First reports from Boeing’s MAX briefings last week

Dec. 10, 2019, © Leeham News: The first reporting from last week’s Boeing briefings for analysts, opinion-makers, influencers and consultants (but not the media) began to emerge Saturday. (Media briefings may be scheduled in January.)

The briefings are the latest in Boeing’s effort to restore confidence in the 737 MAX.

First reports

David Learmount, the former aviation safety editor for Flight International magazine, attended the briefing. He is a highly respected authority. He now has a blog and has a lengthy report from the briefings here.

Learmount reports in some detail the information shared by Boeing, much of which has been revealed by Boeing over the course of several months.

A key difference: Boeing CEO Dennis Muilenburg was there to face questions and respond.

Greg Feith and John Goglia were at the briefings. Feith is a former crash investigator for the National Transportation Safety Board. Goglia was a member of the Board. Both are talking heads on TV following crashes or on safety issues. The also have long podcasts on these matters.

On his Facebook page last week, Feith said the two will have podcasts following the Boeing briefings. These aren’t up yet, but Feith gave a preview on his Facebook post. Feith wrote:

We attended several briefing that discussed in detail the MCAS software, aircraft certification, the ODA process, 737MAX production philosophy vs. clean-sheet-of-paper design, pilot training and other “return to service” issues. In addition, we went on two factory tours and had an opportunity to fly several profiles in the Engineering simulator involving both the “old” MCAS software and the revised” software. I will say that flying the profiles reconfirmed what John and I have been saying since November 2018, and it provided us the opportunity to dispel the myths and misinformation that has been presented in both the media and the NTSC accident report.

We will also discuss the changes that Boeing has made within the company to improve processes and internal oversight, their relationship with the FAA and other certifying authorities, and the relationships with airline customers.

CBS News, which was not at the briefing, provided this report based on information from someone who was.

CBS has a couple of slides that were provided by Boeing to briefing attendees. The slides have previously been released in other Boeing briefings.

Bloomberg News, which like CBS, was not invited to this briefing, also has a report from those who were.

140 Comments on “First reports from Boeing’s MAX briefings last week

  1. Scott,

    In David Learmount’s post (linked above), Craig Bomben is quoted as saying “The purpose of fitting MCAS, Bomben explained, was to compensate for a slight change in the low-airspeed aerodynamics of the 737 Max compared with the NG.”

    There was me thinking that MCAS was originally fitted to solve the pitch moment curve at high speed, and it was subsequently modified to deal with low speed, high angle of attack.

    “It only happens when the Max is at low airspeed with the flaps up, and is being flown manually.”

    I understood that MCAS was much less aggressive in it’s first incarnation to address the pitch moment curve at high speed, and then it was modified to move the stabiliser much faster to address the low speed issue ?

    I further understood that safeguards such as g-force measure were removed when MCAS was re-purposed to deal with the pitch moment curve at low speed.

    Perhaps Bjorn could clarify ?

    Perhaps Bomben was just ‘dumbing down’ the facts for the press ?

    For those really interested in what actually happened to ensure that lessons are learnt, I think the actual time line is important.

    I trust Bjorn’s statements !

  2. This is from Mr. Learmount’s blog: “But if it is correctly triggered, the system now “operates only once per AoA event”, according to Bomben, and when it does trigger stabiliser movement, it memorises how much displacement has taken place, so if it were triggered again it would take account of existing stabiliser displacement and will not apply more than a safe cumulative limit.”

    Maybe I have misunderstood something, but it sounds to me that, despite saying that it would trigger only once per AoA event, it seems to indicate that it would be able to trigger again anyway. If this is in the event of another AoA event, how does MCAS/the aircraft know it is a “new” AoA Event?

    • “” how does MCAS/the aircraft know it is a “new” AoA Event? “”

      haha, I thought about that too.

      I don’t believe that they could fly MCAS1.0 in the sim, maybe MCAS1.3.
      Once a cheater … always a cheater. No PR can cool me.

    • And there in lies the rub.

      Correct identification of a single AoA event is a safety critical function. Cumulative accounting of how much MCAS has already intervened is also a safety critical function. If those both go wrong in an unfortunate way, there’s not a whole lot else to stop MCAS running away as before.

      The problem is, Boeing are not implementing these in triplicate, independent implementations, as one would normally expect to see in a safety critical function. They’re apparently using two copies of the same implementation.

      To me it seems they’re simply one software bug away from the thing running away again. The reason why these two functions are safety critical is that it they do go wrong and MCAS does run away again, all the pilots have left is to turn off the system and use the trim wheels. And we already know that those are next to useless if excessively mis-trimmed.

      I think they’re going to get a nasty shock when the EASA start looking at this in detail.

    • I guys,

      The alpha vane will show a reduced AoA after MCAS has been triggered. If the AoA goes below some threshold it will then reset. The reset means it’s a new event.

      What the threshold is isn’t known. When I read the JATR/ LION Air crash reports I said I wanted to know the AoA/Mach profile at which MCAS triggers. It’s the profile that determines the threshold.

      So you are right. It can’t reset unless MCAS activation causes the AoA to go below the threshold.

      We then come to the nuances of open loop systems. Airplanes controlled using control surfaces are using open loop systems because the control surface are not connected to the sensors. So the control surface moves but it’s the sensors that show the response to the movement of the control surface.

      Trim stabilisers are slow. For the MAX it’s 0.26°/second. Elevators are 50 to 100 times faster. The consequence of the slow movement of the stabiliser is that the action/reaction loop is slow. I read somewhere 3 seconds, but can’t remember where. But, it needs to be sub-second.

      The slow action/reaction loop will make threshold management very, very difficult. This is especially true in a storm. A storm can cause the nose to move up faster than the action/reaction loop can respond. Especially when an airplane wants to go nose up, as is the case with regard to the MAX.

      The action/reaction loop is why primary control surfaces have high speed/high precision servo hydraulic actuators. It allows a control surface to move fast, thereby reducing the action/reaction loop to sub-second.

      The trim stabiliser on the MAX does not have servo hydraulic actuators. It’s a good old fashioned electric motor.

      In advance, Rob, Mike and Vasco. Sorry for my formal training. I really do apologise.

      A stabiliser will work if it’s upgraded to have fail-safe redundancy and high speed/high precision servo hydraulic actuators.

      Even better to remove the pitch instability. Strakes will work. A bigger stabiliser and bigger elevators also works. Raising the airplane and lowering the engines also works.

      This comes to bigger elevators. It’s clear the elevators don’t have margin. They should have margin.

      Boeing are playing with fire. What they are doing has never been done.

      • Another scenario that must be considered is a hail storm encounter on descent, which is usually accompanied by very turbulent air and strong vertical gusts – exactly when a stable airplane would be needed the most. In a hail storm encounter (more frequent than most think), it doesn’t matter how fast the tail could move or how redundant the AOA system feeding the MCAS is. A hail storm will take out all vanes and disable the MCAS and the stall warning systems.

        A passive system (i.e. bigger tail & control surfaces) is absolutely required for robust longitudinal or lateral-directional stability & control under all conditions. This is an absolutely inviolable rule of commercial aircraft design and Boeing has been toying with watering this down this for some time, starting in the early 787 days.
        Strakes/ventral fins will not be sufficient as they don’t address the insufficient control problem on the MAX (current elevators being too small for a difficult go-around). Theoretically, the airplane needs a bigger tail, but body sections 47/48 can’t accommodate this without a major redesign, which would basically make the MAX 2.0 a new airplane.

        Bottom line: there is no kosher/robust solution to this problem, only fake band-aides that would delay the inevitable by maybe a few years.

        I get the feel that Boeing is doing all this because they have no other option. The execs in the know are putting what is left of BCA’s reputation on the line, to buy a few more years to get out of dodge (similar to what Hamilton just did; preemptively retiring before he can be blamed/fired).

        • Why would a larger vertical fin and horizontal stabilizer be needed if they are further away from the CG ? The vertical is needed for engine out and the shorter distance for the origional 737 did reaquire a larger ‘ fin ‘ to cover the engine out yaw situation. Seems to me the longer the lever arm ( distance ) from the center of gravity or rotation would allow a smaller fin or at least the same fin as on the shorter body ??

          • Bubba, you are right that both the elevator and stabilizer moment arms are lengthened with the longer fuselage, although depending on the design, the CoG may also move backwards a bit.

            But we know that for stability, the CoG has to remain in front of the CoL, so it can’t move that far and it’s probably safe to assume the longer moment arm, as you say.

            The elevator authority/larger elevator issue has been discussed endlessly, so I won’t go into it again. I’ll only point out that control authority must grow with AoA to be an effective counterbalance to the growing influence of the nacelle lift with AoA, in order to be effective.

            So MCAS adds the needed authority growth with the stabilizer, so as to preserve the elevator authority for the pilot. That is the design intention.

          • “MCAS adds the needed authority growth with the stabilizer, so as to preserve the elevator authority for the pilot. That is the design intention.”

            I would rather say that MCAS doesn’t preserve any authority of stabilizer. More, as both crashes proved MCAS via stabilizer rather cancel authority of elevators.

            I would say that MCAS moves stabilizer because moving too small elevators is ineffective at some AoA / manoeuvres with CoG / stall characteristics of MAX’s. If elevators were big enough simply push-sticker would be sufficient. Btw, pilots always can move stabilizer, by thumb switches, so they can always “preserve elevator authority” by himself, they don’t need any MCAS.

            And NGs don’t have MCAS – so following your thoughts – they are in trouble because there is no system to “add the needed authority growth with the stabilizer, so as to preserve the elevator authority for the pilot”. Luckily NGs don’t have so troubled CoG / stall characteristics like MAXs.

            Concluding. Troubled CoG / stall characteristics / airframe instability (however we name this MAX issue with new engines) = problem because of too small elevators = MCAS is needed.

            So, I think you wrong.

          • Pablo, you can think what you like, and are welcome to your thoughts.

            The case has been laid out clearly and cleanly that refutes the claim of too-small elevators, by people who know a lot more than either of us. None of the reports or regulators have raised it as an issue, and they too know a lot more than either of us.

            My arguments are consistent with those findings, and what I have learned from my research, so I stand by them. If new information becomes available that doesn’t support them, I’m always willing to reconsider, and integrate the new facts.

          • @Rob

            I’m truly touched by your permission “you can think what you like, and are welcome to your thoughts”. I’m really sorry that I haven’t asked you for it beforehand.

            Your line of thinking is unbeatable as always “The case has been laid out clearly and cleanly that refutes the claim”, “My arguments are consistent with those findings”.

            But I don’t see any contraguments from your side. Self-supporting PR doesn’t count for me.

          • Pablo, I gave up on that because you reject everything I say. So there is no point in arguing with you.

            Case in point, on the movements of the trim wheel, I explained to you twice how they would need to be different than STS, if MCAS indeed was active at 3 degrees AoA and managing stability of an unstable aircraft, as you claimed. You rejected that argument and said the movements are exactly the same and indistinguishable.

            So then I adopted your argument, I said that if they are truly indistinguishable, they are performing the same or similar functions, which would make them redundant, and there would be no need for MCAS, nor would MCAS be doing anything substantial. You rejected that as well.

            So if I use my point I’m wrong, if I use your point I’m wrong. I’m wrong in all cases, therefore no need to argue.

          • @Rob

            Don’t shift a topic – you claimed that MCAS was invented to preserve elevators authority – we are talking here about this one.

            You presented a twisted statement, and I pointed out why is wrong in my opinion. But this is a second post when you are complaining on me but not presenting contraguments. So there’s no arguments to refute from my side, so don’t complain or accuse – its doesn’t count as a valid argument neither.

            You shifted topic to “I know how to distinguish trim movement by STS and MCAS” by claiming again that they would need to be different. But, again, you are not explaining (you never did, so stop claiming that you did – that is simply untrue), how or in which manner in practice these would be different. I think the answer is: magically somehow 😉

            And I see you still don’t understand by saying “they are performing the same or similar functions, which would make them redundant” – well they are not redundant because the are not the same because they are activated by different scenarios /algorithms. Both using same tools – same jackscrew, same engine in the same pace, that’s only similarity – same tools, but in different scenarios.

            Good night Rob!

          • Pablo, this is why I don’t want to argue with you. Every single thing I say is rejected. If I say I’m being rejected, you reject that as well. That is not a debate or a discussion, it’s just a platform for you to assert your own views. Which is perfectly fine, you can assert away, as much as you like. But there’s no real value in engaging with you.

