Leeham News and Analysis
There's more to real news than a news release.
Leeham News and Analysis
- Boeing CEO promises company is turning around…again April 24, 2024
- Solid start for stand-alone GE Aerospace despite cuts to LEAP output April 23, 2024
- SPEEA, Boeing at impasse over safety program, union says April 23, 2024
- Better transparency needed on Boeing’s 1Q earnings call April 22, 2024
- Bjorn’s Corner: New engine development. Part 4. Propulsive efficiency April 19, 2024
Why is the 737 MAX safe now when it wasn’t before?
Subscription Required
Now open to all readers.
By Bjorn Fehrm
Introduction
September 14, 2020, © Leeham News: The FAA and EASA Safety of Flight authorities have examined and test flown the changes Boeing has done to the 737 MAX to make it safe to fly again. Everything points to these authorities re-certifying the 737 MAX as safe to fly in the coming months.
In a Saturday article Dominic Gates of The Seattle Times quotes from a recent interview with me and an experienced 737 Captain, Mike Gerzanics, where we both say we consider the MAX safe to fly with the changes.
Here my reasons as an aeronautical engineer why I think so.
Summary
- The original design of a smoothing software for the 737 MAX flight control system was badly implemented.
- It’s not the changes to the 737 MAX base aircraft that makes it unsafe, such as larger engines, it was an unusually sloppy implementation of the smoothing software, called MCAS, that was flawed.
- MCAS is now properly implemented and tested. This returns the 737 to the safe aircraft it was before MCAS was implemented.
The 737 and safety
The Boeing 737 still keeps the same base design as when it started operation with Lufthansa 1967. Its safety record over the 53 years of operation is good, one of the better of airliners that have flown our skies.
The accidents that have been haven’t had a pattern, like for the McDonnel Douglas MD11 that was difficult to land. The base design is sound with none of the stability quirks of T-tailed airliners like the BAC-111 or DC-9/MD-80/90.
The problem with the 737 MAX was a flight control smoothing system, the Maneuvering Characteristic Augmentation Systems (MCAS), had an uncharacteristically sloppy design, making it outright dangerous.
This is not the base aircraft being dangerous. It’s about Boeing cutting corners in getting the MAX to market, without spending the necessary care and effort when adding a smoothing function to its flight control system for the type.
The inadequate analysis of the design of the system and its safety made it outright dangerous, capable of overwhelming even experienced flight crews, as demonstrated after the crashes in Boeing’s simulators where US airline 737 flight crews had problems with a malfunctioning MCAS, despite knowing what to expect.
Let’s now go through the typical questions about the MAX and it’s flight characteristics and where the MCAS problems came from.
The 737 MAX
The 737 MAX is a safe aircraft to fly also without MCAS. How can I know, I haven’t flown the MAX?
No, but test pilots from Boeing, FAA, and EASA have. And they don’t certify an unstable aircraft, they can’t. The flight safety rules for airliners denies unstable aircraft certification.
The updated MCAS will be deactivated when its sensors disagree. Then the aircraft is flying without MCAS and by definition, it can’t then be unstable. This is why I know.
To explain one step deeper.
An unstable aircraft will pitch/turn/roll without the Pilot giving it a command to pitch/turn/roll. I have flow such aircraft and when they start to depart it happens fast. You have to counter the move with a quick and large push on the controls.
In the MAX case, the additional pull in pounds-force to get the nose to a higher pitch Angle of Attack (AoA) was not linear close to stall AoAs. Let’s say it was 4 lbs per additional AoA in the normal flight regime and reduced to 2lbs for the last degrees before the stall.
This characteristic differed to the 737 NG (the previous 737 version) and would have required special simulator training to learn the pilots the difference in characteristics between the MAX and NG. This is not desirable when there is a pool of perhaps 50,000 pilots that are trained on the NG.
Boeing did what other aircraft manufacturers do, it fixed the change in pull force with a minor change to the flight control system. The most rational way was to extend the functionality of a helper trim system already on the 737 for decades, the Speed Trim System (that changes the horizontal stabilizer trim slightly so the Pilot gets a better feel for the aircraft during speed changes in climb and descent).
Now Boeing used Speed Trim in a modified form to give a linear force feel also for the last part of the AoA range before a stall. Doing this is OK if it’s well analyzed and implemented. This is where things went seriously wrong.
The work to implement MCAS
Implementing Flight Controls Systems (FCS) for aircraft that fly a large speed range, such as airliners, is complicated stuff. The requirements on the FCS at low speed, like takeoff and landing, is different to cruise, where supersonic effects on different parts of the aircraft complicate things.
Aircraft designers have learned how to master this and the 737 FCS is a run-of-the-mill example of such a system.
Implementing MCAS should have presented no problem if thorough work practices had prevailed. They didn’t. We have enough evidence from all the investigations to say that.
Critics of the original MCAS implementation has centered on the system being triggered off a single AoA sensor. It detects the aircraft is passing an AoA pitch threshold (say 10° out of 14°, where stall occurs) and then trims the horizontal stabilizer so the pull force on the Yoke when entering this region remains 4lbs per degree AoA. When the AoA descends below 10° AoA, the trim is reset to its previous position. With this logic pitch increases require 4lbs per degree for the whole below stall AoA range, going up or down.
