Bjorn’s Corner: Analysing the Lion Air JT610 crash, Part 6.

By Bjorn Fehrm

December 6, 2019, ©. Leeham News: We now finalize the series about the Lion Air JT610 crash by analyzing the changes Boeing has made to the aircraft to avoid further problems with MCAS (Maneuver Characteristics Augmentation System).

The changes bring MCAS to the level it should have had from entry into service and in some aspects further.

The fixing of MCAS

We start with a change that does not involve MCAS. When the 737 MAX fleet starts flying again the Angle of Attack (AoA) warning text AOA DISAGREE on the pilot’s Primary Flight Display (PFD) will be active, Figure 1.

Figure 1. The pilot’s Primary Flight Display of an updated 737 MAX. Source: Boeing.

For the MAX this warning went inactive due to a supplier incorrectly tying its appearance to the presence of the optional PFD AoA indicator (top in Figure 1).

The revised logic is the AOA DISAGREE shall always be available and after the crashes, the optional AoA indicator is a no-cost option for the airlines.

We now go to the changes made to MCAS and the systems participating in the augmentation function.

The original design

The original MCAS relied on a single AoA signal passing a threshold value for activation. This was allowed under FAR Part 25 for systems that had a safety hazard classification of “Major” hazard if things went wrong.

The Lion Air accident was caused by an AoA sensor which was incorrectly calibrated. It had a faulty bias of 21° AoA instead of 0°. For an MCAS function which is activated at say 12° AoA this meant MCAS was active from lift-off. Only the additional criteria of “flaps in” held it back until these were retracted. In the Ethiopian Airlines case, it was with high probability a bird strike that ripped off the sensor, causing the sensor rotor to swing to over 70°.

AoA failures like these are not common. The report states Boeing statistics show a total of ~20 failures over the last 17 years. To have two such failures a short time after another precluded Boeing from have fielded at fixed MACS before the second AoA failure happened.

The key problem was a non-fault proof trigger was combined with an unnecessarily aggressive MCAS function, trimming the aircraft’s nose down at a high rate in repeated activations. It could move a normal trimmed state of around 5° to full nose down (0°) in two activations if not countered with the pilot using his manual trim to trim against. This aggressiveness was not called for.

The aircraft needed one nose-down trim of 2.4° at the most (low speed and altitude) if it had passed into the nose-up happy region before stall. Subsequently, the nose-down trim is reversed once the AoA falls below the threshold. This re-passing of the threshold value would have been the correct reactivation criteria for MCAS, not the fact the pilot trimmed.

A pilot trims when a dynamic event is brought to a stable state. In a stable state, there is no need for further augmentation. The correct criteria for a re-activation of MCAS is the AoA has passed below the sensitive region and the nose-down trim has been reversed. Now the reactivation was the same as for Speed Trim, the pilot had trimmed. Why this can be the criteria for MCAS is not clear.

Finally, the original MCAS function had no global limit on its authority. At full nose-down trim, the horizontal stabilizer controlled by MCAS could outcompete the pilot controlled elevator. The aircraft would nose over when MCAS had trimmed full nose down irrespective of how hard the pilots pulled on the Yokes. Only trimming would have helped but it’s not in a pilot’s muscle memory to trim during correction of a nose movement, you trim once you have achieved steady-state and can feel the stick forces. Trim is to neutralize these forces for the pilot, not to control the pitch of the aircraft.

The revised design

The revised design, presently under scrutiny by the FAA and other airworthiness agencies address weaknesses in all three areas.

The trigger now is only done when the two AoA vanes on a 737 MAX agree there is a case of a high AoA, passing the threshold for MCAS activation. If there is disagreement between the sensors the MCAS function will be disabled. As argued in the last Corner this is OK as you can fly without MCAS and the probability this making the flying harder for the pilot for a flight with an AOA DISAGREE is practically nil.

Initially, this comparison was made on a sensor signal level. For the final solution, the check is done after the processing of the MCAS function. If there is a disagreement between the active function chain and the monitoring chain MCAS will be deactivated.

This improvement checks all sensors and processes who participate in MCAS to see there are no differences in computed actions.

An improved trigger is now followed by an MCAS function which checks the AoA value has gone below the threshold and the nose-down trim is reset before it can activate for a new augmentation. This should have been there from the first implementation. It’s difficult to understand how the team around MCAS assumed a trim action by the pilot means the augmentation is reversed and it shall be allowed to re-activate.

Finally, the updated MCAS can’t steal all pitch authority from the pilot. There is a global limit on how much trim nose down MCAS can command. The pilot is always guaranteed he can keep the nose level and pitch it up if he needs it.

The 737 MAX should now be safe

The Boeing 737 has a good safety record. The aircraft has no special vices and is void of dangerous modes like a deep stall or aileron or rudder reversal. The larger MAX engines called for a pitch augmentation to give the pilot a linear pitch feel all the way to stall.

The introduced augmentation to fix this had an uncharacteristically sloppy implementation. The uproar over how this could pass into a certified air transport aircraft was called for. But now the corrected augmentation is there. The enormous amount of work which has gone into the update has made MCAS one of the most analyzed and tested flight control augmentations ever. The updated MCAS is now safe, measured with any standards.

In my opinion, MCAS is now fine and we should turn to more pressing issues in our air safety work.

223 Comments on “Bjorn’s Corner: Analysing the Lion Air JT610 crash, Part 6.

  1. Great article and explanation thanks.

    Regarding pressing safety issues, it would be very valuable focus on perceived corruption in low cost asia airlines, using two log books, falsifying or buying qualifications, un-certified parts, the list seems long

    • A bit of an English disagreement.

      I would hope that Boeing is not Usually sloppy building software (ie full of bugs and killer features) rather than unusually sloppy with their software.

      In short, reading it as written Boeing is normally sloppy and in this case of MCAS 1.0 just more so, I don’t think that is the intent (hope!)

      I would rephrase that to something like, horribly sloppy software or unprecedented sloppy software for MCAS 1.0.

  2. @Björn Fehrm Will AoA disagree have any implication on the operation of the B737MAX in terms of MEL and restrictions in the flight envelope?

  3. “Lots of time invested”

    IMU and reading between the lines in Mr. Marco’s injection that time and energy ( at least from the US/BOEING/FAA side) seems to have been mostly spent in political agitation behind the scenes?

    Has the computational side now seen a major modular revamp/redistribution of tasks and has that been verified to be a robust solution ?

  4. Bjorn,

    What do you make of the 19th November email from Kim Marko, specifically the reference to “Not knowing the exact reasons for telling us that the 12.1 as a fix is not effective (ref. F2.3 recent change to CAT), the fact is that it is another point that was just discovered.”

    In the diagram, 12.1 is highlighted in red “MCAS Authority Limit to Ensure Pilot Control” – Does not prevent CAT – 12.1 Ineffective.

    Peter Lemme seems to think CAT may mean catastrophic.

    “the 12.1 changes, seems that there is issue with the circuit that preserves elevator authority driving uncertain acceptability.

    Note the CAT term, I presume is Catastrophic.”

    My questions would be:
    Who is telling Jim Marko that 12.1 as a fix is not effective, the FAA, or Boeing ?
    Does CAT indeed mean Catastrophic ?
    Does Jim Marko have a point, if the MAX is safe to fly with MCAS disabled, as it would be if the AOA disagree, why not remove MCAS, and certify it as a variant of the 737 as I think it’s pretty clear additional training is going to be required anyway ?
    If the AOA disagree, what is to be the procedure, divert to alternate immediately, or continue the flight ?

    I sense clear frustration in the email, Marko has marked the 12.1 section in red for a reason.

    “Authority confidence in robustness of the architecture and safety assessment – LOW” – From someone with a much better idea of what’s going on, that’s worrying.

    I do understand MCAS is there to meet the “linear pitch feel” regulation, but couldn’t they make an exception ?

    I’ve said this before, it doesn’t make sense to add a system that if it fails, creates a more dangerous condition than the issue that it is intended to mitigate.

    • “” I do understand MCAS is there to meet the “linear pitch feel” regulation, but couldn’t they make an exception ? “”

      Why should there be an exception? Because Boeing built 800 planes already? Why is Boeing even keep producing the MAX if they can’t be sure all regulations are followed with MCAS2.0 and MCAS in general? An software audit will be made for the first time in Boeing history. As if the audit won’t find mistakes!!!

      There can’t be an exception for this important regulation.

      If MCAS needs to go, Boeing has to follow the regulation in another way. There should NOT be excuses, especially if Boeing is circumventing regulations.

  5. Are there switches to turn off all automation and fly manually using back-up instrumentation only if the computers on the 737MAX does not perform as expected?

    • claes, Are you asking, if one were to pull the circuit breaker on the main Flight Control Computer, what would happen? Losing the new FBW yaw damper system, air data system, Speed trim system, MCAS, the full works? That’s a good question. They had an Air Canada 767 run out of fuel once (mistake of fueling with imperial / metric / gallons / pounds conversion), and suddenly the pilots glass panel displays went dark, and they only had a peanut gyro, compass and altimeter to play with. Luckily they were VFR and were able to find a place to land, but, I assume that’s one of the required tests for certification.
      You would be flying a ‘naked’ 737 at that time.

  6. Now the cut out switch procedure is taken away for Mcas? The EASA hsd some issus with wheel crankforce possibly needed a servo assistanse. Is this gone or will pop up again delaying an othervise good airplane futher?

    • Not gone but I don’t know where it stands in the issues though its separate but related.

      As it affects all NGs (the classic had two drives so I don’t know how they are affected)

      It gets into this should have been addressed long ago and I have yet to see an answer of any kind.

  7. Bjorn, I wonder if your closing lines perhaps have an unintended meaning? “The introduced augmentation to fix this had an unusually sloppy implementation. The uproar over how this could pass into a certified air transport aircraft was called for…In my opinion, MCAS is now corrected and we should turn to more pressing issues in our air safety work.”

    I take your word on MCAS as gospel. But is not the real safety question deeper than “what is wrong with MCAS?” (i.e. MCAS is solved, plane = safe, “move on to more pressing issues”), but what causal factors led to this sloppy implementation and fatalities? Of course, many experts and less-than-experts shared their opinions these last 12 months about culpability. Whatever the causal factors for MCAS faults, isn’t it at least reasonable to wonder if those causal factors infected other elements native to MAX too, but separate from MCAS and are maybe lurking like a virus for when the plane comes back in service? I’m not sure I follow the logic that we A.) We acknowledge sloppy implementation and processes at Boeing in MAX development, including (but not definitively limited to) MCAS and B.) The MAX is now safe, because MCAS is fixed. Wouldn’t it just be more correct to say “we can be sure the plane is likely more safe than before” now that MCAS is fixed? I just don’t understand the final leap of logic to “let’s move on, MCAS is fixed now.”

    Boeing’s defensive reaction following Lionair and preceding Ethiopian, was rather unsettling. Particularly given the second fatal event in March following their approach to Lionair. Although I am pleased MCAS is now safe I’m not sure how it solves for the underlying causal issues, if they exist.

    Regardless I am grateful for your insightful pieces.

    • Not a matter of if, an underlying causal must exist. From certainty at a qualitative level, doubts are raised at a quatitative level. The “aggressiveness”, in Bjorn’s words, of MCAS should be a good indicative of the aggressiveness of the cause: pitch up tendency. Unless this whole shananigan can be blamed on excess zeal in implementing a solution to a problem.

    • To both, I say move on to the next issue which includes any on the MAX.

      • I think part of the post was “are there any issues on MAX we don’t know about?”

        One area I continue to be very concerned about though it applies to NG as well is the Manual Trim System.

        While the force issue is one aspect (speed lock up and the frozen motor) also, how feasible is it to flip the handle out and grab it when (if) the wheel is spinning?

        • TW, no need to flip the handle out. The wheel can be grasped and stopped from the rim.

          I’m not sure about the wheel force but it may be that speed & altitude & therefore loading are the key issues. The MAX was operating with a 250 knot speed limit at the time of the crashes, but was well above that speed in the second crash. That was also well above the speed range programmed in the simulators, although that has since been fixed.

          We have not heard an outcry from 737 NG pilots on this issue. The comments I’ve read suggest their training is to not let the aircraft get too far out of trim. This means responding quickly to runaway, hence the memory item.

          • It would be interesting to know how much friction you need to apply.

            Pretty low geared obvious.

            Handle flip out to get any real movement (and small on NG as I recall).

            With a major seized motor breakout force and the hard movement unless you yo yo, just keeps coming back to me as a really bad backup system that should have been addressed two generations ago.

            One aspect of grandfather clause when it was deemed acceptably but no on would allow that now (granted FBW is done)

    • I think that you raised a very good point. MAX debacle brought light on a larger cultural and managerial issue at Boeing.

      Is it possible to design aircraft that would be 100% fault proof and safe in any given condition? No, because you always have variables that could go wrong, either in initial assumptions (e.g. gust / load lvel, crew reaction time), or manufacturing, maintenance procedures etc.

      How can you minimize chances of unpredictable happening? By having robust and technically sound decision making process, in both design and assessment of the risk when an issue is identified. At this point, I don’t have trust that Boeing has that process in place, or even culture to support it.

      IMO, original MCAS design was negligent, and the way Boeing dealt with aftermath of the first disaster and failed to prevent Ethiopian crash was criminal and warrants criminal charges.

      We know that 737 was granted a lot of exceptions over decades. Is there anywhere a list of these exceptions available? I tried to find it without success. Do I have confidence in Boeing’s review process and that we still have equivalent safety on 737 MAX for all these exceptions? No, I don’t, and my choice will be not to put family on one of their aircraft if I can avoid it.

      I think that the company does not deserve my trust, until they demonstrate they will take this lesson seriously and implement changes, and that goes beyond retiring or firing a few people.

      • Nick, Not exactly exceptions, but, a lot of historical changes are listed in the ‘original’ type certificate that has been amended many times over the years..

    • Bjorn, I understand that you have mostly if not absolutely settled the issue. My comment was not meant with the intent to reinitiate the debate in this corner, rather to express that the issue is only suspended in my view until a more opportune moment, ie. additional details that may come to light in the future.

  8. Few critical comments @Bjorn if you allow:

    1) “The updated MCAS is now safe, measured with any standards.” – Are you sure? I haven’t heard FaAA tested it live, nor EASA, nor I’ve heard even Boeing presented reMCAS to certification? I missed something or simply “paper PR words”?

    2)” The 737 MAX should now be safe” what about other flaws/issues eg. rudder cable shielding or changed for bad logic of trim cutout switches. I even haven’t heard that Boeing responded to them, not mentioning about even trying addressing it. So, MCAS fix = good to fly, forget everything else???

    3) How safe MAX is without MCAS working? As far as I know nobody knows is apart Boeing, which is still delaying tests requested by EASA.

    I’m afraid Boeingitis strikes again, am I wrong?

  9. Bjorn said: “AoA failures like these are not common. The report states Boeing statistics show a total of 17 failures over the last 20 years. To have two such failures a short time after another precluded Boeing from have fielded at fixed MACS before the second AoA failure happened.”

    Weren’t there three AoA sensor failure if you included the previous Lion Air flight with the third pilot that survived the triggering of MCAS?

    • IIRC it is counted as one failure per 1 hour flight time. JT043 should count at least for 2 failure events.

      • There were also 3 AoA disagree events in a previous flight of JT043 from 03:28 till 06:35. So these should add 3 more failure events, in total 6 from Lion Air and another one from ET302.
        Makes me wonder if Boeing really counted only 17 before, when we have 24 now. Sorry, I can’t believe Boeing anymore … “We Own Safety”

      • Correction:
        It were 20 failures before and now we should have 27 failure events.

    • It was the same failure, which because of missing AOA DISAGREE weren’t fixed.

      • Thanks Bjorn,

        how can it be fixed in flight. If a failure occures during a complete flight and the flight takes 2 hours it should count as 2 events, that’s how I read it in the reports. I could be wrong.

        Maint was working on the failure and the failure was reported as fixed. Not being able to fix it should count as a new failure event. These failure events should account for human mistakes too, not only bird failures flying into an aircraft.

      • You have to think about, why they use this failure form, “event per flight hour” and not “event per flight”. If you have a long transatlantik flight without failure the stats “zero event per 8 hours” looks much better than “zero event per one flight”. With this form “per hour” you can increase the calculation.

        Now in turn, you have JT043 and JT610, and Bjorn said “it was the same failure”. Now you change the system from “per hour” to “per flight” but not enough, you change it to “per two flights”. THAT’S HOW YOU PLAY THE SYSTEM TO YOUR ADVANTAGE.

        A previous flight on the FDR, from 03.28 till 06.35, there were 3 failure events, but at least within 4 hours. JT043 was within 2 hours and JT610 within 1 hour. ET302 was within 1 hour. So for these failure flights the calculation should be 8/8 and not 2/8 as Bjorn would like to count, the flight from 03.28 till 06.35 as one event, then JT043 and JT610 together as one event. Sorry Bjorn, but you are playing the system.

        So we have 8/8 for these 3 flights and Boeing counted 20 events in the last 17 years. If you check these 20 events you would find that these events are not within only 20 hours. BOEING IS PLAYING THE SYSTEM TO THEIR ADVANTAGE.

        • I only read it once @Leon but I think you are right – Boeingitis – curves the logic and tries to curve laws of physics.

