Maneuvering Characteristics Augmentation System

From HandWiki
Revision as of 21:35, 6 February 2024 by JMinHep (talk | contribs) (simplify)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Short description: Aircraft control system involved in fatal accidents
Movable horizontal stabilizer of the 737 MAX

<section begin="summary" />The Maneuvering Characteristics Augmentation System (MCAS) is a flight stabilizing feature developed by Boeing that became notorious for its role in two fatal accidents of the 737 MAX, which killed all 346 passengers and crew among both flights. Systems similar to the Boeing 737 MCAS were previously included on the Boeing 707 and Boeing KC-46, a 767 variant.[1][2]

On the 737 MAX, MCAS was intended to mimic the flight behavior of the previous generation of the series, the Boeing 737 NG. During MAX flight tests, Boeing discovered that the position and larger size of the engines tended to push the nose up during certain maneuvers. Engineers decided to use MCAS to counter that tendency, since major structural redesign would have been prohibitively expensive and time-consuming. Boeing's goal was to have the MAX certified as another 737 version, which would appeal to airlines with the reduced cost of pilot training. The Federal Aviation Administration (FAA) approved Boeing's request to remove a description of MCAS from the aircraft manual, leaving pilots unaware of the system when the airplane entered service in 2017.[3]

After the fatal crash of Lion Air Flight 610 in 2018, Boeing and the FAA, still not revealing MCAS, referred pilots to a revised checklist procedure that must be performed in case of a malfunction. Boeing then received many requests for more information and revealed the existence of MCAS in another message, and that it could intervene without pilot input.[4][5] According to Boeing, MCAS was supposed to compensate for an excessive nose up angle by adjusting the horizontal stabilizer before the aircraft would potentially stall. Boeing denied that MCAS was an anti-stall system, and stressed that it was intended to improve the handling of the aircraft. Following the crash of Ethiopian Airlines Flight 302 in 2019, Ethiopian authorities stated that the procedure did not enable the crew to prevent the accident, which occurred while a fix to MCAS was under development.[6] This incident prompted the world to react and ground 737 MAX planes across the globe.

Boeing admitted MCAS played a role in both accidents, when it acted on false data from a single angle of attack (AoA) sensor. In 2020, the FAA, Transport Canada, and European Union Aviation Safety Agency (EASA) evaluated flight test results with MCAS disabled, and suggested that the MAX might not have needed MCAS to conform to certification standards.[7] Later that year, an FAA Airworthiness Directive[8] approved design changes for each MAX aircraft, which would prevent MCAS activation unless both AoA sensors register similar readings, eliminate MCAS's ability to repeatedly activate, and allow pilots to override the system if necessary. The FAA began requiring all MAX pilots to undergo MCAS-related training in flight simulators by 2021.<section end="summary" />

Background

The 737 MAX uses an adjustable stabilizer, moved by a jackscrew, to provide the required pitch trim forces. Generic stabilizer illustrated.

In the 1960s, a basic pitch control system to avoid stalling was installed in the Boeing 707.[1] Later, a similar system, in this case specifically called MCAS, was implemented on the Boeing KC-46 Pegasus military aerial refueling tanker.[2] The KC-46, which is based on the Boeing 767, requires MCAS because the weight and balance shifts when the tanker redistributes and offloads fuel.[2] On that aircraft, the MCAS is overriden and disengaged when a pilot makes a stick input.[2]

Another MCAS implementation was developed for the Boeing 737 MAX, because its larger, repositioned engines changed the aircraft's flight characteristics compared to the preceding 737 generations.[9][10] When a single angle of attack (AoA) sensor indicated that the angle was too high, MCAS would trim the horizontal stabilizer in the nose-down direction.[11] Boeing did this to meet the company's objective of minimizing training requirements for pilots already qualified on the 737NG, which Boeing felt would make the new variant more appealing to aircraft customers that would prefer not to bear the costs of differences training.[12] However, according to interviews with agency directors describing assessments undertaken after the MCAS-induced crashes had occurred, both the FAA and EASA felt that the aircraft would have had acceptable stability, even without MCAS.[12]

737-200 JT8D engine with original cowling design
737-800 (Next Generation) CFM56 engine, forward of the wing, with flat bottom shape
737 MAX 9 CFM LEAP-1B engine, further forward from the wing and higher off the ground

Role of MCAS in accidents

The tracking data of Lion Air Flight 610 from Flightradar24
Vertical airspeeds of Boeing Max 737s in 2018-2019 crashes
The vertical airspeeds of the Boeing 737 MAX 8s involved in the JT 610 and ET 302 crashes

For flights ET 302 and JT 610, investigators determined that MCAS was triggered by falsely high AoA inputs, as if the plane had pitched up excessively. On both flights, shortly after takeoff, MCAS repeatedly actuated the horizontal stabilizer trim motor to push down the airplane nose.[13][14][15][16] Satellite data for the flights showed that the planes struggled to gain altitude.[17] Pilots reported difficulty controlling the airplane and asked to return to the airport.[18][19] The implementation of MCAS has been found to disrupt autopilot operations.[20]

On March 11, 2019, after China had grounded the aircraft,[21] Boeing published some details of new system requirements for the MCAS software and for the cockpit displays, which it began implementing in the wake of the prior accident five months earlier:[13]

  • If the two AoA sensors disagree with the flaps retracted, MCAS will not activate and an indicator will alert the pilots.
  • If MCAS is activated in non-normal conditions, it will only "provide one input for each elevated AoA event."
  • Flight crew will be able to counteract MCAS by pulling back on the column.

On March 27, Daniel Elwell, the acting administrator of the FAA, testified before the Senate Committee on Commerce, Science, and Transportation, saying that on January 21, "Boeing submitted a proposed MCAS software enhancement to the FAA for certification. ... the FAA has tested this enhancement to the 737 MAX flight control system in both the simulator and the aircraft. The testing, which was conducted by FAA flight test engineers and flight test pilots, included aerodynamic stall situations and recovery procedures."[22] After a series of delays, the updated MCAS software was released to the FAA in May 2019.[23][24] On May 16, Boeing announced that the completed software update was awaiting approval from the FAA.[25][26] The flight software underwent 360 hours of testing on 207 flights.[27] Boeing also updated existing crew procedures.[13]

On April 4, 2019, Boeing publicly acknowledged that MCAS played a role in both accidents.[28]

Purpose of MCAS and the stabilizer trim system

The FAA and Boeing both disputed media reports describing MCAS as an anti-stall system, which Boeing asserted it is distinctly not and instead a system that's designed to provide handling qualities for the pilot that meet pilot preferences.[29][30][31][32] The aircraft had to perform well in a low-speed stall test.[33] The Template:Pslink (JATR) "considers that the STS/MCAS and elevator feel shift (EFS) functions could be considered as stall identification systems or stall protection systems, depending on the natural (unaugmented) stall characteristics of the aircraft".

The JATR said, "MCAS used the stabilizer to change the column force feel, not trim the aircraft. This is a case of using the control surface in a new way that the regulations never accounted for and should have required an issue paper for further analysis by the FAA. If the FAA technical staff had been fully aware of the details of the MCAS function, the JATR team believes the agency likely would have required an issue paper for using the stabilizer in a way that it had not previously been used; this [might have] identified the potential for the stabilizer to overpower the elevator."[34]

Description

An angle of attack (AOA) sensor.

Background

The Maneuvering Characteristics Augmentation System (MCAS) is a flight control law[35] built into the Boeing 737 MAX's flight control computer, designed to help the aircraft emulate the handling characteristics of the earlier Boeing 737 Next Generation. According to an international Civil Aviation Authorities team review (JATR) commissioned by the FAA, MCAS may be a stall identification or protection system, depending on the natural (unaugmented) stall characteristics of the aircraft.[34][36][37] Boeing considered MCAS part of the flight control system, and elected to not describe it in the flight manual or in training materials, based on the fundamental design philosophy of retaining commonality with the 737NG. Minimizing the functional differences between the Boeing 737 MAX and Next Generation aircraft variants allowed both variants to share the same type rating. Thus, airlines can save money by employing and training one pool of pilots to fly both variants of the Boeing 737 interchangeably.[38]

When activated, MCAS directly engages the horizontal stabilizer, this is distinct from an anti-stall device, such as stick pusher, which physically moves the pilot's control column forward and engages the airplane's elevators when the airplane is approaching a stall.

