Bjorn’s Corner: Analysing the Lion Air JT610 crash, Part 4.

By Bjorn Fehrm

November 22, 2019, ©. Leeham News: We continue the series on analyzing the Lion Air JT610 crash by analyzing MCAS in more depth before we go to the final part of the flight.

We look at what was wrong with the initial version of MCAS, the augmentation system that caused JT610 to crash and what has changed in the updated version.

What was wrong with the first version of MCAS?

We looked at the initial part of Flight JT610 last week. We found out how a bias fault in the left Angle of Attack (AoA) sensor could go undetected from the previous flight (because of a missing warning message for the MAX) and how it caused left side stall warning, IAS and ALT DISAGREE warnings and finally triggered MCAS once the flaps were retracted.

As the Captain, who was flying, compensated MCAS nose-down trim with a nose up manual trim, MCAS reset and trimmed nose down again after a five-second wait. This repeated 22 times before the Captain asked the First Officer (FO) to take over the controls. This was presumably to get the head free to analyze what was wrong with the aircraft as the FO had trouble helping the Captain to understand what was wrong.

Before we go into what happened after this handover, let’s understand why MCAS was trimming nose-down again and again and why the updated version will not behave like this.

MCAS repeated nose-down trims

As described in the last Corner Boeing classified a misfunction of MCAS as a “Major” safety event but not a “Hazardous” or “Catastrophic” one. This allowed a single sensor trigger of the high AoA augmentation function, where MCAS trims nose down to counteract a tendency for the 737 MAX to “nose up” too easily a high AoA.

With MCAS starting a nose-down trim at say 11° AoA the stick force per AoA and added G feels proportional to the pilot all the way to stall, which we assume starts at 14° AoA for the clean aircraft (clean=no slats/flaps). Without MCAS the stick force per AoA/G would reduce in this region (but it would still be positive meaning you need to pull harder to get more AoA/G).

MCAS will trim nose down at up to nine seconds for the initial part of this trip up the AoA scale to get the right stick force balance and will trim nose up an equal amount when the AoA falls below the trigger value. The amount of trim needed (set by trim time duration) at different speeds and altitudes will be read from a look-up table with AoA and Mach as inputs. The table gives the length of the trimming needed to set the stick force at the right level.

There is no change in this function between the original MCAS and the updated one which is now in test. What has changed is the condition for a reset of MCAS.

The original did not check if the AoA had fallen below the trigger value before it reset. The only condition for a reset was the pilot had used manual trim. With a stuck high AoA, MCAS then started a new cycle until the pilot trimmed the next time, when it all started over again.

Why did MCAS reset if the pilot used trim? MCAS helps a pilot do an emergency maneuver at high AoA (no normal maneuvers are done in this AoA range). It augments the aircraft so he doesn’t have to compensate for a nose-up happiness of the aircraft when maneuvering in this region. He can focus on his emergency maneuver, which with a high probability is dynamic. A pilot doesn’t trim during such a maneuver, you do it afterward when things have settled down,  to balance the stick forces.

Consequently, the pilot trimming was taken as the signal the aircraft was out of the critical situation and MCAS should reset, to be ready should it be needed again.

With a “Major” classification of an MCAS malfunction scenario, there was no obligation to list all possible failures and play through these scenarios in a Failure Mode And Effect Analysis, FMEA. Consequently, the case with an AoA sensor stuck at a higher value than the trigger threshold was never properly analyzed. Also, the danger of the pilot’s manual trim as the only reset criteria was not discovered.

The revised MCAS adds that the AoA must have fallen below the trigger threshold, which guarantees only one MCAS activation for each AoA passing of the threshold.

We can see how the “Major” classification of a rough MCAS opens the risk both on the trigger side and the function itself.

In the JT610 final report, the “Major” classification of a rough MCAS was deemed fundamentally wrong. It should have been classified as “Hazardous” which would have forced a redundant trigger and a full FMEA of the MCAS system.

In addition to an improved function, Boeing has also introduced a dual redundant trigger architecture for the updated MCAS. Initially, both AoA sensors’ values were compared and if they differed in values over several seconds MCAS was deactivated and the flight would finish without MCAS.

Isn’t MCAS needed for the safe flight of the 737 MAX? No! This is where most articles about MCAS are lacking. The 737 MAX works without MCAS.

Nothing in normal flying changes, in fact very little in non-normal flying as well. The pilot can do brusk Go-Arounds where he slams the throttles to full power and we won’t even get close to where MCAS steps in. First, because in a Go-Around he has slats and flaps deployed and as the aircraft cleans up he’s way below 11° AoA.

I have problems finding any case where a pilot would fly in a way where an inop MCAS would be missed. And if we for some extreme reason sometimes, somewhere, somehow find us in such a flight situation, the probability that MCAS then is inop is virtually nil.

But still, it all the holes in the cheese line up, flying without MCAS between 11° AoA and up to stall is doable. The aircraft is not unstable, just nose-up happy. If you then swing into stall warning (which starts at say 13°) you will as a pilot let go of the stick, this is an instinctive reaction of all trained pilots. You get out of stall warning and most likely the nose-up happy region.

And even if the MAX swings into stall it’s not the end of the world. Stall in an airliner like the 737 MAX is controllable, just release stick pressure and you are out of it. Not the big deal it’s made to be.

I describe all this to get some proportion into the discussion after the feel of doom around the 737 MAX which has been created by all the MCAS articles. Make no mistake about it, the original MCAS was terrible and dangerous but the revised is not. And the base aircraft has deficiencies, like most airliners, but it’s not a fundamentally dangerous aircraft.

The bottom line is, you don’t need MCAS to fly the 737 MAX. You can even fly in the extreme region where it would be active without endangering the aircraft. Would you slide into stall warning if maneuvering in this region? Probably. You are there because you pull nose-up like crazy to avoid something and you have nose-up inertia in the maneuver. Would you then swing into a stall? Maybe. So what? Every pilot knows how to get out of a stall, it’s straight forward in the 737, including the MAX.

Comparison of FCC outputs

The architecture where two AoA sensor values are compared has since the summer been improved. Now the output of the Flight Control Computer processes are compared and any discrepancy means a command like MCAS will not be carried out. This means all sensors and systems feeding the FCCs and all processing in the FCCs, including FCC hardware failures, are now checked for identical results, not only the AoA values.

This improves the safety of the trigger and function of MCAS and other functions in the FCC to a new level, not found in the 737 before.

In addition to these safety enhancements, there is now a global limitation of the authority of MCAS. We will discuss this in the next Corner when we discuss the actions of the First Officer and why the JT610 crashed.

275 Comments on “Bjorn’s Corner: Analysing the Lion Air JT610 crash, Part 4.

  1. “” As described in the last Corner Boeing classified a misfunction of MCAS as a “Major” safety event but not a “Hazardous” or “Catastrophic” one. “”

    The problem is FAA’s FAR don’t include a “Hazardous” failure category.

    JT610 final report, 6.2 E.1:
    “” FAA Advisory Circular AC 25.1309-1A, datedJune 21, 1988 and SAE ARP4761 define the severity classes that are used to classify the effect of loss or malfunction as part of an FHA. AC 25.1309-1A defines the following three severity classes: catastrophic, major and minor, with corresponding acceptable probabilities of extremely improbable (1E-9) or less per flight hour), improbable (1E-5 or less), and no worse than probable (1E-3).
    European regulations (originally JAR and now EASA) include an additional category: hazardous, which falls between catastrophic and major and has an associated acceptable probability of 1E-7 or less. The differences among the classes are associated with effects on the aircraft, occupants, and crew. “”

    There is also a table Figure 2 on page 250 of the report.

    • Leon, I initially went with your argument but indeed the “Hazardous” level was correct so I’m changing back. The analysis was apparently done to the FAA/JAR joint classification which includes “Hazardous”, page 250 in the report. See also page 272.

      • Bjorn,
        I don’t think you made a mistake. Wouldn’t it be good to respect other regulations too? I think we will move to one global regulation. Can’t be that few regulators have weak regulations, it’s the same as government funding. But of course Boeing enjoyed less regulation and took advantage of it and now is paying the price.

        I’m sure good pilots could fly the MAX without MCAS as you pointed out, but obviously MCAS was needed to
        – keep the same classification as the NG and
        – follow regulations to have a linear flight behaviour.

          • Leon:

            With one regulator you will develop have group speak. We see that with the mutually agreed recognition.

            We would be better off with a heavy review of FAA to Europe and EASA to the US. Review should be more than the cursory it gets now.

            Having questions asked is always a plus. There may be a good answer and there may be a gap.

            Brazil caught the MAX ref gap at least. As they have an aircraft industry they had expertise and that speaks well of their AHJ.

            I see to many time an aircraft issue comes up that are allowed to go years and it should be be corrected in a week at most.

            We need more robust and more questions not less.

          • TransWorld,
            I meant one regulation, not one regulator. How can it be that FAA certifies without Hazardous classification and EASA is using it. We know now that Boeing is/was the FAA.

            FAA certifying in Europe and EASA in US would be very complicated and might not be good.
            Best would be if regulators are independent, maybe part of the WTO and Trump, Congress and TAB have no chance. Boeing and Airbus need to pay fees to get certifications.

          • Got it.

            I think at issue is the auto cert vs a more in depth pass though not necessarily to the level of the certifying authority.

            I often review bid documents. Some parts we let stand such as the mfg specs.

            What we focused on was how the bid addressed our criteria.

            In the case of EASA they should not have to look into the data being right, but was the interpretation of the data right.

            Do they not see tests left out that should have been done.

            While I don’t agree with where it has gone, Boeing has been the pioneered on so much tghat the FAA is always behind.

            The battery on the 787 was a case in point. There was no Li I battery specifications.

            But unlike the 707 certification’s, there are experts on Li I battery, just not aviation use.

            Boeing needs to get out of that sort of thing and the FAA needs to make them rather than allow.

            We truly do need FAA reform.

            Any areas that do not have standards should automatically form an independent committee to come up with them.

            There may be times (composites) that any mfg would get stalled by that process and then there needs to be a mechanism to deal with.

            Mfg can go on with their approach but also form the independent standards committee.

            In the case of the battery it was finally agreed it fell withing the bounds of the Radio Technical Committee.

            Not all agree with what they did but from my take between ensuring non cascade and the containment/venti9ng with no moving parts, its done the job.

            I continue to feel some differences are healthy.

    • Leon,

      It’s one of the things that’s bothered me. Loss of MCAS is “minor” but misfunction of MCAS is “major”. To be clear, but I’m sure you know, the loss of function and misfunction are two different things.

      To say the least the logic is curious. Boeing introduced MCAS to address a “minor” hazard but if MCAS misfunctioned it would be a “major” hazard.

      JTAR fully questions the logic – recommendation R3 – and makes clear the pitch up tendency must be independently tested without MCAS to see whether the loss of MCAS is “minor”.

      Whether Boeing are allowed to do what they are doing depends entirely on whether they are correct in saying the loss of MCAS is “minor”. If the loss of MCAS is categorised above “minor”, then MCAS doesn’t meet FAA/EASA regulations.

      Equally, Boeing must prove that if MCAS misfunctions then the hazard remains the same hazard or less of an hazard. So “minor” remains “minor” or less. In other words a misfunction cannot increase the hazard. If Boeing can’t prove this then MCAS doesn’t meet FAA/EASA regulations

      • You fail to follow that many changes have been made in MCAS 2.0 to prevent just that.

        Using original system hazard of 1.0 to assess the 2.0 setup simply means you run around in logical circles going no where.

        • TW, this is an interesting observation. But I think Philip is attempting to circumvent circular reasoning, which is anchored in the logic of MCAS (whether 1.0 or 2.0) or software, and not in the fundamental aerodynamic design of the aircraft. There are a lot of very serious givens in Bjorn’s article that correct much of the journalism about the significance of adding larger, more forward engines to the aerodynamics of the Max and the capacity of the aircraft’s design to handle this change. Bjorn is saying things that other aeronautical engineers aren’t saying or don’t have the information to say. Has EASA flown and tested the Max without MCAS, yet? Wasn’t or isn’t this supposed to occur this month? Are the following now facts about the Boeing 737 Max?

          “The 737 MAX works without MCAS.”

          “And the base aircraft has deficiencies, like most airliners, but it’s not a fundamentally dangerous aircraft.”

          “The bottom line is, you don’t need MCAS to fly the 737 MAX. You can even fly in the extreme region where it would be active without endangering the aircraft. Would you slide into stall warning if maneuvering in this region? Probably. You are there because you pull nose-up like crazy to avoid something and you have nose-up inertia in the maneuver. Would you then swing into a stall? Maybe. So what? Every pilot knows how to get out of a stall, it’s straight forward in the 737, including the MAX.”

          “MCAS helps a pilot do an emergency maneuver at high AoA (no normal maneuvers are done in this AoA range). It augments the aircraft so he doesn’t have to compensate for a nose-up happiness of the aircraft when maneuvering in this region. He can focus on his emergency maneuver, which with a high probability is dynamic. A pilot doesn’t trim during such a maneuver, you do it afterward when things have settled down,  to balance the stick forces.”

          “Nothing in normal flying changes, in fact very little in non-normal flying as well. The pilot can do brusk Go-Arounds where he slams the throttles to full power and we won’t even get close to where MCAS steps in.”

          “Stall in an airliner like the 737 MAX is controllable, just release stick pressure and you are out of it. Not the big deal it’s made to be.”

          I don’t think it’s circular reasoning to ask if these assertions are factually correct. No one else seems to have access to this information about the Boeing 737 Max, so I can understand the skepticism.

          • You get someone like Bjorn who knows aircraft aerodynamics inside and out, both as a fighter pilot (where you really find out the limits) and an engineer.

            None of is is a mystery, read a few book on jets and how they act and its standard fare.

            I can follow Bjorn easily, but I have read the history and there is a wealth of published of information on what he talks about.

            This is not like the days when aerodynamics were not understood.

            Now its very small differences that you find in test, not like the Boeing Flying Boats where you had to put 3 rudders on it to get it to behave.

            And frankly going form a stable configuration to lethal killer with a small change in aerodynamics of the MAX?

            Look at the Baluga and the Dreamlifter. And those fly fine but the MAX is a unstable killer ?

            Just find it amazing and depressing the lack of logic.

      • It’s entirely plausible to have a system where loss of function is less sever than a misfunction.

        Mush like misleading information cam be more hazardous than loss of information.

    • Late and nit quite related. Computer types old enough to remember the 8086 based chips (2 pairs) used in the 37 flight control computer set up, raise a question which raised one for me that I believe you will be able to answer.
      As designed to run a pretty basic desk top computer this chip was (a) bulletproof, and (b) very slow by modern standards. Even back 35 years it was slow. To ensure that it did not miss inputs there was a sequencing of tasks, facilitated by a built-in delay in the way processing happens. (Please note, I am parroting things told me by people who know this stuff.)
      They ask me (LoL) if the delay might interfere with its current use in aviation where a delayed response might be an issue. I said I knew where to ask, so here I am.
      My addition is that I seem to recall that EASA added to the list of MCAS issues that the chips might become overloaded. And that one outcome could be that the MCAS (or was it the autopilot?) would not actually turn off in all circumstances even when the crew turned the switch to off.
      Could there be some connection. That the chips in some circumstances do become what could be called overloaded and that the fundamental architecture of the 8086 family — the built-in delay, as in queuing inputs — might be the cause? And that whatever software fudges and patches are being applied as the solution only answer half the problem.
      It has always struck me that the Airbus package — OK real fly-by-wire — is a great deal more comprehensive using modern computer technology. That sticking to using the 8086 architecture is yet another example of Boeing sticking to old stuff to avoid any question about needing a major (as in all new) certification?

      • Howard, the reports from June you are citing turned out to be incorrect. There was not a processing speed issue. The issue was response to artificially induced errors in the circuits (bit-flips) that are required as part of cosmic ray testing. That testing became more stringent in the wake of the crashes, and was focused specifically on the stabilizer circuits.

        The 286 processors used in the MAX are well understood, very predictable sequential single-thread processors. That is an advantage in avionics, believe it or not.

        I remember when the 386 came out, it introduced errors in real-time systems because it was the first of the series to not be entirely sequential. There are programming solutions and techniques for multi-thread or non-sequential operations, but the 286 by nature is extremely stable.

      • @ howard a banks

        The Intel 8086 Family was not (primarily) designed to be used in IBM PCs. The 8086 was used in many industrial applications, typically in PLCs. When IBM years later was designing and selecting equipment for the PC, the 8086 came up as the perfect chose, – price, availability, and capability.

        FCCs use later versions of the Intel series, and they are fully capable – and (not least) proven.

        I still have my Intel 8086 Family User’s Manual (book) – it’s dated October 1979. – Perhaps a curiosity, – but I feel attached to it, it was the first integrated CPU I worked with (we have both developed since 1979)

      • Howard, It’s thought that the 737-MAX uses 80286 chips. Still very old, but proven over time.
        As for the ‘cosmic ray’ bit flip issue, as the reason to go dual channel, I’m puzzled. If the FAA really want’s to worry about cosmic rays, then why just the 737-MAX FCC’s changing to dual architecture? Why not the 773-NG’s which use a very similar flight computer? I don’t have a CPU monitor history of the FCC’s in question. So, I don’t know if there are any race issues between sensor processing etc. I assume it’s single threaded in design, so the FCC has to deal with one sensor input at a time. A very fast time, but, still one reading and processing of it at a time.

        • Mainly because they aren’t looking at the NG right now.

          It’s quite possible that some combination of 3-5 bit flips could cause a problem in the NG, but since there’s no MCAS in it they haven’t looked at the NG implementation.

          FWIW, 5 flipped bits is a rather ridiculous requirements.

    • SAE ARP 4761 and 4754A are considered acceptable means of compliance even though AC-1309-1B is still draft.

      ARp-4754A clearly defines 5 classifications and the FDAL required for each.

      Catastrophic, Hazardous, Major, Minor, and No Safety Effect.

  2. Word police alert! “not the bid deal”
    I did think that “brusk” must be wrong until I consulted the dictionary, seems to be totally correct even though I have never heard of it before!
    Would I be right in in saying that if MCAS had never been fitted, it’s unlikely that the nose happyness would ever have been the cause of an accident during the entire lifespan of the MAX?

  3. I do some software development non critical and not related to aviation.

    The trigger reset still doesn’t work completly if it’s AoA bias failure. Using your example figures if you have a bias of say 8° when you trying to climb above 3° MCAS will activate dropping your nose and will reset. The pilot then trims it out or pulls back more to bring the nose back up and MCAS will activate again. The pilot trims out or pulls up MCAS activates again and repeat.

    If it triggers at say 11° the reset needs to be at say 5° so the difference is big enough that pilot would be able to prevent it getting to reset when fighting against it.

    Else you are just depending on the AoA disagree, I guess having both AoA with a simlar bias failure is unlikely.

    I disagree with “And if we for some extreme reason sometimes, somewhere, somehow find us in such a flight situation, the probability that MCAS then is inop is virtually nil.” Because generally you get into extreme situation because something has already gone wrong like instrument failure.

    However you description of the reason for needing MCAS suggests to me it would be better of not having it since pilots normal trained reaction is the correct action to get out of trouble anyway.

    • Missing a few things.

      Disagree means it will not activate. The split allowance (from memory) is a degree or two.

      It also can only activate once with limited authority.

      And the MCAS is both known now and I believe (still in the works) training in and with it.

      What is at issue still is the manual trim and the forces involved include breakout and speed areas.

      • TW, I think Deckard is thinking in terms of both AOA’s working correctly with the new software. Both in agreement. The new software may reset below a certain threshold AOA, and then if the pilot corrects upwards with pitch, and hits the trigger limit for activation of a new cycle of MCAS, you could get into a tug of war, if the limits aren’t set enough away from another. I think the AOA disagree cutoff point mentioned in previous Boeing announcements was 5.5 degrees, if the Left and Right were out of kilter, then MCAS would shut down. I’m not sure if it would reset if they became in line again, or it would stay shut down until engine shutdown or WOW or maintenance.

        • This situation is equivalent to a repeating limit cycle with both AoA sensor out of calibration, but with a similar bias. In that case the pilot could trim out the aircraft and then turn off electric trim.