      • I don’t see any indication of formal training, just linking a few disparate items together and throwing it out.

        Would any of us wanted the old guy on the Trike as a aircraft designer?

        One issue is a misunderstanding of open loop vs closed loop. Nothing says your closed looped sensor can’t fail (so for that you need multiple redundancy and cross check as well).

        In reality there is another method of control in between, its called Incremental Control.

        In fact the 737 Stab does have a visual indicator of where its at.

        Having worked with both systems, its a toss up.

        Linear actuators in fact do not have inherent feedback, it has to be built in.

        And you do not want instantaneous response to controls regardless. An aircraft that has that is extreme in its movements if it can survive it at all (think of the A300 tail snapping off over Long Island)

        Which also is an interesting facet unto itself, you cab move the ruder maximum without any speed smoothing circuitry and rip the tail off.

      • Philip,

        It’s sad you feel the need to apologize for your formal training. I will never apologize for my formal training in this subject matter, as I was trained well.

      • @Philip, you’re reciting the ideal case. What matters is what does the AoA event detection do when one or both AoA vanes are broken or some software bug happens?

        Two identical vanes plus two copies of the same software running on separate installations of the same FCS hardware does not add up to fault tolerant safety critical design. Rather it promotes the chances that a fault will become fatal. It may be better than the junk that was MCAS1.0, but not good enough to be acceptable.

        • I agree. I was stating the ideal. I don’t even like the ideal, when everything is working.

      • Not at all philip, your insight is very welcome.

        Well Boeing certainly could innovate, as long as they keep within a proper peer reviewed develop process with thorough testing and validation. Regulations don’t disallow innovation.

        • Your words remind me of A Jones. I have repeated said I think Boeing engineers have been forced into MCAS because I can’t believe they would do it willingly. A Jones disagrees. He thinks all the good engineers have left the building. I’m beginning to think he’s right.

          Please stay away from the self appointed superiority. That’s TW’s job. If you have something to say, say it.

        • Philip, I meant it as more than a generality. It should have applied in this case. Of course wherever that would have lead Boeing, and as was proven twice they should have been lead away from MCAS. I find it hard to believe there is no competence at Boeing, rather think this was consequence of managerial decisions.

          There… I’ve said it. Not that I hadn’t before.

      • The stabiliser down trim is now to be limited per MCAS event such as to allow sufficient elevator authority to over power the trim. Surely to do this MCAS a must know the aircrafts C of G and weights? It should also take into account the aircrafts throttle setting and speed. If not it must be very crude.

  3. On a positive note, it seems tht Boeing and Mr. Muilenberg have actually been listening and/or thinking clearly about how they should go forward on getting the grounding lifted worldwide, with the acceptance of, at least, a large majority of the certifying authourities.

    • Let’s not get too carried away. EASA have said a few things that are code phrases for “bin MCAS or put in full FBW, no half measures”. Boeing might get a nasty shock…

      • As it should be. Max 8, doomed to fail. Satisfying stockholders with an unworthy a/c is just plain wrong.

  4. ‘Greg Feith and John Goglia were at the briefings’

    I don’t wish to cast aspersions but these two seem to be apologists for Boeing in their writings focusing on the now discredited ‘blame the foreign pilots’ trope. It seems curious that their blog seems to be invented to ‘deal’ with the MCAS issue. Are they close to Boeing and is this again an opportunity to spin? I could be wrong..

  5. In the David Learmount article, Test Pilot Bomben says
    ===================
    “But if it is correctly triggered, the system now “operates only once per AoA event”, according to Bomben, and when it does trigger stabiliser movement, it memorises how much displacement has taken place, so if it were triggered again it would take account of existing stabiliser displacement and will not apply more than a safe cumulative limit.”
    ==================

    In the CBS News graphic
    =============
    “MCAS will activate once per high angle-of-attack event, and pilots can always override MCAS
    without the system activating automatically a second time” from CBS graphic
    ============

    So, how does a pilot know when MCAS triggers? Is there a light that bllnks? What is the exact definition of a “high angle-of-attack” event? Dependent only on AoA, or also Mach speed, and angle of bank? What is the “safe cumulative limit?” Does the “safe cumulative limit” reset per flight, or per time limit? When/how is an “AoA event” reset? After a certain time period, the lowering of AoA to some value? The only “OFF” switch to MCAS, is still the, frozen at high settings, manual trim wheel, leaving the Pilots without the Manual-Electric yoke mounted trim switch? Will Boeing be showing any more details than this to 737 pilots? If I were a 737 Pilot and Boeing only told me these vague references to how MCAS operates, I’d be royally pissed.

    • @ Richard,
      The only feedback (to pilots) of MCAS activation – I know about – is the ‘noise’ from the running Hstab wheel. However, Maintenance should get data through the ACMS (Aircraft CondMonitoring System) on the ground. The Flight Data Acquisition Unit (FDAU) which dumps data to the DFDR, also (should) do the same to the ACMS. I guess the ‘follow-up’ will be rigorous (and interesting!) when the B737MAX again take up flying.

      I guess performance data will be collected and studied in to the dark hours – I hope they share the findings with us.

      • Svein. also the stabilizer position is indicated next to the trim wheels. But my guess is the first diagnostic information the pilot has is that the nose is dropping.

        If he is isn’t commanding it via the elevator and control column, then first check would be the stabilizer indicator. He further knows that the aircraft design requires nose-up trim (a prerequisite of stability), so the units should be above 4 degrees, typically at 5 or 6 degrees.

        So if the aircraft is going nose-down and the stabilizer is below 4 degrees, that’s a good indication that the stabilizer is the cause, and from that point he has memory items for what to do.

        I think automation is great, and building as many protections and redundancies into MCAS as we can is fine, but there is no substitute for a simple understanding of the aircraft and how it flies.

      • @SveinSAN

        Without separate warning light MCAS was and probably will be unrecognisable.

        Both normal working STS and normal working MCAS are pitching aircraft the same way – they both use same jackscrew and sameengine, trim wheels are moving at same pace – the only difference is that both systems are activated by different computer algorithms. From outside, during a flight – no one can tell. After a flight – maybe computer analyst will figure out what triggered jackscrew movement.

  6. I hope EASA’s own review doesn’t result in MCAS getting classified as anti-stall system for re-certification. That would be a depth charge.

    • Quite the contrary, we should all hope that this will be what EASA does: Classify MCAS as what it is. The whole world knows for quite some time now that this is the elephant in the room. Many with a direct interest in Boeing would of course never admit it and will find a thousand words to explain what they don’t believe themselves (…only purpose is to give the same feel, bla, bla, bla,…). The test flights with MCAS switched off will show that the handling of the MAX is not tolerable over the entire flight envelope. It may be only with extremely light or heavy load factors, at very slow or high speeds, flying really tight turns, from hot/high airports, in heavy winds, you name it, but you would either exclude this from the allowed flight envelope and thus reducing the operational capabilities of the MAX (significantly?) or you find a different solution.

      Why not try a larger elevator to begin with? This could be implemented relatively easily. Should this not suffice, there is the next option – enlarging the stabilizer. And of course fix the automatic speed trim and the manual trim, while we are at it.

      Sure it will cost quite a lot of money, it will make Boeing look bad at first glance, it will take quite some time, it will be new parts that need to be designed, tested, built and implemented, but it might restore a lot more confidence in all customers than only a software update could.

      • Said flight have occurred and showed nothing of the sort.

        In fact, MCAS was not even considered initially and all testing was done without it.

        All the data on test flights is recorded and is available to all AHJ who want to review it.

        So instead of repeating this falsehood, it would be good to report some factual evidence if you think you have any.

        • Hi TransWorld,
          I thought these flights have not occurred until now. I haven’t seen this (EASA pilots flying the MAX without MCAS) in the news. Can you post a link to this, please?
          Regards,
          Björn

          NOTE: This is a different Bjorn from LNA’s Bjorn.

          Hamilton

          • Bjorn #2, this was discussed in Bjorn #1’s last column. EASA has access to the original data from Boeing’s test flights that established the need for MCAS.

            But they raised a concern that the FAA had not flown those tests themselves and verified the data, they had accepted Boeing’s evidence instead. So now EASA wants to fly similar tests, with EASA pilots and without MCAS, to see for themselves.

            EASA is looking to verify the original decision, and also to quantity the behavior and benefit of MCAS, by comparing to the case without. That’s a prudent move and no one has objected to it, including Boeing.

            The delay has been the software audit which is not yet complete. Once it is and those concerns are addressed, with software in near-final form, then EASA will have their flights.

            EASA has not signaled that there is a huge problem here. They have said that they expect certification to be a few weeks behind the FAA.

            We’ll have to see the results, and further requests and corrections may emerge from it, which add further delay, but I don’t think this is the smoking gun that some have claimed.

          • Bjorn translates as ‘bear’, maybe a good 2nd choice

          • @Bjorn (not Fehrm 😉

            Afaik nor FAA nor EASA flew MAX without MCAS, only Boeing.

            Boeing knew they would be in trouble with certification so they added MCAS and then as a whole package delivered to FAA, which made some inextensive flight testing / Boeing worsen MCAS (depends who will want blame whom in near future).

            So until EASA will check it well – no one can tell how much troubled airframe MAX is, or not. We all guessing in fact – some have good arguments, some lame, and some just presenting lack of arguments as facts.

  7. That’s not unfortunately all – Boeing says: no sim training, just iPad game like last previously.

  8. Craig Bomben says, according to David Learmount:

    But if it is correctly triggered, the system now “operates only once per AoA event”, according to Bomben, and when it does trigger stabiliser movement, it memorises how much displacement has taken place, so if it were triggered again it would take account of existing stabiliser displacement and will not apply more than a safe cumulative limit.

    This is very similar to what I suggested a couple weeks ago.

    MCAS is reset by both a trim input from the pilot and MCAS retrimming ANU after the AoA falls below a reset threshold.

    This makes sense because MCAS has to handle the possibility that during the non-normal maneuver the pilot can use the column switches to apply manual electric ANU trim that counteracts the AND trim from MCAS. Some sort of reset and re-apply logic is needed. After all, the risk of overcontrol remains if the above threshold AoA condition persists, and MCAS is there for a reason.

    However, it makes no sense that subsequent MCAS AND inputs during the same non-normal maneuver should be the same magnitude as the initial MCAS input. As far as I can tell, this is the way Boeing implemented original MCAS. In my thinking, subsequent AND inputs should only bring the stabilizer to the same target position based on AoA and Mach number. After all, the pilot might not apply enough manual electric ANU trim to completely cancel out the AND trim input that MCAS provided.

    The only real way to correct this is for MCAS to monitor the stabilizer position, either through a sensor or by tracking and integrating all of the stabilizer commands. This way cumulative MCAS actions will never move the stabilizer more than the original target value. If MCAS is limited to only one action for every over-threshold AoA event, then the possibility exists for the pilot to inadvertently de-activate MCAS by electrically trimming ANU during the maneuver.

    https://leehamnews.com/2019/11/22/bjorns-corner-analysing-the-lion-air-jt610-crash-part-4/#comment-290363

    • Mike, I agree, you correctly described the faults in MCAS 1.0 and the required actions of MCAS 2.0. Basically the output becomes bounded, as hopefully the AoA and any other inputs are now as well.

      The pilot is assisted by MCAS as long as the nose remains above the threshold. If it stays up forever (as in the malfunctions), MCAS will either reach the bounded maximum deflection (2.5 degrees) or timeout, or both, but it will not reactivate after the timeout occurs, until the nose comes down below the threshold and it resets.

      Additionally the nose-down reset will remove the deflection introduced by MCAS. But the deflection will remain in place in the case of a timeout, because as you said, the pilot may be intentionally holding the aircraft nose-up.

    • I’ll add that in the case were the full MCAS authority remains stuck in place (2.5 degrees), due to any kind of malfunction, the elevator has sufficient authority to counter that, although the column forces are increased We saw this in both of the accident flights. The pilot can relieve the forces with electric trim, to bring the stabilizer back above 4 degrees. Or with manual trim wheels if needed.

  9. Don’t bend; don’t water it down; don’t try to make it logical; don’t edit your own soul according to the fashion. Rather, follow your most intense obsessions mercilessly.

    Now the Sirens have a still more fatal weapon than their song, namely their silence. Someone might possibly have escaped from their singing; but from their silence, certainly never.