Boeing's former CEO Dennis Muilenburg said "[MCAS] has been reported or described as an anti-stall system, which it is not. It's a system that's designed to provide handling qualities for the pilot that meet pilot preferences."[32]

The 737 MAX's larger CFM LEAP-1B engines are fitted farther forward and higher up than in previous models. The aerodynamic effect of its nacelles contributes to the aircraft's tendency to pitch up at high angles of attack (AOA). The MCAS is intended to compensate in such cases, modeling the pitching behavior of previous models, and meet a certain certification requirement,[33] in order to enhance handling characteristics and thus minimizing the need for significant pilot retraining.[39][40][32]

The software code for the MCAS function and the computer for executing the software are built to Boeing's specifications by Collins Aerospace, formerly Rockwell Collins.[41]

As an automated corrective measure, the MCAS was given full authority to bring the aircraft nose down, and could not be overridden by pilot resistance against the control wheel as on previous versions of the 737.[42] Following the Lion Air accident, Boeing issued an Operations Manual Bulletin (OMB)[43] on November 6, 2018, to outline the many indications and effects resulting from erroneous AOA data and provided instructions to turn off the motorized trim system for the remainder of the flight, and trim manually instead. Until Boeing supplemented the manuals[44] and training, pilots were unaware of the existence of MCAS due to its omission from the crew manual and no coverage in training.[42] Boeing first publicly named and revealed the existence of MCAS on the 737 MAX in a message to airline operators and other aviation interests on November 10, 2018, twelve days after the Lion Air crash.[45]

Safety engineering and human factors

As with any other equipment on board an aircraft, the FAA approves a functional "design assurance level" corresponding to the consequences of a failure, using the SAE International standards ARP4754 and ARP4761. MCAS was designated a "hazardous failure" system. This classification corresponds to failures causing "a large reduction in safety margins" or "serious or fatal injury to a relatively small number of the occupants", but nothing "catastrophic".[46]

The MCAS was designed with the assumption, approved by FAA, that pilots would react to an unexpected activation within three seconds.[47]

Technology readiness

The MCAS design parameters originally envisioned automated corrective actions to be taken in cases of high AoA and g-forces beyond normal flight conditions. Test pilots routinely push aircraft to such extremes, as the FAA requires airplanes to perform as expected. Before the MCAS, test pilot Ray Craig determined the plane did not fly smoothly, in part due to the larger engines. Craig would have preferred an aerodynamic solution, but Boeing decided to implement a control law in software.

According to a news report in the Wall Street Journal, engineers who had worked on the KC-46A Pegasus tanker, which includes an MCAS function, suggested MCAS to the design team.[48]

With the MCAS implemented, new test pilot Ed Wilson said the "MAX wasn't handling well when nearing stalls at low speeds" and recommended MCAS to apply across a broader range of flight conditions. This required the MCAS to function under normal g-forces and, at stalling speeds, deflect the vertical trim more rapidly and to a greater extent—but now it reads a single AoA sensor, creating a single point of failure that allowed false data to trigger MCAS to pitch the nose downward and force the aircraft into a dive.[49][39] "Inadvertently, the door was now opened to serious system misbehavior during the busy and stressful moments right after takeoff", said Jenkins of The Wall Street Journal .[50]

The FAA did not conduct a safety analysis on the changes. It had already approved the previous version of MCAS, and the agency's rules did not require it to take a second look because the changes did not affect how the plane operated in extreme situations.[51]

The Joint Authorities Technical Review found the technology unprecedented: "If the FAA technical staff had been fully aware of the details of the MCAS function, the JATR team believes the agency likely would have required an issue paper for using the stabilizer in a way that it had not previously been used. MCAS used the stabilizer to change the column force feel, not trim the aircraft. This is a case of using the control surface in a new way that the regulations never accounted for and should have required an issue paper for further analysis by the FAA. If an issue paper had been required, the JATR team believes it likely would have identified the potential for the stabilizer to overpower the elevator."[34]

In November 2019, Jim Marko, a manager of aircraft integration and safety assessment at Transport Canada aviation regulator's National Aircraft Certification Branch questioned the readiness of MCAS. Because new problems kept emerging, he suggested to his peers at FAA, ANAC and EASA to consider the safety benefits of removing MCAS from the MAX.[52]

Scrutiny

The MCAS came under scrutiny following the fatal crashes of Lion Air Flight 610 and Ethiopian Airlines Flight 302 soon after takeoff. The Boeing 737 MAX global fleet was grounded by all airlines and operators, and a number of functional issues were raised.[53][54][55]

The MCAS deflects the horizontal stabilizer four times farther than was stated in the initial safety analysis document.[53] Due to the amount of trim the system applies to the horizontal stabilizer, aerodynamic forces resist pilot control effort to raise the nose. As long as the faulty AOA readings persist, a human pilot "can quickly become exhausted trying to pull the column back".[56] In addition, switches for the horizontal stabilizer trim assist now serve a shared purpose of turning off automated systems such as MCAS as well as the trim buttons on the yoke, whereas in previous 737 models each could be switched off independently. In simulator sessions, pilots were stunned by the substantial effort needed to manually crank the trim wheel out of its nose down setting when the trim assist was deactivated.[57][58][59]

Boeing CEO Dennis Muilenburg has stated that there was "no surprise, or gap, or unknown here or something that somehow slipped through a certification process."[60] On April 29, 2019, he stated the design of the aircraft was not flawed and reiterated that it was designed per Boeing's standards.[61] In a May 29 interview with CBS, Boeing admitted that it had botched the software implementation and lamented the poor communications.[62]

On September 26, the National Transportation Safety Board criticized Boeing's inadequate testing of the 737 MAX, and pointed out that Boeing made erroneous assumptions on pilots' response to alerts in 737 MAX, triggered by activation of MCAS due to a faulty signal from an angle-of-attack sensor.[63][64]

The Joint Authorities Technical Review (JATR), a team commissioned by the FAA for 737 MAX investigation, concluded that FAA failed to properly review MCAS. Boeing failed to provide adequate and updated technical information regarding the MCAS system to FAA during Boeing 737 Max certification process, and had not carried out a thorough verification by stress-testing of the MCAS system.[37][65]

On October 18, Boeing turned over a discussion from 2016 between two employees that revealed prior issues with the MCAS system.[66]

Boeing's own internal design guidelines related to the 737 MAX's development stated that the system should "not have any objectionable interaction with the piloting of the airplane" and "not interfere with dive recovery".[67] The operation of MCAS violated those.[68]

National Transportation Safety Board

On September 26, 2019, the National Transportation Safety Board (NTSB) released the results of its review of potential lapses in the design and approval of the 737 MAX.[69][70][71] The NTSB report concludes that assumptions "that Boeing used in its functional hazard assessment of uncommanded MCAS function for the 737 MAX did not adequately consider and account for the impact that multiple flight deck alerts and indications could have on pilots' responses to the hazard".[70](p8) When Boeing induced a stabilizer trim input that simulated the stabilizer moving consistent with the MCAS function,

the specific failure modes that could lead to unintended MCAS activation (such as an erroneous high AOA input to the MCAS) were not simulated as part of these functional hazard assessment validation tests. As a result, additional flight deck effects (such as IAS DISAGREE and ALT DISAGREE alerts and stick shaker activation) resulting from the same underlying failure (for example, erroneous AOA) were not simulated and were not in the stabilizer trim safety assessment report reviewed by the NTSB."[70](p5)[72]

The NTSB questioned the long-held industry and FAA practice of assuming the nearly instantaneous responses of highly trained test pilots as opposed to pilots of all levels of experience to verify human factors in aircraft safety.[73] The NTSB expressed concerns that the process used to evaluate the original design needs improvement because that process is still in use to certify current and future aircraft and system designs. The FAA could, for example, randomly sample pools from the worldwide pilot community to obtain a more representative assessment of cockpit situations.[74]

Supporting systems

The updates proposed by Boeing focus mostly on MCAS software.[35] In particular, there have been no public statements regarding reverting the functionality of the stabilizer trim cutout switches to pre-MAX configuration. A veteran software engineer and experienced pilot suggested that software changes may not be enough to counter the 737 MAX's engine placement.[75] The Seattle Times noted that while the new software fix Boeing proposed "will likely prevent this situation recurring, if the preliminary investigation confirms that the Ethiopian pilots did cut off the automatic flight-control system, this is still a nightmarish outcome for Boeing and the FAA. It would suggest the emergency procedure laid out by Boeing and passed along by the FAA after the Lion Air crash is wholly inadequate and failed the Ethiopian flight crew."[76]

Boeing and the FAA decided that the AoA display and an AoA disagree light, which signals if the sensors give different readings, were not critical features for safe operation.[77] Boeing charged extra for the addition of the AoA indicator to the primary display.[78][79] In November 2017, Boeing engineers discovered that the standard AoA disagree light cannot independently function without the optional AoA indicator software, a problem affecting 80% of the global fleet that had not ordered the option.[80][81] The software remedy was scheduled to coincide with the roll out of the elongated 737 MAX 10 in 2020, only to be accelerated by the Lion Air accident. Furthermore, the problem had not been disclosed to the FAA until 13 months after the fact. Although it is unclear whether the indicator could have changed the outcome for the ill-fated flights, American Airlines said the disagree indicator provided the assurance in continued operations of the airplane. "As it turned out, that wasn't true."[82]

Runaway stabilizer and manual trim

In February 2016, the EASA certified the MAX with the expectation that pilot procedures and training would clearly explain unusual situations in which the seldom used manual trim wheel would be required to trim the plane, i.e. adjust the angle of the nose; however, the original flight manual did not mention those situations.[83] The EASA certification document referred to simulations whereby the electric thumb switches were ineffective to properly trim the MAX under certain conditions. The EASA document said that after flight testing, because the thumb switches could not always control trim on their own, the FAA was concerned by whether the 737 MAX system complied with regulations.[84] The American Airlines flight manual contains a similar notice regarding the thumb switches but does not specify conditions where the manual wheel may be needed.[84]

