Maneuvering Characteristics Augmentation System

The tracking data of Lion Air Flight 610 from Flightradar24

The vertical airspeeds of the Boeing 737 MAX 8s involved in the JT 610 and ET 302 crashes

Investigators determined that MCAS was triggered by falsely high angle of attack (AoA) inputs, as if the plane had pitched up excessively. On both flights, shortly after takeoff, MCAS repeatedly actuated the horizontal stabilizer trim motor to push down the airplane nose.[15][16][17][18] Satellite data for the flights, ET 302 and JT 610, showed that the planes struggled to gain altitude.[19] Pilots reported difficulty controlling the airplane and asked to return to the airport.[20][21]

On March 11, 2019, after China had grounded the aircraft,[22] Boeing published some details of new system requirements for the MCAS software and for the cockpit displays, which it began implementing in the wake of the prior accident five months earlier:[15]

• If the two AoA sensors disagree with the flaps retracted, MCAS will not activate and an indicator will alert the pilots.
• If MCAS is activated in non-normal conditions, it will only "provide one input for each elevated AoA event."
• Flight crew will be able to counteract MCAS by pulling back on the column.

On March 27, Daniel Elwell, the acting administrator of the FAA, testified before the Senate Committee on Commerce, Science, and Transportation, saying that on January 21, "Boeing submitted a proposed MCAS software enhancement to the FAA for certification. ... the FAA has tested this enhancement to the 737 MAX flight control system in both the simulator and the aircraft. The testing, which was conducted by FAA flight test engineers and flight test pilots, included aerodynamic stall situations and recovery procedures."[23] After a series of delays, the updated MCAS software was released to the FAA in May 2019.[24][25] On May 16, Boeing announced that the completed software update was awaiting approval from the FAA.[26][27] The flight software underwent 360 hours of testing on 207 flights.[28] Boeing also updated existing crew procedures.[15] The implementation of MCAS has been found to disrupt autopilot operations.[29]

On April 4, 2019 Boeing publicly acknowledged that MCAS played a role in both accidents.[30]

The FAA and Boeing both refuted media reports describing MCAS as an anti-stall system, which Boeing asserted it is distinctly not.[31][32][33] The aircraft had to perform well in a low-speed stall test.[34] The Joint Authorities Technical Review "considers that the STS/MCAS and elevator feel shift (EFS) functions could be considered as stall identification systems or stall protection systems, depending on the natural (unaugmented) stall characteristics of the aircraft".

The JATR said, "MCAS used the stabilizer to change the column force feel, not trim the aircraft. This is a case of using the control surface in a new way that the regulations never accounted for and should have required an issue paper for further analysis by the FAA. If the FAA technical staff had been fully aware of the details of the MCAS function, the JATR team believes the agency likely would have required an issue paper for using the stabilizer in a way that it had not previously been used; this [might have] identified the potential for the stabilizer to overpower the elevator."[35]

The Maneuvering Characteristics Augmentation System (MCAS) is a flight control law[36] built into the Boeing 737 MAX's flight control computer, designed to help the aircraft emulate the handling characteristics of the earlier Boeing 737 Next Generation. According to an international Civil Aviation Authorities team review (JATR) commissioned by the FAA, MCAS may be a stall identification or protection system, depending on the natural (unaugmented) stall characteristics of the aircraft.[35][37][38] Boeing considered MCAS part of the flight control system, and elected to not describe it in the flight manual or in training materials, based on the fundamental design philosophy of retaining commonality with the 737NG. Minimizing the functional differences between the Boeing 737 MAX and Next Generation aircraft variants allowed both variants to share the same type rating. Thus, airlines can save money by employing and training one pool of pilots to fly both variants of the Boeing 737 interchangeably.[39]

When activated, MCAS directly engages the horizontal stabilizer, thus is distinct from an anti-stall device, such as stick pusher, which physically moves the pilot's control column forward and engages the airplane's elevators when the airplane is approaching a stall.

