Boeing How Safe is the Boeing 737 Max's MCAS System?

[cyboman]

I don't think so. The stab cutout should be like an EMO switch in most life-safety systems. When you hit that button it needs to be off, period, as you don't know where the problem is, you just need it to stop moving. The flawed design is MCAS overpowering possible manual control.

The issue I see is that there is no true manual electric control of the trim without having automated trim systems active (EDIT: this is only the case in the Max and not the NG). It's akin in a way to disabling autopilot and all the sudden all hydraulic control is lost (not a perfect comparison). Given the size of the stab and thus the control forces required to move it under a variety of flight scenarios, I think there should be a pathway for the pilot to control it electrically without any automated trim systems. So in an automated sys failure, there is still electric control. Take a look at the jackscrew on the 737, it's huge:

:

Listen to that motor. Not something you'd want to be adjusting mechanically under heavy load conditions.

If there was a switch that just disabled automated trim systems. Then in the Ethiopia air case, the pilots potentially wouldn't of been stuck dealing with an immovable trim wheel.

EDIT: And if you look at the preliminary Ethiopian flight report, before the final dive it appears they disengaged the cutouts to try to command electric trim as a last ditch effort (since they could not trim via the trim wheel). It worked, but then MCAS was able to activate again, commanding more nose down trim, effectively making the dive irrecoverable.

Boeing solution is to use the electric trim and then quickly use the stab cut out before any automated systems can command trim. That sounds a lot like a hack to me.

 

[nsaspook]

The issue I see is that there is no true manual electric control of the trim without having automated trim systems active. It's akin in a way to disabling autopilot and all the sudden all hydraulic control is lost (not a perfect comparison). Given the size of the stab and thus the control forces required to move it under a variety of flight scenarios, I think there should be a pathway for the pilot to control it electrically without any automated trim systems. So in an automated sys failure, there is still electric control. Take a look at the jackscrew on the 737, it's huge:

:

Not something you'd want to be adjusting mechanically under heavy load conditions.

If there was a switch that just disabled automated trim systems. Then in the Ethiopia air case, the pilots potentially wouldn't of been stuck dealing with an immovable trim wheel.

Boeing solution is to use the electric trim and then quickly use the stab cut out before any automated systems can command trim. That sounds a lot like a hack to me.

The problem is you just don't know what's causing the problem. The electrical assist drive sub-system could be the problem (stuck activator, relay, shorted wire, etc ...) while the automation front-end(s) is/are totally operational. I've seem many videos of manual trim being used for decades on the 737 when it's far out of trim but not at the MCAS driven extremes that seems to have caused the loss of so many lives.

 

[cyboman]

The problem is you just don't know what's causing the problem. The electrical assist drive sub-system could be the problem (stuck activator, relay, shorted wire, etc ...) while the automation front-end(s) is/are totally operational.

Right, so you still need a way to disable electric trim. But I still contend there should be a way to disable automated pitch trim systems without giving up the electrical assist. That would of been really invaluable in these latest tragedies I think. (EDIT: This is exactly how it operated on the NG model, which has speed trim / AP trim systems but not MCAS.) It's really just one more switch. In fact, with the Boeing flight control philosophy being what it is. I'm surprised they take this approach with their automated systems.

This functionality, looked at another way, is also solved by an override that allows direct law control.

I've seem many videos of manual trim being used for decades on the 737 when it's far out of trim but not at the MCAS driven extremes that seems to have caused the loss of so many lives.

Well in the extremes it's going to take a ton of rotations to correct the trim and that's if the load forces are manageable. Which requires time and at least one hand off the yoke if there is no co-pilot to help.

 

[Tom.G]

A three position switch Off-Manual-MCAS.

 

[cyboman]

A three position switch Off-Manual-MCAS.

Sounds simple enough. They may have to label it different than MCAS. Since there is speed trim and mach trim that also command pitch trim. Perhaps "OFF-MAN-AUTO".

Looking at the existing switches:

It looks like the first one cuts out the main electrical assist control and the second cuts out auto pilot commanded trim. To disable MCAS Boeing's instructions are to cutout both. It looks like they tied MCAS into those in such a way that both need to be cut out. My guess is it's tied into MAIN ELECT and it's procedure to cutout AP too just in case.