Boeing's CEO Muilenburg, when asked about the non-disclosure of MCAS, cited the "runaway stabilizer trim" procedure as part of the training manual. He added that Boeing's bulletin pointed to that existing flight procedure. Boeing views the "runaway stabilizer trim" checklist as a memory item for pilots. Mike Sinnett, vice president and general manager for the Boeing New Mid-Market Airplane (NMA) since July 2019, repeatedly described the procedure as a "memory item".[85] However, some airlines view it as an item for the quick reference card.[86] The FAA issued a recommendation about memory items in an Advisory Circular, Standard Operating Procedures and Pilot Monitoring Duties for Flight Deck Crewmembers: "Memory items should be avoided whenever possible. If the procedure must include memory items, they should be clearly identified, emphasized in training, less than three items, and should not contain conditional decision steps."[87]

In November 2018, Boeing told airlines that MCAS could not be overcome by pulling back on the control column to stop a runaway trim as on previous generation 737s.[88] Nevertheless, confusion continued: the safety committee of a major U.S. airline misled its pilots by telling that the MCAS could be overcome by "applying opposite control-column input to activate the column cutout switches".[89] Former pilot and CBS aviation & safety expert Chesley Sullenberger testified, "The logic was that if MCAS activated, it had to be because it was needed, and pulling back on the control wheel shouldn't stop it."[90] In October, Sullenberger wrote, "These emergencies did not present as a classic runaway stabilizer problem, but initially as ambiguous unreliable airspeed and altitude situations, masking MCAS."[91]

In a legal complaint against Boeing, the Southwest Airlines Pilot Association states:[92]

An MCAS failure is not like a runaway stabilizer. A runaway stabilizer has continuous un-commanded movement of the tail, whereas MCAS is not continuous and pilots (theoretically) can counter the nose-down movement, after which MCAS would move the aircraft tail down again. Moreover, unlike runaway stabilizer, MCAS disables the control column response that 737 pilots have grown accustomed to and relied upon in earlier generations of 737 aircraft.

Stabilizer cutoff switches re-wiring

The trim wheel and cutoff switches in a previous generation cockpit

In May 2019, The Seattle Times reported that the two stabilizer cutoff switches, located on the center console, operate differently on the MAX than on the earlier 737 NG. On previous aircraft, one cutoff switch deactivates the thumb buttons on the control yoke that pilots use to move the horizontal stabilizer; the other cutoff switch disables automatic control of the horizontal stabilizer by autopilot or STS/MCAS. On the MAX, both switches are wired in series and perform the same function: they cut off all electric power to the stabilizer, both from the yoke buttons and from an automatic system.

Thus, on previous aircraft it is possible to disable automatic control of the stabilizer yet to employ electric power assist by operating the yoke switches. On the MAX, with all power to the stabilizer cut, pilots have no choice but to use the mechanical trim wheel in the center console.[93]

Manual trim stiffness

As pilots pull on the 737 controls to raise the nose of the aircraft, aerodynamic forces on the elevator create an opposing force, effectively paralyzing the jackscrew mechanism that moves the stabilizer.[94] It becomes very difficult for pilots to hand crank the trim wheel.[94] The problem was encountered on earlier 737 versions, and a "roller coaster" emergency technique for handling the flight condition was documented in 1982 for the 737-200 but did not appear in training documentation for later versions (including the MAX).[94]

This problem was originally found in the early 1980s with the 737-200 model. When the elevator operated to raise or lower the nose, it set up a strong force on the trim jackscrew that opposed any corrective force from the control systems. When attempting to correct an unwanted deflection using the manual trim wheel, exerting enough hand force to overcome the force exerted by the elevator became increasingly difficult as speed and deflection increased and the jackscrew effectively jammed in place.[95]

For the 737-200, a workaround called the "roller coaster" technique was developed. Counter-intuitively, to correct an excessive deflection causing a dive the pilot first pushes the nose down further, before easing back to gently raise the nose again.[96] During this easing back period, the elevator deflection reduces or even reverses, its force on the jackscrew does likewise and the manual trim eases up. The workaround was included in the pilot's emergency procedures and in the training schedule.[95]

While the 737 MAX has a similar jackscrew mechanism, the "roller coaster" technique has been dropped from the pilot information. During the events leading to the two MAX crashes, the stiffness of the manual trim wheel repeatedly prevented manual trim adjustment to correct the MCAS-induced nose-down pitching. The issue has been brought to the notice of the DoJ criminal inquiry into the 737 MAX crashes.[95]

In simulator tests of Ethiopian Airlines Flight 302 flight scenario, the trim wheel was "impossible" to move when one of the pilots would instinctively pull up from the nosedives. It takes 15 turns to manually trim the aircraft one degree, and up to 40 turns to bring the trim back to neutral from the nose down position caused by MCAS.[97]

Horizontal stabilizer actuator

The horizontal stabilizer is fitted with a conventional elevator for flight control. However, it is itself all-moving about a single pivot and can be trimmed to adjust its angle. The trim is actuated via a jackscrew mechanism.

Slippage concern

Engineers Sylvain Alarie and Gilles Primeau, experts on horizontal stabilizers consulted by Radio-Canada, observed anomalies in the data recorded during the Lion Air and Ethiopian Airlines crashes: a progressive shift of the horizontal stabilizer by 0.2°, before the crash.[98] In reference to the Ethopian Airlines flight, Alarie noted that without receiving a command from the MCAS or the pilots, the jackscrew slipped, and then slipped again as the aircraft accelerated and dove.[98] Primeau noted that this deflection was an order of magnitude larger than what would ordinarily be permitted, and they concluded that these deflections were disallowed by FAA regulation 395A.[98] These experts are concerned that the loads on the jackscrew have potentially increased since the creation of the 737, modern versions of which are considerably larger than the original design.[98]

These experts have raised concerns about the motors possibly overheating in April 2019.[99]

MCAS circumvention for ferry flights

During the groundings, special flights to reposition MAX aircraft to storage locations, as per 14 CFR § 21.197, flew at lower altitude and with flaps extended to circumvent MCAS activation, rather than using the recovery procedure after the fact. Such flights required a certain pilot qualification as well as permission from corresponding regulators, and with no other cabin crew or passengers.[100][101]

Angle of attack

As per Boeing technical description: "the Angle of Attack (AoA) is an aerodynamic parameter that is key to understanding the limits of airplane performance. Recent accidents and incidents have resulted in new flight crew training programs, which in turn have raised interest in AoA in commercial aviation. Awareness of AOA is vitally important as the airplane nears stall."[102] Chesley Sullenberger said AoA indicators might have helped in these two crashes. "It is ironic that most modern aircraft measure (angle of attack) and that information is often used in many aircraft systems, but it is not displayed to pilots. Instead, pilots must infer (angle of attack) from other parameters, deducing it indirectly."[103]

AoA sensors

Though there are two sensors on the MAX only one of them is used at a time to trigger MCAS activation on the 737 MAX. Any fault in this sensor, perhaps due to physical damage,[90] creates a single point failure: the flight control system lacks any basis for rejecting its input as faulty information.

Reports of a single point of failure were not always acknowledged by Boeing. Addressing American Airlines pilots, Boeing vice-president Mike Sinnett contradicted reports that the MCAS had a single-point failure, because the pilots themselves are the backup. Reporter Useem said in The Atlantic it was "showing both a misunderstanding of the term and a sharp break from Boeing's long-standing practice of having multiple backups for every flight system".[104]

Problems with the AoA sensor had been reported in over 200 incident reports submitted to the FAA; however, Boeing did not flight test a scenario in which it malfunctioned.[105]

The sensors themselves are under scrutiny. Sensors on the Lion air aircraft were supplied by United Technologies' Rosemount Aerospace.[106]

In September 2019, the EASA said it prefers triple-redundant AoA sensors rather than the dual redundancy in Boeing's proposed upgrade to the MAX.[107] Installation of a third sensor could be expensive and take a long time. The change, if mandated, could be extended to thousands of older model 737s in service around the world.[107]

A former professor at Embry-Riddle Aeronautical University, Andrew Kornecki, who is an expert in redundancy systems, said operating with one or two sensors "would be fine if all the pilots were sufficiently trained in how to assess and handle the plane in the event of a problem". But, he would much prefer building the plane with three sensors, as Airbus does.[108]

AoA Disagree alert

In November 2017, after several months of MAX deliveries, Boeing discovered that the AoA Disagree message, which is indicative of potential sensor mismatch on the primary flight display,[109] was unintentionally disabled.[13]

Clint Balog, a professor at Embry-Riddle Aeronautical University, said after the Lion Air crash: "In retrospect, clearly it would have been wise to include the warning as standard equipment and fully inform and train operators on MCAS".[110] According to Bjorn Fehrm, Aeronautical and Economic Analyst at Leeham News and Analysis, "A major contributor to the ultimate loss of JT610 is the missing AoA DISAGREE display on the pilots' displays."[111]

The software depended on the presence of the visual indicator software, a paid option that was not selected by most airlines.[112] For example, Air Canada, American Airlines and Westjet had purchased the disagree alert, while Air Canada and American Airlines also purchased, in addition, the AoA value indicator, and Lion Air had neither.[113][114] Boeing had determined that the defect was not critical to aircraft safety or operation, and an internal safety review board (SRB) corroborated Boeing's prior assessment and its initial plan to update the aircraft in 2020. Boeing did not disclose the defect to the FAA until November 2018, in the wake of the Lion Air crash.[115][116][117][118] Consequently, Southwest had informed pilots that its entire fleet of MAX 8 aircraft will receive the optional upgrades.[119][120] In March 2019, after the second accident of Ethiopian Airlines Flight 302, a Boeing representative told Inc. magazine, "Customers have been informed that AoA Disagree alert will become a standard feature on the 737 MAX. It can be retrofitted on previously delivered airplanes."[121]

On May 5, 2019, The Wall Street Journal reported that Boeing had known of existing problems with the flight control system a year before the Lion Air accident.[122] Boeing defended that "Neither the angle of attack indicator nor the AoA Disagree alert are necessary for the safe operation of the airplane." Boeing recognized that the defective software was not implemented to their specifications as a "standard, standalone feature." Boeing stated, "...MAX production aircraft will have an activated and operable AoA Disagree alert and an optional angle of attack indicator. All customers with previously delivered MAX airplanes will have the ability to activate the AoA Disagree alert."[116] Boeing CEO Muilenburg said the company's communication about the alert "was not consistent. And that's unacceptable."[123][116]

Visual AoA indicator

The primary flight display of a Boeing 737-800 aircraft with a functional angle of attack display on the upper right; the AoA Disagree alert would appear as a text message.