  10. Did EASA have an opportunity to fly the 737Max without MCAS last month as they requested?

    Was this deemed unnecessary?

    • EASA wanted to flight test in mid December, but I guess they want first trying the sim and for that I think they need the software audit first, which Boeing never provided before.

      LNA reported about 5 certification steps and one passed the FAA, nothing new for weeks since then. Muilenberg asked for a certification date/timeline recently but FAA denied.

  11. To alleviate concerns over past MCAS problems, and to build trust in the new, improved MCAS, Boeing should fully describe the pitch up issue, with data for the 737-MAX. They should also show pilots the trigger AOA/Mach/Bank Angle schedule for MCAS. Why they don’t do this, is quite troubling. To try and say this is company proprietary technology, at this point, is plain unbelievable. You can’t fully evaluate if MCAS is now safe or not, without this description and data.

    If the “AOA Disagree” warning appears, has MCAS already triggered once for 10 seconds?
    (from the KNKT accident report)
    “… the “AOA DISAGREE” message appears on the Captain and First Officer PFD when the values of the left and right AOA transmitted by the ADIRUs differ by 10° or more for 10 continuous seconds.”
    I assume it does trigger, but, we need Boeing to fully describe the operational aspects of MCAS to know for sure.

    “AoA failures like these are not common. The report states Boeing statistics show a total of 17 failures over the last 20 years. To have two such failures a short time after another precluded Boeing from have fielded at fixed MACS before the second AoA failure happened.”
    Three AOA’s on 737-MAX’s actually failed.
    1) the original bad AOA sensor that had a different epoxy heat expansion problem that was the reason they replaced the AOA sensor prior to LNI043/JT610.
    2) the faulty calibrated, replaced AOA sensor that failed causing the 21 degree deviation.
    3) ET302’s bird strike, while technically not a sensor failure, caused AOA data failure.

    “The key problem was a non-fault proof trigger was combined with an unnecessarily aggressive MCAS function, trimming the aircraft’s nose down at a high rate in repeated activation’s. It could move a normal trimmed state of around 5° to full nose down (0°) in two activation’s if not countered with the pilot using his manual trim to trim against. This was not called for.”
    Why isn’t an aggressive MCAS called for?
    From a NYTimes article…
    “Yet a few weeks later Wilson and his co-pilot began noticing that something was off, according to a person with direct knowledge of the flights. The Max wasn’t handling well when nearing stalls at low speeds. Wilson told engineers that the issue would need to be fixed. He and his co-pilot proposed MCAS, the person said.”
    Boeing responded by modifying MCAS to have greather authority, taking out the G-force sensor that was originally in place, along with the AOA sensor, rewiring the stab cutout switches, taking out of the loop the runaway safety column limit switches. Again, without the data, we’re depending on Boeing and the FAA to tell us how much of an issue this is.

    “If there is disagreement between the sensors the MCAS function will be disabled. As argued in the last Corner this is OK as you can fly without MCAS and the probability this making the flying harder for the pilot for a flight with an AOA DISAGREE is practically nil.”
    With only Two AOA sensors, you can’t verify which is wrong, so the only option is to turn MCAS OFF. When does an AOA DISAGREE light appear? Just when danger of a stall increases. MCAS will be OFF, when that danger approaches. Boeing mentions in this article on AOA sensors that in certain pitching up events, that the AOA readings can be off quite significantly due to angle of bank etc.
    Pilots will probably notice how often the AOA DISAGREE light appears, but, only after 10 seconds of continuous limits hit. But, again, we have no numbers to evaluate how rare an event this might be. Once per aircraft lifetime, once per fleet lifetime? I think only seeing the data, and flying the plane with MCAS OFF can answer the question fully. If the plane’s controls lighten up etc. then pilots will have to be trained in simulators how to respond in AOA DISAGREE / MCAS OFF flight handling. Over-controlling pitch, when the stabilizers are mis-trimmed can lead to an AirDubai type accident.

    I’d like an MCAS ACTIVE light and an MCAS OFF switch It’s impossible to tell if the trim wheel is moving from Speed Trim, the other pilots yoke switch or MCAS. If a pilot see’s MCAS ACTIVE and it’s obvious it shouldn’t be (nose pointed down etc), then the pilot can switch off MCAS. Currently, his only option is to kill the entire electric stabilizer system. MCAS is quick and powerful operating on the stabilizer. I think there should be Three AOA’s or Two AOA’s and another G-force sensor for a three vote system. Turning off MCAS at the wrong time is not appropriate. I’d also like the column limit switches put back in place for MCAS. I think the STS trim system uses 4 degrees as their limit. I think maybe 75 lbs of force or other high value should be enough to say to MCAS, “You’re wrong, I want control, now”.

    Boeing hid MCAS changes from the FAA. Boeing and the FAA failed in their hazards assessment of MCAS originally. Now, they want us to take their word for it that everything is OK. But, they’re not going to describe or show us the details of the pitch up problem. It could be a very small issue, maybe just needing the FAA to authorize a deviation, with proper pilot training, and eliminating MCAS. But, it appears to be a larger issue. How much larger, only Boeing and the FAA know at this point. But, hiding the data doesn’t build public confidence. The ultimate test will be if the plane starts flying again. But, I don’t want to test, without seeing the data, with hundreds of lives at stake.

    • “” Boeing and the FAA failed in their hazards assessment of MCAS originally. Now, they want us to take their word for it that everything is OK. “”

      You have to think that the FAA are not software freaks. So how do they check software? Boeing said that they never provided an software audit during certification before. NEVER. Now EASA is in the process and an audit will be made for the first time in Boeing history. You have to think about how unprofessional they worked in the past.

      And the TAB in their preliminary report said that MCAS is following regulations and is safe. A system full of amateurs.

      All the power to Jim Marko who has a clue.

      • The FAA doesn’t check software. They check the artifacts form the software development process (see DO-178).

        That includes planning, requirements, testing, and verification documents. They don’t do code reviews.

        • So EASA is asking for an audit now. How can they ask for it. It might be because of regulations. Good EASA is doing this.

          The next question I would have, is the audit really independant. I read many audits (not software) and some had a strange view.

      • Wrong, the FAA have known a great deal about softwrae, look for presentations by Mike deWalt for example (though he retired years ago).

        (‘ST Dog’ points to what may be the case.
        In recent decades the emphasis has been on good development methods, which ‘ST Dog’ partly points to.
        And normal practice now is to define requirements for the software and test to them.)

        Keep in mind the FAA delegates to consultants and company people, as individual DERs or in a company organization called ODA or scuh which many manufacturers have. Many of the DERs are retired FAA people such as Mike deWalt.

        And keep in mind that MCAS’ problem was not software but requirements – a flawed approach to system design and safety review.

        • On December 11, 2019, Representative Peter DeFazio, chairman of the House Transportation and Infrastructure Committee, said that the committee’s investigation “has uncovered a broken safety culture within Boeing and an FAA that was unknowing, unable, or unwilling to step up, regulate and provide appropriate oversight of Boeing”.

          On December 11, 2019, Dickson announced that MAX would not be recertified before 2020, and reiterated that FAA did not have a timeline. The following day, Dickson met with Boeing chief executive Dennis Muilenburg to discuss Boeing’s unrealistic timeline and the FAA’s concerns that Boeing’s public statements may be perceived as attempting to force the FAA into quicker action.

  12. @Bjoern,

    You have two statements I would like to comment

    You say: ‘The revised logic is the AOA DISAGREE shall always be available and after the crashes,….’

    With ALWAYS, it should in my view include taxing take-off roll – perhaps aural alarm above a minimum speed. From the DFDR recordings we can see that the ‘AOA disagree’ was present during the take-off roll, and the flight could have been aborted in time before V1 (when readings should be stable/correct). Is it like this, or will it not ‘sound alarm’ till after rotation?

    You also say: ‘For an MCAS function which is activated at say 12° AoA this meant MCAS was active from lift-off.’

    I guess you mean ‘active from ROTATION’. But that aside, if I shall follow your logic; – wasn’t it active from the installation of the faulty AOA sensor’ (+ when the captain’s side was the AOA in MCAS use) – long before lift-off?

    In an earlier comment I asked you the following: If the AOA disagree alarm had been available, what would the most likely scenario have been?

    And; when the captain’s stick-shaker ‘takes off’ at rotation, shouldn’t that indicate an AOA failure on his side?

    And (last one); I guess Speed and Altitude Disagree Aural Alarms will be as before – if so, shall we assume that pilots from now on, will know the coherence between AOA and these alarms – as a MEMORY item?

    And (absolutely last one); your corner articles are both interesting and informative – and they seem the generate a wide range of views and thoughts from the commentariat – I can (almost?) live with that.

  13. To alleviate concerns over past MCAS problems, and to build trust in the new, improved MCAS, Boeing should fully describe the pitch up issue, with data for the 737-MAX. They should also show pilots the trigger AOA/Mach/Bank Angle schedule for MCAS. Why they don’t do this, is quite troubling. You can’t fully evaluate if MCAS is now safe or not, without this description and

    If the “AOA Disagree” warning appears, has MCAS already triggered once for 10 seconds?
    (from the KNKT accident report)
    “… the “AOA DISAGREE” message appears on the Captain and First Officer PFD when the values of the left and right AOA transmitted by the ADIRUs differ by 10° or more for 10 continuous seconds.”
    I assume it does trigger, but, we need Boeing to fully describe the operational aspects of MCAS to know for sure.

    “AoA failures like these are not common. The report states Boeing statistics show a total of 17 failures over the last 20 years. To have two such failures a short time after another precluded Boeing from have fielded at fixed MACS before the second AoA failure happened.”
    Three AOA’s on 737-MAX’s actually failed.
    1) the original bad AOA sensor that had a different epoxy heat expansion problem that was the reason they replaced the AOA sensor prior to LNI043/JT610. 2) the faulty calibrated, replaced AOA sensor that failed causing the 21 degree deviation. 3) ET302’s bird strike, while technically not a sensor failure, caused AOA data failure.

    Why isn’t an aggressive MCAS called for?
    From a NYTimes article…
    “Yet a few weeks later Wilson and his co-pilot began noticing that something was off, according to a person with direct knowledge of the flights. The Max wasn’t handling well when nearing stalls at low speeds. Wilson told engineers that the issue would need to be fixed.
    Boeing responded by modifying MCAS to have greater authority, taking out the G-force sensor that was originally in place, along with the AOA sensor, rewiring the stab cutout switches, taking out of the loop the runaway safety column limit switches. Again, without the data, we’re depending on Boeing and the FAA to tell us how much of an issue this is.

    “If there is disagreement between the sensors the MCAS function will be disabled. As argued in the last Corner this is OK as you can fly without MCAS and the probability this making the flying harder for the pilot for a flight with an AOA DISAGREE is practically nil.”
    With only Two AOA sensors, you can’t verify which is wrong, so the only option is to turn MCAS OFF. When does an AOA DISAGREE light appear? Just when danger of a stall increases. MCAS will be OFF, when that danger approaches. Boeing mentions in this article on AOA sensors that in certain pitching up events, that the AOA readings can be off quite significantly due to angle of bank etc.
    Again, we have no numbers to evaluate how rare an event this might be.
    Once per aircraft lifetime, once per fleet lifetime? I think only seeing the data, and flying the plane with MCAS OFF can answer the question fully. If the plane’s controls lighten up etc. then pilots will have to be trained in simulators how to respond in AOA DISAGREE / MCAS OFF flight handling. Over-controlling pitch, when the stabilizers are mis-trimmed can lead to an AirDubai type

    I’d like an MCAS ACTIVE light and an MCAS OFF switch It’s impossible to tell if the trim wheel is moving from Speed Trim, the other pilots yoke switch or MCAS. If a pilot see’s MCAS ACTIVE and it’s obvious it shouldn’t be (nose pointed down etc), then the pilot can switch off MCAS. Currently, his only option is to kill the entire electric stabilizer system. MCAS is quick and powerful operating on the stabilizer. I think there should be Three AOA’s or Two AOA’s and another G-force sensor for a three vote system. Turning off MCAS at the wrong time is not appropriate. I’d also like the column limit switches put back in place for MCAS. I think the STS trim system uses 4 degrees as their limit. I think maybe 75 lbs of force or other high value should be enough to say to MCAS, “You’re wrong, I want control, now”.

    Boeing hid MCAS changes from the FAA. Boeing and the FAA failed in their hazards assessment of MCAS originally. But, they haven’t described or shown us the details of the pitch up problem. It could be a very small issue, maybe just needing the FAA to authorize a deviation, with proper pilot training, and eliminating MCAS. But, it appears to be a larger issue. Hiding the data doesn’t build public confidence. The ultimate test will be if the plane starts flying again. But, I don’t want to test, without seeing the data, with hundreds of lives at stake.

    • Richard:

      What I see your reporting is a repeat of the fallacies around MCAS and the pitch up aspects.

      Do we need an MCAS off light? As its a non essential system? Pilots will be trained on its characteristics.

      I do not know if the column switch issue has been addressed.

      There is also considerably change in the computer interactions that is yet to be publicized how that affects the operations.

      If the AOA disagree by X amount (2 degrees?) then MCAS is off at lift off or whenever the vanes become effective on takeoff a whatever speed that is deemed they are flying right.

      As MCAS has many defeat mechanism do you want another light?

      Keep in mind the cascading of Alarms on the flight deck and the confusion that causes in actually flying the aircraft and masking problems.

      • “” If the AOA disagree by X amount (2 degrees?) then MCAS is off “”

        5.5 degrees difference

      • Richard cannot be repeating a fallacy: he is simply saying “show us the data.”

        Boeing/FAA should release:

        1. 737 Max limits to static longitudinal stability w/o MCAS.

        2. 737 Max fuselage Cm vs. AoA data.

        3. 737 Max AoA, Mach table for MCAS.

        • In saying he needs to see the data is a backhanded way or saying there is an issue.

          I will refer to Nancy Polosi and asked if she hates the president. That is a loaded leading statement wrapped up on a directional question.

          There has been massive focus on this and rightfully so.

          Nothing to date has ever suggested it had aspects other than the MCAS 1.0 being total garbage.

          In fact the very fact that turning it OFF was the correct response (if you knew it was going off the ranch) demonstrates that.

          And auto disable with AOA disagree.

    • Richard,

      The AoA Disagree alert has nothing to do with the state (active, inactive, off, on, whatever) of MCAS. This alert is standard on all NG’s and should’ve been standard on all MAX’s as well, but it wasn’t because of a screw-up. Independent of MCAS, an AoA disagree can cause altitude and airspeed disagree through mis-correcting the ADIRU’s, as well as erroneous stick shaker function like what happened during the crash flights. The pilots need the AoA disagree alert to help them trouble shoot and pinpoint AoA sensor problems so they can write up paperwork for maintenance.

      • In May 2019, Boeing defended that “Neither the angle of attack indicator nor the AoA Disagree alert are necessary for the safe operation of the airplane.”

        But Bjorn said it was a reason for the crash.

        Boeing people are useless. Let them clean the streets or something similar when not much brain is needed.

      • Mike, I though, with the new MCAS, that if the AOA DISAGREE alert appeared, then MCAS was inactivated, as one AoA sensor was deemed incorrect? That’s the last word I heard from the Aviation Week article. Maybe it’s different values, that they work off of? If so, that’s even more worrisome. Like the Eastern 401 accident, where the warning indicator and AP disconnect were not tied together.

        I wonder how an MCAS activation actually feels like on the controls now to a pilot. He’s pulling up, then maybe before the column lightens up, the MCAS trim comes in, which would put more force on the column, making a pilot maybe want to pull harder? It really has to be tuned quite closely to the required stick force bias, not to confuse a pilot.

        • Richard,

          I’m sorry I wasn’t clear. What I should’ve said when I said “The AoA Disagree alert has nothing to do with the state (active, inactive, off, on, whatever) of MCAS.” is, that while MCAS monitors the state of the AoA disagree to determine when it is enabled or disabled, the AoA disagree alert doesn’t depend at all on MCAS. The AoA disagree alert is on the NG (no MCAS) and has purposes well beyond MCAS. Bottom line though, when the AoA disagree alert is on, MCAS is disabled.

      • If the AOA is input into the airspeed and altitude, I can see how it is important.

        I’m still a little unclear on MCAS. To read the articles by journalists it sounded like MCAS was turned on by one AOA threshold, and moved at one set rate for one set duration, then a possible refire after five seconds, but maybe this is not the case.
        Versus more than one input, AOA and airspeed in various combinations turn it on. Or more than one MCAS trim speed or variable duration?

  14. This article is opinion not fact. It’s say move on. Not without the facts.

    Clearly the 737 MAX failed the test for the high speed nose up turn. It then failed the low speed flaps up high angle of angle of attack test. That means it would fail all elevated angle of attack tests.

    By deduction it’s the elevators. They don’t work. So responsibility was given to the stabiliser.

    But the stabiliser isn’t subject to fail-safe redundancy. So we are told Boeing re-wrote the FCC in less than 6 months. No they didn’t. They have used chewing gum. The regulators know it.

    No moving on without the facts. This article is not fact.

    • Philip, I think you still may be confused on the elevator issue. The added lift from engine nacelles causes a non-linear pitch-up tendency, at angles above 12 degrees, which is outside the normal flight envelope (apart from takeoff and landing with flaps/slats deployed).

