Boeing How Safe is the Boeing 737 Max's MCAS System?

[PeterDonis]

According to this article in the Seattle Times [1], Boeing did a safety analysis on the 737 MAX that included several key flaws:

(1) The analysis assumed that MCAS could only move the horizontal stabilizers a limited amount; in fact it was capable of moving them about four times as much;

(2) The analysis failed to take into account that MCAS could make repeated trim adjustments if the pilots responded with trim adjustments of their own (which means that after repeated trim adjustments MCAS could have moved the stabilizers to the physical limit of their travel);

(3) The analysis assessed a failure of the system as "hazardous", but failed to notice that at that risk rating the system is not allowed to act based on input from a single sensor.

If these items are borne out by further investigation, this is very troubling news. The main open question appears to be whether this safety analysis is the final one that the FAA based their certification on, or whether there were other later ones prior to certification.

[1] https://www.seattletimes.com/business/boeing-aerospace/failed-certification-faa-missed-safety-issues-in-the-737-max-system-implicated-in-the-lion-air-crash/

 

[russ_watters]

Yes, you're right, I was failing to follow my own advice and confusing pitch attitude with angle of attack.

Note also that we've been focusing on a one-axis pitch-up scenario. The issue also applies -perhaps even more - in a turn. Regardless of if the nose is high, low or level, increasing the angle of bank requires increasing the aoa in order to keep the nose from dropping. It's difficult because in a turn there is no way to know what your stall speed is to maintain level flught. You might think you are plenty fast, but then you start to turn and stall.

I recently saw a light plane crash report where the pilot was executing a missed approach and forgot to apply full power. She started a turn, retracted the flaps, and the plane stalled/spun.

 

[russ_watters]

Note also that we've been focusing on a one-axis pitch-up scenario. The issue also applies -perhaps even more - in a turn. Regardless of if the nose is high, low or level, increasing the angle of bank requires increasing the aoa in order to keep the nose from dropping. It's difficult because in a turn there is no way to know what your stall speed is to maintain level flught. You might think you are plenty fast, but then you start to turn and stall.

I recently saw a light plane crash report where the pilot was executing a missed approach and forgot to apply full power. She started a turn, retracted the flaps, and the plane stalled/spun.

BTW, I'm currently learning to fly in a plane without a functioning stall horn. This discussion has me questioning whether that's wise...

 

[CWatters]

Never had one in the gliders I flew. At low speeds if everything went quiet it was time to worry. At high speeds you got buffeting.

 

[cyboman]

I didn't say the MCAS applies force to the yoke. That's the effect, not the direct action. The direct action is adjusting the trim, the same as if the pilot manually rotated the trim wheel. Applying (changing) force to the yoke happens due to the change in aerodynamics. Changing the force is the desired result of adjusting the trim, but changing a control surface position is the direct action.

I've been asserting basically what you've said here from the beginning. I feel like there is a bit more agreement now however. The crux of our disagreement as I see it was me seeing MCAS as effecting attitude and not just effecting yoke force. So when you say "yoke force is the effect", I also see a change in pitch force from the change in trim an effect, that has an effect on pitch, that's where I think we differ in our viewpoint of the system. I was arguing against the idea that it only applies force feedback and it's only the pilot which effects pitch attitude. I've been saying MCAS effects attitude by changing the aerodynamics a lot, that's sort of central. There were times when I was refuted, by saying "thinking of it changing aerodynamics is not the right way".

I admit my wording, "MCAS adds negative pitch attitude" is confusing and imperfect - that's how I was visualizing it. I don't mean it always has the effect of causing a negative pitch attitude, as in below the horizon (I think I stated that somewhere), but instead that it adds negative pitch (it does that by creating a pitch down moment (thx @PeterDonis)). So the moments created by yoke input, the moment of the stab (commanded by MCAS), and all the other moments in the equation in sum create the result force that determines pitch attitude of the plane.

You are really arguing this point harder than you need to. It isn't a critical point (or maybe its a different point...). It's a cart or horse, chicken or egg argument that doesn't matter. The point that matters is that unlike a stall prevention system, MCAS will not prevent you from continuing to raise the nose.

This point was really the necleus of our disagreement the way I see it. It could be seen as unimportant I suppose. I guess the importance of the point is it stems from seeing the system as not ultimately having a direct effect on attitude. It seems to suggest MCAS doesn't have any pitch authority. Actually it has more than the pilot using only the yoke since it's moving the entire horizontal stab. That's likely why in the failures the pilots could not overcome the nose down pitch force from the stab.

