Inside the Effort to Fix the Troubled Boeing 737 MAX

Hundreds of people are dead because of the stupidity Boeing’s personnel and management. The override capability of the MCAS system was the result of programmers and engineers mistakenly thinking that they new more about flying airplanes than pilots do.

I'm glad to see that you have much more experience designing aircraft than Boeing.

Maybe they should run all of the hundreds of thousands of engineering decisions that they have to make on every new project through you before they implement them.

The purpose of MCAS was to make the 737 MAX handle the same as the 737 NG so that pilots didn't have to be type rated for one aircraft or the other, but that they could fly either type. (Airline pilots are only allowed to be type rated on one type of aircraft at a time for revenue operations.)

What the 737 MAX is not, is more prone to stall than the the 737 NG. What is different is that the controls lighten up more on the MAX than the NG, so the controls feel different near maximum AoA. MCAS was to trim the aircraft so that it felt like the 737 NG.

MCAS would only come into play during a very narrow and seldom seen flight regime of 1) autopilot off, 2) high angle of attack, and 3) slow speed. These conditions are rarely if ever seen in normal operations, so MCAS would seldom if ever actually be needed.

Where the engineers screwed up, and they screwed up royally, was not in deciding to add MCAS to the flight control software, it was in failing to fully take into account the consequences of an AOA sensor failure. Since MCAS would only rarely if ever operate under normal circumstances, it wasn't treated as the critical flight control system that it should have been, which includes adding redundancy to the system to mitigate single point failures. For that, Boeing was very wrong.

Boeing DID PROVIDE AN OFF BUTTON. It is called the STAB TRIM cutout switches and they are right on the throttle control column, and are a mandatory memory item that pilots are supposed to be able to remedy from memory without having to use a checklist.

After the Lion Air crash, Boeing sent out explicit instructions to all operators of the 737 MAX outlining MCAS, what its symptoms were, and how to immediately mitigate any problem with the system.

The Ethiopian Air pilots were required to read and sign off on this notice. When the MCAS system on their flight malfunctioned due to a faulty AOA sensor, they did turn off the STAB TRIM cutout switches. Then they turned them back on, and crashed.

Yes, Boeing was stupid, but not because they put MCAS in the flight control software, but because they didn't provide redundant cross checks of the two AOA sensors when determining when to activate MCAS. Instead, they only used the input from one AOA sensor.

They have added the cross check now, and the MAX should be back in the air by December.

And if you think Boeing are the only humans making mistakes when designing aircraft, then you've forgotten the Airbus crashes that resulted from faulty speed sensing pitot tubes. In all Airbus aircraft, unlike the manual backup 737, all flight control is done through a computer, and if the computer thinks your control input will cause the aircraft to stall, it won't implement that command. But when the computer doesn't get the correct data, like airspeed, it mistakenly vetoes the pilots commands.

Look up Air France 447.

Yes, Boeing was stupid, but not because they put MCAS in the flight control software, but because they didn't provide redundant cross checks of the two AOA sensors when determining when to activate MCAS. Instead, they only used the input from one AOA sensor.

I like that statement because as a non pilot I understand that pilots make a big deal about the Angle of Attack and so if you are going to give them information on the AOA it should be practically foolproof, and NOT just one opinion, with a second opinion being optional and costing more money.
AOA External sensors can be damaged by ice, runway debris, bird strikes, so you need a backup of some sort.
Of course you can get it from Boeing if you want to pay extra. - Tom

AOA External sensors can be damaged by ice, runway debris, bird strikes, so you need a backup of some sort. Of course you can get it from Boeing if you want to pay extra. - Tom

There was some confusion about that in the media. There has always been two AOA sensors on the aircraft, and they are connected to the redundant flight control computers.

What was optional was to display the angle of attack on the electronic flight display screens. From what I've read, it was an option that was only purchased by some U.S. airlines with lots of ex-military pilots who are used to having that instrument in the cockpit, but was not purchased by overseas airlines with pilots who were trained on civilian aircraft that does not have an AOA instrument on board.

Then the option was that if you purchased the AOA cockpit display option, then you also got an "AOA Disagree" warning on the cockpit display. If you did not get the option, you also do not get the AOA disagree warning.

The dual flight control computers still flagged the AOA disagree for its own internal use (except for MCAS, which was a big problem) but the pilots were not told that the two AOA sensors disagreed.

So as part of the software fix for MCAS, all displays will have the AOA disagree alert regardless of whether they have the AOA display option.

So you believe the 737 MAX shouldn’t fly again even with the so-called software updates. Right?

No.

I think that having a fly-by-wire system like MCAS can make the 737MAX a safe aircraft to fly, as long as it is appropriately configured.

I am no expert, but it seems like the correction should require, at minimum:

1) Multiple AOA sensors. In a situation where the AOA sensors are not in agreement, with one reading a stall situation and the other not, this information to be reported to the pilot, who can resolve the discrepancy, compare the readings to the actual performance of the aircraft, and trigger the MCAS, if necessary.

2) Simple controls to disable MCAS system. In the event MCAS is triggered in a situation where no hazard exists, the pilot should be able to disable it by hitting a button. Preferably a Big Red Button.