So either a third switch could be labeled AUTO SYS for the auto trim systems. Or a three position switch on the MAIN ELEC as you've suggested. However the three position switch may not follow best practices with these guarded switches.

EDIT: Or, perhaps they could tie all the auto trim systems into the AP cutout and change the label to just AUTO. Cutting it out would take out all auto to the trim. No new switch required. Could even just black out PILOT. However, maybe there are scenarios where you'd want to cutout the AP and not the speed, mach or MCAS trim systems. (EDIT: After reading Peter Lemme's material, in the NG the AP switch here cuts out the speed trim sys and AP is disabled. Tying MCAS into this AP cutout switch may of been the best direction from a pilot pov for consistency with the NG.)

EDIT 2: The original photo here is from the NG. They are labelled differently in the MAX as PRI and B/U (attached below) and as suggested with the NG you could still command electric trim and disable auto systems. Not so in the Max.

 

[cyboman]

I think a big part of the issue is concern for pilot information overload and of course additional training. Boeing may view these auto pitch trim systems as bulletproof enough to be seen as augmentation to the feel systems like the elevator feel sys. Given how we've seen they can fail and their pitch authority, that's perhaps not a good standpoint.

I know if I was a pilot of one of these crafts I'd say, "What do the systems do? How much pitch authority do they have? OK. Ya, give me the extra switches please. I'd like to be able to cutout those systems."

One of the changes to MCAS rolling out is to decrease it's pitch authority. I think I'd still want the cutout however.

 

[cyboman]

Found this from Peter Lemme at satcom:

The autopilot trim command on 737NG is either the trim while the autopilot is engaged, or the trim command from the Speed Trim System (STS). MCAS issues commands on the same autopilot interface and would be inhibited by this cutout switch if it were on 737MAX.

For reasons I have yet to understand, Boeing changed the cutout switches on 737MAX to PRI and B/U. In this configuration, both cutout switches are thrown in any runaway situation,

With the 737NG cutout switches, MCAS runaway is stopped by just throwing the autopilot cutout switch, leaving electric trim fully operable.

With the 737MAX cutout switches, MCAS runaway is stopped by throwing both switches, losing electric trim altogether. In this case, the flight crew must rely on manual trim via turning the trim wheel/crank. As discussed above, the manual crank can bind up, making flying much more difficult.

https://www.satcom.guru/2019/04/stabilizer-trim-loads-and-range.html

Some really great information on his site regarding MCAS. Some of his opinions seem to echo much of what's been said here. His credentials are very impressive in avionics engineering so that's a very good thing.

 

[cyboman]

I have a forum related question. Does it make sense to edit previous posts noting an edit has been made. So that that post is stand alone more accurate? Or does it make more sense to just make another post clarifying? It seems the former is fairly tedious and maybe not sustainable in very active discussions.

 

[nitsuj]

I don't think that's "all". If you read through this entire thread and the preliminary reports of the two crashes (which I'd recommend, but it's tough read - as in disturbing), I find it hard to believe you'd feel that way.

Also, it's pretty clear that's not all the max needed by the software updates rolling out. Many of which were suggested early on in this thread. MCAS was a very bad design with an even worse implementation and that's just the tip of this complicated iceberg.

A new type certificate would make mcas moot; not required. Am surprised after being told that mcas was installed to avoid the need for a new type certificate that you would not see my point. What's more my comment is qualified with a "maybe". I find it hard to believe you would attempt to dispute a "maybe".

 

[cyboman]

A new type certificate would make mcas moot; not required. Am surprised after being told that mcas was installed to avoid the need for a new type certificate that you would not see my point. What's more my comment is qualified with a "maybe". I find it hard to believe you would attempt to dispute a "maybe".

MCAS is intrinsically faulty as a flight control augmentation system. I think I get that you're saying that it's not required if it fell into a new type. But that's not what happened.

It's in how you frame your argument. When you say maybe, it's not so benign. In this context its refuting my more complex perspective and position. And in effect simplifying the scenario such that if one, more training was provided and two, a new type certification was attained, all would be good. Well, both of those things needed to happen potentially but that doesn't remedy the totality of the problems and challenges that automated systems like MCAS create. And it wouldn't be moot or unnecessary I would argue. I think with those huge LEAP engines, you needed MCAS. Training could potentially supplant it but you'd still be left with an unstable aircraft and instead of MCAS you'd be putting that instability on the pilot to correct for.