          It should be an unlikely event, but I agree with your idea for checking AoA for potential bias before takeoff. It might not catch all instances because AoA is not considered reliable until a certain airspeed is reached.

          • I believe there should be a very tight disagree limit. Whatever is within the norms.

            Then it simply does not activate.

            No MCAS and as I have stated in the past and Bjorn confirm, so what?

            If you can’t handle a stall you don’t belong in the cockpit.

          • Rob, How critical are pitot tubes and AOA sensors to aircraft safety? How many redundant pitot tubes and AOA sensors should an aircraft have? Obviously, One is not enough, as MCAS has proven. Is Two enough? Three? Different sensor types for the data, in case one type becomes frozen? (for example frozen AOA and speed data could be validated by accellerometers, GPS data for reasonability checks?)

          • Richard, I agree two is the minimum.

            Generally there is one set of sensors per FCC, so that each computer is fully redundant and failures do not cross over between systems. 737 has two FCC’s.

            Airbus FBW systems have three FCC’s so three sets of independent sensors.

            Obviously they are critical in the sense that automation and instrument flying depends on them. I believe there are efforts to develop alternative sensing methods (inertial, GPS, etc). I agree that developing reasonability checks based on them could be a good thing,

            A lot would also depend on clear presentation of the additional information to the pilots. The more complex things get, the more difficult that becomes.

          • Rob, A really good overview of FBW in the link below .. The Airbus architecture at times uses up to Five computers.
            These choices were obviously fundamental to establish the now-classical architecture of the Airbus flyby-wire systems , namely a set of five full-authority digital computers controlling the three pitch, yaw, and roll axes and completed by a mechanical back-up on the trimmable horizontal stabilizer and on the rudder. (Two additional computers as part of the auto pilot system are in charge of rudder control in the case of A320 and A321 aircraft.)

          • Richard, just to clarify, the A320 has 3 sets of independent sensors, connected to 3 ADIRU units that together deliver data to the flight computers.

            The A320 computers are arranged so that one group works together to form the equivalent of an FCC. The remaining group also functions as a separate FCC.

            In block diagram form, this is somewhat similar to the 737. The higher number of computers provide greater redundancy and more reserve processing power, which are both needed since the FBW has complete control of the aircraft.

          • 737: has 3 Pitot and 3 separate static systems.

            One of the cross checks is to the backup instrument cluster.

            So while two AOA the critical stuff has 3.

  4. A bad flight test results analysis and classification of a late flight test change that did not trigger a full Failure Mode analysis cost Boeing $9-$12bn instead of a 2 month delay doing the mod before certification costing maybe $100-250M. Especially since the more redundant KC-46A MCAS system was implemented more or less at the same time.

  5. Just like Bjorn is pointing out, I’m also a bit puzzled about the need for MCAS. I’m no airliner pilot, but when I did my basic pilot training. Geting out of a stall situation is something you train alot.
    Starting to wonder if Boeing are afraid to get in to some kind of super stall with the MAX?

    • The yoke force relationship that Bjorn describes is required by regulations. If that makes it behave more like the NG, that is because the NG also complies with the regulations.

      If the aircraft does not natively have that characteristic, then some form of augmentation is required. That was the purpose of MCAS. This is true of all commercial aircraft, it’s just achieved in different ways

    • My understanding is that MCAS was added to make the MAX behave more like the NG, in order to avoid simulator training for pilots moving from the NG to the MAX.

      • That has been widely suggested in the press, and it was a result for the reason I cited, in that both aircraft are compliant. But it was not the reason for developing MCAS.

        Boeing did advertise the similarity and avoidance of simulator training as a selling point of the MAX. They also emphasized similarity when the NG was introduced as an extension of the 737 type. But that similarity didn’t drive the development of MCAS.

        • Agreed: There was a criticize in the high angle of attack ala stall that the pitch up was beyond what was allowed per regs.

          I do find it funny all the comments about testing the max in that region when it was tested in that region as part of certification’s.

          Its one area that you have to now matter what grandfather rights the aircraft is allowed to have.

        • Didn’t Muilenberg repeatedly state himself during the congressional hearings that the MCAS was a safety feature designed “to make the MAX behave more like the NG” so less training would be required? Why blame the press here? Is the press getting nearly everything about this story wrong, or are independent sources in the aerospace industry, including the CEO of Boeing?

          • I believe Mullenberg said that keeping handling characteristics similar to the NG was a customer request, to minimize pilot retraining. But it was not the inception event for MCAS.

            I’ve seen it reported that the initial high-speed case for MCAS was handling-driven, but the extension to the low-speed case was due to matching the NG. I haven’t been able to find justification for that, outside of those reports themselves.

            Here is the article I have found to be the most informative and well-sourced at Boeing:


          • Rob,
            But this is a press report — and those are being disputed here. The “inception event” or the intended purpose, I thought, according to Muilenberg, was to minimize training for pilots flying other versions of the 737 and the Max as a safety precaution. I thought he said this multiple times during the congressional hearings. Now, I’m thinking that I must have heard wrong.

          • Heheh.
            MCAS is there to “make the MAX fly like an NG”.
            is one (myopic) aspect.

            MCAS is there to “make the MAX conform to certification requirement comparable to the NG”.
            ( Still enough waivers exist for both airframes.)
            would be nearer the truth afaics.

          • RealSteve, Mullenberg did say that a Boeing goal was to minimize retraining from the NG to the MAX, but in response to another line of questioning.

            The issue was raised in the context that Boeing had a large financial incentive to minimize retraining, and that this influenced the decision to not include MCAS in the documentation, or to provide specific training for it. Boeing denied this but it was a valid question. It’s hard to believe there was not at least some influence.

            I believe some people and elements of the press extended this financial incentive to also be the justification for creating MCAS. But the reporting from Seattle Times and New York Times, that appears to be well-sourced, does not support this. The issue was identified by test pilots as a control issue, and there was no reported reference to the NG in those discussions.

  6. Bjorn,
    Are you under any nondisclosure agreement(s) for the sources of information for these articles?

    • What kind of question is this?

      If he says “yes”, well then Bjorn / Leeham is in trouble and article taken down.

      If he says “no”, well then…duh, you get the article.

      The answer to the question is obviously “no”.

      One thing you can say clearly about Leeham is it’s professional. What an insulting question.

  7. @Bjoern,

    I read in an AviationWeek article that MCAS could (would?) be needed in very special circumstances: i.e. with a very light aircraft with the COG near the aft limit – during more ‘normal’ loading conditions the aircraft would not be (able to?) be in the critical corner of the flight envelope. >So the question is simply: Couldn’t MCAS have been deleted (turned off) if loading restrictions had been imposed? – at least after the accidents had taken place?

    This method was used on the A321, see LHN article on 19 July 2019. The Airbus model/variant had a ‘pitch-up issue’ (to quote LHN), and the problem was solved by imposing loading restrictions – such as removing aft seat rows – until a software was available (in 2020). Interesting is also that in this case the sensor side was all at many’s liking – fully redundant – but the software was not ‘good enough’.

      • Ted, the function is similar but it’s not a distinct or discreet system like MCAS, it’s embedded in the flight control law of the fly-by-wire system. So it’s a more integrated approach than MCAS. One advantage of that is that any change to the control law automatically receives a full review and analysis.

        • Can they solve the problem with the an automated flight control feedback system and the elevator? Or is that against the certification regulations, and it has to be done with the stab?

          Not to familiar with all the control laws, but does the certification test have to be done in the most basic control law. How much feedback information is allowed in the loop, to pass this test? What is the test? Stick force? Is this applicable on the A321?

          • Regulations and testing are the same for all aircraft.

            The elevator is not traditionally used for trim so that it’s full authority is reserved for the pilot or auto-pilot. Not sure if that is encoded in the regulations, but I suspect so as it’s standard practice.

            I suspect the testing must be done under all control laws that could possibly be in force during the test conditions.

  8. Bjorn, Have you had a opportunity to fly the 737-MAX sim with MCAS turned off, in the high AOA region to experience first hand, what the stick forces are? If, so, what is it like from a Pilots perspective. I really think before the 737-MAX is re-certified that at the very least, 1) Boeing needs to publish the details of the “nose up happiness” in the 737-MAX. How, when and why it occurs. 2) Publish the full details of the MCAS operational rules and parameters, in both the Lion Air and Etheopean versions of MCAS. (there was an FCC update in Jan 2019, I’m not sure if ET302 had it installed or not) And obviously 3) Publish the full details of MCAS operational rules and parameters of the new dual channel version. I don’t think that is a lot to ask, and should be required reading for any 737 pilot. The new dual channel programming concerns me as a programmer. The testing involved in any change in a complex system is tedious. But, for a dual channel system change, I’d also like for them to show what testing they did. It does take quite a lot of effort to get things done right.

    One of the first things a pilot does in an emergency, is to switch off the Autopilot and Auto-throttle.
    I’m not sure if the speed trim system is deactivated also? I hope there is an OFF switch included in the new version of MCAS. If not, and they are depending completely on the software, I would be concerned. I want the pilot to be able to switch off MCAS (and not just via the trim motor cutout switches).

    I also don’t like this new use of flight controls to augment pilot control feedback. They have an elevator feel computer system already in place, which doesn’t use flight surfaces to feedback column force, but, actually applies additional column force directly to the column. As soon as you start playing with flight control surfaces via automated control systems, that should trigger a catastrophic hazard designation immediately requiring full FEMA analysis. The speed trim system included. The speed trim system is turned off via column cutout switches. I’d also like to see some sort of AOA ground test incorporated in the before takeoff checklist, since the AOA sensors are so critical now. The pilots currently will only find out if an AOA fails just after takeoff, and this is not a good point in the flight profile, with a very high workload and not any altitude to use as a safety margin. If they could verify working AOA’s before flight easily, I’d much rather them find out on the ground than just after takeoff.

    If they don’t include an OFF switch for MCAS and depend on the current Stabilizer motor cutout switches, then that opens up the whole can of worms about the manual trim wheel operation in the full flight envelope. I’d like to know how many revolutions it takes for the trim wheel to move one degree of stabilizer and how long it takes a pilot to do it. I’m sure if depends on how out of trim the stabilizer is, but, it sounds like there is a major issue of trim wheel movement, during an emergency when the electric trim is unavailable.

    • I don’t believe that the 737 is any more nose up happy than any other jet.

      Its a characteristic of the configuration with the MAX having a bit more pitch up at stall.

      I have a confirmation from a 737 pilot that it alwyas did pitch up when you poured the throttle to it. As its a known characteristic its also a built in adjustment.

      To put it another way, I owned a narrow track and top heavy 4 x4. Back in the day before all the steer control stuff (and no anti lock – yes the stone age of vehicles)

      It had the most vicious skid characteristics of any vehicle I have driven (and I have driven a lot). When it skidded, you could stop the skid fine, but as you came to a stop, the top heavy loaded up the suspension and then it snapped back the other way. That was what got you.

      What I found was that for that vehicle you anticipated the stop and you started back the other way with counter steering to stop it the other way (which it did). Desirable? No. Controllable, yes.

      The MAX or any jet is no where near that bad. Its known, you train and learn to get out of a stall and its no issue.

      As JMA pointed out, private pilots and commercial (in other words ALL) pilots train a lot for stall and how to recover. Aircraft have nasty stuff designed out so they do not turn upside down and spin like some did back in the old days (even older days than I am)

    • I would personally doubt that the simulator would provide realistic yoke feel (or overall aircraft feel) at a point that far outside the normal operational envelope. The aircraft designer has the computer models but reality may turn out to be different. Running that scenario in the sim would just feel the way it should have felt if the models were 100% accurate. Actual flights are required.

      • sPh, Yes, I should have thought of that. The sim’s are very realistic in their presentation, and simulate movement as well as they can, but, being bolted to the ground, they are limited by the hydraulic movement limitations as to how much they can actually recreate. I’ve only been in one (737-800) a few times and they are quite realistic. A great training aid for pilots learning procedures and systems, but, they can’t take the place of real aircraft in terms of aircraft testing. Boeing’s is souped up a bit, but, it’s still a simulation.

        • The Level D full flight simulators are certified for zero flight hour training, so they are pretty good. They use acceleration cueing so as not to utilize their full range of motion or hit the stops. Then they return to neutral position below the perceptual limit.

          They can do a commercial airliner critical AoA simulation realistically (15 to 18 degrees), so probably could handle MCAS training as well.

          I believe there was an issue with the MCAS software not being implemented fully or well in simulation, which Boeing has worked to address.

          • I’ve never been in a full-flight simulator but I’ve been told they are incredibly realistic. An army helicopter pilot told me they were required to fly an hour as copilot in the physical aircraft after finishing a simulator session because the simulator was so close to the real aircraft but not _exactly_ the same that it was like being type rated in two different aircraft.

            That said, the simulation can only be as good as the models driving it, and when the a design has normal range +/- 30, operational range +/- 50, but certification range +/- 100 I personally would not trust that the models were fully accurate at +/- 99 without testing the real object.

          • sPh, I believe the simulators are thoroughly validated before being certified for zero flight hour training, partly by comparison to actual flight data. The data are recorded in actual flights and then replayed in the simulator to assure accurate reproduction. This is certified by test pilots who have flown both real aircraft and the sim.

            Only the Level D simulators can get that rating, and only at that point are they considered acceptable for the zero hour training.

            The question here was whether that would be sufficient for MCAS training. I believe it would, based on what I have learned about the certification process.

            I’m sure there are many scenarios for which the simulation would not be sufficient. For example fighter training, they don’t use full-motion sim because it’s not nearly robust enough. Possibly for your Army helicopter friend as well. But for commercial pilot training, I think they are pretty accurate.

          • Rob/Sph:

            Level D are supposed to be exact, no perceptible differences from not just the real bird but the real birds flight characteristics.

            Part of my job was to power and Air Conditioning support for one, so I got a very up close and personal look and some education in them (to the point we had argument as to where their responsibility began and ours ended at the interface points).

            They ran regular tests that were submitted to FAA to prove they met the fidelity standards and the FAA inspected them (I never asked how often)

            I did fly in it and it indeed was fully realistic (the visual system was not at the time but got upgraded so it may have been better)

            What I can say is you discount the obvious visual system being off immediately as the scenery (if not in the clouds) is distant and it did the same cuing as the real thing would.

            The computer room to run it was 35 feet long and 20 wide. Separate hydraulic pack room with 220 some hp in hydraulics (two 100 hp and an idler of 20 hp) for the struts (election actuation is being used now)

            Upgraded to new computer standards when the boards went obsolete.

            All that and I find it unfathomable that the manual trim was allowed to get corrupted for feel on the NG sims.

            The techs would have tested that – no one seems to have questioned it.

            Originally it followed the profile for hard to move at speed and clutch break out with a frozen motor.

            That is another aspect to this twisted story.

          • Sim engineer here. Class-D Sims are as real as it gets, although in motion you don’t get continuous G-forces up, down, left, right and over the z-axis (yaw). There are strict QTG tests to perform yearly for recertification, and all control forces are very much scrutinized. Final point is that sim manufacturers do not develop software like MCAS. They receive it as a closed software package, with just inputs and outputs, and tie that model into their own software. So anything that’s operational in the real aircraft, is exactly the same as in the Sims. Now as for training, failures only can be tested as far as the failure modes installed in the sim. And yes, I’ve been on a bunch of recreated flight 610 simulations, albeit on an NG sim. I think one point is very clear. They never got to the point in the checklist to reduce throttle to about 30% according to weight/altitude. They both stuck to initial 75% as per QRH. Both aircraft went close to Vmo (320kts IAS I think it is) and manual trimmed was getting too hard. In Ethiopian, this is why they turned the electric trim controls back on, after initially turning them off, which kicked in MCAS again, and dooming the flight.

          • Paul: Good to get the input, I was outside the loops for the most part other than side conversations.

            Would you have an insight as to the manual trim for the 737 getting changed and no one noticed?

    • Hi Richard,

      quote: “I’d like to know how many revolutions it takes for the trim wheel to move one degree of stabilizer”

      According to the video of Mentour, it takes 15 turns per unit, for 40 seconds with great difficulties on the end (max speed: 300kt) (it goes from 4 nose down units to 3 nose down units)

      • The Mentour was gone when I looked but you are replacing a high speed motor so its going to be a lot.

        • Mentour was also talking about a simulator. My impression is that the trim wheel behavior in the simulator does not parallel that in the actual plane or real flight conditions.

          • It’s true that the simulator did not adequately represent forces on the manual trim wheels at high airspeeds and low altitudes, where the forces are very high. The simulator model regime was based on the 250 knot regulation speed limit at 10,ooo feet altitude. The accident airspeeds were much higher than this, and not correctly represented.

            That was discovered when the real accident events were replayed in the simulator. The issue has since been corrected, the trim wheel force model has been extended to include the accident conditions.

          • Hi everyone,
            The simulator may not be very realistic but we know they had great difficulty under 300kt and we also know that the crew of Flight 302 could not use it. I read somewhere that it took 250 laps to go from one end to the other of the range of use, 17.1 units. 250 / 17.1 = 14.61

  9. Bjorn:

    If I am remembering right, an article from Seattle either Boeing or Alaska Airlines has moved to the mantra, unload, unload , unload which is an active stick push forward.

    The logic was that you want the aircraft flying and LCA are slow in response, so being more “active” to get back to normal was the current thinking.

    • TW, good question. I’m not a jet pilot, so, do you want to point the nose down as quickly as possible. Maybe someone with more experience can chime in?
      I was reading an old 737 classic accident report, and they suggested not using too much pitch down?
      (russian 737-500 go-around accident from years ago)
      imagine this same go-around in a 737-max (with twice the
      engine thrust.. see below video)
      on page 86 of the accident report, they go into great detail of the speed trim system’s detailed
      operation and schedule. i wish we had the same detail of mcas in the lion air accident report.
      on page 96 of the accident report, they describe a pilot experiment they did with a number
      of pilots, in a recreation of the go-around procedure. quite eye opening. it appears when you get
      close to stall, you’re not supposed to use full elevator down. i wonder how mcas reactions would affect this? this accident has been marked off to bad pilot training. there were some comments
      from russian officials concerning lack of analysis of the elevator, but, they have been dismissed.
      (example of a go around procedure of a 737-800 is on page 4)
      (video of an aeromexico 737-max doing a go-around.. seems very straight forward)
      question for the aerodynamic folks… can a 737’s engine vortex wake turbulance ever, in a slow
      speed, pitching up, turn, with engines at max thrust, nip into the elevator’s air flow? maybe then
      causing an increased pitch up force?

      • Richard:

        What Bjorn describe as relax and I more describe was nose down is similar though relax would not be the term I use.

        As with an SEL (single engine land) you are not trimmed into a stall your are pulling back hard, but its basically the same thing, get the nose down.

        What you do not do is keep it down once you are flying again be it SEL or LCA.

        Its nothign more than a skid in the now older vehicles, once you stopped you did not keep cranking into a skid.

        Its all about the training.

        Through this all you are watching your AH, airspeed, VSI, altimeter, DG, turn and bank (accelerated stall)

        I can’t repeat it enough, its not just training, its drilled into you that its second nature even if you are deliberate confirming it all.

        You know what you should see and you are active in checking to see if that is what is occurring.

        Confirmation bias should have no place in the cockpit.

        I worked with pressure gauges for many years, inclding the exact model and mfg of the gague on the Maconda blow out (its simply the best gague in tghe world for tghat use)

        They looked at it and then questioned it was right and assumed it was wrong.

        All the training said assume its right (and why there was only one gauge there I have not a clue)

        Correct is to believe it and take the action as well as get another gauge on the system and cross check.

        I make no claim to have been a top level pilot per Sullenberg.

        But with my training, when I got myself into a spin I also got myself out (that is uncommon but I had a lot going for me particularly good altitude to assess)

        I also did a good job on an MD-11 flight simulator in landing. Pilot was surprised.

        Again some advantages in Auto Throttle I did not have to worry about and it was virtually the same approach picture as an SEL (he was used to non pilots being in the demonstrations)

        My take is that I got good solid basics and if a pilot gets those he can handle an amazing amount.

        I do wonder if training should not go back to SEL and the basics as part of the training.

        Maybe even the old steam gauges.

        • I don’t know that Philip has tried to answer anything and has offered up false hoods.

