December 6, 2019, ©. Leeham News: We now finalize the series about the Lion Air JT610 crash by analyzing the changes Boeing has made to the aircraft to avoid further problems with MCAS (Maneuver Characteristics Augmentation System).
The changes bring MCAS to the level it should have had from entry into service and in some aspects further.
The fixing of MCAS
We start with a change that does not involve MCAS. When the 737 MAX fleet starts flying again the Angle of Attack (AoA) warning text AOA DISAGREE on the pilot’s Primary Flight Display (PFD) will be active, Figure 1.
For the MAX this warning went inactive due to a supplier incorrectly tying its appearance to the presence of the optional PFD AoA indicator (top in Figure 1).
The revised logic is the AOA DISAGREE shall always be available and after the crashes, the optional AoA indicator is a no-cost option for the airlines.
We now go to the changes made to MCAS and the systems participating in the augmentation function.
The original MCAS relied on a single AoA signal passing a threshold value for activation. This was allowed under FAR Part 25 for systems that had a safety hazard classification of “Major” hazard if things went wrong.
The Lion Air accident was caused by an AoA sensor which was incorrectly calibrated. It had a faulty bias of 21° AoA instead of 0°. For an MCAS function which is activated at say 12° AoA this meant MCAS was active from lift-off. Only the additional criteria of “flaps in” held it back until these were retracted. In the Ethiopian Airlines case, it was with high probability a bird strike that ripped off the sensor, causing the sensor rotor to swing to over 70°.
AoA failures like these are not common. The report states Boeing statistics show a total of ~20 failures over the last 17 years. To have two such failures a short time after another precluded Boeing from have fielded at fixed MACS before the second AoA failure happened.
The key problem was a non-fault proof trigger was combined with an unnecessarily aggressive MCAS function, trimming the aircraft’s nose down at a high rate in repeated activations. It could move a normal trimmed state of around 5° to full nose down (0°) in two activations if not countered with the pilot using his manual trim to trim against. This aggressiveness was not called for.
The aircraft needed one nose-down trim of 2.4° at the most (low speed and altitude) if it had passed into the nose-up happy region before stall. Subsequently, the nose-down trim is reversed once the AoA falls below the threshold. This re-passing of the threshold value would have been the correct reactivation criteria for MCAS, not the fact the pilot trimmed.
A pilot trims when a dynamic event is brought to a stable state. In a stable state, there is no need for further augmentation. The correct criteria for a re-activation of MCAS is the AoA has passed below the sensitive region and the nose-down trim has been reversed. Now the reactivation was the same as for Speed Trim, the pilot had trimmed. Why this can be the criteria for MCAS is not clear.
Finally, the original MCAS function had no global limit on its authority. At full nose-down trim, the horizontal stabilizer controlled by MCAS could outcompete the pilot controlled elevator. The aircraft would nose over when MCAS had trimmed full nose down irrespective of how hard the pilots pulled on the Yokes. Only trimming would have helped but it’s not in a pilot’s muscle memory to trim during correction of a nose movement, you trim once you have achieved steady-state and can feel the stick forces. Trim is to neutralize these forces for the pilot, not to control the pitch of the aircraft.
The revised design, presently under scrutiny by the FAA and other airworthiness agencies address weaknesses in all three areas.
The trigger now is only done when the two AoA vanes on a 737 MAX agree there is a case of a high AoA, passing the threshold for MCAS activation. If there is disagreement between the sensors the MCAS function will be disabled. As argued in the last Corner this is OK as you can fly without MCAS and the probability this making the flying harder for the pilot for a flight with an AOA DISAGREE is practically nil.
Initially, this comparison was made on a sensor signal level. For the final solution, the check is done after the processing of the MCAS function. If there is a disagreement between the active function chain and the monitoring chain MCAS will be deactivated.
This improvement checks all sensors and processes who participate in MCAS to see there are no differences in computed actions.
An improved trigger is now followed by an MCAS function which checks the AoA value has gone below the threshold and the nose-down trim is reset before it can activate for a new augmentation. This should have been there from the first implementation. It’s difficult to understand how the team around MCAS assumed a trim action by the pilot means the augmentation is reversed and it shall be allowed to re-activate.
Finally, the updated MCAS can’t steal all pitch authority from the pilot. There is a global limit on how much trim nose down MCAS can command. The pilot is always guaranteed he can keep the nose level and pitch it up if he needs it.
The Boeing 737 has a good safety record. The aircraft has no special vices and is void of dangerous modes like a deep stall or aileron or rudder reversal. The larger MAX engines called for a pitch augmentation to give the pilot a linear pitch feel all the way to stall.
The introduced augmentation to fix this had an uncharacteristically sloppy implementation. The uproar over how this could pass into a certified air transport aircraft was called for. But now the corrected augmentation is there. The enormous amount of work which has gone into the update has made MCAS one of the most analyzed and tested flight control augmentations ever. The updated MCAS is now safe, measured with any standards.
In my opinion, MCAS is now fine and we should turn to more pressing issues in our air safety work.