    What if I slept a little more and forgot about all this nonsense

    Franz Kafka

    • “A Little Fable” by Franz Kafka:
      “Alas”, said the mouse, “the whole world is growing smaller every day. At the beginning it was so big that I was afraid, I kept running and running, and I was glad when I saw walls far away to the right and left, but these long walls have narrowed so quickly that I am in the last chamber already, and there in the corner stands the trap that I am running into.”

      • That fable is quite fitting for such a Mickey Mouse organization as Boeing, or what’s left of the original one, that is before 1997.

        • @Uwe & @Normand Hamel

          I prefer to go with the wisdom told by lady from Amherst – Emily Dickinson:

          “To pity those that know her not
          Is helped by the regret
          That those who know her, know her less
          The nearer her they get“.

          Guidance: replace ‘her’ with ‘it’

  10. I do respect many comments on this site. But can I pick up on Richard Davenport contribution. He pointed me toward history. The history of Boeing with regard to stabilisers and elevators. I did read your links and with great interest. Many thanks.

    Boeing do design airplanes with marginal elevator authority. There is nothing wrong with that. Provided the airplane is stable.

    But the airplane must be stable. Instability chips away at the elevator authority. This is especially true if the elevator authority is marginal.

    So we come to the 737. It started stable. But changes chipped away at the stability. The MAX isn’t stable to the point at which the elevators can’t control the stability. Hence the need to move to the stabiliser to control stability.

    But thanks to Richard. I didn’t know the history. I do know. The links needed a lot of thought. I suggest others read them.

    • One must blame it it one the loophole, which is grandfathering. This a/c has been flying since 1967, has had many grandfathered changes and yet it is an old a/c. Sorry, Boeing has/did sell it’s collective soul to profits over people….a part of business as usual in these United States.

    • There seem to be a few, low speed, pitch up, loss of elevator authority, 737 accidents. I think some of these may be flying on the “back side of the power curve” as they seem so low in airspeed, high in pitch, and high in power. Not to get into these situations in the first place, is a good idea. But, when pilots find themselves in them, the elevator has less authority at low airspeed, high AoA. I think the pitch up can be caused primarily by the pitch up rotation momentum of the engine as described in this link (especially if the aircraft is at low weight)
      ==================
      pitch up rotation momentum
      https://www.linkedin.com/pulse/lessons-from-boeing-737-max-crisis-octavian-thor-pleter
      ==============
      Tatarstan Airlines Flight 363 (While the engines accelerated to near takeoff thrust, …gear up/flaps up …. and the aircraft pitched up to about 25 degrees nose up)
      https://www.avherald.com/h?article=46b9ecbc&opt=7168
      =============
      Thomsonfly (“The result of applying maximum power was that the engines exceeded their full power setting, causing a nose-up pitch moment that exceeded the elevator authority, although the captain had applied full nose-down pitch on the control column)
      https://www.flightglobal.com/thomsonfly-737-stalled-on-approach-says-uk-accident-report/86596.article
      ===========
      UTAir 558 (during a go-around, used Rudder and Aileron’s to get the pitch down, after elevator couldn’t respond enough at elevated pitch. An incident, but, not an accident.)
      https://www.aeroinside.com/item/10433/utair-b735-at-moscow-on-oct-13th-2017-loss-of-control-recovered
      ==========
      Wild youtube simulating the pitch changes on UTAir 558 (in Russian)
      (at the :30 mark, you see full elevator down, but, not much happening, so the pilot goes to the Aileron’s and Rudder) (which is in the Boeing manual for full stall recovery.. shed Alpha)
      https://www.youtube.com/watch?v=zmg-tLuMmJo&feature=youtu.be
      ============

  11. How’s MCAS work? The New York Times, Seattle Times, and Leeham have described the nature of MCAS, and now I hear some experts contradict some of that. MCAS isn’t needed at high speed stalls? MCAS isn’t needed to counter the pitch up of the engines at high AOA? MCAS will run only once? Now maybe twice? MCAS has multiple rates and variable durations instead of fixed? MCAS returns in the reverse direction once it goes under the trigger AOA?
    If Boeing can’t articulate exactly how MCAS worked the first time, and how it works now, at least EASA is keeping them honest, because right now, it looks about as clear as mud.

    • Ted, I think the comments that were made are consistent with the discussions we’ve had thus far.

      Bomben did not discuss the high-speed case but we can reasonably assume it exists, and that MCAS uses different trim rates and authorities for different airspeeds. That would only make sense.

      Also his comments about center of lift moving forward, are another way to describe the effect of the engine nacelles. If you add lift in front of the wing, that moves the center of lift forward. In technical terms, the pitch stability of the aircraft becomes non-linear when that happens, and the pitch-up motion tends to accelerate. That is what MCAS is meant to address.

      As far as the multiple activations, he was saying that the MCAS contribution to stabilizer defection is now bounded (2.5 degrees). No matter what the sequence of activation is, it cannot exceed that contribution.

      So for example, if MCAS runs out 2 degrees of deflection in an activation cycle, and then there is a pitch oscillation (AoA drops through the threshold but pops back up again), although that triggers another cycle, MCAS cannot apply more than 0.5 degrees in the new cycle, so that 2.5 degrees cannot be exceeded (or whatever authority it’s using for that airspeed, 2.5 being the worst case)

      MCAS was always designed to remove it’s contribution if the nose dropped back down through the deactivation threshold. We never saw that behavior in the accidents because the AoA sensor was stuck high. Instead we saw the timeout behavior where it reset and tried again.

      That behavior is now removed If the sensors are both stuck high, MCAS will stop at its authority limit and do nothing more. At that limit, there is still sufficient elevator authority to compensate, but with increased column forces. Then electric or manual trim could be used to remove the MCAS contribution and relieve the forces.

      • I don’t disagree with anything you say, I just would like to see something like you wrote in writing from the FAA or Boeing.

        Although longitudinal stability, the reason for MCAS, was described here in a graph of moment coefficient versus AOA, in the Part 25 Airworthiness standards, it is described in terms of stick force and airspeed.

        25.173 Static longitudinal stability.
        (a) A pull must be required to obtain and maintain speeds below the specified trim speed, and a push must be required to obtain and maintain speeds above the specified trim speed.
        (c) The average gradient of the stable slope of the stick force versus speed curve may not be less than 1 pound for each 6 knots.
        25.175 Demonstration of static longitudinal stability.
        (b) Cruise. Static longitudinal stability must be shown in the cruise condition as follows:
        (1) With the landing gear retracted at high speed, the stick force curve must have a stable slope at all speeds

        §25.201 Stall demonstration.
        (a) Stalls must be shown in straight flight and in 30 degree banked turns
        (1) Starting at a speed sufficiently above the stalling speed to ensure that a steady rate of speed reduction can be established, apply the longitudinal control so that the speed reduction does not exceed one knot per second until the airplane is stalled.
        (2) In addition, for turning flight stalls, apply the longitudinal control to achieve airspeed deceleration rates up to 3 knots per second.

        I think that is the relative portion, and the FAA and Boeing have to build a logical proof from that point for the world to see.

        If MCAS runs for 9 sec, that could equate to a max allowable 9 knot decel in a level test or max allowable 27 knot decel in a bank test, for whatever that’s worth.

      • Rob,

        I pleased that you now agree with what I said a year ago when Bjorn said it was all about the CoG. I responded by saying it was about the CoL. Specifically the nacelles are extending the mean chord of the wing forward. In doing so, the CoL is moving forward causing a moment that accelerates.

        But to add. Boeing decided to control the moment using the stabiliser. In doing so the stabiliser is opposing the elevators. Ultimately, the reason for both crashes was elevator inoperability because they were being opposed by the stabiliser.

        We are told the new MCAS won’t make the elevators inoperable. But the stabiliser will still be used in a manner that opposes the elevators, reducing the authority of the elevators. By how much is unknown.

        We don’t agree on when the accelerating moment starts. The Lion Air crash reports says at elevated AoA. Elevated is anything above standard. Standard is 3° or less. That’s logical given the very forward but very high nacelles. The nacelles will generate significant lift even at relatively low AoA.

        I think the MAX failed the high speed nose up turn test and the low speed elevated AoA test with flaps up. But let’s see what EASA says. But the pitch instability has been confirmed by the JATR/LION Air crash report. That should no longer be subject to question. How bad it is needs to be addressed by EASA.

      • Rod: “Instead we saw the timeout behavior where it reset and tried again. ”

        No it was reset by the pilot trim input not some timeout.
        The same way STS resets. Pilot trim input stops the movement (STS or MCAS) and resets the system after 5 seconds.

        Had the pilots not manually trimmed after MCAS movement it would not have moved the stabilizer again.

        • Thank you STDog, I had been wondering about the reset and timeout and how that interacted with electric trim.

          I think I understand now that MCAS runs up to 10 seconds for every activation, unless interrupted in some way (AoA decrease or electric trim).

          If the interruption is AoA decrease, MCAS should then reverse/back out the change it made. Do you know if it also reverses for pilot interruption by electric trim?

          • I don’t think it would in that case. The assumption being that if the pilot trimmed it was to a proper setting. Part of the Boeing “pilot in control” mantra. The system wasn’t going to second guess the pilots desired trim settings.

            So MCAS just reset fully. That’s how it got so far out of trim. MCAS adds 2 units and is stopped by manual input that removes 0.5 units. Then MCAS triggered again assuming it was in a trimmed state.

            That matches what I’ve seen about STS. No memory of what was done when interrupted. Resets to the initial state waiting for the external trigger.

            The design just didn’t properly account for the bad AoA input. Not with hysteresis to ensure a new event (added in the new version) nor any range check for realistic values (AoA above 30 means more trouble than MCAS is going to help with).

  12. It boggles my mind that some here still think that the MAX is somehow unstable in pitch after all the excellent analysis in the Bjorn’s Corner series (by a guy who has years and years of direct experience and expertise) and very compelling evidence to the contrary.

    To be clear, the MAX does suffer from a sudden reduction in stability in the high pre-stall AoA regions of the operational envelope. How serious is this issue? Well, Boeing thinks this is a MAJOR issue according to their FHA (loss of MCAS function was assessed as MAJOR in the operational envelope). This was confirmed in the KNKT report, contrary to what some might claim. So, this reduced stability region has to be dealt with unless the regulators want to relax their safety requirements.

    Reduced stability is not the same as unstable. Reduced stability means the pitching moment will still always act in the direction of restoring the aircraft to its trim condition when the AoA is upset, it’s just that the restoring moment is smaller than it is in other regions of the envelope.

    The KNKT report first describes this phenomenon as a “nose-up pitching moment” and states how it affects the stick force characteristics covered by regulations. Then in the same paragraph the report uses the expression “pitch up tendency” to describe this same phenomenon. This doesn’t mean the aircraft suddenly pitches up on it’s own once a certain AoA is reached. It means that the moment balance is changed so the aircraft is easier to pull up.

    Reduced stability regions can be easily dealt with by a function such as MCAS, especially if those regions are relatively small and near an edge of the envelope (stall).

    Unstable is a whole other deal. If the MAX was indeed unstable in pitch, even in the the relatively remote high pre-stall AOA region, a function like MCAS could never be used to compensate for it. The stabilizer and elevator can only shift the pitching moment curve up and down but can never change the slope which determines the natural stability. So, even with MCAS, an unstable MAX would still suffer control reversal and would be impossible to certify or sneak past the regulators.

    Also, MCAS only applies predetermined and fixed AND inputs to the stabilizer when the AoA is above a predetermined threshold, and then undoes them with ANU inputs once the AoA is again below the threshold. MCAS does not provide proportional AND and ANU inputs that are dependent on the constantly changing AoA magnitude. MCAS is threshold based open loop control law within STS, not a closed loop system that can provide artificial stability based on feedback from sensors.

    Even though the implementation of the original MCAS was atrocious, I don’t think Boeing aerodynamicists are stupid, and they would have to be stupid to think an unstable aircraft could be corrected with a function like MCAS, even in remote parts of the envelope.

    The Seattle Times recently reported that Boeing performed a series of MAX flight tests over the summer with MCAS disabled. Now Boeing revealed that the the MAX has undergone 240 hours or “regulatory scrutiny” in the simulator after spending 1,200 hours refining the simulator. I think it’s very likely that the FAA has participated in MCAS disabled simulator sessions.

    But the first “public test” of the MAX with MCAS disabled occurred just over a year ago on the flight before right before LNI043. During this flight the left AoA sensor failed open circuit causing speed and altitude disagree alerts for the majority of the flight. Since the failure was open circuit, MCAS activation was prevented. No control problems of any kind were reported even though MCAS was effectively disabled.