Boeing published an article in Aero magazine about AoA systems, "Operational use of Angle of Attack on modern commercial jet planes":

The AoA indicator can be used to assist with unreliable airspeed indications as a result of blocked pitot or static ports and may provide additional situation and configuration awareness to the flight crew.[102]

Boeing announced a change in policy in the Frequently Asked Questions (FAQ) about the MAX corrective work, "With the software update, customers are not charged for the AoA Disagree feature or their selection of the AoA indicator option."[124]

In 1996, the NTSB issued Safety Recommendation A-96-094.

TO THE FEDERAL AVIATION ADMINISTRATION (FAA): Require that all transport-category aircraft present pilots with angle-of-attack info in a visual format, and that all air carriers train their pilots to use the info to obtain maximum possible airplane climb performance.

The NTSB also stated about another accident in 1997, that "a display of angle of attack on the flight deck would have maintained the flightcrew's awareness of the stall condition and it would have provided direct indication of the pitch attitudes required for recovery throughout the attempted stall recovery sequence." The NTSB also believed that the accident may have been prevented if a direct indication of AoA was presented to the flightcrew (NTSB, 1997)."[125](p29)

Flight computer architecture

In early April 2019, Boeing reported a problem with software affecting flaps and other flight-control hardware, unrelated to MCAS; classified as critical to flight safety, the FAA has ordered Boeing to fix the problem correspondingly.[126] In October 2019, the EASA has suggested to conduct more testing on proposed revisions to flight-control computers due to its concerns about portions of proposed fixes to MCAS.[127] The necessary changes to improve redundancy between the two flight control computers have proved more complex and time-consuming than the fixes for the original MCAS issue, delaying any re-introduction to service beyond the date originally envisaged.[128]

In January 2020, new software issues were discovered, affecting monitoring of the flight computer start-up process and verifying readiness for flight.[129] In April 2020, Boeing identified new risks where the trim system might unintentionally command nose down during flight or prematurely disconnect the autopilot.[130]

Microprocessor stress testing

The MAX systems are integrated in the "e-cab" test flight deck, a simulator built for developing the MAX.[131][132] In June 2019, "in a special Boeing simulator that is designed for engineering reviews,"[133] FAA pilots performed a stress testing scenario – an abnormal condition identified through FMEA after the MCAS update was implemented[134] – for evaluating the effect of a fault in a microprocessor: as expected from the scenario, the horizontal stabilizer pointed the nose downward. Although the test pilot ultimately recovered control, the system was slow to respond to the proper runaway stabilizer checklist steps. Boeing initially classified this as a "major" hazard, and the FAA upgraded it to a much more severe "catastrophic" rating. Boeing stated that the issue can be fixed in software.[135] The software change will not be ready for evaluation until at least September 2019.[136] EASA director Patrick Ky said that retrofitting additional hardware is an option to be considered.[20]

The test scenario simulated an event toggling five bits in the flight control computer. The bits represent status flags such as whether MCAS is active, or whether the tail trim motor is energized. Engineers were able to simulate single event upsets and artificially induce MCAS activation by manipulating these signals. Such a fault occurs when memory bits change from 0 to 1 or vice versa, which is something that can be caused by cosmic rays striking the microprocessor.[137]

The failure scenario was known before the MAX entered service in 2017: it had been assessed in a safety analysis when the plane was certified. Boeing had concluded that pilots could perform a procedure to shut off the motor driving the stabilizer to overcome the nose-down movement.[138] The scenario also affects 737NG aircraft, though it presents less risk than on the MAX; on the NG, moving the yoke counters any uncommanded stabilizer input, but this function is bypassed on the MAX to avoid negating the purpose of MCAS.[139] Boeing also said that it agreed with additional requirements that the FAA required it to fulfill, and added that it was working toward resolving the safety risk. It will not offer the MAX for certification until all requirements have been satisfied.[135]

Early news reports were inaccurate in attributing the problem to an 80286[140] microprocessor overwhelmed with data, though as of April 2020 the concern remains that the MCAS software is overloading the 737 MAX's computers.[141]

Computer redundancy

(As of 2019), the two flight control computers of Boeing 737 never cross-checked each other's operations; i.e., each was a single non-redundant channel. This lack of robustness existed since the early implementation and persisted for decades.[137] The updated flight control system will use both flight control computers and compare their outputs. This switch to a fail-safe two-channel redundant system, with each computer using an independent set of sensors, is a radical change from the architecture used on 737s since the introduction on the older model 737-300 in the 1980s. Up to the MAX in its prior-to-grounding-version, the system alternates between computers after each flight.[137] The two computers' architecture allowed switching in-flight if the operating computer failed, thus increasing availability. In the revised architecture, Boeing required the two computers to monitor each other so that each one can vet the other.[128]

Trim system malfunction indicator

In January 2020, during flight testing, Boeing discovered a problem with an indicator light; the defect was traced to the "redesign of the two flight computers that control the 737 MAX to make them more resilient to failure". The indicator, which signals a problem with the trim system, can remain on longer than intended by design.[142][143]

Updates for return to service

In November 2020, an Airworthiness Directive required corrective actions to the airplane's flight control laws (embodied in the Speed Trim System software):

  • The new flight control laws now require inputs from both AOA sensors in order to activate MCAS. They also compare the inputs from the two sensors, and if those inputs differ significantly (greater than 5.5 degrees for a specified period of time), will disable the Speed Trim System (STS), which includes MCAS, for the remainder of the flight and provide a corresponding indication of that deactivation on the flight deck.
  • The new flight control laws now permit only one activation of MCAS per sensed high-AOA event, and limit the magnitude of any MCAS command to move the horizontal stabilizer such that the resulting position of the stabilizer will preserve the flightcrew's ability to control the airplane's pitch by using only the control column. This means the pilot will have sufficient control authority without the need to make electric or manual stabilizer trim inputs.
  • The new flight control laws also include Flight Control Computer (FCC) integrity monitoring of each FCC's performance and cross-FCC monitoring, which detects and stops erroneous FCC-generated stabilizer trim commands (including MCAS)[144]