So again, the difference between "trying to get the nose down" and "helping you avoid letting the nose rise too high" is not very critical. The critical difference between the MCAS and a normal stall prevention system is the authority. You can still stall a plane with MCAS, it's just harder. But you can't stall a plane with a normal stall prevention system.

Put that way, I think they are almost the same thing. Your wording, or the latter, again seems to suggest MCAS has no pitch authority.

But that's not what happens with MCAS. With MCAS, the pilot is in the act of increasing his nose-up force when the MCAS kicks-in to oppose what he's doing. The nose should not drop in that situation, it should just rise less than if MCAS wasn't there.

This is semantic I think. If the nose is rising less with the system activated, that means it's dropping in relation to where the nose would otherwise be. This is why almost everywhere it's described as "pushing the nose down". You can say "MCAS keeps the nose from rising" that's fine but our difference is you don't see MCAS as effecting pitch attitude. If it keeps the nose from rising, it's effecting pitch attitude. The view MCAS doesn't effect pitch, that it's only the pilot using elevators which does, isn't accurate because there is a pitch force from the trim (in our scenario aka MCAS).

 

[cyboman]

https://www.seattletimes.com/business/boeing-aerospace/failed-certification-faa-missed-safety-issues-in-the-737-max-system-implicated-in-the-lion-air-crash/

And this opening paragraph:

As Boeing hustled in 2015 to catch up to Airbus and certify its new 737 MAX, Federal Aviation Administration (FAA) managers pushed the agency’s safety engineers to delegate safety assessments to Boeing itself, and to speedily approve the resulting analysis.

I mean, seriously? That's the whole point of the independence of the FAA. That's like asking VW to do their own emissions certification...wait...

Adding that it is “unable to comment … because of the ongoing investigation” into the crashes, Boeing did not respond directly to the detailed description of the flaws in MCAS certification, beyond saying that “there are some significant mischaracterizations.”

Euphemism kung fu there.

“There was constant pressure to re-evaluate our initial decisions,” the former engineer said. “And even after we had reassessed it … there was continued discussion by management about delegating even more items down to the Boeing Company.”

Boeing was obviously exerting the pressure. If they need to expedite certification for competitive reasons, why not give the FAA extra budget dollars for that project so they can hire or redirect more safety engineers, accelerating the process as much as possible without compromising safety?

The original Boeing document provided to the FAA included a description specifying a limit to how much the system could move the horizontal tail — a limit of 0.6 degrees, out of a physical maximum of just less than 5 degrees of nose-down movement.

So the actual stab limit of 2.5 degrees would give a physical maximum of 20.8 degrees of nose down movement (assuming they are directly proportional)? That seems like a pretty insane amount of potential pitch attitude change for a system that's supposed to be so invisible it's not worth mentioning. And, it can keep resetting and essentially max out the nose down trim of the stab. Is that origin of the name Max? j/j

I wonder what the maximum nose down trim angle of the stab is. I looked but couldn't find it. Thought it would be here: http://www.b737.org.uk/techspecsdetailed.htm but couldn't find it. One interesting thing you can see is that the stab in the Max is unchanged from the previous NG model. Maybe a redesign of the stab would of been worth the cost, as opposed to the MCAS software which mysteriously changes the control surface behind the scenes.

Like all 737s, the MAX actually has two of the sensors, one on each side of the fuselage near the cockpit. But the MCAS was designed to take a reading from only one of them.

Sheesh, they had the sensor there and didn't even use it? I say use 6, three on each side like on the big boys. Seems like a pretty important sensor.

 

[cyboman]

BTW, I'm currently learning to fly in a plane without a functioning stall horn. This discussion has me questioning whether that's wise...

I vote not-wise. Can't be too careful.

 

[cyboman]

Pilot / science writer they had on PBS had a pretty good summation of the Max situation:

 

[russ_watters]

I've been asserting basically what you've said here from the beginning. I feel like there is a bit more agreement now however. The crux of our disagreement as I see it was me seeing MCAS as effecting attitude and not just effecting yoke force. So when you say "yoke force is the effect", I also see a change in pitch force from the change in trim an effect, that has an effect on pitch, that's where I think we differ in our viewpoint of the system. I was arguing against the idea that it only applies force feedback and it's only the pilot which effects pitch attitude. I've been saying MCAS effects attitude by changing the aerodynamics a lot, that's sort of central. There were times when I was refuted, by saying "thinking of it changing aerodynamics is not the right way".

I admit my wording, "MCAS adds negative pitch attitude" is confusing and imperfect - that's how I was visualizing it. I don't mean it always has the effect of causing a negative pitch attitude, as in below the horizon (I think I stated that somewhere), but instead that it adds negative pitch (it does that by creating a pitch down moment (thx @PeterDonis)). So the moments created by yoke input, the moment of the stab (commanded by MCAS), and all the other moments in the equation in sum create the result force that determines pitch attitude of the plane.

