now, so when you are back on ground, the aircraft is AOG, unless MEL is modified. Doubtful.

    3. All swept wing aircraft are longitudinally unstable as the speed increases. MAX is a more critical at some speeds and AoA, obviously. MCAS is made to prevent aircraft going anywhere near a stall region inadvertently. So if the pilot knows he has no protection, he is expected to use adequate caution during rest of the flight, like any other item in the MEL, I suppose. Do not forget, B767-400 tankers have MCAS and they are flying for some time now.

    4. Two accidents have made everyone loose confidence in Boeing. They are at fault big time by depending on one sensor to drive a large control surface at a critical phase when the aircraft is trying to gain speed and altitude. And not telling the pilots about it. Blaming it on third world pilots was unnecessary, as this dodgy design was made in the first world engineers, with all the technology that man has invented.
    My two pence worth comments.

    • @Tech-Guru

      “Do not forget, B767-400 tankers have MCAS and they are flying for some time now.”

      Maybe, but there are many more MAX out there, and I would guess they amass disproportionately more hours and cycles. Out of hundreds of aircraft, “only” two were lost due to the issue, and it is unclear how many experienced it without it leading to a hull loss.

      Even if the problem was to exist on the tanker as well, the total number of KC-767 may be too small for it to have led to a more serious incident or accident.

      Furthermore, I would guess that a tanker might proportionally spend less time on take-offs, which so far were the main critical period.

  21. It reads:

    “MACS ignores the pilot if he doesn’t agree with what MCAS is doing; Speed Trim does.”

    I find the phrasing a bit confusing. Speed trim does what? Ignore the pilot (like MCAS)? Disagree with MCAS? Or is it supposed to read “MCAS ignores the pilot if he doesn’t agree with what MCAS is doing; Speed Trim does *not* [ignore the pilot, so unlike MCAS].”

  22. So where’s the catch ? First we have MCAS 1.0 that not only is given authority over pilot action but the very existance of which is kept blind to those same pilots as well as to Regulators. Now we get MCAS 2.0 that is being publicised loud and clear tutti quanti to Media, airline professionals, analysts and Regulators but which basically gets disabled or impeached (downrated) automatically as soon as the pertinent sensors that normally trigger it into action are found potentially unreliable, subject to QRH checklist …The question is “Should I stay or should I go ?” It strikes me that Boeing may have become embarrassed with their MCAS which has been created to perform a job that is not very well defined (it seems clear though that it is there for some intended flight envelope protection) but the full replacement of which will possibly take more than these six months, so they may have come up with this MCAS 2.0 for provisional window dressing, a kind of “bone thrown to the dogs” … ?

    • Produced by the same logically-impaired engineers that brought you MCAS 1.0!

  23. It kind of fits the “deny the problem until we have a solution” communication strategy.

    • I agree totally, have we learned nothing about safety in the last 50 years !

      “Boeing only rolled out the software update now, after the second crash, because we wanted to get it right,” the first Boeing official said Wednesday.” – same CNN article.

      But that’s not an admission that they got it wrong the first time, or that the FAA was happy with it as it was …

      If the FAA isn’t going to change, I certainly hope the CAA, EASA etc. are a lot more thorough, open, and transparent, and don’t just rubber stamp the software upgrade.

    • “Make the 737MAX safe again!”…that begs the question, why not make it safe enough in the first place? The inherent doublethink here is unbelievable.

  24. As I understand it they are augmenting the training on the NG to mirror that of the MAX and blur the differences between the two. Sounds like madness to me but am guessing common type approval is worth that much.

  25. So MCAS is needed as a flight protection system according to the FAA but if it starts acting up then it is not needed? We are in the realms of tortuous logic with a single focus and that is to get the plane back in the air as soon as possible and as cheaply as possible. Isn’t that the logic that got Boeing into this mess to begin with?

    Do you really think all the other regulators with an axe to grind are going to buy this? Sophism at its best Boeing.

  26. I won’t fly on a 737 MAX and I hope nobody else is daft enough to fly on a 737 MAX.

    MCAS is a software algorithm for beginners. If they are going to do a flight protection system they need to do what Airbus do. Having said that, Airbus always develop airplanes with loads and loads of natural stability. So the flight protection system is a nice have not a must have.

    I agree with commentators who want to know why after 60 years MCAS is a must have. Clearly it is a must have otherwise Boeing would have disabled it after the Lion Air crash.

    As to Bjorn’s theory of blowback causing the trim stabiliser to overpower the elevators. I still think it is a very plausible theory. But I don’t think it was present in the previous two versions of the 737. Boeing would have found it by now, which mesns they would have stopped the trim stsbiliser overpowering the elevators by now. Something has happened. We need to know what for it is central to why MCAS is a must have.

    My only other comment is that it hasn’t been confirmed that the AoA vane was faulty with the Ethiopian crash. All we have been told is there are similarities

    • Philip: Well I was flying DC-3, PBY-5A trough narrow passes in Alaska and I am still alive.

      I was on a DC-3 that had oil blowing out the engine coiling and rivets popping gout of the wing.

      The MAX is so much better.

      And I should be flying in a couple of months and my airline should have the MAX fling by then.

      I will be happy to take it. The airlines is a leading one in its operations and I have full faith in the MAX (with fixed MCAS) and the pilots.

      What I did not like then nor now was a long flight over water in two engine aircraft (jets).

  27. Does the indicator of the trim angle need to be displayed higher up or have more alerts with it?

    • The Key alert will be in red and it will disable MCAS

      As you don’t stall aircraft that is more than adequate (and it has other changes) to maintain normal flight.

