9 ms·

I've read a variety of articles on this and they often said somewhat different things. What I've been able to gather about the timeline of events is: 1. The ne

I've read a variety of articles on this and they often said somewhat different things. What I've been able to gather about the timeline of events is: 1. The new engines on the MAX shifted the center of gravity forward (and I assume center of lift stayed the same). 2. Boeing was worried that #1 would cause the plane to nose up during high angles of attack (so, take off and landing?), and added software, MCAS, to pitch up to counteract this. 3. There's some confusion over when this software kicks in and how to cancel it (something about the trim controls not cancelling MCAS?) 4. Regardless of #3, this software seems to have confused pilots and the current belief is that MCAS was active when pilots didn't want it active. 5. ???? 6. Planes crash. Also, I've read about some concerns about the fact that the handling behavior changed so much but the plane wasn't reclassified as a different type. I'm still unclear about how classifications plays into this story. My core point of confusion is, if MCAS is the culprit why isn't the solution to remove MCAS? Is tendency to pitch during high angles of attack unusual, and something pilots cannot be expected to counteract manually? I've only played sims like DCS and X-Plane (and not very much at that) but "nose goes up when I don't want it to, so I push stick forward" doesn't seem too complicated to me. Of course, I'm no pilot so I'm probably drastically oversimplifying the situation.