While a single sensor trigger is a design practice that some other OEMs avoid (they have three AoA sensors so two can outvote the third as malfunctioning), Boeing has used this design principle on the two AoA sensor 747, 757, 767, and 737.
With two sensors you can’t decide which one is giving incorrect values, you need a two versus one vote structure to achieve this. Instead, Boeing relied on the Pilot detecting a miss-trim situation if MCAS trimmed when it shouldn’t. The Pilot should then shut the malfunctioning electric trim system down, and rely on the manual trim system (via a crank handle) to trim the aircraft.
This would have worked, even with the 10 seconds Pilot detection time of the miss-trim that the crash recorders showed instead of Boeing’s assumed 4 seconds, IF MCAS WOULD HAVE TRIMMED ONCE for each pass into the 2lbs region, as motivated by the AoA range logic I described above. But MCAS didn’t.
It had trimmed 22 times for one AoA pass when the Lion Air JT610 Captain handed over to the First Officer to get the head free to understand why the FCS trimmed intermittently nose down, something he had to counter with nose-up trim.
The First Officer was told to trim against MCAS but was overwhelmed by the intensity and repeated attacks from MCAS. He countered four times but MCAS outperformed him and after five attacks the aircraft nosed-over for ground. The stabilizer trim was then at 100% nose-down.
It’s these non-understandable repeated MCAS trims that I characterize as “really criminal” in the Seattle Times interview. The key here is how MCAS resets itself to be prepared for any subsequent AoA passes into the over 10° region.
The logical reset criteria is an AoA that passes 10° going down. This is also how the reworked MCAS resets. If this would have been implemented in the original MCAS the accidents wouldn’t have happened.
Both the JT610 crew and ET302 flew with one nose-down MCAS trim without problems. The natural reaction is then for the Pilot to correct the miss-trim with the electric trim button on the Yoke. This is where things go wrong in the original MCAS.
For some unexplained reason, Boeing left the reset criteria from Speed-Trim = “the Pilot trims” unchanged. Why? I cannot figure it out, nor can experts I have talked to. The smoking gun is Boeing changed it to the logical criteria for the updated MCAS. This is the root cause these crashes happened and it shouldn’t have been.
Why wasn’t this dangerous reset criteria detected? Because no FMEA (Failure Modes and Effects Analysis) was made in the original MCAS work. This is where all possible failures in inputs to the system and its components are analyzed for their effect. Boeing judged MCAS failures as only a “Major” hazard and this class of system doesn’t require an FMEA.
The consequences of an AoA failure giving a constant high value (which is a very probable failure mode for this sensor) were never analyzed and the severe danger of the wrong reset criteria was not detected.
The leaving of an unlogical reset criteria from the donor system and not analyzing its consequences is where my verdict is “really criminal” as stated in the Times article.
Boeing knows it is using a fail prone trigger system with the single AoA system design. Yet it doesn’t analyze the consequences of such failures other than “the Pilot will fix it”.
You can design in such a way if you make absolutely sure the consequences of sensor failure is fully analyzed as non-dangerous. To shrug it off with “the Pilot will catch it” is totally unacceptable.
Why is the 737 MAX safe now?
As discussed the 737 base aircraft lacks quirks and it has a good safety record from its 53 years in service. The larger engines for the MAX introduced larger nacelles and these caused a lessened additional Yoke pull force for higher pitch angles in the region before stall.
A flight control system fix was introduced, a move in itself that is standard industry practice. If it had been implemented with the care such changes require the lost lives of the crashes would have been spared and the 737 MAX would be flying today. As pointed out, a proper adaptation of the MCAS software from its donor system, Speed-Trim, would have avoided the crashes.
The updated MCAS introduces convincing changes to the logic around the AoA sensors, a change of the reset to what it should have been from the beginning, and also, a global limitation on the authority of MCAS over the aircraft’s flight control system.
The changes have been scrutinized and tested in simulators and flights like no FCS system parts before. The chances this part of the aircraft would cause a MAX crash must now be nil.
With the base aircraft safe as discussed, I have no problems flying on the revised Boeing 737 MAX.
Let’s think about this paragraph:
For some unexplained reason, Boeing left the reset criteria from Speed-Trim = “the Pilot trims” unchanged. Why? I cannot figure it out, nor can experts I have talked to. The smoking gun is Boeing changed it to the logical criteria for the updated MCAS. This is the root cause these crashes happened and it shouldn’t have been.
So, the tougher problem is not physics or aerodynamics or mechanical design. It’s a human question of encouraging an effective engineering problem-solving culture.
As Bjorn writes, “It’s about Boeing cutting corners in getting the MAX to market, without spending the necessary care and effort when adding a smoothing function to its flight control system for the type.”
At the 2019 shareholders’ meeting, Dennis Muilenburg said MCAS was not a flight control system and Boeing followed all the processes. This is textbook group-think. A proper leadership message would have been, “we should have recognized MCAS was critical and we should update our processes.”
Happily, Boeing has addressed many technical issues. I am less certain about the cultural ones.
This is what happened with Douglas rushing their DC 10 into service in order to beat Lockheed with their far superior Tristar.
Now that McConnell Douglas people are running management at Boeing you see it is happening again.
Agree…boeing is now a second class company….never will I board a max. They lied, cheated etc…….
