The MCAS is supposed to deactivate when angle of attack is sufficiently reduced or pilots cut out power to the stabilizer trim.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\nA 737 MAX with the MCAS operates in a manner that can be rather disorienting to pilots accustomed to flying earlier 737 models without the software. A pilot may raise the nose by pulling back on the control yoke but then observe the stabilizer trim wheel moving to trim the nose down opposite to his or her input.\u00a0 This is a result of the aircraft\u2019s computer calculating that the optimum angle of attack for maximum lift is less than the angle which the pilot is demanding through moving the control yoke.<\/p>\n
As long as the angle of attack sensor is providing a high signal, the MCAS will drive the trim repeatedly, overriding pilot input.\u00a0 Note that the nose-down force provided by the stabilizer trim is stronger than the pilot\u2019s ability to counter it by pulling back on the control yoke to raise the elevators.<\/p>\n
Recommended Pilot Responses to MCAS Malfunctions<\/b><\/p>\n
Like any flight control system, the MCAS can malfunction.\u00a0 There are a number of hardware and software faults that can cause the system to behave incorrectly.<\/p>\n
Boeing\u2019s position has been that pilots should respond to an MCAS malfunction as though it were a case of runaway stabilizer trim.\u00a0 This is a condition that pilots routinely train for in a simulator. The handbook procedure for this problem is to cut off electrical power to the stabilizer trim motors and trim the stabilizer back manually using a hand crank in the cockpit.<\/p>\n
Unfortunately, Boeing\u2019s assumptions about pilots\u2019 ability to respond in such a situation may not be realistic.\u00a0 Smaller pilots may not have sufficient strength to pull back on the control yoke to recover from the dive caused by the MCAS.\u00a0 And when the airspeed is high, aerodynamic forces on the horizontal stabilizer may make it too difficult for pilots to manually trim the horizontal stabilizer with the hand crank.\u00a0 In particular, if they are simultaneously holding strong force on the control yokes they may not have a free hand to rotate the trim crank.<\/p>\n
When the MCAS is acting to prevent a stall, the cockpit is full of audible and visual alarms that can be highly distracting.\u00a0 And the time available to understand the situation, diagnose the fault, and take the necessary corrective actions can be very short before a fatal dive angle and descent rate occurs, particularly at low altitude.<\/p>\n
Corner Cutting<\/b><\/p>\n
At the time the 737 MAX program is being developed, Boeing management is obsessively focused on driving down costs in every area in order to maximize shareholder value.\u00a0 Top management compensation is tied to increases in the company share price, providing strong incentives.<\/p>\n
Boeing does not follow generally-accepted design practice when it incorporates the MCAS into a safety-critical flight control system for the 737 MAX.\u00a0 Airbus aircraft have four angle of attack sensors, with comparison among sets of three in order to use the data from the two sensors that most closely agree. Although newer Boeing jetliner designs (e.g. the 777 and 787) use three, only two angle of attack sensors are provided for the 737 MAX.\u00a0 The MCAS only reads data from one of the sensors on a given flight, and then switches to the sensor on the other side of the fuselage on the next flight. If the MCAS gets a reading of a high angle of attack from the one sensor it is using, it will command nose-down stabilizer trim.<\/p>\n
However, it is well known that angle of attack sensor malfunctions are relatively common.\u00a0 A number of things can cause problems, including icing, careless aircraft washing, damage from contact with a jetway, bird strikes, and maintenance errors.<\/p>\n
In addition to using only one angle of attack sensor at a time, Boeing does not follow generally-accepted design practice by providing redundant electrical and signal buses with fail-safe design approaches.\u00a0 This results in several different single-points-of-failure paths in the 737 MAX flight control system.<\/p>\n
Boeing makes several cockpit safety features, such as an angle of attack display, extra-cost options with a high price.\u00a0 As a result, many budget airlines do not order these options. Although a warning light indicating disagreement between the two angle of attack sensors is standard, it does not function if the angle of attack display isn\u2019t installed. The non-functionality of this warning light is not documented.<\/p>\n
Recently, it is reported that rather than using experienced in-house experts, Boeing outsourced much of the development and testing of 737 MAX software to temporary-hire software developers paid as low as $9 an hour by Indian contractors HCL Technologies and Cyient.<\/p>\n
Boeing\u2019s Lack of Transparency<\/b><\/p>\n
Boeing obscures the existence of the MCAS flight control system as a fix to the aircraft flight characteristics problems.\u00a0 It doesn\u2019t have it reviewed by the FAA during the 737 MAX certification process, doesn\u2019t communicate about it to the airline customer technical representatives, doesn\u2019t document it in the flight manuals for the pilots, doesn\u2019t incorporate it in any training materials, and doesn\u2019t represent it in any 737 simulators for pilot training.\u00a0 Until the first crash of a 737 MAX in late 2018, no one outside Boeing even knows of the existence of the MCAS or the design of the systems feeding data to the MCAS.<\/p>\n
Certification of the 737 MAX<\/b><\/p>\n
