Boeing Boeing 737 Max MCAS System

1,349
87
From Boeing: "Flight Control Computers and Stability Augmentation
The trend in the design of modern airplanes is to have less static longitudinal stability--frequently referred to as relaxed static stability (RSS)--to capture the benefit of improved fuel efficiency. Simply stated, some airplanes are now designed to be aerodynamically efficient, and stability is augmented electronically so that stick force gradients will meet certification requirements. Many methods exist for augmenting stability. For example, the Boeing 777 and MD-11 use flight control computers that adjust the elevator actuator positions to give the appearance of more longitudinal stability than the airplane actually has. In other words, computers absorb the extra workload caused by flying with RSS. -https://www.boeing.com/commercial/aeromagazine/aero_02/textonly/fo01txt.html


One of the main functions of MCAS was to make the plane "simpler to fly". To make it simpler to certify and get up in the air. It's pretty evident increased RSS and automation add incredible complexity and new failure modes in their effort to keep things simple for the pilot.
From your boeing quote above.
Simply stated, some airplanes are now designed to be aerodynamically efficient, and stability is augmented electronically so that stick force gradients will meet certification requirements.

In this specific case I don't think that the 737 max was out of line from those requirements. But I know it was out of line from the previous model. Again, mcas was used to make it fly similar to the previous model pilots are already certified to fly.

I would be VERY surprised to hear/read that without mcas, on take off the "yoke resistance" is way off from "normal" / expectation. Though if the pilot flew it the same as the previous model the pitch up would be "too high". Not even remotely necessarily that pilots WOULD pitch up too much. But that is clearly different flight characteristics; which would require a new type certificate.

completely agree with your last statement. We do see the issue the same from that perspective.
 
217
30
From your boeing quote above.
Simply stated, some airplanes are now designed to be aerodynamically efficient, and stability is augmented electronically so that stick force gradients will meet certification requirements.

In this specific case I don't think that the 737 max was out of line from those requirements. But I know it was out of line from the previous model. Again, mcas was used to make it fly similar to the previous model pilots are already certified to fly.

I would be VERY surprised to hear/read that without mcas, on take off the "yoke resistance" is way off from "normal" / expectation. Though if the pilot flew it the same as the previous model the pitch up would be "too high". Not even remotely necessarily that pilots WOULD pitch up too much. But that is clearly different flight characteristics; which would require a new type certificate.

completely agree with your last statement. We do see the issue the same from that perspective.
Well it wasn't out of line with those requirements because part of their genesis was to satisfy them.

Again, only one of the functions of MCAS was certification. It's remedies are more reaching than that which overlap certification.

I would add that you seem to be envisioning MCAS as operating only in a take off scenario. In effect, these systems are very primitive and stupid (so as to decrease failure modes) and as I understand, they don't know if you're in take off or cruising at 30 000 or in a dive or climb (they don't do that level of inductive reasoning), they are limited by their very strict parameters, which seems primarily to be determined by the AoA. This is part of the design problem. Add their pitch authority and this is where we're at.
 
1,349
87
MCAS is intrinsically faulty as a flight control augmentation system. I think I get that you're saying that it's not required if it fell into a new type. But that's not what happened.

It's in how you frame your argument. When you say maybe, it's not so benign. In this context its refuting my more complex perspective and position. And in effect simplifying the scenario such that if one, more training was provided and two, a new type certification was attained, all would be good. Well, both of those things needed to happen potentially but that doesn't remedy the totality of the problems and challenges that automated systems like MCAS create. And it wouldn't be moot or unnecessary I would argue. I think with those huge LEAP engines, you needed MCAS. Training could potentially supplant it but you'd still be left with an unstable aircraft and instead of MCAS you'd be putting that instability on the pilot to correct for.
Ah I see, well I can't argue your feelings.

Note mcas is "active" only with AP off* flaps up and AoA too high. (*because AP, just like the pilots, can fly the plane just fine; it's' not an "unstable" plane)

A link from "the Air Current" article on mcas written by their editor in chief Jon Ostrower who "covered" (aviation journalist) the development of the 737. Where he describes the effect of the redesigns on the flight characteristics as "Ever so slightly changed how the jet handled in certain situations". That's inline with my understanding from Juan's videos I've linked to previously.
 