Thanks Stan,
I agree 100% with your comment.
Bjorn,
With the FAA comment period of 45 days now closed, and just over 200 submissions on https://beta.regulations.gov/document/FAA-2020-0686-0001/comment
A number of the submissions can be instantly dismissed, but from your reading of the submissions, are any worthy of in depth scrutiny, and if so what do you think the FAA, EASA etc. will make of the comments ?
Do you think that there will be any further actions, or have the regulators already made up their minds, and the comments are not relevant ?
“”It’s not the changes to the 737 MAX base aircraft that makes it unsafe, such as larger engines, it was an unusually sloppy implementation of the smoothing software, called MCAS, that was flawed.””
That’s a strange point of view when the higher engines were the cause to implement MCAS.
“”MCAS is now properly implemented and tested. This returns the 737 to the safe aircraft it was before MCAS was implemented.””
Is MCAS a stall system?
Wouldn’t it need a fail-safe redundant stabilizer?
Beside MCAS some other parts were changed too, that says a lot how unsafe the 737 was before and is.
“”The Boeing 737 still keeps the same base design as when it started operation with Lufthansa 1967.””
Before Bjorn wrote: “MCAS is unique to the MAX because it no longer has the docile pitch characteristics of the 737NG at high AOA. The base aircraft has deficiencies, like most airliners, but it’s not a fundamentally dangerous aircraft.”
“”Its safety record over the 53 years of operation is good, one of the better of airliners that have flown our skies.””
How many times did Boeing blame pilots when problems happened?
“”but test pilots from Boeing, FAA, and EASA have””
LOL … Boeing and FAA did flight testing the MAX in 2017 too, so this means NOTHING, and now only a MAX-7 was tested.
Airbus didn’t block the last seat row on A319 too, because the tail is higher on high AOA. Same as on a MAX-7. It depends on the CG, if it’s nose heavy it would behave smooth, that’s why blocking the last seat row. Easy to load the MAX-7 to Boeing’s desire.
From an safety expert I would have expected this would be mentioned.
Even to mention FAA here, when they calculated 15 more crashes but did nothing.
“”they don’t certify an unstable aircraft, they can’t””
Bjorn forgot what he said before: “The aircraft is just nose-up happy.”
The flight behavior must be linear by regulation and still the FAA certified it 2017.
“”The updated MCAS will be deactivated when its sensors disagree. Then the aircraft is flying without MCAS and by definition, it can’t then be unstable. This is why I know.””
If both AOA sensors get damaged from a flock of birds it’s different, Bjorn should know too.
“”Boeing did what other aircraft manufacturers do, it fixed the change in pull force with a minor change to the flight control system.””
Which manufacturer use a kind of MCAS style without fly-by-wire?
Which manufacturer is using the stabilizer in a “novel” way? That’s why JATR complained.
“”Now Boeing used Speed Trim in a modified form to give a linear force feel also for the last part of the AoA range before a stall.””
Before Bjorn wrote this: “Could MCAS have been implemented aerodynamically? Yes. It would most likely be as large aerodynamic strakes at the lower rear part of the fuselage””.
Feel wasn’t mentioned and why should it, there is a feel system already, don’t need a second one.
“”While a single sensor trigger is a design practice that some other OEMs avoid (they have three AoA sensors so two can outvote the third as malfunctioning), Boeing has used this design principle on the two AoA sensor 747, 757, 767, and 737.””
The 737NG is only using single sensor data.
Bjorn doesn’t know at which AOA degree MCAS activates. Isn’t it important to know?
There are still other parts which don’t follow regulation STANDARDS and Bjorn knows it.
And Bjorn knows that Boeing self-certifications were faked. From a safety point of view it should be a need to check all self-certifications, but Bjorn doesn’t even mention it. That’s just garbage.
I can understand that Bjorn is a part of the industry but I thought he is an expert.
Sorry Bjorn, but this all is just Boenig PR.
How can you sleep, telling the public it is safe to fly MAX.
Interesting to see an acknowledgement that, in the base-case 737 MAX, the pilot is the “third sensor” in MCAS. Let’s hope we never get a situation in which the flight crew is distracted at a juncture where they actually have to act as “third sensor”, e.g. because a goose has just gone through the front windshield.
As regards the third sensor being required by EASA, any realistic estimates (from someone other than “The Voice of Boeing”) on when that will be ready? Ryanair (among many examples) are not going to be amused if it takes long. And yet, one can’t imagine a scenario in which it won’t take long — either in the form of a third traditional AoA sensor (extra cutouts in the fuselage, extra wiring) or a synthetic AoA emulator (Christ help us all + review time by EASA).
The Voice of Boeing has read that the goal is for it to be present in the certification of the MAX-10, with retrofits to other MAX models to be done as soon as practicable. So that would imply possibly late in 2021.
This is in keeping with the finding that the requested changes are “design enhancements” rather than safety-critical functions, and thus will not delay RTS, but could possibly delay entry into service of the MAX-10.
Boeing did not want the customers for the Max, to invest in more training and updated simulators. So now, will new simulators and training be required by Boeing and the FAA?
Yes, this is explained in the FAA summary for the proposed AD, and is why the JOEB is meeting this week in London to determine what the new training standards will be.
