How Safe is the Boeing 737 Max's MCAS System?

[PeterDonis]

I would have assumed that the flight control computer's primary if not sole reason for existing is to make uncommanded actions.

I'm not saying the system should never take uncommanded actions. I'm saying that to have a system that can take uncommanded actions, particular ones that could be unrecoverable if wrong, the system needs to be able to detect when it could be wrong and shut itself down and warn the flight crew. For sensors, that means having multiple sensors and checking them against each other. For computers, it means having multiple computers and checking their output against each other. (Note that Airbus fly by wire aircraft already do the latter.)

I wonder if we have a modern bias?

Back when the Apollo computers were state of the art, computers weren't doing the things in airplanes that they are doing now, and they weren't taking the kinds of uncommanded actions that they do now.

 

[russ_watters]

Back when the Apollo computers were state of the art, computers weren't doing the things in airplanes that they are doing now, and they weren't taking the kinds of uncommanded actions that they do now.

Totally disagree. The Apollo spacecraft (both the lunar module and command module) were fly by wire -- the first. Neil Armstrong wasn't manually firing thrusters and throttling the LEM engine, he was telling the computer what he wanted the LEM to do and the LEM computer made it happen. For example, he had a dial with which he specified a descent rate. Armstrong was completely outside the control loop, providing one of the inputs, but none of the control.

...but I don't know the robustness/fault tolerance or if a manual mode existed.

I'm saying that to have a system that can take uncommanded actions, particular ones that could be unrecoverable if wrong, the system needs to be able to detect when it could be wrong and shut itself down and warn the flight crew. For sensors, that means having multiple sensors and checking them against each other. For computers, it means having multiple computers and checking their output against each other. (Note that Airbus fly by wire aircraft already do the latter.)

Again, I'm not disagreeing with you for *today*, but I'm not sure when exactly the 737 flight control computer was first introduced and if such robustness was possible then.

[edit]
Note; the 737 first flew in 1964, so at the time it could not have had a flight control computer at all. But it would have had some electromechanical control features.

 

[PeterDonis]

Neil Armstrong wasn't manually firing thrusters and throttling the LEM engine, he was telling the computer what he wanted the LEM to do and the LEM computer made it happen.

That's not the same as the LEM computer deciding what it's going to do without input from any human. The latter is what I mean by "uncommanded actions". The LEM did actually fly in that mode until the final descent stage, when the pilot had to start issuing commands.

However, the LEM was not an airplane. I said "airplanes" for a reason. The Apollo spacecraft were wonderful feats of engineering, but they weren't commercial products that flew routine routes every day. (To be more specific, I should have said "commercial airplanes".)

I'm not sure when exactly the 737 flight control computer was first introduced

AFAICT the first 737 variants to have one were the classics, starting with the 300 in 1984.

 

[artis]

I think Apollo example here is wrong, first of all it was still different from the modern situations , secondly since it was the absolute poster child of a project for America back then , I bet they literally checked a million times if everything works and went through extreme testing, because a failure in that era with a project like that would mean alot, in an atmosphere where the US competed with the Soviets and the moon landing was their stunt that could/eventually did set them ahead in the race, so yeah... I'd say that is/was totally different from what happens now in a very money driven commercial atmosphere where a company does everything they physically can to make something cheaper yet better.@hutchphd , I very much agree with what you assert about this being more of a management and corporate problem than a technical one.

@PeterDonis you stole words from my mouth when you said that a system where automation does things instead of humans needs to rely on multiple backups, I am fine with the older 737 having say a single AOA sensor as after all they have other alarms and the final judgement would be man made, I doubt a good pilot would go into stall simple because the single sensor was faulty as other sensors would still guide him.
But surely a system that decides in your place should definitely have multiple secondaries as well as Boeing should have built a clear and easy to use disabling switch for the system so that even if it fails from it's single sensor input, the pilot would simply disable it and go manually.
The pilots in the doomed crashes actually tried taking over and they would have been just fine if they disabled the system but due to stress and the disabling function being so complicated and rather "hidden" things went south.
So the question is why Boeing did not make the disabling of the system a priority lesson in their manuals and a regular "must learn and remember" thing.
(Probably because then they would admit that their system is bad and questions would arise)

 

[PeterDonis]

Boeing should have built a clear and easy to use disabling switch for the system

Disabling the stability trim system does disable MCAS in the MAX. The problem is that it also disables the electric motors that normally adjust the trim, so if the pilot disables stability trim when MCAS has adjusted it way off from where it should be, the pilot has to manually adjust it back using the trim wheel, which (a) takes too long, and (b) is apparently not even possible if the trim was put far enough out of whack by MCAS, the pilot simply is not capable of physically exerting enough force on the trim wheel.

The pilots in the doomed crashes actually tried taking over and they would have been just fine if they disabled the system

IIRC the pilots in one of the crashes did turn off stability trim--but in the regime where recovery using the manual trim wheel was not possible (see above).