3. Limit range of trim in MCAS. It should not be possible for the MCAS to have more authority than a pilot has through his stick. Full MCAS deflection combined with full up command from the pilot should result in a nose-up attitude.

4. Transition training for all pilots to familiarize them with the MCAS system, the potential problems, and how to deal with them.

The MCAS obviously has an important function. Simply eliminating it while placing a restriction on operating conditions for the aircraft seems to be a poor response, because the aircraft will be flown from High/Hot airports, no matter what the restrictions are from Boeing. You have to assume that airlines are going to push the aircraft to the limits and beyond, particularly if other, less advanced, versions of the 737 can fly out of these High/Hot airports.

>>>Of course you can get it from Boeing if you want to pay extra<<<

Therein lies the problem. Optional Multiple Sensors and Redundancy should never be viewed as a cost saving opportunity for the Customer. Safety is safety and should always be the first consideration.

We aren’t talking Corinthian Leather here. Nobody died because they chose a Fabric Car Interior.

I'm glad to see that you have much more experience designing aircraft than Boeing.

I would tell you that I am an engineer who has worked in the aviation industry off and on for over 25 years and that I have done work for Boeing, but qualifications mean nothing on anonymous discussion forums. Besides, Boeing upper management has basically already been forced admit as much. We'll just have to wait and see what the revised NTSB reports for these needless disasters say.

Maybe they should run all of the hundreds of thousands of engineering decisions that they have to make on every new project through you before they implement them.

I don't think that I would want that job (or any job with Boeing right now), but that is an excellent suggestion. It is obvious that somebody ought to be reviewing all these stupid decisions Boeing is making!

The purpose of MCAS was to make the 737 MAX handle the same as the 737 NG so that pilots didn't have to be type rated for one aircraft or the other, but that they could fly either type. (Airline pilots are only allowed to be type rated on one type of aircraft at a time for revenue operations.)

The intention is irrelevant. They had no right, morally or legally, to install a system with override capability under the same type rating without training or an off switch.

What the 737 MAX is not, is more prone to stall than the the 737 NG. What is different is that the controls lighten up more on the MAX than the NG, so the controls feel different near maximum AoA. MCAS was to trim the aircraft so that it felt like the 737 NG.

I'm not going to bother with a technical discussion with someone with the lack of technical expertise you have exhibited on this thread, but your statement above is factually incorrect. The use of larger LEAP-1B engines significantly changed the aircraft's center of gravity and rotational inertia which markedly changed the flight envelope and stall characterists.

MCAS would only come into play during a very narrow and seldom seen flight regime of 1) autopilot off, 2) high angle of attack, and 3) slow speed. These conditions are rarely if ever seen in normal operations, so MCAS would seldom if ever actually be needed.

Or if the pitot tube, angle-of-attack sensor, or any of a multitude of other sensors and controllers fail. If that happens then this idiodic system will auger the aircraft into the ground!

Where the engineers screwed up, and they screwed up royally, was not in deciding to add MCAS to the flight control software, it was in failing to fully take into account the consequences of an AOA sensor failure. Since MCAS would only rarely if ever operate under normal circumstances, it wasn't treated as the critical flight control system that it should have been, which includes adding redundancy to the system to mitigate single point failures. For that, Boeing was very wrong.

There are at least fifteen other critical failures in that process, mostly due to the arrogance and hubris of Boeing's engineers and managers. But do't let me stop you from over simplifying, you are doing a great job at that!

Boeing DID PROVIDE AN OFF BUTTON. It is called the STAB TRIM cutout switches and they are right on the throttle control column, and are a mandatory memory item that pilots are supposed to be able to remedy from memory without having to use a checklist.

Baloney, Boeing has already admitted that this was only a temporary remedy and was insufficient to prevent these kind of tragedies. This will be in the reports.

After the Lion Air crash, Boeing sent out explicit instructions to all operators of the 737 MAX outlining MCAS, what its symptoms were, and how to immediately mitigate any problem with the system.

Where did you get this fictitious propaganda? Not even Boeing's lawyers are saying this drivel.

The Ethiopian Air pilots were required to read and sign off on this notice. When the MCAS system on their flight malfunctioned due to a faulty AOA sensor, they did turn off the STAB TRIM cutout switches. Then they turned them back on, and crashed.

Unless you have some blockbuster inside information from the investigation or you were there in the cockpit with them, we won't know anything for sure about this until the revised report is released.

Yes, Boeing was stupid, but not because they put MCAS in the flight control software, but because they didn't provide redundant cross checks of the two AOA sensors when determining when to activate MCAS. Instead, they only used the input from one AOA sensor.

If Boeing is stupid enough to use this silly explanation in court, they will never be able to afford insurance again.

They have added the cross check now, and the MAX should be back in the air by December.

If this is their fix (it won't be), they will never get orders back on this series.