I don't think we're quite there yet. You're still focused on the position and not the force. The pilot doesn't know what position the yoke is in, only what force he's applying, and when a change in trim happens, the yoke moves involuntarily in response because physiologically humans can't hold a position very well, only a force.

It is probably worth considering that for the plane I'm flying and any plane with trim tabs, if moving the tab were directly affecting the plane's attitude without a change in elevator position, the trim tab would move the nose in the wrong direction. The trim tab is there to apply aerodynamic force to the elevator. When the tab tilts up, it pushes the elevator down. If the elevator didn't move down as soon as the tab tilted up, the nose of the plane would rise instead of dropping.

That said, I'm not sure if the action of the trim in the 737 is direct or reversed, but either way it doesn't matter because it instantly changes the force and the elevator and yoke moves in response.

This point was really the necleus of our disagreement the way I see it. It could be seen as unimportant I suppose. I guess the importance of the point is it stems from seeing the system as not ultimately having a direct effect on attitude. It seems to suggest MCAS doesn't have any pitch authority. Actually it has more than the pilot using only the yoke since it's moving the entire horizontal stab. That's likely why in the failures the pilots could not overcome the nose down pitch force from the stab.

Well, here you're mixing the normal and the failure scenarios, but also you are making some assumptions about the mechanics of the motions. The stabilizer and elevator can move together, separately, by the same amounts, by different amounts, however the designer chooses to link them. In a Cessna, when you move the elevator the trim tab moves with it, but not as far. But when you move the trim tab, the elevator doesn't move (mechanically speaking). I don't know how they are linked in the 737, but either way, in normal operation the MCAS won't overpower the pilot because that isn't its job.

Put that way, I think they are almost the same thing. Your wording, or the latter, again seems to suggest MCAS has no pitch authority.

You really think "harder" and "physically impossible" are the same thing? The difference is that with "harder" the plane falls out of the sky and with "physically impossible" it doesn't. That's a big difference!

In any case, could you please explain why you think any of this is important.

 

[cyboman]

In any case, could you please explain why you think any of this is important.

The post you just responded to of mine I think pretty clearly explains that. To summarize it quickly: Your perspective implies MCAS has no pitch authority, which I don't agree with.

 

[cyboman]

You really think "harder" and "physically impossible" are the same thing? The difference is that with "harder" the plane falls out of the sky and with "physically impossible" it doesn't. That's a big difference!

I'm referring to this statement you made: "So again, the difference between "trying to get the nose down" and "helping you avoid letting the nose rise too high" is not very critical."

 

[russ_watters]

The post you just responded to of mine I think pretty clearly explains that. To summarize it quickly: Your perspective implies MCAS has no pitch authority, which I don't agree with.

I get that that's your point, but that doesn't explain why you think it's important. What useful thing does it tell us about the crashes?

Looking back at some of the posts I missed over the weekend, evidently @PeterDonis had a virtually identical discussion with you. At this point, since it seems like just semantics with no value - nothing to tell us about the crashes, I don't see a need to continue it.

 

[cyboman]

I get that that's your point, but that doesn't explain why you think it's important. What useful thing does it tell us about the crashes?

Looking back at some of the posts I missed over the weekend, evidently @PeterDonis had a virtually identical discussion with you. At this point, since it seems like just semantics with no value - nothing to tell us about the crashes, I don't see a need to continue it.

Like I said, "It could be seen as unimportant I suppose. I guess the importance of the point is it stems from seeing the system as not ultimately having a direct effect on attitude. It seems to suggest MCAS doesn't have any pitch authority."
If you're asking why I think it's important to see MCAS that way, I guess the answer would be, because to see it in a different way wouldn't be accurate and would serve to inaccurately represent how MCAS operates.

I agree there's no point discussing it further, I'm comfortable with the points I made before this, I was just originally replying to your post, it wasn't my intent to revive the disagreement. It was already established you and Peter saw it the same way. I just thought it respectful to respond to your post since you took the time to write it.

I have to add when Boeing states: "...a limit of 0.6 degrees, out of a physical maximum of just less than 5 degrees of nose-down movement." It seems odd to still see the MCAS as not moving the nose down or effecting pitch.

 

[PeterDonis]

I'm not sure if the action of the trim in the 737 is direct or reversed

It seems pretty clear to me from what I've seen that the trim function on the 737 changes the angle of the entire horizontal stabilizer, which changes its default angle of attack ("default" meaning "if the elevators are in the neutral position") and therefore the default amount of lift force it exerts at the tail end of the plane. So it would be a different method of working from trim tabs.