Boeing reversed it’s stance on pilot training after it was demonstrated in pilot testing that there was a wide variation in pilot responses. Boeing’s argument in the case of the multiple activations of MCAS (which Bjorn has described well above) was always that pilots would identify runaway trim, and disable the trim motor, as a memory item performed relatively quickly. They did not envision that pilots would engage in a protracted struggle with MCAS, as occurred in the accidents.
But the pilot testing laid that to rest, as only some of the representative pilots performed runaway trim in time to retain control. Most notable was the degree of variation in responses, that is an indication that pilots did not have a clear mental picture of what was happening. Thus each pilot responded differently, according to his/her own experience and skills. That provides clear evidence that training was needed. The purpose of training is to make the responses uniform and correct across all pilots.
Thanks. I was wondering how that was all resolved.
Bjorn and Scott, thank you for making this article free. It provides important understanding and insight into the MAX return to service. It should be required reading for all reporters writing on the MAX. It should help to dispel a lot of misinformation presently in the public eye.
“It should be required reading…”
That sounds rather totalitarian…a bit like when Mein Kampf or Chairman Mao’s Little Red Book were “required reading”.
You’re showing increased signs of desperation in your efforts to convert the world…
Bryce, thus far you’ve compared me to North Korea, Nazi Germany, and Red China. I think you may have a bit of a fixation.
In any case, it’s not wrong to thank Bjorn, Scott or Vincent and commend them for the quality and value of their work. When referenced by other sources, it results in better reporting. I see Leeham pop up quite a bit in sourced aviation articles.
The notion of “required reading” to become knowledgeable about a topic or craft is a common place. My SCUBA course had required reading, lawyers preparing for a trial have required reading, literature classes have lots of it.
If I asked you to let me know what I should read to understand the MAX saga what you recommended (and it may well differ from what Rob might recommend) would be your notion of the “required reading”.
https://www.collinsdictionary.com/dictionary/english/required-reading
I’m aware of what the concept of “required reading” entails…after all, the term does include the word “required”, which your Collins definition (needlessly) replaces by the synonym “essential”.
Because of its mandating nature, it’s usually only used in strict teaching and/or certification settings. Although I gave physics lectures for years, I never described any document as “required reading”…I never went further than “recommended reading”. I don’t know of a single branch of physics where understanding can only be obtained by following an exclusive path through a particular document.
The article by Bjorn expresses an opinion (although certain voices here might want to label it as factual). To suggest that reporters on the MAX should be mandated to read his opinion is absurd; to “recommend reading” it is a different matter.
I taught engineering for many years. In the US at least, the term “required reading” is in common use in the classroom. In fact many classes have “required reading” lists.
There is value in Bjorn’s opinion, but greater value in the facts he presents, from which people can form their own opinion. The point was that an understanding of the facts benefits journalists who are trying to explain to others.
I still see the MAX reported as inherently unstable, MCAS referred to as anti-stall or stall prevention, or that the MAX cannot fly safely without constant correction from MCAS. So those are the kinds of errors that can be eliminated by good information.
Does this analogy work? Cars have steering that self-centres. However, on a lot of cars, the last little bit of steering lock doesn’t self-centre, but that’s OK as you only use full lock when at very low speeds and you have plenty of time to react to the slightly odd steering feel.
MCAS was analogous to providing self-centring steering for that last little bit of lock. However, when it went wrong, it was like the car suddenly started to veer off the road (as the incorrect sensor “thought” it was going the other way). Every time the driver (pilot) tried to correct it, the system would reset and put more force to force the car off the road.
Is that correct (in layman’s terms)?
Charles, you could tweak your steering analogy slightly to say the steering becomes looser the farther you turned to one side. So in order to preserve the feel of steering tightness, MCAS provided a steering force in the opposite direction than you were turning.
If that same correction was applied while you were driving straight forward, it would turn the vehicle to the side, unless you compensate for it with increased force on the steering wheel. You are strong enough to compensate for the first erroneous activation of MCAS, which lasts for 10 seconds, but not much more than that.
On the steering wheel, you also have a button to apply your own correction to the steering feel, so your adjustments would interrupt and override MCAS. This would allow you to resume normal straight driving.
But due to a flaw in the software, each time you made a correction with the button, MCAS would disengage and wait 5 seconds, then try again for another 10 seconds. MCAS would keep activating this way in an infinite loop.
You also have a switch on the dashboard to turn off power steering altogether, which would stop MCAS, but then you have manual steering. However unlike manual steering in a car which gets easier at higher speeds, in an aircraft it gets harder. So if you go too fast, you won’t be able to turn the wheel.
Thus once the malfunction has begun, the only way to keep the vehicle on the road would be to constantly press the button every 5 to 15 seconds to correct for MCAS (Lion Air did this over 20 times), or use the dashboard disable switch, in which case you also have to be aware of speed. The best time to use the switch is after you’ve used the button to correct and MCAS is paused.
And while you are doing this, you have two other false warning lights, the steering wheel is falsely vibrating in your hands to alert that you are going too slow, and your speedometer is giving you the wrong speed. Also if you go too fast, there is an audible warning for that as well, but that warning is not false like the others.
Lastly you have a driver’s education car with controls on both sides, and the passenger side has no alarms or vibration and is ok, but still feels the steering effect of MCAS. So you have to decide which person will drive under those conditions, you who have more experience but problematic controls, or your passenger who has less experience but a good set of controls.