berkut 8y ago
From what I've read, MCAS is disabled with the flaps down, so it wouldn't be for take-off and landing.
ritwikgupta 8y ago
Wasn't the idea that they wanted to avoid pilot re-training? So if pilots would be expected to counteract manually, they would have to train to understand when to do that.
- kalleboo 8y ago
  Pilots are already trained to handle runaway trim, the idea was that an MCAS failure would behave similarly and the same checklist they already trained on could be used. Due to issues in how MCAS was implemented however, the behavior was different from runaway trim and more confusing.
  - Gibbon1 8y ago
    One comment I saw was that with Boeing aircraft when the autopilot is off you're fully manual. Unlike Airbus. MCAS has control authority when the autopilot is _off_.
    - dingaling 8y ago
      > with Boeing aircraft when the autopilot is off you're fully manual The 777 and 787 are full-time FBW, there is no manual reversion. There is no way to move the control surfaces directly. The only difference with the AP engaged is the origin of the control demands.
      - Gibbon1 8y ago
        You can have cables, push rods, hydraulics, power assisted hydraulics, full hydraulic, and electrical actuators. As long as their control inputs are only from the pilot they are identical in every way but their failure modes. There is big big difference between FBW and the aircraft generating control inputs on it's own. Boeing aircraft had two modes, 'manual' and 'auto pilot' The 737 MAX adds a third case, 'sometimes' Boeing never told the pilots about the 'sometimes' part. And never told them that 'sometimes' has ultimately more control authority than they do.
        dingaling 8y ago
        I think you misunderstood my post. There is literally NO manual command over control surfaces in any current Boeing airliner other than the 737 variants. Neither the 777 nor 787 have any pushrods or cables. The Max does indeed have a hybrid approach ( manual actuation, FBW spoilers, mystery MCAS ) but that's not Boeing's current philosophy.
        Gibbon1 8y ago
        You're willfully failing to get my point.
azernik 8y ago
On further investigation, it seems #3 is more: MCAS had much more control authority (i.e. was allowed to change control inputs from the pilots by more) than the FAA had approved. #5 is: a fault in a single, non-redundant sensor could cause the MCAS system to falsely believe the plane was stalling, and push the nose down as hard as it could. Which (see above) was harder than a pilot could override by just pulling in the other direction, as is apparently intuitive for them.
- gtr32x 8y ago
  I've always been confused here on this, does that mean the 737 MAX has a high chance to have faulty reading from their AoA sensors? Or is that pretty much the industry standard right now? This has always seem like the actual culprit.
  - azernik 8y ago
    Sensors break. They get gunk on them. They ice over. Generally a sensor with such a critical failure mode would be triple-redundant - if one fails, the discrepancy between sensors is flagged and the aircraft runs on the other two until the broken one is fixed. In this case, the aircraft had two sensors of the type (Angle-of-Attack), but MCAS was only listening to one of them.
    - gtr32x 8y ago
      Thanks for the elaboration. Could you help me further understand one more thing? When you say MCAS only listens to one, does that mean during the time when one AoA sensor fails? Or it always listens to one during normal operation? Also, it does seem like Boeing dropped the ball here to not build further redundancy here.
      - inferiorhuman 8y ago
        MCAS alternates between the left and right sensor each time the plane lands. With the Lion Air flight I think cycling the electrical power for diagnostic work caused MCAS to pick up the faulty sensor for two flights in a row.
gulikoza 8y ago
Because: 1. earlier 737 models didn't pitch up and Boeing wanted the plane to "feel" the same and not have to re-train the pilots 2. there is some certification requirement that the pitch has to be constant during climb (or something like this); if the plane doesn't have this, it is not certified to fly. It wouldn't pass FAA certification without MCAS.
- manfredo 8y ago
  > there is some certification requirement that the pitch has to be constant during climb (or something like this); if the plane doesn't have this, it is not certified to fly. It wouldn't pass FAA certification without MCAS. So what I gather is the issue was that the MAX didn't fit this requirement for steady pitch (hence the airframe problem referenced in the linked article), and MCAS was supposed to be the band-aid to fix this essentially by automatically pushing forward on the yoke during high angle of attack. If that's the case then the following is especially concerning: > Boeing offered the single angle-of-attack sensor as standard equipment, and charged extra for a second along with a “disagree” indicator that would allow 737 MAX pilots to “cross-check” a faulty sensor. Seems pretty sketchy to ask airlines to cough up extra dough for redundancy on a safety critical system. Who knows what other systems are subject to the same cost/benefit tradeoffs.
  - inferiorhuman 8y ago
    Boeing offered the single angle-of-attack sensor as standard equipment, and charged extra for a second along with a “disagree” indicator that would allow 737 MAX pilots to “cross-check” a faulty sensor. Yeah, that's factually incorrect. All 737 NG/MAX planes have two alpha vanes to detect the angle-of-attack. MCAS only ever uses one at a time. Edit: You can see them both plainly in pictures: https://www.planespotters.net/photo/806268/pk-lqg-lion-air-boeing-737-8-max https://www.planespotters.net/photo/806268/pk-lqg-lion-air-b... https://www.jetphotos.com/photo/8686917 https://www.jetphotos.com/photo/8686917
    - deleted 8y ago
      [deleted]
inferiorhuman 8y ago
MCAS operates on the horizontal stabilizer (and is not a stick pusher like the article claims) the yoke operates on the elevators. The elevators are much smaller and lack the pitch authority of the stabilizer. The stabilizer moves much slower and by the time you've stalled under the conditions MCAS is designed to prevent, you may not have time for the stabilizer to move.
- manfredo 8y ago
  > MCAS operates on the horizontal stabilizer (and is not a stick pusher like the article claims) the yoke operates on the elevators. https://en.wikipedia.org/wiki/Stabilizer_(aeronautics)#/media/File:Tail_of_a_conventional_aircraft.svg https://en.wikipedia.org/wiki/Stabilizer_(aeronautics)#/medi... So the issue is that MCAS was controlling the big control surfaces, the pilots' attempts to correct with yoke input operated on the small control surfaces? The former overpowered the latter. Interesting that MCAS wasn't like cruise control where any significant input deactivates the automated controls. But then again, I know next to nothing about how big airliner control systems work.
  - azernik 8y ago
    > Interesting that MCAS wasn't like cruise control where any significant input deactivates the automated controls. It would disengage... but then would immediately re-engage if the bad sensor readings were still there. And would, in the meanwhile, have reset its control limiter so it would push even harder than the first time.
