Category: Technology

mike.editor@midpush.com, updated 190412

On Tuesday, April 10, 2018, I was out working in the yard and listening to KGO radio. The radio announcer was Pat Thurston who was interviewing Ralph Nader. It turned out that Ralph Nader had lost a grandniece to the Ethiopian Airlines crash this last March. I could tell by the sound of his voice over the radio that he was deeply hurt by this loss. I do not wish him any ill feelings on this loss, but, he said a number of the things on the radio that seemed just wrong.

One item Ralph Nader stated the plane should be stall proof. What? As I pilot I’ve never heard of such a thing. Plane designers strive for gentle stall characteristics, but no plane is stall proof. At a certain speed, they just stop flying.

But could the 737 Max benefit from more gentle stall characteristics? Of course! And this is the start of the 737 Max issues.

When Boeing set out to design a plane of about the 737’s size, it quickly became apparent that a standard re-engine, with a more fuel efficient turbo-fan, would greatly improve the 737. But during flight testing they found the resultant plane, in a stalled, or high angle of attack configuration, would have a slight pitch up tendency at high angles of attack caused by additional lift being caused by the new, larger, engine nacelles in higher angle of attack situations. A pitch up at stall is not the best flight characteristic as it exacerbates the issue of exiting a stall cleanly.

However, pilots, from day one, are trained heavily in stall recovery, with the standard recovery method, of pushing the yoke/stick forward to initiate nose down, applying power as needed, and using the rudders to prevent drop-offs to the port and starboard sides thereby maintaining a straight flight profile

Since the 737 Max has a tendency to pitch up at stall, Boeing engineers came up with the MCAS (Maneuvering Characteristic Augmentation System) system to force the nose down in high angle of attack situations. It only activates when the flaps are retracted, and the autopilot system is disabled. If one of the Angle of Attack (AOA) sensors exceeds a window, it activates for ~5-9 seconds, activating the horizontal stabilizer for nose down trim, then waits 5 more seconds before reactivating again, if the condition still exists.

Both the Lion Air 610 and Ethiopian 304 flights appeared to have had bad AOA sensor input into the MCAS.

The first crash, a Lion Air 610 flight in October 2018, did not have the benefit of the knowledge on MCAS issues being well known. However, the day before, in a different flight, with the same plane, a skilled jump seat pilot, in the backsea,t was able to use the old existing procedure outlined in the 737 Flight crew manual, of disabling the trim. The following day, the same plane had a similar problem and crashed.

After this flight crashed the FAA and Boeing issued more detailed flight manuals and notices concerning what to do operationally when a runaway trim condition is encountered. After this event, all 737-MAX pilots should have taken note and followed up on findings as they become available. The issues were well publicized in the media, and as professionals, should have taken note. Additionally, all airlines should have had at least a discussion with their pilots on the MCAS subsystem.

The Ethiopian pilots should have disengaged MCAS immediately at the sign of runaway nose down trim. Letting MCAS run would require continually more and more stick/yoke back force to bring the nose back up. Eventually the aerodynamic forces become too great. On the Ethiopian flight, MCAS initially ran for two cycles. They then disabled it. It tried a third time, but had been disconnected. But then the pilots may have re-engaged the trim, and MCAS running for a fourth time could have been what sealed the flight’s fate as MCAS ran for the last time.

Flight 302 Event Timeline

Following is a timeline I found on a Seattle Times website. It provides a good visual. Following that is a timeline event description from an experienced 737 airline pilot. He describes these events in a video. If you are a pilot, you will find that video interesting.

