Bjorn’s Corner: Fly by steel or electrical wire, Part 13

October 18, 2019, ©. Leeham News: In our series about classical flight controls (“fly by steel wire”) and Fly-By-Wire (FBW or “fly by electrical wire”) we continue our discussion of pitch stability augmentation systems when we have a mechanical (“fly by steel wire”) pitch control system.

Figure 1. The pitch moment curve of a modern airliner. Source: Leeham Co.

Pitch moment curve stability augmentation with a mechanical base system

In last week’s Corner we listed the requirements we had on our tool, the trimmable horizontal stabilizer, to fix a pitch moment curve like in Figure 1. We need to straighten the segment with reduced pitch stability just before the stall.

Our requirements on the tool to fix the instability part of the curve are:

  1. We need a system that is highly reliable. When it’s needed it should be there when not the probability of misbehavior shall be extremely low.
  2. We need a system that can move a small distance with a low slew rate at high aircraft speed (Q is high) and can move a larger distance with a higher slew rate at a lower speed when Q is low.
  3. As the authority of a horizontal stabilator trim system is large we need a reliable trigger for when it shall go in action and when it shouldn’t. The risk of a misfire shall be very low.
  4. We also need a system where its failure modes shall not create forces on the aircraft which are hazardous, neither for control of the aircraft nor for its structural integrity.
  5. Because of the power of the horizontal stabilator we need a system that can be limited in its authority. The pilot must always have the time to recognize any failures and to mitigate any failure of the system with his elevator.

Requirement number 1, 4 and 5 leads us in the direction of the prevailing jackscrew system used on most airliners, Figure 2.

Figure 2. The horizontal stabilizer trim system of the 737. Source: Boeing and Leeham Co.

It has the advantage of simplicity with the control done with an electric motor that can drive the jackscrew in both directions. In the case of the 737, there is a manual backup via a drum with cables that connect with the trim wheels in the cockpits. The gearing of the manual system is such a pilot can grab the wheel and stop the motor and jackscrew from moving.

The reliability record of the motor/jackscrew assembly is very good. What has failed is the relays and switches for the electric drive to the motor. There have been instances where a stuck switch or relay has driven the system continuously in one direction. This is why the electric drive has travel limiting switches which take away all power to the motor, should a runaway happen, satisfying requirement 4.

In addition, the pilot has two further switches to cut power to the motor, one pair sensing his “hold against” force on the yoke (called Colum Cutout Switches in Figure 2) and an additional pair as the last resort on the trim column pedestal (Trim Cutout Switches in Figure 2).

The “hold against” switches can’t be active during the instability phase of the curve as by definition this is a case where the pilot is pulling hard on the yoke. If the “hold against”switches are active at this phase they take away the pitch argumentation, which is not what we want.

Requirement number 5 is satisfied by switches triggered by the stabilizer movement, cutting the drive to the motor when predefined travel limits are reached.

Use of the trim system for stability augmentation

When we want to use the system for fixing our moment curve in Figure 1 we run into some challenges. The build-up of the force to counteract a pitch-up must be sufficiently fast to stop the pitch-up movement.

The trim system is built to offer a sufficient trim speed to satisfy the Pilots’ and Autopilot’s need for trim. This is often a speed that is slower than needed for augmentation.

For the 737 the normal manual trim speed of 0.2 degrees per second was enough to counter a pitch-up tendency at high speed (the windup turn case). At a low-speed pitch up above 10° Angle of Attack (AoA), the normal trim speed was to slow. It applied the nose downforce to late to neutralize the pitch-up tendency which would bring the aircraft closer to stall without the pilot’s intention to do so.

The trim system had a second, faster speed of 0.27 degrees per second, used for the larger movements needed at the low speeds when flaps and slats are deployed (low Q). The low-speed augmentation of the 737 used this higher speed to neutralize the pitch up above 10° AoA.

The amount of neutralizing force is set with the length of the trim sequence, in the case of MCAS 9 seconds.

The increase in trim speed to 0.27 degrees per second increases any misstrim if the system is triggered by a rough signal before a pilot reacts and trims against. At low speed the situation takes some time to build up as the effectiveness of the horizontal stabilizer is low. This gives the pilot a longer time to react and the effect on the aircraft from a rough trim action is less harsh than at high speed.