 

[artis]

I think the point of having backups for seemingly simple systems is very important, I just about remembered Three Mile Island, and IIRC the operators saw that the light for the actually stuck open pilot relief valve showed that it is closed.There were other malfunctions there in TMI also but this single one with the relief valve being open could have saved the plant and the fate of the industry.
Same could be said about the 737 MAX, many small faults, a poor upgrade on an otherwise old plane but in the end of the day it's a single this or that that brings down the plane, in this case faulty AOA sensor.

PS. @PeterDonis that is exactly why I said Boeing should have made the MCAS disabling as easy as pushing a switch. I understand , complicated systems can malfunction but that is exactly why one makes sure they have a safe backup and no hassle by the end of the day.

 

[PeterDonis]

the question is why Boeing did not make the disabling of the system a priority lesson in their manuals and a regular "must learn and remember" thing.

737 pilots are trained to disable the stability trim system in a runaway trim situation. Boeing's initial logic was that an MCAS failure would present to the pilot the same as runaway trim, so the pilot would just do what they were already trained to do in a runaway trim situation. The problem was, first, that it turns out that MCAS failure does not look the same as runaway trim to the pilot, and second, that the runaway trim recovery procedure, disabling stability trim, might not actually recover from the problem (see my previous post).

 

[PeterDonis]

hat is exactly why I said Boeing should have made the MCAS disabling as easy as pushing a switch

It is. But that didn't help. See my post #497.

 

[artis]

I understand , the system being as it was could screw up the planes position so badly that even disabling it with a quick kill switch wouldn't help, they would essentially also need a way in which to quickly revert the trim of the rear horizontal stabilizer back to usable position, the wings are operated by servo motors driving a jackscrew so either some electric analog control or something as doing it by hand in a situation with the plane having no altitude and a nosedive is not fast enough.

 

[PeterDonis]

in the end of the day it's a single this or that that brings down the plane

No, it isn't. It's always a chain of multiple events.

In the Lion Air and Ethiopian Air crashes, there were multiple ways in which the crashes could have been avoided:

(1) The airlines could have bought the extra package that included an AoA sensor readout in the cockpit, which would have told the pilots that the AoA sensor was malfunctioning. Note that the US flag airlines that bought 737 MAX aircraft did buy this package.

(2) The pilots could have disabled stability trim sooner, as soon as the first problems appeared, instead of leaving it on and allowing MCAS to make repeated trim adjustments that eventually put the plane into a state that was not recoverable when stability trim was disabled.

(3) The pilots could have used the manual electric trim adjustment to get trim back to something close to neutral, in between MCAS adjustments, and then disabled stability trim and therefore MCAS. In the Lion Air case, IIRC, the previous flight of that same aircraft, the day before, encountered the same problem, and another pilot who was not part of the flight crew but was sitting in the jump seat in the cockpit figured out what was going on and told the flight crew to do this, and they did, and completed the flight safely.

 

[artis]

Well sure they could have done this and that and would have been fine, to be honest I think it's a kind of stupid policy to take an instrument read out which is critical for safety on said plane and to make it as an additional package that one has the choice to buy separately.
Almost resembles these "top shop" TV ads where they say "Buy a car, call now" and then with much smaller words at the bottom of the screen it says "engine and wheels come separately"

 

[Gatekeeper1958]

MCAS, MCAS, MCAS...The flight instability with the 737 Max is structural. The problem was caused when Boeing placed the Larger CFM LEAP Engines forward and up in front of the Wings where they should NOT be. This caused the Max to fail the required FAA Flight Tests. What Boeing should have done is use taller main Landing Gear to be able to fit the larger Max Engines PROPERLY under the wing in a similar position as on the 737NG (Next Generation) Aircraft. The 737NG do not have, and do not need MCAS.

Boeing will then obtain near 737NG levels of flight stability, pass the FAA flight tests. The 737 Max 10 have 9.5 inch taller landing gear, and have more than enough room to Properly place the engines under the wing and maintain the 17 inches ground clearance required by the FAA. The Max 7,8, and 9 Aircraft could be re-equiped with the new, taller landing gear.

This Reengineering Solution only requires the Taller Landing Gear, and new engine hangers, thereby utilizing more than 98% of the existing hardware of the Max. I believe flight testing the new Reenginered Max could be accomplished in 6-12 months.

One reason I favor this solution is the mere mention of MCAS brings a feeling of fear, and mistrust, even nausea by the flying public. The Reenginered Max could also be renamed to something like 737 Eagle, something Majestic, and Safe. If you have ever seen an American Bald Eagle flying, it is certainly something magnificent to behold. I have seen several other articles by Aviation Engineers suggesting this solution. I personally will not fly a Max by any name unless the engines are placed properly on the wings. Dennis E Sullens, 29 year's Aviation Quality Assurance, 19 year's with Boeing, Retired.