      In order to correct for that with elevator alone, the elevator would have to grow in size and authority with increasing pitch angle. If you just make the elevator bigger, that will not remove the non-linearity, which is caused by a real force acting on the engine nacelles as pitch increases. It would just shift the stability curve, not straighten it. I think Mike Bohnet also explained this in an earlier post.

      MCAS effectively makes the elevator grow, by using the stabilizer to augment it. That is what provides the correction to the non-linearity. The stabilizer provides the necessary counterforce to the nacelle force, for correction. That is what MCAS was intended to do.

      I think Bjorn has been as factual as he can be. He also separates the facts he presents from his opinion, which is honest and helpful to us who are trying to understand and evaluate.

      • Boeing maintains the “feel” or handling explanation for MCAS. That would mean that another solution, such as a stick nudger, could have been used. It would have been inconvenient for various reasons related to both manufacturing and to certification, and in a related way to sales (as we’ve all seen).

        The semantics around this are somewhat related to the perspective taken: are you observing the airplane, or are you flying it? Fehrm has explained all of this quite well, but it’s still hard to grasp the difference. Two sides of the same coin, is the way I see it.

        A more serious pitch-up tendency would HAVE to be solved with moving the stabilizer or with other structural modifications and the nudger would not be a solution. That’s a guess — and we are ALL guessing if we lack the data. Anyone can draw a convenient graphical model.

        • Tem, the difference is subtle and has been open to question, as noted in the reports.

          In terms of formal definition, a nudger or pusher uses the elevator, takes control from the pilot, and thus is viewed as stall avoidance, prevention, or protection. This is well-covered in the regulations.

          MCAS as intended, uses the stabilizer, does not take control from the pilot, and is viewed as trim or handling augmentation. This is not as well covered in the regulations. The JATR report suggested that Boeing could have done an issue paper to have the issue clarified, and possibly more formally covered by the regulations. That would triggered the safety review of MCAS that was needed.

        • Rob,

          Let me clarify my “confusion”. But I have done it many times in previous posts. If the issue is at an AoA of 12° who cares. I certainly don’t. Equally, I would not understand if the regulators took a different view to me. An AoA of 12° is pre-stall. All the control surfaces will begin to get sloppy.

          I come to the Lion Air crash report. It uses the word “elevated”. This means it doesn’t use the word “extreme” or even “high”. An AoA of 12° is “extreme”, as in the extreme part of the envelope.

          I don’t care about “extreme”. Pilots should not go there. If they do, we do need to start talking about pilot error.

          But coming to the word “elevated”. Normal interpretation of the word “elevated” is anything above standard. Standard AoA is about 3° or less.

          The above I’ve said many times. This view that the issue begins at an AoA of 12° is just that, a view an opinion. If it’s true, I don’t know why Boeing developed MCAS.

          I come to FHA, functional hazard analysis. You must read the JATR report and the Lion Air crash report in tandem to extract this. The JATR report says Boeing designated the pitch instability issue as “minor” but designated MCAS going wrong as “major”. That’s a big no, no. Increasing the severity of a hazard by fixing a hazard is never allowed.

          I’ll end with situational awareness. Reading is a way of gaining situational awareness. Pity the pilots of the crashed airplanes were not given the right to read a procedure that would have saved them and everybody else.

          I’m sure Scott, given is words to me below, can agree that reading is important. Both the JATR report and the Lion Air crash report are damning and informative. I prefer those reports to this series of articles by LNA. This series of articles and the official reports cannot be further apart.

          But, both reports have an omission. When the pitch instability issue starts is not precisely defined. I’m a mathematician. I like numbers. I want numbers.

          The omission means I think Boeing are not telling. After all there is no reason to keep it secret if nothing is wrong. If it’s 12°, as you say, Boeing should be happy, very, very happy. By deduction.

          Let’s not move on until the facts are known. I want the numbers.

          • Philip, if MCAS engaged above 3 degrees AoA, it would be active in most flights. There would be a large history of operation to review.

            Typical AoA for cruise conditions would be around 1.5 to 2.5 degrees. So you are saying MCAS is needed for any deviation from normal cruise conditions. That sounds like a revisiting of the theory that the MAX is inherently unstable, and thus requires MCAS to keep it stable.

            Also if you look at the radar traces of the MAX test flights that are on-going, they are testing the wind-up turn at AoA above 10 degrees, as would be expected to investigate MCAS behavior. The exact MCAS activation value probably depends on several factors, and is not a fixed number. 12 degrees could be a typical example value, based on the pitch stability curve.

          • @Rob

            There is quite big failure in your logic in “if MCAS engaged above 3 degrees AoA, it would be active in most flights. There would be a large history of operation to review.”

            1) Nobody knew what was MCAS exactly until Ethiopian aircraft crashed.
            2) There is no light “MCAS acrivaded”, every time it’s active during no-crashed-flight.
            3) Boeing is still hiding how much instability causes new engines – nor data from Boeing / FAA, nor EASA testing.

            So how do you know, or anyone? Just you don’t. You simply speculate. We all do, because lack of tgis basic data. But you also assume about MCAS something it’s no proved, but from other hand MCAS is very spooky thing.

          • The world of circular argument. Pablo, thanks for picking up on it.

            Circular argument. It’s wrong because I say it’s wrong.

            Rob/Mike, you are experts. Brilliant!

          • There is no evidence to support the idea that MCAS is active at the levels Philip claims. He is speculating, I am reporting the knowledge which we have, and which is consistent with the findings of the reports.

            No report or regulator has stated anything like this. No pilot has commented that there seems to be another system in play, or that the trim wheels are spinning for any other reason than normal speed or Mach trim. Or that the wheels are moving constantly back & forth, as they would if MCAS or another system was being used to maintain stability of the MAX.

            Lack of evidence is not proof that somehting is being concealed. Philip has repeatedly accused me of circular logic because I won’t accept this.

            In his reasoning, proof is not required, it’s enough for him to suspect, and then let the other person prove the negative. But that is not formal or good logic or reasoning, because it’s usually not possible to prove a negative.

            That’s why we use an evidence-based approach, so that we can prove the positive instead. Philip has not proved the positive on this issue, nor could he be expected to, not due to his abilities, but because of the lack of evidence.

            It’s a form of speculation used by an obviously intelligent person who has said he is an engineer and mathematician. So he should know better, it would have been one of the first things he was taught in those professions.

            If additional evidence surfaces that supports his view, then he would no longer be speculating, but would be able to prove the positive. I eagerly await this, but in the meantime I will stick with what the evidence supports.

          • My collage roomate was a math major.

            Nice guy, real nice group of people who came to the room and talked over their math problems.

            What I found was that higher match is philosophy not reality.

            Me, I was building campground at the time and reality was what made sure I stayed employed. Actually all my jobs were reality based.

          • Rob, That’s one of the insidious things about MCAS. It hides in the trim wheel movements. How can a pilot know if the trim wheel is turning because of the other pilots yoke switch, the speed trim system, the A/P commands, or MCAS (MCAS probably trips the A/P off before issuing commands)? MCAS could have activated numerous times previously, but, ask a 737 pilot, if it ever happened to him and he couldn’t tell you. I’d like a light saying MCAS ACTIVE. That would at least alert the pilot, as to why the trim wheel is moving. 737 Pilots are so used to the trim wheel moving from speed trim, that they mentally block it out.

          • Richard, I agree the presentation of what’s driving trim needs to be more transparent, since there are numerous systems connected now. Indicators would be one way of doing that.

            Since the constant pushback we get from manufacturers is screen space and distraction, from human factors we know that color change is an effective method to convey information. So possibly a single indication space with multiple background color changes and data to represent the different systems.

            I might do it this way, using 8 characters of text:

            – Alpha character prefix and background color change to indicate system command origination

            – An up or down arrow or neutral dash, followed by a colon

            – the present target value in trim units, followed by a colon

            – the present stabilizer position in trim units

            So for example, if I see M^:41:25 with red background, I know that MCAS is trimming nose up, the target value is 4.1 units, and I’m presently at 2.5 units and increasing. So in one glance, I know what’s going on.

            This would cover MCAS, STS, MT, and column pushbuttons (both left and right side), as well as the cutout switch.

            I’m sure this is an amatuer viewpoint, but you can get an idea of what’s possible, even when limited to simple text. Graphics would greatly expand the possibilities.

          • @Rob

            You don’t know, because it’s imposible to anyone to notice if MCAS worked, but you from this assume that MCAS didn’t activate.

            You wrote “the wheels are moving constantly back & forth, as they would if MCAS or another system was being used to maintain stability of the MAX” exactly the same manner trim wheels moves when automatic trim systems activates on daily basis, multiple times during the flight. So how do you distinguish trim wheel movement by MCAS and by STS – simply, you can’t, it’s look exactly the same.

            Properly working MCAS would kicked 1 or 2 seconds, let say soft way, an then desactivate because aircraft reached safe levels. MCAS in failure kicks for 10 seconds bringing aircraft to the ground, in hard way.

            Have you checked what pilots wrote about irratic MAX behaviour in NASA database?

          • Pablo, I did check the NASA database and reported those results in another post, to answer a question from Al.

            As far as MCAS being active during flight at pitch angles of 3 degrees as Philip suggested, that would result in a much more rapid and shallow cycle movement. It would also be nearly constantly moving back & forth, if it was necessary to maintain the stability of the MAX as Philip suggested.

            It would appear as more of a limit-cycle or hunting behavior, possibly even a vibration. I think that would be quite noticeable and different from speed trim or Mach trim.

            If you’ve ever seen a stability control system, you’ll know what I mean. They are often based on derivative control, so they react to the slope of the change, in addition to the change itself.

            You mention 1 to 2 seconds as time constant, it would need to be shorter than that at 3 degrees target with the aircraft normally at 2.5 degrees. Unstable aircraft systems need to respond faster than a person could. But I don’t believe the MAX is unstable.

            I cannot imagine any reason that MCAS would be needed at 3 degrees, or even 6 degrees of pitch. There are no handling issues in that range, and other trim systems are already active. I don’t know what else to add.

          • @Rob

            Trim wheels “constantly moving back & forth”. From outside looks the same whem STS activates or MCAS activates in valid way. So you can only guess.

            “I cannot imagine any reason that MCAS would be needed at 3 degrees, or even 6 degrees of pitch. There are no handling issues in that range,” you still assuming there’s no issue at low values? Did you tested without MCAS? I believe not. FAA tested? Answer is not, MCAS hasn’t been submitted to external certification, and new is still not ready. EASA did? Not, they are still waiting for Boeing to give them that opportunity.

          • Pablo, there is no evidence to substantiate your statements on this, or Philip’s. EASA, FAA and others have tested the MAX with and without MCAS, and will continue to do so until they are satisfied.

            You keep telling others what they don’t know, but all the statements you have criticized are based on fact and evidence that have been clearly explained, in some cases at great length. You are welcome to provide your own facts and evidence as counter-arguments, if you wish.

            Telling someone else that they don’t know, or are uneducated, as a defense of your own position, is not a persuasive argument. It’s known logically as the argument from intimidation. Truly knowledgeable people have no need to do that. Bjorn doesn’t. Mike doesn’t, I don’t. The fact that both you and Philip do, speaks volumes.

          • @Rob, that’s a news from you: “EASA, FAA and others have tested the MAX with and without MCAS, and will continue to do so until they are satisfied.” where did you found it??? I mean a reliable source. Please be kind to share with us, because we all are waiting about a year.

            Re “Pablo, there is no evidence to substantiate your statements on this” well… if you think so, maybe I shall repeat… evidence: trim wheels are spinning and spinning as they were designed to spin, always the same way, and there is no warning light “MCAS activated”. Or maybe you know how to distinguish “spin, spin” kicked by normal working STS ??? and “spin, spin” kicked by normal working MCAS ??? Please tell us.

            I will not continue because I really would like to hear from in above two matters.

            You wrote some personal complaints about some people who disagree with you, but do you really have arguments?

          • Pablo:

            The reality you refuse to accept is Boeing tested the 737MAX without MCAS

            It was added latter in the program.

            EASA is welcome to grab any MAX in Europe and take it into the air and do all the testing they want with it on or off.

            To turn it off all you have to do is close the flap circuit (jumper it in my world).

            However, as they have all the data from the Boeing test they don’t need to, they can see what the MAX does without it.

            Frankly you sound like the Republican on Impeachment , its a hidden process.

            And then when its fully public, its not fair.

            Even if a meteor come in and hits you in the forehead you arn’t going to believe it, so just say so and we can get on with life.

          • Pablo, please note I did tell you.

            The spinning motions for MCAS as stability control at low A0A would need to be substantially different from STS or MT, because the function would be substantially different.

            If the motions are the same, then the functions would have to be the same, so MCAS would be redundant at low AoA since STS is already active and adjusting pitch at that level.

            MCAS was designed to address the non-linear accelerating pitch curve at high AoA, which is above at least 10 degrees, probably 12 degrees or so, as Bjorn indicated. In the region of 3 degrees to 6 degrees, the curve is linear so no need for MCAS.

            On the flight data, please note the regulators have access to the original flight data on the MAX, which included with/without MCAS, and also stages of development of MCAS. Also data from all the testing that has since been done.

            Mike Bohnet pointed out that this testing would have included tests without MCAS, or variations of MCAS, in order to quantify the effect and behavior of MCAS. That seems reasonable to me as well, it’s what I would do, is what any good testing regime would do.

            If the regulators want additional testing or additional scenarios, that is perfectly fine. But that doesn’t justify the assumption that something is terribly wrong with the MAX and is being concealed.

          • @TransWorld

            It not quite true.

            FAA never tested MAX without MCAS because this systems had been added in soft version at very early stage of testing. You can assume that instability is a soft, mild or hard issue, but you can only assume at this stage. Only Boeing tested it, and added MCAS, then hid it from anyone. If it’s all well known, why EASA would demand testing MAX with and without MCAS??? They can’t read???

            Neither EASA can grab any MAX for testing as you propose, because (1) they are private property, manufacturer like Boeing should provide one for testing, because during testing external sensors are installed to corroborate with electronics of aircraf and airframe is stressed, (2) there is a strict procedure called certification and EASA is sticking it.

          • @Rob

            I ask you straight question how you distinguish “STS spin spin” from “valid MCAS spin spin” and your tesis is “would need to be substantially different” but you don’t explain how. Very watering down, very inprecise. You just don’t know, like nobody knows.

            You continue “If the motions are the same, then the functions would have to be the same, so MCAS would be redundant at low AoA since STS is already active and adjusting pitch at that level.” and here lies a gap in your logic – both systems do exactly the same, using the same trim wheel and jackscrew – pitching aircraft, but they are kicked by different scenarios programmed in a computer chip.

            Just a hint, some very good pilots has spoken, that even a hard, invalid activation of MCAS which led to deadly crashes was very hard to diagnose as exactly induced by MCAS. And we are talking about normal, soft, valid activation of MCAS.

            My second question was where did you get information, which you presented as a bold fact, that FAA, EASA had already tested MAX without MCAS, and your answer was watering down, very imprecise. Don’t you think if that your untrue information presented as fact was true EASA would not demand testing MAX without MCAS? But demands, and sticks with it. You think they can’t read data?

            You claimed also that regulators has flight data about “all stages of development of MCAS”, hmmm… are you familiar with a fact that Boeing didn’t submitted hard version of MCAS to certification? simply hid it from anyone? So what the hack you are inventing, man??? Pararel reality?

            At the end. If anyone assume sth, or deduce sth, present it as an assumption or deduction, or supposition and explain from what you drew it. But please don’t invent “facts”.

            You can write some comment about “seeking true” or something, and add some inprecise generalities as strong arguments. But I’ve done with it.

          • Pablo, actually TW is correct.

            The inception of MCAS began after flight testing revealed an issue. It was the test pilot that raised the issue, based on the aircraft performance without MCAS. Therefore that data does exist, and the regulators have access to it.

            If EASA wants to explore that issue further, that’s perfectly fine, no one is stopping them, as TW pointed out. I’m sure they are trying to answer their own questions and verify things for themselves, and there’s no reason why they shouldn’t.

          • With all the hiding and cheating Boeing did in the past (sure they fear to get behind bars) you can’t expect that they are not manipulating further. I would check in detail and expect the worst. It’s the job of regulators to find the mistakes. I would expect that the audit has/shows mistakes. If EASA won’t find the mistakes, other regulators will, and how would EASA look like then. You can’t expect honesty from Boeing’s criminal bean counting management. Unbelievable they are still in power.

      • If you just make the elevator bigger, that will not remove the non-linearity, which is caused by a real force acting on the engine nacelles as pitch increases. It would just shift the stability curve, not straighten it.

        Rob, and I do remember Mike explaining it, that is a very good take away point. But I do wonder about something like an elevator trim tab easing the column forces transferring to the column and the pilot.

        The semantics around this are somewhat related to the perspective taken: are you observing the airplane, or are you flying it?

        On point: recently I was researching about this FEEL versus STALL, as far as I could understand both terms fall under Certification in context of AUGMENTATION. Which is what MCAS stands for. I was under the impression that a Stabilator (moving stabiliser) via STS (speed trim system) was meant to deal with STALL and an Elevator via EFS (elevator feel shift) meant to deal with FEEL.