References

  1. ↑ 1.0 1.1 (in en) A Basic "MCAS" System was installed in the Boeing 707 in the 1960s, November 1, 2019, https://leehamnews.com/2019/11/01/a-basic-mcas-system-was-installed-in-the-boeing-707-in-the-1960s/, retrieved January 3, 2021 
  2. ↑ 2.0 2.1 2.2 2.3 (in en-US) USAF Reviewing Training After MAX 8 Crashes; KC-46 Uses Similar MCAS, March 22, 2019, https://www.airforcemag.com/usaf-reviewing-training-after-max-8-crashes-kc-46-uses-similar-mcas-system/, retrieved August 1, 2021 
  3. ↑ Laris, Michael (June 19, 2019). "Changes to flawed Boeing 737 Max were kept from pilots, DeFazio says". The Washington Post. https://www.washingtonpost.com/local/trafficandcommuting/changes-to-flawed-boeing-737-max-were-kept-from-pilots-defazio-says/2019/06/19/553522f0-92bc-11e9-aadb-74e6b2b46f6a_story.html. 
  4. ↑ "Multi Operator Message". The Boeing Company. November 10, 2018. https://skybrary.aero/bookshelf/books/4479.pdf. 
  5. ↑ "Exclusive: Boeing kept FAA in the dark on key 737 MAX design changes - U.S. IG report" (in en). Reuters. July 1, 2020. https://www.reuters.com/article/us-boeing-737max-exclusive-idUSKBN2413R6. 
  6. ↑ "Continued Airworthiness Notification to the International Community". FAA. March 11, 2019. https://www.faa.gov/news/updates/media/CAN_2019_03.pdf. 
  7. ↑ "Boeing's MCAS may not have been needed on the 737 Max at all" (in en-US). January 10, 2021. https://theaircurrent.com/aircraft-development/mcas-may-not-have-been-needed-on-the-737-max-at-all/. 
  8. ↑ "Airworthiness Directives; The Boeing Company Airplanes". November 20, 2020. https://rgl.faa.gov/Regulatory_and_Guidance_Library/rgad.nsf/AOCADSearch/FB91ABC41EF06432862586260051E5DF?OpenDocument. 
  9. ↑ Fehrm, Bjorn (November 14, 2018). "Boeing's automatic trim for the 737 MAX was not disclosed to the Pilots". https://leehamnews.com/2018/11/14/boeings-automatic-trim-for-the-737-max-was-not-disclosed-to-the-pilots/. 
  10. ↑ "Must Reads: How a 50-year-old design came back to haunt Boeing with its troubled 737 Max jet" (in en-US), Los Angeles Times, March 15, 2019, https://www.latimes.com/local/california/la-fi-boeing-max-design-20190315-story.html, retrieved May 23, 2022 
  11. ↑ "Your 737 MAX Questions. Answered: 5. What is MCAS?". Boeing. https://www.boeing.com/737-max-updates/737-max-answers//. 
  12. ↑ 12.0 12.1 Boeing's MCAS may not have been needed on the 737 Max at all, January 10, 2021, https://theaircurrent.com/aircraft-development/mcas-may-not-have-been-needed-on-the-737-max-at-all/ 
  13. ↑ 13.0 13.1 13.2 13.3 "737 MAX software update". Boeing. https://www.boeing.com/commercial/737max/737-max-software-updates.page. 
  14. ↑ "Boeing flies first 737 MAX 7 with MCAS software update". https://saemobilus.sae.org/automated-connected/news/2019/04/boeing-flies-a-737-max-7-with-mcas-software-update. 
  15. ↑ "The Boeing 737 MAX: Is the problem with the plane or the pilots?". March 12, 2019. https://www.intelligent-aerospace.com/home/article/16537707/the-boeing-737-max-is-the-problem-with-the-plane-or-the-pilots. 
  16. ↑ "Change to 737 MAX controls may have imperiled planes". Reuters. https://graphics.reuters.com/ETHIOPIA-AIRLINE-CONTROLS/0100916V1NZ/index.html. 
  17. ↑ Levin, Alan. "Clue Linking Mysterious Boeing 737 Max Disasters Came From Space". https://www.bloomberg.com/news/articles/2019-03-13/doomed-737-caught-on-satellite-data-that-could-aid-investigation. 
  18. ↑ Lazo, Luz; Laris, Michael; Aratani, Lori; Paletta, Damian (March 13, 2019). "FAA's emergency order grounding Boeing jets came after the agency identified similarities between crashes in Ethiopia, Indonesia". The Washington Post. https://www.washingtonpost.com/local/trafficandcommuting/canada-grounds-boeing-737-max-8-leaving-us-as-last-major-user-of-plane/2019/03/13/25ac2414-459d-11e9-90f0-0ccfeec87a61_story.html. 
  19. ↑ Beech, Hannah; Suhartono, Muktita (March 20, 2019). "Confusion, Then Prayer, in Cockpit of Doomed Lion Air Jet". The New York Times. https://www.nytimes.com/2019/03/20/world/asia/lion-air-crash-boeing.html. 
  20. ↑ 20.0 20.1 "Boeing 737 Max's Autopilot Has Problem, European Regulators Find". Bloomberg News. July 5, 2019. https://www.bloomberg.com/news/articles/2019-07-05/europe-sets-out-demands-for-boeing-before-max-can-fly-again. 
  21. ↑ Gates, Dominic (March 18, 2019). "Flawed analysis, failed oversight: How Boeing, FAA certified the suspect 737 MAX flight control system". The Seattle Times. https://www.seattletimes.com/business/boeing-aerospace/failed-certification-faa-missed-safety-issues-in-the-737-max-system-implicated-in-the-lion-air-crash/. 
  22. ↑ "The State of Airline Safety: Federal Oversight of Commercial Aviation". U.S. Department of Transportation (DOT). March 27, 2019. https://www.transportation.gov/content/state-airline-safety-federal-oversight-commercial-aviation. "On January 21, 2019, Boeing submitted a proposed MCAS software enhancement to the FAA for certification. To date, the FAA has tested this enhancement to the 737 MAX flight control system in both the simulator and the aircraft. The testing, which was conducted by FAA flight test engineers and flight test pilots, included aerodynamic stall situations and recovery procedures. The FAA's ongoing review of this software installation and training is an agency priority, as will be the roll-out of any software, training, or other measures to operators of the 737 MAX." 
  23. ↑ Gates, Dominic (April 1, 2019). "Boeing's software fix for 737 MAX still weeks away from delivery to FAA". https://www.seattletimes.com/business/boeing-aerospace/boeings-software-fix-for-737-max-still-weeks-away-from-delivery-to-faa/. 
  24. ↑ Corfield, Gareth (March 19, 2019). "Boeing big cheese repeats pledge of 737 Max software updates following fatal crashes". The Register. https://www.theregister.co.uk/2019/03/19/boeing_repeats_737_max_software_update_promises/. 
  25. ↑ Rappard, Anna-Maja; Wallace, Gregory (May 16, 2019). "Boeing says it has completed 737 Max software fix". CNN. https://www.cnn.com/2019/05/16/politics/737-max-boeing-software-fix/index.html. 
  26. ↑ MacMillan, Douglas (May 16, 2019). "Boeing says 737 Max update is being held up by FAA questions". The Washington Post. https://www.washingtonpost.com/business/2019/05/16/boeing-says-max-update-held-up-by-faa-questions/. 
  27. ↑ Josephs, Leslie (May 16, 2019). "Boeing says it has completed a software update for 737 Max anti-stall system linked to fatal crashes". CNBC. https://www.cnbc.com/2019/05/16/boeing-says-it-has-completed-the-development-of-updated-software-for-the-737-max.html. 
  28. ↑ Gregg, Aaron (April 4, 2019). "Boeing CEO apologizes for lives lost and acknowledges role of company's flight-control system in two crashes". The Washington Post. https://www.washingtonpost.com/business/2019/04/04/boeing-ceo-dennis-muilenburg-apologizes-lives-lost-ethiopian-indonesian-plane-crashes/. 
  29. ↑ "Congress holds fiery hearings on Boeing 737 Max 8 approval". https://www.cbsnews.com/live-news/faa-hearing-today-live-stream-updates-boeing-737-max-8-mcas-senate-commerce-committee-2019-03-27/. 
  30. ↑ Broderick, Sean; Norris, Guy; Warwick, Graham (March 20, 2019). "The Boeing 737 MAX MCAS Explained". Aviation Week & Space Technology. http://aviationweek.com/commercial-aviation/boeing-737-max-mcas-explained. 
  31. ↑ Ostrower, Jon (November 13, 2018). "What is the Boeing 737 Max Maneuvering Characteristics Augmentation System". https://theaircurrent.com/aviation-safety/what-is-the-boeing-737-max-maneuvering-characteristics-augmentation-system-mcas-jt610/. 
  32. ↑ 32.0 32.1 32.2 Zhang, Benjamin (April 29, 2019). "Boeing's CEO explains why the company didn't tell 737 Max pilots about the software system that contributed to 2 fatal crashes". Business Insider. https://www.businessinsider.com/boeings-ceo-on-why-737-max-pilots-not-told-of-mcas-2019-4. 
  33. ↑ 33.0 33.1 "14 CFR § 25.203 - Stall characteristics.". Electronic Code of Federal Regulations. Legal Information Institute. https://www.law.cornell.edu/cfr/text/14/25.203. 
  34. ↑ 34.0 34.1 34.2 Hart (2019). Boeing 737 MAX Flight Control System : Observations, Findings, and Recommendations. FAA. https://www.faa.gov/news/media/attachments/Final_JATR_Submittal_to_FAA_Oct_2019.pdf. 