 

[nitsuj]

From Boeing: "Flight Control Computers and Stability Augmentation
The trend in the design of modern airplanes is to have less static longitudinal stability--frequently referred to as relaxed static stability (RSS)--to capture the benefit of improved fuel efficiency. Simply stated, some airplanes are now designed to be aerodynamically efficient, and stability is augmented electronically so that stick force gradients will meet certification requirements. Many methods exist for augmenting stability. For example, the Boeing 777 and MD-11 use flight control computers that adjust the elevator actuator positions to give the appearance of more longitudinal stability than the airplane actually has. In other words, computers absorb the extra workload caused by flying with RSS. -https://www.boeing.com/commercial/aeromagazine/aero_02/textonly/fo01txt.htmlOne of the main functions of MCAS was to make the plane "simpler to fly". To make it simpler to certify and get up in the air. It's pretty evident increased RSS and automation add incredible complexity and new failure modes in their effort to keep things simple for the pilot.

From your boeing quote above.
Simply stated, some airplanes are now designed to be aerodynamically efficient, and stability is augmented electronically so that stick force gradients will meet certification requirements.

In this specific case I don't think that the 737 max was out of line from those requirements. But I know it was out of line from the previous model. Again, mcas was used to make it fly similar to the previous model pilots are already certified to fly.

I would be VERY surprised to hear/read that without mcas, on take off the "yoke resistance" is way off from "normal" / expectation. Though if the pilot flew it the same as the previous model the pitch up would be "too high". Not even remotely necessarily that pilots WOULD pitch up too much. But that is clearly different flight characteristics; which would require a new type certificate.

completely agree with your last statement. We do see the issue the same from that perspective.

 

[cyboman]

From your boeing quote above.
Simply stated, some airplanes are now designed to be aerodynamically efficient, and stability is augmented electronically so that stick force gradients will meet certification requirements.

In this specific case I don't think that the 737 max was out of line from those requirements. But I know it was out of line from the previous model. Again, mcas was used to make it fly similar to the previous model pilots are already certified to fly.

I would be VERY surprised to hear/read that without mcas, on take off the "yoke resistance" is way off from "normal" / expectation. Though if the pilot flew it the same as the previous model the pitch up would be "too high". Not even remotely necessarily that pilots WOULD pitch up too much. But that is clearly different flight characteristics; which would require a new type certificate.

completely agree with your last statement. We do see the issue the same from that perspective.

Well it wasn't out of line with those requirements because part of their genesis was to satisfy them.

Again, only one of the functions of MCAS was certification. It's remedies are more reaching than that which overlap certification.

I would add that you seem to be envisioning MCAS as operating only in a take off scenario. In effect, these systems are very primitive and stupid (so as to decrease failure modes) and as I understand, they don't know if you're in take off or cruising at 30 000 or in a dive or climb (they don't do that level of inductive reasoning), they are limited by their very strict parameters, which seems primarily to be determined by the AoA. This is part of the design problem. Add their pitch authority and this is where we're at.

 

[nitsuj]

MCAS is intrinsically faulty as a flight control augmentation system. I think I get that you're saying that it's not required if it fell into a new type. But that's not what happened.

It's in how you frame your argument. When you say maybe, it's not so benign. In this context its refuting my more complex perspective and position. And in effect simplifying the scenario such that if one, more training was provided and two, a new type certification was attained, all would be good. Well, both of those things needed to happen potentially but that doesn't remedy the totality of the problems and challenges that automated systems like MCAS create. And it wouldn't be moot or unnecessary I would argue. I think with those huge LEAP engines, you needed MCAS. Training could potentially supplant it but you'd still be left with an unstable aircraft and instead of MCAS you'd be putting that instability on the pilot to correct for.

Ah I see, well I can't argue your feelings.