    - concerned_user 8y ago
      Also thanks to "zero training delta" commitment pilots probably didn't even know it exists or in a high-stress situation like imminent stall probably just forgot about it all.
      - acqq 8y ago
        It's worse: the pilots are supposed to "jump in" instead of the software when the plane is typically already in the critical state and then to control the plane which behaves exactly differently from the way they are trained. Only when the MCAS operates "properly" the plane behaves as they were trained! That "omission" was intentional as the Boeing selling point was "it is the same old, no new pilot training needed." That's how they have "sold" the worth of 600 billion dollars of the MAX planes! The probable strategy for Boeing was "we will blame the pilots" and had the two crashes not happened so fast one after another they would have probably got away with it!
kn0where 8y ago
I don’t have an aeronautical background at all, but a hunch I heard from some aviation forum is that the plane must be certified to be safe when flown by merely an “average” pilot, and if the Max was more difficult because it had this tendency to stall, that might mean it needs a pilot with more skill, therefore more training for existing 737 pilots. So MCAS was needed to ensure no skill difference or training difference whatsoever for the pilots, even if a typical pilot should be capable of flying without MCAS.
jacquesm 8y ago
> Boeing was worried that #1 would cause the plane to nose up during high angles of attack Your #2 is flawed. Shifting the center of gravity forward would cause the plane to nose down relative to the older model. The problem is that the engines are more powerful, mounted higher and further forward shifting the point of thrust to a location where the plane would rotate further (nose 'up'), that is why MCAS attempts to push the nose down by trimming the tail plane if it senses the plane to be in a too high angle of attack.
- cyansmoker 8y ago
  This. The engines are further away from the plane's fulcrum, and this means that they can now cause the plane to tilt up more efficiently.
- concerned_user 8y ago
  From what I read purpose of MCAS is to make stick give same feedback as on 737 NG, i.e. certain linear force increase would correspond to deflection amount on the elevator. With MAX it was no longer true due to air frame geometry and engine changes, and at certain high angles same amount of force applied to stick would result in more deflection. All this had to be maintained in order to not have re-certify all the pilots from NG but be allowed to only give minimal training I think.
  - speedplane 8y ago
    We don't even know the real problem, how can we make speculation like this. Every article seems to cite "faulty sensor data", but is this really true? Would making the sensor more reliable or having an additional backup sensor have prevented the issue? Is it possible for the software to even detect when the sensor is faulty? Maybe the sensor worked fine, and the MCAS worked fine, but the plane itself has faulty aerodynamics. At this point, it seems clear that MCAS had something to do with the crashes, but it's far too early to point to the root cause.
    - markdown 8y ago
chrisblackwell 8y ago
#5 The answer is: The aircraft stalls
na85 8y ago
The thing about the 737 is that you have massively powerful engines essentially hanging from the underside of the wings, and the wings are in a low-wing configuration (i.e. they sprout from the bottom of the fuselage and not the top like a Cessna). Imagine you're on final into a busy airport and you have to abort your descent because $reasons. If you slam the throttles forward, the thrust is all below the aerodynamic centre of the aircraft, so you have a net nose-up pitching moment created. In other words, when you slam the throttles forward the aircraft tends to nose up. A 737 pilot told me recently that in a take-off/go-around situation you actually need to push the yoke forward to restrain the aircraft's nose-up tendency until you can re-trim for climb. MCAS was introduced because the new engines on the MAX, essentially, make the airframe more dangerous at high Angle of Attack than the previous generations of the 737, and so MCAS was intended to automagically keep pilots from entering the dangerous regime. MCAS was required in order to keep to the "zero training delta" commitment. The solution might be removing MCAS, but that will/would require more pilot training which would essentially render the MAX a completely new aircraft as far as regulation is concerned.
- dingaling 8y ago
  > the thrust is all below the aerodynamic centre of the aircraft Just like 95% of airliners. In fact the Max engine thrust line is higher and closer to the datum than most. The Max's problem is not thrust line, it is additional lift generated by the forward-mounted engine nacelles at high AoA which reduces stick-load and makes pitch-up to a stall likely. Nothing to do with thrust.
  - na85 8y ago
    >Just like 95% of airliners. In fact the Max engine thrust line is higher and closer to the datum than most. Correct. >The Max's problem is not thrust line, it is additional lift generated by the forward-mounted engine nacelles at high AoA which reduces stick-load and makes pitch-up to a stall likely. Nothing to do with thrust. Nothing you've written here contradicts what I wrote previously, so I'm not sure if you're just aggressively agreeing with me, but I'll assume that this is the case. Yes, the aircraft is dangerous at high AoA, as I wrote in my previous comment.
xbmcuser 8y ago
From what I have understood they used MCAS so that they didn't need to reclassify the plane model and that pilots would not need to retrain for it as with the MCAS the handling would be similar to the older planes. The actual problem might not be with the design but using workarounds to get through red tape of reclassifying and retraining pilots for a new plane
sschueller 8y ago
Is the reason they moved the engines forward to avoid having to lift the plane higher and not having it fit jetways/stairs?
- gregd 8y ago
  The CFM Leap-1B (new engine on 737 Max) are bigger than the CFM56-7B, so Boeing had to change the mounting point of the engine (further forward and higher on the wings).
  - sschueller 8y ago
    Right, but why didn't they just lift the aircraft higher off the ground to fit the larger engines.
    - Maxion 8y ago
      Because they couldn't fit larger landing gear.
    - salawat 8y ago
      Because the gear has to be stowed! The gear is retracted inboard, so lengthening was a non starter given the rapidly escalating hardware changes that would be required to the gear bays. Once you start changing the fundamental structure of the air raft, you also start weakening your case for a common type certificate as well.
rujuladanh 8y ago