At higher speeds, a fast trim speed has more dire consequences. As said, the trimmed horizontal stabilizer has a powerful authority if the dynamic pressure (Q) is high (high speed and low altitude brings a large Q). This means a rough augmentation trim will pitch down the aircraft violently. This is what happened in both the Lion Air and Ethiopian Airlines cases.

The pilots were probably thrown off their seats as the G meter trace from the accident reports show a minus 1G load factor at the aircraft midpoint and the cockpit sits on a longer movement arm. This prolonged the reaction time and in my opinion the jolting reaction of any large trim actions at speeds close to Vmo (maximum allowed Q for the aircraft) made it harder for the pilots to neutralize the MCAS misstrim.

It’s not understandable why Boeing kept the high trim speed for the high-speed domain. Tests had shown the low trim speed was sufficient for high-speed cases and a switch of trim speeds for the system is not complicated. Now the high trim speed startled the pilots with its violence and quickly overpowered the pilot’s elevator as requirement no 5 wasn’t respected. The reaction times for the pilots were cut too short by using one trim speed for MCAS (and its unwarranted repeat action after five seconds wait quickly worsened the situation).

If the flight control system would have been Fly-By-Wire (FBW) control with feedback, the FBW could combine the trim of the stabilator with a tempering force from the elevator. It can thus combine a fixed trim speed with a bit of elevator to get any control force it desires.  The redundancies in the system are such this control scheme would present no hazard to the aircraft.

A mechanical system doesn’t have the sensors or actuators to perform such mixed functions. It has to live with the trim speeds the system has and work with trim time to moderate the forces. But there are two speeds in the system. Why aren’t these used?


We can see we need for an augmentation system:

  1. A reliable trigger system so we don’t end up with a misstrimmed aircraft by any faulty trigger of the powerful stabilizer based trim system.
  2. A system which has an authority limited to what is needed, to not put the aircraft in danger should the system misbehave.
  3. Finally, we need an overall limit on the trim authority, so any system runaway can always be counteracted by the pilots via the elevators.

None of the three above criteria were respected by the initial MCAS version. One wonders why? The updated version of MCAS which is scrutinized now fulfills all three.

24 Comments on “Bjorn’s Corner: Fly by steel or electrical wire, Part 13

  1. Thank you Bjorn.

    You write: “The updated version of MCAS which is scrutinized now fulfills all three [criteria]”.

    I have seen nothing in the public domain that would convince me of that. Is there a detailed description how the future MCAS is supposed to work?

    EASA has called MCAS an anti-stall device. The JATR report is just a bit more vague about that: “From its data review, the JATR team was unable to completely rule out the possibility that these augmentation systems function as a stall protection system.”

    If the 737 MAX is inherently unstable and needs an anti-stall device the three criteria may not be sufficient.

    • I have written about the updated system in earlier articles. Here the gist of it:

      1. Reliable trigger. Both AoA vanes with their associated Flight control computers processing are compared and if the results differ over a threshold MCAS is deactivated. So the risk of a false trigger is now low, it’s now a dual redundant trigger system.

      2. The trimming is now done as one 9 seconds trim session for each high AoA event, taking away the risk of repeated MCAS attacks due to faulty triggering.

      3. The global authority is now restricted for MCAS (which it wasn’t). The Pilot can always maneuver the aircraft with up to 1.5G even if MCAS runs to a max position.

      • Thank you Bjorn.

        I had read those points in one of your earlier pieces. They are unfortunately not detailed enough to judge the system.

        What happens when one AoA vane fails? Is the system capable of diagnosing which one failed or will it just shut down MCAS?

        If MCAS is needed to get the MAX certified (anti-stall device?) then shutting MCAS down because one AoA vane fails seems to be quite on the margin of being overall certifiable.

        No wonder that EASA is pressing for an additional sensor or some other safer solution.

        • MCAS is not needed for the aircraft to be flown safely under normal circumstances. It is only needed close to stall to provide increasing yoke forces as angle of attack increases. Consistent yoke forces are a certification requirement.

          However since aircraft are very, very rarely flown close to stall the there is no problem with simply shutting down MCAS in the case of a malfunction and then fixing the issue before the next flight.

          The caveat is that MCAS must fail in a way that does not endanger the aircraft. The issue with MCAS v1 was that in some cases it did not fail by simply disabling itself, but rather by activating aggressively and repeatedly, confusing pilots and leading to disaster.