 

[Gatekeeper1958]

MCAS, MCAS, MCAS References below:
¶
FOOTNOTE 01. Aviation Engineers Criticize Engine Placement.¶
¶
https://samchui.com/2019/07/10/easa-identifies-737-max-autopilot-fault/¶

EASA IDENTIFIES 737 MAX AUTOPILOT FAULT.¶
by AARON HILSZ-LOTHIAN, JULY 10, 2019¶
¶
"Past and present engineers within the aviation industry have flagged the aircraft as unsafe to fly because it is not a software problem, it is a structural problem that required the MCAS system in the first place."¶
¶
"A redesign of the engine position on the aircraft would cost a ridiculous amount of money and would likely render the grounded aircraft useless [I think a safe reenginered Max will sell and make billions of dollars]. Flight testing and new production methods would have to be conducted, leaving the idea in the scrap bin." [But there is still time for the Max 10, and may cost Billions more, and more death's if MCAS' short cut is pursued. The question that should be asked is: "What if MCAS can NOT safely solve the inherent Flight Instability in the Max? What if placing the larger Max Engines PROPERLY under the wing is the only safe solution, regardless of cost?]¶
¶
"Despite this the idea to add or redesign hardware hasn’t been completely disregarded as EASA director Patrick Ky said, retrofitting additional hardware relating to the angle of attack sensors was still an option."¶
¶
FLAGNOTE 01 (Continued).¶
¶
FORMER BOEING OFFICIAL REFUSES TO TURN OVER 737 MAX DOCUMENTS¶
By AARON HILSZ-LOTHIAN, SEPTEMBER 9, 2019¶
¶
https://samchui.com/2019/09/09/form...-to-turn-over-737-max-documents/#.XXqBj1NlA0M¶
¶
"A former Boeing official has refused to turn over crucial 737 MAX development documentation, after he cited the Fifth Amendment."¶
¶
"According to The Seattle Times, Mark Forkner, Boeing’s chief technical pilot on the 737 MAX program, refused to turn over documents requested by the U.S. Department of Justice as part of their investigation."¶
¶
"During his time at Boeing, it is said that he was often anxious about deadlines and management pressure, during the development of the 737 MAX, resulting in frequent visits to peers for help."¶
¶
"Adding to the curiosity within the investigation, Forkner was behind the suggestion of not informing customers of the Maneuvering Characteristics Augmentation System (MCAS)."¶
¶
"MCAS was designed in a last minute attempt to overcome a handling characteristic, this saw the nose pitch up as a result of the forward and high mounted CFM LEAP engines."¶
¶
"A flawed design, the system would take angle of attack data, from a single sensor, and adjust the horizontal stabiliser to point the nose down if a stall was imminent."¶
¶
"It is this system that is believed to be the cause of the crashes of Ethiopian Airlines Flight 302 and Lion Air Flight 610, both resulting in 346 lives gone."¶
¶
"Worsening the situation, the zero mention of MCAS was paired with an agreement to train pilots digitally through a one hour differences course."¶
¶
FLAGNOTE 01 (Continued).¶
¶
Software Won’t Fix Boeing’s ‘Faulty’ Airframe¶
By George Leopold, 03.27.19 ¶
¶
https://www.eetimes.com/document.asp?piddl_msgid=383631&piddl_msgposted=yes&doc_id=1334482&page_number=2¶
¶
The saga of Boeing’s 737 MAX serves as a case study in engineering incompetence, and in engineering ethics – or the lack thereof.¶
¶
New details have emerged about the competitive pressures placed on Boeing 737 engineers as the aircraft manufacturer scrambled to fend off defections by major U.S. airlines to rival Airbus. The European consortium was challenging Boeing’s flagship product with its upgraded A320neo. According to reports, U.S. carriers like American Airlines were preparing to switch to the longer-range Airbus mode.¶
¶
Boeing responded with what it claimed was an upgraded version of its workhorse 737 equipped with a larger CFM LEAP engine providing longer range and greater fuel efficiency. The larger engines required Boeing engineers to place them far ahead of the wing leading edge to achieve [FAA required 17 inches] ground clearance.¶
¶
That design decision meant the 737 MAX would tend to pitch up while accelerating or when the aircraft experienced a high angle of attack – the angle between the wing and the direction of flight. The proposed solution to the pitch-up problem—and a means of achieving flightworthiness certification—was a software system called MCAS.¶
¶
Critics assert the engine placement effectively made the 737 MAX series a fundamentally different aircraft with different handling characteristics requiring new operational software and pilot training. The re-certification process Boeing sought to avoid for competitive reasons would have been lengthy and expensive.¶
¶
Among Boeing’s critics is Gregory Travis, a veteran software engineer and experienced, instrument-rated pilot who has flown aircraft simulators as large as the Boeing 757. Travis posted a damning critique of the 737 MAX fiasco last week that concluded: “It is likely that MCAS, originally added in the spirit of increasing safety, has now killed more people than it could have ever saved. It doesn’t need to be ‘fixed’ with more complexity, more software. It needs to be removed, altogether. (Travis is sharing his evaluation as a Google Doc, located here.)¶
¶