  35. ↑ 35.0 35.1 "737 MAX SOFTWARE UPDATE". Boeing. https://www.boeing.com/commercial/737max/737-max-software-updates.page#/overview. 
  36. ↑ "FAA Updates on Boeing 737 MAX" (in en-us). https://www.faa.gov/news/updates/?newsId=93206. 
  37. ↑ 37.0 37.1 "FAA failed to properly review 737 MAX jet anti-stall system: JATR findings" (in en). Reuters. October 11, 2019. https://www.reuters.com/article/us-usa-boeing-airplane-faa-idUSKBN1WQ0H8. 
  38. ↑ Warwick, Graham (March 20, 2019). "The Boeing 737 MAX MCAS Explained" (in en). https://aviationweek.com/commercial-aviation/boeing-737-max-mcas-explained. 
  39. ↑ 39.0 39.1 Ostrower, Jon (November 13, 2018). "What is the Boeing 737 Max Maneuvering Characteristics Augmentation System". https://theaircurrent.com/aviation-safety/what-is-the-boeing-737-max-maneuvering-characteristics-augmentation-system-mcas-jt610/. 
  40. ↑ Bazley, Tarek (March 11, 2019). "Control system under scrutiny after Ethiopian Airlines crash". https://www.aljazeera.com/news/2019/03/control-system-scrutiny-ethiopian-airlines-crash-190311094532350.html. 
  41. ↑ "Boeing's 737 Max design contains fingerprints of hundreds of suppliers" (in en). Washington Post. https://www.washingtonpost.com/business/economy/boeings-737-max-design-contains-fingerprints-of-hundreds-of-suppliers/2019/04/05/44f22024-57ab-11e9-8ef3-fbd41a2ce4d5_story.html. 
  42. ↑ 42.0 42.1 "My Testimony Today Before the 𝐇𝐨𝐮𝐬𝐞 Subcommittee on Aviation" (in en-US). June 19, 2019. http://www.sullysullenberger.com/my-testimony-today-before-the-𝐡𝐨𝐮𝐬𝐞-subcommittee-on-aviation/. 
  43. ↑ "Boeing Statement on Operations Manual Bulletin". Boeing. November 6, 2018. https://boeing.mediaroom.com/news-releases-statements?item=130327. 
  44. ↑ "FAA Issues Emergency AD Against Boeing 737 Max 8" (in en). November 8, 2018. http://www.flyingmag.com/faa-emergency-airworthiness-directive-boeing-737-max-8/. 
  45. ↑ Hradecky, Simon (January 14, 2019). "Crash: Lion B38M near Jakarta on Oct 29th 2018, aircraft lost height and crashed into Java Sea, wrong AoA data". http://avherald.com/h?article=4bf90724/0009&opt=0. 
  46. ↑ Campbell, Darryl (May 2, 2019). "The many human errors that brought down the Boeing 737 Max". https://www.theverge.com/2019/5/2/18518176/boeing-737-max-crash-problems-human-error-mcas-faa. 
  47. ↑ "The inside story of MCAS: How Boeing's 737 MAX system gained power and lost safeguards" (in en-US). June 22, 2019. https://www.seattletimes.com/seattle-news/times-watchdog/the-inside-story-of-mcas-how-boeings-737-max-system-gained-power-and-lost-safeguards/. 
  48. ↑ Tangel, Alison Sider and Andrew (September 29, 2019). "WSJ News Exclusive | Before 737 MAX, Boeing's Flight-Control System Included Key Safeguards" (in en-US). Wall Street Journal. https://www.wsj.com/articles/before-737-max-boeings-flight-control-system-included-key-safeguards-11569754800. 
  49. ↑ Baker, Mike; Gates, Dominic (March 26, 2019). "Lack of redundancies on Boeing 737 MAX system baffles some involved in developing the jet". https://www.seattletimes.com/business/boeing-aerospace/a-lack-of-redundancies-on-737-max-system-has-baffled-even-those-who-worked-on-the-jet/. 
  50. ↑ Jenkins, Holman W. jr. (November 5, 2019). "Boeing vs. Technological Chaos". https://www.wsj.com/articles/boeing-vs-technological-chaos-11572998029. 
  51. ↑ Nicas, Jack; Kitroeff, Natalie; Gelles, David; Glanz, James (June 1, 2019). "Boeing Built Deadly Assumptions Into 737 Max, Blind to a Late Design Change" (in en-US). The New York Times. ISSN 0362-4331. https://www.nytimes.com/2019/06/01/business/boeing-737-max-crash.html. 
  52. ↑ "Transport Canada safety official urges removal of MCAS from 737 Max". November 23, 2019. https://theaircurrent.com/aviation-safety/transport-canada-safety-official-urges-removal-of-mcas-from-737-max/. 
  53. ↑ 53.0 53.1 Gates, Dominic (March 17, 2019). "Flawed analysis, failed oversight: How Boeing and FAA certified the suspect 737 MAX flight control system". The Seattle Times. https://www.seattletimes.com/business/boeing-aerospace/failed-certification-faa-missed-safety-issues-in-the-737-max-system-implicated-in-the-lion-air-crash/. 
  54. ↑ Fehrm, Bjorn (April 5, 2019). "Bjorn's Corner: ET302 crash report, the first analysis". Leeham News and Analysis. https://leehamnews.com/2019/04/05/bjorns-corner-et302-crash-report-the-first-analysis/. 
  55. ↑ Gates, Dominic (October 29, 2019). "Live coverage: Boeing CEO Dennis Muilenburg testifies to Congress about 737 MAX". The Seattle Times. https://www.seattletimes.com/business/boeing-aerospace/boeing-ceo-must-have-answers-about-the-737-max-as-he-faces-congressional-scrutiny-this-week/. 
  56. ↑ Travis, Gregory (April 18, 2019). "How the Boeing 737 Max Disaster Looks to a Software Developer". IEEE Spectrum. https://spectrum.ieee.org/aerospace/aviation/how-the-boeing-737-max-disaster-looks-to-a-software-developer. 
  57. ↑ Bjorn, Fehrm (April 3, 2019). "ET302 used the Cut-Out switches to stop MCAS". https://leehamnews.com/2019/04/03/et302-used-the-cut-out-switches-to-stop-mcas/. 
  58. ↑ Mike Baker and Dominic Gates (May 10, 2019). "Boeing altered key switches in 737 MAX cockpit, limiting ability to shut off MCAS". The Seattle Times. https://www.seattletimes.com/business/boeing-aerospace/boeing-altered-key-switches-in-737-max-cockpit-limiting-ability-to-shut-off-mcas/. 
  59. ↑ Sean Broderick (May 10, 2019). "Ethiopian MAX Crash Simulator Scenario Stuns Pilots". Aviation Week Network. https://aviationweek.com/commercial-aviation/ethiopian-max-crash-simulator-scenario-stuns-pilots. 
  60. ↑ Daniel McCoy (April 24, 2019). "Boeing CEO: Nothing slipped through in original 737 MAX certification". Wichita Business Journal. https://www.bizjournals.com/wichita/news/2019/04/24/boeing-ceo-nothing-slipped-through-in-original-737.html. 
  61. ↑ Dominic Gates (April 29, 2019). "Facing sharp questions, Boeing CEO refuses to admit flaws in 737 MAX design". Seattle Times. https://www.seattletimes.com/business/boeing-aerospace/facing-sharp-questions-boeing-ceo-refuses-to-admit-flaws-in-737-max-design/. 
  62. ↑ "Boeing CEO says he would put his family in a 737 Max "without any hesitation"" (in en). CBS News. May 29, 2019. https://www.cbsnews.com/news/boeing-ceo-dennis-muilenburg-says-he-would-put-his-family-737-max-without-any-hesitation-exclusive-2019-05-29/. 
  63. ↑ Kitroeff, Natalie (September 26, 2019). "Boeing Underestimated Cockpit Chaos on 737 Max, N.T.S.B. Says" (in en-US). The New York Times. ISSN 0362-4331. https://www.nytimes.com/2019/09/26/business/boeing-737-max-ntsb-mcas.html. 
  64. ↑ "Safety Recommendation Report: Assumptions Used in the Safety Assessment Process and the Effects of Multiple Alerts and Indications on Pilot Performance". NTSB. September 19, 2019. https://www.ntsb.gov/investigations/AccidentReports/Reports/ASR1901.pdf. 
  65. ↑ Gelles, David; Kitroeff, Natalie (October 11, 2019). "Review of 737 Max Certification Finds Fault With Boeing and F.A.A." (in en-US). The New York Times. ISSN 0362-4331. https://www.nytimes.com/2019/10/11/business/boeing-737-max.html. 
  66. ↑ Laris, Michael (October 18, 2019). "Messages show Boeing employees knew in 2016 of problems that turned deadly on the 737 Max". The Washington Post. https://www.washingtonpost.com/local/trafficandcommuting/text-messages-show-boeing-employees-knew-in-2016-of-problems-that-turned-deadly-on-the-737-max/2019/10/18/8578c990-f1ca-11e9-89eb-ec56cd414732_story.html. 
  67. ↑ "Hearing before the committee on transportation and infrastructure". The boeing 737 MAX: examining the design development and marketing of the aircraft. 𝐇𝐨𝐮𝐬𝐞 of representatives. October 30, 2019. https://www.govinfo.gov/content/pkg/CHRG-116hhrg38282/pdf/CHRG-116hhrg38282.pdf. 
  68. ↑ "After 18-Month Investigation, Chairs DeFazio and Larsen Release Final Committee Report on Boeing 737 MAX" (Press release). House Committee on Transportation and Infrastructure. September 16, 2020. Archived from the original Check |url= value (help) on July 14, 2022. Retrieved September 17, 2020.
  69. ↑ Kitroeff, Natalie (September 26, 2019). "Boeing Underestimated Cockpit Chaos on 737 Max, N.T.S.B. Says". The New York Times. ISSN 0362-4331. https://www.nytimes.com/2019/09/26/business/boeing-737-max-ntsb-mcas.html. 