MCAS wasn’t introduced to simplify pilots’ life. It was to make the plane way cheaper overall by avoiding the plane being a different one according to regulations. Regulations that were there to make planes safer to begin with by making sure differently enough planes warrant training, processes, reviews, etc. Sadly, MCAS introduced unintended side-effects and is not as transparent as it was supposed to be, from what looks like. Therefore, if you remove MCAS, the plane should be easier to predict; but who knows what that implies now that the plane has been sold and flying for a lot of time (financially, legally...).
- acqq 8y ago
  > if you remove MCAS, the plane should be easier to predict And the prediction is: the plane would then not pass the "is it safe?" tests which don't exist "just so" but to make sure that the plane can avoid to crash as soon as something small and insignificant happens. Without the MCAS the input from the pilot would lead to plane failing easier in higher angles of attack. The MCAS was added to avoid that. So MCAS should work and should not have a single point of failure, as long as 737 MAX flies. MAX is indeed less stable in higher angles of attack. All Boeing claims "they can simply turn it off" are misleading. The plane is actually more dangerous without properly functioning MCAS. But to properly function the sensors have to be redundant and reliable, and the control that activates it too. And the control software which deactivates it should also be smart enough that "activate/deactivate" cycle isn't itself the crash cause, which is what it looks like was what directly caused the last two crashes: - the sensor used was only one, i.e. was not redundant. - the control software blindly trusted it. - the software, apart from blindly trusting the input of the sensor, was not even properly tested in the condition of the faulty sensor, specifically, the impact on the pilots. - the whole feature of MCAS was intentionally downplayed, and even hidden initially, to hide the fact that the pilots would have to train for the conditions in which MCAS fails (it can happen, as it at the end depends on mechanical and computer devices) -- the pilots have to be trained to "save" the plane without MCAS functioning, even if the plane is less stable. Note: MCAS should properly function as much as possible to minimize the chance for any small error causing big crash, but in the case when MCAS is not functioning the pilot still has the chance to save the plane only if he is trained exactly in the simulator which simulates the plane with no MCAS (when the controls don't behave "normally", which is what MCAS provides when working). That kind of training was not made at all because the selling point of MAX was "it's the same old, no need to pay for pilot's training." (Or maybe, then the pilots would know that the chance to save the plane was so reduced that they would complain more about the overall plane design?) - the decision to "just let pilot turn it off" was based on the false assumption that the faulty MCAS behavior is "obvious" to the pilots so that they turn it off easily. All that was not implemented in Boeing 737 MAX. By the way, the sensor looks like this: https://aviation.stackexchange.com/questions/2317/how-does-an-alpha-aoa-vane-work https://aviation.stackexchange.com/questions/2317/how-does-a... And the need for the redundancy was commonly known also before the crash: "The AOA values are never averaged. Depending on the AOA computer, logic is used to determine if one of the vanes is giving bad data"
speedplane 8y ago
There's also the issue of the "faulty sensor". We don't yet know if the sensor was faulty, but if it was, whether MCAS could have detected that fault.
- aybs 8y ago
  I'm really curious what the Software QA process is like at a company like this (or any company where automation failure can result in loss of life).
  - salawat 8y ago
    From comments I've read, abysmal, in the sense the Quality people are told they aren't there to keep the plane from falling out of the sky, but rather to generate audit trail so that if a disaster happens, the cause is traceable. My personal approach to Software QA is generally more in line with the role fulfilled by a Systems Engineer, so I'm intensely uncomfortable having read Quality may be culturally interpreted in such a perverse manner. Funny thing about Quality is you find exactly what you look for. Start out making a system that only suffers traceable disasters, and you get a different product than one which focuses on not suffering disasters in the first place.
mhandley 8y ago
Your point #1 is incorrect. The problem with the larger engines is that their larger nacelles placed further forward produce extra lift at high angles of attack. This lift is further forward than the centre of mass. The certification requirement is that to produce steadily increasing angles of attack, you need to steadily increase back pressure on the yoke. The problem with the Max is that this is no longer true. Past a certain angle of attack, the back pressure needed to further increase angle of attack reduces. The plane is not actually unstable, but it's closer to being so than the certification requirements allow. And it's certainly behaviour that Boeing couldn't claim was similar enough to older 737s to allow a common type rating. Hence MCAS, which was supposed to detect this condition and make the aircraft fly like an older 737. This allowed a common type rating, and allowed the aircraft to be certified. But fundamentally, the airframe has an undesirable property, and you'd never have designed it this way unless the desire for a common type rating dominated other design decisions.
- reacweb 8y ago
  It is incredible: the airframe has been designed to reuse the certification of 737. A flaw that could be fixed in a proper way, instead has been worked around using unreliable subterfuges. The aim of the certification process is to ensure the safety (and reliability) of aircraft. The required mindset shall be that the certification process helps to highlight defects in order to build a better aircraft. Here, the mindset was that the certification process is a burden with arbitrary constraints that have to be fulfilled even if this means a worse aircraft. IMHO, the people (managers) with the wrong mindset shall be replaced and the faulty airframe of 737 shall be killed.
  - greeneggs 8y ago
    This is unfair. If done appropriately, making a plane behave the way pilots expect should also make it safer. A "worse aircraft" with a better UI can actually be a safer aircraft.
    - rtkwe 8y ago
      Only so far as we can assume the UI never breaks and the sensors are always correct. The issue is pilots need to be trained to understand where the UI hides the underlying performance of the plane because when it breaks it can go wrong incredibly quickly. MCAS altered the way to aircraft reacted and also would restart it's changes unless completely cut out. Pilots didn't receive enough training to recognize the issue as being the MCAS system adjusting the trim fast enough to prevent the crashes during takeoff and ultimately the whole point of the MCAS was to avoid having to retrain and maintain the common type rating.
jussij 8y ago
From the article. That design decision meant the 737 MAX would tend to pitch up while accelerating. So the MCAS was there to counter that behaviour by automatically pushing the nose down when it detected this nose up situation.