    Since typical cruise is is flown at 2° – 4° AoA and 6° – 8° AoA are typically achieved in normal turns, we know for sure that the MAX has no stability issues below at least 8° AoA.

    Claims that the MAX is unstable seem to be based almost exclusively on the fact that Boeing chose to have MCAS activate the stabilizer instead of the elevator or instead of changing the elevator feel based on AoA input. “They must doing something nefarious like trying to cover up an ineffective elevator!”
    This is a weak argument based on pure speculation.

    What about the fact that it is much simpler and easier to make a software change in the STS within the FCC than to completely redesign the long proven hydro-mechanical elevator feel system to accept electrical signals it never before could accept? Or perhaps MCAS is much lower risk if implemented properly than to try aerodynamic fixes that the engineers had little confidence in.

    No, I agree with Bjorn. It is settled. The MAX is stable in pitch.

    • Clearly the JATR/LION Air crash reports don’t agree with you. To use the reports, MCAS came about because of a pitch up tendency in high speed nose up turns. It was then modified for a pitch up tendency at low speed, elevated AoA with flaps up.

      What you are saying means MCAS is unnecessary. Well if it’s unnecessary get rid of it.

      With regard to a cover up. Even now Boeing can’t agree with what the official reports say. As Ted says, they are still very muddled in what they say.

      They are using the stabiliser. But in a fashion that has never been used before. It’s a fair question to ask why!

      Ten billion dollars and counting, 9 months and counting for something that is a “minor” hazard, as per a FHA. Everything on an airplane is at least a “minor” hazard.

      P.S.

      If you do know of another airplane that uses a stabiliser in this fashion, please name it. Exclude the Tristar. The Tristar has a fully redundant high speed stabilit at or. Those words don’t apply to the MAX trim stabiliser.

      • Philip,

        I said:

        To be clear, the MAX does suffer from a sudden reduction in stability in the high pre-stall AoA regions of the operational envelope.

        and:

        The KNKT report first describes this phenomenon as a “nose-up pitching moment” and states how it affects the stick force characteristics covered by regulations. Then in the same paragraph the report uses the expression “pitch up tendency” to describe this same phenomenon. This doesn’t mean the aircraft suddenly pitches up on it’s own once a certain AoA is reached. It means that the moment balance is changed so the aircraft is easier to pull up.

        In response you said:

        Clearly the JATR/LION Air crash reports don’t agree with you. To use the reports, MCAS came about because of a pitch up tendency in high speed nose up turns. It was then modified for a pitch up tendency at low speed, elevated AoA with flaps up.

        Please tell us all how what I said is not compatible with what you said in the quotes above.
        ——————————–

        I said:

        To be clear, the MAX does suffer from a sudden reduction in stability in the high pre-stall AoA regions of the operational envelope. How serious is this issue? Well, Boeing thinks this is a MAJOR issue according to their FHA (loss of MCAS function was assessed as MAJOR in the operational envelope). This was confirmed in the KNKT report, contrary to what some might claim. So, this reduced stability region has to be dealt with unless the regulators want to relax their safety requirements.

        Then you responded with:

        What you are saying means MCAS is unnecessary. Well if it’s unnecessary get rid of it.

        and:

        Ten billion dollars and counting, 9 months and counting for something that is a “minor” hazard, as per a FHA. Everything on an airplane is at least a “minor” hazard

        How did I say that MCAS isn’t needed? I cited the NTSB addendum to the KNKT report, Table 7 on page 272. It is a summary table of Boeing’s FHA for MCAS which clearly states that loss of MCAS function was assessed as MAJOR in the operational envelope. Obviously Boeing thought and still thinks MCAS is needed. Why do you persistently maintain that loss of MCAS is only a MINOR hazard when the report clearly says otherwise? You do know that others here can look it up for themselves, right?
        ——————————

        They are using the stabiliser. But in a fashion that has never been used before. It’s a fair question to ask why!

        Of course it’s a fair question to ask why. However, that is not only what you’re doing. You are also using Boeing’s use of the stabilizer to propagate and promote the “MAX is unstable” falsehood.

        What’s the big deal if the MAX stabilizer is used in a novel way? It’s a stability augmentation function just like STS is a stability augmentation function. STS makes adjustments to the stabilizer based primarily on airspeed and MCAS makes adjustments to the stabilizer primarily based on AoA. In principal, no big deal. The fact that Boeing screwed up the implementation the first time around doesn’t change this.

        Finally, it should be obvious that Boeing’s public face is not the same the one they present to regulators. I can’t fathom why anyone would assume differently. If there is a company that is different, please let me know.

    • So many words, so few facts, just adding to the huge pile of Boeing’s permanent lies and obfuscation.

      I have a PhD in aerospace engineering, I teach aircraft design, and I’ll believe that the MAX is stable in pitch when EASA says so. Not Boeing, not the FAA, not Bjørn Fehrm, not Rob or Mike Bohnet, none of all the apologists and paid shills.

      I’m patiently waiting for EASA’s flight tests with MCAS off.

      • Bernardo, I think we all are waiting at this point. This issue needs to be finally laid to rest, one way or the other.

        If you are right, then all the work done by Boeing thus far has been pointless, and we are no farther along than a year ago, despite continuous and unprecedented oversight by world-wide regulators.

        If Bjorn, Mike and others are right then we can have the MAX be certified for flight, with full support of the regulators.

        There could be an in-between result as well, the regulators may ask for more improvements and changes. We’ll just have to see.

        If that happens though, the battle here will continue to rage, as each side will say it supports their position. So I really hope there is a definitive resolution instead.

        • Agreed, except for one point: Unlike others, I’m not claiming to know the truth. I’m asking for the truth to be revealed, by the people in the direct know, not by such with second-hand knowledge or such with hidden agendae.
          There is a fierce war of information going on due to the immense stakes, and it tires, frustrates, and infuriates me having to tell correct data from deliberate misleadings.

          • I think that goes back to whether we trust the agencies that serve as our proxies. Boeing cannot possibly consult with very person who has an interest or a background in this area. Nor are they obligated to share information with everyone who asks.

            So we create regulators and investigators, to whom Boeing does have to answer, and is accountable. They act as proxies for us, but also have an obligation to preserve Boeing’s rights.

            The law is very clear on this. The proxies can breach confidentiality if it conflicts with public safety, or is a significant finding in the reporting. But not generally otherwise.

            So we have to be satisfied with that, and be vigilant to see if the proxies are doing a good job. For the FAA, that came under question because MCAS passed certification.

            So now we have people from around the world looking over their shoulder, but at least it was by their own invitation. Still, there will need to be broad agreement to ensure that the result is widely accepted.

            I wish I could se all the data too, but I recognize there is no obligation on the part of anyone to share with me.

          • If MCAS is required to pass these requirements:

            Part 25 Airworthiness standards:
            25.173 Static longitudinal stability.
            (a) A pull must be required to obtain and maintain speeds below the specified trim speed, and a push must be required to obtain and maintain speeds above the specified trim speed.
            (c) The average gradient of the stable slope of the stick force versus speed curve may not be less than 1 pound for each 6 knots.
            25.175 Demonstration of static longitudinal stability. (b) Cruise. Static longitudinal stability must be shown in the cruise condition as follows:
            (1) With the landing gear retracted at high speed, the stick force curve must have a stable slope at all speeds
            25.201 Stall demonstration.
            (a) Stalls must be shown in straight flight and in 30 degree banked turns
            (1) Starting at a speed sufficiently above the stalling speed to ensure that a steady rate of speed reduction can be established, apply the longitudinal control so that the speed reduction does not exceed one knot per second until the airplane is stalled.
            (2) In addition, for turning flight stalls, apply the longitudinal control to achieve airspeed deceleration rates up to 3 knots per second.

            Why would a Canadian official suggest MCAS be removed, or why would EASA still be questioning this a year later if it is so cut and dry?

            Aside from those two official sources, Boeing and the FAA haven’t said anything definitive. This leaves journalists like John Ostrower reporting inside sources, Bjorn on Leeham who has a degree in AE, and Peter lemme who has a degree in AE and EE, but even in those two cases, their expertise may not be in aircraft stability performance and testing. Although we may not have heard from those experts at the FAA and EASA, we know they haven’t signed off yet.

          • Ted, I think there will always be diversity of opinion, and dissent from the majority view. The more people you have involved, the more likely this is. Even in this forum, you’d be hard pressed to find two people who agree 100%.

            In that case the thing to do is not to suppress the dissenters, but let then speak and use all their arguments. Then they can be evaluated to see if they shift the majority view. If they don’t, then they have the minority view and they can keep looking for further evidence to support their case. But in the meantime, the majority has to move forward.

            EASA and the FAA are negotiating their agreement, as both have understood they need to agree, to avoid fragmenting the world’s transportation network. So each will have demands that they want to be met. EASA wants to test the MAX without MCAS, that is fine, and we shouldn’t assume that implies they won’t agree with the FAA.

            They both have defined processes they are following, so we just have to wait to let them finish their work. But I think the result will be agreement on a common position, whatever it is.

      • Bernard

        Me to. But please understand the need for deduction in the absence of facts. But then perhaps you do.

        One of the things I would like to happen is the facts presented to accudemia. I trusted my tutors and what they said didn’t let me down whilst I was at university and even through my career which involved ruthless industrial behaviour.

        The truth isn’t known. My words are deduction and I know that.

      • Bernardo,

        So many words, so few facts, just adding to the huge pile of Boeing’s permanent lies and obfuscation.

        So, you think I’m lying and trying to hide the truth? If so, please point out specifically where I’m guilty of this in my comment. Merely stating you have a PhD in aerospace engineering doesn’t lend any credibility to your charges. Frankly, it’s a lazy response and it doesn’t mean anything in this forum where anonymity is standard.

        Further down you say:

        I’m asking for the truth to be revealed, by the people in the direct know, not by such with second-hand knowledge or such with hidden agendae.

        and:

        There is a fierce war of information going on due to the immense stakes, and it tires, frustrates, and infuriates me having to tell correct data from deliberate misleadings.

        Are you implying that I have a hidden agenda and that I’m deliberately misleading others? Again, if so, please show us all specifically where I’m doing this.

        In my view, Boeing deserves to be bashed for pretty much every way they handled the MCAS situation, from the design all the way through to their response to the crashes. However, they should be bashed in a factual way, for the things they truly did wrong, not for things that we think they might’ve done wrong.

        There’s been a lot of lazy and uninformed bashing in this forum, especially over the last year or so.

        • Mike, some here believe we may be acting as agents of Boeing and trying to sway the discussion favorably in their direction. Hence the “are you being paid” remarks.

          If you defined an absolute scale to characterize Boeing, with Dr Evil on the far left and Mother Teresa on the far right, then you & I would be somewhat left of center, but for those much farther to the left than us, we appear to be well to the right.

          It’s just a matter of perspective. In the other column, I made a speech about the need to be truthful and objective and fair, and that the methods you use matter, but it attracted a lot of criticism. So all I can do is try to fight the good fight. My own view is that criticism works best if it’s tight and accurate, and not broad and diluted.

          For what it’s worth, you did an excellent job as always in your post. Very well written, very clear. So thanks for injecting a dose of rationality.

        • You, Mike, have been partisan in each and every of your “contributions”. So all you say has to be taken with a pile of salt.

          Further, nobody except Boeing cam tell how the MAX behaves in high angles of attack. EASA cannot, and they don’t trust Boeing, so they demand their own flight tests. Hi-fi CFD could not tell. But you, Mike Bohnet-from-the-armchair, can? I’m not even reading your postings in total and I can still reliably call out BS. All your words are meaningless and just muddying the waters.

          • Bernardo,

            So I’m partisan? In what way? Do you mean in the tired old Airbus vs. Boeing sense? Since you have identified yourself as someone who is “firmly in the Airbus camp”, I suppose defending the MAX design probably triggers you. But that is your problem not mine. Since you are admittedly an Airbus fan, I guess all you say should be taken with a grain of salt as well.

            I admit I have defended Boeing products a lot on LNA over the years because there has been a lot of broad, diluted and ignorant criticism directed at Boeing and its products. And lately, this kind of criticism is rampant here. But I challenge you to find any instance where I’ve unfairly criticized or mocked Airbus or its products. I did once strongly criticized an Airbus analysis years ago, but in my view it was justified.