• 5:38:00 – Flight 304 takes off, flaps at 5 degrees, trim at 5.6 units, throttles at 94%. (the throttles remained at 94% throughout the entire flight)
• 5:39:00 – Captain states he is trying to engage autopilot.
• 5:39:22 – At about 1,000 feet AGL(above ground level) the left autopilot is engaged. Pitch trim still 5.6 units
• 5:39:44 – Left and Right AOA sensor indicators began deviating. The left (shown above) is obviously reporting erroneous data. Right max was 15, left was above 74. At this time other left and right instrument readings, (ie airspeed), began deviating. The AOA sensors are a primary input into MCAS.
• 5:39:45 – Captain requests flaps up, and the copilots acknowledges. The captain also makes yoke initiated trim changes.
• 5:39:55 – The autopilot disengages, (with the auto pilot disengaged, and the flaps retracted, MCAS can now engage). An autopilot can disengage if it detects a grossly “out-of-trim” condition.
• 5:39:57 – The captain requests the first officer to maintain runway heading. A normal procedure during takeoff problems. They are having flight control problems.
• 5:40:00 – The aircraft recorder recorded 9 seconds of nose down trim, 4.6->2.1 units. This is MCAS detecting a perceived AOA issue, and trying to recover.
• At about this time they start getting ground proximity audio warnings, “don’t sink, don’t sink”, adding to the workload and confusion. The radar altimeter is the source of these warnings. They pull back on the yoke and the aircraft begins a climb.
• 5:40:12 – The captain adds yoke initiated up trim, changing the trim from 2.1-> 2.4 units. Good.
• 5:40:17 – The aircraft recorder records 9 seconds of nose down trim, MCAS activates with trim changing from 2.4->0.4 units.
• The pilot requests help from the first officer with the yoke and yoke trim. Yoke electric trim is used to trim nose up from 0.4->2.3 units. The yoke must have been heavy and hard to pull up at 0.4 units. Good.
• 5:40:35 – The first officer, (he had only 200 hours in type, “did recent” training, in type help here?), makes the right call to disengage the Cutout, the captain agrees. The Cutout disengages electrical trim. Leaving manual trim operative. But are the loads on the control surfaces too high to make it useful? The throttles are still at 94%.
• MCAS tries another run, the 3rd, but the trim is not effective as the crew has disengaged electric trim via the Cutout switch. Trim does not change.
• 5:41:20 – The right over-speed clacker is written on the recorder. This means the aircraft is operating at too high an airspeed. It remains on over-speed for the duration of the flight. Throttles are still at 94%. The aircraft is accelerating.
• 5:41:46 – The captain ask if the trim if operating? The first officer states, not working, but can he try manual. The captain told him to try.
• 5:41:54 – The first officer replies that the manual (non electrical) trim is not working. At their high speed, and in their trim condition, with high loads on the yoke to maintain altitude. The jack-screw (see below) may have too high a load on it to move easily. To reduce the load they would have to push, nose down. But, they are probably too near the ground for this maneuver.
• The elevator trim has slowly moved over the past few minutes from 2.3->2.1 units. This is a question, was it 1) elevator feel, 2) mach trim, 3) misapplying manual trim in the wrong direction?
• Throttles are still at 94%. The aircraft has accelerated to 340 knots, VMO (Max Operating Speed). The loads on the control surface are very high.
• 5:43:11 – Two momentary manual electrical nose up switches are noted on the recorder. (The big question, did they re-engage the Cutout switches?)
• ~5:43:20 – MCAS is alive again, nose down pitch runs for 5 seconds, 2.3->1.0 units, the aircraft began pitching nose down. At this high a speed, subtle changes in the control surfaces are magnified. The right airspeed indicator shows acceleration reaching 500 knots before the end of the recording. The throttles were maintained at 94% throughout the flight.

Nominally if an aircraft is going down. You want to cut-back the throttles, not leave them at 94%. That much throttle means speed, both in level flight, and definitely in a descent. Ideally throttling back, reducing airspeed, which would reduce aerodynamic pressure on the stabilizer, which would let the jack screw operate, under manual trim, to bring trim back into compliance. Lowering the nose, to also reduce aerodynamic pressure on the stabilizer, would unload the jack-screw. But this step requires altitude to work. Additionally the captain used his yoke mounted electrical trim effectively a number of times. Usage of this switch is supposed to override MCAS system, but once he let go the switch, MCAS would take over. Perhaps, Cutout On, yoke switch nose up, then Cutout immediately OFF.

Monday morning quarterbacking, with no stress or confusion, and reading how the systems work via the manuals. Not everybody has this luxury. Situational awareness and good training are key.

What Boeing Should Do

I am going to go out on the edge and state what is wrong with the MCAS design. Boeing will undoubtedly come up with a better design. This could be construed as Monday morning quarterbacking. Not my intention. I just get upset when emotion, rather than logic and facts, drive decisions and talk in the media. So I had to peer under the covers and beyond the media. As a retired software engineer, and a pilot, it bothers me when I see designs that can be improved. And if anybody who reads this disagrees or finds fault with anything here. I can correct it.