berkut 8y ago

From what I've read, MCAS is disabled with the flaps down, so it wouldn't be for take-off and landing.

ritwikgupta 8y ago

Wasn't the idea that they wanted to avoid pilot re-training? So if pilots would be expected to counteract manually, they would have to train to understand when to do that.

kalleboo 8y ago
Pilots are already trained to handle runaway trim, the idea was that an MCAS failure would behave similarly and the same checklist they already trained on could be used. Due to issues in how MCAS was implemented however, the behavior was different from runaway trim and more confusing.
- Gibbon1 8y ago
  One comment I saw was that with Boeing aircraft when the autopilot is off you're fully manual. Unlike Airbus. MCAS has control authority when the autopilot is _off_.
  - dingaling 8y ago
    > with Boeing aircraft when the autopilot is off you're fully manual The 777 and 787 are full-time FBW, there is no manual reversion. There is no way to move the control surfaces directly. The only difference with the AP engaged is the origin of the control demands.
    - Gibbon1 8y ago
      You can have cables, push rods, hydraulics, power assisted hydraulics, full hydraulic, and electrical actuators. As long as their control inputs are only from the pilot they are identical in every way but their failure modes. There is big big difference between FBW and the aircraft generating control inputs on it's own. Boeing aircraft had two modes, 'manual' and 'auto pilot' The 737 MAX adds a third case, 'sometimes' Boeing never told the pilots about the 'sometimes' part. And never told them that 'sometimes' has ultimately more control authority than they do.
      - dingaling 8y ago
        I think you misunderstood my post. There is literally NO manual command over control surfaces in any current Boeing airliner other than the 737 variants. Neither the 777 nor 787 have any pushrods or cables. The Max does indeed have a hybrid approach ( manual actuation, FBW spoilers, mystery MCAS ) but that's not Boeing's current philosophy.
        Gibbon1 8y ago
        You're willfully failing to get my point.

azernik 8y ago

On further investigation, it seems #3 is more: MCAS had much more control authority (i.e. was allowed to change control inputs from the pilots by more) than the FAA had approved. #5 is: a fault in a single, non-redundant sensor could cause the MCAS system to falsely believe the plane was stalling, and push the nose down as hard as it could. Which (see above) was harder than a pilot could override by just pulling in the other direction, as is apparently intuitive for them.

gtr32x 8y ago
I've always been confused here on this, does that mean the 737 MAX has a high chance to have faulty reading from their AoA sensors? Or is that pretty much the industry standard right now? This has always seem like the actual culprit.
- azernik 8y ago
  Sensors break. They get gunk on them. They ice over. Generally a sensor with such a critical failure mode would be triple-redundant - if one fails, the discrepancy between sensors is flagged and the aircraft runs on the other two until the broken one is fixed. In this case, the aircraft had two sensors of the type (Angle-of-Attack), but MCAS was only listening to one of them.
  - gtr32x 8y ago
    Thanks for the elaboration. Could you help me further understand one more thing? When you say MCAS only listens to one, does that mean during the time when one AoA sensor fails? Or it always listens to one during normal operation? Also, it does seem like Boeing dropped the ball here to not build further redundancy here.
    - inferiorhuman 8y ago
      MCAS alternates between the left and right sensor each time the plane lands. With the Lion Air flight I think cycling the electrical power for diagnostic work caused MCAS to pick up the faulty sensor for two flights in a row.

gulikoza 8y ago

Because: 1. earlier 737 models didn't pitch up and Boeing wanted the plane to "feel" the same and not have to re-train the pilots 2. there is some certification requirement that the pitch has to be constant during climb (or something like this); if the plane doesn't have this, it is not certified to fly. It wouldn't pass FAA certification without MCAS.