            I agree that no-one besides Boeing knows definitively how the MAX behaves in a stall. However, that doesn’t mean that educated guesses can’t be made based on info gleaned from official reports, reporting by credible news sources, Boeing itself, technical papers in the open literature, and knowledge and experience in the field.

            I don’t think Hi-fi CFD is needed to know that the MAX is stable in pitch or that the boundary layer from the nacelles are thin enough to make it under the wing, for example. Simple estimates and educated guesses can suffice.

            Besides defending the wrong team’s product, what about my comment do you think is technically incorrect? You still haven’t said and I would be interested to know. But don’t make the mistake of thinking you are the only one that can suss out BS on this topic.

            Claiming all my words are meaningless without reading them though? That’s some real impressive next level stuff.🙄

            https://leehamnews.com/2019/07/01/pontifications-busting-the-xwb-brand-and-more-about-the-boeing-iag-deal/#comment-276550

          • @Mike Bohnet

            [quote]Since you have identified yourself as someone who is “firmly in the Airbus camp”, I suppose defending the MAX design probably triggers you. But that is your problem not mine. Since you are admittedly an Airbus fan, I guess all you say should be taken with a grain of salt as well.[/quote] Why don’t you mention the rest of my posting where I was calling for reasonable argumentation instead of crude Boeing-bashing?
            [quote]Claiming all my words are meaningless without reading them though? That’s some real impressive next level stuff.[/quote] As Philip put it so nicely: Deduction.

    • “” the MAX does suffer from a sudden reduction in stability in the high pre-stall AoA regions of the operational envelope. Boeing thinks this is a MAJOR issue according to their FHA (loss of MCAS function was assessed as MAJOR in the operational envelope). This was confirmed in the KNKT report “”

      KNKT didn’t flight test, they can’t confirm that it is only major. KNKT is only mentioning what the criminals want us to believe.

      “” the report uses the expression “pitch up tendency”. This doesn’t mean the aircraft suddenly pitches up on it’s own once a certain AoA is reached “”

      In turbulent conditions a pitch up tendency can multiply effects.

      “” Reduced stability regions can be easily dealt with by a function such as MCAS “”

      Jim Marko doesn’t think so.

      “” even with MCAS, an unstable MAX would still suffer control reversal and would be impossible to certify or sneak past the regulators “”

      Boeing self-certified it and hid the more powerful MCAS from FAA. Now Jim Marko said MCAS has to go.

      “” I don’t think Boeing aerodynamicists are stupid “”

      Engineers were forced with undue pressure not to report problems, kept in small groups without further information, some were replaced. Then after the crashes the criminals blamed pilots.

      “” The Seattle Times recently reported that Boeing performed a series of MAX flight tests over the summer with MCAS disabled. Now Boeing revealed that the the MAX has undergone 240 hours or “regulatory scrutiny” in the simulator after spending 1,200 hours refining the simulator. “”

      Boeing should have done that years ago. The failed ET sim was a reason why ET302 crashed.

      “” Boeing chose to have MCAS activate the stabilizer “”

      Boeing certified itself what JATR called “novel”.

      “” perhaps MCAS is much lower risk if implemented properly “”

      Jim Marko said it’s trash.

      • Leon,

        KNKT didn’t flight test, they can’t confirm that it is only major. KNKT is only mentioning what the criminals want us to believe.

        Flight tests don’t determine hazard levels. That is done way before flight test in the FHA. The FHA results drive the design requirements for a given feature. The KNKT report has an NTSB addendum that reveals Boeing’s FHA results for MCAS on page 272, Table 7.
        ——————————

        In turbulent conditions a pitch up tendency can multiply effects.

        Care to elaborate? Reduced stability is still stable.
        ——————————

        Boeing self-certified it and hid the more powerful MCAS from FAA.

        Not proven. We will find out eventually though.
        ——————————

        Engineers were forced with undue pressure not to report problems, kept in small groups without further information, some were replaced.

        So, you think management forced Boeing engineers to be stupid? Ok…..🤪
        ——————————

        Jim Marko doesn’t think so.

        Now Jim Marko said MCAS has to go.

        Jim Marko said it’s trash.

        I think you are putting too much stock in one guy’s opinion. Don’t get me wrong. I think he is legit and he presented an alternate point of view, which is healthy for the organization. However, his views are not Transport Canada’s views.

        Quite the pattern emerging here, though.

        Jim Marko, he’s our man
        if he can’t do it
        no-one can

        • Mike,

          “” Flight tests don’t determine hazard levels. That is done way before flight test in the FHA. The FHA results drive the design requirements for a given feature.
          Boeing thinks this is a MAJOR “”

          Boeing increased MCAS power after flight tests. Obviously something went wrong and Boeings assumptions were completely wrong and that killed. What the criminals think and their assumptions can never be confirmed by KNKT. KNKT doesn’t even have complete MCAS data. Makes no sense to have Boeing members in accident investigation teams. Thank God Ethiopia didn’t send the FDR to the US with their criminal corrupted system.

          Certified from the FAA was 0.6 deg with pilot training, not 2.5 deg with keeping it secret.

          EASA will never certify MCAS like the MAX is now. What do you think China and India will do. China might ask for Muilenburg to give him justice.

        • “” So, you think management forced Boeing engineers to be stupid? Ok….. “”

          In March 2019, reports emerged that Boeing performed the original System Safety Analysis, and FAA technical staff felt that managers pressured them to sign off on it. Boeing managers also pressured engineers to limit safety testing during the analysis.

          A 2016 Boeing survey found almost 40% of 523 employees working in safety certification felt “potential undue pressure” from managers.

          During design and construction of the MAX, the FAA delegated a large amount of safety assessments to Boeing itself, a practice that had been standard for years, but several FAA insiders believed the delegation went too far. By 2018, the FAA was letting Boeing certify 96 percent of its own work.

          The JATR found that Boeing exerted “undue pressures” on Boeing ODA engineering unit members (who had FAA authority to approve design changes).
          The JATR team identified specific areas related to the evolution of the design of the MCAS where the certification deliverables were not updated during the certification program to reflect the changes to this function within the flight control system. In addition, the design assumptions were not adequately reviewed, updated, or validated; possible flight deck effects were not evaluated; the SSA and functional hazard assessment (FHA) were not consistently updated; and potential crew workload effects resulting from MCAS design changes were not identified. Nor has Boeing carried out a thorough verification by stress-testing of the MCAS.

    • “” The Seattle Times recently reported that Boeing performed a series of MAX flight tests over the summer with MCAS disabled. Now Boeing revealed that the the MAX has undergone 240 hours or “regulatory scrutiny” in the simulator after spending 1,200 hours refining the simulator. “”

      Some posters don’t get it.
      EASA will not accept any regulatory delegation to Boeing.
      EASA wants to uncover all the cheatings Boeing did when Boeing self-certified 96% of the work.

  13. MCAS is still going to fire for 10 seconds of Down trim…

    In the AirDubai Rostov on Don accident, the pilot put in 12 seconds of Down trim. That didn’t work out well.

    This 10 seconds doesn’t seem linear to me. Or very controlled.
    They should put the G-sensor back in place. Negative G’s are not places you want to add nose down trim. And use some other feedback to stop, not just a time limit of 10 seconds.

    From a 737’s Training manual on stalls…
    ==============
    To recover from a stall, angle of attack must be reduced below the stalling angle.
    Nose down pitch control must be applied and maintained until the wings are
    unstalled. Application of forward control column (as much as full forward may be required) and the use of some nose-down stabilizer trim should provide sufficient elevator control to produce a nose-down pitch rate. It may be difficult to know how much stabilizer trim to use, and care must be taken to avoid using too much trim. Pilots should not fly the airplane using stabilizer trim, and should stop trimming nose down when they feel the g
    force on the airplane lessen or the required elevator force lessen.
    ============
    Note the very last sentence .. Pilots should not fly the airplane using stabilizer trim…..

    • 10 seconds is the timeout value, the maximum time it is allowed to actively operate. If the nose falls below the threshold within that time, it will stop and reverse its deflection. Also the rate and authority will be relative to airspeed. So it is a more nuanced control than just banging on the stabilizer.

      I think they found that the G-sensor doesn’t work for the low-speed case. But they could still use it for the high-speed case, as a safeguard.

      The case you cited is a full stall, you need to get the nose down to gather airflow under the wings and regain lift and control. In that case you use both elevator and stabilizer as needed. All hands on deck.

      The last sentence means that you use the stabilizer for trim and elevator to control the plane. That is consistent with the MCAS regime, where MCAS uses the stabilizer trim forces intentionally, to reserve elevator authority for the pilot.

    • Hi Richard,

      MCAS won’t always put in that much trim. 10 seconds of AND is the worst case. None of us know the MCAS schedule.

  14. So the “influencer” says this:
    ” I will say that flying the profiles reconfirmed what John and I have been saying since November 2018, and it provided us the opportunity to dispel the myths and misinformation that has been presented in both the media and the NTSC accident report.”

    These guys have been saying since November 2018 that MCAS wasn’t to blaim (much) but it was mostly the (third world) pilots. Contrary to all the information that has come out since.

    I wonder if Boeing invited any “influencer” that doesn’t think there are myths and misinformation in the NTSC accident report?

    • “Dispel the myths and misinformation ”
      Go on then and dispel away, by providing the correct information.

  15. Would an “OFF” switch, or a warning light on MCAS cost Boeing $750 million dollars? From published reports, Boeing has an agreement with SW Airlines that if the 737-MAX requires simulator training, they will pay SW $1 million dollars per aircraft. If I were the FAA, I’d want to look at that agreement, to see if it puts any undue pressure on Engineering decisions at Boeing, in regards to safety. At any discussions between Collins (the FCC maker) and Boeing, in terms of design requirements. Of course, I think that a plane that has had it’s engines doubled in thrust and changed from steam gauges to flat computer panels should have a new type certificate.

  16. Let me take another run at the rational for MCAS. Bjorn, Mike and others have done a great job of explaining this, but continue to be rejected by some commenters here. So here is perhaps a simpler approach to the same concepts.

    At the very least, it should provide much needed humor and target practice for the anti-MCAS folks. And perhaps as well to those more knowledgeable than I. 🙂

    If we begin with a simple force balance on the airframe, we know that the LEAP engine nacelles introduce an additional lift force at high AoA, above 10 degrees (Bjorn mentioned 12 degrees). Let’s call that force LN.

    Further we know that LN acts ahead of the wing, so it moves the CoL forward, and also that LN increases with increasing AoA. This combination leads to non-linearity (the bottom hook) in the pitch stability curve at high AoA. Expressed another way, this means the rate of pitch will increase with AoA. It’s also been called a pitch-up tendency, being nose-happy, or an accelerated pitch.

    Note that this is not an instability in the conventional sense. The aircraft is not at risk of suddenly flipping over or going out of control, in this regime of AoA. Rather the stability margin (or excess or reserve or buffer), is decreasing, and the decrease is occurring at an increasing rate with AoA.

    So if we have LN appearing and acting ahead of the wing at high AoA, then we need a counterforce on the airframe that acts behind the wing. We have two control surfaces available for that, elevator and stabilizer.

    Let’s begin with elevator. For level flight before LN becomes significant, the pilot has a linear control relationship with the column. If he moves the column distance X, he gets a pitch response Y from the aircraft. This behavior is fairly constant over the range of small AoA encountered in normal flight. It’s easily learned and the pilot incorporates it into muscle memory, it becomes instinctive.

    Now let’s consider higher AoA where LN becomes significant. The pilot still has elevator authority in the column, but there is a difference now. If he moves the column distance X, he gets only a fraction of Y in response. Also since LN is increasing with AoA, the fraction of Y he gets is decreasing with AoA. So he is getting progressively less response from the column as the nose goes up. He is now experiencing the non-linearity of the stability curve hook, directly in his control column.

    As Bjorn pointed out, this experience can be unsetting and uncomfortable. The pilot feels like his control authority is going away. The aircraft is now helping him get into trouble, rather than avoiding it, by enabling further rise of AoA into the stall regime.

    Does this mean the elevator authority is insufficient? No, it is exactly as it was before. And the pilot still has control, but his instinctive muscle memory no longer serves him. He has to learn the new behavior, which is now changing with AoA, at a moment when there is a risk of not arresting the pitch, and continuing into stall. The safety regulators absolutely do not want him put into this situation, so they make rules to help avoid it.