The FAA takes a hands-off approach on certifying the 737 MAX and trusts Boeing to effectively self-certify the new aircraft.\u00a0 The type certificate from the original 737 design, nearly 50 years old, is used for the new variants. This policy is partly because the FAA certification department is drastically under-staffed due to many years of budget cutbacks.\u00a0 Other nations accept the FAA certification of the 737 MAX and do not independently evaluate the aircraft\u2019s design and airworthiness.<\/p>\n
Accidents and the Grounding of All 737 MAXs<\/b><\/p>\n
Two fatal crashes of 737 MAX aircraft occur in 5 months.\u00a0 The crashes, traceable to flight control problems unable to be overcome by the pilots, expose the existence of the MCAS.\u00a0 All 737 MAX aircraft worldwide are grounded until the aircraft can be determined to be safe. Airlines operating nearly 400 737 MAX aircraft scramble to replace the lost capacity with other aircraft.\u00a0 They are forced to cancel many scheduled flights, and incur significant financial losses.<\/p>\n
Investigations to determine the full details of the causes of the two crashes are underway, but will take a significant time to reach definitive conclusions. While the operation of the MCAS is clearly a factor, there are indications that a number of other aspects of the design may be involved in the overall failure chains.<\/p>\n
Passenger confidence in the 737 MAX series evaporates.\u00a0 People indicate they are unwilling to fly on a 737 MAX, at least until the aircraft is positively demonstrated to be safe.\u00a0 Aircrews also express apprehension about the airplane.<\/p>\n
Airlines begin cancelling their orders if they are able.\u00a0 However, their contracts with Boeing make this very difficult.<\/p>\n
Boeing continues to produce over 40 unmodified existing 737 MAX aircraft every month while no customers take delivery.\u00a0 Boeing has difficulty finding places to store all the airplanes coming off the production line. Employee parking lots are filled with 737 MAXs.<\/p>\n
Boeing management asserts in public testimony that the company has done nothing wrong.\u00a0 The 737 MAX design is safe, Boeing\u2019s design and certification processes for the airplane were sound, and that the pilots in the two crashes should have been able to overcome the problems even though they had no knowledge of the existence and operation of the MCAS.<\/p>\n
Boeing tries to show that pilots should have been able to deal with the problems in the two crashes by reproducing the conditions in simulators.\u00a0 However, the pilots in the simulator trials appear to have known what to expect, rather than being taken completely by surprise, so a successful recovery in a simulator may not be a realistic confirmation of the system safety.\u00a0 There are doubts that the simulator trials are realistic in other respects as well.<\/p>\n
Lawsuits against Boeing begin piling up, with many different plaintiffs filing suit.\u00a0 Boeing\u2019s stock price declines.<\/p>\n
At the same time as the 737 MAX crisis, news comes out about serious manufacturing defects in other Boeing jetliners currently being produced.\u00a0 These defects include tools, even ladders being left inside structural compartments after being closed up. The defects also include damage to electrical power and signal cabling that can cause shorts and defective data.\u00a0 The U.S. Air Force refuses to accept additional Boeing KC-45 tanker aircraft (modified 767s) because of these production quality control defects. Boeing 787 Dreamliners are also reported to have serious manufacturing quality control problems.<\/p>\n
A separate defect independent of the MCAS software is discovered in the 737 MAX flight control system. A microprocessor can get overwhelmed by the volume of data to be handled and cause significant delays in processing.<\/p>\n
Although the investigation of the detailed causes of the crashes is far from being completed, Boeing is desperate to get the 737 MAX back into service as soon as possible.\u00a0 Boeing engineers work on modifications to the MCAS software. However, no changes are made to the physical systems (sensors, signal and power buses, etc.). There is no guarantee that changes to the MCAS algorithms are sufficient to make the airplane safe.<\/p>\n
Problems with Boeing\u2019s Proposed Solution<\/b><\/p>\n
Boeing proposes the fix for the 737 MAX is a software change to the MCAS so that it will only push down one time and not repeatedly.<\/p>\n
This does not correct the multiple single-point-of-failure cases: depending on a single angle of attack sensor, a single data bus, and a single electrical circuit connecting the angle of attack information into the flight control computer.<\/p>\n
This also does not correct the fact that MCAS does not take into account other data that show the aircraft is\u00a0not<\/b>\u00a0in danger of stalling.\u00a0 The flight data recorders from both crashes indicate that the other systems were showing that the nose attitude was down (not up), the trim was full nose down, the altitude, airspeed, power, and ground proximity warning all provided contrary indications to a stall situation and were opposite to what MCAS was designed to prevent.\u00a0 A proper implementation of the MCAS would involve a complete integration with other flight data systems to provide backup, redundancy, and corroboration, so the MCAS cannot act alone or contrary to the majority of other indications.<\/p>\n
Furthermore, MCAS bypasses pilot display of the situation and pilot control as primary, contrary to all good transport aircraft design practice.<\/p>\n