          I do know he has a total ignorance of aircraft stability and aviation in general as he has claimed you cannot fly on instrument in stormy weather (we have since the 30s)

  10. I genuinely don’t understand this. Here is the given: MCAS is a feel or stick-force system designed to make the Max feel like the NG, because the Max is “nose-up happy.” I don’t understand, then, why any system would exceed the feel of the NG and fight the pilot with hundreds of pounds of stick force if there weren’t some sense of an eminent and catastrophic stall. I’m thinking of the ET302 pilots, floating in space, rocketing towards the ground as they applied every once of strength in their bodies into pulling back on the yoke. Isn’t this more than a program designed to mimic the stick force of another aircraft?

    • I think the reason for MCAS took on a dual fold aspect.

      MAX is not nose up happy, regulators felt it exceeded pitch up which does not no mean nose happy just more than acceptable.

      Boeing in turn had monetary reasons to keep the MAX as common to the NG as possible to avoid costs. In no way should that beat safety and there is no question 347 people are now dead as a result of it.

      Yes we know what happened with Lion and Ethiopian. The problems (if not how it got there) are well understood and are being corrected.

      It seems to me a dead horse is being beaten with the fake talking points being inserted over and over (nose up happy)

      • TW, I’m not inserting fake talking points. Maybe I misunderstood it, but I was using Bjorn’s own language when I quoted the term “nose-up happy.”

    • RealSteve, the NG similarity justification of MCAS is not a given, it’s a premise of your argument, for which there is no established evidence, even though it’s been widely reported in the press.

      Also you’re referencing the behavior of an MCAS malfunction as if it were the intended design behavior. It never was intended or designed for that scenario. MCAS was not adequately designed, implemented or tested, and no one is denying that was a serious oversight and flaw, that never should have happened.

      Essentially the stabilizer ran away (full AND deflection) due to an MCAS malfunction, and this was not identified or trimmed against by some pilots. It was by others. Boeing has responsibility for the behavior of MCAS under malfunction, and for not documenting MCAS for pilots.

      This was the source of the extreme column forces, as well as high airspeed in the Ethiopian accident. Those control forces were not a design feature of MCAS.

      • Rob,
        I’m not making an argument. I’m trying to understand or disentangle one or several that have MCAS as an anti-stall device; a safety feature reducing the amount of training between NG and Max pilots; or an unnecessary something that might nudge the nose down when flying extreme maneuvers way (and infinitesimally rarely) outside the normal flight envelope. It’s almost like MCAS 2.0 is not just being re-engineered (or rewritten), but it is being repurposed from MCAS 1.0 — retroactively and ex post facto. This then becomes a question about the software itself and not its original, intended, and purloined use and not, for instance, about the stabilizer and whether it should or can be used the way the software tries (or once tried) to use it. But it does indeed seem to me (a radically non-engineer) like an argument, or a rationalization, and not an analysis. There are too many assumptions and unknowns — or at least things that are only and uniquely known to the writer. Other serious and qualified aeronautical engineers don’t seem confident enough to make the same assertions about the Max. So, it’s difficult to follow, very interesting, and mostly sad for the people who died.

      • … are you saying that MCAS produced “runaway stabilizer” or that MCAS pitched the stabilizer in the wrong direction? On ET302, were the pilots fighting runaway stabilizer in the end or MCAS, as it aggressively pitched the plane down when they turned “stab trim” back on? I can’t see how software that does that was written just to apply a little counter stick force to mimic the handling of another jet.

        • Real Steve:

          What MCAS 1.o really is under the wrong circumstances is a variation of Runaway Stab. Boeing was half assed right on that.

          It was not what they were trained for as it was not continuous.

          Trim countered it and it also stopped for a few seconds.

          But keep in mind they never just trimmed out and turned stab off, they left it in.

          So when they turned stab back on, it came in with its all too much authority (deg per second or max to the limits) .

          What you are missing is the same input is there all along, high AOA and it was just waiting to do what it was programed to do, dump the nose.

          Now why they did not see that, get it and test for it is a whole investigation on going.

          As engineers they know better, so it went off the rail process wise.

          Part seems to be the disjointed design and test that test did not know what the design was going.

          Mixed up in it I believe is Boeing selling the MAX as not NEEDING to to train pilots on the MAX, same oh same oh as the NG.

          Like the Titanic, if they had gone South and away from the ice fields it would have not been a problem either.

          Or if they had been going dead slow? They had the warnings.

          But no, lets go near ice at Maximum speed because? Well we are unsinkable.

          People tend to think they are logical but they don’t think.

      • RealSteve, to clarify, MCAS was implemented to comply with regulations regarding aircraft handling at high AoA. There should be no confusion on that point.

        The high AoA condition is unlikely in normal flight. This has led to statements that MCAS is not necessary. This is true in the sense that pilots can fly the aircraft without it, but not true within the scope of the regulations.

        Note that the converse has also been stated. If MCAS is necessary, then the aircraft must be unstable without it. That is not valid, for the same reason that it met a regulatory requirement for the desired behavior of the aircraft, at high AoA.

        MCAS did effectively create a runaway stabilizer condition (full stabilizer deflection AND), when supplied with incorrect AoA information, and when not countered by the pilot.

        This action was not designed or intended or tested. MCAS was designed to deflect the stabilizer briefly at high AoA and reverse that when high AoA was remediated. It was never intended to drive the stabilizer full AND. That was the result of a malfunction and poor design and implementation, which did not check for or address this possibility.

        • I had not seen mention that the MCAS reversed itself

          Not that it didn’t (or doesn’t) but had not seen that.

    • There isn’t anything to understand. This article isn’t factually. It’s assumption.

      The JTAR report and the Lion Air crash report provide many of the facts. But one key fact is missing. The AoA/Mach number profile when MCAS is engaged. It’s missing.

      Can I ask the Ethiopian Airline crash investigators to include the AoA/Mach number profile when MCAS is engaged. It’s somewhat important to understanding.

      It comes down to this. According to Boeing, MCAS exists because of a “minor” hazard. It’s implementation proved to be a “catastophic” hazard but equally it’s implemenation was designed to be a “major” hazard.

      The logic doesn’t connect. Correct a “minor” hazard by implementing something that is a “major” hazard. See the JTAR and the Lion Air crash report.

      Even to day, the logic doesn’t connect. Trim stabilisers are not designed to be the primary means of manuevering in pitch. As that is the case, the fail-safe redundancy isn’t there.

      So, what’s being attempted is entirely unique. FAA/EASA regulations don’t cover it. Boeing are writing their own regulations and saying they comply with FAA/EASA regulations. In other words, Boeing are rewriting the meaning and purpose of FAA/EASA regulations to comply with what they are doing,

      Of course they are using grandfathering. Why not? Boeing can do what they want!

      It’s going to the courts. Rewriting the meaning and purpose of regulations always means the courts.

      • As the automation such as it exist on the NG and MAX do use the stabilizer for pitch, that is beyond ??????????????????????

        And in fact, the stabilizer is used by the pilots for trim in pitch as the trim button use is the first thing they go to to do so.

        And yes the response for failure it to turn off the power to it and use elevator.

        Its no different than the 737 Rudder issue. It was no designed nor intended to crash aircraft, but due to a failure to understand a failure path, it did.

        In reality there is zero difference between MCAS 1.0 and that ruder failure. Equally so was Boeing refusal to even consider it.

        It no more complicated than that. Boeing could not have done a worse job on MCAS.

        What you want to do is understand how they got to that point and what is needed in the regs (or enforcement of them) to ensure it does not happen again.

        You are aware that Boeing wrote the Jet age regs?

        There was nothing there before so they wrote them.

        What has happened since is a corruption of the process to allow this to have occurred.

        Ironically, the MAX is less of a stretch of the regs than the 777x and the 747-8.

        Now grandfathering of aircraft is a good subject for discussion.

        Should the A320 and A330NEO be put through a whole new certification’s as well?

        Should there be separate category of FBW grandfather and old mechanical grandfather?

        The reality is that various versions of the grandfather have been allowed now and sans some huge impacts, Airlines depend on continuity of that. In other words its a future discussion and possibly will never come up again (granted Boeing with the 747-8 and 777x have made that more likely)

        But we have also seen cases of where the base aircraft was accepted and then stretched (A330 I believe was grandfathered to the A300 and if that is not a massive change?)

        My 1995 F250 truck is still road legal (as are any vehicles) so do I have to melt it down because it does not have skid control and anti lock brakes and only one airbag?

        • Not interested.

          Bjorn’s views can be subject to question. As it stands he is getting nothing right. Indeed his record over the year speaks for itself. I remember he blamed the pilots.

          • I think Bjorn is looking at the entire accident chain, as clearly and fairly as he can. That includes considering pilot actions.

            He hasn’t been disrespectful of the pilots like some commentators. As a pilot himself, he understands better than we do what they experienced during the accidents.

            So we can listen and learn and ask questions and present evidence to the contrary, all of which is fine. But maybe avoid outright declarations that he is getting nothing right. That is quite obviously untrue.

          • Philip:

            Bjorn has gone out of his way to NOT blame the pilots.

            Frankly I blame the pilots quite a bit tho0ugh I offer no excuses and blame Boeing as well.

            So no, you have that part wrong.

            Where you are totally mistaken is not seeing the difference between a view (pilots vs Boeing) and aerodynamic facts.

            For all practical purposes, Bjorn is like Einstein in this example. He not only knows about it, he lives, breathes and understands the fundamental of it as well as aircraft reality.

            If he said the 737MAX was iffy on stability I would believe him.

            If the MAX is so iffy, how can they massively modify the 747 and the A300 (A330?) into the shapes they did and be fine?

            If you start out with a stable aircraft, you have to do something more than move the engines around a bit to make it unstable.

            Major fuselage changes on the 767 (400) and its still stable.

          • Wrong TW, as always. Bjorn wrote an article blaming the Lion Air pilots just after the crash. I ripped into him. You objected. To say the least you objected.

            A year later. Nothing’s changed. This article is something I can not agree with.

            But I will be civil.

          • You are rembering wrong Philip. This is what Bjorn did say less than 2 weeks later when he had the cockpit recorder information

            “We await more information before going beyond the observations made above. I think it’s safe to say; it wasn’t a clear-cut “execute the Trim Runaway” checklist situation for the crew. ”
            No ‘blame the crew’- its a silly phrase as experienced people think of accident causes

            I think you are confused over a different spat you have had , one of many.
            However for other readers this was your opinion in that article..note how sure you are.
            “But, from the beginning I took the view that it wasn’t stabiliser trim. I think MCAS put the stabiliser to maximum deflection to prevent stall on the basis of inaccuate AoA. This caused a steep dive.

            Media commentary suggests I’m right.”

        • “” Now grandfathering of aircraft is a good subject for discussion.
          Should the A320 and A330NEO be put through a whole new certification’s as well? “”

          I know the A330neo is an old design, Airbus didn’t change much, but what went wrong? I’m not very strict with regulations and I’m sure EASA isn’t too but of course there can’t be excuses for important things.

          Huligans made the MAX stabilizer and elevator stronger, obviously because of increased forces, but forgot to make the elevator bigger and the weak jackscrew can’t keep up with it, that’s unacceptable. FAA???

          Classifying hazardous hazards as major from the FAA killed people.

          On the A321 the big doors 3L/3R aft the wings were degraded from the FAA because the doors don’t reach the floor and have a step. Degraded so much that the FAA count 3L/3R only for 5 seats, that’s unbelievable. Of course the A321 hurts much.

          Good luck with certifying the 777X. It’s Boeing’s culture what went huligan and killed, we all know this and this must stop NOW.

          • Leon:

            I agree Boeing released lethal software and could not have done a worse job of its logic.

            Jack-screw and elevator are not in question here, its the control of them via MCAS 1.0 that was. To contend otherwise is factually wrong.

            Airbus and its culture of the FBW have also killed people.

            We work to correct that for the sake of all passengers and the health of aviation.

            False information does not help address or correct the situation.

  11. That’s because the system was getting inaccurate data. If that data was accurate then the trim being applied would have been appropriate. That doesn’t mean the plane wouldn’t have necessarily crashed, of course, because if that AoA data was accurate that means something extremely serious was happening to the airplane.

    • Kind of a ?

      If it had been real, the AOA would have gone down as a result of the pilot and and MCAS actions and then its a non issue.

      I can only think of one Aircraft stall and that was AF447.

      That was a result of bad software that refused to believe the speed as it ignores anything below a certain level.

      Unfortunately like MCAS 1.0, it does not have multiple sensor imputing to tell the computer the aircraft is in the air and the speed is valid.

      In the case of AF447 the pilots induced it.

      • I’m not sure if it was just bad software that was the problem in AF447. In the end, I thought it was bad piloting. My impression is that there is enough redundancy in the A330, that if the pilot had not constantly intervened as he had, the aircraft would have righted itself. Indeed, this is the only possibility in a fly by wire system that often flies outside the limits of the pilots ability to intervene with sound judgments concerning things like altitude, speed, and angle of attack. A good example is Quantas Flight 72. The navy, Top Gun captain who was flying the plane ultimately saved the flight by doing nothing. He was in a dive and pulling back on the stick. He said he had been counter-intuitively trained to let go of the stick in such situations. He let go, and the redundant computer systems that he had lost faith in — that seemed to want to kill him like HAL900, that had gone haywire — righted the aircraft. The plane eventually landed with no deaths.

        • Real Steve:

          That gets to the heart of this and when is it software and when is it the pilots?

          And Frankly, it really gets into, The System.

          The pilots were allowed to get lazy. Amazing that 3 pilots with that level of flight and sim time could get there.

          But like the Titanic, the FBW as done by Airbus claims its foolproof.

          But then the so called fool proof then dumps it on pilots who are still the fool proof mode of thinking./

          As I recall they looked at something like 13 loss of pitot.

          I believe only two handled it the way they were trained to.

          Most pulled back as I recall. That is so nutty from flying standpoint as to be unfathomable.

          If you loose your air speed (stall) then you push the nose down, not pull back more.

          And in fact a 757 pilot did just that going into Ireland. While it was wrong it at least had a disjointed logic.

          However, if you are at 30k and in level flight, what is going to zero out your Airspeed?

          As that is above even Everest – nothing (well in flight breakup but then you would be sucking thin air not warm and fuzzy with alarms in a cockpit).

          So when I say software, either design it to do it all or do not train people that it is.

          Think of it as MCAS, loss of a single parameter (speed) puts you into alternative control law and all sorts of alarms (including stall which is plain wrong)

          Why would you not program in the attitude , VSI, altimeter into this and,

          Ding – Ding: Hey pilot, you have lost pitots, we are going to 5 deg attitude and 85% throttle, push the button to acknowledge (those two are the right position and settings to keep flying safely)

          All the years of training for which that is an automatic memory checkoff item went by the wayside.

          So, no one tested it. Hmmm.

          I then have to ask, can we NOT train pilots?

          Clearly the system is creating poor pilots.

          Then should the automation not be in full control at all times? (software seeing and program)

          That is why I say it was software.

          As noted by the JTA study, pilots are overwhelmed by the alarms and do not react.

          US and Europe are working on training to see if pilots really get basic handling of the aircraft.

          So its also a system issue. The training clearly has not worked, but bells alarm and whistle are also clearly proven not to work and they are in the cockpit as well.

          Likely its a combination fix, but I can blame software as much as the pilots in AF447 as thee was some simple programing that would have stopped it as well.

          • I would suggest browsing over to AVHerald and reading a fairly new incident, ‘Incident: Orange2fly A320 at Muscat on Jan 28th 2019, Alpha Floor on approach at 210 feet AGL’. It appears that either the pilots did not understand how the systems of their highly automated FBW aircraft interacted, or they had a momentary lapse of systems-situational-awareness and put the controls system into the wrong mode. The FBW last-ditch protections did save them but it pulled up at 200 AGL. So I think the US NTSB’s report on pilot training and deep understanding – which doesn’t get referenced much in these discussions – is of more than passing interest.

          • Long standing issue from my standpoint is the FBW.

            With a human being at the controls (fully) the modes move in and out automatically and seamlessly, they do not need to be programed, they are there.

            If on landing you hit the minimums and whatever your indicator used has you at the threshold and no runway in sight, you do a abort (go around).

            Computer logic need to be told its in an abort mode. Cob the throttle and it does not get it. Pull the wheel back and it still want to land.

            While Air Asiana 777 into SFO was 3 idiots in the cockpit (I would not even call them pilots) Boeing took away the last safety as a result of the FLCH Trap mode. No auto throttle (its not told to turn off it turns off and stays off as a result of FLCH mode) even though the decent is arrested and FLCH is still on but you are not doing FLCH.

            Until they correct that mode issue its going to keep happening.

            You should not have to be Stephen Hawking to fly an aircraft.


            Auto Thrust FMA
            Alpha Floor

            The amber boxed A FLOOR annunciation is displayed when the speed is between ALPHA Max and ALPHA Protection, and the auto thrust system commands TO/GA thrust regardless of thrust lever position. ALPHA FLOOR occurs at a predetermined angle of attack.

            The A FLOOR engaged mode changes to TOGA LK when A FLOOR conditions no longer exist.

            The α floor function is not available below 100 feet RA or during single engine operation with flaps at CONF 1 or greater. Alpha floor protection is only available in normal law.

    • 737 MAX 8, made in the u.s.a., flown in the u.s.a. End of the Max 8.

    • Pretty much the same thing.

      The new part is the pilot training, so Boeing could get the ok and deliver aircraft and the pilot training would have to be done and then re-start worked into the schedule and system.

      As the holiday season will be an all hands and any aircraft you can get ting (along with pickle fork inspections) there will be no pilots to spare post Holiday as they will be (pun intended) Maxed out and on rest.

      Some small mfgs can clearly stop and re-start and with the parts backlog not an issue.

      There is noting that the package fix is not on the way to submital.

        • Uwe,

          Scott Hamilton mentioned this in his article
          two weeks ago.

        • Hi Uwe,

          In the interview that Scott referenced with a link, Dave Calhoun is clearly talking about RTS in the context of Dennis Muilenburg not getting any bonuses “until the MAX, in its entirety, is back in the air and flying safely”.

          Then Calhoun clarifies by saying:

          Return to service starts the day it’s certified. It’s not over when it’s certified. There’s no victory in that, right? We have to get the airplanes that our customers have put on the ground, we have to get them back in the air. We have to assist them every step of the way. And, we have to get the airplanes that we’ve built, and are ready for delivery to customers, back in the air as well. That’s a long program, it’s at least a year.

          This is totally in line with other reporting. Max re-certification at end of year 2019 or beginning of 2020, and all grounded MAX’s flying by beginning-ish 2021.

          • So it seems Calhoun has no idea too. If he meant the delivering of already built MAX he better should have said at least 2 years.

            Still the FAA has no timetable.
            EASA’s flight testing and the results still up in the air.
            Transport Canada wants MCAS out.
            Quality of simulator software is still uncertain (one reason why ET302 crashed).
            EASA mentioned a transitioning time till a 3rd AoA sensor is included. What if other regulators wants this from the start?
            What about the stabilator/elevator issue?

            Boeing is only hoping.

          • So Transport Canada now want’s MCAS out, huh?

            Whatever you say, Leon.🤪

  12. Bjorn:

    Thanks for the great article. I understand plane can fly without MCAS; however, I’m confuse whether that is allowed considering 14 CFR part 25 maneuvering characteristics requirements. If system malfunction, I don’t think that is satisfied and I’m not sure FAA can approve an aircraft given such possibilities.

    • If they got rid of the changing MCAS software, they’d have to do some physical change as Bjorn suggested in one of the previous parts of this series, as in aerodynamic strakes etc.? That might be easier to test and certify, and be an easier sell to the rest of the world regulators. They’d have to do some retrofitting to the current fleet, but, it seems like a more proven approach to me.

      • For the MAX the issue is the center of lift moving forward with high AoA, so an aerodynamic solution would need to either prevent that or move it backward to compensate. Not sure how that could be done without some sort of lift device.

        Turbofan engines will be getting bigger yet, since the fan size contributes to efficiency. Already up to 12 foot diameter. So the nacelle lift problem at high AoA isn’t going away.

        • Not so for the A320 series, their GTF fans in the neo versions are even larger than the engines on the Max but Airbus said no special mods were required.
          I imagine the same situation for 777X .