So why not disable MCAS and still have powered steering.
Also what are stability issues that MCAS was correcting for. In other words can we fly with MCAS turned off.
“So if you go too fast, you won’t be able to turn the wheel.”
Actually, as the FAA noted in the RTS AD, it got fed up with all the claims to that effect, so it scheduled a test flight with Boeing to measure the force needed to operate the trim wheel manually in various combinations of airplane configuration and airspeed within the flight envelope. It found the trim wheel to be within the ergonomic capabilities for the range of pilot sizes that are expected to be flying. So there really is no big choice to be made, unless the piloting skills are so poor that the significant risks of a runaway stabilizer are comparable to the risks of the pilot allowing airspeed excursions beyond the normal flight envelope.
Also, the steering wheel vibrating is not an indication of going too slow, it is an indication of the steering wheel deflection approaching the skid point (equivalent to the critical [stalling] AOA on an airplane).
The accidents happened because of over self-centering when it wasn’t needed.
MAX without MCAS is self-centering but on ligh AOA it’s not self-centering anymore because MAX is pitching up (like the steering lock on a car).
Once AOA sensors disagree and MCAS is off you will have the same as on a car, on high AOA MAX will pitch up.
Bjorn changed. Now he says MCAS is about “feel”. So when MCAS is off because of AOA disagree there is wrong “feel”. But MAX already has another feel system, why not calibrate this feel system correct, so MCAS wouldn’t be needed. Makes no sense what Bjorn is trying to sell us … Boeing PR
>but on ligh AOA it’s not self-centering anymore because
>MAX is pitching up (like the steering lock on a car).
This is just wrong. No civilian aircraft can be certified if it is not aerodynamically stable, or as the analogy puts it “self-centering”. To believe that MAX is unstable as defined by the certification requirements is to believe that flight test pilots from Boeing, the FAA, Transport Canada and EASA (and eventually Brazil and China) are all part of conspiracy to help Boeing keep the MAX in the air.
It’s not a good analogy but everybody can recognize changes in the car steering of old cars. I recognized it too. The Volvo 244 can turn within 10m no other car could.
A MAX-7 was tested.
Airbus didn’t block the last seat row on A319 too. They blocked it on 180 pax A320, and also on the A321. It has to do with CG.
Airbus recognized this AFTER the MAX crashes, maybe this aerodynamical behavior could not be simulated or calculated and wasn’t expected.
Then it might also have to do with the tail. On the MAX the engines are very high, higher than normally can be seen on other planes. It changes the aerodynamics which would need a higher tail too and it gets worse the longer the plane is. But the stabilizer is at the same old low position.
Boeing test pilots recognized the aerodynamic behavior which resulted to put MCAS in. EASA only need to check this and it must be easier to recognize on MAX-8 and -9.
It’s proven that Boeing was cheating and hiding. They can manipulate the CG and hide it so that the MAX-7 won’t easily pitch up, just a little bit nose heavy. Then it might not be easy for EASA to recognize it on a MAX-7. Boeing pilots had much more time to recognize it.
On the first hijacking of a 727 the hijacker jumped off the aft stairs. Pilots could recognize a trim change. It’s interesting to read on wikipedia, this hijacking was copied many times.
I wonder how much stabilizer deflection is needed if all pax move to the back.
I agree with you. This plane should be scraped. Nowdays having worked in Boeing for some time, I sense a culture of arrogance at every level. Here we have Einstein humble himself saying his knowledge made him like a child and other hand you have Engineers happened to work with not realize how little they know.
“But MAX already has another feel system, why not calibrate this feel system”
Because the existing feel system is a mechanical computer (like the old mechanical cash registers that made a loud whirring and clacking and clunking sound… and added up the prices of your purchases, except this one is quiet) and it integrates the airspeed and density (as measured by the pitot-static tubes mounted on the vertical stab) with the amount of elevator deflection from the stabilizer-neutral position to generate the force feedback on the control column.
MCAS on the other hand, is needed to add “heaviness” to the elevator feel when the airplane is pulled into a very high AOA to counter the “lightness” in the elevator caused by lift generated by the engine nacelles at very high AOA (which reduces the load on the tailplane). But it must not interfere with the pilot’s primary flight control, so it couldn’t be added to the elevator feel system (it would have been very difficult anyway). However, as normally the stabilizer is adjusted to null out the force being input to the elevator—it stands to reason that adjusting the stabilizer in the opposite direction will make the pilot apply MORE elevator force to maintain the same pitch attitude, or the pilot may recognize an excessive AOA and relax the elevator force, thus allowing the pitch (and AOA) to decrease to a more normal value.
That’s all MCAS does—de-trim the elevator at very high AOA to create heaviness to match what would be felt on the 737NG. It’s not an anti-stall system.
Björn, one question regarding why MCAS was chosen. Since the force required to pull on the yoke changes at high AoAs, wouldn’t it have been a much simpler change to add a little “brake” or motor that simulates that force.
It wouldn’t interfere with the actual flying, so it should be a much safer solution.
In Robert Bogash’s comments on Boeing 737 MAX modifications to improve airworthiness – (AD) 2018-23-51 here:
https://beta.regulations.gov/comment/FAA-2020-0686-0213
In his COMMENT #2, he offers the ‘stick pusher’ or ‘stick nudger’ alternative.