There is a strong likelihood that damaged wiring may have caused the faulty inputs to the MCAS function.\u00a0 On one of the aircraft that crashed, the angle of attack sensor produced faulty readings on flights the previous day.\u00a0 Before the fatal flight, it was replaced with a brand new unit, indicating that the sensor itself was unlikely to be the source of the problems.\u00a0 Boeing\u2019s proposed fix does nothing to correct the possibility of damaged wiring from manufacturing quality control defects.<\/p>\n
In one of the 737 MAX crashes, it appears that the powered stabilizer trim may have re-engaged itself after the pilots acted to disengage it.\u00a0 This is not being addressed in Boeing\u2019s proposed MCAS software fix.<\/p>\n
The proposed fix does not have a means to disable the MCAS software functions altogether.\u00a0 MCAS will continue to operate, regardless of pilot actions.<\/p>\n
Boeing is not proposing to provide new training for 737 MAX pilots as part of the fix.\u00a0 In particular, 737 flight simulators are not being upgraded to accurately represent the MCAS functionality and possible failures.<\/p>\n
Importantly, Boeing is trying to avoid a full FAA (and other nation airworthiness agency) certification review of the modified aircraft, because this could delay returning the 737 MAX aircraft to service for a substantial period.<\/p>\n
Pilot Views<\/b><\/p>\n
Chesley “Sully” Sullenberger, the pilot for the \u201cMiracle on the Hudson\u201d water landing of an Airbus airliner in 2009, told the House Transportation Committee during a hearing on the 737 MAX that it is critical that pilots not be faced with “inadvertent traps.”\u00a0 He said “We must make sure that everyone who occupies a pilot seat is fully armed with the information, knowledge, training, skill and judgment to be able to be the absolute master of the aircraft and all its component systems and of the situations simultaneously and continuously throughout the flight.”\u00a0 Boeing\u2019s attempt to avoid specific training for the 737 MAX and its specific characteristics is viewed very negatively by pilots.<\/p>\n
Conclusions<\/b><\/p>\n
Boeing has been driven by economic incentives into producing a product with deficiencies, seriously harming its reputation as a trusted supplier of safe aircraft.\u00a0 By selling the 737 MAX as not requiring detailed certification review and needing no significant pilot training for the new characteristics of the aircraft, Boeing has failed in its responsibilities to be honest with regulatory authorities, airline customers, aircrews, and the flying public.\u00a0 It is not clear at the present time (July 2019) when appropriate corrective actions can be completed to make the 737 MAX aircraft safe to return to regular airline service, even as large numbers of unmodified aircraft continue to roll off the production lines.<\/p>\n
Appendix: Federal Aviation Regulation Airworthiness Criteria<\/b><\/p>\n\nSec. 25.173 \u2014 Static longitudinal stability.<\/b><\/li>\n<\/ul>\n Under the conditions specified in \u00a725.175, the characteristics of the elevator control forces (including friction) must be as follows:<\/p>\n
(a) A pull must be required to obtain and maintain speeds below the specified trim speed, and a push must be required to obtain and maintain speeds above the specified trim speed. This must be shown at any speed that can be obtained except speeds higher than the landing gear or wing flap operating limit speeds or\u00a0V<\/i>FC\/M<\/i>FC, whichever is appropriate, or lower than the minimum speed for steady unstalled flight.<\/p>\n
(b) The airspeed must return to within 10 percent of the original trim speed for the climb, approach, and landing conditions specified in \u00a725.175 (a), (c), and (d), and must return to within 7.5 percent of the original trim speed for the cruising condition specified in \u00a725.175(b), when the control force is slowly released from any speed within the range specified in paragraph (a) of this section.<\/p>\n
(c) The average gradient of the stable slope of the stick force versus speed curve may not be less than 1 pound for each 6 knots.<\/p>\n
(d) Within the free return speed range specified in paragraph (b) of this section, it is permissible for the airplane, without control forces, to stabilize on speeds above or below the desired trim speeds if exceptional attention on the part of the pilot is not required to return to and maintain the desired trim speed and altitude.<\/p>\n
[Amendment 25\u20137, 30 FR 13117, Oct. 15, 1965]<\/p>\n
\n25.601 General.<\/i><\/b><\/li>\n<\/ul>\n The\u00a0airplane<\/a>\u00a0may not have design features or details that experience has shown to be hazardous or unreliable. The suitability of each questionable design detail and part must be established by tests.<\/p>\n <\/p>\n","protected":false},"excerpt":{"rendered":"
The Boeing 737 MAX: A Case Study of Systems Decisions and Their Consequences Revised 3 July 2019 The Boeing 737 MAX program provides an illustrative […]<\/p>\n","protected":false},"author":3,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"site-sidebar-layout":"no-sidebar","site-content-layout":"page-builder","ast-site-content-layout":"","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"disabled","ast-breadcrumbs-content":"","ast-featured-img":"disabled","footer-sml-layout":"","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"default","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""}},"footnotes":""},"yoast_head":"\n
The Boeing 737 MAX: A Case Study of Systems Decisions and Their Consequences - The Systems Perspective<\/title>\n \n \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n\t \n