How Safe is the Boeing 737 Max's MCAS System?

[.Scott]

I had a question before which is sort of related. I still don't understand it completely: If MCAS is meant to be active in scenarios of high AoA and pitch up conditions. Would it ever be active when the plane has a negative pitch attitude. It was suggested this could occur during a dive when the pilot is pitching up to pull out. But it doesn't seem likely adding nose down trim in that scenario would be beneficial so wouldn't it be improbable MCAS would be active then?

I guess it seems counter intuitive imagining MCAS operating in negative pitch attitude scenarios since it's often described as a stall prevention system.

The specific problem that MCAS was meant to solve was that without it, pilots that were accustom to the handling of the 737 could unintentionally put the MAX into a stall - for example, during steep banks. So what MCAS does is monitor the aerodynamic environment of the plane - not its orientation, not its proximity to the ground - just its interface to the air. If it determines that the pilot might be induced to pull harder than he should (that he would on a 737), it will reposition the horizontal stabilizer to create the familiar 737 environment.

For MCAS, "useful" doesn't mean less effort for the pilot, it means creating the same amount of effort that the pilot expects.

So, let's say that they plane has already stalled - and the nose has dropped as it will even without pitch input from the pilot. What the pilot needs to do now is to push the nose down even more - to pick up air speed. Then the pilot will need to begin a fairly high-G pull up - enough to avoid excessive airspeed and the ground, but not enough to break the plane or injure the passengers. During these maneuvers, all of which are done with the plane pitched towards Earth, the pilot will be operating the yoke mostly by feel. His eyes will be on other things. So it's important that the plane respond based on this expected feel.

 

[cyboman]

High AoA, yes. Pitch up, not necessarily. As @russ_watters reminded me in post #238, AoA is not the same as pitch attitude. AoA is the angle between the wing and the relative wind; if the plane is descending fast enough, AoA can be high even if the nose is pitched down.

Right, yes I remember this. I believe I got that wording from the Boeing flight man has MCAS described that way, but I think it's meaning is high AoA and pitch up conditions, meaning the plane is "wanting" to pitch up or the pilot is pulling up. So it's a condition not an attitude. Confusing wording.

 

[cyboman]

The specific problem that MCAS was meant to solve was that without it, pilots that were accustom to the handling of the 737 could unintentionally put the MAX into a stall - for example, during steep banks. So what MCAS does is monitor the aerodynamic environment of the plane - not its orientation, not its proximity to the ground - just its interface to the air. If it determines that the pilot might be induced to pull harder than he should (that he would on a 737), it will reposition the horizontal stabilizer to create the familiar 737 environment.

For MCAS, "useful" doesn't mean less effort for the pilot, it means creating the same amount of effort that the pilot expects.

So, let's say that they plane has already stalled - and the nose has dropped as it will even without pitch input from the pilot. What the pilot needs to do now is to push the nose down even more - to pick up air speed. Then the pilot will need to begin a fairly high-G pull up - enough to avoid excessive airspeed and the ground, but not enough to break the plane or injure the passengers. During these maneuvers, all of which are done with the plane pitched towards Earth, the pilot will be operating the yoke mostly by feel. His eyes will be on other things. So it's important that the plane respond based on this expected feel.

Thanks, that example helps.

 

[.Scott]

Right, yes I remember this. I believe I got that wording from the Boeing flight man has MCAS described that way, but I think it's meaning is high AoA and pitch up conditions, meaning the plane is "wanting" to pitch up or the pilot is pulling up. So it's a condition not an attitude. Confusing wording.

According to this page:
http://www.b737.org.uk/mcas.htm

To summarise; MCAS will trim the Stabilizer down for 10 seconds (2.5 deg nose down) and pause for 5 seconds and repeat if the conditions (high angle of attack, flaps up and autopilot disengaged) continue to be met. Using electric pitch trim will only pause MCAS, to deactivate it you need to switch off the STAB TRIM [CUTOUT} switches.

So, it appears that only AoA, flaps, and autopilot states are important.

 

[PeterDonis]

it appears that only AoA, flaps, and autopilot states are important

Other sources linked to in this thread have indicated that the pitch up moment due to the new engines depends on airspeed as well as AoA, so one would expect that the MCAS algorithm would also have airspeed as an input. But I have not seen any source actually say that.