          • Duke, this is because the Airbus mods are integrated into their flight control law software. That approach does not require a discreet system like MCAS. It’s implemented as an integrated whole, for the entire aircraft.

            That doesn’t mean the additional lifting forces from the nacelles at high AoA are not present. They are just compensated for in a different way.

        • I agree with the Duke, provided there is a pylon between the wing and the nacelle to allow the airflow to separate, thereby preventing the nacelle from becoming a forward lifting device.

          All modern airplanes have forward mounted engines. It helps with CoG but also helps calm the airflow before it reaches the wing. This in turn allows pylons with less depth. But the depth of the pylon must be sufficient to allow the flow to separate.

          It’s the upward mounting of the engine on the MAX not the forward mounting of the engine.

          No other modern airplanes have the same problem as the MAX, no matter how hard some suggest they do. That includes Boeing airplanes.

          • I don’t think there’s any evidence that the type of mounting radically changes the lifting force produced by the nacelle area. The larger engines will add lift based on their area alone, when inclined at sufficient AoA.

            There is an argument that the further forward they are mounted, the more the center of lift can move forward at high AoA. But the difference between MAX and NEO is a few feet, it’s not a huge change given the size of the aircraft.

          • Rob,

            Then you are not an aerodynamic engineer.

            In aerodynamics you can move something an inch and get completely different results.

            I can’t take you seriously. Sorry.

          • Philip, please note you are free to present your evidence here at any time. Making statements that the people who disagree with you are not competent, is not helpful, does not advance understanding, or the discussion in any way.

          • Rob,

            I will add. Is 346 dead people evidence.

            I admit Boeing won’t tell. It’s the one thing missing. They will not admit the pitch up tendency caused by the nacelles.

            They must not be allowed to get away with this.

            No evidence. Seriously. We can all keep secrets. I can’t take you seriously

          • Boeing has always acknowledged that the nacelles generate additional lift, that was the rational for developing MCAS. It was also evident in the flight testing.

            There is no evidence that the mounting pylon is a significant factor in that lift. The more forward location is a factor, but it does not dominate the effect. The dominant effect is the nacelle area.

          • Rob,

            Hundreds of years of aerodynamics disagree with your words. The Coanda effect is the effect you need to read up on. It’s why airplanes fly.

            You don’t have the right to redefine aerodynamics as per your posts. You don’t have the right to say every airplane as the same issue as the MAX.

            You talk about evidence. You provide the evidence that makes clear all airplanes with forward mounted engines have the same issue as the MAX.

            Pylons exist to eliminate the issue the MAX suffers from. So, it’s not forward mounting it’s upward mounting.

          • Airbus statement
            “The nacelles are larger than the 737 nacelles, however, so the pitch up moment from the engines in isolation can be similar. As the ‘engines sit lower on the wing their combined effect with the rest of the aircraft and its wing’ is not the same as the 737 MAX. According to Airbus, it has not been forced to do anything special to control the changed pitch balance of the A321neo.”
            The 346 dead people is only evidence that Boeing botched a minor augmentation system implementation , however ‘” the 737 Max flies fine without it “.
            People forget how many other aerodynamic changes Boeing had to make to the 737 Max to chase the better efficiency of the larger diameter fans with Neo engines and even had a ‘pip’ programmed for after 2021 .
            In a different context, when Douglas put larger diameter and heavier engines on its stretched MD80, the extra weight at the rear and other deficiencies meant they made an unusual solution of
            small elevons on the engine pylons themselves.

          • Philip, you may be misunderstanding the application of the Coanada effect.

            In the case referenced for podded engines, if the pod is above the wing, the entrained high-velocity exhaust lowers air pressure above the wing and increases lift. It’s an advantage of locating the pod above the wing.

            In the case of the pod being below the wing, it would tend to decrease lift, to the extent that it’s effective. I’m sure that effect is considered in positioning the pod, and in flow testing. You wouldn’t want that effect below the wing.

            I think the larger engine nacelles generate lift in the traditional way, by deflecting the airstream downwards upon impinging on their cylindrical shape. They begin functioning as lifting bodies at high AoA.

            Since this depends mostly on size and surface area, the same effect will occur on all airframes. Position will also play a role. If the extra lift is generated closer to the center of lift, the effect will be diminished.

          • From the cited article:

            “Like the 737 MAX, the A319/320/321neos are affected by the mounting of larger engines with their larger nacelles ahead of the center of gravity…”

            “The larger engines for the A320neo series are controlled by the aircraft’s inherent pitch stability which is constituted by the aircraft’s horizontal Stabilator and Elevator and its FBW which controls these aerodynamic surfaces…”

            This is what I was saying, Airbus did not do anything special because the characteristics of the aircraft are already embedded in the FBW flight control law.

            Note that this was not possible for the 737, which has to accept the input of the pilot, even if that nears or exceeds the edge of the flight envelope. In the A320, the aircraft would be expected to invoke pitch protection in similar circumstances. It is certified for that FBW protection, whereas the 737 is not.

          • Philip:

            It must have come as a shock to the 737 original that it could not fly without a pylon! All those 737-100 and 200 flights I took must be figment of my imagination.

            You are aware the pylon came in with the Classic? Moved on the NG?

          • Rob:

            Philip does not misunderstand (nor understand) any of the aerodynamic theories, they are simply there to be used as techno gobly gook speak to support his agenda.

            Nor the reality that if an aircraft is stable it takes a huge change to make it unstable (notice he does not response to the Dreamlifter , the Beluga, stretched birds (way stretched as the 747-8 and 767-400, A300 etc)

            Its almost charming.

            I kind of morph back to the days of the flat earth and the last person saying, no, no , no, its flat I tell you.

            As they say, De-Nile is a river in Egypt.

          • TW the pylon came with with the high by pass ratio engine, which now becomes even higher.
            Low undercarriage is great for rear engined planes, the first 737 was the offspring of the 727, but like many who are first , the first twin engined under wing enginned plane didn’t quite have the configuration totally right.

          • Sorry, all bodies that have an AoA have a lifting component. Trivial stuff. The question is whether the lifting component is not typical.

            So rubbish. Really, really rublish. I reply below in a new thread.

          • I will make it clear.

            I’m not fazed by the behaviour. You can’t teach me aerodynamics but neither can Bjorn.

            I ‘m reading BS

          • @Dukeofurl
            I looked this up on the MD80. Amazing.

            Now that’s an aerodynamic solution to problematic engine placement.

            For some reason, it seems to have been lost that the placement of the engines was modified for the Max, because of the short landing gear. There was no room. Airbus didn’t have this problem. The Neo is higher off the ground, so the larger engines stayed in their place. The Max, however, uniquely moved the engines forward, and as Philip says, up. This presented some unique aerodynamic challenges, which probably could have been fixed with costly, physical, aerodynamic tweaks. Instead, Boeing opted to fix the problem with software. That’s what I understood at the beginning. But then, I’m being told that the Max flies fine without the software tweaks (I’m not sure what is meant by the Max — maybe it flies fine with other software tweaks, just not MCAS); that the software tweaks were merely designed as a safety measure to make the Max feel like previous iterations of the 737; etc. It’s strange how the discussion moves and Boeing doesn’t provide any strong documentation to fix it down. To me (despite all of the smoke and red herrings) this means that Boeing tried to cheaply fix an aerodynamic problem with a 21st century software or digital solution on a 20th century plane that just couldn’t handle the new adaptation. I know the software fix can be retroactively and intelligently rationalized, but this seems obvious to me. MCAS was a cheap fix for a cheap airplane that everyone — particularly carriers in the developing world; and greedy airline executives — seemed to want. The Max still sits on the ground. EASA has yet to fly it without MCAS. The conclusion seems clear. Despite “arguments” to the contrary, the aerodynamic issues of the Max can’t be safely fixed with software.

          • Richard Davenport,

            Thanks for the link to the site about the MD80 pylon devices. It taught me a term that may be known by many here, but could be useful to me in thinking through a lot of what I’ve read: “deep stall.”

            Here is what one commentator said about it, and the principles involved sounded familiar and maybe applicable to a nose-up happy aircraft.

            “The MD-80 is somewhat unique in that instead of the above methods, it takes advantage of the air flying over the control surfaces to deflect them …

            “However, the T-tail design can result in a “deep stall” where airflow to the elevator is blocked by the wings, making a nose-down pitch change (to recover from a stall) impossible. So, the MD-80 has the ability to electrically move the elevator to the nose-down position when the control wheel is pushed fully forward to the stops. This allows breaking the stall even when minimal airflow is present at the elevator.”

            “The MD-90 accomplishes the same stall recovery by using the movable mini-elevators behind the engines.”

          • “” It’s the upward mounting of the engine on the MAX not the forward mounting of the engine. “”

            This makes so much sense, that’s why it adds, can’t separate the flow.

            That’s why it’s not a happy nose, it’s a mad nose … MadMax

          • “”” It’s the upward mounting of the engine on the MAX not the forward mounting of the engine. “”

            The much added flow from the engines is also a reason why they could easily notice the problem in the wind tunnel.
            Much more difficult to notice a problem if the flow separates only little bit but not enough.
            That’s why they are hiding. Boeing hahaha Muilenburg hahaha sure they needed to pressure their engineers to keep their mouths shut.

        • Rob, By lifting device, do you mean something like a forward mounted canard? A small wing to stall before the main wing? You have to ensure the main win doesn’t stall before the canard in these cases? These designs seem quite efficient, but, never catch on?



          • Richard, I wasn’t referring to any specific solution, just noting what the problem was and what would be required to remediate it. The center of lift would have to not move forward as much at high AoA, if an aerodynamic solution was used.

            A canard solution is moving MCAS from the back of the plane to the front. Either way, you use a control surface to counter the movement of center of lift.

            I don’t know what the aerodynamic solution would be, just pointing out what it would have to do.

    • There you go. The regulators have not rubber stamped MCAS because it does not follow established practice. It’s unique. I won’t bore people with my criticisms again, there are too many.

      Strakes can produce or defeat lift, depending on their angle to the airflow. But they are very costly on drag. If it is necessary, expect a couple of hundred nautical miles to be removed from the range.

      Returning to the regulators. The official reports are damning. I’ve never understood why many on this web-site think they can be ignored.

      Yes, we are told the new version of MCAS is better, but it takes 2-3 years to do that kind of software properly. Even then an all moving, high speed, stabiliser is necessary. As the link makes clear, it’s all chewing gum.

      If MCAS is allowed it will go to the courts.

      I was the first to suggest strakes, many moons ago

    • A bit more detail on the actual email with some attached block diagrams comparing current-in-progress design compared to the 737-NG etc
      Again, Boeing needs to come clean about the full details of the ‘happy pitch up’ situation. How serious is it, and how easily can it be fixed via a hardware fix rather than a software control system nightmare.

      • Richard, the block diagram in the email notes that the MAX is non-compliant without MCAS, but suggests that a return to the NG control design could be achieved with additional compliance flight testing. It doesn’t really say how that would be achieved, so is hard to evaluate.

        The main thrust seems to be as in the title, MCAS must be off the table, and then we see how else the MAX can be made compliant. So it’s mostly expressing a negative opinion of MCAS.

        Without having a more defined solution, this may not have much weight with the regulators or Boeing. I sense this person is frustrated because he believes strongly that MCAS is a bad solution, but that is not reflected in the broader view.

    • I’m a little confused by what the Canadian FAA manager is advocating for. His job is to certify aircraft, not suggest to Boeing how to do it? It’s up to Boeing to design the aircraft. Is he suggesting that the Canadian FAA tell Boeing to try another alternative, other than MCAS? Regulations are broadly worded to achieve results, not to focus or suggest a method of achieving them. Do we now have Boeing certifying aircraft and the regulators designing them?

      • Richard, I think he is just really unhappy with the concept of MCAS, and is hoping to draw attention to it and maybe end up with a different solution.

        He didn’t say what the solution should be, just that a better solution might be possible if we went back to the NG controls and tried again, with MCAS off the table this time.

        I’m inclined to support his right to speak up, since he feels strongly about it, but it’s difficult to evaluate whether that could practically happen or not. I just don’t know.

      • Richard,

        Boeing thinks that MCAS2.0 is safe now and said that a failure would never happen again. Same as the TAB. The Technical Advisory Board presented its preliminary report to the FAA, finding that the MCAS design changes are compliant with the regulations and safe.

        But Deckard, who is a software engineer, mentioned in one of the first comments here that MCAS2.0 can still reset itself again and again and he came to the conclusion that if MCAS is not really needed it is better to keep it out. Same as the engineering manager in aircraft integration and safety assessment at Transport Canada.

        Boeing rushed MCAS2.0 again, saying it’s safe when it is NOT.

        • “Boeing thinks that MCAS2.0 is safe now ”
          False interpretation.
          We don’t really know what Boeing thinks or knows.

          What they hand out publicly is that “MCAS2.0 is to be taken as safe now .. “

          • “” We don’t really know what Boeing thinks or knows. “”

            This is a game, with different players and everyone thinks to be in control, but as it always is, most players lose because only one can win, player A wins, but player B has completely different intentions “B” and wins game B, player B doesn’t know what kind of game player A is playing but obviously they are both on the same side and player A knows this, there are other players, easily to be played, only small wheels, but important to let this machinery work, machinery “A”, hard for player C to play against A and B, but player C has his own machinery working, player C wants to keep control, or should I say con-troll, putting some trolls into the game …
            to be continued
            Fear the MadMax

    • Why doesn’t Boeing change from the MCAS system controlling pitch, to simply a change in the current Elevator Feel Computer system? That would just apply additional control force to the column. If an AOA failed, it would only apply different stick forces to the column. The pilot would be fighting with the column control, but, you could at least control the fight with a limited amount of column force. That seems like a solution to comply with the stick force requirements of the FAR’s and get rid of the dangers of MCAS. Why hasn’t this been proposed before, or even originally? MCAS seems like the wrong solution to the pitch force problem. Unless it’s not the problem MCAS is trying to fix.

        • I suspect they need a good greasing.

          I want it noted I was the first one to suggest this.

          • TransWorld,

            didn’t you say Jack The Screw is in total control

    • Why is MCAS using control surfaces to change stick force? Why not simply use the current Elevator Feel Computer system? You can control how much force is applied to the column, and allows the pilot to maintain control of the aircraft. If an AOA fails, then the pilot would just have to pull harder until he figures out the AOA had failed. The plane wouldn’t get have the danger of getting dangerously out of trim. Why didn’t Boeing do this in the first place and why aren’t they doing this now? Rip out MCAS and put in a change to the Elevator Feel Computer system. It doesn’t make sense to use the Stabilizer as a column force augmenter. Use the current Elevator Feel Computer. That’s what it’s there for. What am I missing?

      • Richard, the elevator force system is there mainly to compensate for the effects of airspeed. There is not an issue of under-control for that circumstance. In fact the reverse is true, there is a risk of over-control if the elevator forces are not represented correctly.

        For the high AoA case there is the opposite risk, that of under-control which the pilot might not sense. If you mask the under-control with the elevator feel system, that makes it more likely that the pilot would not respond correctly. On the other hand if you make the aircraft more controllable by adding AND forces, which the pilot also senses, that is making it more likely that the pilot will respond correctly.

        If you have FBW like Airbus, you don’t care whether the pilot responds correctly or not. You just ignore the inputs that are incorrect, the computers will not fly the aircraft into hazardous maneuvers.

        In the Boeing system, since the pilot has full authority, there are regulatory requirements to present behavior correctly and maintain controllability to help keep out of trouble.

      • Richard, the elevator feel system is mostly there to compensate for airspeed. It corrects for the possibility of over-control, if the forces on the elevator are not correctly represented to the pilot. The aircraft control authority is increasing for that situation. The elevator feel system lessens the chance of an upset.

        In the high A0A situation, the risk is under-control. The aircraft control authority is decreasing. If the elevator feel system were to mask this for the pilot, the possibility of an upset increases.

        By using aircraft control forces to compensate, MCAS was intended to lessen the chance of an upset by aiding the pilot in a potential under-control situation. The elevator feel system could not accomplish this.

        • Rob, So, you think MCAS is there as a stall avoidance system? Then a control column stick pusher system rather than a column force increase would be needed. In that case, they should have known the MCAS hazard assessment would be much greater than they stated and why Boeing does not want to refer to MCAS as a stall avoidance system.

          • Richard, there is still confusion here. Stall avoidance systems use the elevator as the pilot would or should, they are intended to override the pilot.

            MCAS was never designed to do that. It was designed to help the pilot deal with the high AoA situation where control authority begins to diminish due to an accelerated non-linear pitch tendency. It brings the behavior of the controls in line with the regulations, and in so doing decreases the probability of a stall occurring. For that reason, it uses the stabilizer instead of the elevator.

            You could think of it in terms of a safety response rather than an emergency response. Safe operation should help to avoid emergencies, but the emergency is not the sole or primary motivation for safe operation.

  13. Why can’t we just get rid of MCAS? If nose happyness at the extremes of the flight envelope is unlikely to cause a crash even without extra training, what’s the point? Boeing are not shy about asking for a waver,why didn’t they do so, particularly after it had clearly caused a crash?
    Pilot error, if pilots can’t cope with it, then it’s wrong.

    • Only Boeing knows how happy the nose is or if it is crazy or mad.
      That’s why EASA wants flight testing without MCAS.
      Since Boeing is hiding for over a year and lost billions on the way you have to assume the worst.
      Not good for the million of pilots who would fly the MAX. Regulators won’t allow a calculated crash.

    • If Boeing decides to rip out MCAS, then, they certainly would be required at this point, to fully describe the ‘happy pitch up’ characteristics of the 737-MAX in detail. Maybe, it was over reaction by test pilots originally, but, it needs to be fully described now, to the world, to see if it needs further changes to the aircraft or can be written off as such a rare event and recoverable with current control systems as to be waivered by regulators.

    • Beside MCAS there are also other parts of concern. Boeing made stabilizers stronger without completely reengineering it. Rushed things careless. Not a problem, it’s cheap to pay for victims.

      What else did they change and isn’t uncovered yet.

    • Grubbie, right now MCAS (or an alternative solution) is required by the regulations. The aircraft must maintain certain handling characteristics throughout the flight envelope.

      As far as pilots not coping with MCAS, some did and some did not. Looking objectively at the reports, it’s clear that pilot error was a part of the accident chain. That doesn’t absolve Boeing at all, it’s just a statement of fact.

      It’s a shame that people have tried to polarize the crashes, as either being all Boeing’s fault, or all the pilot’s fault. Neither view is correct. The truth is that all the elements noted in the reports were factors, so they all should be considered.

      • Did the pilot flying jump seat in the flight before the accident just delay the crash by a day? If he wasn’t sitting in the jump seat, with a good view of the stabilizer wheel spinning away, would the accident have happened a flight earlier with just a 2 man crew? If the pilots in the Etheopean crash were able to figure out that the Left AOA was bad from all of the lights and buzzers going off, then why wasn’t the FCC able to figure it out? Was it the added sensors of humans (eyes out the window, etc) that brought them to the correct result, or should the FCC have been able to figure it out form the lights and buzzers? If you want the FCC to take ultimate control of the flight surfaces, it had better be as smart, or smarter than the human pilots and as reliable. I think one can argue that Airbus control systems are close to being as correct and reliable as a human interpreting the instruments. MCAS is not.

        • MCAS was never intended to be a FBW system, or to take control of the aircraft. It’s behavior was the result of incorrect input along with a bad design and implementation.

          MCAS deflected the horizontal stabilizer in a manner that was unbounded, without correct AoA data or pilot counteraction. We know that counteraction was possible because the captain of Lion Air did it successfully.

          Pilots were placed in an adverse situation by these failures. We know from human factors that people are more likely to make mistakes in adverse situations. So mistakes are not unexpected, nor should we be harsh or critical that they occurred. But they did occur, and to not acknowledge that or learn from it, is pointless, no matter how angry at Boeing we are.

          We have independent investigation boards so as to take the emotion out of it, and learn what we can from whatever happened. There is a lot to learn here, if we can be honest and objective.