          This “consequences” of failure” and “importance” to safety determination is applied to everything on the aircraft and for each item it is determined how reliable it needs to be and how to proceed in case of failure. MCAS is no different and if the correct analysis had been performed it would never have been implemented as it was.

          Given a correct implementation the MAX should be just as safe as the NG, which while in many regards is “old fashioned” has a good safety record.

          • @jbeeko

            You assume that MCAS is just an an augmentation systems. That is probably not a safe assumption.

            From the JATR report:
            “From its data review, the JATR team was unable to completely rule out the possibility that these augmentation systems function as a stall protection system.”

          • For both the crashed aircraft, wasnt the stall warning stick shaker activated as well, contributing to the cockpit confusion along with repeated ( every 5 sec) violent shaking from the down pitching elevator.

      • Bjorn, I think there’s one thing that may be being taken for granted.

        The software must also be verified to be 100% reliable. It wouldn’t matter if the AOA sensors were reliable if the software in certain situations triggered an MCAS like event.

        All items in the chain would need to be verified in turn, AOA sensors, wiring, interface to the software, and of course the software itself.

  2. Your point about adapting the speed of MCAS trim inputs to air speed is a sound one, but it would probably not have made a difference in the particular scenario encountered by Lion Air and Ethiopian. This failure mode created a simultaneous UAS situation, so the same root cause which misled MCAS to trigger in error would also have pulled the rug out from under any trim speed to air speed dependency.

    It’s still a good idea of course which should help the crew recover from a spurious MCAS intervention prompted by another malfunction that does not affect air speed readings. In any scenario involving ambiguous speed indications however such a link between trim speed and air speed cannot be relied on to work correctly, even in an architecture robust against erroneous input.

    It should therefore be stressed that two-speed MCAS trim does not absolve the manufacturer from the responsibility of providing adequate redundancy to handle conflicting speed data (as you state in requirements #1 and 3).

    • Your handle “Trident” reminds me that the Hawker Siddeley Trident fired its powerful compressed gas stick shaker of at least two alpha sensors with great precautions taken to prevent false triggering. In that case the concern was super stall (a potential worse danger than the MAX pitching issue). Wisdom from the 1950s. It would appear that to get Bjorn’s elegant smoothly acting solution Boeing would needs 3 alpha sensors and 3 pitot-static sensors operating in a 2oo3 mode with filtering of outier data through some kind of FAR 25.1322 compliant system. A complete overhaul of this magnitude across the MAXs systems is daunting but might be acceptable if it could be modularised to confined to just the air data and MCAS system.

  3. I have a suspicion that the trim speed for the stabiliser jack screw was not by variable speed drive. It might have operated at only a fixed preset speed or even a gear box change.
    I have a question about artificial as opposed to augmented stability. To meet FAR standards all airliners must have natural stability which is achieved by having the centre of gravity ahead of the centre of lift so that the aircraft is nose heavy and the tailplane must provide down force. Are there any FBW systems that can fly an aircraft that is tail heavy as opposed to nose heavy such that the tail must provide a permanent up force. Such a situation might arise with badly loaded aircraft or a load that shifts in flight. Both scenarios have been fatal.
    I’m also curious as to why so few commercial aircraft have not gone fir an all moving tailplane or stabilator as opposed to the stabaliser merely trimming and the elevator proving control.

    • I will try to answer: the current tail heavy airplanes that I know, which I presume are the ones that flies with a more aft CG and neutral longitudinal static stability, are A32X family, E2 family and A220 family. I believe that the A330, A350 and A380 have neutral longitudinal static stability as well. I don’t know about the 787.
      For the stabilator question, I believe that it is mostly due to aerodynamic loads which without a stabilizer would increase too much the hinge moment for the elevator actuator.

      • I am certain all of these aircraft are still nose heavy, with the tail fin providing a down force to raise the nose and that they possess static stability. This is because FAR Part 25 requires this. I thunk perhaps we could call the E2 relaxed stability and perhaps the A321neo with the flex. cabins (extra row of seats at rear) as crossing over.
        I am curious as to what would happen if a load shifted to the rear and centre of gravity was behined the centre of lift if the FCS could still fly the aircraft. I don’t think a human can.

        • They are nose heavy, but with the closed-loop FBW assistance. In other words, the system is responsible for increasing the aircraft longitudinal stability. Usually the FCS can counteract aft CGs scenarios, but there is a limit which is usually very close to the centre of lift. If the CG moves behind the center of lift, even close-loop FBW aircraft will become unstable.