        While this is logical due to the strength of effect expected from either control surface in terms of forces both aerodynamically and the reciprocal on the cockpit controls, Certification does not clear cut FEEL shift and STALL identification/prevention. What we can be assured of is that both approaches address airspeed via affecting pitch (and AoA), no matter if looking from the perspective of aerodynamic forces on the plane, or alternatively, from the cockpit control forces on the pilot. We can’t separate the former from the latter one is the reaction of the other.

        In both cases the objective is to prevent reaching a stall state, or in other words, a low enough speed about which lift becomes insufficient.

        Conclusion: The regulator leaves room for the manufacturer to choose how to address an imminent stall, still, how a manufacturer ultimately addresses it must be indicative of the magnitude of the issue it is dealing with or as appears to be the case… the magnitude of its negligence.

        • Vasco, trim tabs are replaced by the stabilizer trim, which is more effective and creates less drag. Either way you create a new control surface with separate controls.

          Trim systems aim to maintain and enhance pitch stability for the pilot. That includes all modes of flight, using various trim systems, and extends to stall conditions. So it applies both to stall and non-stall. MCAS targeted the non-linear pitch curve regime below stall.

          I guess in my view, this differentiates it from dedicated stall prevention systems, such as stick pusher or nudger. But if it is active in the stall regime, then you could also view it as stall recovery assistance, or even stall prevention.

          I think this is what the JATR report meant, when they said they could not rule out the possibility that MCAS was a form of stall prevention.

          It would be good to clarify that in the future, so the regulations are clear and address all the variations.

        • Vasco,

          The same argument of non-linearity applies to the trim stabiliser.

          All moment curves go off the cliff at some point. So it’s when the moment curve goes off the cliff, not if. If it start’s to go off the cliff at an AoA of 6° you in trouble. If it’s 12° or above, it’s not much to shout about.

          Please remember we are talking flaps up here. MCAS doesn’t activate with flaps down. A 12° AoA with a MTOW of 80 tonnes is going some. Indeed, I will be interested if it’s possible with a MAX. It will need massive down force on the tail and very powerful engines. Anybody know? Remember flaps up.

          Anyway, Rob’s/Mike’s argument isn’t valid. Moment curves always go off a cliff. So it’s when, not if.

        • Rob, yes the stabilator is there in place of a tab for trimming purposes. And I meant to say “magnifying” instead of “easing”, which would be the correct direction of the correction needed on the column. But this additional control could be strictly commanded by the FCC and seldom used if the flight envelope where AoA/load factor issues arise is so rare, only negatively affecting drag on those corners of flight, by remaining neutral and in line with the elevator most of the time.

          Philip, I don’t think the argument they were advancing was implying that moment curve cliff as conditional on the size of the stabilator, elevator. I think it implies only that by shifting the curve one is not solving the problem, only delaying it. If I do understand it, in your view, sufficiently delaying the onset of the cliff would constitute a valid solution. But also that delaying is the best possible solution since we will get a cliff no matter how “late” we’ll get it.

          Let me say, I don’t mind at all parsing these conflicting views, what I know is that they keep pushing me into the subtleties of aerodynamics, and I am fine with it. Thank you all.

          • Rob said: “The semantics around this are somewhat related to the perspective taken: are you observing the airplane, or are you flying it? … Two sides of the same coin, is the way I see it.”

            Again, I’m not sure I understand the issues, but there doesn’t seem to be any “same coin” in this discussion. Just coin … money — serious money. It is my impression that Boeing chose the route it chose — altering a 50 year old system to fit state of the art engines — because it was the cheapest and the fastest. It didn’t increase drag and decrease efficiency. It didn’t require expensive physical alterations. It seemed painlessly to update an old, inexpensive, tried and true system that budget airlines wanted because it was unusually cheap and they didn’t have to spend more money on training when they got it.

            Socks on a rooster.

            So, this doesn’t seem to be a semantic issue or one of perspective at all.

            What gets lost is that decrepit, slow, inefficient, jack screw being asked to rapidly respond to commands as if it were part of a fly by wire system; which it isn’t. It wasn’t designed for this use and, as they said, such a system would not be allowed in a recently designed jetliner. The Canadian engineers emphasized this point. It’s not just a matter of perspective. There are profound, physical consequences to the approach taken. It’s not like tweaking software on a true fly by wire system (though for some reason, Boeing is leading us to believe that it is just that easy).

            It might be irresponsible for the Max to fly before the report on ETS302 is finished. Was the AoA vane damaged by a bird strike — definitively? Was their slippage or unusual wear on the jack screw? Is it possible that MCAS is working much more than indicated — though its corrections are less aggressive when AoA sensors report lower degrees of angle of attack? (If they had opted for a system similar to a stick pusher, how much would it work?) Why is it not possible to find out exactly what the JATR engineers meant when they found the Max’s use of the stabilizer unusual?

            Why is there so damn much mystery about this airplane?

          • RealSteve I think you confused my comment with Tem’s. I did not say that.

            With regard to the lower-level MCAS activation, I addressed that in another post.

            Vasco, you’re suggesting an alternate method to achieve the same results as MCAS, using trim tabs on the elevator instead of the stabilizer. I can only respond that trim tabs are not usually found on commercial airliners, the technology has moved to the stabilizer instead, for the reason that it’s more efficient.

            Also on the stability curve issue, neither Mike nor I suggested that shifting the stability curve is delaying the issue. You cannot delay the issue unless you change the lift characteristics of the engine bodies. As long as that force is present on the airframe, it must be counteracted by another force on the airframe.

            If that force is provided by an elevator, it consumes some of the authority available to the pilot via the control column, thus overriding some aspects of his control. This is why trim uses a separate surface. If you re-center the column to compensate, that effectively masks from the pilot that he has reduced authority.

            For that reason, the stabilizer is preferred because it can be controlled separately as a trimming action, and preserves the pilot’s authority. Thus the stabilizer was a logical choice for MCAS. None of the reports have suggested that the function be moved to the elevator.

          • RealSteve, my comment format mislead you, sorry for that. The semantics point was indeed raised by Tem, and I do think it matters. because it is this semantics that allows Boeing PR to muddy the waters and focus on Feel as if it was totally unrelated with an eventual subsequent Stall, ie. pass the problem on at a level of cockpit control instead of at aerodynamic control. These can’t be separated, they are mutually tied together. Regulations even mention ratios between these.

            The jury is still out on your remaining questions, and as you put it a conservative but well advised stance going forward would be to wait for Ethiopian final report. Very high interests are involved pressuring otherwise. We’ll see the backbone of the regulator soon enough.

            Rob, replace “delaying” with whatever expression best describes the consequence of the moment curve shift in that direction which is understood as beneficial. It was not meant as a technical term. It is meant as opposed to the “early” onset of too lighter forces on the column versus the load factor. Of course if the curve is only shifting we might reach a point where we cease to comply with certification on its linear part.

            Regarding any suggestions of alternative solutions to the problem Boeing was facing with the MAX, at least from my part, they are very helpful in gauging the problem via any feedback exchanged. I have no preference for either one, it does force me to deal with the concepts involved.

        • Vasco,

          Good stuff. The cliff is there. It’s when the wing stalls. Nothing can be done about that.

          But, the tail should not lose authority before the wing stalls. A rule of thumb.

          There lies the problem. The tail is failing before the wing fails. Ergo, the tail can’t control the lift that is being produced.

          • Philip, aircraft are designed so that the tail will not stall before the wing stalls, since the tail is a control surface that is required for stall recovery. No aircraft could be certified with a tail that stalls before the wing.

            The “deep stall” characteristic of the T-tail was an example of where that design requirement could still fail, if the tail was caught in the wing wash, causing an early stall. That problem does not occur with a conventional tail like the 737.

          • TW, please don’t engage in the same dismissive behavior displayed by others. You generally present good arguments and viewpoints, so please keep doing that, it contributes greatly to the discussion.

      • As I recall ( possibly wrong ) Boeing already uses an hydraulic artifical feel system on the NG and ? MAX. And that the feel system increases the yoke feel as a funcion of ?? speed and AOA and ??.

        IF so, then a logical question might be- under the requirement to increase the feel to maintain a linear response, why not just add a factor to the feel system dependent on ” high” AOA, Speed, G limits, etc. and essentially making it near impossible for both pilots to move the yake any further aft ??

        This SLF must be missing something .. ??

        • Bubba, this has been discussed extensively in other posts in this column. Richard made this same point. I made an analogy to automotive power steering in my discussion, so you could search on that to find it, if you wish.

    • @philip: Your comment is opinion, not fact. Not that we’re splitting hairs, here.

      • Never said my words were fact. But they are deduction. Boeing are not telling anyone.

        I’ve repeatedly made clear that Boeing need to release the precise details of the pitch instability and the precise reason why the stabiliser is being used in this manner as opposed to using the elevators. I don’t know, you don’t know and Bjorn doesn’t know. Nobody knows.

        The reason we have been given for MCAS is not valid. It is not about making the MAX feel like an NG. That is fact, for it’s only necessary to recalibrate the feel computers to do that.

        It is also fact that Boeing have never admitted the existence of pitch instability. We had to wait until the JATR report and the Lion Air crash report for that. It is also fact that a trim stabiliser has not been used in this manner before; it’s use is unique. JATR used the word “novel”.

        We can then come to the facts about the FCCs. But that’s a long list.

        From the facts, I’ve made deduction about what Boeing is not telling. I’ve said that many times. I hope we can agree that it is unnecessary for me to repeat everthing I have previously said each time I make a post.

        The issue with Bjorn’s own logic, deduction or opinion was exposed by Richard. Bjorn in a previous article said just push the nose down using the control column. I agree, if the elevators work. I’m sure Richard would also agree. But more importantly, as Richard said, it means that recalibrating the elevator feel computers is sufficient to make a MAX feel like a NG.

        Bjorn’s opinion is that the pitch instability is trivial. Richard responded with a trivial solution, recalibrating the elevator feel computers. In other words, if Bjorn is right Richard is right. But the elevators must work. That’s the condition. The elevators must work in all areas of the envelope. Richard knows that.

        I’ve said it many, many times. It’s all about the elevators. I admit it is deduction and have repeatedly admitted it is deduction. Boeing are not telling so I can’t say it’s fact.

        Another deduction. On the ground for nine months for something trivial or minor. Boeing have money to burn.

        And another deduction. If it’s trivial or minor pull MCAS and let the pilots fly it.

        And another deduction. I’ll go with India’s DGCA. To paraphrase, only let the most experienced and able pilots fly the MAX, if the MAX is allowed to fly. By deduction, the DGCA don’t think it’s trivial or minor.

        Then the e-mails… And so on.

        Let’s not move on until the facts are known.

        But, let’s not split hairs. A “novel” use of a trim stabiliser at “elevated” AoA. The word “novel” is in the JATR report, the word “elevated” is in the Lion Air crash report. Perhaps LNA need to take on board those words. Just my opinion.

        To everybody, please don’t reply that MCAS1.0 was sloppy and MCAS2.0 will be the bees knees. I know the argument. I don’t believe the argument. Anyway to do a real duplex channel solution in less than 6 months – they made the decision in the summer to go active/active – is hilariously funny. If Boeing can do that, they can do a NSA in 2 years. By deduction.

        • I agree with you @philip. Problem is that Bjorn presents assumptions as facts, which shall not be allowed. When nobody tested anything or Boeing said anything measurable about instability or MCAS, but only watering down all the issues revealed in the process. It’s even now hard to make any positive deductions about MAX. We have just Boeing’s PR. No data.

        • Philip

          For what it’s worth, I don’t think there have been many invalid MCAS activations. Pilots that have flown the simulator with MCAS 1.0 have reported that they were surprised how aggressive the AND from MCAS was.

          Sorry I can’t remember off-hand the links to where I saw their comments.

          I would have expected to see reports from line pilots if they had seen an invalid MCAS activation. I would have expected the PR machine to have produced pilots, and evidence stating that properly trained pilots have experienced MCAS 1.0, and handled it without issue.

          Perhaps I am looking in the wrong places, but I just haven’t seen any evidence of the above.

          Now the pitch moment curve, and the feel of the NG. It’s taken me a while to understand it, if I indeed do.

          Here’s my take; the pitch moment curve of the MAX is not linear due to the behaviour of the aircraft at high AOA due to engine size, placement, tail cone changes etc. So the NG has a linear pitch moment curve, to make the MAX ‘feel’ like the NG it too must have a linear pitch moment curve. This is actually regulation, aircraft must have a linear pitch moment curve. Hence my confusion over NG ‘feel’.

          So pilot is pulling back on the column at high AOA, and the MAX wants to pitch up more than the NG, the pilot ‘feels’ the column takes less effort to pull back.

          So why not use EFS, just make the column harder to pull back. That would make the column heavier, but you still have the pitch increasing, so STS is modified by MCAS to move the stabiliser AND, this mitigates the increase in pitch, and at the same time increases the amount of force required to pull the column back due to the aerodynamic forces acting on the elevators.

          The elevators maintain full authority!

          Just how fast the pitch increases at high AOA is speculation, as is the angle of attack that triggers MCAS, BA are not saying, certainly in public, and perhaps not even to the regulators.

          We just have to wait, and see how this plays out.

          My prediction;
          BA will push as hard as possible to get the MAX in the air as soon as possible.
          The FAA seem like they are going to try to do the job properly, if they are allowed to.
          EASA will go along with the FAA as long as the FAA are allowed to do the job properly, if they are not allowed to do the job properly, EASA will do their own certification.
          TCCA, I think management wanted to follow the FAA, I think they have to be careful now that Jim Marko’s email is out there.
          CAAC, expect politics to play a part.
          ANAC, that could be interesting…

          I think if it’s not done properly, there will be leaks all over the place, and the hard data will end up in the media.

          • JakDak, this is a good analysis, the only point I would clarify is the effect of EFS vs MCAS.

            In an accelerating pitch situation, in order to represent that behavior correctly to the pilot via the column, you have to subtract force. The behavior of the aircraft is getting worse more quickly than the pilot can sense. This is the chief danger of an accelerating pitch. As Bjorn said, for the pilot the sensation is that control of the aircraft is evaporating for no apparent reason. This happens over the span of about 3 to 5 degrees of pitch, but above roughly 12 degrees, so it can feel pretty quick if you aren’t expecting it.

            But the regulations specifically prohibit subtraction, as it would encourage (makes it easier for) the pilot to get into trouble by continuing the pitch and transitioning into the stall regime.

            Therefore we have to add force with aerodynamics, which is what MCAS does. It corrects the force balance on the airframe while also adding force to the control column. Additionally, if the pilot continues in pitch, the EFS will magnify this force further by artificial means to discourage the pilot from getting further into trouble.

            The net effect of these things is that the column behavior satisfies the regulations, which in turn are meant to keep the pilot out of trouble, and the pilot is in fact kept out of trouble because the aerodynamics match the column behavior.

            If instead of MCAS, you used EFS to add force to the column, that might satisfy the regulations but it would effectively mask the impending loss of control authority from the pilot, which essentially defeats the purpose of the regulations.

            This is a subtle point but an important one to understand what drove the selection of MCAS. Boeing said they looked at other solutions, we don’t know what they were but at least we can see why MCAS would be included among them.

            It’s likely that as Bjorn said, an experienced pilot could deal with this, as well as stall, without any sweat. But the regulations are written to ensure it doesn’t happen at all, probably because it has happened at some point in the past. For every accident, there are attempts to break the chain that caused them. So most likely, this was a link in a previous incident.

          • Rob,
            If instead of MCAS, you used EFS to add force to the column, that might satisfy the regulations but it would effectively mask the impending loss of control authority from the pilot, which essentially defeats the purpose of the regulations.
            I think just the opposite is true. Adding force to the column matches the increase in AoA, as the plane is now pitching up more, the control force is more. Having MCAS work opposite to the pilot’s inputs is confusing. The pilot is pitching up with the controls, yet MCAS is pitching the plane down. The
            direct opposite of what he’s intending the aircraft to do. In the two accidents, the pilots were continuously fighting with MCAS. On the Lion Air JT610, I think the pilot fought with MCAS over 20 times. If MCAS had a column force activation, rather than moving a control surface (the stabilizer), then he’d be fighting the increased force, but, still controlling the aircraft (assuming MCAS didn’t add in 1000 lbs of force). You could limit the maximum force able to be applied to the column. What we’re taking about, sounds a lot like the Airbus Alpha protection system. And, the question of, if HAL (Fly-By-Wire), should have an OFF switch?

          • Richard, the EFS can add force to the column to represent the increasing sensitivity of the control surfaces to increasing airflow. In that case it represents forces to the pilot more accurately.

            It can also add force to discourage the pilot from pulling back any further, in situations where that might be dangerous. This intentionally misrepresents the forces as a warning, and to prevent the pilot from hitting the column cutout which would remove some of his trim protection.

            In the accelerating pitch situation, adding force would mask the softening of the column due to aerodynamic forces, so it would mis-cue the pilot, without adding any actual stability. It would just make the pilot think he had stability that wasn’t really there.

            At that moment, the pilot really needs to sense that the column authority is going away, at an increasing rate, because that is what’s actually happening. However to allow that would violate the regulations, because it’s exactly the aircraft behavior they are trying to avoid. So if we add force to the column here, it has to be through an actual contribution to stability, via aerodynamic forces. Hence MCAS.

            The only good EFS could do, is if it pushed the column over, which would use the elevator to add the necessary airframe force. That would work but then it’s become a stick-pusher system, is relying on the elevator, and is overriding the pilot. There are separate regulations for those systems, they are meant for being right at stall, last-ditch actions.