• When MCAS detects an angle of attack disparity, it activates the pitch trim, for nose down, for ~5-9 seconds. It does this continually resting every 5 seconds until the condition is alleviated. It should only do this once. And a cockpit annunciator should announce its activation, and maybe require an alarm reset. At this point the pilots would be alerted. And they should be capable of doing this work manually. The Ethiopian pilots should have deactivated MCAS, using the Cut-Out switches(shown below) on the first movement of the horizontal stabilizer trim via MCAS. They deactivated it after two cycles. But there was no alarm, and they were confused, as they most likely had not been trained on this sub-system, and had not encountered it in prior flights. For an individual pilot, AOA sensor failures are rare. But standard training scenarios are for “special situations”. It has been speculated that a bird strike may have taken the AOA sensor out.
• MCAS should never be allowed to run to full nose down trim. Unless the planes weight and balance were severely compromised, there should never be a need for this situation. The Ethiopian crash had full extension of the horizontal stabilizer jack-screw. The forces both from sheer speed, and trimming the plane improperly, would have made manual trimming exceedingly difficult, if not impossible.
• The MCAS system should take note of the airspeed of the aircraft. When the aircraft is doing 350+ knots, and the Angle of Attack sensors are showing 60 degrees of angle of attack. The software should realize this is wrong! If it were true. The wings of the aircraft could have been torn off from the aerodynamic forces on the wings. A 737 is not an F-16 doing combat maneuvers. High AOA angles are common in the slower phases of flight, not at higher air speeds.
• MCAS has two Angle of Attack (AOA) indicators. If the time sampled averages of the sensors differ by too large a delta. The system should realize it has a compromised system, one of the sensors was giving very bad data, and act accordingly with appropriate visual/audio warnings. What’s the point of two sensors if you only pay attention to the out-of-band unit?

• The 737 Max should require Type Certification by the pilots flying them. They should be tested on the operational usage of the system that differ from the previous plane. Obviously if you have pre-737 Type Certification, getting a 737 Max Certificate will not be as involved.
• The MCAS system was thought to be required as when the 737 nears a stall condition, as it has a tendency to pitch up. Ideally it would pitch nose down. Redesigning the engine nacelles, which generate too much lift at high angle of attacks, could help here. But, pilots are trained to avoid flying close to stall speeds. The non-pilot public, and legal teams, will focus on this facet of the problem.
• Boeing should make their options for this sub-system, standard. Key is the AOA sensor difference warning.
• Boeing needs to enforce a training program and require all pilots to be certified. Each country’s rules are different regarding training. Lessons Learned from prior events, ie the Oct/2018 Lion Air incident, and the Ethiopian Mar/2019 flight should be rolled into training. Were the Ethiopian pilots aware of the Airworthiness Directive 2018 23-51? Were they aware of the Oct/2018 crash and it causes? If not, why not?

Timeline (major)

• The first flight of the 737 Max took place on Jan 29, 2016, almost 49 years after the maiden flight of the first 737.

• 2018-10-29 – Lion Air Flight 610 crashes 13 minutes after takeoff. A different flight crew was on board and was unaware of the operational usage of the 727 MCAS. 189 people died. This is a serious training issue. The flight crew, aided by a non-official jump seat pilot the day before was successful in dis-engaging MCAS and using manual trim to fly the plane.
• 2018-11-07 – An investigation of the crash quickly pointed to the MCAS system. The FAA issues an Airworthiness Directive 2018 23-51 to describe and reinforce disabling a run-away trim condition.
• 2019-03-10 – Ethiopian Airlines Flight 302 crashes shortly after takeoff.
• 2019-03-11 – Countries begin grounding the 737 Max.
• 2019-03-13 – Trump makes an emergency order grounding the 737 Max in US.
• 2019-04-11 – Boeing states it has completed 96 flights with its upgrade MCAS software. Additionally the 737 MAX may not be suitable, for high altitude, higher temperature airports. High temperatures and altitude increase the density altitude requiring higher ground speeds for takeoff. Higher ground speeds means a longer takeoff roll. It will be interesting to see what they have come up with.

• MCAS has two Angle of Attack sensors, one on each side. The function of these sensor is to sense high angles of attack, (which could mean a stall is imminent). It then uses the 737 horizontal stabilizer jack-screw to raise the leading edge, pushing the nose down.

If you have sufficient altitude, you can manually go nose down to unload the forces on the jack-screw to return to normal trim. But if your altitude is in-sufficient, this option may not be available to the pilot. You may not be able to trim at high air-speeds while attempting up elevator because of the loading.

• 2019-mar-15 video(5:08), this video by Juan Brown describes the 737 horizontal stabilizer system.
• 2019-apr-03 video(24:27), this video by Juan Brown is an update to the video above. It also describes the aerodynamic forces at play that make trim operations more complicated because of forces on the horizontal stabilizer. At 16:33 Juan describes how trim may become in-effective at high air speeds and high load conditions. High load is caused by pulling back on the yoke, to attempt to climb.
• 2019-apr-10 video(16:27), this video by Juan Brown is an update to the video above.

About the Author: I have had an interest in aviation since childhood and obtained my pilots license in the late 70’s after high school. My profession, before retirement, was as a software engineer, and I did work as a subcontractor in the early 80’s for Boeing as part of the implementation team for a software flight system for a wing issue that was apparent during early airflow testing on either the 757 or 767. I can’t remember which model. Boeing however, solved the flight problem via a wing design change. Hence, the team was disbanded and I moved on to other endeavors. I am not an aviation “expert”.