 

[russ_watters]

Right, yes I remember this. I believe I got that wording from the Boeing flight man has MCAS described that way, but I think it's meaning is high AoA and pitch up conditions, meaning the plane is "wanting" to pitch up or the pilot is pulling up. So it's a condition not an attitude. Confusing wording.

The word "pitch" is a noun and a verb and yes, "pitch up" and "up pitch [attitude]" mean very different things. One is a position and the other a motion.

 

[cyboman]

According to this page:
http://www.b737.org.uk/mcas.htm
So, it appears that only AoA, flaps, and autopilot states are important.

Actually that's exactly where I got it from. If you look at the image right above where you're quoting, which is a page from the flight manual, the last paragraph under the MCAS heading says:
"The MCAS only operates at extreme high speed pitch up conditions that are outside the normal operating envelope."

But as I've suggested, perhaps "conditions" is not saying it's only active with actual positive pitch attitude, but instead implying when the plane is being maneuvered to pitch the plane upward from it's current attitude. That is, it won't be active when the pilot is pushing forward on the yoke. Again the language is a bit confusing to me.

 

[cyboman]

The word "pitch" is a noun and a verb and yes, "pitch up" and "up pitch [attitude]" mean very different things. One is a position and the other a motion.

Right, so then in the manual it's referring to the motion right not position or attitude? "...pitch up conditions..."

 

[russ_watters]

Right, so then in the manual it's referring to the motion right not position or attitude? "...pitch up conditions..."

The grammar of each sentence will tell you. [edit] The noun version matters to the pilot because he can't see his aoa, but the flight control computer probably mostly cares about the verb.

 

[.Scott]

.

Actually that's exactly where I got it from. If you look at the image right above where you're quoting, which is a page from the flight manual, the last paragraph under the MCAS heading says:
"The MCAS only operates at extreme high speed pitch up conditions that are outside the normal operating envelope."

But as I've suggested, perhaps "conditions" is not saying it's only active with actual positive pitch attitude, but instead implying when the plane is being maneuvered to pitch the plane upward from it's current attitude. That is, it won't be active when the pilot is pushing forward on the yoke. Again the language is a bit confusing to me.

It a page from the training manual:

In this case, "pitch up condition" means that the pilot is pulling on the yoke to pitch the plane further up. For example, he may be attempting to pull out of a dive.
A pitch up that is outside normal operating envelope is one that would either threaten a stall or threaten aerodynamic damage to the plane.
When the word "envelope" is used, it is talking about the flight limitations of the airplane - that are independent of its attitude.

That is probably why it it is also looking at the bank angle. Though that is not as well advertised, it is shown in the graphic as "steeply turning".
When a plane is making a turn at more than the standard turn rate, an "accelerated stall" is possible.

 

[cyboman]

.

It a page from the training manual:
View attachment 240538

In this case, "pitch up condition" means that the pilot is pulling on the yoke to pitch the plane further up. For example, he may be attempting to pull out of a dive.
A pitch up that is outside normal operating envelope is one that would either threaten a stall or threaten aerodynamic damage to the plane.
When the word "envelope" is used, it is talking about the flight limitations of the airplane - that are independent of its attitude.

That is probably why it it is also looking at the bank angle. Though that is not as well advertised, it is shown in the graphic as "steeply turning".
When a plane is making a turn at more than the standard turn rate, an "accelerated stall" is possible.

Ahh right, that's what I thought.

 

[cyboman]

@.Scott Would you happen to know the maximum stab nose down trim angle on the Max? I was wondering if it's possible to calculate the maximum nose down movement the system could cause (this is obviously due to other moments too as it applies to final pitch attitude). But it could work to show it could actually be impossible to recover the plane with such nose down movement. I asked here in relation to data in the Seattle times article:

So the actual stab limit of 2.5 degrees would give a physical maximum of 20.8 degrees of nose down movement (assuming they are directly proportional)? That seems like a pretty insane amount of potential pitch attitude change for a system that's supposed to be so invisible it's not worth mentioning. And, it can keep resetting and essentially max out the nose down trim of the stab. Is that origin of the name Max? j/j

I wonder what the maximum nose down trim angle of the stab is. I looked but couldn't find it. Thought it would be here: http://www.b737.org.uk/techspecsdetailed.htm but couldn't find it. One interesting thing you can see is that the stab in the Max is unchanged from the previous NG model. Maybe a redesign of the stab would of been worth the cost, as opposed to the MCAS software which mysteriously changes the control surface behind the scenes.