            In terms of what you said, that EFS increasing force on the column is matching the increasing AoA, that is true but that force does not represent any actual control stability or authority. It’s completely artificial.

            MCAS is preserving authority by keeping the aerodynamic forces balanced, to avoid the accelerated pitch. It’s not denying the ability to pitch, but the pitch will be more linear with the column force. With EFS, you wouldn’t be controlling the pitch acceleration, as MCAS does.

            What you said about pilots being confused and battling MCAS was a result of the malfunction. I don’t think they would do either with a correctly-operating MCAS, if they understood and were aware of it.

            The best analogy I can think of, is if you’ve seen American cars from the 50’s and 60’s, with the huge steering wheels and super-cushy power steering. You could spin the wheel stop to stop with your little finger, and this effortlessness was a big selling point. But you had no road feel at all, you could hydroplane or skid and never know until it was too late. That is like using EFS.

            Eventually the Americans caught on from the Europeans, and design for steering feel became important instead. If the front wheels begin to lose traction, you feel it immediately in the steering wheel. That is like using MCAS.

            Not a perfect analogy but hopefully it conveys the general idea, even though (like me) the reference is a bit dated.

          • @JakDak

            I agree that there weren’t many invalid MCAS activations apart both crashes. I can only reckon that pilots anonymously wrote about irratic MAX behaviour, which could be MCAS induced, in NASA database.

            But we know nothing how many valid MCAS activations were.

          • Rob, your whole last post now fits my initial intuition, or subsequent intuition corrections as the matter got deeper for the initiated (me).

            Nicely paced walk from an EFS not serving as a solution. We were not even engaged in an exchange which means to me that we have achieved, for the better part, language convergence too.

            Your contributions keep being very welcome.

      • Thank you for nailing one of the irresponsible speculators in this deteriorating thread.

        “Deduction” has to come from facts, but many people start with an emotion instead of facts, they try to use logic to justify their speculation and conspiracy theories As a famous philosopher said “check your premises”. ‘Intuition’ comes from subconscious processing of storeed information and values, the result _must_ be validated by the conscious mind. (In this thread ‘values’ of the troubled commenters is a big question.)

        So Bjorn’s earnest attempt to explain the situation the fated pilots were in has been ruined by anonymous speculating conspiracy-theorist jerks who failed to comprehend Bjorn’s earlier series explaining pitch stability. Even IF they say some sensible things it’s like milk in poison – doesn’t keep you alive.

        You are overdue for banning several people from wasting space, obscuring sensible comment with their blathering, and reducing motivation of others to take the time to read your threads. I doubt you tolerate that in your day job.

        • Keith,

          try to find Vasco da Gama’s post, it’s very long, it starts with deviding readers in 4 categorys a-d, I think it’s from December 11, not in this thread.

          • Keith,

            this is the thread:

            FAA: No MAX certification until 2020; analysis forecast 15 more crashes if MCAS not fixed

  15. I hope I’m wrong, but I think we need to be careful when taking information from Boeing at face value.

    Early on in this saga, after the Lion Air crash but before the Ethiopian Air crash, Björn wrote he expected MCAS to be fixed/changed soon and in the mean time pilots would know what to do in case the situation would happen again (paraphrasing).
    We all know what happened next, and how an MCAS fix hasn’t been implemented yet.

    I’m not trying to burn Björn for that statement, it was based on incorrect information from Boeing.

    How much of the conclusion MCAS will be safe is based on information coming from Boeing?

    • You have to imagine that Trump grounded the MAX, not Boeing and not the FAA, tells you everything you need to know.

    • Julian, your comments illustrate the complex interplay between manufacturer, regulators, airlines, pilots, public commentary, and the news cycle. This is a whole other aspect of this situation.

      I don’t think any of us would have predicted that we’d be where we are now, with the MAX. That is reflected in the range of opinion expressed in these forums.

      Some believe the problems are well understood, fixes are in place, we’re ready to move on. Others believe Boeing and the MAX should be burned to the ground, and salt sprinkled on the ashes. That controversy now has a life of its own, independent of reality or truth, driven mostly by opinion. Whatever happens with the MAX, that controversy will live long into the future.

      We see this also in the differing opinions between regulators, and even within the same regulator, as with the Marko e-mail. There is a tendency within our culture to diverge in opinion, rather than converge. That leads to unpredictability & uncertainty in the outcome. It’s really unfortunate.

      • Rob,
        What a major mischaracterization of the two positions. One is optimistic, careful, and rational the other is … crazy. I don’t hold that politics in the US are naturally polarized — but the commercial news media relentlessly trains thought on the matter by presenting one emergent side as mostly illegitimate. If you only knew how most of us believed in Boeing and loved its products over the years. I used to hate the look of most Airbus products. I hated the idea of complete fly by wire. And I was proud of the American aerospace industry. But the executives at Boeing have betrayed their workers, the public, and all dreamers with the very hasty, greedy, and unimaginative conception of the Max and the cheap sloppy way it fixed an aerodynamic issue and put lives at risk. It’s an embarrassment and a momentous setback that no amount of PR and wishful thinking will fix. You can blame the calculations and conjuncture of pessimists on this site, but this was not a normal engineering problem that lead to the deaths of nearly 350 people. It was not. And the fact that there is so much about this that the company still keeps a mystery is both bewildering and disturbing. It doesn’t inspire confidence. I simply can’t see why a corporation would protect as proprietary the details of updates it made to a 50 year old system? Whose going to want to copy that??? The world has moved on!

      • Rob, I will reinforce RealSteve’s, and moderate the “Boeing and the MAX should be burned to the ground” position, which is obviously an extreme position… I mentioned earlier that my initial approach to this MAX drama was as general as user interface wise. Indeed from a flight enthusiast position I always preferred Boeing control philosophy of a Pilot with hands on the “bare metal”, as I want to fly an aircraft instead of an algorithm. What Boeing achieved was precisely introducing an half backed algorithm, violating its own philosophy by preventing two pilots from flying its craft and in addition crashing them both. The former is excusable, the latter to an inadmissible extent is not.

        • Clearly Boeing violated their pilot control policy when they disabled the cutout switch.

          That said, when dealing with 10s of thousands of pilots, their view that pilots should always be able to put an aircraft in jeopardy is vastly outdated, if it ever was dated to start with.

          When control became boosted, you no longer had the so called pilots feel.

          NTSB urgency recommend that Boeing remove the FLCH feature of disabling the minimum speed/stall protection from auto throttle and the ignored them (which they can do under the US system)

          This is another case where auto throttle is not turned off by the pilot, its turned off by a mode change.

          Experienced 777 pilots call it the Flak Trap (FLCH).

          Frankly Airbus makes far more sense as the sensors feeding data to a computer can accuracy give you maximum bank or nose up safely.

          Frankly it does not go far enough in that you still have the modes issues. You pull the nose up and put full thrust it should auto shift from landing to go around.

          • TW, logically the column cutout was not used for MCAS because it would defeat the purpose. The column could already be at the cutout position when MCAS was needed.

            I believe that is also why it was not added back as one of the modifications for MCAS 2.0.

            As Peter Lemme pointed out, removing it may have been necessary, but doing so created the need to provide additional safety mechanisms, and also to explain clearly to the pilots.

          • Rob:

            I get it, but the illogical gets to me.

            I worked around coneyor r systems, there were rules of what was allowed to run auto start and what would not (if people could be by the belt ie loading stations it should not start in auto, the people at the belt had to start it.

            But, they then made the one belt both a loading station and a through belt depending on how the sort was being done. Then you could start it in auto evn though there were people by it. One whole train could auto start despite people by and loading each one of 6 belts.

            Same with horns, all belts had horns but two did not. Well you can see down them so they don’t need horns.

            Well you can see down the manual start belts as well but they have horns?

            What I call a logic bust.

            What it really amounted to was if they needed an out they ignored it or they forgot to add an alert and ignored that as inconvenient.

            I just fine Boeing so called philosophy totally flawed.

            Oddly until MAX 1.0, the safety record of Airbus and Boeing in the Single Aisle was equal.

          • Rob, Peter Lemme’s Oct 28th article is, as always, excellent reading.
            On the column cutout issue he has a few things to say

            By this interpretation of 25.255, the most mistrim you must demonstrate is three seconds. How can pilot response to stopping the runaway stabilizer be assured within three seconds? The answer lies in the aft and forward column cutout switches.
            The aft column cutout switch performs two functions.
            1. Stop the stabilizer from running away
            2. Limiting the level of mistrim to preserve elevator effectiveness.
            Boeing has used the aft and forward column cutout switches starting with the 707 and then including 727, 737, 747, 757, and 767. In all those airplanes, over all those years, the column cutout switches performed exactly as designed.
            He mentions the need to respond quickly, to a runaway trim event, and that previously the column cutout switches in other Boeing aircraft were used for this purpose. But, he doesn’t address how the 737-MAX pilots should respond quickly to a runaway trim event. The time to recognize the runaway event, and then take action, in enough time to avoid severe mis-trimming of the stabilizer, has been shown by the two accidents to be difficult to achieve. He also refers to this
            It was apparent, once the flight data was available, that the assumptions Boeing had relied on were not holding up. The level of mistrim was excessive. Pilots did not reliably respond within three seconds. Pilots did not always trim back to neutralize column forces. Pilots did not rely on manual electric trim to counter nose down trim malfunction.
            also, he mentions the need for an OFF switch to MCAS
            AC25-7D Paragraph 42 offers further guidance for stall identification, from which it seems that there should be a procedure to deactivate the augmentation, an OFF switch.
            We’ll have to wait and see what Boeing and the FAA come up with for MCAS 2.

      • Guys, I think these responses illustrate my point. I was referencing the wide variety of opinion that exists, the full spectrum from the MAX is ready & let’s move on, to the MAX should never be allowed to fly again.

        In addition, many of the opinions have been extended to involve Boeing itself, not just the MAX. Most of that is speculation, since we know little about the internal processes at Boeing, or their motivation.

        Most importantly, there is lack of convergence. Neither side can offer the other facts that will significantly alter their opinion. So it just becomes an endless dispute. That is the unfortunate part.

        When I’ve seen misunderstandings expressed as opinion or fact by others here, I’ve tried to explain and educate so as to narrow the gap. I hope I am also receptive to corrections that others point out in my own misunderstandings. It seems to me, that this is the only way to build consensus. First, there has to be a common understanding of the facts.

        In the Deepwater Horizon case, there were many parties involved, so the first step was a finding of fact by the court, which then formed the basis of understanding for all further action. That dispensed with many disputes and arguments, because it eliminated opinion as a basis.

        The closest thing we have to that is the accident reports. I’ve tried to use them as evidence and a finding of fact, rather than a basis for conjecture or speculation. Or if I speculate, I try to make that clear. That’s the best I know how to do.

    • The Atlantic Ocean has since flowed under the bridge and major information outside of Boeing has been presented.

      Boeing failings on the MCAS are close to (maybe are) unprecedented. The 737 rudder issue and the 767 Laudi Air crash being two that might rival it.

      The Rudder issue was so off the wall Boeing failing was in not looking at it.

      Clearly Boeing knew the MCAS issue as soon as the initial data from the Indonesian crash was available.

      To know and still issue a lousy response procedure ? That I think was way beyond the pale.

      • I agree on “way beyond the pale”. I can see how MCAS might not have been brought to the attention of the CEO or less likely chief engineer during development. But after that crash, the CEO and chief engineer should have been diving deep into the details and making the big money decisions. The company CVR at that point is really the missing piece of the puzzle. Maybe some day we’ll hear that story.

      • Lousy in hindsight. But at the time believed to be correct and effective. It was for their test pilots in the simulator. Besides, AoA failures are rare, they didn’t expect another failure before the fix was done.

        Instead a low chance bird strike caused another failure and set off a chain of events that led to more changes in the system.

        • No, lousy as soon as you saw the logic of one AOA (let alone an unbelievable aggressive degree of movement, repeating and ability to push it all the way nose down) .

          And Boeing has experience with this in 767 and 747.

          The illogic is so profound it defies logic and goes over the edge into insanity.

          Test pilots were not involved in the programs thoughts and logic and did not know the authority was increased nor was a rational test program laid for tests in all modes, method and means.

          That goes hand in had with the test pilots and the controls engineers not being co-located. That has been proven over and over again to enhance a situation to a good outcome.

          The FAA is fining Boeing for installing bad slat tracks – AFTER they were informed that they were bad.

          What kind of thinking is that? Purely nuts is what it is.

          • I don’t think it was just sloppy or incompetent engineering.

            I love reading this site and posting on it, but you can actually see the process that led to this debacle right here on this page. There are certain things that are obvious, but that are also hidden in plain site.

            Here we have engineers behaving like lawyers, advocating for a position that they call rational — and which, by the way, meant billions of dollars in profits. And then you have some dissenters who disagree.

            The word, groupthink was researched by Irving Janis, in the wake, I think of Jimmy Carter’s failed Iran Hostage Rescue mission. It discusses how smart, rational people can make idiotic decisions. The decision to put engines that don’t fit on the 737Max was idiotic. And now the world is in a big mess because of it. And its quite clear from this site, that groupthink is settling in again.

            One component of groupthink is marginalizing and isolating dissenters; characterizing their positions as crazy; questioning why they don’t just shut up and learn to get along with the group. It seems fairly obvious that Boeing is trying to rescue a failed system that never should have been built with more patches. Groupthink is settling in. It’s somewhat Orwellian. The language is shifting. Facts are shifting. Things that seemed serious now seem superfluous. Tasks that once seemed Herculean are accomplished in a few months. And now, serious Engineers with sterling reputations are vouching for system without knowing all the facts and details and before reading the final report of the crash of ET302.

          • Real Steve:

            While overall you are accurate, you then veer off into the TFH of the engine don’t fit the airplane.

            They in fact have not fit the 737 as the original engine were a fared not pylon engine.

            The fact that this thing is not radically unstable is????


            And a miner change in engines is going to whack out a perfectly stable air-frame.

            It totally defies logic let alone reality .

          • RealSteve, I would make the opposite argument about what goes on here. I have been insulted multiple times for my views, told they are rubbish, told I don’t know anything about engineering or aerodynamics, told I am nuts. That is the definition of marginalizing and isolation.

            No one has suppressed your voice or your ability to give your opinion. Just as no one has suppressed Jim Marko. The regulators have been careful to preserve his voice, and allow him to give evidence if he wishes, even if it’s not the dominant view. That is entirely proper.

            We have offered counter-arguments based on the facts as we know them. You are equally free to present counter-arguments for your positions. That is not groupthink, it’s just the testing of your assertions.

            In order for the discussion to be meaningful, though, there has to be a standard of reference. That reference should be the truth, as established as best we can, by facts and reason.

            None of us is born with a truth organ. We have no automatic knowledge of the truth. We only have our ability to observe and correlate information into a self-consistent narrative that is backed up by observations.

            We can speculate as to what might be true, that is a basic function of insight. But that has to be followed by supporting observations, evidence, and fact, in order to be considered true. Something cannot be true just because we feel it must be true.

            I’m sure you’re familiar with the X-Files slogan, “the truth is out there”. This is a classic alteration of the method which says that proof exists, I just don’t know what it is, or I don’t have access to it. But that kind of truth remains a belief, until it’s established with fact.

            The purpose of that thinking is to allow speculation without the need for evidence, you just assume the evidence exists.

            It’s frequently been said here that Boeing must release all information. The implication of that is as above, the truth exists but I don’t have access to it. But we know that the regulators & investigators act as our proxies, they do have access to it, and Boeing is required legally and ethically to respond. So do we trust our proxies or not? If not, that is a whole other issue.

            One advantage of participating in the forums is that there is a broad diversity of views. There is also an opportunity to test your views and see if they stand up. If I give an incorrect fact or reason and someone corrects me, that is ultimately a good thing for me, I am better for it. But for that to happen, my goal has to be identifying the truth, rather then whether I am right or wrong.

            If I am wrong, I am not marginalized by that. I am just wrong, and have hopefully learned something. If I persist or insist on being wrong, I cannot expect the facts to adapt to support me, I’ll just continue to be wrong. But being wrong is not a reason for the person not to participate in the discussion, or to be ignored or isolated.

            Again the goal is not an attempt by anyone here to isolate or marginalize or suppress a point of view. It’s just an attempt to identify and substantiate the truth.

          • @Rob

            What is the reason about all that whimping, man? I don’t understand. Nobody insults you here, or maybe I didn’t notice. If you are wrong someone points it out. You can agree with someones arguments or stick with yours, even into blind if you wish.

          • @Rob,
            Very well written and we’ll argued.

            It’s strange that the givens are so elusive for a system on which hundreds of thousands of lives depend. And in the X files, weren’t they speaking of nature and paranormal phenomena?

  16. Regarding the reset logic of MCAS originally, I think it was just held over from STS. Recent reading about the STS system mentions the 5 second wait after pilot trim resetting it.

    And that makes sense given MCAS (supposedly) was developed as an extension/variation of the STS function already in the FCC.

    Similarly I think the lack of total authority also came from STS. I’ve seen nothing that says STS has any limit on how many times or a total movement it is allowed.

    So they just assumed that STS was safe and didn’t add extra checks to it. Just a new function with new inputs, but most of it stayed the same.