manfredo 8y ago
> there is some certification requirement that the pitch has to be constant during climb (or something like this); if the plane doesn't have this, it is not certified to fly. It wouldn't pass FAA certification without MCAS. So what I gather is the issue was that the MAX didn't fit this requirement for steady pitch (hence the airframe problem referenced in the linked article), and MCAS was supposed to be the band-aid to fix this essentially by automatically pushing forward on the yoke during high angle of attack. If that's the case then the following is especially concerning: > Boeing offered the single angle-of-attack sensor as standard equipment, and charged extra for a second along with a “disagree” indicator that would allow 737 MAX pilots to “cross-check” a faulty sensor. Seems pretty sketchy to ask airlines to cough up extra dough for redundancy on a safety critical system. Who knows what other systems are subject to the same cost/benefit tradeoffs.
- inferiorhuman 8y ago
  Boeing offered the single angle-of-attack sensor as standard equipment, and charged extra for a second along with a “disagree” indicator that would allow 737 MAX pilots to “cross-check” a faulty sensor. Yeah, that's factually incorrect. All 737 NG/MAX planes have two alpha vanes to detect the angle-of-attack. MCAS only ever uses one at a time. Edit: You can see them both plainly in pictures: https://www.planespotters.net/photo/806268/pk-lqg-lion-air-boeing-737-8-max https://www.planespotters.net/photo/806268/pk-lqg-lion-air-b... https://www.jetphotos.com/photo/8686917 https://www.jetphotos.com/photo/8686917
  - deleted 8y ago
    [deleted]

inferiorhuman 8y ago

MCAS operates on the horizontal stabilizer (and is not a stick pusher like the article claims) the yoke operates on the elevators. The elevators are much smaller and lack the pitch authority of the stabilizer. The stabilizer moves much slower and by the time you've stalled under the conditions MCAS is designed to prevent, you may not have time for the stabilizer to move.

manfredo 8y ago
> MCAS operates on the horizontal stabilizer (and is not a stick pusher like the article claims) the yoke operates on the elevators. https://en.wikipedia.org/wiki/Stabilizer_(aeronautics)#/media/File:Tail_of_a_conventional_aircraft.svg https://en.wikipedia.org/wiki/Stabilizer_(aeronautics)#/medi... So the issue is that MCAS was controlling the big control surfaces, the pilots' attempts to correct with yoke input operated on the small control surfaces? The former overpowered the latter. Interesting that MCAS wasn't like cruise control where any significant input deactivates the automated controls. But then again, I know next to nothing about how big airliner control systems work.
- azernik 8y ago
  > Interesting that MCAS wasn't like cruise control where any significant input deactivates the automated controls. It would disengage... but then would immediately re-engage if the bad sensor readings were still there. And would, in the meanwhile, have reset its control limiter so it would push even harder than the first time.
  - concerned_user 8y ago
    Also thanks to "zero training delta" commitment pilots probably didn't even know it exists or in a high-stress situation like imminent stall probably just forgot about it all.
    - acqq 8y ago
      It's worse: the pilots are supposed to "jump in" instead of the software when the plane is typically already in the critical state and then to control the plane which behaves exactly differently from the way they are trained. Only when the MCAS operates "properly" the plane behaves as they were trained! That "omission" was intentional as the Boeing selling point was "it is the same old, no new pilot training needed." That's how they have "sold" the worth of 600 billion dollars of the MAX planes! The probable strategy for Boeing was "we will blame the pilots" and had the two crashes not happened so fast one after another they would have probably got away with it!

kn0where 8y ago

I don’t have an aeronautical background at all, but a hunch I heard from some aviation forum is that the plane must be certified to be safe when flown by merely an “average” pilot, and if the Max was more difficult because it had this tendency to stall, that might mean it needs a pilot with more skill, therefore more training for existing 737 pilots. So MCAS was needed to ensure no skill difference or training difference whatsoever for the pilots, even if a typical pilot should be capable of flying without MCAS.

jacquesm 8y ago

> Boeing was worried that #1 would cause the plane to nose up during high angles of attack Your #2 is flawed. Shifting the center of gravity forward would cause the plane to nose down relative to the older model. The problem is that the engines are more powerful, mounted higher and further forward shifting the point of thrust to a location where the plane would rotate further (nose 'up'), that is why MCAS attempts to push the nose down by trimming the tail plane if it senses the plane to be in a too high angle of attack.