217
30
Ah I see, well I can't argue your feelings.

Note mcas is "active" only with AP off* flaps up and AoA too high. (*because AP, just like the pilots, can fly the plane just fine; it's' not an "unstable" plane)

A link from "the Air Current" article on mcas written by their editor in chief Jon Ostrower who "covered" (aviation journalist) the development of the 737. Where he describes the effect of the redesigns on the flight characteristics as "Ever so slightly changed how the jet handled in certain situations"
The qualification "ever so slightly" doesn't really bode well in light of the recent tragedies with pilots with more than adequate flight hours and experience, in that type. It's all about probabilities and scenarios. If said pilot goes up and says, "The aircraft didn't feel very different." That doesn't really say much. Perhaps it's worth something if they fly like 10 - 50 different flight scenarios.
 
217
30
Note mcas is "active" only with AP off* flaps up and AoA too high. (*because AP, just like the pilots, can fly the plane just fine; it's' not an "unstable" plane)
Well, perhaps it was proven as stable before the newest mark which is MAX with the new engines.
 
1,349
87
I would add that you seem to be envisioning MCAS as operating only in a take off scenario. In effect, these systems are very primitive and stupid (so as to decrease failure modes) and as I understand, they don't know if you're in take off or cruising at 30 000 or in a dive or climb (they don't do that level of inductive reasoning), they are limited by their very strict parameters, which seems primarily to be determined by the AoA. This is part of the design problem. Add their pitch authority and this is where we're at.
Am giving up with a final retort lol. mcas does not at all operate on take off. flaps up is a requirement for it to activate. That is shortly after take off, while engines are still at take off thrust. And where the "creeping up" of the nose would occur.

again three requirements (as at the time of the accidents) flaps up, AP off and high AoA for mcas to activate.
 
217
30
Am giving up with a final retort lol. mcas does not at all operate on take off. flaps up is a requirement for it to activate. That is shortly after take off, while engines are still at take off thrust. And where the "creeping up" of the nose would occur.

again three requirements (as at the time of the accidents) flaps up, AP off and high AoA for mcas to activate.
You lean on these basic parameters for activation as if they forgive the erroneous activation we've seen in these tragedies.
 

FactChecker

Science Advisor
Gold Member
2018 Award
4,730
1,614
It is inconceivable to me that the plane is outside of the required stability margins when the system is operating correctly. I think that the issues are the reliance on a single AOA input, the removal of displays which would tell the pilot what is going on, and the way the system seemed to ignore pilot pitch-up inputs for such a long time. So the system would believe one unverified input while ignoring (or unaware of) indicators that the input may be wrong.
 
217
30
flaps up, AP off and high AoA for mcas to activate.
In other words, typically normal flight regime outside of the AoA sensor input.
 
217
30
It is inconceivable to me that the plane is outside of the required stability margins when the system is operating correctly.
There is a lot of assumptions here. But again it's how those lines or margins are drawn.
I think that the issues are the reliance on a single AOA input, the removal of displays which would tell the pilot what is going on, and the way the system seemed to ignore pilot pitch-up inputs for such a long time. So the system would believe one unverified input while ignoring (or unaware of) indicators that the input may be wrong.
Or in laymen's terms, the system was "dumb". An oversimplification, because simplification of a system was beneficial in this scenario (simpler was better). It proved to be a erroneous pressure on the decision making. Such that a system with tremendous pitch authority was mis-configured to disastrous effects.
 

russ_watters

Mentor
18,405
4,653
In other words, typically normal flight regime outside of the AoA sensor input.
I think you're mixing together the "normal" operation and the failure scenario. Having a high aoa during cruise - most of the "normal flight" regime - would require a ripping-the-wings-off steep turn. So there is no scenario in cruise when it should activate. The actual part of the flight envelope or normal flight regime where MCAS should activate is pretty small. You could add additional sensors such as an airspeed limit (MCAS disabled above 300kts for example), but that also adds another potential failure point.