    As for elevator authority, I’ve read several places that the elevator is supposed to have enough authority to counter full AND stab under normal conditions (an FAA requirement). The problem was speed reducing the elevator authority when the aircraft exceeded Vmo.

    • This all rings true according to my reading, except for the last sentence. It’s unlikely that it was fine up until Vmo. Some simulator tests have shown otherwise, if I recall correctly. The bigger problem was the failure of the Mach table to account for the low altitude + high airspeed. Fehrm went into this in some detail months ago.

      • Either way, there appears to be a loss of elevator authority at higher speeds. Perhaps below Vmo, certainly above Vmo.

        That comes back to the same conditions with the NG and not getting severely out of trim. The MAX just added a new path to get out of trim.

        Maybe someone knows the regs better and can find some info on elevator authority requirements. I’m a software guy.

      • I’ve searched the regs, it is hard to compare due to the following:

        > STS, stabiliser, trim augmentations are bounded in terms of airspeed deceleration rate (knots per second)

        > EFS, elevator, augmentations are bounded in terms of force magnitude (pounds)

        From Title 14: Aeronautics and Space – Chapter 25

        25.173 Static longitudinal stability.
        Under the conditions specified in §25.175, the characteristics of the elevator control forces (including friction) must be as follows:

        (a) A pull must be required to obtain and maintain speeds below the specified trim speed, and a push must be required to obtain and maintain speeds above the specified trim speed.(…)

        (c) The average gradient of the stable slope of the stick force versus speed curve may not be less than 1 pound for each 6 knots.

        (c) constitutes a significant bound, but the whole section is informative.

        • Yes, that explains a lot. I was curious about this, (5) The center of gravity position that results in the highest value of reference stall speed. So if the COG is forward, that is more force on the tail, and more downward force on the wings, so the highest stall speed is COG forward?

        • What are the two pitch stability tests in question?
          Must have (c) 1lb more stick force for 6 knots decel

          1) level test to stall at max decel of 1 knot per sec
          2) 30 degree bank turn to stall at max decel of 3 knot per sec

          Is this correct?

        • Ted, don’t mistake me for a specialist, I am but an enthusiast, “highest stall speed is COG forward” is correct as long as CoG is forward of CoL. An increase in lift must counter the also increased tail down force the forward most is the CoG to keep the balance. More lift implies increased speed following the regulations equation in §25.103 defining stall speed.

          Maybe those would be the relevant ones regarding MAX but §25.175 mentions 4 tests (climb/cruise/approach/landing) under specific configurations for compliance regarding stall.

  17. Thanks for this article. I’ve never read and want to know re the 737MAX before the awful fatal crashes. How many flights in the US had MCAS “issues”? How many flights in US had to flip out stab trim switches incl deactivating CMD and or AP?
    And the same questions for flights around the world

    • Al, there haven’t been any flights in the US where MCAS was reported to have engaged, as it did in the accident flights, and one other flight on the same aircraft that preceded the first accident flight.

      All of those incidents were initiated by failure of an AoA sensor. As Bjorn described, that is actually a fairly rare event, roughly 20 (or 27 if you count multiple instances of the same sensor based on flight hours) in the last 17 years, out of many thousands of flights and millions of flight hours.

      The first AoA failure was actually a mis-calibration of a refurbished unit, performed by a Florida shop which has since had its license suspended. The sensor was not tested as required, after installation by Lion Air. The second failure is believed to be from a bird strike.

      There were two reported incidents of US aircraft experiencing a brief nose-down movement upon engagement of auto-pilot. But those were not related to MCAS. I don’t believe a cause was found for that behavior in either flight.

      I don’t know of any where the trim cutout had to be used, and I don’t know about outside the US at all.

      The 737 MAX model doesn’t have a lot of data accumulated because it was a relatively new model and less then 200 were in service at the time of the grounding.

      • @Rob

        Regards to “there haven’t been any flights in the US where MCAS was reported to have engaged”.

        You will never get reported MCAS activation because there isn’t “MCAS activated” light or alarm. It was hidden in Speed Trim System in unrecognisable way, and hidden from knowledge of anyone: pilots, airlines, regulators. Until it crashed twice. Maybe it was activated few seconds, maybe soft way. We just don’t know.

        If I remember well there were few reports about MAX irrational behaviour (probably MCAS hard activation) in NASA database runned for FAA, which reports FAA failed to see, until MAX crashed.

      • Rob,
        You say, “The first AoA failure was actually a mis-calibration of a refurbished unit, performed by a Florida shop which has since had its license suspended. ” This is not true. Didn’t the AoA sensor first fail on JT043? Wasn’t it then replaced? And then the replacement on JT610 failed because it wasn’t properly calibrated or installed. So we are actually talking about two, separate AoA sensor’s here, aren’t we?

        • RealSteve, the failed AoA sensor involved in the Lion Air crash was mis-calibrated. The sensor that it replaced, as far as I know, did not cause an incident.

          Al had asked about MCAS issues. I reported those that I had found in my research. If you have others to report, please feel free to do so.

          • There is no miscalibration around. i.e. no adjustment provided.
            There is only testing for an OK/fail procedure..

            IMU: The shop in Florida never tested the second resolver output.

          • Uwe, from the Lion Air final report, the testing instrument is believed to have had a Relative/Absolute switch set in the wrong position (Relative) during calibration/testing of the resolvers (pages 90-91).

            After introducing an intentional bias in assembly, they were able to show that calibration/testing in Relative mode could allow a 20 degree bias to be undetectable at the time of testing, but apparent when installed with the aircraft avionics, which effectively work in Absolute mode.

            Also that the standard model test instrument did not have this switch, so this may not have been understood by the technician performing the rebuild.

            So I saw this as two errors made during rebuild, first an error in assembly, then an error during calibration and testing.

            Calibration in this case may be just setting the zero position, as the span is mechanical. You may have better knowledge of this than I.

        • @RealSteve & Rob

          The first AOA sensor that failed had a broken wire wire in one of the AOA sensor winding. The result was that the AOA worked or didn’t work. This caused no MCAS actions

          However, the lack of an AOA reading generated airspeed/altitude disagree alarms. This lead the mechanics to believe it had something with the pitot tubes to do, – so the worked on them. They didn’t know the connection between airspeed/altitude readings and the AOA.

        • That is correct but its also what Rob said.

          The first AOA was exhibit erratic behaviour. Not uncommon in electronics.

          It was replaced by a perfectly fine AOA, but the AOA was not calibrated

          1. By the Florida Shop (required)

          2. Confirmed to read right by the Indonesian Avionics tech who replaced it (required) .

          The second AOA was not a failed unit, it was a two level system failure.

  18. Just wondering if the correction to MCAS re AOA issues works the same way for excessive nose down AOA readings, thus forcing a NOSE UP MCAS to stabilizer trim etc etc ?

    • Bubba, MCAS does not respond to nose down, as there is not an issue with handling at that condition.

      • Hmmm- perhaps an addition of a gear train internal to the AOA plus a d shaft insteacd of a mickey mouse set screw might be considered. Thus – a bird strike or similar woould rersult in the counterweight- gravity movement such that the resulting signal would be xx degrees nose down output, instead of yy degrees nose up ?

  19. 1) I’ve heard that implementation of a fix before the second accident was also influenced by a government slowdown during that time. True?
    2)Was the elevator’s inability to overcome the stabilizer force exacerbated by the airplane traveling way over max speed because thrust was never reduced?
    3) I’d love to her your thoughts about the similar change in pitch force due to the A320neo bigger engines, and how that was handled.

    • Ande, to answer your questions:

      1. There was a government shutdown but it’s not clear how large the impact was on progress. Boeing said it delayed 5 weeks, the FAA initially agreed, but then reversed and said it wasn’t significant. How much of that is politics, we don’t know. We do know there was disagreement during that time about the extent of the changes.

      2. Yes, the control forces vary as the square of the speed, so they are vastly greater as you approach or exceed Vmo. The pilots were initially able to compensate with elevator, and continued climbing at a low rate, until the last 20 seconds. At that point, speed went above Vmo and also MCAS had been reactivated, which brought the stabilizer near full AND deflection again. The control forces were very large so they had to work together, but they momentarily got the column full back, without being able to recover the aircraft.

      3. The Airbus FBW system contains a comprehensive aerodynamic model of the aircraft, as an integrated package. Thus whatever the aircraft characteristics are, they are fully embedded in the FBW control law, with the computers having full authority. So there is no need to specially handle exceptions with a separate discreet system, as is necessary in the Boeing system where the pilot has full authority, and systems are built around the pilot.

    • @AndePac

      I partly desagree with @Rob point of view, so here it is my take:

      1) False. And lame excuse. If you have dangerously flawed product you fix it without waiting for anyone. Boeing didn’t need FAA to be told to fix it and how, it’s Boeing as manufacturer responsability from A to Z. None MCAS fix yet be done officially, and it’s a year form Lion Air crash.

      2) B737 has small elevators comparing to stabilizer. Yes, faster you go, smaller surfaces like elevator becames less effective. What peoples forget tbat Addis Abbeba is high&hot and MAXs doesn’t like such conditions. If you’d like to climb in high&hot you have to have full of trust, otherwise you fell, and Ethiopian pilots didn’t want to fell down. One of the insidious things of MCAS is that you get “Unreliable Airspeed” warning. You can only guess, you guess wrong – you fell down. But we have to wait until Ethiopian report will be published.

      3) A320 is full Fly by Wire so it’s not a big deal to tweek it right, and A320 has a longer landing gear so engines didn’t have to be moved forward like in MAX, and nacelles didn’t have to be flattened, so significantly less influence they have to the stability of the aircraft.

  20. I wonder about the wisdom of making such strong statements and recommendations before the report on ET302 has been completed. Is it more than conjecture that a rare bird strike took out the AoA sensor? It seems the discussion of this sensor has morphed a bit. I thought they failed at a higher rate and we’re much more vulnerable than this article suggests.

    • There is a difference between logic and conjecture.

      When an AOA is perfectly normal until you are in the air and then suddenly goes to 70 degrees, its extremely likely a bird strike.

      As the nose impacted first, all evidence is gone from that impact.

      Any instrument failure data and assessment should account fro all failures from internal to external.

      I believe Boeing used just internal. And that even assumed correct test before install. Which did not happen in two parts of the AOA replacement.

  21. An aircraft (for the matter any man- mafe system) is “safe” only after implementation in test flights & getting feedback over hundreds of testings to tweak & tune the systems. No paper analysis alone, is sufficient to certify that something is safe. So i am sorry, your article and perspective/ approach seems FLAWED.

    • Koh, with respect, the MAX has undergone something like 1,000 hours of fight testing with the modifications Bjorn is citing, and helping us all to understand.

      That has been done in conjunction and with the oversight of safety regulators from around the world, some of whom provide their own pilots for independent assessment. There is probably more testing yet to come, before we see the MAX again.

      That is about 20% of the flight time expected to completely certify a new aircraft type. So all of this is being carefully reviewed and tested, that’s why it has taken 9 months. It is most definitely not a paper analysis.

      • Rob,

        Actually the 1000 or so hours are what’s worrying me. BA seems to have started working on MCAS immediately after the Lion Air crash, this is a lot of time to deal with a software issue. I write software, and to me this is indicative of how difficult MCAS is to do correctly given the hardware, and other limitations that BA have.

        I do wonder if Jim Marko doesn’t have a point, remove MCAS, train the pilots to deal with the non linear pitch moment.

        So it’s not an NG, and pilots will need a little more training.

        I struggle with the idea of adding more software complexity to attempt to make sure that a system that is implemented to mitigate a minor issue doesn’t present a major or catastrophic hazard if it fails.

        • JakDak, the testing and effort are not just related to MCAS, but to the reconfiguration of the FCC’s to dual master. That is a very significant change. Philip has expressed doubts it can even be done (or done well) within that timeframe.

          This probably greatly outweighs MCAS in terms of effort, but it has allowed time for the regulators to do additional evaluation of MCAS, and make additional requests prior to MCAS testing and certification. I think that’s been a good thing.

          The regulators are free to make Marko’s requested change if they wish. My guess is they would be very reluctant to lower the bar for the MAX. Politically that would send the wrong message to Boeing, would appear to the public as a capitulation to Boeing, and result in endless criticism that the MAX is uncertifiable. So I don’t think they have much choice but to work with Boeing to ensure the MAX is compliant with regulations.

          I hope that in the future, they will address systems like MCAS more clearly in the regulations, so we don’t end up in a mess again. There should be the same clear safety requirements for handling augmentation as for other flight control systems. Then Boeing would be mandated to follow and it wouldn’t be optional or arbitrary.

          I agree that a correction to a minor issue cannot itself become a major hazard, which did happen with MCAS 1.0. So the effort has to be invested so that MCAS 2.0 does not create a major hazard. Or another solution found, but that seems unlikely after all this time, and with so many observers. I’m glad that many eyes are on that besides Boeing. I think the more the better, even if it does slow things down.

          • @Rob

            Regards to “I hope that in the future, they will address systems like MCAS more clearly in the regulations, so we don’t end up in a mess again”

            There are clear regulations about systems like MCAS – it’s called FBW system. Someone likes it or not MCAS is a piece of FBW technology – it behaved like one, and should be certified as one.

        • @JakDak

          It would be great infamy for Boeing to remove MCAS, especially after they announced to reconfigure FCCs to Dual Master. But mayne Jim Marko’s proposition is the only feasible solution, assuming that unstability issue is not so big, which should be first tested & revealed.

    • Have you stopped driving?

      Last yearly death count is 25,000 or so a year (does not count maimed)

      Hospital and doctors kill 250,000 a year. So don’t go to the doc either.

      • US road toll is much higher than that , it’s 36,000 plus and had been falling.
        That’s a bit less than all ‘gun deaths’- homicide, suicide and accident. Then there is work place deaths , another 5000 or so. Some jobs you wouldn’t want to go back to like logging with a very high death and injury rate

    • @Greg,

      it reminds me about an episode on the next to the last day in 1979 (!!). I was travelling with SAS from Copenhagen to LA, – via Seattle – in time to reach the Rose Ball game. When approaching the aircraft – I could hear a lady screaming and yelling; I later learned it was at her husband: YOU PROMISED IT SHOULD NOT BE AN DC-10. But it should be a B747 he said, – but she refused to believe him, When I came up to the couple, I came to the husbands assistance, – a B747 was scheduled for today, but yesterday it had an incident at the airport the and had to be replaced with this DC-10. I have traveled with DC-10 many times – I said – and I am still alive.

      After 15-20 minutes of talk we managed to convince her to board, and travel as planned. I discussed with the couple while underway, all kind of topics, including airline safety. When we landed in LA she was relaxed, and hopefully with a revised view on air travel safety. Good food and excellent wines helped as well in taking her mind off the negative thinking

      Two days later the USC Trojans defeated the Buckeyes from Ohio State with one point (17-16)

  22. Björn writes:
    “AoA failures like these are not common. The report states Boeing statistics show a total of ~20 failures over the last 17 years. ”

    That number is likely false and the real number must be much higher.

    Peter Lemme wrote:
    “A single AoA vane malfunction (actual rate is around 1E-7, declared rate is 1E-5 malfunctions per hour) ”

    In another piece Lemme wrote:
    “Reliability of the AoA sensor was evaluated over a 4-6 year period, with a mean time between unscheduled removals was 93,000 hours. A typical airframe is modeled at about 100,000 hours, so the AoA vane typically last nearly the lifetime of the airplane.”

    Does Boeing truly have statistics over AoA failures? Is it necessary for airlines to tell Boeing when an AoA sensor fails? If not how would Boeing know?

    Why would there be third party refurbishing companies for AoA sensors if those failed only 20 times over 17 years?
    That would not make any economic sense.

    • Erroneous AOA signals are not frequent events. Boeing reported that 25 activations of stick shaker mostly due to AOA failures occurred in 737 aircraft for the past 17 years during more than 240 million flight hours.

      (Lion Air final report p195 – my emphasis)

      Maybe Bjorn found a source to quantify the “mostly due to AoA failures” statistic.

      At the time of the accident roughly 250 737 MAX aircraft were in service with assumed average utilization of 2,000 flight hours, with the total accumulated fleet at 500,000 flight hours. With two AOA sensors installed on each aircraft, this means a failure occurred on the 737 MAX every 1,000,000 flight hours (1E-6), more than the requirement probability of 1E-7. The same AOA sensor is used on other aircraft and the AOA failure rate is even lower.

      (Lion Air final report p196)

      What is missing here is that any previous AoA failures were not as consequential (and catastrophical at that) as AoA failures in MAX and its MCAS fed input. What Boeing did was put the safety of the flight depending so much on a unreliable item, when this had never been the case before.

      • Think there is a problem with how failure rate of AOA is tracked.

        a) intrinsic failure due to wiring, temperature, wear, assembly faults, etc

        b) failure due to ramp rash, bird strikes, installation errors, freezing,
        lubrication errors and similar

        c) incorrect reporting of AOA failure which later found out to be in error when investigation showed another problem-issue at fault.

    • AoA sensors are pulled for maintenance and repair. That doesn’t mean you have an in-flight failure that results in a reported upset. In a good maintenance program, you wouldn’t wait for failure to replace worn or questionable parts. The aircraft has maintenance logs which report anomalies so they can be addressed before failure.

