Investigations of the Boeing 737 MAX crashes — one by Indonesia’s Lion Air in October 2018 and the other by Ethiopian Airlines in March 2019, causing a total loss of 346 lives — have isolated a flight control system, Maneuvering Characteristics Augmentation System (MCAS), as a probable cause. MCAS took over when it thought the planes were stalling. Except they weren't stalling. Investigators suspect damaged sensors gave a false stall reading and MCAS took control and put the aircraft into a dive. Pilots, never told MCAS was on board, did all they could do, but not knowing about MCAS, they were unable to fight it off.
How Did This Happen?
Initially, “a few lines of code,” MCAS was rather benign, requiring or demanding no attention, except in rare high-speed situations that had come up in simulator testing early in the development of the 737 Max. However, flight testing revealed the 737 MAX was not handling well in low-speed stall conditions due to its larger and more powerful engines. Boeing engineers volunteered a software fix and MCAS was revised to handle low-speed stall.
MCAS now had to be more powerful and act more severely to handle low-speed stall. Safeguards that prevented MCAS from taking control at low-speed were removed. Also removed was input from multiple sensors to detect stall.
MCAS had initially relied on two angle-of-attack (AOA) sensors, but the new version of MCAS, involved in both crashes, only used the one on the left side. Wind vane AOA sensors are often damaged. Both Lion Air and the Ethiopian Air flights were getting bad data, indicative of damaged sensors. It is not known when or why MCAS came to rely on a single sensor.
The Federal Aviation Administration (FAA) had approved MCAS in its initial design for the purpose of handling extreme high-speed situations. It was not informed that the flight control system had grown more powerful and would be applied more in more situations, reported The New York Times (NYT).
Not only did Boeing neglect to inform the FAA of the revised MCAS, it sought to keep it a secret from the airline pilots. Boeing’s chief technical pilot, Mark Forkner, requested in a March 30, 2016 email to senior FAA officials, that mention of MCAS be stripped from the 737 MAX pilot manual, reports the NYT.
He neglected to mention MCAS would be taking over in more flight situations, including more often encountered low-speed, stall situations. Boeing, playing by FAA rules, did not resubmit the revised MCAS because the changes of the control system applied during low-speed conditions, not extreme (interpreted as high-speed) conditions. Laboring under the impression that MCAS was functioning in its original benign state and would be rarely used, the FAA approved Forkner’s request.
Forkner currently works for Southwest Airlines and is responding only through his lawyer.
The FAA role — and especially how it may have been led by the very company it was supposed to be watching — is under investigation by the US Senate.
When the 737 MAX took flight with passengers, the FAA assumed it to be with the wimpy, benign flight control system, content to stay in the shadows, probably never used. But on-board was a pumped up and muscular MCAS, poised to take control of the aircraft. It was no longer chained by constraints. The pilots had no idea of a stowaway on board. The MCAS was programmed to act on signal: trim the stabilizers to pitch the aircraft down.
The FAA database of incidents records five complaints of 737 MAX pilots who could not control their aircraft. In addition, there were the aforementioned tragedies of Lion Air and Ethiopian Airlines flights.
Boeing test pilots flew the aircraft with the new, more powerful MCAS and tested two situations, a high-speed maneuver and one low-speed stall, where MCAS was activated and then “freezes.” What happened when the sensor was damaged? Such a scenario was considered, but was judged to be so unlikely, predicted to occur once every 10 million flight hours. A fleet of one hundred 737 Maxes would have to fly 10 hours a day every day of the year for 27 years to reach 10 million flight hours.
It only took 3 years for two 737 MAX planes to go down.
MCAS is Born
In 2012, veteran test pilot Ray Craig testing high-speed situations in a simulator in the early days of 737 MAX development, detected problems with the 737 MAX in certain high-speed cases. The FAA demands all passenger aircraft be able to handle a battery of extreme cases, like flying into another plane’s vortex. Boeing’s fix was the MCAS software. Craig, an old-school pilot and probably distrustful of a software fix, relented to MCAS. After all, it would only kick in when speeds were high and there were great g-forces — a combination rarely encountered.