Bjorn may be able to comment further as to why a stick pusher wasn’t chosen over MCAS.
Personally I suspect that a) a software fix may have been thought to be a cheaper option. b) A version of MCAS was already used on other Boeing aircraft. c) To keep the MAX as close to the NG as possible to avoid training, the Speed Trim System could be modified to perform the MCAS function.
Another issue is whether the addressment of the problem should be artificial (simulating the correct forces for the pilot) or adjusting the aerodynamics so the forces are correct and the aircraft remains in trim.
The elevator feel system, or a brake system, would have been a simulation. It’s ok to simulate forces when the aircraft is in trim and you want to encourage the correct response from the pilot. It’s not ok when the adjustment conceals a mis-trim condition.
Or putting it another way, the elevator feel system is meant to help correctly represent the state of the aircraft to the pilot, enhancing that representation in some circumstances. It would not be doing that if used in place of MCAS.
As far as a stick-pusher, that is clearly an anti-stall system, as it uses the elevators to push the nose over. It’s meant as a last effort at stall prevention if the pilot fails to do so.
If used in the MCAS scenario, it could in theory be moderated to also perform the needed trim function with the elevators. In that case you are substituting forced motion of the stick for increased stick forces to enhance the pilot decision. But that goes against the usual control rule that elevators are for pilot control of ascending/descending, and stabilizer is for trim.
The argument has been made that MCAS performs an elevator function with the stabilizer. That conclusion is understandable in terms of how MCAS behaved in the accidents. It pushed the nose over and thus performed an elevator function. But that was not the design intention of MCAS, which was only to keep the aircraft in trim. As Bjorn said, it was a result of errors in implementation.
If the center of lift moves forward, that changes the balance of the aircraft to favor the nose-up condition, unless trimmed out in some manner. MCAS does that with the stabilizer and was not wrong in inception, but was wrong in implementation.
I struggle to understand how we can make the assumptions of safety before publication of the final ET302 report.
Do we not need to know – fully – the sequence of events here first>
The FAA said in the summary document, that they are reserving comment until the final report is released, and may amend the RTS AD if that is indicated by the final report recommendations.
Thanks, was not aware of that. Surprised it’s not been published yet.
https://airinsight.com/call-for-more-redundancy-of-max-systems/
I think there is still need work to do if the Max is allowed back to service.
This plane should have never been grandfathered.
Boeing would be better resuming NG production while they work on a replacement. All former senior management should be judged and condemned for their crimes.
Boeing must be nationalized and the American taxpayer must foot the bill.
That’s an excellent article on AirInsight, isn’t it?
I recommend that it be “Required Reading” for all those reporting on the MAX.
““Finally, the checklist would be revised to add a reference item to manually trim the horizontal stabilizer for pitch control, and note that a two-pilot effort may be used to correct an out-of-trim condition” – Requiring both crew members to turn the trim wheel simultaneously in a non-normal scenario is extremely undesirable and goes against all philosophies of having one pilot fly and one run the QRH. No flight control system should require both pilots to operate it at any stage, let alone in an emergency.”
https://beta.regulations.gov/comment/FAA-2020-0686-0152
This comment from the British Airline Pilots Association (BALPA) is quite troubling.
Regulation 25.143:
The airplane must be SAFELY controllable and maneuverable without exceptional piloting skill or STRENGTH.
For conventional wheel type controls, the maximum control forces permitted are 10 pounds for long term application.
From the proposed AD summary document:
“Stabilizer Trim Wheel Forces comply with 14 CFR 25.143 by analysis, per EASA CRI B-17, because existing guidance does not cover stabilizer trim wheel forces. Simulator predictions, validated by flight test, were used to calculate the required stabilizer trim wheel forces and a mockup of the stab trim wheels was used to measure the force capability of appropriate pilots.”
So it’s compliant by analysis rather than specified forces, since none are listed in the regulations.
Or software !!!!
Aircraft should be flown entirely by software or solely by humans – Never both.
If both pilots are needed it means pilots are not allowed to visit the lavatory.
Either they wear Pampers or ETOPS goes down to 90 minutes.
This is a concern all around. Other pilot unions / associations have asked for additional training on the trim wheels, some for unloading techniques. Some have also asked for runaway trim and unreliable airspeed checklists to remain as required memory items (the AD says that with reduction in expected response time, they can be moved to QRH).
Pilots from BALPA may be participating in the UK JOEB meeting this week, so perhaps will get a look at the training and have a chance to express their concerns.
I still wonder why the stab trim cutout switches were changed.
I understand all previous QRH actions were to flip both, but leaving them as they were up to the NG would mean that it would be possible to flip the ‘auto pilot’ (right hand) switch, stopping STS (and presumably MCAS) from functioning, and allowing the crew to still use electrical trim to regain trim.
If the crew were for any reason unable to manually trim, having the electrical trim option available seems to make sense.
I would have thought this would be a simple, and relatively inexpensive change that adds another layer of safety. Am I missing something ?
Jakdak, this has been recommended by at least three commenters, including Peter Lemme. My hope would be that it could be done as well. It depends on how much else was changed by Boeing in those circuits.