cyansmoker 8y ago
This. The engines are further away from the plane's fulcrum, and this means that they can now cause the plane to tilt up more efficiently.
concerned_user 8y ago
From what I read purpose of MCAS is to make stick give same feedback as on 737 NG, i.e. certain linear force increase would correspond to deflection amount on the elevator. With MAX it was no longer true due to air frame geometry and engine changes, and at certain high angles same amount of force applied to stick would result in more deflection. All this had to be maintained in order to not have re-certify all the pilots from NG but be allowed to only give minimal training I think.
- speedplane 8y ago
  We don't even know the real problem, how can we make speculation like this. Every article seems to cite "faulty sensor data", but is this really true? Would making the sensor more reliable or having an additional backup sensor have prevented the issue? Is it possible for the software to even detect when the sensor is faulty? Maybe the sensor worked fine, and the MCAS worked fine, but the plane itself has faulty aerodynamics. At this point, it seems clear that MCAS had something to do with the crashes, but it's far too early to point to the root cause.
  - markdown 8y ago

chrisblackwell 8y ago

#5 The answer is: The aircraft stalls

na85 8y ago

The thing about the 737 is that you have massively powerful engines essentially hanging from the underside of the wings, and the wings are in a low-wing configuration (i.e. they sprout from the bottom of the fuselage and not the top like a Cessna). Imagine you're on final into a busy airport and you have to abort your descent because $reasons. If you slam the throttles forward, the thrust is all below the aerodynamic centre of the aircraft, so you have a net nose-up pitching moment created. In other words, when you slam the throttles forward the aircraft tends to nose up. A 737 pilot told me recently that in a take-off/go-around situation you actually need to push the yoke forward to restrain the aircraft's nose-up tendency until you can re-trim for climb. MCAS was introduced because the new engines on the MAX, essentially, make the airframe more dangerous at high Angle of Attack than the previous generations of the 737, and so MCAS was intended to automagically keep pilots from entering the dangerous regime. MCAS was required in order to keep to the "zero training delta" commitment. The solution might be removing MCAS, but that will/would require more pilot training which would essentially render the MAX a completely new aircraft as far as regulation is concerned.

dingaling 8y ago
> the thrust is all below the aerodynamic centre of the aircraft Just like 95% of airliners. In fact the Max engine thrust line is higher and closer to the datum than most. The Max's problem is not thrust line, it is additional lift generated by the forward-mounted engine nacelles at high AoA which reduces stick-load and makes pitch-up to a stall likely. Nothing to do with thrust.
- na85 8y ago
  >Just like 95% of airliners. In fact the Max engine thrust line is higher and closer to the datum than most. Correct. >The Max's problem is not thrust line, it is additional lift generated by the forward-mounted engine nacelles at high AoA which reduces stick-load and makes pitch-up to a stall likely. Nothing to do with thrust. Nothing you've written here contradicts what I wrote previously, so I'm not sure if you're just aggressively agreeing with me, but I'll assume that this is the case. Yes, the aircraft is dangerous at high AoA, as I wrote in my previous comment.

xbmcuser 8y ago

From what I have understood they used MCAS so that they didn't need to reclassify the plane model and that pilots would not need to retrain for it as with the MCAS the handling would be similar to the older planes. The actual problem might not be with the design but using workarounds to get through red tape of reclassifying and retraining pilots for a new plane

sschueller 8y ago

Is the reason they moved the engines forward to avoid having to lift the plane higher and not having it fit jetways/stairs?

gregd 8y ago
The CFM Leap-1B (new engine on 737 Max) are bigger than the CFM56-7B, so Boeing had to change the mounting point of the engine (further forward and higher on the wings).
- sschueller 8y ago
  Right, but why didn't they just lift the aircraft higher off the ground to fit the larger engines.
  - Maxion 8y ago
    Because they couldn't fit larger landing gear.
  - salawat 8y ago
    Because the gear has to be stowed! The gear is retracted inboard, so lengthening was a non starter given the rapidly escalating hardware changes that would be required to the gear bays. Once you start changing the fundamental structure of the air raft, you also start weakening your case for a common type certificate as well.

rujuladanh 8y ago

MCAS wasn’t introduced to simplify pilots’ life. It was to make the plane way cheaper overall by avoiding the plane being a different one according to regulations. Regulations that were there to make planes safer to begin with by making sure differently enough planes warrant training, processes, reviews, etc. Sadly, MCAS introduced unintended side-effects and is not as transparent as it was supposed to be, from what looks like. Therefore, if you remove MCAS, the plane should be easier to predict; but who knows what that implies now that the plane has been sold and flying for a lot of time (financially, legally...).