      If anyone can find instances of in-flight failures that have not been considered by Born or Peter or EASA or FAA, or any of the many others that have looked into this, now would be the time to present them. I’m sure that information would be highly valued.

      • Rob:

        I don’t get the ref to maint.

        I don’t know if the AOA has a specified lifetime and a pull to replace or repair.

        Usually if they fail in flight its a erratic or full failure which result in bogus data. Not sure a bird strike is so much a failure as an incident that results in a destroyed AOA that is the same affect.

        As noted by Indonesian the erratic AOA developed on one flight so there is was no warning.

        It could simply have failed as well.

        Probably the most common question I got from the office people when I was working on their air boxes was “why now?”
        Uhh because it was its time.

        Often the same identical looking electronics wold fail and the replacement never fail again or there would be erratic patterns of failures. You wold know it failed from the symptoms but not how long it would last, ergo – no prediction possible and you could replace a good one with one that was going to fail soon.

        Some you knew failed or lasted forever and could burn in past the know early failure times.

        In all the years I did it, I had a non electronics guy who was helping me walk into the test room while we were burning in problem mini board and see a resister smoking.

        We then looked at the various revs we had and saw the newest ones had a much higher wastage resister. Ah hah!

        As it was a simple on layer circuit board, we went back and replaced all those same location resisters with the higher wattage and never had another failure.

        Years latter the larger board started failing and it was a capacitor that had never failed before (non integral). 20 years service on it and then two and no more.

        Moving parts you can come up with a replacement schedule for and monitor wear. Electronics?

        I don’t know in depth if there are some they do replace and accept it may have infant mortality of it their own.

        I have talked to the mechanics after an airplane came out of a heavy check. That is when they had the most failures.

        Combination they disturbed perfectly happy stuff and the new stuff failed.

        • TW, I meant maintenance in the sense of you inspect something and find it to have an issue. Possibly bent or scraped, that wouldn’t show up in the diagnostics.

          I miss the days of discrete components where you could get in and repair things, or build things from scratch yourself. Now mostly throw-away components, not ever meant to be serviced, just replaced. But I’m sure they are more reliable as well.

      • Without any engineering expertise I can already tell you that the Boeing data are wrong (not necessarily intentionally, but wrong nonetheless).

        If there’s only about one AoA failure per year worldwide, then the chance that it would have happened on a MAX flight in 2018 was about 1 in 100. The chance that the MAX would suffer two AoA sensor failures in its first 18 months of service is on the order of 1 in 10,000.

        The simplest explanation is that in other aircraft an AoA sensor failure is nowhere near catastrophic. Thus they often go unreported, at least at the level of data that Boeing has access to.

        • Which makes you wonder how many other mis-calibrated sensors were done by the Florida repair shop? I assume the FAA has tracked down all of the repaired sensors and re-tested them. Did they find
          any others out of calibration, or was it just that one repair that was faulty? Or did other Airlines notice the calibration error when they tested them during installation? I haven’t heard anything about the AoA sensor failure rate from that repair facility.

        • Mike, I think those probabilities may be overestimated.

          Using the quoted numbers from the Lion Air report (page 195), there were 25 AoA in-flight failures resulting in stick-shaker (would have triggered MCAS if present). The sampling period was 17 years with 240 million flight hours, across a fleet of roughly 5,000 aircraft. That translates into about 8 to 10 million 737 flights on average per year (we’ll use the lower conservative figure of 8 million).

          If we assume the distribution of failures is random over time, that yields an AoA in-flight failure probability of roughly 1 in 5.4 million, for any given flight across the entire average year.

          If we further assume that failures are unrelated to each other, then the probability of another in-flight AoA failure occurring anywhere in the fleet, within 90 days, is about 1 in 22.2 million.

          If we instead evaluate the probability per aircraft, it would be 1 in 3,400, for any given aircraft across the entire average year (about 2,000 flights). For a second aircraft within 90 days, it would be 1 in 13,790.

          These figures are ballpark and depend on assumptions used for conversions between aircraft, flight hours and flights. The sources for the conversions were different, so no guarantee that they would be fully consistent or would fully agree. Really more of an approximation, with errors possible up to 20%.

          • Catastrophic failure is 1 in 1,000,000,000 flight hours – never once in the fleet of aircraft of a given type.
            The AoA failures, along with the way MCAS was using only one AoA sensor, and was programmed and operated the stabilizer was catastrophic in two accidents within a year.
            I don’t think there are many ways to increase the reliability of single AoA sensors by a large factor currently. So, you have to take into account AoA failures within your control system. Will an AoA failure push a flight control surface by a large amount? Then, you need to make sure the control system is fail safe. MCAS wasn’t. It now has to be, if they continue using it, in the same manner. I”m with JakDak. I’m a programmer. I’d much rather they use a hardware fix. A strake or whatever. Otherwise, you need to go with a full FBW system, which still has enough problems, when implemented correctly.

        • first order guess:
          7000 frames flying, 3000h/a , AoA MTBF 100k hours.
          :: 210 AoA go bust per year.
          Add in lots regular maintenance, checking.

          After all beyond the coil based resolver it is a mechanical design with gears, bearings, … that need service

  23. LNA,

    Your interpretation of the JATR report and the Lion Air crash report leaves much to question. What you have said the reports have not said. Even though you claim that you have said what the reports have said.

    To be specific. The reports have not said it’s sloppy programming. The reports have said it’s sloopy aerodynamics!

  24. Philip, as usual this is your conclusion, but is not the conclusion of the reports or the experts that try to help us interpret them.

    Additionally it’s another run at “the MAX is inherently unsafe” argument. If the FAA or EASA or any other of the participating investigating bodies truly believed that, they would simply say that the MAX cannot be allowed to fly again, and the whole thing would end tomorrow.

    You have said this, numerous times, as have others in this forum, but the above agencies and the majority of experts have not said that at all. There’s just not evidence to support that conclusion.

    The response to that is always that Boeing is somehow concealing the evidence, not just from us, but from the regulators to whom they are legally bound parties. The regulators have remedies they can pursue to get the information they need. But you don’t see them doing that, because Boeing is cooperating. Boeing has to cooperate, legally and ethically and if they ever want customers to buy their products.

    • Rob,

      So the reports are lying when they say there is a pitch up tendency. For both reports say it. I’m not the writer of the reports so it’s not my conclusion. Sadly everthing is a lie that doesn’t agree with you. So you offer another run at fiction. But there are plenty who don’t accept your fiction. Many on this site have stood their ground with the gibberish on offer.

      I know you and Mike don’t have a formal education in aeronautical engineering. I do. To give an example, your comments and Mike’s comments about why the stabiliser is being used and not the elevators. The reasoning can’t be any more silly. Very, very sad.

      It is difficult to respond to your reasoning because it is just silly. But I’ll have a go. A control surface is a control surface is a control surface. The bigger they and the bigger the deflection the more force available. The quicker they move the quicker the force can be applied. Basic aerodynamics.

      So the designer can choose bigger and faster or smaller and slower. But it does need to be big enough and fast enough to control the moment within the agreed envelope.

      So, the designer can choose big and fast or smaller and slower. That applies to any control surface.

      The point I’m making is there is nothing special about the stabiliser. It doesn’t have some special right to address the moment curve. A right that isn’t available to the elevators. That’s silly.

      I’ve always said that the stabiliser can be made to work. But it needs upgrading to achieve fail-safe redundancy and it needs to be much, much faster. In other words, it needs to be a stabilator. The Tristar is the only commercial airplane that used a stabilator.

      Your’s and Mike’s explanation for the use of the stabiliser just proves that neither of you have the necessary education. Your explanation is silly.

      Equally, your opinion that it all kicks off at an AoA of 12° is also silly. Why bother doing anything if the pitch up tendency starts at an AoA of 12° with flaps up. I’d fly in it, if that was the case. It’s perfectly safe without doing anything. Again, it just proves you don’t have the education.

      The reports concluded that there was a pitch up tendency. I admit, I said it a year ago. But then I have the education. It starts well before an AoA of 12° or Boeing have lost their marbles.

      Returning to this series of articles. This series of articles cannot be further removed from the reports and you cannot be further removed from the reports. A world of fiction.

      I prefer the reports. But then they are written by professionals

      • Philip, you’re resorting to criticism of the person rather than their arguments here again, something that you regularly do. That actually weakens your argument, whether you realize it or not.

        I stand by my extensive explanations and statements, they are correct to the best of my knowledge.

        The stabilator could be made to work as an alternative. The L1011 still has elevator-like flaps but they work in proportion to the stabilizer position, so the two surfaces function as one and are controlled from the column. Trim inputs use separate hydraulics but move the whole assembly. This was viewed as safer since it was less vulnerable to mis-trim, and could even take off in a mis-trimmed condition. The ability to deal with mis-trim would have been a benefit in an MCAS-type malfunction.

        But it was also more complex to control and more vulnerable to control failure, since there was no secondary surface to use as backup (two surfaces could not be controlled separately). Every design has strengths and weaknesses.

        I think it’s unlikely that the MAX will adopt a stabilator. The L1011 is the only example.

        • Rubbish. You and Mike resort to the personal. You’re explanations are so contorted for the purpose of disregarding the facts that it beggars belief. Both of you are silly but very personal with regard to being silly.

          I have a formal education. I know. I called it a year ago. Pitch instability. I’m not alone. Many have my education. We all know. I’ll leave it at that.

          Get a grip.

          • Philip, here we are, and after your November 2018 point absolutely vindicated, mere weeks after the first crash, what had been hidden from public view by Boeing, diverted away by blaming pilots on early reporting, vigorously denied all along the way, only to reach March 2019 when the second crash occurs, and the facts began to see the light.

            I can totally understand the frustration that must invade your thoughts, but I also have to say that it detracts from the substance of your comments when you resort to several qualifications that further nothing more than alienation from your audience. That is very unfortunate, specially since you are probably the most qualified on the issue at stake. I can see through that but many can’t, and those that do happen to tolerate it and still engage with you must thicken their skin a considerable amount, some which took it in the chin with quite a dignity, those that early on were not even in this forum distastefully dismissing your capability to analyse and pinpoint the problem.

            I hope you can receive this criticism too and I’ll emphasise that it addresses form not substance. Cheers, Philip.

          • Vasco, the point is not how thick our skins are, it’s about the need to engage in meaningful and factual discussion, and refrain from personal denigration. I discussed that in another post at great length, so no need to repeat it here.

            If Philip was abused early on for defending the pilots of Lion Air and saying there was another cause, I’m sorry that happened, it would have been wrong, but I was not a part of it. That’s not an excuse for him to abuse others now.

            When TW was getting a bit personal, I mentioned it to him and he immediately stopped. I suspect he was responsive because it was never his goal to do that. He is here (like most of us) to ask and answer questions, participate in the discussion, to learn and to educate, as we are each able.

            On the other hand, Philip has only dug in deeper when this is mentioned to him. He’s become progressively more dismissive and his arguments more frequently stray into the personal, challenging the person’s abilities rather than their facts or reasoning, as a means to advance his position.

            That is a well-known tactic. As I mentioned in another post, it’s called the argument from intimidation. It’s a form of intellectual bullying. And just as with TW, his response says something about his motivation.

            Philip has consistently emphasized his technical training, and implied the lack thereof in others, but he doesn’t use the methods that were taught in that training. The burden of proof is on the proposer, but he often shifts it to the responder, not explaining or defending, but insisting he can’t be proved wrong (the “you don’t know” and “but I do” arguments). It’s often true that he can’t be proved wrong, but only because it’s difficult or impossible to prove a negative.

            Philip is certainly not alone in doing these things. But to anyone who uses those methods, I am always going to respond by driving the discussion back into factual territory, to the best of my ability. Not just because we should be factual in the first place, but because we can never allow those methods to dominate the discussion, our thinking, or our decisions.

            I’ve pretty much exhausted the well of reason on this, so I’m just going to stop. The vast majority of people here don’t have those behaviors, because they aren’t needed if our purpose is to advance understanding or help establish truth.

          • Rob, as far as I have read you, your words are true, and it would be easy for me, while sharing Philip’s view, to stand by… but I could only up to a point, specially if directed to you which I regard as one of the most polite netizen I came across. Maybe Philip needed to read this from someone closer to his view. Maybe if we were all discussing this at some table, eyes on eyes, we would value more the discussion and be more respectful. Being no good excuse, internet is prone to this immaterial indifference. I’ve read Phillip, he also knows how to deflect disrespect, he must hone that skill. I think he’ll come about.

          • I have followed this for several months, now. I don’t think Philip began to characterize other arguments as rubbish in the beginning. Instead, his posts were incredibly informative and theory based as he struggled to suss out what was at the root of MCAS. His conclusion was quite different from any I had seen in the popular media as the discourse subtly got changed from aerodynamics to software programming. And he, unlike most other posters, has been fairly consistent, from my perspective. He believed the problem stemmed from the lack of elevator authority at certain angles of attack. He was firm in his belief that the fix needed to be aerodynamic involving a bigger tail and/or a faster more reactive stabilizer. He read closely the JATR and accident reports and transmitted a knowledge and history of having read such reports, saying the JATR was the most critical he had witnessed. Echoes of things he was saying could be heard in comments by other aeronautical engineers. I’m not sure at what point things became personal and petty, but they did. Philip’s position was fairly clear and it didn’t change much. But a lot of it was attacked — questioning his knowledge of fundamental aerodynamic principles. Anyway, I hope he keeps contributing and is patient. We’ll all eventually learn if he is correct or not. His position won’t make Boeing stockholders happy. But PR won’t make the Max an airplane that it isn’t. The Max program seems too big to fail. There’s a lot riding on Philip being wrong.

          • Thank you Vasco, that is a good summary and response. I admit I am easily triggered by those methods, because I’ve experienced them all my life. I’ve lost jobs because of them, then been rehired when the truth was finally understood, but not before significant loss. I regard them as some of the most damaging things one person can do to another, apart from physical violence. But I will try to park that reaction in future.

          • It’s quite annoying when some posters try to find excuses why Boeing did it this way, it makes you think these posters are part of the Boeing Bean Counter Machine, when the reasons are known and so easy to understand,
            – rushing things because they wasted time earlier and needed to hurry because of Airbus,
            – putting undue pressure on engineers not to report problems to keep the timeline,
            – cutting systems because of $$$ not caring about victims because victims are cheap to pay, when mostly nothing has to be paid, only need is to blame pilots,
            – paying politicians to become the certifier and then cheating the system,
            – same as they did now and got fined,
            – it’s their culture and till the bean counters are not replaced nothing will change.

          • As we are offtopic.


            Are you new sheriff in town? Someone named you?

            “When TW was getting a bit personal, I mentioned it to him and he immediately stopped.”

            And all your whimping about seeking truth and “Truth is out there”, actually about nothing substantial and with no reason. Was is electorial speech?

            Did I miss elections? 😉

            My small Christmas wish: If someone have valid ontopic arguments, please speak, if you don’t – restrain.


            Maybe not always what you write is supernice (it’s not a tea time at 5 o’clock) but it’s always direct and argumented. Lots of others are very less polite on daily basis towards you and they don’t have many contrarguments.

          • Pablo, Vasco also chided my behavior on an earlier occasion, for which I thanked him, as I also did above.

            So maybe Vasco is Sheriff and I am the Deputy? 🙂

            Actually I think Vasco would make a pretty good sheriff, I’d vote for him.

          • I don’t actually see many gunslingers, or gamblers looking for trouble, electing someone to spend most of his time in the barber shop would be a waist. I think our hosts would intervene if it was really called for.

            Neither of us should take some tirades too personally, this is an internet forum, we should know what we have to be up to.

          • Vasco, my sheriff comment was meant as a compliment. You’ve acted as moderator in these forums several times, including above. I was only saying that you’ve been good about it.

            As far as being an Internet forum, civil discourse is still possible and should be encouraged. We don’t have to use the relative safety of sitting behind our computer screens to be uncivil.

            You have pointed out that this discussion might be different if we were sitting around the table face-to-face. That was an excellent point. I hope my comments have been consistent with that approach. I’m sure I’m not perfect in that regard, but I have tried to avoid that behavior.

          • Pablo,

            I’m happy Philip is here, I even missed him on days when I didn’t read from him, sure the prey stuff was kind of strange haha, but I forgive him, I can understand when all the kids here are bothering.

            I felt honored when Transworld named me beside Philip not only once haha, thanks TW

          • Vasco,

            Sorry, I won’t come round

            I and many are subject to systematic abuse. To give an example, Rob says I’m confused. He justifies it using Mike Bonhet’s total mis-understanding of moment curves and how control surfaces are used with regard to moment curves.

            As Pablo says, the Sheriff is in town. We accept rubbish or we get abused.

            The usual abuse is that your some kind of idiot. Well that applies to the sheriff.


          • Philip, I have said my piece, meant as a friendly suggestion. I’ll move away next time a crossfire is on a verge of starting. I’ll keep high interest in the substance of your comments as usual.

  25. I’ve been trying to find out if wind tunnel testing can simulate a wind up turn type of event? I haven’t had much luck looking on the internet. I’ve seen some video’s of some aircraft models on a moveable stick holding device. But, can they mimic a moving aircraft in a turn, with flight control surfaces moving, with force sensors measuring roll, yaw and pitch forces dynamically? So you could have a pilot ‘flying’ the model through the wind tunnel, measuring surface forces, or is the small size model not able to scale up to life size accurately? To accurately represent the true airflow, you’d have to have the wind move with the aircraft to represent the airspeed, or the model on gimbals to properly orient the aircraft as it ‘flew’.