 

[.Scott]

@.Scott Would you happen to know the maximum stab nose down trim angle on the Max? I was wondering if it's possible to calculate the maximum nose down movement the system could cause (this is obviously due to other moments too as it applies to final pitch attitude). But it could work to show it could actually be impossible to recover the plane with such nose down movement. I asked here in relation to data in the Seattle times article:

It would be a function of both the stabilizer angle and the airspeed.
Here is the only source I see right now (for the Lion crash) - I will look harder later:
https://oppositelock.kinja.com/lion-air-737-max-8-crash-100-pounds-of-yoke-force-21-1833371123

The system would also pivot the stabilizer that much [2.5 degrees] repeatedly as long as data inputs indicated the aircraft was about to stall, regardless of the pilots’ strenuous efforts to overpower the system. In the October Lion Air crash, which killed 189 people, the flight data recorder counted the captain countering the system 21 times with the first officer taking over for [a] few tries before the captain’s final futile efforts to arrest a 500-MPH dive. The data indicated the nose-down yoke forces peaked at a little more than 100 pounds.

Even if it were only 30 pounds, that would be a lot to hold steady - not letting it go harder or softer.
Under normal conditions (autopilot excepted), you want to be able to control the plane with just your finger tips. So you would trim it up with that objective.

 

[cyboman]

It would be a function of both the stabilizer angle and the airspeed.
Here is the only source I see right now (for the Lion crash) - I will look harder later:
https://oppositelock.kinja.com/lion-air-737-max-8-crash-100-pounds-of-yoke-force-21-1833371123Even if it were only 30 pounds, that would be a lot to hold steady - not letting it go harder or softer.
Under normal conditions (autopilot excepted), you want to be able to control the plane with just your finger tips. So you would trim it up with that objective.

Interesting thanks.

 

[cyboman]

I'm interested in the sort of instrumentation or feedback that exists that is communicating the status of the trim and it's setting / status and the autonomous systems interacting with it. Is the only feedback to the pilot of current trim settings the actual trim wheel?

 

[.Scott]

I'm interested in the sort of instrumentation or feedback that exists that is communicating the status of the trim and it's setting / status and the autonomous systems interacting with it. Is the only feedback to the pilot of current trim settings the actual trim wheel?

In small planes, the only trim feedback you get is difficult handling when it is out of trim.
From Aloha_KSA's description, the 737MAX also provides a noise and the sight of the trim wheel spinning when the trim is changing - both are easy to miss or ignore. Also according to KSA, there is a direct indication on the center pedestal.
https://www.pprune.org/rumours-news/619272-ethiopian-airliner-down-africa-102.html#post10423122

So, if you are completely prepared for the malfunction, you could handle it. In fact, there is an interesting story about the flight before the fateful Lion flight. The failure occurred on that flight as well - and the crew did not catch it - but an off duty pilot sitting in the jump seat (which has a good view of the center pedestal) did catch it and gave instructions to the pilots on how to handle it.
https://www.bloomberg.com/news/arti...in-cockpit-saved-a-737-max-that-later-crashed

The procedure would be: trim back using the electric system - which will temporarily cutout MCAS and then immediately flip the STAB cutout switch.
If you have that exact sequence in mind and you recognize the problem before it develops into a roller coaster ride, it is simple.

But if it's been a year or two since you tried that in a simulator, you may remember that the issue might be MCAS and that it can be stopped with the cutout switch - so you use that switch. But now you would need to unwind the trim manually - which could take minutes.

Or you might at first think that it was stuck trim - and so you brace yourself for a lot of exertion. Only to discover in time that the trim is far from stuck and is actually getting worse and worse.