acqq 8y ago
> if you remove MCAS, the plane should be easier to predict And the prediction is: the plane would then not pass the "is it safe?" tests which don't exist "just so" but to make sure that the plane can avoid to crash as soon as something small and insignificant happens. Without the MCAS the input from the pilot would lead to plane failing easier in higher angles of attack. The MCAS was added to avoid that. So MCAS should work and should not have a single point of failure, as long as 737 MAX flies. MAX is indeed less stable in higher angles of attack. All Boeing claims "they can simply turn it off" are misleading. The plane is actually more dangerous without properly functioning MCAS. But to properly function the sensors have to be redundant and reliable, and the control that activates it too. And the control software which deactivates it should also be smart enough that "activate/deactivate" cycle isn't itself the crash cause, which is what it looks like was what directly caused the last two crashes: - the sensor used was only one, i.e. was not redundant. - the control software blindly trusted it. - the software, apart from blindly trusting the input of the sensor, was not even properly tested in the condition of the faulty sensor, specifically, the impact on the pilots. - the whole feature of MCAS was intentionally downplayed, and even hidden initially, to hide the fact that the pilots would have to train for the conditions in which MCAS fails (it can happen, as it at the end depends on mechanical and computer devices) -- the pilots have to be trained to "save" the plane without MCAS functioning, even if the plane is less stable. Note: MCAS should properly function as much as possible to minimize the chance for any small error causing big crash, but in the case when MCAS is not functioning the pilot still has the chance to save the plane only if he is trained exactly in the simulator which simulates the plane with no MCAS (when the controls don't behave "normally", which is what MCAS provides when working). That kind of training was not made at all because the selling point of MAX was "it's the same old, no need to pay for pilot's training." (Or maybe, then the pilots would know that the chance to save the plane was so reduced that they would complain more about the overall plane design?) - the decision to "just let pilot turn it off" was based on the false assumption that the faulty MCAS behavior is "obvious" to the pilots so that they turn it off easily. All that was not implemented in Boeing 737 MAX. By the way, the sensor looks like this: https://aviation.stackexchange.com/questions/2317/how-does-an-alpha-aoa-vane-work https://aviation.stackexchange.com/questions/2317/how-does-a... And the need for the redundancy was commonly known also before the crash: "The AOA values are never averaged. Depending on the AOA computer, logic is used to determine if one of the vanes is giving bad data"

speedplane 8y ago

There's also the issue of the "faulty sensor". We don't yet know if the sensor was faulty, but if it was, whether MCAS could have detected that fault.

aybs 8y ago
I'm really curious what the Software QA process is like at a company like this (or any company where automation failure can result in loss of life).
- salawat 8y ago
  From comments I've read, abysmal, in the sense the Quality people are told they aren't there to keep the plane from falling out of the sky, but rather to generate audit trail so that if a disaster happens, the cause is traceable. My personal approach to Software QA is generally more in line with the role fulfilled by a Systems Engineer, so I'm intensely uncomfortable having read Quality may be culturally interpreted in such a perverse manner. Funny thing about Quality is you find exactly what you look for. Start out making a system that only suffers traceable disasters, and you get a different product than one which focuses on not suffering disasters in the first place.

mhandley 8y ago

Your point #1 is incorrect. The problem with the larger engines is that their larger nacelles placed further forward produce extra lift at high angles of attack. This lift is further forward than the centre of mass. The certification requirement is that to produce steadily increasing angles of attack, you need to steadily increase back pressure on the yoke. The problem with the Max is that this is no longer true. Past a certain angle of attack, the back pressure needed to further increase angle of attack reduces. The plane is not actually unstable, but it's closer to being so than the certification requirements allow. And it's certainly behaviour that Boeing couldn't claim was similar enough to older 737s to allow a common type rating. Hence MCAS, which was supposed to detect this condition and make the aircraft fly like an older 737. This allowed a common type rating, and allowed the aircraft to be certified. But fundamentally, the airframe has an undesirable property, and you'd never have designed it this way unless the desire for a common type rating dominated other design decisions.

reacweb 8y ago
It is incredible: the airframe has been designed to reuse the certification of 737. A flaw that could be fixed in a proper way, instead has been worked around using unreliable subterfuges. The aim of the certification process is to ensure the safety (and reliability) of aircraft. The required mindset shall be that the certification process helps to highlight defects in order to build a better aircraft. Here, the mindset was that the certification process is a burden with arbitrary constraints that have to be fulfilled even if this means a worse aircraft. IMHO, the people (managers) with the wrong mindset shall be replaced and the faulty airframe of 737 shall be killed.
- greeneggs 8y ago
  This is unfair. If done appropriately, making a plane behave the way pilots expect should also make it safer. A "worse aircraft" with a better UI can actually be a safer aircraft.
  - rtkwe 8y ago
    Only so far as we can assume the UI never breaks and the sensors are always correct. The issue is pilots need to be trained to understand where the UI hides the underlying performance of the plane because when it breaks it can go wrong incredibly quickly. MCAS altered the way to aircraft reacted and also would restart it's changes unless completely cut out. Pilots didn't receive enough training to recognize the issue as being the MCAS system adjusting the trim fast enough to prevent the crashes during takeoff and ultimately the whole point of the MCAS was to avoid having to retrain and maintain the common type rating.

jussij 8y ago

From the article. That design decision meant the 737 MAX would tend to pitch up while accelerating. So the MCAS was there to counter that behaviour by automatically pushing the nose down when it detected this nose up situation.