  70. ↑ 70.0 70.1 70.2 National Transportation Safety Board (September 19, 2019). "Safety Recommendation Report: Assumptions Used in the Safety Assessment Process and the Effects of Multiple Alerts and Indications on Pilot Performance". https://www.ntsb.gov/investigations/AccidentReports/Reports/ASR1901.pdf.  This article incorporates public domain material from websites or documents of the National Transportation Safety Board.
  71. ↑ "NTSB Issues 7 Safety Recommendations to FAA related to Ongoing Lion Air, Ethiopian Airlines Crash Investigations". https://www.ntsb.gov/news/press-releases/Pages/NR20190926.aspx. 
  72. ↑ See also Hill, Andrew (October 6, 2019). "Boeing Report Highlights Human Factors No Company Should Ignore". Financial Times. https://www.ft.com/content/19781330-e5cd-11e9-b112-9624ec9edc59. 
  73. ↑ "Plane Tests Must Use Average Pilots, NTSB Says After 737 MAX Crashes". The Wall Street Journal. September 26, 2019. https://www.wsj.com/articles/plane-tests-must-use-average-pilots-ntsb-says-after-737-max-crashes-11569506401. 
  74. ↑ Levin, Alan (September 26, 2019). "Boeing Failed to Predict That Slew of 737 Max Warning Alarms Would Confuse Pilots, Investigators Say". Time (magazine). https://time.com/5687473/boeing-737-alarm-system/. Retrieved September 24, 2021. 
  75. ↑ George Leopold (March 27, 2019). "Software Won't Fix Boeing's 'Faulty' Airframe". EE Times. https://www.eetimes.com/document.asp?doc_id=1334482. 
  76. ↑ "Why Boeing's emergency directions may have failed to save 737 MAX" (in en-US). April 3, 2019. https://www.seattletimes.com/business/boeing-aerospace/boeings-emergency-procedure-for-737-max-may-have-failed-on-ethiopian-flight/. 
  77. ↑ Freed, Jamie; Johnson, Eric (November 30, 2018). "Optional warning light could have aided Lion Air engineers before crash: experts". Reuters. https://www.reuters.com/article/us-indonesia-crash-boeing-aoa/optional-warning-light-could-have-aided-lion-air-engineers-before-crash-experts-idUSKCN1NZ0QL. 
  78. ↑ Newburger, Emma (March 21, 2019). "Crashed jets reportedly lacked key safety features because Boeing charged extra for them". CNBC. https://www.cnbc.com/2019/03/21/crashed-boeing-jets-lacked-key-safety-features-that-were-add-ons.html. 
  79. ↑ Tabucho, Hiroko; Gelles, David (March 21, 2019). "Doomed Boeing Jets Lacked 2 Safety Features That Company Sold Only as Extras". The New York Times. https://www.nytimes.com/2019/03/21/business/boeing-safety-features-charge.html. 
  80. ↑ Gelles, David; Kitroeff, Natalie (May 5, 2019). "Boeing Believed a 737 Max Warning Light Was Standard. It Wasn't." (in en-US). The New York Times. ISSN 0362-4331. https://www.nytimes.com/2019/05/05/business/boeing-737-max-warning-light.html. 
  81. ↑ "FAA considered grounding some Boeing 737 Max planes last year: source" (in en-US). https://news.yahoo.com/faa-considered-grounding-boeing-737-max-planes-last-180808293.html. 
  82. ↑ Koenig, David; Krisher, Tom (June 7, 2019). "Boeing wanted to wait 3 years to fix safety alert on 737 Max". https://apnews.com/024ba22014d647a481d52e52ab8dde61. 
  83. ↑ "Explanatory Note to TCDS IM.A.120 – Boeing 737". May 24, 2019. https://www.easa.europa.eu/sites/default/files/dfu/IM.A.120%20Boeing737%20TCDS%20APPENDIX%20ISS%2010.pdf. 
  84. ↑ 84.0 84.1 "Regulators knew before crashes that 737 MAX trim control was confusing in some conditions: document". Reuters. https://www.reuters.com/article/us-ethiopia-airplane-regulator-insight-idUSKCN1RA0DP. 
  85. ↑ Gates, Dominic (April 3, 2019). "Why Boeing's emergency directions may have failed to save 737 MAX". https://www.seattletimes.com/business/boeing-aerospace/boeings-emergency-procedure-for-737-max-may-have-failed-on-ethiopian-flight/. 
  86. ↑ "Checklists come into focus as pace-setter for 737 Max return". October 9, 2019. https://theaircurrent.com/aviation-safety/checklists-come-into-focus-as-pace-setter-for-737-max-return/. 
  87. ↑ Standard Operating Procedures and Pilot Monitoring Duties for Flight Deck Crewmembers. Advisory Circulars. FAA. January 10, 2017. AC 120-71B. https://www.faa.gov/documentlibrary/media/advisory_circular/ac_120-71b.pdf. 
  88. ↑ Glanz, James; Creswell, Julie; Kaplan, Thomas; Wichter, Zach (February 3, 2019). "After a Lion Air 737 Max Crashed in October, Questions About the Plane Arose". The New York Times. ISSN 0362-4331. https://www.nytimes.com/2019/02/03/world/asia/lion-air-plane-crash-pilots.html. 
  89. ↑ "Boeing 737 MAX: What Happened, And What Now?". Aviation Week Network. https://aviationweek.com/boeing-737-max-what-happened-and-what-now. 
  90. ↑ 90.0 90.1 "My Testimony Today Before the House Subcommittee on Aviation". June 19, 2019. http://www.sullysullenberger.com/my-testimony-today-before-the-house-subcommittee-on-aviation/. 
  91. ↑ "My Letter to the Editor of New York Times Magazine". October 13, 2019. http://www.sullysullenberger.com/my-letter-to-the-editor-of-new-york-times-magazine/. 
  92. ↑ PLAINTIFF'S ORIGINAL PETITION, SWAPA vs. Boeing. 2019. 
  93. ↑ "Boeing altered key switches in 737 MAX cockpit, limiting ability to shut off MCAS". May 10, 2019. https://www.seattletimes.com/business/boeing-aerospace/boeing-altered-key-switches-in-737-max-cockpit-limiting-ability-to-shut-off-mcas/. 
  94. ↑ 94.0 94.1 94.2 "Vestigal design issue clouds 737 MAX crash investigations". April 4, 2019. https://theaircurrent.com/aviation-safety/vestigal-design-issue-clouds-737-max-crash-investigations/. 
  95. ↑ 95.0 95.1 95.2 Jon Ostrower; "Vestigial design issue clouds 737 Max crash investigations", The Air Current, April 4, 2019. (retrieved November 21, 2019)
  96. ↑ Brady, Chris. "The Boeing 737 Runaway Stabilizer Procedure". http://www.b737.org.uk/runawaystab.htm#rc. 
  97. ↑ Hemmerdinger, Jon (April 2, 2020). "Simulator tests demonstrate 737 Max manual trim difficulties". https://www.flightglobal.com/safety/simulator-tests-demonstrate-737-max-manual-trim-difficulties/137651.article. 
  98. ↑ 98.0 98.1 98.2 98.3 (in fr-CA) Des révélations troublantes sur le Boeing 737 MAX 8, November 10, 2019, https://ici.radio-canada.ca/nouvelle/1382157/boeing-737-max-experts-questions-enquete-verin-systeme-anomalie-aeronautique, retrieved November 11, 2019, "Sur les courbes, Sylvain Alarie et Gilles Primeau observent un glissement progressif de 0,2 degré du stabilisateur horizontal. Ça peut sembler peu, « mais c’est un ordre de grandeur supérieur à ce qui est normalement permis quand on conçoit des systèmes comme ceux-ci, » ajoute Gilles Primeau. « Ces mouvements sont facilement observables, et, selon nous, selon le règlement 395A, ne devraient pas avoir lieu. »" 
  99. ↑ "Boeing a-t-il fait preuve de négligence?" (in fr). Radio-Canada info. April 1, 2019. https://www.youtube.com/watch?v=BbY5P-ylYS4. 
  100. ↑ "Norwegian Flies Boeing 737 MAX Over Europe For Storage Purposes". June 12, 2019. https://simpleflying.com/norwegian-boeing-737-max-flight/. 
  101. ↑ 102.0 102.1 "Angle of attack". Boeing. 2000. http://www.boeing.com/commercial/aeromagazine/aero_12/aoa.pdf. 
  102. ↑ Leinfelder, Andrea (August 22, 2019). "Did Boeing, aviation industry heed lessons of 2009 Air France crash?". Houston Chronicle. https://www.houstonchronicle.com/business/article/Did-Boeing-aviation-industry-heed-lessons-of-14369021.php. 
  103. ↑ Useem, Jerry (November 20, 2019). "The Long-Forgotten Flight That Sent Boeing Off Course". https://www.theatlantic.com/ideas/archive/2019/11/how-boeing-lost-its-bearings/602188/. 
  104. ↑ "Boeing relied on single sensor for 737 Max that had been flagged 216 times to FAA". April 30, 2019. https://www.cnn.com/2019/04/30/politics/boeing-sensor-737-max-faa/index.html. 
  105. ↑ Frankel, Todd C. (March 17, 2019). "Sensor cited as potential factor in Boeing crashes draws scrutiny". The Washington Post. https://www.washingtonpost.com/business/economy/sensor-cited-as-potential-factor-in-boeing-crashes-draws-scrutiny/2019/03/17/5ecf0b0e-4682-11e9-aaf8-4512a6fe3439_story.html. 
  106. ↑ 107.0 107.1 Gates, Dominic (September 10, 2019). "European regulator plans its own test flights of Boeing 737 MAX in sign of rift with FAA". https://www.seattletimes.com/business/boeing-aerospace/european-regulator-plans-its-own-test-flights-of-boeing-737-max-in-sign-of-differences-with-faa/. 