 

[.Scott]

I found quote from another pilot that describes the value of the MCAS.
This is from retired 737 pilot "gums", at this link:
https://www.pprune.org/rumours-news/619494-mcas-altitude-v-attitude.html#post10419880

I can tellya that having the stick/wheel feel get light as you approach a stall AoA is not good. And then, if you pull back just a tad longer the nose continues to rise all by itself.

As a pilot myself, I want the plane to fight me at least a bit before going into a stall. This pilot is suggesting that the MAX without the MCAS doesn't do that at all. It just pivots up freely - eventually pitching into the stall all on its own.

What makes this important is that pilots shouldn't just turn this system off - and Boeing can't suggest that as a solution. MCAS isn't just nice for making the 737-MAX feel like a 737-NG, it is a critical safety component.

It is also worth talking about stalls. In a small plane, a full stall followed by a prompt recovery will loose you about 100 feet of altitude. A little delay and that could easily be 300 feet. But jumbo jets move fast and pivots slowly. From what I've read, recovering within 1000 feet is really excellent - and depending on the circumstances, a loss of 10,000 feet is not unreasonable. During the stall, the plane pitches down dramatically (especially as viewed from the cockpit) and the airspeed varies a lot. There is usually at least a little roll moment, and in some cases the plane can roll dramatically. Certainly, in a passenger plane, this is a maneuver to be avoided.

 

[JBA]

Before computer control systems, a parallel to the current issue existed on the Boeing 727 that was discovered in flight testing prior to the release of the aircraft. The issue was that as the elevators passed through the neutral horizontal position from down to up there was sudden reduction the amount of stick force resistance that could result in the pilot pitching the plane upward toward a stall attitude. The solution used for that problem was to train pilots to anticipate the force change plus the addition of a rod of depleted U238 extending from the back inside edge of each elevator section to provide rotational inertia and give the pilot time to react to the force change.
A test pilot I had an opportunity to visit with during that time made the comment "you would be surprised how much the operating stability of an aircraft is a result of weights and springs".

 

[Ken G]

What I'm hearing from the pilot's perspective makes them sound somewhat isolated from the design choices, and even the design information. That doesn't seem like a good thing, we'd like to imagine the people who have to fly the plane having a lot of input into its design and certainly complete information about its design. But it sounds more like something that engineers foisted onto the pilots, framed as being for their own good, without necessarily really telling them why and how to deal with it. Is it possible that this is due to a sense that certain aspects of the MAX needed to be concealed from the pilots to mitigate objections?

The reason I ask is because If I were an engineer being tugged in several different directions in my design choices, on the one hand wanting to make a plane that pilots like to fly while on the other hand meeting various profit-related specs, I might find myself tempted to conceal from both sides of those conflicting interests some of the tradeoffs going on. Would I hesitate to tell the executives who see the corporate bottom line that the plane could fly cheaper if I just made it harder on the pilots? Would I hesitate to tell the pilots that the plane could be made easier to fly but it would cost more? If I'm tempted to conceal that kind of information, it could lead me to design systems to help compensate for the tradeoffs in ways that I am not fully forthcoming about. Could this dynamic be playing a role in the design of the MAX and the MCAS? If so, it might explain why some pilots are saying things like "why isn't this in the manual?"

 

[cyboman]

I found quote from another pilot that describes the value of the MCAS.
This is from retired 737 pilot "gums", at this link:
https://www.pprune.org/rumours-news/619494-mcas-altitude-v-attitude.html#post10419880

As a pilot myself, I want the plane to fight me at least a bit before going into a stall. This pilot is suggesting that the MAX without the MCAS doesn't do that at all. It just pivots up freely - eventually pitching into the stall all on its own.

What makes this important is that pilots shouldn't just turn this system off - and Boeing can't suggest that as a solution. MCAS isn't just nice for making the 737-MAX feel like a 737-NG, it is a critical safety component.

It is also worth talking about stalls. In a small plane, a full stall followed by a prompt recovery will loose you about 100 feet of altitude. A little delay and that could easily be 300 feet. But jumbo jets move fast and pivots slowly. From what I've read, recovering within 1000 feet is really excellent - and depending on the circumstances, a loss of 10,000 feet is not unreasonable. During the stall, the plane pitches down dramatically (especially as viewed from the cockpit) and the airspeed varies a lot. There is usually at least a little roll moment, and in some cases the plane can roll dramatically. Certainly, in a passenger plane, this is a maneuver to be avoided.