Note mcas is "active" only with AP off* flaps up and AoA too high. (*because AP, just like the pilots, can fly the plane just fine; it's' not an "unstable" plane)

A link from "the Air Current" article on mcas written by their editor in chief Jon Ostrower who "covered" (aviation journalist) the development of the 737. Where he describes the effect of the redesigns on the flight characteristics as "Ever so slightly changed how the jet handled in certain situations". That's inline with my understanding from Juan's videos I've linked to previously.

 

[cyboman]

Ah I see, well I can't argue your feelings.

Note mcas is "active" only with AP off* flaps up and AoA too high. (*because AP, just like the pilots, can fly the plane just fine; it's' not an "unstable" plane)

A link from "the Air Current" article on mcas written by their editor in chief Jon Ostrower who "covered" (aviation journalist) the development of the 737. Where he describes the effect of the redesigns on the flight characteristics as "Ever so slightly changed how the jet handled in certain situations"

The qualification "ever so slightly" doesn't really bode well in light of the recent tragedies with pilots with more than adequate flight hours and experience, in that type. It's all about probabilities and scenarios. If said pilot goes up and says, "The aircraft didn't feel very different." That doesn't really say much. Perhaps it's worth something if they fly like 10 - 50 different flight scenarios.

 

[cyboman]

Note mcas is "active" only with AP off* flaps up and AoA too high. (*because AP, just like the pilots, can fly the plane just fine; it's' not an "unstable" plane)

Well, perhaps it was proven as stable before the newest mark which is MAX with the new engines.

 

[nitsuj]

I would add that you seem to be envisioning MCAS as operating only in a take off scenario. In effect, these systems are very primitive and stupid (so as to decrease failure modes) and as I understand, they don't know if you're in take off or cruising at 30 000 or in a dive or climb (they don't do that level of inductive reasoning), they are limited by their very strict parameters, which seems primarily to be determined by the AoA. This is part of the design problem. Add their pitch authority and this is where we're at.

Am giving up with a final retort lol. mcas does not at all operate on take off. flaps up is a requirement for it to activate. That is shortly after take off, while engines are still at take off thrust. And where the "creeping up" of the nose would occur.

again three requirements (as at the time of the accidents) flaps up, AP off and high AoA for mcas to activate.

 

[cyboman]

Am giving up with a final retort lol. mcas does not at all operate on take off. flaps up is a requirement for it to activate. That is shortly after take off, while engines are still at take off thrust. And where the "creeping up" of the nose would occur.

again three requirements (as at the time of the accidents) flaps up, AP off and high AoA for mcas to activate.

You lean on these basic parameters for activation as if they forgive the erroneous activation we've seen in these tragedies.

 

[FactChecker]

It is inconceivable to me that the plane is outside of the required stability margins when the system is operating correctly. I think that the issues are the reliance on a single AOA input, the removal of displays which would tell the pilot what is going on, and the way the system seemed to ignore pilot pitch-up inputs for such a long time. So the system would believe one unverified input while ignoring (or unaware of) indicators that the input may be wrong.

 

[cyboman]

flaps up, AP off and high AoA for mcas to activate.

In other words, typically normal flight regime outside of the AoA sensor input.

 

[cyboman]

It is inconceivable to me that the plane is outside of the required stability margins when the system is operating correctly.

There is a lot of assumptions here. But again it's how those lines or margins are drawn.

I think that the issues are the reliance on a single AOA input, the removal of displays which would tell the pilot what is going on, and the way the system seemed to ignore pilot pitch-up inputs for such a long time. So the system would believe one unverified input while ignoring (or unaware of) indicators that the input may be wrong.

Or in laymen's terms, the system was "dumb". An oversimplification, because simplification of a system was beneficial in this scenario (simpler was better). It proved to be a erroneous pressure on the decision making. Such that a system with tremendous pitch authority was mis-configured to disastrous effects.

 

[russ_watters]

In other words, typically normal flight regime outside of the AoA sensor input.

I think you're mixing together the "normal" operation and the failure scenario. Having a high aoa during cruise - most of the "normal flight" regime - would require a ripping-the-wings-off steep turn. So there is no scenario in cruise when it should activate. The actual part of the flight envelope or normal flight regime where MCAS should activate is pretty small. You could add additional sensors such as an airspeed limit (MCAS disabled above 300kts for example), but that also adds another potential failure point.