  4. Looking at the green ling curve, it goes all the way to stall. Will they test fly an aircraft to stall with one activation of MCAS, and how closely in reality will it model the desired theoretical green line even slope they are trying to achieve?

    Because, that is the definition of pitch augmentation. If the MCAS kicks in and thy can’t stall it, then I would imagine it would be defined as stall protection instead.

    • Why can’t Boeing just tell us?I can’t imagine it’s going to fly again without answering the question.

    • As per Dominic Gates the need for MCAS at lower speeds was discovered during flight testing so I suspect it has already been done there. The article does not say if a windup test was attempted without MCAS.

      My guess is that Boeing has flown both scenarios close up to stall without MCAS. That is why they are so confident MCAS is only needed as an augmentation system in those cases.

      • Hi all, I try to answer several questions here;

        1. All airliners except E-Jet E2 have an aerodynamic static stability margin, none is neutral stable or unstable. The E2s are the only airliners in the world that have reduced static stability margins (it’s still statically stable but with a reduced margin), fully OK as the FBW is always active with pitch damping/augmentation, also in direct mode (it has a 10E-9 failure probability ie is Certified as an always-available backup system). All other airliners, including FBW types, have a traditional static stability margin where the nose tips down when the pilot takes the hand of the stick (after a speed adjustment if miss-trimmed). The A320/330/340/380 have a horizontal tail tank that can be filled in cruise to lower the stability margin (and consequently trim drag). The fuel is transferred back to the main tanks to give a normal stability margin for descent/landing or take-off/climb.

        2. A statically stable aircraft can have an aft CG where the horizontal tail provides an up-force as long as the combination wing+stab has a stable characteristic. At the aft-most CG of some airliners it flies as stab+elevator which provides a positive life, the combination is still stable. The normal case is a stab with downforce.

        3. The 737NG has a trim down stab function when stall AoA is IDed by the SYMD. The exact transfer logic for MCAS to this Stall function is not clear to us. MCAS is labeled as an argumentation, the 737NG stall trim down as a stall function. How these relate, function together and got certified for the 737 MAX is not described in any information we have seen so far.

        • Very interesting Bjorn !

          “The A320/330/340/380 have a horizontal tail tank that can be filled in cruise to lower the stability margin”

          I don’t see the A350 listed there, have AB not implemented this function on the A350 ?

          As you haven’t listed any Boeing aircraft, I am presuming that the 777, and 787 family don’t have this functionality.

          Is this function accomplished automatically, or is it controlled by the pilots directly ?

          • Most figther jets and the Concorde has this feature of aft “trim tank”, when you go supersonic the center of lift moves for “normal type of wings” from 1/4 chord to 1/2 chord. Hence you want to pump some fuel aft if you have trimmed out the Aircraft subsonic.

            The Concorde also had three auxiliary or trim fuel tanks (two in front and one in the tail). Here is what the trim tanks were used for:
            •As the Concorde reached supersonic speeds, its aerodynamic center of lift shifted backward.
            •This shift drove the nose of the aircraft downward.
            •To maintain balance, fuel was pumped backward into the trim tanks.
            •The redistribution of fuel balanced the aircraft by making its center of gravity match the center of lift.
            •When the plane slowed down, the center of lift shifted forward.
            •Fuel was then pumped forward into the trim tanks to compensate.

            Airbus might need to fill the tail and stabiliser with fuel for the A350-1000 Qantas SYD-JFK aircraft

          • Hi Claes,

            I was aware that Concorde used fuel for both cooling, and trimming, not surprising that Airbus decided to use fuel for trim.

            I understand why a 737 wouldn’t have it, I just wondered if the A350 also has it, and if the 777, or 787 family have anything like this.

            I’m assuming that the flight engineer on Concorde performed the fuel trim manually, and wonder how automated fuel trim is on Airbus aircraft ?

            I don’t see a problem for the A350-1000 doing JFK-SYD, I’m interested in how it will do LHR-SYD.

          • Hi JakDak,

            the A350 doesn’t have it, nor 777 or 787. For the A350 (and maybe 787) some of this functionality can be achieved by the micro-warping of the wing which can be done with micro-movable flaps and spoiler which can move down as well to close the gap. The 747 has a tail tank but not for this reason, rather extra tankage. It’s not used for trim drag reduction.

Leave a Reply

Your email address will not be published. Required fields are marked *