          • Rob, I’m asking the question objectively. If Boeing thinks MCAS is smart enough, and reliable enough, to pitch the plane via the Horizontal Stabilizer by itself, not depending on dumb pilots to see an angle of attack indicator, and have them take the appropriate action. Then why not have the same smart MCAS take appropriate action (turn itself off), as per the Emergency Airworthiness Directive issued after the Lion Air crash, using the runaway stab trim procedure?
            “in the event of uncommanded Horizontal Stabilizer trim movement combined with any of the following… yada yada yada.. The flight crew must comply with the runaway trim stabilizer” Why doesn’t Boing simply have MCAS take that same action, switch of turning itself off, and saying “MCAS tripped off, the pilots are now in control via the manual electric trim switch” as the A/P does currently when it’s confused. Shouldn’t that be the the programming rules that MCAS should be programmed by? Why are we having an automated system take over, and then depending on pilots to diagnose the problem, remember / read a procedure to turn it off. Why can’t we have MCAS know that it’s sick when it’s running more than once and one or more of those listed conditions are happening. We’re commanding the pilots via an Emergency AD to do what MCAS should be doing. It’s able to spin the trim wheel faster than the pilots. But, we’re commanding the pilots to try and take control after MCAS has forced the trim wheel out of the normal range, and shut down their Manual Electric Trim, leaving them literally stuck with the stuck manual trim wheel. If MCAS is smart enough and reliable enough to fly the Stabilizer then it should be smart enough and reliable enough to stop itself and return control to the pilots. There should be the same standard applied.

          • Richard, for any system there is the possibility of malfunction. We can always think of new ways to modify the system to avoid malfunctions, but those also introduce new modes of malfunction. We can add backups for the backups for the backups, ad infinitum.

            For better or worse, we rely on pilots to be the final backup systems, because humans are highly adaptable learning machines. Otherwise we don’t need pilots any longer, we could just use automation as others have suggested here.

            However from human factors we know that humans are not infallible either. But they are the most well-suited for unpredictable situations, hence we still rely on them.

            There is no such thing as zero risk. Accidents still happen, and will continue to happen, but the trend is that we are getting better at managing the risk. Pilots being in the cockpit are still a big part of that management, so their role has to be examined carefully, no differently than any other systems we use.

            As far as what MCAS should or shouldn’t have done, we have been over and over and over that so many times, that I don’t know what else to say. No one disagrees with you that it could and should have been done better, and that it was a major contributing factor to the accidents.

          • @RD,
            Interesting questions. But you are describing more of a fly by wire system with computers in control. From what I’ve read, such systems have an incredible level of redundancy for the computers to instantly check and cross check their decisions. In looking at the 787, for instance, I think there are at least three different separate and distinct computers with three different processing chips. Again, for me this is a serious narrative question. It’s the narrative of the hero and heroic action. It’s a plot device, where everything rotates around that one point of action and heroic success. So, there’s the heroic pilot — who through seat of the pants flying saves the airplane, John Wayne style. But in reality, the hero that saved the previous Lyon air flight was the third person in the jump seat. No, it wasn’t. It wasn’t a single point. It was the combination of three pilots cross checking each other’s judgments — redundancy. Even Sully interacted with a true fly by wire system, with multiple levels of redundancy, and then double checked his most significant decisions with a seasoned first officer. In the Quantas 47 flight, the first decision made by the Top Gun, navy fighter pilot captain was to request that the seasoned first officer be returned to the cockpit from his break. The problem is that Boeing plans to jerry rig a system in the Max with its two flight control computers that would double check each other — but this is not how such systems are designed form the ground up. And from previous discussions on this sight from people who seem to have knowledge of the reasoning behind true fail-safe redundancy; this is a very complicated endeavor that cannot be reduced to the heroics of Victorian melodrama. One hero, one system cannot save the day. In the digital age, it is more like “Her” of the science fiction film. The film has a hero, Joaquin Phoenix, but (spoiler alert), we learn that the deep, touching, and profound relationship rendered in the film is just one of thousands carried on by the AI system, whose voice is that of Scarlett Johansson. He’s not that important — to Her.

            So, this is where we live. We are looking for the easy heroes and villains of a Victorian melodrama in a very complex system. There can be no simple point of failure or heroic success. Still, I blame Boeing for trying to get off cheap and introducing into the modern world of aviation a system with feeble redundancy that could be brought down by a single point of failure — or required, at least, three pilots in the cockpit to succeed as its heroes.

          • @Rob,

            It may (for sure) be a rerun, – but – I once learned: ‘in technology nothing is 100 percent’ (safe).

            If you bring humans in the ‘equation’. you move (far) away from the one hundred percent. Proof? Where I live, car drivers collide with moose hundreds of times every winter. All/Most drivers know – from signs and warnings – that they are on a dangerous stretch. But the accident rate stays put. It is as simple as that.

          • Svein, it’s basically a trade-off. Automation has high repeatability and doesn’t have human failings such as fatigue and distraction.

            Humans have low repeatability and have many other failings not present in automation, but vastly surpass automation in being able to recognize and adapt to new situations.

            So high-quality human-machine interfaces seek to optimize the strengths and minimize the weaknesses of both elements.

            We can benefit from both, and we should invest in improving the capabilities of both, while recognizing that they are fundamentally different.

            In the case of these accidents, both elements failed, and failure of both was required for the accidents to occur. Additionally the interaction between human and automation was a contributing factor. So we should be concerned about that, and examine all elements closely.

            As I’ve said many times, the polarization of “bad automation/MCAS/MAX/Boeing” and “bad human/pilot” doesn’t really get us anywhere.

          • If pilots are blamed then this falls back to Boeing and the FAA for not implementing the needed training, and Boeing was the FAA.

            Of course an ONE hour ipad training was the seller and that’s biting their faces now.
            Lost billions and keep losing.
            Lost all reputation and trust.
            Lost the chance to cheat and hide behind FAA and politics.

            Announcing RTS again and again new … how foolish … they will have to pay for every MadMax they produce.

          • Rob, Why not have the high AOA alert not trigger MCAS to move the stabilizer, with all of the associated dangers, but, simply have the high AOA alert, feed the Elevator feel computer, so that you can ensure the pilot can overpower “MCAS” at all times, and the trim runaway situation vaporizes for an AOA failure via “MCAS”. In that case, it would just offer a sudden increase in column feedback that the pilot would simply overcome with more force. This should satisfy the FAR’s for pitch gradient force feedback, be more safe, and have the pilot in full control. Of course, you’d need more training for the pilots, but, that may be cheaper than the current alternatives Boeing is looking at for 5000 aircraft.

          • Richard, I answered in your other thread on this issue. Might want to re-read that.

            The elevator feel system adds force to the column to represent the increased elevator forces due to increasing airspeed. Control authority is plentiful and increasing in that case, and this must be communicated to the pilot, to avoid over-controlling the aircraft.

            In high AoA, you have the opposite problem. Control authority is diminishing and the risk is that the pilot will under-control, or not have the authority needed if the AoA continues the upward trend.

            You can represent and address excess control authority by adding force to the column. You cannot represent or address lack of control authority by subtracting column force (or adding it). You have to compensate for the behavior of the aircraft, which is what MCAS tries to do.

            If you responded to a mushing column by artificially increasing force with elevator feel, that would encourage a loss of control by masking the impending danger from the pilot. That’s the opposite of what you want to do in that situation.

          • What I’ve learned from this forum, is that there is nothing mysterious about building robust, fail safe systems. It takes time, money and knowledge, but it is possible. Unfortunately, it becomes problematic if you are trying hastily to cut corners and jerry-rig a robust system over a much older system that was grandfathered and not built to modern standards. There is a lot of anti-intellectual information out there in the world right now, but as many have said, flying is the safest it’s ever been. Computers and computer systems are really good, and engineers know what they are doing — if they are not forced to justify, rationalize and execute stupid sh*t by incompetent and greedy corporate executives who lost sight of the mission of their company.

          • MCAS was not unbounded. It appears that way because the pilot (human) reset the system with manual trim inputs that did not fully counter what MCAS did. (thus progressively getting farther out of trim)

            Boeing borked the reset logic by assuming the pilots would trim to neutral state if they trimmed at all. That is being corrected in v2, so the AoA input has to return below trigger point to reset.

            One aspect not covered much is the loss of elevator authority at high speed (more an issue with the 2nd crash I think). While below VMO, the elevator can counter full AND trim, at higher speeds it can’t.

    • Good question. The answer:

      If MCAS addresses a “minor” hazard then MCAS can go. Yes, it needs training to address a “happy nose”. But who cares. So get rid of MCAS. Job done.

      It’s much more serious than a “happy nose”. So it’s much more serious than a “minor” hazard. I don’t think the MAX will pass regulations on pitch up tendency never mind stall tendency.

      Sorry Bjorn, the official reports need to be addressed. They are beyond damning. I don’t like disagreeing with you. But, I have no choice.

      • Philip,is there more specific data than you think in some of Bjorns corners? I wonder.

        • Where? There is no information about the pitch up tendency, as far as I’m aware. I can only go on what the official reports say. Unfortunately they leave open the question, proposing that tests are carried out.

        • To add. Bjorn says no big deal. I’ve often said I don’t care if it’s in the pre-stall region. I really don’t.

          Switch the bloody think off and let the pilots fly the airplane, has been my opinion for a very long time. It doesn’t even need strakes. But, the condition is that the hazard is “minor”.

          Unfortunately neither official report backs Boeing. They leave the question entirely open. It’s the most important question. EASA want to perform independent verification!

  14. I’m wondering to what extent over-zealous regulations have contributed to the problem. In other words, if these particular regulations had not existed, my best guess is that Boeing would not have implemented MCAS. I’m wondering what the likelihood of accidents would have been without it.

    Have regulations led to adding a relatively complex system with its attendant failure risks, only to reduce another risk that is small in the first place?

    Sure, there are several other contributing causes, most gravely those created by Boeing, but I think we should look at all contributing factors.

    To say it very pointedly, have bad regulations killed people?

    • I’ve thought about that too, but I think a reasonable premise of the regulations is that systems will be designed and operated safely. That did not happen in the case of MCAS.

      I’ve read some articles that suggest as aircraft become more complex, it will be difficult to test every combination of potential failures. So we will always have fixes that arise from in-flight incidents. But in the long run, safety is increasing so the complexity does have dividends with regard to safety.

      • Rob,
        This thinking about complex systems may apply to contemporary modern designs, to the Neo or to the 787. But the Max is a 50 year old aircraft that was poorly updated. I’m just not sure that this thinking applies. We should be thinking more about the decision process, grandfathering, share buy-backs, discounts, competition, etc. rather than state-of-the-art, complex systems, which this definitely wasn’t.

        • RealSteve, the established record is that 737 safety has increased steadily along with the rest of the aviation industry, including newer and older designs. This has largely been due to automation and technology. The 737 has not been exempt from that or left behind.

          There’s no doubt that newer designs are superior, but that does not automatically imply that older designs are unsafe. That’s not reflected in the record at all.

          • Rob, I was responding to the logic of your phrase “as aircraft become more complex.” I wasn’t saying anything about the increased safety of the 737. Instead, I was thinking that the issue in this particular case wasn’t normal “increasing” technological complexity, but simple short-sighted cost cutting.

        • RealSteve,

          of course. In 2015 an engineer questioned a single failure AoA sensor activating McAss. But safety was not a priority, intentions were completely different. Boeing was in a hurry because of the NEO, pressure was put on engineers not to report problems. Information wasn’t shared, engineers were kept in small groups. Some engineers were replaced. Some systems which were planned to introduce were simply cut because of $$$. It’s cheap to pay victims and mostly nothing has to be paid, only needed is to blame the pilots, this always worked.
          This culture was already going on for many years, Boeing, through politics, became the FAA, getting exceptions from regulations and kept it secret.
          Even with all this cheating Boeing was not competitive.
          Still no end in sight with MadMax, Boeing is digging the hole deeper. This is EPIC.

    • I think if a new airplane design comes up with a solution that breaks a regulation, but, the manufacture deems safe, they would ask for a waiver from the regulation by the authorities. The regulations aren’t set in stone. There are procedures for requesting deviations. But, Boeing hasn’t asked for a waiver, as far as I know. The 737 has been ‘grandfathered’ via their original type certificate, avoiding a lot of current regulations for years. I think that needs to be looked at. We really do need Boeing to show and tell the details of the ‘happy nose’ issue. I”m quite surprised more details on the MCAS logic wasn’t in the Lion Air accident report. MCAS does encompass more than one problem to solve. Originally, it was in the high Mach area, with low speed trim operating the Stabilizer. But, then a low speed extension was added. This is the one that has drawn all of the attention. Some of the discussions about the reason for MCAS has not differentiated between the two separate software solutions. They were developed for two independent issues/events.

    • No it’s not, incompetent pilots are constantly being rescued by clever aeroplanes. When the air tanker fool managed to get his camera stuck between his seat and the side stick, the aircrafts software saved the day.

  15. This article concerns me. Bjorn states the “737 MAX works without MCAS”; the “bottom line is, you don’t need MCAS to fly the 737 MAX”; and “the base aircraft has deficiencies, like most airliners, but it’s not a fundamentally dangerous aircraft.”

    If this is the case, why didn’t Boeing toss EASA (and any one else who asked) the keys to an MCAS-free Max and let them take it out for a spin?

    Why has the plane been grounded all of this time?

    I’m afraid that this article is indicative of something serious. Boeing is provably not going to provide more information about the 737 Max freely and most of what we will learn will be based on argument and conjecture where engineers and experts testify in court on behalf of their clients like advocates.

    • Bjorn, this is the first time I address you personally. I fully concur with Realsteve. I trust you capabilities fully. I trust you did a proper analysis and given your experience that your analysis is close as to the truth as it can be. But WHY, WHY, if it is that simple, did Boeing not come out with this story themselves. I am not a pilot. I am not an engineer. But I did loads of studies in tense situations between industry and society on the environment. I made it to be a reputable professor in my field. My studies influenced investment decisions on 100 millions of dollars. That is a fraction of the 200 billion $ stock market value of Boeing or the 300 billion dollars of value of the 5000 Max sales. Even in my situation I saw tense pressures on me personally, fake news, attempts to frame or yes, bend the truth towards what was of interest in the people whose millions were at stake. This situation is not at all different. But I cannot accept that the world has to live with inferences (how good they can be) rather than an impartial checked truth by FAA and EASA. Boeing MUST come out themselves with a clear statement for which corners of the flight envelope MCAS was needed and aviation authorities MUST have done an impartial check if this is indeed in such rare situations as now suggested.

      • An interview with Boeing Test Pilot, Ed Wilson and his co-pilot would be a good place to start.
        But a few weeks later, Mr. Wilson and his co-pilot began noticing that something was off, according to a person with direct knowledge of the flights. The Max wasn’t handling well when nearing stalls at low speeds.

        In a meeting at Boeing Field in Seattle, Mr. Wilson told engineers that the issue would need to be fixed. He and his co-pilot proposed MCAS, the person said.

        The change didn’t elicit much debate in the group, which included just a handful of people. It was considered “a run-of-the-mill adjustment,” according to the person. Instead, the group mostly discussed the logistics of how MCAS would be used in the new scenarios.

    • If EASA wants to remove the regulations for handling characteristics at high AoA, or grant the MAX an exemption, that is within their power. Then Boeing could do as you suggest.

      The MAX is grounded because the regulators grounded it. They could have alternatively required MCAS to be deactivated, but this would also require an exemption.

      I think we can guess from this that the regulations are not going to be relaxed or exempted. If that happened, there would be a huge public outcry. They cannot respond to loss of life by loosening safety.

      Bjorn is just pointing out that MCAS is unlikely to be needed in normal flying, so neither the presence nor absence of MCAS affects the inherent stability of the MAX in normal flight. There is nothing sinister in this statement or the article, it’s just a statement of fact.

      As far as Boeing releasing trade information to the general public, it’s unlikely they will do that due to liability and propriety. The NTSB rules and the Trade Secrets Act are examples of how parties to an investigation can request confidential status for the information they provide (they cannot refuse to provide the information itself). Even FOIA requests have an exemption for confidentiality.

      Also safety-related data that the party may independently compile, is considered confidential by default, as it would be a gold mine for litigation, yet is vital to investigation.

      The public and other interested parties can challenge this confidentiality in court, and it is sometimes overturned. But in general there is no mechanism for it to be breached by public request. So we have to rely on the official investigators and regulators to be vigilant for us, they do have access to all the data.

      • “Lossening safety”, but it’s actually not,is it? In fact, reading Bjorns words, one can only come to the conclusion that by obeying the regulations to the letter Boeing inadvertently caused 2 needless accidents.Things are not always logical.

        • I think the regulations presume that safe systems will be designed and implemented for compliance.

          In this case a system was proposed to comply with one safety requirement, but poor design, implementation and operation caused another huge safety problem, and large loss of life.

          But I don’t think you can blame the regulation for that. MCAS could and should have been done properly the first time.

          The regulation is not fundamentally wrong, many other aircraft safely comply with it. So the fault doesn’t lie within it.

      • I’m not sure there are that many airplane manufacturers looking to update 50 year old air frames out there who might be curious about the “trade information” or company secrets that went into the making of the Max. I’m not sure any aircraft accident story — involving two new airplanes that crashed within months of each other — has had to rely on so much conjecture.

        • Boeing has a legal obligation to be forthcoming with regulators and investigators, that is established when they become a party to the inquiries. To the best of my knowledge they have done that, I have heard no complaints from those responsible, that Boeing has not cooperated.

          Boeing has no obligation to release information to the members of this forum, or the general public. Nor are most of us in this forum qualified to analyze it, even if they did.

          We all have an interest in this and are trying to understand as best we can. But there is a reason that only experts are primarily involved. Those experts have a duty to release their findings when complete.

          In the meantime, Boeing is mandated to work only with those experts, in their role as a participating party. They cannot release information or comment separately.

          You may recall that Elon Musk tweeted about Tesla accidents and got kicked out of the investigations. The investigators don’t want to be competing with an alternative narrative, there is only one official set of findings.

          • Rob, If the FAA came out tomorrow, and said we were wrong in our original assessment to ground the MAX. We’re re-certifying the old MCAS version of the MAX to fly again. It was all an issue with the AOA sensors, and we’ve closed the bad AOA sensor company. Would Airlines then pull their planes out of moth balls, wash them off, schedule their pilots to fly them? Would the pilots hesitate at all in flying them? Would passengers step aboard them without any fear? I think if/when the FAA re-certifies the MAX, everyone will want to have data to decide for themselves. After seeing how political and close the FAA is to Boeing. How they were the last to ground the MAX, after two crashes, saying we need to wait to see more data in order to ground the MAX. I don’t think a lot of folks will be following the experts decisions, especially if the data is kept secret. I don’t see how Boeing can’t release the data. If they don’t and another plane crashes for whatever reason, they are toast.

          • It’s very hard to be patient when one hears talk of corporations not having obligations to “members of this forum.” When huge corporations take on the functions of government, they certainly have obligations to the demos. When it becomes impossible to disentangle the corporation from the FAA — who work for us, they have obligations. When they get huge tax breaks, they have obligations. When they employ tens of thousands of workers, may one day be due for a federal buyout and are simply too big to fail, they have obligations. And when I step on an aircraft with the trust that they have done everything in their capacity to make it as safe as is humanly possible, they have an obligation to be open about the process leading to two brand new airplanes killing nearly 350 in accidents within a few months of each other. What the hell? Throughout the US and the world, we violate people’s privacy and imprison them for minor infractions all the time. Why would the corporate standard not be even higher when the lives of hundreds of thousands of people are at stake? To be honest, these particular accidents seem like outliers. Usually, all of the dynamics and issues leading to the cause are known fairly quickly and the airplane corporation, the regulators and the investigators are open with information. I’ve never in my lifetime seen an airplane company look so culpable of incompetence and wrong-doing and regulators — worldwide — have so many fundamental and unanswered questions while being openly critical. It makes no sense that the public who might end up flying one of these planes that Boeing is desperately trying to re-certify, will have no idea how aerodynamically sound the fundamental structure of the 737 Max is — even if they don’t understand it. What will happen if one crashes again?

          • Richard, I think most people will accept the decision either way, trusting in the experts. You don’t see a public clamor to either get the MAX flying or to keep it grounded. People are waiting for the reviews to be completed and published, which is a reasonable stance.