Travis is unequivocal in his assessment of the Boeing 737 MAX. “It’s a faulty airframe. You’ve got to fix the airframe [and] you can’t fix the airframe without moving the engines” back and away from their current position.¶
¶
Ultimately, Travis also bemoans what he calls “cultural laziness” within the software development community that is creeping into mission-critical systems like flight computers. “By laziness, I mean that less and less thought is being given to getting a design correct, and simple – up-front,” he wrote. “What needs to happen, I think, is for liability to accrue where it is generated.”¶
¶
Incompetent or Unethical?¶
¶
Whether the cautionary tale of Boeing 737 MAX is a question of ethical engineering – doing things right the first time, making damned sure mission-critical systems work with five nines (99.999 percent) or higher reliability with built-in redundancy – remains an open question.¶
¶
“IT MAY JUST BE ENGINEERING INCOMPETENCE,” TRAVIS CONCLUDES.¶
¶
That, or economic and competitive pressures that led Boeing to effectively conceal the existence of MCAS as a way to avoid a lengthy recertification process for the 737 MAX, a process requiring extensive pilot retraining on expensive new simulators. All would have raised the unit cost of each aircraft by millions of dollars, Travis noted, thereby reducing Boeing’s chances of competing with the Airbus 320neo.¶
¶
The Boeing 737 MAX tragedies also recall the engineering decisions that led to the shuttle Challenger disaster in 1986 and the Apollo 1 fire in 1967. Boeing’s haste in responding to the Airbus challenge reminds Travis and others of the group-think curse called “Go Fever” during Project Apollo that eventually killed the crew of Apollo 1 during a launchpad simulation. In that case, crew safety was sacrificed in the name of schedule.¶
¶
Boeing’s engineering decisions while hastily developing the 737 MAX have ultimately resulted in the deaths of [346] people.¶
¶
Travis expects one of two possible outcomes for Boeing. “I see a scenario where they don’t sell any more of these planes.” More likely, he continues, is an announcement in coming days [Posted 27 March 2019] that the aircraft maker is fixing the MCAS software to handle inputs from multiple angle of attack sensors.[FN 01 and FN 04].¶
¶
Either way, Travis concludes, “Software [now] stands between man and machine.”¶
¶
— George Leopold is the former executive editor of EE Times and the author of Calculated Risk: The Supersonic Life and Times of Gus Grissom (Purdue University Press, Updated, 2018).¶
¶
FOOTNOTE 02. 737 Max 10 Landing Gear are 9.5 inches taller.¶
¶
https://www.flightglobal.com/news/a...details-737-max-10-landing-gear-design-451546/¶
¶
FLAGNOTE 03: Virgin Airlines switches Max 8 to Max 10's.¶
¶
https://www.google.com/url?sa=t&sou...FjAAegQIAxAB&usg=AOvVaw14wQobQHnwCduWhCVBskKx¶
¶
FLAGNOTE 04. EASA 737 MAX REQUIRED IMPROVEMENTS FOR CERTIFICATION:¶
¶
https://www.google.com/url?sa=t&sou...Vaw0luTe1ErtWK6xb9xdNly3m&cshid=1567041030325¶
¶
FLAGNOTE 05. US FAA Regulations for Anti Stall and Flight Stability of Commercial Aircraft against 737 Max.¶
¶
"The LEAP engine nacelles are larger and had to be mounted [if main landing gear is not taller as the B-Max 10] slightly higher and further forward from the previous NG CFM56-7 engines to give the necessary [17 inch] ground clearance. This new location and larger size of nacelle cause the vortex flow off the nacelle body to produce lift at high AoA [Angle of Attack]. As the nacelle is ahead of the C of G [Center of Gravity], this lift causes a slight [?] pitch-up effect (ie a reducing stick force) which could lead the pilot to inadvertently pull the yoke further aft than intended bringing the aircraft closer towards the stall. This abnormal nose-up pitching is not allowable under 14CFR §25.203(a) "Stall characteristics".¶
¶
Several aerodynamic solutions were introduced such as revising the leading edge stall strip and modifying the leading edge vortilons but they were insufficient to pass regulation. MCAS was therefore introduced to give an automatic nose down stabilizer input during elevated AoA [Angle of Attack] when flaps are up. [Dennis E Sullens: According to "Aviation Best Practices" and many Aviation Engineers (FN01), at this point of failing the Wind Tunnel and Flight Testing, Boeing should have made BOTH main and front Landing Gear taller and then place Lager Max Engines PROPERLY under the wing, thereby bringing the Max to near 737NG levels of flight stability, passing the FAA Flight Stability requirements, and thereby eliminating the need for MCAS. No MCAS, no Problems. Everybody is happy.]"¶
¶
14CFR §25.203 Stall characteristics.¶
¶
"(a) It must be possible to produce and to correct roll and yaw by unreversed use of the aileron and rudder controls, up to the time the airplane is stalled. No abnormal nose-up pitching may occur. The longitudinal control force must be positive up to and throughout the stall. In addition, it must be possible to promptly prevent stalling and to recover from a stall by normal use of the controls."¶
¶
http://www.b737.org.uk/mcas.htm¶
¶
FLAGNOTE 06. Flight Crashes Resulting In Death's, Aircraft Company and Model Compared.¶
¶
http://www.airsafe.com/events/models/rate_mod.htm¶
¶
Boeing's Troubled Tanker Has Its Wings Clipped Again¶