We tend to get tunnel vision focusing on the specific system or crash scenario. It's not a simple system and while it does appear a failure mode was missed or underestimated, Boeing engineers are not idiots and have surely thought through the broader implications.
 

russ_watters

Mentor
18,405
4,653
To further clarify: I think that with trim, manual control may in fact not be hydraulically assisted. So, if I'm not mistaken when they use the stab cutout switches that may result in no hydraulic or "electric" assistance to control the trim and the trim wheels in effect work mechanically. I'm not sure of this however. It may be the case that the stab cutout only bypasses automated systems and the trim switches on the yoke still operate using electric control of the trim. Given the recent tragic scenarios, I think that's preferable.

For other systems, like elevator, aileron and rudder, manual control would still mean hydraulically assisted since as previously explained direct mechanical control is not a practical flight scenario and more of a redundant backup architecture. Manual control in this sense, is disabling autopilot.
Trim is the *only* aerodynamic control in which manual control is even possible, so rather than have multiple levels of automation, they may drop straight to full manual. The electronic trim is not the same as hydraulic assist in that it is still fully decoupled mechanically from the control surface. Hydraulic assist is pretty "dumb".

Related to what I said in my previous post, these failure scenarios get complicated. There was an Airbus crash once where the aoa sensors froze up during an automation/acceptance test, the plane's computer realized it and handed full "manual" control to the pilots, with the pitch trim strongly "up". The pilots either didn't notice or didn't know how to handle the issue and simply pushed their control sticks all the way forward to avoid the stall. It didn't work and the plane stalled and crashed.

In this case they evidently didn't know the trim was "fighting" them - because they couldn't feel it - and never tried to manually spin the trim wheels, which likely would have prevented the crash.

This also relates to past discussions of the pros and cons of a system (trim itself) that can overpower the pilots. Is it worse to be overpowered and know it or overpowered and not know it?
 
217
30
I think you're mixing together the "normal" operation and the failure scenario. Having a high aoa during cruise - most of the "normal flight" regime - would require a ripping-the-wings-off steep turn. So there is no scenario in cruise when it should activate. The actual part of the flight envelope or normal flight regime where MCAS should activate is pretty small. You could add additional sensors such as an airspeed limit (MCAS disabled above 300kts for example), but that also adds another potential failure point.

We tend to get tunnel vision focusing on the specific system or crash scenario. It's not a simple system and while it does appear a failure mode was missed or underestimated, Boeing engineers are not idiots and have surely thought through the broader implications.
What I meant is that all of the conditions outside high AoA are totally normal. So that a single AoA sensor reading that's bad results in erroneous activation.

Regarding if the Boeing engineers are idiots. Obviously they are not. However, they aren't all going to be of the same caliber and experience. It's hard to know where to put the blame with a big corporation like that, I'm sure more than one head in more than one department will roll. However, I think it's accurate to say that MCAS was a very stupid design and implemented very poorly.
 
Last edited:
217
30
Trim is the *only* aerodynamic control in which manual control is even possible, so rather than have multiple levels of automation, they may drop straight to full manual.
I was sure I read somewhere that there is redundancy in the case both A and B hyd fail.

It's termed manual reversion in the 737:

"In the event of a dual hydraulic failure, a manual reversion mode will allow the elevators and ailerons to driven through a mechanical means"

"In the event of of a total hydraulic failure, manual forces from the control wheel would be transmitted through stops in the power input control linkage, thus providing a direct mechanical link to the control wheel. Input forces are minimized by aileron balance tabs and hinged balance panels. "

-https://www.airliners.net/forum/viewtopic.php?t=731915

"Ailerons are powered by hydraulic systems A and/or B. If both hyd should fail, manual reversion is available from both control wheels. "

None for the rudder but there is a 3rd way to power it if A and B fail:

"The rudder is moved by a PCU powered by hyd sys A and/or B. If A and/or B fails a standby PCU can be powered from the standby hydraulic system. "

"The control column moves the elevators using hyd A and/or B. If both hyd should fail, manual reversion is available from both control columns. "

Also there are balance tabs on the elevators and ailerons.