    • I’m curious as to the rational of the two tests. I could see the wind up test as the test case for the highest speed stall, and the level flight as the lowest speed stall test case. In the turn test, if the aircraft is at maximum weight and loaded forward limit, then the wings are the most loaded, plus the additional 1.15g factor of a 30 degree bank. In the level case if the aircraft is at minimum weight and loaded at the aft limit, that should be the lowest speed stall test condition.

    • Richard, my guess is it could not be simulated very well in a wind tunnel. You might get the aerodynamic loads by twisting on a stand, but you wouldn’t get the acceleration or g-loads. The test is too dynamic.

      You could do it in a simulator, but the results would not be definitive unless you did it first in flight testing and then ported the data over. Even then it might not perfectly replicate the motions and forces as felt by the pilot.

      I think that’s why Boeing is out flying the MAX almost every day. They have a permit to do test flights.

    • Wouldn’t they just do static tests with the model in various positions to represent the climbing curve. The results would be plotted to create a ‘smother curve’ .
      In addition computational results could refine further details.

      Interesting Youtube on Boeings wind tunnel shop where the models are made . Some seem quite big and talks about the inside tubing connecting to the instrumentation

      This other video covers the 737 max testing inside Boeings transonic wind tunnel

      • Dukeofurl, Yes, those are what I’ve been finding. They all seem to be as you say, static snapshots that they try and make into a movie as best possible. I’m assuming they are interested more in finding out airflow characteristics, not trying to put an aircraft through flight testing. Would another model, with moveable flight surfaces, mounted on 3 axis gimbals, be able to ‘fly’ in a wind tunnel, and provide data much earlier in the testing program, rather than waiting until the real plane is built and then test flown? It seems like the pitch up issue, on the MAX, was found quite late in the testing program. Finding out things you have to fix late in testing is usually involves a major headache. If they could have found out about the need for MCAS a few years sooner, it would have been better.

        • “If they could have found out about the need for MCAS a few years sooner, ..”

          Afaics Boeing knew all the time that fitting any kind of bigger engines would demand a position further forward and up. I’d be surprised if they did not disseminate over the implications and potential fallout.

          Cloaking realization of MCAS in incompetence is nothing more than trying to get around criminal fallout of their move.

          • There were 3 steps I think in which they increased the fan diameter because the economics were not good enough. Sure they knew what bigger diameter meant, otherwise they would have chosen it from the start. But you know, if they are greedy nothing will stop them.

          • Uwe, your post got me thinking, so I found that someone has posted blueprints of the NG and MAX on StackExchange, and compared the engine size and mounting differences.

            From that I did some very rough calculations, and found that the LEAP 1-B engines on the MAX add about 30 square feet of cross-sectional area each, as compared to the CFM56 engine on the NG. Also the LEAP engines are mounted less than 2 feet farther forward than the CFM56, and less than a foot higher.

            This surprised me because the added area is small relative to the area of the wing, so you wouldn’t necessarily expect a big impact, even with the forward extension. But probably there are aerodynamics involved in terms of the shape, the cowlings, and how the flow interacts with the wing and nacelle with increasing AoA, that dominate the lift.

            So maybe this is complex enough that it was not that apparent in the design phase, and difficult to model in a wind tunnel as Richard suggested. Perhaps it really was not apparent until the actual flight testing.

            There is also CFD as a modeling method, I’m not sure about that either, in terms of accurately modeling the engine interaction with the wing. I don’t know how detailed those models are.

            On the other hand, using the Home Improvement method, a 4×8 sheet of plywood is 32 square feet, so if you bolted that protruding forward from a wing at 250 knots, there’s obviously going to be some impact. 🙂

          • @Rob
            Sometime after Jan 2016 was when they put the dangerous part of MCAS into place. This was after the first actual test flights. So, I’m just assuming that this was the first notice that Boeing took to the pitch up issue being either bigger than they originally thought, or had knowledge of at all. Not from any wind tunnel testing. The first 737-MAX delivery was May 2017, so they developed and tested the dangerous part of MCAS in a year and a half, after the plane had been first built.

        • The 737 model is mounted on a gimbal through the top of the tail surface. Its clearly not going to be massive changes in angle but its only going to simulating normal flight. Considering the number of hours needed even for small changes to get the basic configuration right, its only worthwhile to look at ‘edge of envelope’ stuff towards the end of testing . Even then you cant test pilot stick forces on a wind tunnel model, its self evident you have to build a flight correct simulator verified by actual flying of a production plane. That would indicate the time line of when these sorts of things could happen.

  26. “The 737 MAX should now be safe”, seems to be the conclusion, but “Should” is not good enough in civil aviation.

    More than 1 year has passed since the first crash, and we still cannot reach the conclusion that “The 737 MAX IS now safe”. What a disgrace.

    The power of MCAS has been reduced a lot, but AFAIK no evidence has been shown about how the plane performs without it in the critical parts of the envelope where it was initially meant to operate in. With MCAS power reduced, it makes me wonder if the next crash will be because MCAS failed to activate and prevent a stall…

    • Erik, the time has not been spent solely on MCAS. Boeing is also converting the two flight control computers from master-backup to dual-master configuration, so that one can always be checking the other in real-time. That is a significant task, and has required a lot of flight testing to be certified. Together with MCAS testing, about 1,000 hours of flight time and still growing.

      The conclusion of “is now safe” cannot be made by Bjorn, or by Boeing, it can only be made by the world-wide regulators that are reviewing the MAX. So we have to wait for their work to finish. In the meantime, Bjorn used “should be safe” as is appropriate.

      As far as flight data with or without MCAS, that is available to the regulators and presumably will be part of their certification process.

    • @Erik

      Nobody really knows how MAX performs without MCAS, I think is the most correct answer. Few months ago there was a serious digging if FAA tested it that way. There were no clear response, so because of lack of information the issue fall silent, until not far from know Patrick Ky made a presentation for EU Parliament when was shown that during recertificacion EASA demanded from Boeing to be MAX tested without MCAS and with a new MCAS. And EASA is still waiting.

      On paper MCAS fix looks reasonable. But it’s still on paper, I mean only Boeing flew it.

      Unfortunately Bjorn jumped again too early into conclusion about safety of MAX – MCAS fix, is not all unfortunately, they are other issues like unoperable trim wheels at higher speeds, changed logic of cutout switches, shielding of rudder cable etc. that needed to be addressed. And of course live testing which will confirms or not stability of airframe without MCAS and MCAS fix.

    • Boeing knows, test pilots know, EASA knows (has access to the data) but wants to test and confirm for themselves, along with many other results they wish to verify.

      Current holdup is the software audit. EASA visited Collins last month, then together with FAA requested more data from Boeing, which has now been delivered.

      Once audit is complete, EASA test flights will occur, using EASA pilots, as originally determined in September and October. EASA also completed the majority of their simulator tests in July. Altogether they have about 70 points they want to verify, normal and abnormal conditions.

      So MCAS modifications have been flown many times by many people, both in sim and real flight. That process is not complete but should not be presented as an unknown.

      EASA has not signaled any show-stoppers as of yet, saying only they may be a few weeks behind the FAA in their certification. There is no indication that they are having any issue testing to their requirements.

      • So… Considering all this “information” likely from the inside, should we assume that you are speaking on behalf of Boeing?

        • haha … yeah … I felt so too,
          few weeks ago I asked him if he gets paid for the stuff he is posting,
          good you recognize this too.

        • Unfortunately not, it’s a mistery from where Rob pulls out all his “informations”. He likes to repeat that something is well known, published many times, present supposition as bold facts, use elaborate words etc. so I would be careful.

          “Boeing knows, test pilots know, EASA knows” so if Boeing knows = EASA knows, in my opinion, in perfect pararel world that would be truth. All we know that EASA is awaiting months for Boeing to test MAX with and without MCAS.

          • Patrick Ky stated in September that EASA had a concern that FAA had not itself tested the MAX without MCAS, but had instead accepted Boeing’s flight test data as evidence.

            EASA feels that this test is needed to establish a baseline for MCAS performance and behavior, independent of Boeing’s original data. They want to see & evaluate for themselves, which I have repeatedly stressed, is perfectly fine.

            They are basically establishing an experimental case-control for MCAS. The FAA and Boeing have agreed, I would as well, it’s good science. There is always value in improving or verifying or duplicating a dataset for comparison.

            EASA requested the test in October and it was scheduled for mid-December, after the completion of the software audit in November. Since the software audit was delayed by the request for additional data in a different format, which has now been provided, the EASA flight tests have also been delayed until audit completion. The software has to be locked-in before testing.

            There is no objection or concealment or lack of cooperation by Boeing here, as has been implied. EASA knows what to expect and the conditions they wish to test, as they have seen the original Boeing data.

            EASA is using the philosophy “trust but verify”, which is understandable given the loss of confidence that has occurred.

      • Information is collected from various news articles about the MAX return to flight. It’s freely available to the public, but it takes some effort to find it because it’s not sensational enough to make headlines.

        It’s important to provide it here so that there is balance in what is said. There is both good and bad news to report. Advocation for the truth is not the same as advocation for Boeing. I have been critical of Boeing and continue to be, about many things. But criticism can be done with balance, and may be more effective if it is.

      • Rob,

        didn’t you earlier today posted that the audit is already finished, and now you say the audit is still a holdup.
        Mondays are often bad days, right …

        • Leon, I reviewed my posts for today and I have not said that. In fact I have not seen anyone say that in this forum. I’m not aware of any reports that the audit is finished. If you have knowledge otherwise, we’d all be interested in reviewing it.

          • Rob,

            you posted this (it’s from the cbsnews article)

            “” Also they have submitted the additional paperwork requested by the regulators after the rejected submission in November (the code audit). “”

          • Rob,

            then in another post you are confirming this again.

            “” Since the software audit was delayed by the request for additional data in a different format, which has now been provided “”

          • Leon, those posts are regarding the submission of the additional paperwork that is required for the audit. The audit could not be completed until that was submitted. It was submitted a few days ago, and the audit is now underway again, with the requested information.

      • “EASA has not signaled any show-stoppers as of yet, ”

        Afair “last things heard about hands on experience” from EASA were about getting access to a disabled MCAS 737MAX. This seems to still be open, right?

        • Uwe, the reporting on this is that testing without MCAS was brought up in late September, as an EASA condition for RTS. The request was made and granted in early October, and scheduled for mid-December because it couldn’t take place without the software being first audited and approved.

          The audit was scheduled for early November, and did take place, but the people from EASA wanted at least some additional data provided in a different format, which apparently Boeing had never used before. So that introduced a delay of a few more weeks.

          As of last week, the data had been delivered and the audit is underway again. There could be additional delays if corrections emerge from the audit. But once all of that is done, the EASA test flights should proceed.

          After those flights, there could be yet another round of requests and corrections. I think this is why the regulators are reluctant to put a date certain on RTS. It’s a process and we just have to let it play out, however long that takes.

          I also think Boeing knows this, as the public is not really trusting their word right now, so their only salvation is approval from the independent regulators. So as much as they would like to push thing along, they have to wait like everyone else.

          I just wanted to make it clear that the delays don’t reflect reluctance or desire on the part of Boeing to avoid the tests, as was implied by some of the statements here.

          On another note, I finally found some more detailed reporting on the airworthiness authority transfer from Boeing to FAA.

          Initially I thought this might be a compromise between FAA and EASA on the resolution of ODA.
          However it appears that the FAA concern was that Boeing would not have sufficient quality control in place to deal with the flood of airframes returning to (or newly entering) service, and Boeing’s strong desire to expedite could potentially create new problems.

          So the FAA has said this will be in effect until Boeing demonstrates sufficient quality control, but it’s not necessarily permanent. Also might be a response to quality control issues raised for the 737 and 787 production lines.

          • Thanks Richard. Another possible cause of the transfer was the recent fine issued to Boeing, for failure to report and issuing airworthiness certificates with known problems present. They were already on probation for a previous incident.

            Apparently in this case, Boeing used its ODA authority to classify the problem as a minor repair, which could be addressed in regular maintenance. They did then do that, the repairs were made, but the FAA felt it was significant enough to be reported and invoke the FAA procedures.

            So there are echoes of the MCAS classification errors in this. I really hope Boeing gets the message, and has a “come to Jesus” moment about bringing potential problems to light. They cannot afford even the appearance of non-compliance, much less establishing a pattern of that behavior.

    • Thank you Scott, for the reference. That was interesting and I look forward to their analysis of Lion Air 610.

  27. For what it’s worth, here is some information obtained from Boeing’s recent closed-door stakeholder meeting.

    They have reached 1,850 hours of flight testing, with 1,200 simulator hours and 240 simulator hours conducted by regulators. Also they have submitted the additional paperwork requested by the regulators after the rejected submission in November (the code audit).

    • BTW, in re-reading the article one sentence did pop out
      Muilenberg is confident the combined hardware and software changes Boeing has developed for the Max will satisfy the FAA and the multinational Joint Operations Evaluation Board (JOEB).
      “combined HARDWARE and software changes”

      And there’s going to be some memory in MCAS as to how much trim can be added?
      “But if it is correctly triggered, the system now “operates only once per AoA event”, according to Bomben, and when it does trigger stabiliser movement, it memorises how much displacement has taken place, so if it were triggered again it would take account of existing stabiliser displacement and will not apply more than a safe cumulative limit.”

      also, a better more longer lasting link to the article is

      • Richard, essentially he is saying that MCAS output will be bounded, so as not to exceed its authority, as it should have been originally. Mike Bohnet alluded to this in the previous Bjorn column in this series.

        Both the inputs and the output of MCAS should have been bounded as a basic rule of control programming. MCAS should have known that AoA values of 30 to 70 degrees were unrealistic, and it should not have exceeded it’s control authority limit of 2.5 degrees stabilizer deflection. These two changes alone, would likely have prevented the accidents.

    • “The purpose of fitting MCAS, Bomben explained, was to compensate for a slight change in the low-airspeed aerodynamics of the 737 Max compared with the NG.” -Boeing test pilot
      I find it curious, that there is never a quote from Boeing that simply says, MCAS is used on the MAX to comply with certification requirements. Or if a comparison with the NG is needed, an MCAS system was not needed on the NG to comply with certification requirements. If those are the facts, why not just state them.

      • MCAS was intended to achieve several goals, if properly implemented (which it was not).

        One goal was to satisfy the regulations for column force at high AoA. Another was to provide aerodynamic assistance to the pilot in aircraft handling at high AoA. If these two things were accomplished, then it also would provide similarity to the NG at high AoA, since the two aircraft are otherwise aerodynamically similar

        All three of these were desirable. Some say the NG similarity was a driver and not an inherited benefit, so they might express the above in a different order.

        Those goals are complimentary and self-consistent, so all three could be achieved at the same time. In discussions, people tend to select the one they feel is most important or relevant, or possibly the one they feel is most likely to be understood by the public.

        I have seen all three quoted at various times. The ones that have been objected to by Boeing, are the claims of stall prevention or inherent instability.

        Stall prevention is open to debate as a possible goal, because MCAS works in the regime just before stall, and continuing into stall. It doesn’t shut off if the aircraft stalls. So was stall prevention a design goal or is it an inherited benefit? Depends on your point of view. Boeing says no, others say yes.

        • I don’t see how there could be two tests that mandate an aircraft be flown to stall, and at the same time have a stall prevention system operational, that seems contradictory, so I don’t think MCAS could fit the definition of stall prevention.

          I wonder how MCAS works during the level flight to stall test? If it is run at a deceleration of 1 knot per second, over the course of MCAS is 9 seconds or so, so a deceleration of 9 knots. The required stick force increase is 1lb per 6 knots, which would mean over the course of MCAS it should increase stick force by 1.5lb. Kind of surprising that 2.5 degrees change in horiz stab trim only equates to 1.5lb change in elevator force, but I suppose that is the lowest speed case.

          • I think MCAS is also linearizing the pitch curve, so it is maintaining column force that would otherwise be going away. This is in addition to the required regulatory force behavior.

            So for example, without MCAS the force might drop by 5 lbs (just a guess) with increasing AoA above 12 degrees. MCAS is maintaining that plus the 1.5 lb required change.

            I think this is why EASA wants to test without MCAS, they want to quantify the behavior and the benefit.

  28. Everyone, I point to two things:

    Is there a regulation requiring certain pitch force characteristics? I remember that Boeing designed a triplex ‘augmentation’ system due to a new regulation, but found in flight testing that a few vortex generators would meet the requirement. I don’t hear the TC expert addressing such a regulation. IOW, why was MCAS there at all. (Bjorn’s earlier series of articles may cover that, in this one he mostly just covers the desire to help pilots.)

    (Both Bjorn and the TC person are suggesting it is not needed. The TC person is concerned that there may be other problems because of the [sloppiness] of MCAS development, so his solution is remove it, I ask if that is more mucking with the system/software that could cause problems.)

    An article by CBS news includes a slide about what culture changes Boeing is making. However I cannot read the detail in the slide, only the title. (December 8, 2019 ‘Boeing tries to restore confidence in 737MAX in stakholders’ presentation’.)

    • Jim Marko is saying that MCAS is not a solution to fix the problem. Other solutions are needed.

Leave a Reply

Your email address will not be published. Required fields are marked *