The recommendation for 3rd AoA sensor is very common. FAA doesn’t mention it in the AD summary so most people may not realize EASA has already required it.
I did see a comment by a 737 pilot that seemed to imply that as the 737 is a ‘fly by cable’ aircraft, his last resort would be to switch off all electrical systems, and just fly manually.
An interesting idea, I wonder if that’s possible, and how exactly it would be accomplished, just how many circuit breakers would you have to pull, and how would you know which ones to pull ?
We know the Ethiopian crew flipped the stab trim cutout switches, found they couldn’t trim manually, and then flipped the cutout switches back again to try electric trim.
I can’t help but wonder if they were able to leave the right hand stab trim cutout switch down, but enable the left hand cutout switch, if they’d have been able to re-trim, and recover the aircraft. I wish that they could have had the chance (if the cutout switches had still been configured as NG switches are).
I agree, it would have given them another option and avoided the final & fatal activation of MCAS, assuming they had eventually trimmed back to neutral. They hadn’t trimmed fully back, up to that point. But it would have given them more time to figure it out.
One commenter said Boeing’s reasoning for removal was that all the checklists had been converted to throwing both switches, so there was no longer any procedural difference between them for pilots.
If true, that points up the dichotomy of keeping things as simple as possible, without removing too many pilot options. As an engineer, I want the options. But from the pilot comments, they want clear and concise and simple.
Achieving those two things together is a human factors problem. Kind of like SpaceX with Crew Dragon touch screens, they are better when things go right, but maybe not as many options if things go wrong. Seems like human factors will be an in-demand discipline as automation increases.
“the checklists had been converted to throwing both switches”
I get that, but as the checklists all state throw both switches, why would you change the hardware at all. They went to great effort not to change things, but they changed these switches.
I wonder if there have been any instances where throwing the switches failed due to failure of a switch, and thus wiring them up in series would make cutout more secure ?
Not sure why EASA, Cathay etc. seem to be opposing the FAA on this:
https://www.flightglobal.com/safety/us-rule-on-early-777-fuel-tank-inerting-overrides-foreign-carriers-objections/140264.article
I’m not sure how seriously to take the ruling as the compliance interval has been pushed out to 72 months. Just how many of the affected aircraft will still be flying in 6 years ?
If there is a safety issue that’s serious enough to address, I just don’t get why there’s such a long delay.
Airlines have long fought off tank inerting due to the installation and operational expense. In the US, the TWA 800 explosion was the final straw, after which there has been a steady movement toward inerting.
Boeing in some cases has been able to substitute changes in cable routing or fuel indicating systems, But recently the FAA even made them update 727’s of which only a few remain in foreign service.
When dealing with statistically remote events, small changes in assumptions can result in large changes in risk estimate. So you get into these cost-benefit disputes. I’m sure we’ll see more of that as aircraft get progressively safer.
The change in compliance period is to reduce the financial burden on airlines, and perhaps allow aircraft replacement as an alternative. It’s not an imminent safety of flight issue. As with the MAX wiring change, it’s more of a compliance issue.
Matth,
the BALPA comment is great and has much more.
Another one described a new process on the MAX which the NG doesn’t have and which isn’t trained:
Landing with spoilers only … I wonder what Boeing was smoking
Then many issues are mentioned which apply to the NG too and even with crashes were not corrected. Unbelievable
And I found a letter where FAA were pure lieing.
It will take years to get through these comments. Other regulators who read them might ground the NG too.
There is a comment for the proposed RTS AD from Air China, they are seeking clarification on the required MAX modifications, which they apparently are already working with Boeing to carry out. Including the wiring bundle changes and test flight requirements.
That would seem to indicate they believe the MAX will be certified in China. The domestic air travel market within China has more or less recovered, so perhaps they have enough activity to utilize the MAX.
FlightGlobal has this reaction from Boeing to the LH2 announcement by Airbus:
https://www.flightglobal.com/airframers/hydrogen-powered-airliners-unlikely-in-near-term-boeing-exec/140273.article
Sorry…posted in the wrong place.
Blame caffeine deficiency.
One thing I wonder about is if Boeing could have received an exception to the requirement for linear yoke forces up to stall if they had mandated simulator training for that scenario? In that case no MCAS would have been needed.
If so then there is a sad irony to the whole saga since it looks like simulator training will be required.