-http://www.b737.org.uk/flightcontrols.htm

...so rather than have multiple levels of automation, they may drop straight to full manual.
Remember that the NG operated exactly as I suggested. The AP cutout disabled all automatic trim commands while you could leave MAIN ELEC in normal to command electric trim. This was procedure in the NG for stab trim runaway. They changed it in the Max for some reason.
 
Last edited:
217
30
This also relates to past discussions of the pros and cons of a system (trim itself) that can overpower the pilots. Is it worse to be overpowered and know it or overpowered and not know it?
It's a good point. I would say that it's worse to be overpowered to begin with. It's one thing if the pilot has commanded the stab to an out of trim scenario, but when auto systems are doing it, then a lot of confusion can ensue as we've seen.

The issue of not knowing is again I believe a feedback problem (and training and probably a bunch of other things as is always the case). But I really think that a feedback system, like I posted earlier should be included in the PFD that shows the trim angle and perhaps if it's in man electric, full manual, or auto.
 

russ_watters

Mentor
18,405
4,653
It's a good point. I would say that it's worse to be overpowered to begin with.
Well again, that's not one of the options. The trim needs to be stronger than the pilot otherwise the plane -basically any plane - wouldn't be flyable. Not even a little Cessna. Remember, trim has to be adjusted every time you change your speed or attitude and as you burn fuel. You can be overpowered by *not* adjusting trim, not just by over-adjusting it.

And to clarify, in case it isn't clear, I'm not just talking about needing 100+lb of force as in these scenarios. Even the ~20lb changes that are pretty normal in the Cessna I fly would be unsustainable for more than a few minutes. Humans just aren't built to be able to hold constant force with muscles.
It's one thing if the pilot has commanded the stab to an out of trim scenario, but when auto systems are doing it, then a lot of confusion can ensue as we've seen.
Right; that's different from the trim being stronger than the pilot, that's auto-trim doing something unexpected. But in a plane without auto-trim, even a small plane such as a Cessna, if you don't adjust the trim yourself, you'll be fighting it for most of the flight, with poor odds of completing the flight successfully.

So my point is, in a situation where the plane hands full manual control to the pilot, is it easier to handle the plane when you have feedback or don't? Well again, it depends. If you are handed control when in control and in trim and with all your instruments working, it may not matter. When you make a change in attitude/speed, you should notice the yoke pressure on a manual plane and notice the joystick isn't centered on a fly-by-wire plane. But unfortunately, computerized planes rarely hand the pilot manual control when the plane is fully functional -- they only do it when something fails. And when that happens, a pilot with a lot on his plate might not realize what is going on. The XL888 pilots in the above link didn't realize it - perhaps because they couldn't feel it - and crashed. The Ethiopian Air pilots did realize it - because they felt it - and crashed anyway.
The issue of not knowing is again I believe a feedback problem (and training and probably a bunch of other things as is always the case). But I really think that a feedback system, like I posted earlier should be included in the PFD that shows the trim angle and perhaps if it's in man electric, full manual, or auto.
In the case I just linked, XL888, the pilots were given a notification that auto-trim was no longer active and either missed it or misunderstood it. For Ethiopian, I'm not sure if we know yet whether they followed the procedure correctly.
 
1,349
87
In other words, typically normal flight regime outside of the AoA sensor input.
No.

That is typical flight just after take off. Am not sure about landing, I imagine sometimes they do "auto pilot" landings, at least to some degree.

Typical flight is with AP on.
 
217
30
No.

That is typical flight just after take off. Am not sure about landing, I imagine sometimes they do "auto pilot" landings, at least to some degree.

Typical flight is with AP on.
My view is the logic for activation outside of the AoA vane input is completely normal. It does not represent a scenario outside or on the edge of the flight envelope. As you've pointed out it occurs regularly after take off.
 