Boeing's former CEO Dennis Muilenburg said "[MCAS] has been reported or described as an anti-stall system, which it is not. It's a system that's designed to provide handling qualities for the pilot that meet pilot preferences."[40]

The 737 MAX's larger CFM LEAP-1B engines are fitted further forward and higher up than in previous models. The aerodynamic effect of its nacelles contributes to the aircraft's tendency to pitch up at high angles of attack (AOA). The MCAS is intended to compensate in such cases, modeling the pitching behavior of previous models, and meet a certain certification requirement,[41] in order to enhance handling characteristics and thus minimizing the need for significant pilot retraining.[42][43][40]

The software code for the MCAS function and the computer for executing the software are built to Boeing's specifications by Collins Aerospace, formerly Rockwell Collins.[44]

As an automated corrective measure, the MCAS was given full authority to bring the aircraft nose down, and could not be overridden by pilot resistance against the control wheel as on previous versions of the 737.[45] Following the Lion Air accident, Boeing issued an Operations Manual Bulletin (OMB)[46] on November 6, 2019 to outline the many indications and effects resulting from erroneous AOA data and provided instructions to turn off the motorized trim system for the remainder of the flight, and trim manually instead. Until Boeing supplemented the manuals[47] and training, pilots were unaware of the existence of MCAS due to its omission from the crew manual and no coverage in training.[45] Boeing first publicly named and revealed the existence of MCAS on the 737 MAX in a message to airline operators and other aviation interests on November 10, 2018, twelve days after the Lion Air crash.[4]

As with any other equipment on board an aircraft, the FAA approves a functional "design assurance level" corresponding to the consequences of a failure, using the SAE International standards ARP4754 and ARP4761. MCAS was designated a "hazardous failure" system. This classification corresponds to failures causing "a large reduction in safety margins" or "serious or fatal injury to a relatively small number of the occupants", but nothing "catastrophic".[48]

The MCAS was designed with the assumption, approved by FAA, that pilots would react to an unexpected activation within three seconds.[49]

On September 26, 2019, the NTSB released the results of its review of potential lapses in the design and approval of the 737 MAX.[71][72]^(p1)[73] The NTSB report concludes that assumptions "that Boeing used in its functional hazard assessment of uncommanded MCAS function for the 737 MAX did not adequately consider and account for the impact that multiple flight deck alerts and indications could have on pilots' responses to the hazard". When Boeing induced a stabilizer trim input that simulated the stabilizer moving consistent with the MCAS function, "... the specific failure modes that could lead to unintended MCAS activation (such as an erroneous high AOA input to the MCAS) were not simulated as part of these functional hazard assessment validation tests. As a result, additional flight deck effects (such as IAS DISAGREE and ALT DISAGREE alerts and stick shaker activation) resulting from the same underlying failure (for example, erroneous AOA) were not simulated and were not in the stabilizer trim safety assessment report reviewed by the NTSB."[72][74]

The NTSB questioned the long-held industry and FAA practice of assuming the nearly instantaneous responses of highly trained test pilots as opposed to pilots of all levels of experience to verify human factors in aircraft safety.[75] The NTSB expressed concerns that the process used to evaluate the original design needs improvement because that process is still in use to certify current and future aircraft and system designs. The FAA could for example randomly sample pools from the worldwide pilot community to get a more representative assessment of cockpit situations.[76]

The trim wheel and cutoff switches in a previous generation cockpit

In May 2019, The Seattle Times reported that the two stabilizer cutoff switches, located on the center console, operate differently on the MAX than on the earlier 737 NG. On previous aircraft, one cutoff switch deactivates the thumb buttons on the control yoke that pilots use to move the horizontal stabilizer; the other cutoff switch disables automatic control of the horizontal stabilizer by autopilot or STS/MCAS. On the MAX, both switches are wired in parallel and perform the same function: they cut off all electric power to the stabilizer, both from the yoke buttons and from an automatic system.