  107. ↑ Baker, Mike; Gates, Dominic (March 26, 2019). "Lack of redundancies on Boeing 737 MAX system baffles some involved in developing the jet". The Seattle Times. https://www.seattletimes.com/business/boeing-aerospace/a-lack-of-redundancies-on-737-max-system-has-baffled-even-those-who-worked-on-the-jet/. 
  108. ↑ Fehrm, Bjorn (March 27, 2019). "Boeing presents MCAS fix to pilots, regulators and media". https://leehamnews.com/2019/03/27/boeing-presents-mcas-fix-to-pilots-regulators-and-media/. 
  109. ↑ "Optional warning light could have aided Lion Air engineers before crash: experts". Reuters. November 30, 2018. https://www.reuters.com/article/us-indonesia-crash-boeing-aoa-idUSKCN1NZ0QL. 
  110. ↑ Fehrm, Bjorn (November 15, 2019). "Bjorn's Corner: Analysing the Lion Air JT610 crash, Part 3.". https://leehamnews.com/2019/11/15/bjorns-corner-analysing-the-lion-air-jt610-crash-part-3/. 
  111. ↑ MacGillis, Alec (November 11, 2019). "The Case Against Boeing". The New Yorker. ISSN 0028-792X. https://www.newyorker.com/magazine/2019/11/18/the-case-against-boeing. 
  112. ↑ "Air Canada says their 737 Max jets have all safety features Boeing sells as extras". CBC.ca. March 21, 2019. https://www.cbc.ca/amp/1.5065888. 
  113. ↑ "Optional warning light could have aided Lion Air engineers before crash: experts". Reuters. November 30, 2018. https://www.reuters.com/article/us-indonesia-crash-boeing-aoa/optional-warning-light-could-have-aided-lion-air-engineers-before-crash-experts-idUSKCN1NZ0QL. 
  114. ↑ "Boeing wanted to wait three years to fix safety alert on 737 Max". Los Angeles Times. Associated Press. June 7, 2019. https://www.latimes.com/business/la-fi-boeing-737-max-safety-alert-20190607-story.html. 
  115. ↑ 116.0 116.1 116.2 "Boeing Statement on AOA Disagree Alert" (Press release). Boeing. May 5, 2019. Retrieved May 7, 2019.
  116. ↑ Gelles, David; Kitroeff, Natalie (May 5, 2019). "Boeing Believed a 737 Max Warning Light Was Standard. It Wasn't.". The New York Times. ISSN 0362-4331. https://www.nytimes.com/2019/05/05/business/boeing-737-max-warning-light.html. 
  117. ↑ Tabuchi, Hiroko; Gelles, David (March 21, 2019). "Doomed Boeing Jets Lacked 2 Safety Features That Company Sold Only as Extras". The New York Times. ISSN 0362-4331. https://www.nytimes.com/2019/03/21/business/boeing-safety-features-charge.html. 
  118. ↑ "Southwest is adding new Angle of Attack indicators to its 737 Max fleet". November 30, 2018. https://theaircurrent.com/aviation-safety/southwest-airlines-is-adding-new-angle-of-attack-indicators-to-its-737-max-fleet/. 
  119. ↑ "Lion Air Report Analyzes Pilot Struggle With 737 MAX Trim System". November 30, 2018. https://www.aviationtoday.com/2018/11/30/lion-air-report-analyzes-pilot-struggle-737-max-trim-system/. 
  120. ↑ Zetlin, Minda (March 24, 2019). "Boeing CEO Says Safety Is Highest Priority. The Company's Pricing Says Something Different". https://www.inc.com/minda-zetlin/boeing-safety-features-options-upgrades-angle-attack-disagree-light-mcas-lion-air-ethiopian.html. 
  121. ↑ Pasztor, Andy; Tangel, Andrew; Sider, Alison (May 5, 2019). "Boeing Knew About Safety-Alert Problem for a Year Before Telling FAA, Airlines". The Wall Street Journal. https://www.wsj.com/articles/boeing-knew-about-safety-alert-problem-for-a-year-before-telling-faa-airlines-11557087129. 
  122. ↑ "Boeing CEO Admits Mistake in Handling Warning-System Problem". Associated Press. June 16, 2019. https://www.voanews.com/usa/boeing-ceo-admits-mistake-handling-warning-system-problem. 
  123. ↑ "Frequently Asked Questions". Boeing: 737 MAX FAQ. https://www.boeing.com/commercial/737max/737-max-contacts.page. 
  124. ↑ Le Vie, Lisa R. (August 1, 2014). Review of Research On Angle-of-Attack Indicator Effectiveness (Report). NASA Langley Research Center (LaRC). NASA/TM–2014-218514. https://ntrs.nasa.gov/search.jsp?R=20140011419.  This article incorporates text from this source, which is in the public domain.
  125. ↑ Davis, Aaron C.; Lazo, Luz; Schemm, Paul (April 4, 2019). "Additional software problem detected in Boeing 737 Max flight control system, officials say". The Washington Post. https://www.washingtonpost.com/world/africa/ethiopia-says-pilots-performed-boeings-recommendations-to-stop-doomed-aircraft-from-diving-urges-review-of-737-max-flight-control-system/2019/04/04/3a125942-4fec-11e9-bdb7-44f948cc0605_story.html. 
  126. ↑ Pasztor, Andy; Tangel, Andrew (October 8, 2019). "Friction Between U.S., European Regulators Could Delay 737 MAX Return to Service". The Wall Street Journal. https://www.wsj.com/articles/friction-between-u-s-european-regulators-could-delay-737-max-return-to-service-11570527001. 
  127. ↑ 128.0 128.1 Levin, Alan (November 8, 2019). "Delays in Boeing Max Return Began With Near-Crash in Simulator". Bloomberg.com. https://www.bloomberg.com/news/articles/2019-11-08/delays-in-boeing-max-return-began-with-near-crash-in-simulator. 
  128. ↑ "Boeing finds yet another 737 MAX software issue". January 19, 2020. https://www.slashgear.com/boeing-finds-yet-another-737-max-software-issue-19607147/. 
  129. ↑ at 00:43, Gareth Corfield April 9, 2020. "Stop us if you've heard this before: Boeing's working on 737 Max software fixes for autopilot, stabilization bugs" (in en). https://www.theregister.co.uk/2020/04/09/boeing_737_max_software_fixes/. 
  130. ↑ "Boeing: The "e-cab" – a test flight deck". http://www.boeing.com/commercial/737max/news/the-e-cab-a-test-flight-deck.page. 
  131. ↑ "The "e-cab" – A Test Flight Deck". Boeing. November 30, 2015. http://players.brightcove.net/800000612001/a7975ab0-d4c3-4514-a6c3-d7bfff0667c5_default/index.html?videoId=4637926975001. 
  132. ↑ Levin, Alan; Johnsson, Julie; Courtney, Shaun (June 27, 2019). "Boeing needs up to three months to fix newly discovered 737 Max glitch". https://www.latimes.com/business/la-fi-boeing-737-max-new-glitch-20190627-story.html. 
  133. ↑ Fehrm, Bjorn (June 28, 2019). "New pitch trim issue forces further changes to 737 MAX software". Leeham News and Analysis. https://leehamnews.com/2019/06/28/bjorns-corner-new-pitch-trim-issue-forces-further-changes-to-737-max-software/. 
  134. ↑ 135.0 135.1 "Boeing Statement on 737 MAX software" (Press release). Boeing. June 26, 2019. Retrieved June 27, 2019.
  135. ↑ Ostrower, Jon (June 27, 2019). "FAA and Boeing initially disagreed on severity of "catastrophic" 737 Max software glitch". The Air Current. https://theaircurrent.com/aviation-safety/faa-and-boeing-initially-disagreed-on-severity-of-catastrophic-737-max-software-glitch/. 
  136. ↑ 137.0 137.1 137.2 Gates, Dominic (August 1, 2019). "Newly stringent FAA tests spur a fundamental software redesign of Boeing's 737 MAX flight controls". https://www.seattletimes.com/business/boeing-aerospace/newly-stringent-faa-tests-spur-a-fundamental-software-redesign-of-737-max-flight-controls/. 
  137. ↑ "Latest 737 Max Fault That Alarmed Test Pilots Rooted in Software". Bloomberg News. https://www.bloomberg.com/news/articles/2019-07-27/latest-737-max-fault-that-alarmed-test-pilots-rooted-in-software. 
  138. ↑ Broderick, Sean (August 1, 2019). "Software Fix Will Address Most Recent MAX Issue". Aviation Week & Space Technology. https://aviationweek.com/commercial-aviation/software-fix-will-address-most-recent-max-issue. 
  139. ↑ Allard, André (July 3, 2019). "MAX's computer has reached its limit". Wings Over Québec. https://www.wingsoverquebec.com/?p=8649. 
  140. ↑ Campbell, Darryl (April 9, 2020). "The ancient computers in the Boeing 737 Max are holding up a fix" (in en). https://www.theverge.com/2020/4/9/21197162/boeing-737-max-software-hardware-computer-fcc-crash. 
  141. ↑ "Boeing Fixing New Software Bug on Max; Key Test Flight Nears". Bloomberg. February 6, 2020. https://www.bloomberg.com/news/articles/2020-02-06/boeing-identifies-new-software-problem-on-grounded-737-max-jet. 
  142. ↑ O'Kane, Sean (February 6, 2020). "Boeing finds another software problem on the 737 Max". https://www.theverge.com/2020/2/6/21126364/boeing-737-max-software-glitch-flaw-problem. 
  143. ↑  This article incorporates public domain material from the Federal Aviation Administration document "Airworthiness directives; The Boeing Company Airplanes".

External links

Further reading



Retrieved from "https://handwiki.org/wiki/index.php?title=Maneuvering_Characteristics_Augmentation_System&oldid=3381852"