      • I was thinking also in terms of other runaway trim conditions other than MCAS, or just seeing the guage higher up in the field of vision when adjusting the trim switches.

  28. Roger Béteille, father of the A300 (first Airbus programme), used to go about hard nuts to crack saying “Back to Essentials !” Now, Boeing have proposed to save the day introducing their new MCAS 2.0 artefact, acknowledged with mitigated welcomes by us here AvGeeks. But the essential issue when gaugeing MCAS 2.0 is not whether and how well it patches up the apparent flaws of the previous MCAS 1.0, not at all ! The essential question that in particular the FAA needs to ask about MCAS 2.0 (a question which apparently was never asked about MCAS 1.0 before) is : What is the exact purpose of this system ?

    Reformulated, if the purpose is to set up a protection at certain corner(s) of the MAX’ flight envelope then Boeing please tell us exactly which one(s) ??

    Only upon letting the world know precisely what the problem(s) is (are) that Boeing is now trying to solve with their MCAS 2.0, can we observers gauge the proposed solution and eventually absolve this artefact as the right thing to do ?

    • We are fully informed on why the FAA said a fix was needed as there was a pitch up criteria at stall that is not allowed per certification standards .

      I fail to understand why you have to ask or how you have missed that information?

      As I have said repeatably (and supported by one other person ) it was the process that is flawed not the aircraft.

      The FAA allowed the 787 to have a no standards volatile battery installed (as was EASA until the smack down)

      Now there is an industry standard for testing and how those are setup. Airbus did not have a standard either when it started.

      All aircraft have areas they don’t fly well in. Some are software and some are hardware fixed.

      • @TransWorld : Thank you, yes, I’ve seen a number of explanations offered here of how MCAS 2.0 kicks in doing this or that, and when, but very few (so far in fact I’ve seen none admittedly sourced from an FAA or Boeing spokesperson) tell us what the adverse manoeuvering characteristic(s) exactly is (are) that need(s) to be “augmented” ? Could the MAX be so designed with its particular rigging of the engines (forward and upward on its new pylon) that at high AoA, at TOGA engine setting or at high altitude cruise power setting, the engine cowlings (nacelles) produce a ghost aerodynamic lift with a pitch-up effect, the stronger the higher the AoA, calling up stabilizer trimmings pitch down from MCAS to compensate ?

        In such case, I quite understand the discomfort created with the occurrence of an “AoA disagree” signal coming “on” ! : compare the MAX with a spacecraft approaching a black hole in the vecinity or beyond its Schwartshield limit ?!

        You are quite right, TransWorld : one has to opt between a software change or a hardware change : if my assumption about that “ghost lift” is correct (Boeing, come forward please ?!), then I recommend a hardware change to cater for what could in reality be a natural instability of the MAX ?!

  29. The BIG problem is once the stab has gone full nose down there is no way to get the aircraft back in trim if the MCAS system is still active. It is impossible to manually wind the trim with any loading on the flight controls opposing the desired direction of trimming. Then there is the issue of whether or not the small elevators on the 737 can overcome the stab.

  30. “I fail to understand why you have to ask or how you have missed that information? ”

    Because it is only speculation. Care to quote a source from Boeing or the FAA?

  31. So what about AF447, was that the copilot’s fault for the stall, and the pilot’s fault for not noticing, or was that a defect of the sidestick system that Airbus has not fixed? Bombardier improved on it.

    Are the 737MAX and the 767-2C the only commercial aircraft certified in history that are aerodynamically unstable at high AOA?

    Do the re-engined A330 and A320 with the larger engines have aerodynamic instability at high AOA? The aviation authorities of all countries must have the moment versus AOA graphs for all these aircraft. Where’s the proof?

    • I believe Boeing commercial people may have weighed in to choose MCAS the way it is designed for fuel consumption purposes, to compete cost-wise vs A32X. With the trimmed stabiliser in nose down mode during cruise at high altitude, the stabiliser produces positive lift, which added to the ghost lift of the nacelles (also positive, if my assumption hereabove is correct ?), allow the pilot to trim the MAX at cruise to a lesser wing incidence, reducing induced drag, which equates to a lower fuel cosumption. Maybe Boeing thought this was necessary to weigh in against A320’s bigger fan diameter … they may have traded lower SMC against an unstable configuration ? OK, why not, if their design is safe ? But in such case, to pretend the MAX and the NG are flown in the same way, appears to be stretching the reality somewhat, oder … ?

  32. The fix is gonna limit or inhibit the MCAS and warm the Pilots about the system malfunctions. What about the tendency to stall which required the system in the first place? Will FAA allow that to pass through certification? If so then why did they insist on MCAS the first time around?

    • Your questions are perfectly stated. Something does not smell right. The choice of words used has an effect on how we respond to them. Manoeuvring Control Augmentatjon System sounds benign and much less alarming than Mision Critical Anti Stall.

      I have a theory that Boeing found, to their dismay, that the 737MAX, during powered climb, could steadily increase its angle of attack until it stalls. To avert scrutiny of this aerodynamic issue Boeing devised an anti stall system and called it MCAS to disguise it’s real purpose. Why else would Boeing report to the FAA that it only uses 0.6 degrees of stabiliser control when actually it uses 2.5 degrees?

      If, as you pose in your question, it is a safety system designed to prevent stall what happens with MCAS 2.0 when a pilot enters a real stall? Boeing have been intentionally vague about the anti-stall nature of MCAS and are now obscuring this up by now limiting MCAS as an augmentation system. For Boeing to admit that MCAS is an anti-stall safety measure invites a raft of uncomfortable questions by the FAA about the inherent aerodynamic design and flight worthiness of the MAX.

Leave a Reply

Your email address will not be published. Required fields are marked *