Thus, on previous aircraft it is possible to disable automatic control of the stabilizer yet to employ electric power assist by operating the yoke switches. On the MAX, with all power to the stabilizer cut, pilots have no choice but to use the mechanical trim wheel in the center console.[95]

However, as pilots pull on the 737 controls to raise the nose of the aircraft, aerodynamic forces on the elevator create an opposing force, effectively paralyzing the jackscrew mechanism that moves the stabilizer.[96] It becomes very difficult for pilots to hand crank the trim wheel.[96] The problem was encountered on earlier 737 versions, and a "roller coaster" emergency technique for handling the flight condition was documented in 1982 for the 737-200 but did not appear in training documentation for later versions (including the MAX).[96]

In the early 1980s a problem was found with the 737-200 model. When the elevator operated to raise or lower the nose, it set up a strong force on the trim jackscrew which opposed any corrective force from the control systems. When attempting to correct an unwanted deflection using the manual trim wheel, exerting enough hand force to overcome the force exerted by the elevator became increasingly difficult as speed and deflection increased and the jack screw effectively jammed in place.[97]

A workaround was developed called the "roller coaster" technique. Counter-intuitively, to correct an excessive deflection causing a dive the pilot first pushes the nose down further, before easing back to gently raise the nose again. During this easing back period, the elevator deflection reduces or even reverses, its force on the jackscrew does likewise and the manual trim eases up. The workaround was included in the pilot's emergency procedures and in the training schedule.[97]

However while the 737 MAX has a similar jackscrew mechanism the "roller coaster" technique has been dropped from the pilot information. During the events leading to the two MAX crashes, the stiffness of the manual trim wheel repeatedly prevented manual trim adjustment to correct the MCAS-induced nose-down pitching. The issue has been brought to the notice of the DoJ criminal inquiry into the 737 MAX crashes.[97]

In simulator tests of Ethiopian Airlines Flight 302 flight scenario, the trim wheel was "impossible" to move when one of the pilots would instinctively pull up from the nosedives. It takes 15 turns to manually trim the aircraft one degree, and up to 40 turns to bring the trim back to neutral from the nose down position caused by MCAS.[98]

The horizontal stabilizer is fitted with a conventional elevator for flight control. However, it is itself all-moving about a single pivot and can be trimmed to adjust its angle. The trim is actuated via a jackscrew mechanism.

Sylvain Alarie and Gilles Primeau, experts on the horizontal stabilizers, observed anomalies in the data from the aircraft data recorders: a progressive shift of 0.2 degrees of the horizontal stabilizer, before the crash. "It may not seem like much, but it is an order of magnitude higher than what is normally allowed when designing systems like these", says Gilles Primeau. They say that the movements are easily observable, and disallowed according to Regulation 395A. These anomalies raise fundamental questions about this jack screw, which controls the horizontal stabilizer since the beginning of the 737 models, first certified in 1967.[99]

These slips are particularly visible on flight ET302: "While there is no MCAS command, and no control of the pilots, we see a movement of the jack screw which controls the horizontal stabilizer, we see a slip. And at the very end of the flight, the jack screw starts to slide again with an increase in the speed of the plane and its dive," says Alarie.[99]

Since its original design, the 737 has become 61% heavier, 24% longer, and 40% wider, and its engines twice as powerful. These experts are concerned that the loads on the jack screw have potentially increased since the creation of the 737. By regulations, the controls must be designed for 125% of the foreseeable loads.[99][100] These experts have raised concerns about the motors possibly overheating in April 2019.[101]

During the groundings, special flights to reposition MAX aircraft to storage locations, as per 14 CFR § 21.197, flew at lower altitude and with flaps extended to circumvent MCAS activation, rather than using the recovery procedure after the fact. Such flights required a certain pilot qualification as well as permission from corresponding regulators, and with no other cabin crew or passengers.[102][103]

Though there are two sensors on the MAX only one of them is used at a time to trigger MCAS activation on the 737 MAX. Any fault in this sensor, perhaps due to physical damage,[92] creates a single point failure: the flight control system lacks any basis for rejecting its input as faulty information.