1,349
87
You lean on these basic parameters for activation as if they forgive the erroneous activation we've seen in these tragedies.
:oops:Really? am not interested in going along that tangent with you.
 
1,349
87
My view is the logic for activation outside of the AoA vane input is completely normal.
that's fine, my reply you quoted was to you saying...

In other words, typically normal flight regime outside of the AoA sensor input.
My reply was that (AP off) is not "typically normal flight regime..."
 
217
30
Well again, that's not one of the options. The trim needs to be stronger than the pilot otherwise the plane -basically any plane - wouldn't be flyable. Not even a little Cessna. Remember, trim has to be adjusted every time you change your speed or attitude and as you burn fuel. You can be overpowered by *not* adjusting trim, not just by over-adjusting it.
What I mean here is that the scenario of the airbus you gave was an undesirable scenario that you'd rather not be in, where the elevator controls are overpowered by the stab and there is no attitude control.

But unfortunately, computerized planes rarely hand the pilot manual control when the plane is fully functional -- they only do it when something fails. And when that happens, a pilot with a lot on his plate might not realize what is going on.
Ya I imagine that's a big issue with these types of failures. I think better HCI and feedback could help as we've suggested.

In the case I just linked, XL888, the pilots were given a notification that auto-trim was no longer active and either missed it or misunderstood it. For Ethiopian, I'm not sure if we know yet whether they followed the procedure correctly.
I think a constant feedback of the stab trim on the PFD would be better than a verbal notice or light. It just has so much pitch authority and now we have all these auto systems commanding it.

The preliminary report shows the Ethiopian flight followed procedure correctly for a runaway stab trim. Right before the final dive it looks like they switched the cutouts back to normal. I suggested this was likely a last ditch effort to regain manual electric control of the trim since the manual wheel wasn't working and the pilot is heard saying that, "It's not enough" after asking the co pilot to help him pull back on the yoke. The electric trim did work, as would be the case in the NG, but unlike the NG where they could command electric trim without auto trim systems, MCAS was now active again. MCAS did one final AND trim command effectively making the dive irrecoverable.

It's easy in hindsight to look at the situation and pick out all the things that could of been done better. Without really being in that situation we can't fully understand how much of it was human factors. We'll know more with the final report.

What I will say is that when you look at the graphed data from the FDR, it's pretty shocking how MCAS operates in these failure scenarios. It commands nose down trim for an incredibly long period of time, up to 10 seconds with a 5 second break and has no command limit. And when commanding any electric trim commands from the yoke are overridden. If you haven't read the report, I'd recommend it. Especially take a look at that FDR graph, it allows you to see the flight from a flight data perspective. You may wish to skip the historical facts I think it's titled, where it goes through the flight by time-code. I found that rather upsetting.
 
217
30
:oops:Really? am not interested in going along that tangent with you.
Well that's the angle I get from how you seem to defend MCAS but I could be mistaken. You seem to feel like it's an easy fix if the pilots are trained. And you constantly reiterate it's activation parameters. I'm not really clear on why. These were well established in this thread hundreds of posts ago.
 
217
30
that's fine, my reply you quoted was to you saying...



My reply was that (AP off) is not "typically normal flight regime..."
AP is off during take off. And climb out. It's also not used 99% of the time for landing. So I don't see AP off as non-normal. It's part of every flight.
 
1,349
87
AP is off during take off. And climb out. It's also not used 99% of the time for landing. So I don't see AP off as non-normal. It's part of every flight.
who said it wasn't ? rhetorical.
 
217
30
who said it wasn't ? rhetorical.
You did I thought. I'm saying AP off is part of a "typically normal flight regime". You seemed to disagree.
 

Want to reply to this thread?

"Boeing 737 Max MCAS System" You must log in or register to reply here.

Physics Forums Values

We Value Quality
• Topics based on mainstream science
• Proper English grammar and spelling
We Value Civility
• Positive and compassionate attitudes
• Patience while debating
We Value Productivity
• Disciplined to remain on-topic
• Recognition of own weaknesses
• Solo and co-op problem solving
Top