    Does that mean it’s impossible for the pilot to handle? No, an experienced pilot should have no trouble adapting. But the regulators do not allow that situation, because there are too many other unknown variables that might interact with it, even for an experienced pilot. You cannot foresee all ends, so you mitigate the risk. It’s good risk management.

    So could we use a larger elevator as a solution? If we do, that changes the relationship of column position X to aircraft response Y. But that relationship is still fixed, it still cannot adapt to the new & changing force LN at high AoA. So the pilot will still experience the effect of diminishing column response with increasing AoA. Or as Mike put it, the larger elevator shifts the stability curve, but does not straighten the hook, or at the very least, change its slope. As long as the hook remains, the pilot will have this experience.

    Obviously it would be great to provide the pilot with a linear response throughout the range of AoA, so that his muscle memory is always valid. This is equivalent to straightening the hook. Since LN is growing with AoA, we need a counterforce that also grows with AoA. We’ve seen that the elevator alone cannot achieve this.

    But as it happens, we have another control surface available, the stabilizer. If we can have the stabilizer work in conjunction with the elevator, such that the counterforce grows with AoA, the pilot will get the desired linear response in the column.

    Using the two surfaces together is somewhat similar to a stabilator, which has elevator and stabilizer always working in concert, rather than separately. It has the characteristic of being much more resistant to pitch problems, and that would be highly desirable here. It has disadvantages as well, so if we could create that behavior at high AoA only, that would effectively target our problem.

    And so we arrive at the concept of MCAS. Use the stabilizer to provide the counterforce to LN, which straightens the hook and gets us the desired column response, while not consuming the pilot’s elevator authority, and leaving it intact.

    Is MCAS perfect in this regard? No, it’s not a closed loop control that provides PID compensation for LN. But it alters the slope of the hook enough to comply with rules, and improve the pilot’s experience.

    MCAS can be an elegant and appropriate engineering solution, but it was horribly botched in the first version. So then do we throw it away or try to fix it? Boeing believes they can fix it and thus far the regulators have not discouraged them, although there are dissenting voices (Jim Marko and others). Marko’s criticism revolves around his belief that MCAS cannot possibly be fixed or made to work reliably or safely. If that is true, it should show up in the extensive flight & sim testing being done. Ultimately the regulators will have to decide.

    So that’s what I wanted people here to understand about MCAS. The attack may now commence. 🙂

    • Rob,
      If a 737-MAX is near stall, the stick shaker goes off, the pilot puts in TOGO full thrust, can he overcome the pitch up with only elevator at that point, or does he need to also use stabilizer, and sometimes even rudder and ailerons to lower the AoA? Boeing says that MCAS will not put the stabilizer in a position to over power the elevator now. How?

      • Richard in the situation you describe (near or at stall), the pilot is using TOGO thrust but instead of climbing out, wants to put the nose down and accelerate to recover. MCAS is helping him do that, and he should be commanding the elevator nose down as well. With both MCAS and elevator commanding nose down, it will drop and MCAS will shut off, backing out its contribution to the stabilizer. At that point the pilot is back on elevator alone.

        I think one point of confusion is that people are still thinking of MCAS in terms of the malfunction behavior, where MCAS used the stabilizer to oppose the elevator and could not be overcome.

        In correct practice, the opposition of MCAS to elevator should only be for guidance, it basically anticipates the need for the pilot to command nose down with elevator, and starts the process going for him. He should then follow with elevator to drop the nose, at which point MCAS shuts off.

        If he resists the cue from MCAS and does not use elevator nose down (high power climbing turn as evasive maneuver), then he will have to pull harder on the column to maintain the climb in opposition to MCAS. In that case MCAS makes it more difficult for him to pull up further and transition into stall. But MCAS will not exceed its authority, it will just wait for the nose to come down, until it times out.

      • Pardon me if this question isn’t valid (or too confusing. Not an engineer). But in this scenario, how long after TOGO thrust is engaged does the pitch up tendency last? I mean the effect of the increase in thrust causing an increase in AOA, at an increasing rate?

        What I think I mean is, does the increased pitch up force _stop increasing_ once the engines have spooled up and are providing continuous max thrust, or does the increased pitch up force continue until the aircraft accelerates to the trimmed speed?

        Also, in stall recovery, once the nose is down and the a/c is accelerating to above stall recovery speed, would the pilots have practiced reducing thrust promptly to a normal thrust for the altitude and attitude (thus stopping the MAX’s tendency to excess pitch-up?).

        • Raf, the engines spooling up would tend to increase the pitch-up. So going to TOGO thrust would have to be accompanied by commanding elevator nose down, in order to recover from a stall. Preferably you would push the nose over first and then add thrust.

          After the aircraft has accelerated to safe speed, you would need to reduce thrust, yes. You cannot continue at TOGO in level flight because the aircraft would overspeed, as occurred in the Ethiopian accident.

          Also just to clarify, when the nose is pushed over to lower the AoA, the MAX no longer has a pitch-up tendency. It only has that behavior at high AoA (above 10 to 12 degrees), and the only way for it to get into that attitude is for the pilot to pull back on the column and put it there. The autopilot is pitch limited and will never go there. So MCAS is mainly a handling protection for the pilot.

        • RaflW, Good Questions. It would depend on the Weight and Balance of the aircraft at the time, from what speed / altitude etc. It’s a dynamic component. You can pitch up quickly above stall, quite a bit, as long as you quickly have enough energy or force to bring it back into normal flight AoA. If for instance the airspeed is low, and the elevator loses effectiveness, you may have to cut the thrust, use other controls to turn and bank the plane, add flaps, add trim down, but, you can then get into a roller coaster ride, if you do things too quickly. You’ll get yourself into negative G’s and be floating in mid air, with very ineffective flight control surfaces. I knew a pilot that got himself into a flat spin, and the airflow over the tail was blocked, so he pulled one spoiler circuit breaker and deployed the spoilers to stop the spin and recover. He was much more of an experienced pilot than I. With these newer more powerful engines and their mounting, maybe Boeing will change their recommended stall procedures to not use full thrust, or reduce thrust after a certain point?

    • @Rob
      You call the stabilizer a control surface, and want to use it sort of as a stabilator.

      In that case, shouldn’t the the action/movement of the stabilizer be a lot faster, around the same speed as the elevator?

      IMHO it doesn’t move fast enough to be allowed to be used in that way.

      • Julian, the MCAS full authority deflection response time of the stabilizer is 10 seconds. It probably wouldn’t need that much deflection except in the extreme low speed case, when the aircraft is moving very slowly.

        For the high speed case, less than a degree is needed so that would be about 2 seconds. I think that is fast enough.

        The stabilizer is a more powerful surface than the elevator. The goal is only to assist in countering the nacelle force, which increases with pitch (AoA). I don’t think the MAX can pitch all that quickly, it weighs 60 to 80 tons, so has a lot of inertia.

        • My point was that if the stabilizer is seen as a control surface that might change the minimum speed requirement of the action/movement (from an FAA/EASA rules perspective).

          Doesn’t 2 seconds for 1 degree sound very slow to you?

          • It does seem slow, yes, in comparison to the elevator or other surfaces. But in the context of the force that’s being countered, which depends on aircraft pitch, it’s not that slow. The MAX pitching up several degrees would probably take several seconds.

            We know from the test pilot reporting, that MCAS is effective at its task. Whether it has lag issues that cause it to over/under correct, I don’t know. That would be the likely outcome of being too slow.

            The slow response would be most evident for the larger deflections required for low speeds, but maybe that is offset by the MAX pitch rate being slower as well, at low speeds.

            Whether the regulators would consider MCAS to be a control actuation or a trim actuation, I can’t say. It gets into the grey area that JATR noted about MCAS being novel. It would have been better for Boeing to do an issue paper on MCAS and have it formally considered, then all these questions would be answered.

            I’m hoping that some version of that is being done now, it’s being looked at in the context of the regulations, where that wasn’t done before.

          • That’s the issue, control actuation or trim actuation. It also explains Boeing’s use of words when describing MCAS. They want to avoid FAA/EASA ruling it’s control actuation.

          • Julian, Boeing is also worried about MCAS being called a Stall Protection system, as the regulations are much more specific in the design requirements. The JATR has an open Recommentdation about this, to the FAA
            =========
            Recommendation R3.5:
            The FAA should review 14 CFR 25.201 (Stall Demonstration)
            compliance for the B737 MAX and determine if the flight control augmentation functions provided by STS/MCAS/EFS constitute a stall identification system.

            Finding F3.5-A: The nose-down pitch identified during
            Boeing flight tests for stall appears to the JATR team to be the product of system augmentation with flaps and gear up, and is likely due to stabilizer motion from the MCAS function.

            Finding F3.5-B: The FAA-accepted Boeing flight test technique of freezing column deflection at the onset of
            EFS was perceived by the JATR team as possibly not meeting
            the requirements of § 25.201 for natural stall identification
            from nose-down pitch, not readily arrested. Column/elevator deflection data indicates that there may be an insufficient
            column input to attempt to arrest the nose-down pitch created by system augmentation.

            Finding F3.5-C: The JATR team considers that the STS/MCAS and EFS functions could be considered as stall identification systems or stall protection systems, depending on the natural (unaugmented) stall characteristics of the aircraft
            . From its data review, the JATR team was unable to completely rule out the possibility that these augmentation systems function as a stall protection system.

    • That sounds like a great explanation to me. I’m curious the specific conditions that make an aircraft start to see less longitudinal stability. What is the most unfavorable condition, max fore load or aft load? Or the angle of the stabilizer at stall? If it was heavily loaded with a fore load at low speed, the stab would be working hard at high angle nose up. Versus if it were lightly loaded with an aft limit load at high speed, the stab would be at low angle nose up. I’m surprised there was an issue at high speed. I’m also curious as to the range on the stab from 0 to 14 degrees nose up that MCAS is used for a correction. 10 to 14 degrees? 7 to 14 degrees? 4 to 14 degrees?

      • Ted, the stabilizing moment arm on the airframe is the distance between the aft-located CoL, and the fore-located CoG.

        Obviously these can move around a bit, but for a properly loaded and balanced aircraft, and speaking very roughly, the CoG is somewhere the near the front of the wing root, and the CoL is somewhere near the back of the wing root.

        So with that in mind, the worst case is aft-load as it moves CoG backwards and closes the gap between CoL and CoG, which lessens the moment arm. In that case the stability margin is reduced the most.

        As far as the effect on stabilizer, that is a different question, and you have represented it correctly. The stabilizer is a large and powerful surface, so it doesn’t need a lot of deflection. That’s one of the advantages, when trimmed at 1 degree or so, it’s effective yet introduces minimal drag, and maximizes fuel economy.

        As we saw in the accidents, a deflection of 4 degrees was enough for the pilots to lose control, if not counteracted.

        On the stabilizer, the indicated position is adjusted to reflect only positive values for the pilots, to avoid confusion, and also so the increasing scale represents nose up. Also called units rather than degrees, although 1 unit = 1 degree. Here is a conversion table:

        Deflection Indicated Result
        (degrees) (units)
        4 0 full nose down (MCAS 1.0)
        2.5 1.5 limited authority (MCAS 2.0)
        0 4 neutral
        -1 5 common trim in flight
        -12 16 full nose up

        The MCAS 1.0 output was unbounded, so it could use the full 4 degrees nose down, or zero units. For MCAS 2.0, the output is bounded at 2.5 degrees, or 1.5 units. That is still quite powerful, while also retaining the override ability of the elevator.

        It’s also notable that MCAS should now be a relative, delta value. So for example, if you start from 5 units, MCAS would reduce that to 2.5 units at maximum authority. If starting from 6 units, down to 3.5 units. This relative positioning allows the other trim systems (STS, MT) to remain in effect.

        Here is an image of an Embraer deflection scale:

        https://www.airteamimages.com/embraer-erj-190_ER-ECB_air-moldova_142006.html

        Here is an image of the MAX cockpit indicator:

        https://i.stack.imgur.com/3LwFX.png

        • When is the 0 units needed in flight? 1.5 units of the new limit of MCAS? I had not heard that. And I’m surprised it is so high, as I would have guessed at half the range, or 8.
          When I was talking about max fore or aft load, I was thinking about the actual loading of the aircraft which varies, and testing for the most adverse load condition is required. Of course the max fore load and max aft load are always ahead of the center of lift, I got that.
          Now in regards to the KC-46, perhaps the aft load limits were needed to be pushed farther back than on the 767-200, and that could explain the need for MCAS.