Reports of a single point of failure were not always acknowledged by Boeing. Addressing American Airlines pilots, Boeing vice-president Mike Sinnett contradicted reports that the MCAS had a single-point failure, because the pilots themselves are the backup. Reporter Useem said in The Atlantic it was "showing both a misunderstanding of the term and a sharp break from Boeing's long-standing practice of having multiple backups for every flight system".[106]

Problems with the AoA sensor had been reported in over 200 incident reports submitted to the FAA; however, Boeing did not flight test a scenario in which it malfunctioned.[107]

The sensors themselves are under scrutiny. Sensors on the Lion air aircraft were supplied by United Technologies' Rosemount Aerospace.[108]

In September 2019, the EASA said it prefers triple-redundant AoA sensors rather than the dual redundancy in Boeing's proposed upgrade to the MAX.[109] Installation of a third sensor could be expensive and take a long time. The change, if mandated, could be extended to thousands of older model 737s in service around the world.[109]

A former professor at Embry-Riddle Aeronautical University, Andrew Kornecki, who is an expert in redundancy systems, said operating with one or two sensors "would be fine if all the pilots were sufficiently trained in how to assess and handle the plane in the event of a problem". But, he would much prefer building the plane with three sensors, as Airbus does.[110]

In November 2017, after several months of MAX deliveries, Boeing discovered that the AoA Disagree message, which is indicative of potential sensor mismatch on the primary flight display,[111] was unintentionally disabled.[15]

Clint Balog, a professor at Embry-Riddle Aeronautical University, said after the Lion Air crash: "In retrospect, clearly it would have been wise to include the warning as standard equipment and fully inform and train operators on MCAS".[112] According to Bjorn Fehrm, Aeronautical and Economic Analyst at Leeham News and Analysis, "A major contributor to the ultimate loss of JT610 is the missing AoA DISAGREE display on the pilots' displays."[113]

The software depended on the presence of the visual indicator software, a paid option that was not selected by most airlines.[114] For example, Air Canada, American Airlines and Westjet had purchased the disagree alert, while Air Canada and American Airlines also purchased, in addition, the AoA value indicator, and Lion Air had neither.[115][116] Boeing had determined that the defect was not critical to aircraft safety or operation, and an internal safety review board (SRB) corroborated Boeing's prior assessment and its initial plan to update the aircraft in 2020. Boeing did not disclose the defect to the FAA until November 2018, in the wake of the Lion Air crash.[117][118][119][120] Consequently, Southwest had announced to pilots that its entire fleet of MAX 8 aircraft will receive the optional upgrades.[121][122] In March 2019, after the second accident of Ethiopian Airlines Flight 302, a Boeing representative told Inc. magazine, "Customers have been informed that AoA Disagree alert will become a standard feature on the 737 MAX. It can be retrofitted on previously delivered airplanes."[123]

On May 5, 2019, The Wall Street Journal reported that Boeing had known of existing problems with the flight control system a year before the Lion Air accident.[124] Boeing defended that "Neither the angle of attack indicator nor the AoA Disagree alert are necessary for the safe operation of the airplane." Boeing recognized that the defective software was not implemented to their specifications as a "standard, standalone feature." Boeing stated, "...MAX production aircraft will have an activated and operable AoA Disagree alert and an optional angle of attack indicator. All customers with previously delivered MAX airplanes will have the ability to activate the AoA Disagree alert."[118] Boeing CEO Muilenburg said the company's communication about the alert "was not consistent. And that's unacceptable."[125][118]

The primary flight display of a Boeing 737-800 aircraft with a functional angle of attack display on the upper right; the AoA Disagree alert would appear as a text message.