We tend to get tunnel vision focusing on the specific system or crash scenario. It's not a simple system and while it does appear a failure mode was missed or underestimated, Boeing engineers are not idiots and have surely thought through the broader implications.

 

[russ_watters]

To further clarify: I think that with trim, manual control may in fact not be hydraulically assisted. So, if I'm not mistaken when they use the stab cutout switches that may result in no hydraulic or "electric" assistance to control the trim and the trim wheels in effect work mechanically. I'm not sure of this however. It may be the case that the stab cutout only bypasses automated systems and the trim switches on the yoke still operate using electric control of the trim. Given the recent tragic scenarios, I think that's preferable.

For other systems, like elevator, aileron and rudder, manual control would still mean hydraulically assisted since as previously explained direct mechanical control is not a practical flight scenario and more of a redundant backup architecture. Manual control in this sense, is disabling autopilot.

Trim is the *only* aerodynamic control in which manual control is even possible, so rather than have multiple levels of automation, they may drop straight to full manual. The electronic trim is not the same as hydraulic assist in that it is still fully decoupled mechanically from the control surface. Hydraulic assist is pretty "dumb".

Related to what I said in my previous post, these failure scenarios get complicated. There was an Airbus crash once where the aoa sensors froze up during an automation/acceptance test, the plane's computer realized it and handed full "manual" control to the pilots, with the pitch trim strongly "up". The pilots either didn't notice or didn't know how to handle the issue and simply pushed their control sticks all the way forward to avoid the stall. It didn't work and the plane stalled and crashed.

In this case they evidently didn't know the trim was "fighting" them - because they couldn't feel it - and never tried to manually spin the trim wheels, which likely would have prevented the crash.
https://en.m.wikipedia.org/wiki/XL_Airways_Germany_Flight_888T
This also relates to past discussions of the pros and cons of a system (trim itself) that can overpower the pilots. Is it worse to be overpowered and know it or overpowered and not know it?

 

[cyboman]

I think you're mixing together the "normal" operation and the failure scenario. Having a high aoa during cruise - most of the "normal flight" regime - would require a ripping-the-wings-off steep turn. So there is no scenario in cruise when it should activate. The actual part of the flight envelope or normal flight regime where MCAS should activate is pretty small. You could add additional sensors such as an airspeed limit (MCAS disabled above 300kts for example), but that also adds another potential failure point.

We tend to get tunnel vision focusing on the specific system or crash scenario. It's not a simple system and while it does appear a failure mode was missed or underestimated, Boeing engineers are not idiots and have surely thought through the broader implications.

What I meant is that all of the conditions outside high AoA are totally normal. So that a single AoA sensor reading that's bad results in erroneous activation.

Regarding if the Boeing engineers are idiots. Obviously they are not. However, they aren't all going to be of the same caliber and experience. It's hard to know where to put the blame with a big corporation like that, I'm sure more than one head in more than one department will roll. However, I think it's accurate to say that MCAS was a very stupid design and implemented very poorly.

 

[cyboman]

Trim is the *only* aerodynamic control in which manual control is even possible, so rather than have multiple levels of automation, they may drop straight to full manual.

I was sure I read somewhere that there is redundancy in the case both A and B hyd fail.

It's termed manual reversion in the 737:

"In the event of a dual hydraulic failure, a manual reversion mode will allow the elevators and ailerons to driven through a mechanical means"

"In the event of of a total hydraulic failure, manual forces from the control wheel would be transmitted through stops in the power input control linkage, thus providing a direct mechanical link to the control wheel. Input forces are minimized by aileron balance tabs and hinged balance panels. "

-https://www.airliners.net/forum/viewtopic.php?t=731915

"Ailerons are powered by hydraulic systems A and/or B. If both hyd should fail, manual reversion is available from both control wheels. "

None for the rudder but there is a 3rd way to power it if A and B fail:

"The rudder is moved by a PCU powered by hyd sys A and/or B. If A and/or B fails a standby PCU can be powered from the standby hydraulic system. "

"The control column moves the elevators using hyd A and/or B. If both hyd should fail, manual reversion is available from both control columns. "

Also there are balance tabs on the elevators and ailerons.