 

[cyboman]

It seems pretty clear to me from what I've seen that the trim function on the 737 changes the angle of the entire horizontal stabilizer, which changes its default angle of attack ("default" meaning "if the elevators are in the neutral position") and therefore the default amount of lift force it exerts at the tail end of the plane. So it would be a different method of working from trim tabs.

Would it be erroneous to think of trim tabs as basically small rudders on the elevators? So in the Cessna example, the Cessna elevators would be more akin to the stab on the 737, and the Cessna trim tabs more akin to the 737's elevators?

EDIT: I guess that's imperfect since looking at the Cessna it still has a horizontal stabilizer too, which doesn't rotate.

 

[russ_watters]

It seems pretty clear to me from what I've seen that the trim function on the 737 changes the angle of the entire horizontal stabilizer, which changes its default angle of attack ("default" meaning "if the elevators are in the neutral position") and therefore the default amount of lift force it exerts at the tail end of the plane. So it would be a different method of working from trim tabs.

I do think it's direct acting, but I can envision a way it might not be: if adjusting the trim control moved both the stabilizer and the elevator, in opposite directions. Or if the trim adjustment just moves the stabilizer and the pilot responds by moving the elevator.

The advantage of moving both would be that the control column wouldn't need to move in response to a trim change. The pilot would still move it unconsciously, and then move it back, but back to the same position. Otherwise, every time you changed the trim, the neutral position of the yoke would be in a different place. Maybe that doesn't matter much because the neutral position isn't marked anywhere, but I don't know.

It's also worth noting that trim and feel for the pilots can be whatever the designers want; the control surfaces are actually moved hydraulically and the feel for the pilots doesn't need to match what the hydraulic cylinders are applying.

 

[russ_watters]

Would it be erroneous to think of trim tabs as basically small rudders on the elevators? So in the Cessna example, the Cessna elevators would be more akin to the stab on the 737, and the Cessna trim tabs more akin to the 737's elevators?

EDIT: I guess that's imperfect since looking at the Cessna it still has a horizontal stabilizer too, which doesn't rotate.

It's a similar idea. What creates the force against the control column is the elevator not being aligned with the stabilizer - it's the wind pushing it back down. The all-moving trim aligns the stabilizer and elevator by changing the stabilizer angle whereas the trim tab changes the force directly, by giving the elevator its own lift.

 

[PeterDonis]

It's also worth noting that trim and feel for the pilots can be whatever the designers want; the control surfaces are actually moved hydraulically and the feel for the pilots doesn't need to match what the hydraulic cylinders are applying.

AFAIK the 737 already does considerable artificial feel adjustment.

 

[russ_watters]

I have to add when Boeing states: "...a limit of 0.6 degrees, out of a physical maximum of just less than 5 degrees of nose-down movement." It seems odd to still see the MCAS as not moving the nose down or effecting pitch.

Erm, those are so the pilot doesn't have to think about the aerodynamics and mechanics of the stabilizer when he's manipulating the trim. Obviously, it doesn't lower then nose only by 5 degrees either. Similarly, in my Cessna, it doesn't say down trim to raise the nose - that would be confusing!

 

[russ_watters]

AFAIK the 737 already does considerable artificial feel adjustment.

Yes. From a link I posted earlier:

Incidentally, it looks like we're describing "up" and "down" incorrectly for the stabilizer? It says "Stab LE Down = airplane nose up" Not sure what "LE" stands for...

This is one of several such graphs. One was a simple speed vs angle. Honestly, these are pretty complicated and I haven't put forth the effort to think them through.

Either way, not that important: trim adjustment is made clear to the pilot in terms of what you want the nose to do, not the direction the control surface moves (per @cyboman's last post).

[edit] I believe the above is just telling us where the neutral position is, not what the automated trim adjustment is. Here's an example of automated trim adjustment:

 

[PeterDonis]

Not sure what "LE" stands for...

I would assume "leading edge".

 

[cyboman]

Incidentally, it looks like we're describing "up" and "down" incorrectly for the stabilizer? It says "Stab LE Down = airplane nose up" Not sure what "LE" stands for...

I think what it might be is when it says "Stab LE Down = airplane nose up". It's saying when the stab is rotated downward or forward, which is "down" from the horizontal, it results in the nose up moment and vise versa. We've been referring to the stab adding nose down trim. I don't think we were saying the stabilizer moves down for nose down trim.

EDIT: *..which is "down" from the horizontal looking at the LE / leading edge (thx @PeterDonis)

Like it says here: "MCAS moves the horizontal stab trim upward..."