One of the company's flagship military programs suffers a fresh setback.¶

Lou Whiteman
(TMFeldoubleu)
Sep 14, 2019 at 4:32PM

¶
https://www.google.com/amp/s/www.fo...oubled-tanker-has-its-wings-clipped-agai.aspx¶

"In a worst-case scenario, cargo pallets rolling free in the cargo hold could be a danger to crew and could unbalance the aircraft, making it hard to control. It is not yet clear if the issue was limited to one defective latch, or there's a systemic problem that will lead to a comprehensive redesign and retrofit." End of Article.¶
¶
[Dennis E Sullens: if "comprehensive redesign and retrofit" is appropriate for a 767 cargo latch when the problem is "systemic" then even more so justified with the systemic 737 Max Flight Instability (due to improper engine placement), don't you think?]¶

 

[PeterDonis]

Engines forward and up in front of the Wings where they should NOT be

Plenty of other aircraft, including other Boeing aircraft (the 757 and 767, for example), have engines placed forward on the wings in a similar way. So to simply say that engines should not be there is too strong a claim.

This caused the Max to fail the required FAA Flight Tests.

What tests did it fail?

 

[Dr Transport]

https://www.seattletimes.com/business/boeing-aerospace/boeing-pushed-faa-to-arelax-737-max-certification-requirements-for-crew-alerts/

recent article on Boeing write offs, somewhere near $9 Billion, so far. I'm sure it will cost them more down the road and in lost orders.

 

[Gatekeeper1958]

Answer to PeterDonis' questions:

1.) The 757 and 767 did NOT have the Engines forward of the Center of Gravity.

2.) What FAA tests did the Max fail? FLAGNOTE 04.) Of the Reference section above in: 14CFR §25.203 Stall characteristics. See above for details.

Please read entire Reference Section. There are weblinks to the various Articles supporting the Reengineering solution that myself and others in the Aviation Industry suggest.¶

 

[PeterDonis]

The 757 and 767 did NOT have the Engines forward of the Center of Gravity.

I didn't say they were. I said they were forward on the wing, which they are, as a simple look at a photograph will tell you. You said:

Engines forward and up in front of the Wings where they should NOT be

If what you meant was "engines forward of the center of gravity where they should NOT be", then that's what you should have said.

Also, from your earlier post:

That design decision meant the 737 MAX would tend to pitch up while accelerating or when the aircraft experienced a high angle of attack

The 757 and 767 have this same behavior. But they had it when they were first designed, so their original designs took it into account, and so did their original type certifications from the FAA. That's a huge difference between them and the 737 MAX.

FLAGNOTE 04.) Of the Reference section above in: 14CFR §25.203 Stall characteristics.

I see nothing in that link that references that 14CFR section or talks about the 737 MAX failing it.

There are weblinks to the various Articles supporting the Reengineering solution that myself and others in the Aviation Industry suggest.

Just to be clear, I am not in any way disputing that there are better solutions than the one Boeing chose.

 

[Gatekeeper1958]

Reply to PeterDonis'questions:
The 757 and 767 Engines are not above the wings, and forward of the Center of Gravity, as is the case with the Max Aircraft. Yes, I could of been more clear. The conclusion that I made that the Max Engines are improperly placed causing Flight Instability, and Stall during FAA required maneuvers is heavily substantiated by the referenced Articles and Aviation Engineers.

PeterDonis said:
"I see nothing in that link that references that 14CFR section or talks about the 737 MAX failing it."
Gatekeeper 1958, Dennis E Sullens said in
FLAGNOTE 05. US FAA Regulations for Anti Stall and Flight Stability of Commercial Aircraft against 737 Max.¶
¶
"The LEAP engine nacelles are larger and had to be mounted [if main landing gear is not taller as the B-Max 10] slightly higher and further forward from the previous NG CFM56-7 engines to give the necessary [17 inch] ground clearance. This new location and larger size of nacelle cause the vortex flow off the nacelle body to produce lift at high AoA [Angle of Attack]. As the nacelle is ahead of the C of G [Center of Gravity], this lift causes a slight [?] pitch-up effect (ie a reducing stick force) which could lead the pilot to inadvertently pull the yoke further aft than intended bringing the aircraft closer towards the stall. This abnormal nose-up pitching is not allowable under 14CFR §25.203(a) "Stall characteristics".¶
¶
Several aerodynamic solutions were introduced such as revising the leading edge stall strip and modifying the leading edge vortilons but they were insufficient to pass regulation. MCAS was therefore introduced to give an automatic nose down stabilizer input during elevated AoA [Angle of Attack] when flaps are up. [Dennis E Sullens: According to "Aviation Best Practices" and many Aviation Engineers (FN01), at this point of failing the Wind Tunnel and Flight Testing, Boeing should have made BOTH main and front Landing Gear taller and then place Lager Max Engines PROPERLY under the wing, thereby bringing the Max to near 737NG levels of flight stability, passing the FAA Flight Stability requirements, and thereby eliminating the need for MCAS. No MCAS, no Problems. Everybody is happy.]"¶
¶
14CFR §25.203 Stall characteristics.¶
¶
"(a) It must be possible to produce and to correct roll and yaw by unreversed use of the aileron and rudder controls, up to the time the airplane is stalled. No abnormal nose-up pitching may occur. The longitudinal control force must be positive up to and throughout the stall. In addition, it must be possible to promptly prevent stalling and to recover from a stall by normal use of the controls."¶