It sounds to me like stalling is such a fundamentally dangerous scenario (especially on jumbo jets as you point out) that preventing it shouldn't be "patched" with a system like MCAS that is rather violently changing pitch forces. As was suggested by a pilot on CBC, it seems they've pushed the airframe of the 737 to it's "max" and crossed a safety threshold.

 

[cyboman]

the 737MAX also provides a noise and the sight of the trim wheel spinning when the trim is changing - both are easy to miss or ignore.

If they are adding an AoA display to the HUD or altimeter on some Maxs I think they should go further also display the current nose trim angle value of the stab. Since it has so much pitch authority. And if they stick with MCAS, I think an annunciation lighting up should indicate when it's operating too.

 

[cyboman]

What I'm hearing from the pilot's perspective makes them sound somewhat isolated from the design choices, and even the design information. That doesn't seem like a good thing, we'd like to imagine the people who have to fly the plane having a lot of input into its design and certainly complete information about its design. But it sounds more like something that engineers foisted onto the pilots, framed as being for their own good, without necessarily really telling them why and how to deal with it. Is it possible that this is due to a sense that certain aspects of the MAX needed to be concealed from the pilots to mitigate objections?

The reason I ask is because If I were an engineer being tugged in several different directions in my design choices, on the one hand wanting to make a plane that pilots like to fly while on the other hand meeting various profit-related specs, I might find myself tempted to conceal from both sides of those conflicting interests some of the tradeoffs going on. Would I hesitate to tell the executives who see the corporate bottom line that the plane could fly cheaper if I just made it harder on the pilots? Would I hesitate to tell the pilots that the plane could be made easier to fly but it would cost more? If I'm tempted to conceal that kind of information, it could lead me to design systems to help compensate for the tradeoffs in ways that I am not fully forthcoming about. Could this dynamic be playing a role in the design of the MAX and the MCAS? If so, it might explain why some pilots are saying things like "why isn't this in the manual?"

Some good considerations as to what lead to MCAS in the first place.

It also sounds like they need more engineers who are actually pilots and even more ideal, who have or do actually fly the planes they are designing.

 

[cyboman]

I made this for fun. It's a stab position display added to the Primary Flight Display. Not sure if that real estate is available but just made for fun as a proof of concept. It's to the left of the AoA display, above the attitude indicator on the left. Fairly self explanatory. It shows a graphic representation of the stab orientation. The number shows the stab trim angle and an arrow shows the position of up or down of the stab from leading edge. Two other annunciations show if MCAS is operating, same with STS. Perhaps the entire graphic could change to a red color if the stab is at a maximum down or up position.

 

[cosmik debris]

Fairly self explanatory. It shows a graphic representation of the stab orientation. The number shows the stab trim angle and an arrow shows the position of up or down of the stab from leading edge. Two other annunciations show if MCAS is operating, same with STS. Perhaps the entire graphic could change to a red color if the stab is at a maximum down or up position.

View attachment 240595

Self explanatory seems to mean something different to you than to me. :-)

Cheers

 

[FactChecker]

It also sounds like they need more engineers who are actually pilots and even more ideal, who have or do actually fly the planes they are designing.

They must have test pilots who flew and evaluated all the new features -- both in piloted simulations with all scenarios and in test flights. I can't believe that they did not complain about a system that would ignore their inputs and fight them for such a long time. Test pilots are much better at evaluating the final product than engineers are. Engineers think that they have everything working well or they would still be designing it.

 

[cyboman]

They must have test pilots who flew and evaluated all the new features -- both in piloted simulations with all scenarios and in test flights. I can't believe that they did not complain about a system that would ignore their inputs and fight them for such a long time. Test pilots are much better at evaluating the final product than engineers are. Engineers think that they have everything working well or they would still be designing it.

Do you think any of the test pilots are actually engineers? I mean I guess that's being pretty idealistic. It just seems maybe that would help bridge a sort of cognitive gap.

 

[PeterDonis]

Do you think any of the test pilots are actually engineers?