            The FAA was commended by the chair of JATR, for looking at the data before making their grounding decision. It’s vitally important that decisions be factually based. Once they saw the grounding had a factual basis, they acted.

            You are convinced that only you can decide if the MAX is safe to fly, therefore you have to see all the data. You’re free to make that decision for yourself, but not for everyone else. I’m sure that many people will refuse to fly the MAX, you may be one of them, and that’s perfectly fine. No one is being forced.

            I’m with Bjorn, I would not hesitate to fly once I see that it has passed certification. My personal understanding is not great enough for me to make a certification decision. But it’s enough to see that the process has been fair and reasonable, and should therefore have a good outcome.

          • “” What will happen if one crashes again? “”


            another crash would make sense to me.

          • Rob,
            You said “I’m with Bjorn, I would not hesitate to fly once I see that it has passed certification.” Of course Bjorn wouldn’t hesitate — he’s a test pilot. He’s flown all kinds of contraptions I would stay away from and not expect to ferry me somewhere for work or a vacation. And I’m sure the flight attendants, who constantly tempt chance and statistics on airliners might feel differently and have said as much.

          • Rob,
            Trust the experts? Boeings experts kept MCAS a secret. Then after the first crash, they came forward with this secret system, told the FAA that they forgot to mention a small change in power for the MCAS speed, but, since it was a minor hazard, didn’t update the paperwork. They also didn’t feel it necessary to fix the aoa-disagree light, because again, it was a minor hazard. Just issue an Emergency AD about the trim runaway procedure and things will be fine. Then, after the second crash, they said the plane doesn’t need to be grounded, we need more test data to verify that the plane really has a problem? Now, you want us to trust those same experts with their secret problem, and their secret software solution, to have the situation well in hand? Their credibility is zero. I want published proof. They can keep things secret and see how many people trust them. I”m a cynical old man.

          • Richard, you and others here are extremely angry at Boeing, and no facts that I present are going to change that. Only you can change it.

            When I said experts, I was referring to the world-wide agencies that are looking at this. The FAA rightly opened up the process to everyone who wanted to participate. No one has been excluded, no one has been denied access to information, no one has been denied the right to speak. This is why the process has gone on for 8 months. I fully support that, inclusiveness is a key value in this process, it’s the only way to build trust. So the process should go on as long as is needed.

            I don’t think you are being asked to trust solely in Boeing, or solely in the FAA here. A great many people, with more knowledge and experience than us, are looking at this. But just like us, there is bound to be some dissent. We can be inclusive of that as well, and try to weigh it to see if the conclusion of the majority is reasonable.

            In that weighing process, though, we have to be factual. See which facts support the view and which don’t, then evaluate and draw a conclusion. The thing we don’t want to do, is start with a conclusion and then accept only those facts which support it.

            Ironically, that is the same process that led Boeing to the MCAS malfunctions. They considered only the facts that supported their safety classification. Had they looked at the other side, through fault analysis, they would have found the issues. So you always have to be willing to look at the other side.

            I think right now, based on comments by you and RealSteve and Leon, looking at the other side, or giving any credit to Boeing at all, is extremely difficult for you. I get that, I really do. Humans are emotional beings that are strongly driven by values. Boeing actions have violated many of our core values, as you guys rightly point out.

            The key difference between us, though, is that I see errors of knowledge, where you guys see errors of intent. An error of knowledge means that correct values were in place, but insufficient knowledge was developed and mistakes were made. An error of intent means that insufficient values were in place to make a moral decision, without regard for the potential consequences. Put very simply, this is “didn’t know” vs “didn’t care”.

            If there were errors of knowledge, those can be corrected for the future, and that is my goal. If there were errors of intent, that would be a criminal matter. I know that is being looked at as well.

            I honestly don’t believe that Boeing set out to kill people, or disregarded loss of life. Certainly they have a very long record of doing the opposite. I think they made mistakes for the typical reasons that people do. But I realize that some of you may feel differently. I would only ask that we try to be factual in whatever we say here.

          • Rob, There’s only been a few test pilots that have ever flown a ‘naked’ (sans MCAS) 737-MAX. Even fewer have flown a ‘naked’ 737-MAX testing out close to stall characteristics. I”d bet you could count them on one hand. There wasn’t any information in the Lion Air Accident report on it because the plane wasn’t being stalled in the accident. During FAA certification flights, I’m not sure if they would fly ‘naked’ for any demonstrations? When it came time to show a stall type situation, the FAA would see the trim wheel turning and how the plane responded, but, since it wasn’t a ‘stall prevention’ device, and was labeled with a low hazard rating, I wonder if the FAA knew how a ‘naked’ 737-MAX flew? Or, how important MCAS was in close to stall conditions? If they did, then I’d assume they would have questioned the hazard rating on such a system. Will EASA require a demonstration or data on how a ‘naked’ 737-MAX flys in different W&B conditions? I’d like to know how a ‘naked’ 737-MAX handles. I would think you would also? I’m guessing MCAS is needed, and is critical for flight, as there is currently no “OFF” switch.
            I’d like to see the facts. If the function of MCAS is needed, then it needs to be certified to the standards of FBW. Or, a hardware fix to tame the problem. I can’t see Boeing trying to say the close to stall pitch up characteristics are a trade secret and need to be hidden from competitors. We’ll see what transpires. .

          • Richard, I assume that when the test pilots flew the unaltered MAX and said it would not meet regulations without enhancement, they were credible and believed, and the flight data backed them up.

            If regulators want to see that data now, that shouldn’t be a problem. If they want to fly the MAX with MCAS disabled, again that shouldn’t be a problem. As far as I know, these things are being done for the EASA.

            If the regulators also want to see the design decision data as to why MCAS was chosen and what other solutions were tried, again that shouldn’t be a problem. Boeing should be forthcoming with the details.

            The thing is, though, that Boeing is unlikely to release that information to the public. I know that frustrates you, but the regulators and investigators act as our proxies. They balance the requirements of the law to protect both public and private interests.

            If those two come into conflict, for example if a problem is discovered in a confidential system that compromises public safety, then the law requires it to be published in the findings. All significant findings must be published.

            I have read enough such reports to have confidence that this is being carried out. The process is not perfect, I’m sure. You don’t have the same confidence, but I don’t know what the solution to that is.

            You can’t legally demand that Boeing release the data. It can be obtained in discovery during legal proceedings, or it can be released as a significant safety or accident finding, or it can be reported by journalists off the record, or it can be leaked by someone. Otherwise, it’s theirs.

          • Rob, you claimed “Boeing has a legal obligation to be forthcoming with regulators and investigators, that is established when they become a party to the inquiries”. But as others noted they did not come out with full info on MCAS in the first place, not even to FAA. And there have been reports in the media that regulators were frustrated with the information, or lack of that, that Boeing supplied to them. Which led to sending Boeing back for more information and creating a delay in recertification. Even if Boeing is not obliged to disclose information to us in the outside world, they should understand big time they have a major public credibility problem. This can only be solved by honest public pitches, rather than producing spin that appears be untrue or at least have questionable truth value when more facts become available over time. They simply leave the impression they are in a position that they have no option but to push a square block into a too small, round hole – and for that reason cannot provide a simple, truthful elevator (no pun intended…) pitch of what the problem was and how they want to solve it. They promised ‘no pilot training’ to airlines, apparently with high penalties if this would turn out to be otherwise. They promised that the NG and MAX have the same type rating and pilots can move from one to another in their daily schedule if needs be. They need maximum production commonality to keep the price of the MAX low. Now, with MCAS 1.0 a complete failure, they need an alternative software solution – any hardware solution will imply massive additional costs for the 100s of produced and grounded MAXes and the >4000 still to be produced. I wouldn’t be surprised if Boeing is in the following corner – MCAS was, as Bjorn suggests, only needed in corners of the flight envelope you rarely reach, and that pilot action (and hence training) can also solve such situations. But also, I would not be surprised that by relying on pilot action they formally would not comply with some certification rule in such extreme cases. Which would imply asking for an exception of this certification rule. Try to explain this publicly as Boeing after the mess, including the PR mess, you have created. As I indicated earlier, this is all guesswork from my side. But the world cannot live with guesswork here, and therefore Boeing must come out with the story. To the regulators in the first place, but to the public as well. There is a reason why things stay hidden for the public, and that reason probably is a nasty one. If it was easy, Boeing would have told in an effort to get their PR position right and regain credibility.

          • AtFlyer, if Boeing has not been forthcoming with regulators or investigators, they have legal remedies to address that. We, as members of the public, do not. We can demand the release of data but the law doesn’t require it. Those are the facts.

            I also think there is value in applying education and experience to the interpretation of that data. Our agencies can do that for us, the majority of the public cannot. The majority of the press cannot. I couldn’t either, to be honest. I’m glad there are people working at those agencies that can.

            The FAA opened the process to the world, but only to qualified agencies, not to the general public. There’s a reason for that. I think the reviewing base is as broad as it could be, in terms of qualified people, with a wealth and range of viewpoints.

            Broadening it further, to unqualified people, would not improve the quality of the process, and might detract from it if unqualified views are elevated to the same level of discussion. They would add mostly noise to the signal-to-noise ratio.

            When it comes to what happened in the accidents, and issues at Boeing or elsewhere that contributed, those should become part of the public record, and I have confidence that they will. The JATR report was extremely thorough in documenting mistakes made at Boeing. We need that but we have to recognize that we ourselves may not be the best choice to do it.

          • attflyer, I agree that Boeing is digging themselves a hole by not being forthcoming with a better description of the problem. But, I don’t agree that it’s a small issue. They are using 10 seconds of high pitch speed on the stabilizer. That’s a big change. That’s not the way speed trim works at low airspeed. Why they need such a counter force, and where they need it must be in the AOA trigger settings, and the stick force vs AOA data etc. They may not be legally obligated to release the data, but, in the court of public opinion, I think they are losing badly by hiring more Lawyers than Engineers. They also are not doing themselves any favors as the rest of the world looks on. We already see EASA and other regulators saying they won’t follow the FAA blindly on the 777X etc. The FAA says they are the ones making the certification decisions, not Boeing, but, the FAA Designated Reps, still report to Boeing, not the FAA. I thought originally a software fix was in the works, and being tested out, and that was why Boeing wasn’t being forthcoming. They wanted to get it right and then announce the results. But, with them now saying they are asking the FAA for review, and not telling anyone else, I”m more convinced there are outstanding issues, that may technically pass the current FAR’s but, not be as safe as a 737-NG or Airbus 320. Can the FAA, if they have safety concerns and Boeing isn’t willing to address them, NOT certify the plane until Boeing addresses them? Or, can Boeing say, our MAX passes all of the your current FAR’s so you must certify? Who’s the referee if that’s the case?

          • atflyer / Rob, I’d also like to know if the Technical Advisory Boards (the group of NASA, Air Force, and other technical experts) full report will be issued to the FAA, Congress and the public, or will that be marked a State Secret also. Has anyone else known an aircraft company to be so secretive about a new aircraft system (outside of the Military)?

          • Richard,

            “” The FAA says they are the ones making the certification decisions, not Boeing, but, the FAA Designated Reps, still report to Boeing, not the FAA. “”

            EASA said they don’t want delegation to Boeing.
            It seems it was a kind of deal they made, they agreed to less training what FAA wanted.

    • Real Steve.

      To satifsy a regulatin in the obscure corfner of an envelope you had MCAS.

      No once can back down now.

      Boeing did the perfect fix (MCAS 1.0) and defended it to the death (of 346 people).

      FAA can’t back down as it would be giving into Boeing.

      These things take on a life of their own (think of the Blob or the Tomato that ate the one town) and no one can go back to the simple, why not remove it?

      Wars have been waged on less, just a sad aspect of humanity.

    • EASA or another regulator could find a grounded plane and fly it. Once sold/delivered, Boeing can’t stop them.

      Disabling MCAS for a test flight would be simple enough. Just prevent the AoA sensors from going past some point (say 10 degrees?) so MCAS never activates. Simple to install a stop to do that.

  16. If the MAX needs dual computer architecture, I’m very surprised the NG does not need it as well. Or, the safety authorities are letting the NG slide with a lower level of safety, but are drawing a line at the MAX.

    • The MAX came under additional scrutiny for stabilizer control, due to the presence of MCAS which utilizes the stabilizer. That included the cosmic ray testing, which intentionally targeted the stabilizer circuits, when it had not previously.

      The end result was a test that had a very remote chance of occurrence in reality, but since it could not be entirely ruled out, Boeing had to respond to the failed result.

      It’s open to question whether that test and the resulting change should be applied to the NG. On one hand the NG doesn’t have the MCAS stabilizer control concern, on the other the dual architecture is safer and would constitute an improvement.

      I guess it’s up to the regulators to decide.

      • I would think that the Speed Trim system in the 737-NG would be equally prone to the cosmic ray issue. But, the STS has a safety cutout switch built into the pilots column. MCAS took out that safety switch and left the pilot with no way to turn it off. So, if they aren’t putting an off switch for the pilot in the new version of MCAS, then it has to be designed and tested to a much higher standard.

        • Richard:

          Off would be the disable switches on the counsel.

          Not what they were trained for with the column cutout of course.

    • I read somewhere that the MCAS2.0 software has already something included for the NG, but I don’t remember where to find it again. Could be this is a kind of dual architecture as well, but not completely, since I think some hardware is also needed to reach the MAX dual computer version.

  17. Hi Bjorn,

    I think your description of the reset conditions for original MCAS are not quite right. You say:
    “The original did not check if the AoA had fallen below the trigger value before it reset.”

    Here is an excerpt from the NTSB System Safety and Certification Specialist’s Report on pg. 248 of the KNKT Final Report.

    After the non-normal maneuver that resulted in the high AOA, and once the AOA fell below a reset threshold, MCAS would move the stabilizer ANU to the original position and reset the system. At any time, the stabilizer inputs could be stopped or reversed by the pilots using their yoke-mounted electric stabilizer trim switches, which also reset the system after a 5 second delay.

    MCAS is reset by both a trim input from the pilot and MCAS retrimming ANU after the AoA falls below a reset threshold.

    This makes sense because MCAS has to handle the possibility that during the non-normal maneuver the pilot can use the column switches to apply manual electric ANU trim that counteracts the AND trim from MCAS. Some sort of reset and re-apply logic is needed. After all, the risk of overcontrol remains if the above threshold AoA condition persists, and MCAS is there for a reason.

    However, it makes no sense that subsequent MCAS AND inputs during the same non-normal maneuver should be the same magnitude as the initial MCAS input. As far as I can tell, this is the way Boeing implemented original MCAS. In my thinking, subsequent AND inputs should only bring the stabilizer to the same target position based on AoA and Mach number. After all, the pilot might not apply enough manual electric ANU trim to completely cancel out the AND trim input that MCAS provided.

    The only real way to correct this is for MCAS to monitor the stabilizer position, either through a sensor or by tracking and integrating all of the stabilizer commands. This way cumulative MCAS actions will never move the stabilizer more than the original target value. If MCAS is limited to only one action for every over-threshold AoA event, then the possibility exists for the pilot to inadvertently de-activate MCAS by electrically trimming ANU during the maneuver.

    • Mike, I could be wrong, but my interpretation was that the accumulation occurred because MCAS terminated with a timeout condition during the false triggering. In that termination mode, it did not reset as it would with the expected drop in AoA value (normal operation).

      Thus with repeated activations and extreme AoA input that remained constant, the timeout condition was achieved each time without reset, and thus the stabilizer could advance to full AND deflection. The only protection would be pilot counter-trim.

      This was one of several programming errors. The output should have been bounded to the 2.5 degree maximum intended deflection, based on duty cycle (total product of the commanded trim motor run time and rate). Feedback is not required for that calculation, but I agree that feedback would be an improvement. Also reset could have been implemented in all termination modes.

      2.5 degrees is still 60% of the 4.2 degree full deflection, but it’s likely the pilots would have retained enough elevator authority to compensate, even if they didn’t counter-trim.

      • Hi Rob,

        The language in the report describes only reset, not a time out, and it clearly includes the two conditions for reset. I’m basing my educated guesses on the report.

        I think a repeated MCAS action is necessary if the pilot somehow decides to trim opposing MCAS when flying in the envelope where MCAS is needed and designed to activate. Otherwise the pilot can nullify the handling characteristics that MCAS is supposed to provide.

        In my view, Boeing made several wrong assumptions about how the pilot would serve as the “redundancy” that reduced the uncommanded MCAS activation hazard from Hazerdous to Major. Additionally, they made programing errors based on these assumptions that mainly involved the magnitude of the repeat MCAS actions.

        MCAS should never exceed the target stabilizer trim position. Subsequent MCAS inputs for the same high AoA event should only occur if the pilot counter trims ANU and then these subsequent inputs should never move the stabilizer beyond the original target point.

        • Thanks Mike, I agree with most of this.

          I used the term timeout as an indication that the exit of MCAS was time-related, which I believe would not be a normal exit condition. The normal condition would be a decrease of AoA below the activation threshold (possibly with some deadband). This would be consistent with an open-loop proportional controller.

          As you say, the pilot may trim against MCAS and that could cause a timeout exit, which then could warrant an automatic reset and continuation. But from what I understand of MCAS 2.0, that would not happen now, a reset could occur only if there is a transition through the AoA activation threshold again.

          I presume that if MCAS 2.0 times out now, it would leave the bounded maximum stabilizer deflection in place until either the A0A transition occurs, or the pilot overrides with electric or manual trim.

          We don’t have the full details of MCAS 2.0, so this could be wrong. It’s just the logic I would use if I wrote MCAS.

          • v1:
            Not really a time out, just a maximum run time.

            Then it sits there until reset, either by a pilot input or AoA dropping. If pilot input then reset the system. If AoA, then back out the added trim and reset system.

            Pilot input stops movement due to MACS but doesn’t reset system. Only AoA dropping below trigger resets system.

            Best I can tell, neither version envisioned multiple activations for continuing high AoA. It was meant to be a one shot deal. Either the condition subsided and MCAS took out trim and reset, or the pilot took out trim and reset.

            v2 prevents a subsequent activation for the same AoA event. No longer is the pilot assumed to fully remove added trim, AoA has to drop to reset the system.

  18. What I, as a private pilot, keep wondering is why the partly automated airliners do not have one red button (or maybe a few right next to each other) that switches off all assistance functions, autopilot, MCAS, whatever, and makes the plane fly with only manual steering.

    That simple button would most likely have saved all those lost lives.

    I am aware that, with fly-by-wire functionality, it is not sensible to switch off all servos and all computers, but the system could be temporarily downgraded and simplified so much that the airplane would be safe and easy to fly after any automation surprise incident. Perhaps the regulators should demand such a button and severely punish the maker after any accidents caused by this button not functioning as expected.

    The plane I recently fly, as Cessna 172 SP with Garmin G1000 and autopilot, has that button on the left steering grip. I love it.

    I once flew a Cessna 182, whose autopilot, out of the blue in mid-cruise, attempted a barrel roll. That plane also had that nice red button, I knew where it was, and I hit it well before flying inverted.

    I am fully aware that these much simpler aeroplanes do not have anything like fly-by-wire or MCAS, but the concept of a big, red “fly manually” button could still be adapted for airliners. Such a clean solution to save so many lives! Perhaps the regulators should demand this button in all new aeroplanes.

    • Hans-Georg Michna, I totally agree. The first thing I wanted to know when climbing into a plane with an autopilot was where the OFF switch was. On a lot of emergency checklists for the 737, the first items are shut off the A/P, then shut off the Auto-Throttle. Where is the shut off the MCAS system button? Had that been available on the two MAX accidents, immediately, as part of an emergency checklist, there’s a good chance the pilots would have been able to land safely. But, there is no OFF button for MCAS. It’s an automated system, controlling the planes pitch, that pilots can’t shut off (turning off the trim motor just ads to the problem, it’s not a true OFF button for MCAS). If an OFF button isn’t included in MCAS 2.0, then it needs full FBW computer technology.

      • It should be noted that in the 737, the stabilizer drive is clutched in such a way that pilots can grab the trim wheel and hold it against the motor. Although not an off switch, it’s a third method to interrupt MCAS, or any other form of runaway trim, in addition to the electric trim switches and the stabilizer motor cutout switch.