Boeing published an article in Aero magazine about AoA systems, "Operational use of Angle of Attack on modern commercial jet planes":

The AoA indicator can be used to assist with unreliable airspeed indications as a result of blocked pitot or static ports and may provide additional situation and configuration awareness to the flight crew.[104]

Boeing announced a change in policy in the Frequently Asked Questions in a (FAQ) about the MAX corrective work, "With the software update, customers are not charged for the AoA Disagree feature or their selection of the AoA indicator option."[126]

In 1996, the NTSB issued Safety Recommendation A-96-094.

TO THE FEDERAL AVIATION ADMINISTRATION (FAA): Require that all transport-category aircraft present pilots with angle-of-attack info in a visual format, and that all air carriers train their pilots to use the info to obtain maximum possible airplane climb performance.

The NTSB also stated about another accident in 1997, that "a display of angle of attack on the flight deck would have maintained the flightcrew's awareness of the stall condition and it would have provided direct indication of the pitch attitudes required for recovery throughout the attempted stall recovery sequence." The NTSB also believed that the accident may have been prevented if a direct indication of AoA was presented to the flightcrew (NTSB, 1997)."[127]^(p29)

The MAX systems are integrated in the "e-cab" test flight deck, a simulator built for developing the MAX.[133][134] In June 2019, "in a special Boeing simulator that is designed for engineering reviews,"[135] FAA pilots performed a stress testing scenario – an abnormal condition identified through FMEA after the MCAS update was implemented[136] – for evaluating the effect of a fault in a microprocessor: as expected from the scenario, the horizontal stabilizer pointed the nose downward. Although the test pilot ultimately recovered control, the system was slow to respond to the proper runaway stabilizer checklist steps. Boeing initially classified this as a "major" hazard, and the FAA upgraded it to a much more severe "catastrophic" rating. Boeing stated that the issue can be fixed in software.[137] The software change will not be ready for evaluation until at least September 2019.[138] EASA director Patrick Ky said that retrofitting additional hardware is an option to be considered.[29]

The test scenario simulated an event toggling five bits in the flight control computer. The bits represent status flags such as whether MCAS is active, or whether the tail trim motor is energized. Engineers were able to simulate single event upsets and artificially induce MCAS activation by manipulating these signals. Such a fault occurs when memory bits change from 0 to 1 or vice versa, which is something that can be caused by cosmic rays striking the microprocessor.[139]

The failure scenario was known before the MAX entered service in 2017: it had been assessed in a safety analysis when the plane was certified. Boeing had concluded that pilots could perform a procedure to shut off the motor driving the stabilizer to overcome the nose-down movement.[140] The scenario also affects 737NG aircraft, though it presents less risk than on the MAX; on the NG, moving the yoke counters any uncommanded stabilizer input, but this function is bypassed on the MAX to avoid negating the purpose of MCAS.[141] Boeing also said that it agreed with additional requirements that the FAA required it to fulfill, and added that it was working toward resolving the safety risk. It will not offer the MAX for certification until all requirements have been satisfied.[137]

Early news reports were inaccurate in attributing the problem to an 80286[142] microprocessor overwhelmed with data, though as of April 2020 the concern remains that the MCAS software is overloading the 737 MAX's computers.[143]

As of 2019, the two flight control computers of Boeing 737 never cross-checked each other's operations; i.e., each was a single non-redundant channel. This lack of robustness existed since the early implementation and persisted for decades.[139] The updated flight control system will use both flight control computers and compare their outputs. This switch to a fail-safe two-channel redundant system, with each computer using an independent set of sensors, is a radical change from the architecture used on 737s since the introduction on the older model 737-300 in the 1980s. Up to the MAX in its prior-to-grounding-version, the system alternates between computers after each flight.[139] The two computers' architecture allowed switching in-flight if the operating computer failed, thus increasing availability. In the revised architecture, Boeing required the two computers to monitor each other so that each one can vet the other.[130]

In January 2020, during flight testing, Boeing discovered a problem with an indicator light; the defect was traced to the "redesign of the two flight computers that control the 737 MAX to make them more resilient to failure". The indicator, which signals a problem with the trim system, can remain on longer than intended by design.[144][145]