This is one of several such graphs. One was a simple speed vs angle. Honestly, these are pretty complicated and I haven't put forth the effort to think them through.

I was going to ask you to explain the graph actually, because I find it hard to understand.

 

[cyboman]

OK, this might be a little silly and over simplifying but I'm going to throw it out there.

If they just increased size of the stab and thereby it's trim changes would be magnified, could they perhaps just of changed the existing automated trim systems like auto speed trim and other flight software appropriately, they could of then avoided the MCAS "patch"? And eliminate the complication of over-engineering by adding a system like MCAS which introduces a host of new variables and failure modes?

EDIT: I guess it's not that silly because I've read elsewhere which I posted, that people have suggested they should of just redesigned the stab. I suppose I think I'm oversimplifying by "making it bigger" but maybe that's generally speaking, accurate?

 

[cyboman]

Me Tarzangineer, me think bigger engine, and bigger up pushing, me think need bigger back wing.

 

[cyboman]

Actually on this line of thought, even if they didn't change the stab. Why couldn't they just adjust the existing auto trim and force feedback systems to accomplish basically what MCAS does? Why is an additional system or "subroutine" or whatever needed? Sometimes it's qualified as an additional stall prevention system to deal with the engines. But why not just reconfigure the existing stall prevention systems?

 

[cyboman]

I think this largely, as is suggested in the articles, boils down to a cost assessment. Down to money. So redesigning the stab is expensive and then the clients need to worry about new parts for that and lengthy re-certification for changes to the airframe. Redesigning the existing flight systems like autotrim and elevator feel control, also requires re-certification and is also expensive. Adding a new control or augmentation system maybe falls into a different path of certification and has the lowest cost. BUT, is the FAA not considering how new systems like MCAS effects other systems and therefore their previous certifications for them is invalid? It almost seems like they may be viewing all these systems as disparate, but they actually all interact with each other, and changes to one effects all other systems and their expected performance.

 

[.Scott]

I'm not sure what Boeing's equivalent of Direct Law ...

The Airbus has several "Laws" that can be selected for control of the plane. Most fundamentally are Direct Law and Mechanical Law. They are very specific to Airbus - which normally takes pilot control input as an indication of the pilot's intention - and then moves the control surfaces with those intentions in "mind".
For other aircraft, "Direct Law" is approximately equivalent to normal manual flying.

 

[.Scott]

Not pitching down just means the airplane crashes tail first.

No. If you want to crash tail first, you need to put the center of gravity (CoG) well aft of the center of lift or execute some really wild maneuvers.
All normal aircraft are designed so that when the wings stall, the nose drops. Holding the yoke back will allow a stall to persist.
The aerobatic maneuver for inducing the plane to fly backwards is called a tail slide. I have piloted two different aerobatic aircraft (Citabria and Decathalon), but neither of them was certified for tail slides.

 

[.Scott]

I don't understand is how stall detection can be based only on angle of attack. A low speed and low angle of attack can still result in a stall. A high speed steep climb can be perfectly ok.

AM

There is only one cause for a stall - high AoA. Each aircraft has a "maneuvering speed", which is the fastest that the plane can go without being subject to damage by aggressive pilot inputs (primarily pitch up/down). Manuevering speed is not "slow" - though it is less than a normal operating speed. If you pull the nose of the plane up in straight and level flight at maneuvering speed, you will enter a stall. If you hold that stall for a moment and then slam on rudder (left or right), you will fully stall one wing (the one turned back) while generating maximum lift from the other. That's called a snap roll.

At very low speed (below the minimum controllable airspeed) with low angle of attack means that you are not generating enough lift to offset your weight - so you will be accelerating downwards. Perhaps you are following a parabolic trajectory.

 

[.Scott]

It is probably worth considering that for the plane I'm flying and any plane with trim tabs, if moving the tab were directly affecting the plane's attitude without a change in elevator position, the trim tab would move the nose in the wrong direction. The trim tab is there to apply aerodynamic force to the elevator. When the tab tilts up, it pushes the elevator down. If the elevator didn't move down as soon as the tab tilted up, the nose of the plane would rise instead of dropping.

That said, I'm not sure if the action of the trim in the 737 is direct or reversed, but either way it doesn't matter because it instantly changes the force and the elevator and yoke moves in response.

The action of the 737 trim is dramatically direct.

There may be some confusion here because the "trim" on a jumbo jet operates differently than the trim on most small planes. In the case of most small planes, the pitch force adjustment is not controlled by a surface as large as the horizontal stabilizer. In fact, for most sail planes - trim is controlled by the positioning a tie point of a long spring.