  19. The enormity of this is only beginning to reach the corners of my rather dull brain.
    MCAS should have been disabled after the first crash (Boeing probably had more than enough reason to do it before actually) and we would have heard no more about it.
    The rudder cable issue was carefully shoved under the carpet, why didn’t this happen with nose happyness? Was that decision correct?
    It’s vital that we understand how these decisions /non decisions come about.

    • Grubbie, You’re assuming that the ‘nose happiness’ issue in the 737-MAX is a minor annoyance, in a land far far away, as a lot of folks are saying. Boeing isn’t releasing the data. But, they are not wanting to fly a 737-MAX without MCAS.
      MCAS is defending against some situation Boeing isn’t willing to describe, other than it being a ‘pitch up’ force issue near stall. They are flying lots of test flights trying to deal with this issue. And saying it only involves a software fix. I’m not flying on a 737-MAX until they release the data on the problem MCAS is addressing, and the operational rules of MCAS. I don’t think a lot of 737 pilots would be comfortable flying a MAX at this point without that. Even if the FAA certifies it safe to fly again.

    • If they disabled MCAS then it’s no longer certified, effectively self grounding.

      MCAS was there to meet a regulatory requirement. You can’t then go back and just turn off a system that was used to meet regulations. The aircraft was certified in a specific configuration, and MCAS was part of that configuration.

      That would be akin to bolting an exit door shut or removing an emergency slide.

  20. This is my reply to others.

    I’ve repeated said that if the pitch up moment is “minor” then I don’t care. Turn off MCAS. Let the pilots fly the airplane.

    This comes to the flight deck and the FCC. The regulators are targeting the flight deck and therefore the FCCs. For good reason.

    I want to be honest. I didn’t know about the flight deck, which means I didn’t know about the FCCs. What I have learnt makes me break out in a cold sweat.

    But to my credit, after the Lion Air crash, I said that the FCC went into meltdown. A year ago I declared that on this web-site. But I did not know whether the problem was systemic. It was perhaps a one off. I did not know.

    This comes to FCC meltdown. It means instrument failure. Bjorn uses the term instrument failure. Perhaps I should have used it.

    Many know, but to those who don’t, instruments are driven by the FCC. An FBW has nothing to do with it. Instruments are processed by computers. They are processed by the FCC. So a FCC meltdown means instrument meltdown. It means total instrument failure.

    The regulators are focusing on the FCC but they are focusing on everything. They know. I don’t doubt that.

    The regulators like me are asking the same simple question: If the pitch up moment is “minor” turn the bloody thing off. It’s more trouble than it’s worth.

    What needs to be turned off? MCAS. Unless the issue is not “minor”

    It’s cost Boeing $10 billion and they refuse to turn the bloody thing off. Why? By deduction the issue cannot be “minor”

    I am defeated by the logic of what is going on. If it’s “minor” turn the bloody thing off. To spend $10 billion and more defeats me.

    Sorry, I can’t agree with this article.

    • Sorry Philip, but I’m afraid I am going to go with Bjorn and I am also going to trust the UK CAA not to allow the MAX to fly over my densely populated nation unless it is reasonably safe.
      My mind is blown away by the realisation that MCAS and 2 airliner crashes were completely unnecessary, but I’m am going with the theory that something went seriously wrong with the certification system and the FAA can not be trusted, for the following reasons.
      Bjorn is,or was an actual test pilot,and as a specialist aviation journalist is highly likely to hear any leaked information.
      Given the number of organisations involved it is garenteed that MAX pitch up data will be leaked.
      Even Boeing are not mad enough to get even deeper into this almighty cluster****.

      • Presumably that means you are saying get rid of MCAS as totally unnecessary or am I not reading your comments correctly?

        Remember, it’s now been grounded for 9 months with Boeing frantically trying to get MCAS to work without causing a hazard greater than the hazard that caused it’s creation.

        More than $1 billion a month for something unnecessary. Hard to take in.

    • Philip, I agree with your logic. If it’s simply a matter of trying to comply with an FAR that want’s a constant force feedback on the control column, then simply use the Elevator Feel computer to feed the AOA data into. You avoid all of the stab trim runaway risks, and if an AOA fails, the pilot is just left holding more pressure on the control column. Why is MCAS playing with the Stabilizer, to achieve some added control column force, along with all of the associated switch changes etc? Did they really go this convoluted route, just to avoid some additional training for pilots in the simulator? If so, they are learning a very expensive lesson in aircraft control design, the hard way.

      • Agreed,

        From the position of regulation, as per a Functional Hazard Assessment, it doesn’t add up

        From the position of trying to develop control law fail-safe redundancy using 40 year old 80286 processors, it doesn’t add up

        From a position of repurposing a trim stabiliser to do something it’s not designed to do, it doesn’t add up, as per your comments.

        From the position of spending billions, it doesn’t add up.

        And so on. It simply doesn’t add up. Carrying on like this for a “minor” hazard. It can’t be anymore convoluted. Tosh.

        Anyway Boeing have declared they are ready and are pushing for December certification. By law the regulators have not been allowed to interfere. The regulators can’t tell Boeing how to fix things. But they can reject the fix. Certainly some regulators are less than enthusiastic, given the link provided by OV-099.

        The regulators must publish the truth about the “minor” hazard.

      • Richard,

        To add. Your comments are typically insightful. To be explicit in agreeing with you.

        If it’s just about making the MAX feel like an NG, then you are absolutely right. Modify the control logic of the elevator feel computer.

        Part of the mis-understanding on this web-site involves FBW. The MAX isn’t FBW but it is entirely controlled by computers with one exception. The exception is manual trim. This means the flight deck is subject to synthetic forces controlled by computers. So, as you say, just modify the synthetic forces so that a MAX feels like a NG.

        But your insight can be generalised to address the pitch up tendency. Elevator deflections are controlled by computers, even on a MAX. So just modify the control logic to change the elevator deflection to address the pitch up tendency. After all, the elevators have been deflected to achieve an AoA in the first place. So simple, just modify the elevator deflection by modifying the control logic to accommodate the pitch up tendency.

        But the above only works if the aerodynamic issue is “minor”. So I agree, what we are witnessing cannot be more convoluted for an aerodynamic issue that is “minor”.

        My view: I don’t think the elevators are responsive at elevated AoA, so they have had to use the trim stabiliser. The term “elevated” was introduced in the Lion Air crash report. That is not “minor”. Indeed there is no precedent for using a trim stabiliser in this manner.

        • Philip, elevator control authority is reserved for the pilot or autopilot, it shouldn’t be used by other systems because that could result in the pilot not having the full authority available when needed.

          Auxiliary systems use the stabilizer for trim, as a separate control surface that does not restrict the pilot’s authority. If this use of the stabilizer creates too-large elevator forces that might compromise pilot elevator authority, the pilot can override the stabilizer with electric or manual trim. But the reverse is not true, auxiliary systems cannot override the elevator.

          The sole exception is stall avoidance or prevention, such as a stick-pusher system, but there the explicit intent is to override the pilot.

          • Sorry Rob, I don’t understand your comment.

            The movement of the control column deflects the elevators. Elevator deflection is power assisted using hydraulics with electronic valves. Therefore the control column is just a synthetic force controlled by computers. The auto-pilot does precisely that. It controls the synthetic force. That means the control logic can adjust or calibrate the synthetic force to whatever you want it to be causing the elevators to deflect to whatever deflection is required.

            Richard and I are not suggesting MCAS uses the elevators control logic. We are saying that if the aerodynamic issue is “minor” why is MCAS necessary. Instead just tweak the existing elevator control logic. A behind the scenes slight change in elevator deflection to address the pitch up tendency causes no harm at all if there is sufficient elevator authority.

            Tweaks caused by “minor” aerodynamic issues occur all the time. Typically they occur during the flight test programme. In other words, wind tunnels never completely get it right and while CFD (Computational Fluid Dynamics) is improving it doesn’t completely get it right. So flight test programmes always cause tweaks to the control logic to address “minor” aerodynamic issues.

            The words above don’t just apply to Boeing they apply to Airbus and all other airplane manufacturers. Indeed all engineering.

            Ergo, if the aerodynamic issue is “minor” why wasn’t the existing control logic subject to the good old fashioned tweak, as we engineers always say?

            It’s all very convoluted – Richard’s word – for something that is “minor”. The logic isn’t there. Nine months on the ground and the clock still ticking.

            I will end by saying that the only control force that can’t be tweaked on a MAX is manual trim. An 80 tonne airplane where manual trim is manual. I won’t go there. I’ll start crying in my beer.

          • Philip,
            We are still waiting for the accident report on ET302. But there is something deeply cynical, deeply shameful, fundamentally cold-hearted, tragic, and moving (in a quixotic way) about the pilots resorting to that eternally frozen manual trim wheel on that flight in an effort to save the lives of 149 people.

          • So again, MCAS as a handling characteristics system, cannot use the elevator. This is why Boeing used the stabilizer.

            MCAS as stall prevention could use the elevator in the form of a stick-pusher, which is covered separately in the regulations. But then it would no longer be MCAS, it would be a stick-pusher system.

            JATR noted how the use of handling characteristics at high AoA was different than stall prevention, but also noted it was a novel approach that was not directly referenced in the existing regulations.

          • Richard, thank you for bringing this up.

            Phillip, that is new to me. I was under the impression that control forces had to be a direct result of the physical forces and at best they would be leveraged mechanically. This was the only remaining reason in my mind to justify the existence of a stabilizer actuated by MCAS as a solution to the certification requirement regarding feel force.

            How did I miss this point in Bjorn’s Corner series about FBW vs Steel?

            This reinforces in a very strong manner the reason why Boeing had to address some real aerodynamic issue instead of a mere control feel issue imposed by certification. Now the degree of certainty in your opinion is better explained.

          • Rob, that clears up a lot. Wouldn’t the implementation of a stick-pusher, then, be much less involved? Ie. more fail-safe than even a correctly implemented MCAS (nevermind now an incorrectly implemented one)? Would a certification of a stick-pusher be more demanding in terms of implementation, given it addresses a stall instead of a mere handling issue?

            I find it curious that a more consequential stabilizer versus a less impacting elevator, would have reversed demanding roles in terms of certification requirements.

          • Rob,

            Give it up. MCAS is unneessary if the pitch up tendency is “minor”. Ergo, the pitch up tendency is not “minor”.

            Life with it. The regulators know. Let’s see what happens.

          • Vasco, I don’t know the complete chain of design reasoning at Boeing. The choice of MCAS over stick pusher may have come down to the pre-stall characteristics, how quickly the aircraft transitions from controllable to uncontrollable.

            If the transition is rapid, such that the pilot doesn’t get much warning, that would favor a stick-pusher that absolutely takes over the aircraft. If the transition is more gradual, then that would favor a handling solution like MCAS.

            To me, using the stabilizer makes sense as it doesn’t interfere with the pilot’s control authority. I would not interfere with that except in an emergency.

            Bjorn and others have said that MCAS was a reasonable solution to the non-linear pitch curve at high AoA. None of the reports thus far have disputed this, apart from the “novel” language in JATR, which wasn’t a criticism so much as pointing out that Boeing could have asked first (I agreed with that finding). MCAS seems reasonable to me as well.

          • Rob,
            “To me, using the stabilizer makes sense as it doesn’t interfere with the pilot’s control authority. I would not interfere with that except in an emergency.”
            Isn’t using the stabilizer via MCAS, interfering with the pilots control authority (no OFF switch for MCAS) the whole reason the two accidents happened?

          • Richard, I think we’re going around in circles on this issue.

            As I’ve mentioned before, there is what MCAS was designed and intended to do, and then there is what MCAS did under circumstances of malfunction. These two are not the same thing.

            You can forever point at what MCAS did in malfunction, as being wrong, and you’d be right. No one disagrees with that.

            But you cannot also point at MCAS as designed/intended, and level those same criticisms. There is no reason to believe that MCAS would behave like that in the absence of malfunction.

            We were discussing the original design decision to use MCAS. We know that MCAS in malfunction was not the intended design. It was not the intention of MCAS to remove control authority from the pilots.

        • Philip,

          Bjorn said: “The aircraft is not unstable, just nose-up happy.” So, I take it that you profoundly disagree. So, here is what I am understanding – cobbling things together in a humanities-trained mind.

          You are saying, the higher placement of the engines and their nacelles trouble the flow of air. At certain angles of attack this (in words taken from a different context) produces “a ‘deep stall’ where airflow to the elevator is blocked … making a nose-down pitch change (to recover from a stall) impossible.” So, MCAS uses the stabilizer to pitch the nose down when the elevators have lost their authority because of a ‘deep stall’ produced by the engine nacelles at certain angles of attack?

          So, instead of attacking this problem aerodynamically which 1) would have required expensive physical alterations and 2) involved alterations that added weight and drag; Boeing went the, fast, expedient, rationalizeable, and brilliantly cheap “frictionless” route and used software (MCAS) to send commands to the grandfathered, antiquated jackscrew operating the stabilizer under conditions when the authority of the elevator is undermined by the angle of attack and a “deep stall” produced by the airflow from nacelles of the higher engines?

          • RealSteve, the term “deep stall” has been around since the 1950’s and the first use of a T-tail. It has nothing to do with the 737 or its engines.

            The reporting on the development of MCAS has said that Boeing looked at aerodynamic solutions as well. We don’t know what exactly, but I don’t think you can say that they jumped immediately to MCAS purely for cost savings. That is speculation rather than fact, however strongly you may feel about it.

          • Yes. I bit harsh, but yes.

            In simple terms, if there is a “minor” pitch up tendency recalibrate the elevators. But the elevators must have authority. Every airplane manufacturer as been there.

            But it must be “minor”. Anything other than “minor” needs something else.

            Can I say thanks. I do use the lingo of aerodynamics. You Richard and others have helped me draw back on that. Thanks.

          • Rob:

            “A Deep Stall, sometimes referred to as a Super Stall, is a particularly dangerous form of stall that results in a substantial reduction or loss of elevator authority making normal stall recovery actions ineffective. In many cases, an aircraft in a Deep Stall might be unrecoverable. This phenomenon affects certain aircraft designs, most notably those with a T-tail configuration.”


          • RealSteve, in addition to your definition, a “deep stall” can occur when a stall results in all the control surfaces becoming stalled simultaneously, leaving no control authority for the pilot to respond. In that situation, the aircraft can enter a free-fall or flat-spin. Both are difficult recoveries and often fatal.

            This condition is associated with the T-tail because as the aircraft pitches up, the top T section drops into the wing-wash, which can cause the tail to stall even before the wing. Pilot is left with a stalled aircraft and no authority.

            For conventional tail designs like the 737, the tail is below the wing in pitch-up, so out of the wing-wash, sustains airflow, and won’t stall until well after the wing does.

            As far as how this relates to flow and lift for the 737 MAX engines, I wasn’t able to follow Philip’s arguments about the pylons, separation, and/or deep stall. Here is what I think happens, for what it’s worth:

            Once the plane pitches up to 10 degrees or more, the pylon is obscured/removed from the airflow by being behind the nacelle, and it’s likely the separation occurs at some point across the top of the wing, as it normally does. I think this would happen for both NEO and MAX. That leaves the nacelle underside area as the dominate contributor to the additional lift.

            Position is also important, the more forward the engine, the greater the impact of the additional lift on pitch stability. But in terms of engine mounting, I think that effect is minimized in pitch because of the upward tilt of the nacelle, which effectively blocks the pylon.

  21. It seems to me that the only explanation for Boeings behaviour in the aftermath of both crashes was potential financial loss and /or lawyer fright.

  22. Why is there no MCAS off switch? The answer is simple, because pilots would use it. You would then be in the position where you would have to discipline pilots for taking the most logical and safest course of action.

  23. “And even if the MAX swings into stall it’s not the end of the world. Stall in an airliner like the 737 MAX is controllable, just release stick pressure and you are out of it. Not the big deal it’s made to be.”

    How do you know? The relative position of engine and wing leading edge is unlike that of any other airliner, including other 737s. Details of the separated flow field at high angle of attack, as would be provided by CFD analysis, wind tunnel tests, or flight with appropriate flow visualization (e.g., tufts) have never been made public. Neither have the results of any recent MCAS-off tests, assuming they have been performed.

  24. Mike, commercial aircraft are stalled intentionally in flight testing, and the characteristics are recorded. The handling must be as expected, and in compliance with regulations, which pretty much are as Bjorn has described, in order to receive type certification.

    I suspect Born was saying that if the stall is in level flight and being caused by pulling back on the column, letting go of the column will restore the neutral position (due to the elevator centering system), which will cause gravity to pull the nose down, and the aircraft will recover from the stall. It’s designed to have that characteristic, for safety.

    You don’t need CFD and wind tunnel data to have confidence in this. Common sense goes a long way.

    • Three Axis gimbaled in a wind tunnel?
      Can you simulate a turning aircraft in a wind tunnel, or is the aircraft model fixed in place? I tried to find out the answer from the internet. I found some moveable models as in this video.
      But, not exactly what I was looking for. A Three axis gimbaled system. They must have one somewhere? What if the nose happy when close to stall, suddenly becomes a stall, on one side of the aircraft before the other? Can the more forward and upwardly mounted engine nacilles disrupt the boundary
      layer on a wing at a high AOA? Maybe one side before the other in a climbing, twisting turn? Would that show up during wind tunnel testing?

  25. Here are several facts that I think commenters here should keep in mind when talking about MCAS and whether it is needed.

    1) The FHA for any aircraft system can result in different hazard levels for different parts of the flight envelope. Case in point MCAS. Boeing’s FHA assessed the loss of MCAS function as Minor for the normal envelope, but Major for the operational envelope. Check out Table 7 on page 272 of KNKT Final Report (NTSB System Safety and Certification Specialist’s Report).

    These flight envelopes are defined in FAA AC 25-7C Appendix 5. The normal flight envelope includes flight conditions of altitude, weight, airspeed, AoA, maneuvering “g” loads, etc. that are encountered during normal (typical) flight. The operational flight envelope includes the non-normal (atypical) flight conditions that are not common.

    Boeing assessed the loss of MCAS function hazard as Minor during typical flight conditions and Major during atypical, less common flight conditions. This is consistent with what Bjorn has maintained for a while now, even before the KNKT or the JATR reports were released. I know of no credible source or report that contradicts this assessment.

    Contrary to some opinions, Boeing can’t just ignore a Major hazard classification. It has to be addressed and the AHJ can’t just give a pass on their own rules, even if the pass is just for an uncommon part of the flight envelope. Imagine the outcry if that happened. So, MCAS was introduced for a good reason, to address a Major hazard in part of the flight envelope. I think, along with Bjorn, Peter Lemme, and Boeing, that MCAS can be implemented in such a way as to fail safe, i.e. not cause more than a Major hazard if it functions uncommanded. It makes no sense to me to think that what MCAS was is indicative of what it needs to be.

    2) The elevators on the MAX, or on any other 737 model for that matter, are not controlled by the FCC or any other electrical source. They are controlled mechanically, through cables that run from the control column to the elevator PCU’s (Power Control Units). The PCU’s are powered by the aircraft hydraulic systems and controlled directly by the cables, not some kind of “electronic valves”.

    Now, this mechanical control may be augmented or adjusted through three actuators, the elevator feel and centering unit, the Mach trim actuator, and the elevator tab control mechanism. The FCC does control the neutral shift through the centering unit and applies Mach trim through the Mach trim actuator. The FCC also can change the elevator trim tab mode between balance mode and anti-balance mode through the tab control mechanism. However, these actions are small and never override pilot control through the mechanical cables. When the autopilot is disengaged, the FCC does not control the elevator.

    Now, for the EFS (Elevator Feel System). This hydro-mechanical system provides column force feedback to the pilots that is primarily dependent on speed, but also on stabilizer trim position. The main component of this system is the Elevator Feel Computer. This is not an electronic computer, it is a dual redundant hydro-mechanical computer. A good diagram is given in the following link.

    It takes total and static pressure inputs from dedicated elevator pitot-static ports located on each side of the vertical stabilizer, a shaft input representing the stabilizer trim position, and hydraulic pressure. Note that these pitot-static ports are located at the tail of the aircraft and are completely separate from the pitot-static ports that feed the ADIRU’s. It outputs variable hydraulic pressure to the elevator feel and centering unit. This hydro-mechanical computer cannot be easily reprogramed and has no provision to take in electrical inputs of any kind e.g. from an AoA vane.