And if you think Boeing are the only humans making mistakes when designing aircraft, then you've forgotten the Airbus crashes that resulted from faulty speed sensing pitot tubes. In all Airbus aircraft, unlike the manual backup 737, all flight control is done through a computer, and if the computer thinks your control input will cause the aircraft to stall, it won't implement that command. But when the computer doesn't get the correct data, like airspeed, it mistakenly vetoes the pilots commands. Look up Air France 447.

Everyone is aware of Airbus' prior failure in this area. The difference is that Airbus learned from their mistakes. Boeing has only doubled down and covered up their mistakes at the cost of hundreds of lives. No one I know at Boeing is defending these awful decisions. You have to come to internet forums like this to find this level of stupidity.

Bookmark...

Long response later...

Your unwarranted insults and arrogance aside, here are just a few corrections to your assertions. Do some research, don't just rely on your own 25 years of on and off experience:

"After the Lion Air crash, Boeing sent out explicit instructions to all operators of the 737 MAX outlining MCAS, what its symptoms were, and how to immediately mitigate any problem with the system."
Where did you get this fictitious propaganda? Not even Boeing's lawyers are saying this drivel.

Don't take my word for it. You can read the "fictitious propaganda" for yourself. Here is Boeing's post-Lion Air crash bulletin:

http://www.avioesemusicas.com/wp-content/uploads/2018/10/TBC-19-Uncommanded-Nose-Down-Stab-Trim-Due-to-AOA.pdf

Please note that in the bulletin, issued and distributed FOUR MONTHS BEFORE THE ETHIOPIAN AIR CRASH, Boeing wrote (emphasis added):

In the event of erroneous AOA data, the pitch trim system can trim the stabilizer nose down in increments lasting up to 10 seconds. The nose down stabilizer trim movement can be stopped and reversed with the use of the electric stabilizer trim switches but may restart 5 seconds after the electric stabilizer trim switches are released. Repetitive cycles of uncommanded nose down stabilizer continue to occur unless the stabilizer trim system is deactivated through use of both STAB TRIM CUTOUT switches in accordance with the existing procedures in the Runaway Stabilizer NNC. It is possible for the stabilizer to reach the nose down limit unless the system inputs are counteracted completely by pilot trim inputs and both STAB TRIM CUTOUT switches are moved to CUTOUT.

That, my FRiend, is the explicit explaination of the operation of MCAS, and what to do in the event of an AOA sensor failure.

In the same bulletin, Boeing also wrote (emphasis added):

In the event an uncommanded nose down stabilizer trim is experienced on the 737-8 /-9, in conjunction with one or more of the above indications or effects, do the Runaway Stabilizer NNC ensuring that the STAB TRIM CUTOUT switches are set to CUTOUT and stay in the CUTOUT position for the remainder of the flight.
Note: Initially, higher control forces may be needed to overcome any stabilizer nose down trim already applied. Electric stabilizer trim can be used to neutralize control column pitch forces before moving the STAB TRIM CUTOUT switches to CUTOUT. Manual stabilizer trim can be used after the STAB TRIM CUTOUT switches are moved to CUTOUT.

That is the explicit instructions on how to respond to a runaway MCAS system.

"The Ethiopian Air pilots were required to read and sign off on this notice. When the MCAS system on their flight malfunctioned due to a faulty AOA sensor, they did turn off the STAB TRIM cutout switches. Then they turned them back on, and crashed."
Unless you have some blockbuster inside information from the investigation or you were there in the cockpit with them, we won't know anything for sure about this until the revised report is released.

I'll provide the links, you'll have to provide the initiative to read them:

Ethiopian Airlines Pilots Reactivated MCAS Just Before The Crash

Ethiopian Airlines Pilots Initially Followed Boeing’s Required Emergency Steps to Disable 737 MAX System

Ethiopian Airlines pilots re-engaged safety system amid chaotic scene in Boeing 737 Max cockpit: Preliminary report

Ethiopian Airlines pilots followed Boeing’s emergency steps before 737 Max crash: Report

The preliminary report on the Ethiopian Air crash said that the STAB TRIM CUTOUT switches were reactivated. I fail to understand why you doubt this.

Look up Air France 447.

And Quantas 72 in 2008

https://www.newshub.co.nz/home/travel/2019/05/pilot-of-qantas-flight-72-explains-how-he-stopped-a330-from-crashing-in-australia.html

“One way of dealing with the problem is that Boeing is sayig the 737MAX us not suitable for High/Hot airports. This is a major restriction on the design.

Addis Ababa, for instance, is no longer a suitable airport for this aircraft.”

Heck, Denver is considered not suitable for the 737 Max. When our temp is 90°, the density altitude here usually hits well above 10,000 feet.

Let’s see, now, you rail a poster about his statements then you go make some really dumb statements of your own, several of them entirely ignorant of the MCAS design and of aircraft design.

You might want to not get your information from the Internet and then use it to berate others. You look like an idiot.

The proper aircraft design was to not put those oversized engines on a 737 and creating an unstable design.

The 737 should have been redesigned as a new airplane. Boeing wanted to beat Airbus to market and total screwed the pooch. Their blunder is now costing far more than they made.

Thanks. Your comments were spot on.

Thanks for your detailed rebuttal. Very helpful.