PeterDonis said:"The 757 and 767 have this same behavior.
Gatekeeper1958, Dennis E Sullens Reply: All engines below the wing tend to pitch up upon Maximum Thrust. Your point about the 767 and 757 having the "same behavior" is not applicable to the 737 Max for the following reasons:
1.) The 767 and 757 passed the FAA flight tests, the Max failed.
2.) After failing the FAA Flight Tests, the Max needed MCAS (if Engines were not repositioned), the 767 and 757 do not need MCAS.
3.) The 767 and 757 have their engine placement very close to the Center of Gravity. The Max's do NOT.
4.) The 767 and 757 are some of the safest Aircraft ever made. The Max is one of the most dangerous. For example, the 737NG have a 0.06 chance of crashing per 1,000,000 hour's of flight. The 737 Max has a 3.08 per million hours of flight, about 50 times worse. The 767 crash rate is 0.28 per Million hours, and the 757 is 0.22 per Million hours. So they have Engines forward of the wing, but not up and in front of the wing, and not forward of the Center of Gravity. Big differences, and not really the "same behavior."

 

[berkeman]

@Gatekeeper1958 -- Please use the Quote/Reply feature when quoting other users. Click-drag across the text you want to quote, and click the "Reply" popup. That pastes that text into the Edit window inside a Quote Box with the other user's username and a link to the post that you are quoting. That makes it much easier to read your replies that have quotes in them.

Like this:

Gatekeeper 1958, Dennis E Sullens said in
FLAGNOTE 05. US FAA Regulations for Anti Stall and Flight Stability of Commercial Aircraft against 737 Max.

Thank you.

 

[PeterDonis]

FLAGNOTE 05

Ok. You said FLAGNOTE 04 before, so that's where I looked.

The 767 and 757 passed the FAA flight tests, the Max failed

Yes, because the 767 and 757 were designed from the start with the engines mounted forward on the wing, but the 737 was not, and so moving the engines forward on the 737 MAX changed its behavior. If the 737 had been designed from the start with engines forward on the wing, proper account of that would have been taken from the start, like it was with the 767 and 757.

The 767 and 757 have their engine placement very close to the Center of Gravity. The Max's do NOT.

Is there an available reference online that shows where the CG is on these aircraft? I have not been able to find one.

 

[Gatekeeper1958]

Is there an available reference online that shows where the CG is on these aircraft? I have not been able to find one.

Why is it necessary? The mere fact that the 767 and 757 passed the FAA required Wind Tunnel and Flight Testing, and the lack of MCAS, and the decade's of safe flying all point to a well designed aircraft, where the Max is not. Back in the 1980's this was common knowledge to Boeing employees like myself, and I could have called the Engineering Dept. to get the information you requested. But for now, I am now retired, and do not feel the need to relearn what to me appears obvious. I am sure you can research, and acquire a weblink if you are still in doubt. If you can get a photo of the side of the Aircraft, the Center of Gravity is approximately in the middle. Best wishes, Dennis E Sullens.

 

[hutchphd]

Why is it necessary? The mere fact...

It seems to me simple "no I don't have access to that anymore" would have sufficed...

 

[PeterDonis]

Why is it necessary?

Because we like to have references here.

I am sure you can research, and acquire a weblink if you are still in doubt.

I've already tried that. If I had found something on the web I wouldn't have needed to ask the question.

If you can get a photo of the side of the Aircraft, the Center of Gravity is approximately in the middle.

Yes, but that "approximately" doesn't help much if I'm trying to assess a statement like this:

The 767 and 757 have their engine placement very close to the Center of Gravity. The Max's do NOT.

Side views of the 737 max and 767, in particular, look very similar.

 

[Gatekeeper1958]

Side views of the 737 max and 767, in particular, look very similar.

The photo of the side view of the 767-300 shows the Engine maybe 6 inches ahead of the forward edge of the Wing to Body join. The 737 Max 10 is closer to 2 feet ahead of the forward edge of the Wing to Body join. See photos.

 

[PeterDonis]

The photo of the side view of the 767-300 shows the Engine maybe 6 inches ahead of the forward edge of the Wing to Body join. The 737 Max 10 is closer to 2 feet ahead of the forward edge of the Wing to Body join.

Ok, thanks, this makes the issue much clearer.