    Those suggesting that the Elevator Feel computer can be easily reprogrammed to adjust the column force at high AoA need to take a look at the links I provided and gain an understanding of how the system works before making such claims. Bottom line is the MAX elevators are not controlled by computers. Their movement is only slightly adjusted by FCC inputs as I discussed above.

    3) Transport Canada has not rejected Boeing’s MCAS solution. Some people jumped all over the leaked e-mail containing one engineer’s opinion of MCAS and his proposed alternative solution. I looked up Jim Marko on LinkedIn and he is definitely legit, a career Transport Canada guy with a bachelors in materials engineering. His title as he listed it on LinkedIn is: Engineering Manager, Aircraft Integration & Safety Assessment. To me this does not imply that he is a department head, but rather that he could be one of several engineering managers within the department. So, his opinion is in no way representative of Transport Canada’s view on MCAS. Transport Canada even made an official statement to this effect, along with the FAA.

    Personally, I think it is healthy that AHJ’s have people with differing views that are willing voice them and provide rationale. Even though it is not an AHJ function, providing alternative solutions is also a good idea insofar as it aids in understanding the issues. It’s been my experience that debate and discussion based on technical facts readily leads to very rapid understanding of complicated technical issues, and results in innovation. However, I was a bit disappointed that Marko expresses his concern that an MCAS decision will not be technically based, but then in his presentation at least half of his listed issues are political in nature.

    4) Boeing is not afraid to test fly the MAX without MCAS. In fact they have already done it according to the Seattle Times.

    Boeing says MCAS is needed not for stability but only to make the MAX feel the same to a pilot as the previous 737 model. The airplane will fly safely with or without MCAS, Boeing insists.
    To prove that, Boeing has flown near-stall maneuvers in flight tests this summer with MCAS turned off. Safety regulators plan to do the same during upcoming recertification flights.

    So, the FAA will fly the MAX without MCAS first and the data will be provided to other regulators. We will see if other regulators demand their own flights. Personally, I don’t agree with the statement that MCAS is only needed to make the MAX feel the same as NG. I think that is Boeing PR. But it is a fact that the NG complies with the regulations. If the MAX needs MCAS to comply with the regulations, then it follows that it will handle the same or very similar to the NG.

    Also, it appears as if EASA and the FAA are not as far apart as some would like us to believe.

    While the FAA is likely to mandate hands-on Runaway Stabilizer training built into every airline pilot’s yearly recurrent training sessions in a simulator, some foreign regulators may make that a requirement for their pilots before they permit the MAX to return to service.
    In a recent interview with trade magazine Aviation Week, Patrick Ky, executive director of the European Union Aviation Safety Agency (EASA), indicated that his agency will likely go along with the FAA in not making that a requirement.
    Ky said that while some nations may demand simulator training for “purely political or public relations-driven” reasons, it would be “a complete disaster” if the FAA and EASA diverged. “We need to be fully harmonized,” he said.
    That suggests the world’s two major aviation regulators are now aligned, though EASA’s schedule lags slightly the FAA’s. Ky said he expects an EASA decision on returning the MAX to the air “sometime in January.”

    5) The boundary layer from the top of the MAX engine nacelle somehow not making it between the nacelle and the wing bottom is some serious voodoo-aerodynamics. There is no magical force that will keep air from flowing between the nacelle and the wing bottom.

    It can easily be shown that the worst case turbulent boundary layer that forms along the nacelle top will have no problem making it between the nacelle and the wing bottom. I already did this back in July.

    I’ll repeat it here. The following link contains a picture showing the engine nacelle mounting on the 737 MAX. Look at that space between the nacelle chevrons and the wing underside. Seems like a definite pylon to me. Also notice that the top of the nacelle ends right at the wing leading edge.

    At an altitude of 35,000 ft on a standard day, cruising at 0.79 M, and estimating a nacelle top length of 12.5 ft, the turbulent boundary layer will be less than 1.9 inches thick. Judging from the picture there is plenty of room for the nacelle boundary layer to flow under the wing. I don’t think the nacelle boundary layer is ever making it over the wing as long as the nacelle flow stays attached. It will stay attached, at least up through the beginning of wing stall. That is what causes the slope change at high AoA in the pitching moment vs. AoA curve, i.e. the notorious pitch up tendency.

    To calculate boundary layer thicknesses as well as other aerodynamic properties of interest, check out this link.

    • Thanks again Mike, for straightening us out. A lot of what we say is assembled from bits and pieces of knowledge that we may have, or from research, but that is not the same as someone with thorough knowledge, who really understands the material. So thank you taking the time to research and write this. I learned a lot and it is very much appreciated.

      I also think this speaks to the notion that Boeing should release all information publicly. We’ve seen how numerous incorrect statements have arisen from what little we do know. That would be massively amplified with unlimited information. Not because people aren’t well intentioned, but because understanding has to accompany information, in order for evaluation to be meaningful.

      We live in the age of Google where information is at our fingertips. But information is not the same as education or understanding. So we should all keep that in mind while we each research things on the Internet, to further our own personal understanding. It’s good that we do, but it has limits as well.

      • Thank you Rob for the kind words. I don’t really consider myself a technical authority here, but it is pretty obvious that I’m not shy about speaking up if technical claims are made that I know don’t match what I’ve learned through my education and experience (my undergraduate degree is in aeronautical engineering, but I earned that degree a while ago and I’ve never actually done aircraft design in my career).

        In my own comments I try very hard to be technically and factually correct, often times spending a considerable amount of time fact checking myself before I post. However, I most certainly know that I’m not always right, and I’m also not immune to the fandom type of back and forth sniping that happens a lot in these kinds of forums.

        I like coming here to contribute and learn, and have certainly learned so much from the high quality articles and other commenters here at LNA, mainly about the product strategy and business side of the aircraft industry, but also hard core technical subjects as well. Much of my learning has also come from scouring the internet when I fact check myself and others.

        I really appreciate well reasoned comments based on facts and presented with an even keel. Your comments certainly fit that bill so keep up the good work.

        As for your comment on Boeing releasing information to the public, I don’t think many people always want know how the “sausage is made” so to speak. Even those of us who comment on this site.

      • Rob: “I also think this speaks to the notion that Boeing should release all information publicly. We’ve seen how numerous incorrect statements have arisen from what little we do know. That would be massively amplified with unlimited information.”

        I’d say it is the other way around. Simply since there is only leaked and very partial information around, you get speculation and incorrect statements. If you have clear information, particularly if the interpretation is clearly corroborated by independent, reputable agencies like FAA and EASA, without remaining differences in view between such agencies, the fuzz and interpretation you see now will by and large stop. Not doing this will see a continuation of speculation and guesswork. For good reason, since in that case both Boeing ánd the agencies will leave the impression they have something to hide.

        • AtFlyer, first the agencies do have access to the information they need, as far as we know. They have not said they’ve been unable to access data. Second, the fact they have some differing positions is a good thing, as we wanted that diversity of opinion. That’s why the process is open. It’s up to them to negotiate and settle their differences.

          I think your statement gets at the crux of the issue. If the information is released, will that truly end speculation in the public, or will it fuel an explosion in public speculation? My opinion is, the latter.

          I’ve seen some wild speculation in these forums, and when facts to the contrary are presented, they either haven’t been accepted, or the speculator has simply moved on to new information or theory. Often the same theories are resurrected again after a brief lull, so the cycle becomes repetitive.

          The theme is repetitive as well, it goes something like this:

          — The MAX is an inherently unstable or defective airframe, Boeing is concealing this, MCAS is the smoking gun, and the proof of the defects is out there somewhere, if only Boeing didn’t stop us from finding it. —

          To me, that’s coming awfully close to a conspiracy theory. It doesn’t give me great confidence that information is the main issue. It seems like the method of reasoning, and the ability to correctly interpret, is maybe more significant. Also the willingness to accept new information that doesn’t support your position. That speaks to education & experience & depth of understanding.

          I’m the first to admit, I am not qualified to analyze all that data either. I’m glad the FAA opened the process to world-wide qualified agencies. But I’m also glad they are qualified agencies, and not the general public.

          It’s an issue of signal-to-noise ratio. The signal comes from the agencies and their reporting, the noise comes largely from the public. We have qualified experts like Bjorn, Peter, and others to help us resolve the signal. So I would rather have that signal be strong and clear.

    • Mike,

      are you getting paid for the stuff you post here?

      The KNKT reported that repetitive MCAS activations, turned out to be incorrect and inconsistent with the FHA classification of Major.
      The FHA listed the maximum MCAS authority with only 0.6 deg and the duration of a MCAS mistrim with only 3 sec.
      Boeing failed many times which lost lives.

      We all know what Jim Marko wrote. It doesn’t matter what it is, offical, inoffical, wishes or pipedreams. Important is that a manager in this position wrote this. For sure, everything what people involved say are opinions, what Ky says are opinions too, EASA didn’t flight test till now. Only matters is if MCAS will be certified or not. If Transport Canada certifies it, it doesn’t mean that other regulators will certify it too. Important is that Marko wrote to people involved that MCAS has to go. Important is that DeFazio knows this now because it seems he wants to clean this mess up.

      Also important is that Deckard wrote that the trigger reset still doesn’t work completly if it’s AoA bias failure, when the TAB reported that the MCAS design changes are compliant with the regulations and safe.

      For sure there is still a mess, it seems Boeing has no clue and is rushing things again, we know the results. Maximum 0.6 deg were certified, not more, and that killed.

      My opinion for you. EASA will flight test and the results will be incorporated in the ET302 report and then the courts will rule.

      • Leon,

        Have you based your entire portfolio on short selling Boeing stock? Or do you have a history of Airbus fandom? Because, it seems you are really invested in seeing Boeing fail and interpret every piece of information through your lens of hoped for failure.

        The KNKT reported that repetitive MCAS activations, turned out to be incorrect and inconsistent with the FHA classification of Major.

        This is beside the point that I was making. Some have questioned why MCAS is needed if the MCAS failure to activate hazard is assessed at only Minor. I was pointing out Boeing actually classified the MCAS failure to activate hazard as Major, so MCAS was indeed needed.

        I agree that Boeing misclassified the uncommanded MCAS activation hazard as Major in the normal envelope (it was actually classified as Hazardous in the operational envelope). It should’ve been classified as Hazardous in the normal envelope as well. Remember that the MCAS failure to activate and uncommanded MCAS activation hazards are different.

        For sure there is still a mess, it seems Boeing has no clue and is rushing things again, we know the results. Maximum 0.6 deg were certified, not more, and that killed.

        Please cite some real evidence that Boeing has no clue. If this is your opinion then fine, but just saying it does not give it credibility.

        You really don’t know whether 0.6 deg or 2.5 deg was certified. Boeing claims that they updated the FAA and some in the FAA agree they were updated, but they were the wrong people. It’s he said she said at this point, but it will get sorted out.

        To be clear, 0.6 deg didn’t kill. Something like 4.5 deg is what killed. I’ll say this again, what MCAS was is not indicative of what it needs to be or should’ve been. People need to get this straight.

        The FAA will flight test the MAX with MCAS turned off first. Boeing has already done this several months ago. EASA will probably end up trusting the FAA and not demand their own test flight. We will see. Either way, MCAS will get implemented properly, and it won’t be because of some congressman.

      • Leon, you implied that Mike is biased in favor of Boeing, yet he only presented facts and knowledge, making no claim about the guilt or innocence of Boeing. He’s just trying to clarify the discussion by making it factual.

        You, on the other hand, have consistently ranted about how horrible Boeing is, and have repeated it again here as well. If that is not bias, I don’t know what is. I don’t see how you can accuse Mike of bias, and then be so incredibly biased yourself.

        We all get that you’re angry with Boeing, but your anger is not a fact or line of reasoning that the rest of us can follow or consider.

        If you believe, as Marko does, that MCAS 2.0 should not be certified, then you are free to give your facts and reasoning here. If you believe Mike has made an error in his presentation, you are welcome to refute it here as well. If you believe that Deckard’s comments about limit cycle behavior should be addressed in MCAS 2.0, then tell us why, or how you think it should be done.

        We are all looking for a good outcome here, but we won’t get it through anger or only looking at one side of things. We can only get there through a balanced and factual process of reasoning things out.

        • Rob,

          it doesn’t matter what I believe. Marko is involved and is discussing the problems with FAA, EASA and Brazil’s ANAC, these and Transport Canada are experienced certifying regulators. Important is that their discussion reached a point that it is thought about that MCAS has to go. This is important, to notice that the problems are so severe.

          Deckard has explained his opinion which can be followed easily.

          You are trying to figure everything out as if Boeing would be a normal company. But that’s NOT the case.
          In 2015 an engineer questioned a single sensor MCAS failure. Was he replaced, pressured to keep his mouth shut?
          A speed backup system similar to the one installed on the 787 was rejected for the MAX because it could increase costs and training requirements for pilots.
          Boeing convinced the FAA, during MAX certification in 2014, to grant exceptions to federal crew alerting regulations, specifically relating to the “suppression of false, unnecessary” information. DeFazio said that Boeing considered adding a more robust alerting system for MCAS but finally shelved the idea. Was it because of $$$ too?
          Boeing also successfully appealed safety concerns raised by FAA safety specialists about the separation of cables into different zones of the aircraft, to avoid failures due to a common cause.
          Boeing is too cheap, money is much more important than safety. Should that be normal? But you are talking like Boeing is normal.
          Boeing rushed things so much that they forgot about the AoA Disagree alert. Boeing defended that the AoA Disagree alert is not necessary for the safe operation. According to Bjorn a major contributor to the ultimate loss of JT610 is the missing AOA DISAGREE display on the pilots’ displays. Boeing has no clue.
          Safety wasn’t Boeing’s intention, putting undue pressure on engineers.

          You are trying to find excuses for Boeing’s culture.
          It wasn’t wanted that engineers do a good job.
          Rob, are you getting paid for the stuff you post here?

          • Leon, again you are accusing others of bias while declaring your own bias outright. You start with your presumption that Boeing is evil and all your interpretations flow from that.

            I’ve tried to present a more balanced view. I’ve been critical of Boeing but have also defended them, just depending on where the facts lead. Not everything they do is right, not everything they do is wrong. I try to resolve the difference through evidence.

            If you choose not to do that, so be it. Just be aware, as we are, that you are making a choice.

  26. I have no problems with anyone ;being angry nor even antagonistic toward Boeing, they certainly have brought it upon themselves with their approach and arrogance. I share that, maybe more than just about anyone as Boeing was iconic when I was growing up.

    But I also believe in facts.

    There have been some flat out lies put out, including the MAX is not stable.

    That is ludicrous. Blamed on the Coriolis affect now I believe.

    With facts, you can approach the debacle of MCAS 1.0 with an intent to correct it (even if it means removing it).

    With alternative reality MCAS not only will not be corrected nor the underling causes that let it go through the system unchallenged in the first place.

    Tremendous progress has been made in Aviation safety, but there will always be challenges and debacles that need to be corrected.

    Its corporate nature to push the edges as well as try to game the system and we hope our legislature have a sense of responsible to reign them back.

    There should be some perspective here as well.

    Aviation is a PR bonanza that plays to an audience including the failures (or even more so the failures)

    Literally hundreds of thousand die each year in Hospital and physician induced death. Its just one tragedy here and there adding up to an awful total that goes ignored because its not headline inducing.

    Progress is not made on alternative facts, its made on facts and solutions to when its failed.

    • TW, anger is ok as a motivation, but it can’t become a substitute for a factual and reasoned view. If it does, then the technical world will be plunged into the total dysfunction of the political world.

      The scientific method is based on truthful observation and analysis. We accept a truthful outcome whether it supports us or not. Take that away, and we become the babbling bunch of bureaucratic buffoons, that we are witness to in the news almost every day.

      One of my favorite examples, Einstein’s solution for relativity contained a constant term, which he felt was needed to agree with his understanding of the universe. Later it was shown the constant wasn’t needed, which he accepted as his “biggest blunder”, as he was actually right the first time. Then later still, it was found that the constant term may represent a real effect in space-time, so it’s now back in again.

      Einstein wasn’t alive to see this, but his constant is now widely credited as yet another brilliant insight. Lesson is, we have to be looking at all sides of things because we don’t know initially what may turn out to be right. And what we know to be right, is always subject to change. And we have to accept the truth, whether it finds us wrong or right.

      Put another way, the conclusion has to come last, not first. If it’s last, then the change doesn’t invalidate what came before. If the conclusion comes first, then change means starting over, since everything that followed may be invalid.

      Anyway, sorry for the above, a philosophical digression!

  27. Mike, I’ll try again. Point one-you are basically saying that MCAS is an outcry prevention device and admitting that that is its only practical purpose.

    • Grubbie, I think Mike was saying that the “Major” finding cannot be ignored, it must be addressed in some way. If it were not addressed, that would be a source of valid criticism.

      The manner in which it’s addressed, at present, is MCAS. But that does not imply that MCAS exists for the sole purpose of avoiding criticism, it exists to address the major finding. That was Mike’s point.

      You believe that MCAS should be dropped, and the finding addressed by exemption or modification. That’s an alternative view, and we will see what the regulators say. But Mike is not wrong in his statement that until that happens, the finding must be addressed, and MCAS serves that purpose.

    • Hi Grubbie,

      I saw your original reply to my comment and, to be honest, I didn’t know how to respond because I didn’t get what you said. I can be dense that way sometimes. Now that you clarified for me, I think I finally get it.

      The point I was trying to make is that MCAS is needed because the stability issue that MCAS was implemented to address is considered Major in the operational envelope. Boeing can’t just ignore this. Not so much because of the public outcry, although I think the outcry would be substantial, but because the regulations absolutely have to be met.

      I could be wrong about this but I get the impression that it was much more common in the past for aviation regulators to relax the rules or make certain exceptions to accommodate the manufacturers if meeting those requirements proved overly burdensome or costly as long as safety didn’t suffer too much. This is no longer acceptable in today’s aviation industry. Expectations are so much higher than they used to be.

      Bottom line is that the MAX needs the stability issue at high AoA to be addressed so that it can be certified. MCAS is how Boeing chose to address the issue. MCAS was a need to have not a pointless add on.

  28. I don’t believe that MCAS should be dropped, I don’t know, its a decision for the experts. However,Bjorn and most other experts seem to agree that MCAS will never prevent an accident(I was first told this a couple of days after the Lion Air crash and didn’t really believe it), so logically its better to get rid of it and not have metal tubes full of people spearing into the ground or the vast and unnecessary expense for Boeing for that matter. The 737 probably breaks hundreds of regulations that would be required for a completely new model yet is statistically the safest airliner the world has ever seen, or at least was until the MCAS device was fitted to comply with safety regulations.

    • The Speed Trim System (STS) will be working – on-and-off – during climb out. STS and MCAS will both operate the Hstab. The pilots didn’t know about the MCAS so to suspect the STS would be normal, and procedures was in place to deal with an uncontrolable Hstab.

      Also note that for most of the time the captain worked on re-establishing climb, which also could point to the STS.

      Perhaps this was the FO’s first encounter with an uncontrollable aircraft; a situation he was not prepared for – unfortunately.

      ‘In the old days(!)’ it was three persons in the cockpit, all occupied with flying the aircraft, – and a bit of navigation. Then they learned faster – upsets happened pretty often ‘It was different then’, I guess TW would say

  29. One Question, in your article, you hint at what happened after the handover to the FO , but dont pick the topic up later. My question ist: So far the Captain was succesfully fighting MCAS AND Trim, with ANU Input, and they always managed to regain altitude. So why did they suddenly stop this (working) procedure?

    Regards, Wolfgang

    • Wolfgang, Bjorn discusses the First Officers actions, more in detail in his part 5 of the series.
      My own guess is that the First Officer didn’t know how much effort or extra manual trim the Captain was using. The FO was busy on other items. Then he suddenly gets this out of trim aircraft, with a mind of it’s own. He doesn’t realize how much trim he has to use to counter the MCAS commands, or even that there are automatic trim commands coming from somewhere inside the airplane. He’s flying manually, so why should the trim change? The autopilot, in his mind is off. The Auto-Throttle is off. So, he should have full control of the aircraft. Bue, he in reality doesn’t.

Leave a Reply

Your email address will not be published. Required fields are marked *