          • Ted, zero units would not normally be needed in flight, as it represents full nose down. MCAS 1.0 went there in the accidents because the output was unbounded, and when it reset after timing out at 10 seconds, the next cycle started at that position, and drove the stabilizer for another 10 seconds. Those behaviors are fixed in MCAS 2.0.

            1.5 units is equivalent to 2.5 degrees nose down deflection, which is the authority limit for MCAS 2.0. That also corresponds to roughly 10 seconds of operation.

            I’m not sure where you’re getting 8 units, that would be 4 degrees of nose-up trim. That’s a lot of trim, might be needed for an extreme aft-loading situation.

            In general the range of nose-up is greater than range of nose-down, because the aircraft is expected to always require some nose-up trim (1 to 2 degrees) at all times, as a condition of stability (location of CoL and CoG always create a nose-down moment which must be countered).

            With the KC-46 tanker, the issue is that it carries liquid fuel cargo which can easily move around (free surface effect), thus shifting the CoG readily in flight. The effect is suppressed somewhat with baffles and bladders in the tanks, and also by transferring fuel from one tank to another to help maintain balance.

            But it’s still a concern. If the nose pitches up, the free surface effect causes a similar accelerated pitch tendency to the MAX. MCAS was actually developed first for the KC-46, but it was a much better design. The military guys suggested it to the civilian guys, but why they didn’t use the military version as a model, is a major mystery.

            In sea-going tanker ships, the free surface effect has been known to cause capsize. Modern tankers have high-speed transfer systems, if they sense the ship is becoming unstable, they automatically transfer cargo around the ship to maintain stability.

          • Rob, thanks for all that info. 8 units was just a guess. I would have expected the range needed for MCAS as 8 to 16. As you say, the range is 1.5 to 16. The reason this surprises me is that if the aircraft is stalling at 14, then the stab is at 14 relative to the slipstream on the wing. At that point I would almost expect the slipstream to be hitting the underside of the stab and forcing it up. Even at a setting of 8 incidence down, would be 6 units with the leading edge angled up to the direction of travel of the aircraft. But as Bjorn noted, the wing bends the slipstream.

            Intuitively, I have a hard time convincing my mind that the wing bends the slipstream 10 or 14 degrees downward before it hits the stab.

          • Ted, I think there is still a little confusion here. The range of motion used by MCAS is 0 to 2.5 degrees deflection nose-down. That corresponds to 4 to 1.5 indicated units.

            MCAS cannot operate outside that range. It can never command nose-up at all. It can reverse itself to back out from 2.5 to 0 degrees, or 1.5 to 4 units.

            So MCAS would never be working at indicated units above 4 (or degrees less than 0) because above 4 (or less than 0) you are commanding nose-up..

            On the Enbrauer photo I posted, the nose-down degrees are the top 4 above the zero level. The nose-up degrees are the lower 11, below zero level. Those are actually negative degrees, but the minus sign is not shown.

            Sorry if that wasn’t clear. It’s wacky because at the trim wheels, the pilot sees only positive indicated unit values beginning from zero. That helps with human factors because increasing the units will always raise the nose, decreasing units will always lower the nose. The pilot doesn’t have to think about deflection direction or plus/minus degrees.

          • Ted, sorry but I said something wrong here. I forgot MCAS is a delta change, so it will command up to 2.5 degrees from wherever the stabilizer starting position is when it engages.

            So it can operate at values below zero degrees, or indicated units above 4, just depending on where the stabilizer is set before it activates.

            Typically the trim is set around 5 or 6 units in normal flight, so that would be the starting point when MCAS engages. It could then move the stabilizer to 2.5 or 3.5 units, at full authority.

  17. For those who have been drinking the Koolade dispensed by the B PR department, today’s testimony by the FAA chief should allow them to break the habit.
    He has made clear. RTS shall happen when (did not say if but…) it happens, after another eleven steps are completed “in coordination with international regulators “ .
    He also specifically stated that FAA had advised B of these facts of life, and he pretty much intimated B has been lotus eater dreaming its accelerated schedule.
    Smells to me like we are n for a few more months – not weeks – of slogging checks, as FAA is clearly moving to the “ show me” mode.
    As the French say chat échaudé craint l’eau chaude…

  18. Rob,
    From what it appears, MCAS (2) still has no true OFF switch. It’s now ‘intelligent’. I don’t know what that means. It’s not FBW certified software. It’s not safety limited via cutout switches as the Speed Trim System is in all other Boeing aircraft, after previous accidents demanded it. So, you have MCAS software, running the show. If it fails from a broken AoA or some software glitch, the pilot has seconds to determine if it’s a Speed trim runaway event, and use the yoke to stop the trim wheel, and then hit the STAB CUTOUT. If he thinks it’s an MCAS event, he may try to use the Manual Electric Yoke trim to get the plane’s stabilizer in trim before hitting the STAB CUTOUT but, if it’s a true runaway event, he doesn’t want to do that. He can grab the trim wheel and fly one handed, while he tries to sort things out. I say either put in a true OFF switch for MCAS, a large force, full stop limit switch on the column, make the MCAS software fully FBW certified, or do a hardware fix to the airplane. Using the manual trim wheel, as the backup, in the 737 needs to be looked at by the FAA and EASA. That is something that can be fixed by current technology, with not an excessive cost. Once you cut the ONE trim motor now, (maybe bringing back a redundant A/P trim motor as in the past might be a solution?), you could be in a very difficult position, if you don’t hawe an alternate method to kill MCAS, the Speed Trim system, and the A/P. Depending on the now smaller, manual trim wheel when something goes wrong is not sufficient.

    • Richard, the off switch is the stabilizer cutout. I agree it was better on the NG, where they separated the auto from manual cutout functions. They still have the two switches installed, but they are now redundant. So it seems like they could go back, with an engineering change. I would support that. I would also support an indicator space for the source of the trim signal, so the pilot knows which system is driving the stabilizer.

      The safety of MCAS is now meant to be inherent. No matter the malfunction mode, MCAS cannot exceed its authority, and that authority can in turn be overridden by the elevator, with additional force.

      If the source of the runaway is a control system, the pilot should be able to back out the unwanted trim with electric trim, then use the cutout, and manual trim thereafter.

      If the source of the runaway is an actuator problem, then the electric trim will be unresponsive and upon discovering this, he would go right to the cutout. Then use manual trim to back out the unwanted trim, which is much slower and admittedly a poor method. We will never see manual trim on future aircraft, I’m sure.

      One advantage of trim wheels is you can physically grab them to stop the stabilizer. Pilots have said they have never had to do that, and rarely use the trim wheels.

      The column cutout cannot be used with MCAS because the column is going to be back when MCAS is needed.

      The hardware fix is an open topic, but I have not seen anyone come up with a viable aerodynamic solution. The engines are big, so they’d have to go back under the wing to keep the CoL from moving at high AoA. But even Airbus has moved them out in front, they just didn’t raise them up as far as the MAX. And they have FBW which makes it much easier to handle problems with software.

      • Rob, MCAS is not FBW certified. It needs to be, if it’s going to take control, with no OFF switch. The STAB TRIM cutout switch, kills the entire electrical trim system. Basically, killing the one and only trim motor. The Pilots are left with the manual wheel. If the MCAS software has a glitch, there is nothing stopping it except turning off the one and only trim motor. MCAS is Catastrophic in hazard assessment. It needs to be FBW certified. It’s not just the AoA sensor that can go wrong. It was these last two times, but, wiring shorts, lightning etc can happen. When it does, you’re left with just the manual trim wheel. I’ll be interested to see the FAA hazards assessment this time for the MCAS system, if it isn’t FBW certified, and doesn’t have an OFF switch.

        • Richard, there are no failure modes of MCAS 2.0 that can’t be overcome. That was the whole point of redesigning it, and making it inherently safe.

          It’s not FBW because it’s not a full authority system. The pilot retains authority always in Boeing aircraft. MCAS never takes control. The pilot has multiple ways to override MCAS. MCAS has no way to override the pilot.

          In the accidents, MCAS ran amuck and was only partially countered by the pilots, due to various mistakes. Out of respect, we don’t blame them, but we do acknowledge that the ability for pilots to override MCAS existed. That’s part of the whole tragedy.

          • Rob,

            In Bjorn’s FBW vs ‘steel’ article part 13,
            =====================
            https://leehamnews.com/2019/10/18/bjorns-corner-fly-by-steel-or-electrical-wire-part-13/
            =====================
            In his summary section he lists 3 requirements for MCAS

            1) A reliable trigger system so we don’t end up with a misstrimmed aircraft by any faulty trigger of the powerful stabilizer based trim system.

            2) A system which has an authority limited to what is needed, to not put the aircraft in danger should the system misbehave.

            3) Finally, we need an overall limit on the trim authority, so any system runaway can always be counteracted by the pilots via the elevators.
            ====================

            A simple OFF switch, along with an indicator to tell when MCAS has been activated would protect all three requirements.
            Cutting power to the trim motor, taking away the pilots ability to trim via the yoke switch is not an
            OFF switch for MCAS. It’s an OFF switch that could have the pilot lose control of the stabilizer itself, with potentially catastrophic consequences for the aircraft.

          • Richard, you are a strong advocate for the off switch, and that’s perfectly fine. As I mentioned, I would not be opposed to Boeing adding that, and they have a switch already installed that could be used for it (or alternatively go back to the NG dual-switch system).

            I just don’t think Boeing will view it as necessary, given the other safeguards that are now in place. But we will have to see if the regulators require it. If they do, I don’t think anyone but Boeing would argue against it, and they would be certainly overruled at that point.

          • Rob, In an emergency, Pilot’s can kill the A/P, kill the Auto-Throttle, and if there was a switch, I bet they would kill the MCAS and STS. Since they can’t currently, they are stuck with cutting the trim motor, which effectively leaves them with the manual trim wheel. That hasn’t worked well in the past. I say put in the switch, and let the pilot have Manual Electric control of the stabilizer through the yoke switch. In seconds he has control of the aircraft. Without the OFF switch, he’s left cranking the manual control wheel, when seconds may count. It’s not asking for a huge multi million dollar redesign of the airplane. Just a simple OFF switch. Imagine if they had it, and were trained on it, for the last two MAX accidents. A/P OFF, A/T OFF, MCAS-STS OFF, and you’re in full control of the plane, in less than 3 seconds.

    • Richard,

      reading your post makes me very sure that MCAS will never be certified.

  19. The Regulator’s worldwide need to test a ‘naked’ (sans MCAS), 737-MAX stall characteristics. Boeing has been saying MCAS is intended for some linear column force FAR requirements. Yet, by the very design and operation of MCAS, it avoids that area of the flight envelope, in order to claim linear column force. It functions as more of an avoidance of an area of the flight envelope protocol than a augmentation of column force. As Philip has pointed
    out, the final KNKT report refers to this as a ‘novel’ design philosophy.

    How you test without a true OFF switch is another matter. Turning off the trim motor isn’t a true test as you need to be able to vary the stabilizer in motion during testing. So, you’ll probably have to have a different version of the flight software, which breaks the concept of testing the same equipment that will be flying. You may be able to test rig a switch in conjunction with the flap setting switch on the wings, but, that may involve a separate input to the FCC, as I assume the flap setting switch to the FCC signal is used by other systems.

    Boeing seems to have gone to a lot of trouble to avoid having a true “OFF” switch in the design of MCAS. Having no true “OFF” switch, on an automated system, triggered by TWO AoA sensors seems to point to FBW safety standards to me. You are depending 100% on the FCC to stop uncommanded inputs to the stabilizer from possible failures of an AoA sensor. If the A/P goes haywire, you have an OFF switch, if the AutoThrottle goes bonkers you have an OFF switch but, if the MCAS software goes haywire, you disconnect the stabilizer from electric control relying on the slow manual trim wheel. That’s unacceptable for a Catastrophic hazard rating.

    How hazardous is a ‘naked’ 737-MAX? Do the new shark fin winglets, in a turn, cause one wing to stall before the other? The FAA, EASA and others need to investigate more this area of the flight envelope that MCAS is avoiding, by its very design.

    • Richard, you said:

      “Yet, by the very design and operation of MCAS, it avoids that area of the flight envelope, in order to claim linear column force. It functions as more of an avoidance of an area of the flight envelope protocol than a augmentation of column force”

      I didn’t quite follow this. MCAS should become active above around 12 degrees of the un-augmented stability curve, which at that point is non-linear. As it activates, it drives the slope of the curve more towards being linear (the augmented stability curve). That straightening of the slope is the alleged benefit of MCAS. This happens before stall.