 

[artis]

I think for some this may be a bit emotional to admit that Boeing (which is the largest airplane manufacturer of the US) has made such apparent errors but it seems and everything points that they indeed have.Engineers make bad choices too, the questions is when ad why, if something that is unknown to our scientific knowledge affects a design then at least we can say "no one knew" but sadly here as well as elsewhere it;s the role of money. Pressure from shareholders and as we see not always competition is a good thing in a free market economy.
Competition is good when there are many many smaller parties at play, but for large , high revenue companies where there are only say few players in the field like in aerospace such competition can lead to bribery, relaxing of standards etc.
Normally rules and regulation take care of this , the question is why Boeing was able to slip through these?

 

[Gatekeeper1958]

I think for some this may be a bit emotional to admit that Boeing (which is the largest airplane manufacturer of the US) has made such apparent errors but it seems and everything points that they indeed have.

I agree with everything Artis said. Not just the above quote. When Alan Alda playing a US Senator in the 2004 movie "The Aviator" asked Howard Hughes if hiring Prostitutes, and paying for Fancy Hotel rooms and dinner's for US military officials could be considered "a bribe," Leonardo DiCaprio playing Hughes answered "Yes."

Later, in real life when US Senator McCain asked the CFO of Boeing the same question about bribing Airforce officials in regards to the 767 Tanker contract worth billions of dollars, the CFO (who served prison time) almost could not believe the question being asked, because he was not the only one. It is simply, the Music Stopped, and there were no more chairs for him to sit on. In other words, it was his turn. Boeing paid the 500 million dollar Government fine with the bonus monies it had promised to the Union workers like me, with the US promise of no further Dept. of Justice prosecutions. The CEO resigned with no prison time, and no indightments. This is all because the Aircraft industry is so corrupt. I won't give further details, needless to say, Artis is correct, and I agree with his comments above. There are many Articles on the subject. I list just one below by "The Herald."

https://www.heraldnet.com/news/boeing-has-a-tense-past-with-mccain/

 

[Gatekeeper1958]

The CEO resigned with no prison time, and no indightments.

"... no prison time, and no indictments." Spelling correction.

 

[anorlunda]

When we speak of automation and uncommanded actions, we must not use narrow definitions. All autopilots are automation. All take uncommanded actions (duh, that's their purpose.) Using broad definitions, we can say that they are all AI, no matter how old fashioned.

My boat could steer itself using uncommanded actions with this non-electronic wind-powered automation system. It had no redundant sensors, no redundant actuators. My backup was to steer manually 24x7xWeeks until port. If I couldn't do that, the results could be fatal to all on board.

Some might say that this self-steering is not comparable to MCAS because MCAS is digital and has software. My reply to that is, "baloney."

 

[Gatekeeper1958]

All autopilots are automation. All take uncommanded actions (duh, that's their purpose.)

The difference between Auto Pilot and MCAS is the Human Pilot engages the Auto Pilot, where MCAS engages without consent of the Human Pilot or Co-Pilot. MCAS is supposed to work in the background. Now that Boeing has "Watered Down" MCAS so that it will NOT engage if the two Angle of Attack sensors do not agree, will cause future Crashes and loss of life due to the Max's tendency to stall during certain required manoeuvers by the FAA. Or when the MCAS only activates one time, when more times are needed. So MCAS won't kill them, but the Max's inherent Flight Instability and tendency to Stall, will kill people if Boeing continues with this very bad Software Solution.

What Boeing should do is solve the "Root Cause" of the Flight Instability by placing the Larger CFM Leap Engines under the wing, near the Center of Gravity similar to the 737NG. The 737NG do not have, and do not need MCAS. This can be done using the 9.5 inch taller main Landing Gear of the Max 10 on the smaller Max 7,8, and 9 aircraft. The taller landing gear will provide more than enough room for the FAA required 17 inches of ground clearance. Then the Max's will pass the FAA required manoeuvers without MCAS.

No MCAS. No problems. Everybody is happy.

 

[PeterDonis]

All autopilots are automation. All take uncommanded actions (duh, that's their purpose.)

Yes, agreed.

My boat could steer itself using uncommanded actions with this non-electronic wind-powered automation system. It had no redundant sensors, no redundant actuators. My backup was to steer manually 24x7xWeeks until port. If I couldn't do that, the results could be fatal to all on board.

Yes, and if you were trying to sell commercial travel by boat to paying customers, you would find yourself either having to add more automated redundancy to the system or having to keep enough backup humans on board to ensure that someone who was sufficiently awake and functional was always on watch to respond to problems. Or most likely both.

Some might say that this self-steering is not comparable to MCAS because MCAS is digital and has software.

I agree with you, your self-steering system is a perfectly good automated system. (Older Navy ships had similarly non-digital non-computer control systems for things like boilers.) The difference between it and MCAS is just the safety requirements, not any inherent distinction between digital/software and non-digital/non-software automated systems.

 

[PeterDonis]

The difference between Auto Pilot and MCAS is the Human Pilot engages the Auto Pilot, where MCAS engages without consent of the Human Pilot or Co-Pilot.