Historically, test pilots have often been engineers, particularly in the military and NASA. Neil Armstrong, for example, was an aeronautical engineer; that background was considered a significant asset for him as a test pilot with NASA.

I'm not sure to what degree that is still true, or even to what degree it was true back then for civilian companies. It certainly seems like it would be helpful.

 

[FactChecker]

Do you think any of the test pilots are actually engineers? I mean I guess that's being pretty idealistic. It just seems maybe that would help bridge a sort of cognitive gap.

I am not sure, but I always assumed that they had engineering degrees. I believe that most AF pilots have engineering degrees and test pilots are at the top. Their technical engineering skills might have gotten a little rusty because they worked with teems of full-time engineers who had all types of specialties. But they had a good working knowledge of the subjects. They certainly seemed smart enough and fit in perfectly. Their opinion was the one that managers really trusted and respected.

PS. A test pilot at a company like Boeing would have impressive credentials.

 

[jrmichler]

A lot of this discussion was about stability. The center of gravity has a huge effect on stability. Load the airplane to a forward center of gravity (CG), and it is very stable. As the loaded CG moves aft, the stability decreases. The aft limit is determined by the minimum allowable stability.

The wing provides positive lift upward in horizontal flight. The horizontal stabilizer provides negative lift, its force is vertically downward. The total lift from the wing is the gross weight of the airplane plus the negative lift from the horizontal stabilizer. At forward CG, the cruise speed is lower, and the stalling speed higher. Some small plane owner's handbooks list two different stalling speeds for forward and aft CG. Since cruise speed and gas mileage are extremely important in transport aircraft, the manufacturer has an incentive to move the CG as far aft as possible.

 

[Ken G]

Yes, that was just what I was wondering, if the engineers are caught between different priorities. It's natural to have to make tradeoffs, but I worry about the communication about the tradeoffs, versus a tendency to try to conceal what will not be taken well. It sounds like the pilots on the doomed flights must have felt they were fighting their own airplane, and not because any crucial system had failed, but something as simple as a sensor. I think of bomber pilots fighting their planes back to base with half a wing shot off, not because some sensor is acting up. How could a good design allow that?

 

[FactChecker]

How could a good design allow that?

This was not a good design.
1) There is no way that a good design would have the software fight against pilot inputs for such a long time. The initial reaction of the software to a perceived emergency should have been faded out fairly rapidly to allow the pilot commands to take over.
2) There was not enough redundancy to determine which sensor was at fault.
3) The pilots were not given the critical information that the sensors were disagreeing.
EDIT: I have deleted some speculative and possible inappropriate conclusions.

 

[cyboman]

Self explanatory seems to mean something different to you than to me. :-)

Cheers

It should be self explanatory to those following the thread. Let me know what's not clear and I can try to further explain.

 

[cyboman]

This was not a good design.
1) There is no way that a good design would have the software fight against pilot inputs for such a long time. The initial reaction of the software to a perceived emergency should have been faded out fairly rapidly to allow the pilot commands to take over.
2) There was not enough redundancy to determine which sensor was at fault.
3) The pilots were not given the critical information that the sensors were disagreeing.

Good synopsis. Considering the weight of investigations going into this, and now the FBI involved, I think there's going to be some extensive explaining to do on Boeing and the FAA's part.

EDIT: Removed speculative wording about any culpability to Boeing or FAA.

 

[PeterDonis]

fielding such a design may have been criminally negligent.

I felt very early on that it was indeed negligent

It's been a while since I posted a reminder about this, so I'll post it again. This thread is about the technical aspects of MCAS. Speculations about non-technical questions like negligence, which is a question of law, are off topic in this thread. There is a thread in General Discussion which allows somewhat wider latitude.

 

[cyboman]

Historically, test pilots have often been engineers, particularly in the military and NASA. Neil Armstrong, for example, was an aeronautical engineer; that background was considered a significant asset for him as a test pilot with NASA.

I'm not sure to what degree that is still true, or even to what degree it was true back then for civilian companies. It certainly seems like it would be helpful.

Right, that makes sense. Remember seeing a space station feed where they were taking questions from kids and more than once they get asked how to become an astronaut. Studying engineering in some form is typically part of the answer.