My guess is no, as the FAA would have asked them to show that the regulations could not reasonably be met. They wouldn’t have been able to do so, and also that is a sensitive part of the regulations, for direct pilot control,
Training should always be required and I hope this puts an end to the idea that it’s a cost to be avoided. As an industry practice, that was never right. The worst outcome is that pilots can brush up their skills, which as we’ve seen would be beneficial in all cases. The extent of training could still be a function of type similarity. But there needs to be simulator time for all new aircraft
The notion that training is a cost to be avoided exists only in the minds of fly-by-night operators and those in the general public who are only informed by the hype-generating news media. The fact that even Lion Air, an airline with a reputation for cutting corners, pursued with Boeing the need for training on the new MAX model they were going to acquire shows that at least their technical department recognizes the cost that avoiding training ultimately incurs, as does Boeing. That said, they are also cognizant of the absurdness of your global statement “training should always be required” which surprisingly, was promoted by this article. Does training on “how to shift gears by using a clutch” make sense in a car fitted with an automatic transmission? How would you accomplish that training in a simulator or even in a real car? MCAS had no interface with the pilot, and still doesn’t in version 2 —no ON/OFF switch, no levers/knobs to adjust or modulate its operation, no indication that it is operating other than the trim wheel spinning for two or three seconds which is not discernible from the Speed Trim. System’s operation, no reference to it in any procedure or in any alert message. In abnormal activation of MCAS due to an erroneous AOA sensor reading the trim wheel would spin in relatively long bursts of 10 seconds with 5 second pauses in between, but well before the end of the first burst a pilot who was hand-flying the airplane would detect the aberrant pitch change and begin to correct for it, initially with the elevator and as the elevator force continued to increase, by additionally using the electric trim, which would cut the trim burst short and allow the pitch attitude to be restored. So, just intuitively, without any knowledge or special training on MCAS a pilot would counter abnormal MCAS operation and restore normal pitch attitude. In case you missed it, the Flight Data Recorders showed that on all three flights that encountered abnormal MCAS operation prior to the grounding, the pilots responded intuitively, as Boeing expected, and successfully countered MCAS each time it activated—24 times on one of the flights—allowing them to maintain altitude. When the pilot’s electric trim correction stopped MCAS would begin the 5 second pause and thereafter begin the next burst of trim. At least sometime during the next burst of trim the pilot would recognize a problem with the trim system. At this point Boeing expected a pilot trained on the runaway trim procedure, as required for the basic 737 type rating, to recognize the condition and execute the procedure. The pilots on all three flights gave absolutely no indication that they had even heard of the condition, let alone trained for it.
So, when Boeing snubbed Lion Air’s query about simulator training for the MAX they did so not because they were trying to save LA or anyone else some money, but because it wasn’t even possible to provide MCAS training in a simulator. It is also why Boeing, citing transparency of the system, petitioned the FAA to remove MCAS from the pilot’s operations manual—nothing to operate. It is also why the MAX was returned to service still without simulator training for MCAS. There is a required “demo” of MCAS in a simulator, but no one learns how to fly by watching a demo. I can’t criticize the FAA for creating a true waste of time, money and scarce simulator resources for the airlines; they threw that demo in to appease the contentious masses, who have proved that by bad behavior they can push Congress to pass laws that will actually reduce aviation safety.
Hello,
It is not just a matter of rectifying the MCAS, but of recertifying the 737 MAX. Some comments such as Peter Lemme’s or Gilles Primeau’s (*) mention the effects of the loss of an AoA sensor on the EFSM/SMYD and its effects on the control forces. Gilles Primeau also evokes potential problems on the PHR actuator. His (colossal) work is particularly well documented.
(*) https://beta.regulations.gov/comment/FAA-2020-0686-0172
I think some/most of you are missing the point. It is simply criminal neglect to to give a flight control computer system more control authority than the pilot, and implement that computer as single channel (simplex) hardware – even if you hook up 2 or more AoA sensors to it. No amount of software in the world can fix that. It is criminally insane.
Oh, and yes: I do know what I am talking about: 35+ years of specifying, analyzing, designing, testing, certifying civil & military primary, secondary and high-lift fly-by-wire systems.
This is a very non technical question, but is there not just a plane wide “manual override?”
If something goes wonky with the electrical system, they can push manual override for all systems, and just fly the plane to safety?
Is this not available on modern planes? Should it be?
Do you have such an override on your car? If you did, can you describe how you envision it would work?
“And [test pilots from Boeing, FAA, and EASA] don’t certify an unstable aircraft, they can’t. The flight safety rules for airliners denies unstable aircraft certification.”
False and false.
Test pilots *did* certify the original “sloppy MCAS smoothing” design.
And DO178B didn’t stop the faulty aircraft from being originally certified.
I’m an Embedded Avionics Software Engineer. No one has *ever* been killed or injured as a result of my software.
But then again, I’m not a $7 an hour Indian engineer “freshie”. 👈
May I recommend a formal education in Aeronautical Engineering to complement your knowledge in software programming? Along the way you may discover that test pilots don’t certify anything, period. You would certainly discover what constitutes stable versus unstable and recognize that the original airplane wasn’t faulty. You may even come to recognize that it was grounded without valid reason, by a relatively incompetent U.S. President who was then affirmed by underlings. With or without that additional education, I hope in time you acquire the humility to recognize and appreciate the influence of others who provided you with the proper requirements and feedback to drive corrections to your embedded software BEFORE it resulted in any injuries or death. And finally, I hope you come to realize that the quality of a person’s work doesn’t have to be defined by the amount they are paid—there are millions who volunteer without any pay at all and produce excellent work, and denigration of an entire sector of humanity merely on the basis of national location or pay is simply absurd and unwarranted with no supporting data, invalid too as flight control laws are restricted from export to India by EAR and ITAR regulations.
“With two sensors you can’t decide which one is giving incorrect values, you need a two versus one vote structure to achieve this. Instead, Boeing relied on the Pilot detecting a miss-trim situation if MCAS trimmed when it shouldn’t”
Basically Boeing tried to “save money” and used the *inferior* single source design instead of a triple “voting” design and tried to use the pilot as a “sensor”.
Wow. You’re trying to justify this bad decision that goes all the way up to the top people at Boeing?!?!?
This aged well.