      It doesn’t avoid this regime or avoid the stall regime, else stall testing would not be possible. MCAS would prohibit it.

      As far as testing without MCAS, my guess is they would disable the MCAS code with a software or hardware toggle. To do that, you substitute the existing value of stabilizer position as the returned value from the MCAS procedures. That ensues MCAS does nothing, but the code still executes as it did with MCAS, so preserves execution timing and other variables.

      • Rob, Ideally stick force per the FAR’s want’s a constant force per angle of pitch. When you get into the curved part of the graph, where MCAS kicks in, MCAS in effect lowers the AoA, by lowering nose of the aircraft via the stabilizer. There’s actually an aircraft built in the late 1930’s to 1940’s that is certified stall proof. It limit’s the pilots ability to pitch up (sound familiar?) It is a small aircraft called the Ercoupe. It does this physically by limiting the control column movement. It doesn’t allow the pilot to enter into the stall region of the flight envelope. MCAS sounds much more like a stall avoidance device. I think the 737-MAX should be tested for the before and after stall characteristics of MCAS. A naked MAX vs a MCAS MAX to determine the different flight operating envelopes. As for the winglets, they should help lower the stall speed of the wing, as they are there to increase lift, and the faster wing, in a turn should stall first, helping to lower that wing, but, I’d like to verify that. The forked winglet, almost seems like a small wing onto itself.

      • Rob, Let me put this another way .. These are are crazy numbers obviously. Let’s say stall is 45, MCAS trigger is 35 and MCAS reset is 25 …
        If MCAS is working .. then you won’t get to 40, as MCAS will push the nose down. If MCAS is deactivated by 5.5 degree difference in the two AoA senosrs, then you will get to 40 … 40 needs to be tested. Or, if you get to 40 with MCAS active, by really pulling back on the controls, you’re doing this at a trim setting that is different than with MCAS deactivated. In the two accidents the pilots had the controls in their laps, and with the severe mis-trim, they didn’t stall, but, flew into the ground. You need to flight test with and without MCAS active. MCAS artificially limits the flight envelope. With an Ercoupe, the limits were due to hardware. with the 737-MAX the moving limits are due to software. Software can fail. As a programmer, I”ve encountered some large failures. Luckily, no fatalities.

        • Richard, MCAS when working correctly, should not command sufficient nose down to override the elevator that’s being used by the pilot to hold the nose up. It just adds force with the stabilizer to counter the pitch-up tendency.

          As we both have said, if MCAS forced the nose over, it would not be possible to test for stall. But that is not what it does, or was ever meant to do.

          In the accidents, it forced the nose down because it ran the stabilizer to full nose-down deflection, un-countered by the pilots. That was a malfunction, it was never intended to behave that way.

          • MCAS 1.0 did exactly what itwas designed to do in the 2 accidents….running the stabiliser to full nose down with 5 second intervals, as long as the AoA indicator told it to do so. There was a AoA malfunction, not a MCAS 1.0 malfunction.

          • Except that the MCAS 1.0 output was unbounded and did not properly reset, so it was able to use the full stabilizer deflection.

            It was meant to stop at 2.5 degrees as the maximum authority (10 seconds x 0.25 degrees/second actuation rate). But due to the programming errors, at the next cycle it could drive the stabilizer further on to full.

            At 2.5 degrees the pilots could still correct with elevator, even if they failed to counter-trim the stabilizer. At full deflection they could not.

          • Rob, The FCC software is the only thin line holding MCAS from doing the same now. There is no true OFF switch for MCAS. There are no hard column limit switches. No third G forced sensor. Only software.

          • Richard, both the electric trim switches and cutout switch are hardwired, not related to software. So in the case of software malfunction, they would continue to function. I agree the an off-switch would be better, or to return to the NG switch configuration.

          • Rob, When the STAB CUTOUT switches are thrown, that eliminates the Yoke trim switches from functioning on the MAX. Boeing specifically changed the functioning of the STAB CUTOUT switches for the MAX. They didn’t tell the pilots. They just relabeled the switches. The two switches on the NG and all previous versions of the 737 allowed you to either cut out the yoke manual commands, the A/P commands or flipping both. On the MAX, they rewired them, so that either switch now kills everything. Why have two switches that do the exact same thing? Why did they take away the pilots ability to keep manual electric trim. Both accidents could have used it. The ET302 was left with turning on MCAS to get the yoke trim command back. They were trapped, because the original backup plan (the manual trim wheel), now smaller in the NG and MAX wasn’t able to be used because of excessive force. Where is the TRUE OFF SWITCH to MCAS. It’s take control of the stabilizer with no OFF button. If the A/P didn’t have an OFF switch, you’d be in the same position. But, it does have an OFF switch. Why not for MCAS?

  20. Rob, I value your careful wording in many of your posts highly, but here I am afraid I must disagree. MCAS 1.0 did not stop at 2.5 degrees. It was designed to fire over and over again. If it was meant to stop at 2.5, there was a massive design failure. Not a programming failure. But from all what we can read in the press (Boeing will not tell) MCAS 1.0 was designed and operated as intended. Wrong AoA, fire MCAS, repetitively, till stabiliser max nose down. What would have been simpler as programming MCAS 1.0 so that it would have as limit 2.5 degrees nose down for the stabilisers…..

    • AtFlyer, I too value your comments, but I would disagree with this one. There would never be a reason to use full stabilizer deflection for the purpose that MCAS was intended to serve. It’s way too much authority to correct for accelerated pitch. It had to be known to Boeing that it wouldn’t be possible to compensate for this with elevator. The only scenario for which that would be valid (override the elevator) is stall prevention.

      So I have to believe that was either a design oversight (didn’t foresee that might happen) or a programming error (software did not work as expected), or possibly both.

      The other possibility is that Boeing did intend MCAS as stall prevention. In that case it would continue to drive until nose-down, as you say, using full authority, and that would be the intended function. But then that is an entirely different situation. Boeing is on the record that MCAS is not stall prevention.

      As I understood it, MCAS was not meant to index the stabilizer further after the first 10 second run time. The fact that it did, was the first indication I had that something was seriously wrong. Until then I bought Boeing’s story of pilot error. MCAS falsely triggered and they didn’t respond correctly. But if it exceeded it’s authority and continued to index the stabilizer at each activation, that would be an obvious error and an obvious hazard.

      I guess one or the other would have to be true, but not both. It may be that Boeing is trying have it both ways. They say MCAS worked as expected (which implies stall prevention) to avoid liability, then say MCAS is not stall prevention to avoid that part of the regulations, for which it would not be compliant.

      This comes back to the JATR finding that they could have asked about MCAS first, with an issue paper. I continue think that was a major failing on Boeing’s part. Had that been done, we wouldn’t be here now.

      • Rob,

        “So I have to believe that was either a design oversight (didn’t foresee that might happen) or a programming error (software did not work as expected), or possibly both.”
        =======
        Boeing/Collins still has design oversight, and programming review responsibilities. The recent ODA/DER ruels are still in place. The FAA reps. still report to Boeing, not the FAA. As far as I know, they still plan to use MCAS software, modified, with only no physical safety limitation. Just another AoA sensor tied in, that hopefully the software will use to evaluate if the two are out of sync by more than 5.5 degrees for more than 10 seconds. How it resets after that, I’m not sure. So, as far as I know, there is the flap position, and AoA sensors feeding into MCAS (I wonder if gear down position is also in the mix?)

        “As I understood it, MCAS was not meant to index the stabilizer further after the first 10 second run time. The fact that it did, was the first indication I had that something was seriously wrong.”
        ===========
        MCAS 1.0 was programmed to wait 5 seconds, then if the AoA was still high, trigger again. Wasn’t it?
        I know there was a reset after any Manual Electric Trim command from the yoke, to then fire after 5 seconds if the AoA was high. It would be nice to see the original specification document and change documents from Boeing to Collins on MCAS 1.0.

        The combination of time and AoA must make for some interesting programming logic. MCAS 1.0 fires at the initial High AoA event, then commands the nose down, until the Lower AoA limit, or 10 seconds have passed, or yoke trim overrides MCAS. Then you wait for any yoke trim commands, if present, you wait 5 seconds and fire the Nose Down command again, if the AoA is still high, rinse repeat. It doesn’t sound like a pitch augmentation system to me. There is no feedback of stabilizer position or column force. What if you’re at a High AoA, without column force (gusty winds)? Is that pitch control augmentation or stall prevention?

  21. Some recent news on the 737-MAX testing
    =========
    https://theaircurrent.com/aviation-safety/pilot-procedure-confusion-adds-new-complication-to-737-max-return/
    ============
    From what I understand, the new system AOA DISAGREE warning light comes on, if the AoA’s differ by 10 degrees for more than 10 seconds? (please correct me if anyone knows different). I think MCAS 2.0 will inhibit itself, if the AoA’s differ by 5.5 degrees. So, if the AoA’s differ by 5.6-9.9 degrees, then MCAS will be inhibited, and the AOA DISAGREE warning light will be off. What happens to the pitch up then, and/or how much of a chance is there of this happening? Just a small FAR non-compliance, or is it potentially a large enough event to worry about?

      • Leon, Up to the 737-MAX, I think Boeing commercial aircraft have only used AoA sensors for Stall warning, and Pitch Limit display. I don’t think the A/P uses it? Using the AoA sensor for input to an automatic flight control surface seems to need some additional thought.
        ==========
        http://www.boeing.com/commercial/aeromagazine/aero_12/attack_story.html
        ==============
        The Airbus FBW aircraft use Three AoA’s and quite a bit of voting logic to use as stall protection. Two of the Three AoA’s have frozen in flight causing some issues. (the voting logic out votes the good sensor data). Boeing is using only Two on the MAX, and turning off MCAS when they differ by 5.5 degrees. What happens when Two AOA’s on a MAX in the future freeze? I assume that MCAS will trigger and the pilots will have to figure it out and as of now, cut off the trim motor to the stabilizer, without any warning lights alerting them. So, IF they figure it out, they are left with manual trim only. There’s a technical NASA document on AoA’s with a good reference section. And I know there are some companies looking at more accurate and reliable AoA sensors, but, right now they are prone to errors every so often.
        ============
        https://ntrs.nasa.gov/archive/nasa/casi.ntrs.nasa.gov/20140011419.pdf
        ===========

        • Richard, the Air Data Reference (ADR) is a component of the ADIRU that first senses, then corrects and supplies, airspeed, AoA, and altitude data for other aircraft systems.

          AoA is used internally in the ADR and ADIRU for correction of airspeed and altitude, but also is fed forward to other systems. Among those are display, engines, autopilot, landing gear, and various aircraft flight control systems.

          One criticism from the accidents was that too many alarms were set off by the failure of AoA. So it’s embedded in other systems and has been for some time. But the impact of loss is not serious for those systems. It shouldn’t be for MCAS either, when designed and programmed correctly.

          • Rob,
            Airbus has had issues with the Three AoA’s on their stall protection system. The pilot is then left playing Russian Roulette with the Air data computers, trying to figure out which one is worth using.
            When Two become bad, and outvote the One good one, the pilot has to intervene, if he can. I’d like to see another truly independent, redundant AoA sensor system. Maybe GPS EFIS type, or G Force Accelerometers put into the loop for added validity. It seems worth the cost and effort as failed AoA sensor systems moving the nose down automatically, without another safeguard, is not good enough. The MAX with just Two, is less safe than the Airbus system with Three. And Airbus has had problems with Three AoA’s. Boeing’s overall concept of having the pilot be the ultimate decision maker rather than the computer, seems to have changed with MCAS.

  22. Richard, there is work on-going in the field of Synthetic Air Data estimation, based on inertial reference or GPS. I would like to see that be developed into a commercial product and become certified as well, as a third or fourth reference.

    One issue is that air data is used as an input and cross-check for inertial data currently. So to replace air data with synthetic implies you are 100% reliant on non-air sensing. Thus perhaps initially it would serve as a non-automation cockpit reference only.

    In the Boeing system, if two AoA become bad then the system will accept their inputs, but only if they are reasonable values. A value of 30 to 70 degrees, as occurred in the accidents, would not be accepted because the inputs are now bounded.

    That doesn’t mean that they that can’t fail together in a mode with legitimate values. In that case a third sensor would be useful. EASA is talking about requiring that.

Leave a Reply

Your email address will not be published. Required fields are marked *