-http://www.b737.org.uk/flightcontrols.htm

...so rather than have multiple levels of automation, they may drop straight to full manual.

Remember that the NG operated exactly as I suggested. The AP cutout disabled all automatic trim commands while you could leave MAIN ELEC in normal to command electric trim. This was procedure in the NG for stab trim runaway. They changed it in the Max for some reason.

 

[cyboman]

This also relates to past discussions of the pros and cons of a system (trim itself) that can overpower the pilots. Is it worse to be overpowered and know it or overpowered and not know it?

It's a good point. I would say that it's worse to be overpowered to begin with. It's one thing if the pilot has commanded the stab to an out of trim scenario, but when auto systems are doing it, then a lot of confusion can ensue as we've seen.

The issue of not knowing is again I believe a feedback problem (and training and probably a bunch of other things as is always the case). But I really think that a feedback system, like I posted earlier should be included in the PFD that shows the trim angle and perhaps if it's in man electric, full manual, or auto.

 

[russ_watters]

It's a good point. I would say that it's worse to be overpowered to begin with.

Well again, that's not one of the options. The trim needs to be stronger than the pilot otherwise the plane -basically any plane - wouldn't be flyable. Not even a little Cessna. Remember, trim has to be adjusted every time you change your speed or attitude and as you burn fuel. You can be overpowered by *not* adjusting trim, not just by over-adjusting it.

And to clarify, in case it isn't clear, I'm not just talking about needing 100+lb of force as in these scenarios. Even the ~20lb changes that are pretty normal in the Cessna I fly would be unsustainable for more than a few minutes. Humans just aren't built to be able to hold constant force with muscles.

It's one thing if the pilot has commanded the stab to an out of trim scenario, but when auto systems are doing it, then a lot of confusion can ensue as we've seen.

Right; that's different from the trim being stronger than the pilot, that's auto-trim doing something unexpected. But in a plane without auto-trim, even a small plane such as a Cessna, if you don't adjust the trim yourself, you'll be fighting it for most of the flight, with poor odds of completing the flight successfully.

So my point is, in a situation where the plane hands full manual control to the pilot, is it easier to handle the plane when you have feedback or don't? Well again, it depends. If you are handed control when in control and in trim and with all your instruments working, it may not matter. When you make a change in attitude/speed, you should notice the yoke pressure on a manual plane and notice the joystick isn't centered on a fly-by-wire plane. But unfortunately, computerized planes rarely hand the pilot manual control when the plane is fully functional -- they only do it when something fails. And when that happens, a pilot with a lot on his plate might not realize what is going on. The XL888 pilots in the above link didn't realize it - perhaps because they couldn't feel it - and crashed. The Ethiopian Air pilots did realize it - because they felt it - and crashed anyway.

The issue of not knowing is again I believe a feedback problem (and training and probably a bunch of other things as is always the case). But I really think that a feedback system, like I posted earlier should be included in the PFD that shows the trim angle and perhaps if it's in man electric, full manual, or auto.

In the case I just linked, XL888, the pilots were given a notification that auto-trim was no longer active and either missed it or misunderstood it. For Ethiopian, I'm not sure if we know yet whether they followed the procedure correctly.

 

[nitsuj]

In other words, typically normal flight regime outside of the AoA sensor input.

No.

That is typical flight just after take off. Am not sure about landing, I imagine sometimes they do "auto pilot" landings, at least to some degree.

Typical flight is with AP on.

 

[cyboman]

No.

That is typical flight just after take off. Am not sure about landing, I imagine sometimes they do "auto pilot" landings, at least to some degree.

Typical flight is with AP on.

My view is the logic for activation outside of the AoA vane input is completely normal. It does not represent a scenario outside or on the edge of the flight envelope. As you've pointed out it occurs regularly after take off.

 

[nitsuj]

You lean on these basic parameters for activation as if they forgive the erroneous activation we've seen in these tragedies.

Really? am not interested in going along that tangent with you.

 

[nitsuj]

My view is the logic for activation outside of the AoA vane input is completely normal.

that's fine, my reply you quoted was to you saying...

In other words, typically normal flight regime outside of the AoA sensor input.

My reply was that (AP off) is not "typically normal flight regime..."