The stability trim system in previous 737 models also engages without consent of the human flight crew. So while both that and MCAS are different in that respect from the autopilot, I don't think that's the crucial factor. I think the crucial factor is that MCAS was implemented badly (and, as you say, was only implemented at all because of a serious change in the flight characteristics of the plane due to the new engines, which could have been avoided by making other design changes from the start such as the longer landing gear--whereas the previous stability trim system, as far as I can tell, is dealing with flight characteristics that pretty much every plane has).

 

[Gatekeeper1958]

The stability trim system in previous 737 models also engages without consent of the human flight crew.

Yes, this is true about the "Stability Trim" system working in the background on the 737NG, and also "Rudder Stability" during heavy Cross-Wind also work's in the background.

The bottom line is that the 737NG's are among the safest Aircraft in the world with a crash rate of 0.06 per million hours of Flight Time, compared to the Max's 3.08 per million hours of Flight Time, about 50 times greater chance of death, than the NG's.

If another Max crashes because of a Faulty Angle of Attack sensor did not agree, disengaging the MCAS, and the Max goes into a Stall unprotected. This could be dissaterous for Boeing.

No, the MCAS was a bad idea from the very start. Boeing needs to reposition the Engines. Then there will be no need for MCAS, and the Max's should enjoy a safe Crash status, just as the Next Generation 737 have. This is the only Happy Ending that I can figure out. But the Lawmakers, Boeing, FAA, are not talking about this Engine repositioning solution to the problem. Only Patrick Ky of EASA talked about this idea briefly in July.

I am very worried we will have more Max crashes, more blood on the hands of Boeing and the Regulators. Boeing will become the "Sony" of the Aviation Industry only assembling the aircraft, and putting their label on it, with very little "Value Added." And the Max will become the "Corvair" of the Aviation Industry. Remember Ralf Nader's book: "Corvair, Unsafe at any Speed." This might be what the future holds for the 737 Max.

The News Articles I listed above [MCAS, MCAS,MCAS References] have the Weblinks to the statistics I mentioned here in this comment.

 

[anorlunda]

Yes, and if you were trying to sell commercial travel by boat to paying customers, you would find yourself either having to add more automated redundancy to the system or having to keep enough backup humans on board to ensure that someone who was sufficiently awake and functional was always on watch to respond to problems. Or most likely both.

I think that is a bit overstated. The vessel itself meets all applicable USCG requirements as is. To carry passengers commercially requires a Captain's license but no additional equipment for the boat.

Worldwide, even big cruise ships require seagoing tows to get back to port several time per year. What does that tell us about multiple layers of backup/redundancy?

Regulators can and do impose layer after layer of detailed engineered safety systems on airplanes and nuclear power plants. All of them are anti-KISS by definition. I wish we had agreed upon methods to conclusively prove whether they add to safety or subtract from it.

In the case of automobiles, we have a much larger statistical base. That makes it practical to conclusively prove that features like seat belts or airbags really do save lives. But in other fields with sparse statistical data, the benefits of adding complexity for engineered safeguards must be taken on faith. We can argue that they are more effective than a Saint Christopher medal, but we can't prove it.

More redundant sensors plus systems to resolve disagreements? Sure; why not? Anti-KISS. Who cares about KISS? If you want to argue KISS, you must carry the burden of proof.

Forgive my rant. I wish we could apply the same rigor to safety engineering that we do to physics. If we had rigor, we wouldn't need threads with 500+ posts full of opinions (including this post )

 

[russ_watters]

1.) The 767 and 757 passed the FAA flight tests, the Max failed.
2.) After failing the FAA Flight Tests, the Max needed MCAS (if Engines were not repositioned), the 767 and 757 do not need MCAS.

.Now that Boeing has "Watered Down" MCAS so that it will NOT engage if the two Angle of Attack sensors do not agree, will cause future Crashes and loss of life due to the Max's tendency to stall during certain required manoeuvers by the FAA.

Yeah, I really want to see your sources for this too. I don't know if you are being sloppy again, but you are saying that the Max was designed, built and flown without MCAS, then it failed a certification test (for internal testing or official), then it was redesigned to include MCAS. This is something I've never heard and it would be incredible and newsworthy if true. Among other things it would mean that Boeing engineers were incapable of predicting how the geometry change would affect flight characteristics. It also implies the Max should not be certifiable - and I don't see anyone of note suggesting that.

Further, you seem to be saying the Max will stall on it's own, without pilot input. But my understanding of the behavior of the Max is that it never requires forward pressure on the yoke to avoid stall but rather just doesn't have a progressively increasing backpressure (without MCAS). This means it will not stall on its own; if you let go of the yoke the nose will drop. But the PILOT may inadvertently cause a stall by holding a constant backpressure and not expecting the nose to keep rising.

From your post #503:

this lift causes a slight [?] pitch-up effect (ie a reducing stick force) which could lead the pilot to inadvertently pull the yoke further aft than intended bringing the aircraft closer towards the stall. [emphasis added]

I've never seen a source describe clearly and precisely how the uncorrected Max behaves and how it feels to the pilot. Most news sources use imprecise language.