When MCAS did kick in, MCAS would take over the control of the stabilizer (the horizontal wings on the tail) and force the aircraft’s nose down. The original version of MCAS allowed for a maximum of 0.6 degrees of rotation of the stabilizer for 10 seconds.
But in 2016, after the 737 MAX took off in its first test flight, test pilots reported “something was off.” The pilots were having trouble in low-speed stall conditions. These problems were thought to be due to the bigger, more powerful engines and their placement more forward than in the previous 737 model. Rather than apply an aerodynamic fix or have pilots try to handle these situations, MCAS was offered as a solution.
Since stall occurs at lower speeds and altitude but in greater air density, MCAS had to be far more aggressive, be more powerful and be able to rotate the stabilizers four times as fast: a rotation of up 2.5 degrees in 10 seconds.
Why Use MCAS?
Boeing, the world’s biggest aircraft manufacturer, introduced the 737 MAX as the next generation of its best-selling 737 model. New on the model were CFM’s LEAP-1B engines. CFM, the joint venture of GE and Frances’s Safran, had made these massive engines with 69-inch blade diameter, so big that the 737 MAX was going to have a problem with ground clearance. Boeing engineers solved this problem by mounting the engines up and forward from where the previous engines were mounted.
While this solved the ground clearance problem, the forward mounted, more powerful engines were thought to have caused problems in flight.
Sensors Under Attack
The AOA sensor used by the 737 MAX has a six-inch long, thin wind vane on the outside near the nose of the aircraft. The angle of the vane relative to the aircraft is a measure of the pitch of the aircraft, or whether it is nose down, level, or nose up. The sensors are prone to malfunction, often from bird strikes on the wind vane, but also from ice or water, impact from errant jetways, or even mechanics stepping on them. Investigators of the Ethiopian Airlines flight suspect the sensor used was struck by a bird. An FAA database reveals 122 strikes on the AOA vanes since 1995.
Aviation engineers are baffled about why Boeing relied on only the left angle of attack (AOA) sensor when the 737 MAX is equipped with an identical sensor on the other side. If the sensors are giving vastly different readings, it’s a safe bet that one is malfunctioning and MCAS should not kick in.
“A single point of failure is an absolute no-no,” said one former Boeing engineer who worked on the MAX and is anonymously quoted in The Seattle Times. “That is just a huge system engineering oversight. To just have missed it, I can’t imagine how.”
Mike Sinnett, Boeing vice president, insisted that single sensor is not a single point of failure because the pilot acts as a backup. Sinnett was called to answer “tough questions” from American Airline (AA) pilots in a meeting of the pilots union near AA’s North Texas headquarters a few weeks after the Lion Air crash. American Airlines was flying more 737 MAX aircraft than any other domestic carrier and the pilots were upset at learning a flight control system had been installed without their knowledge.
He did not know he was being recorded and the recording would be leaked to The Dallas Morning News. Sinnett downplayed the role of MCAS: "In a million miles, you're going to maybe fly this airplane, maybe once you're going to see this, ever.” There was no reason to burden the pilots with that information about MCAS, he added: “We try not to overload the crews with information that's unnecessary.”
Rising to Boeing’s defense was Captain Todd Insler, chairman of the United branch of the Air Line Pilots Association (ALPA) union, who defended MCAS as one of many systems on an airplane that work in the background without pilots’ knowledge. It’s like watching television, he said in an interview, “I don’t need to know how it works.”
Same Plane—Only Different
Despite selling the 737 MAX as a vastly improved aircraft, with more powerful yet more efficient engines, Boeing was telling the FAA and pilots that the 737 MAX was essentially the same plane as the previous version. Minimal retraining was required — “roughly 30-minute training program on a computer” and certainly no expensive simulator time, according to three former Boeing employees.Not having to retrain pilots with a new aircraft saved the airlines millions of dollars, says the NYT. It was also in Boeing’s interest to not have to certify a new aircraft. The MAX was being sold as its new, more efficient single-aisle aircraft and was competing head-on with Airbus SE, whose A320neo is on a path to take the lead from Boeing in the single-aisle passenger category.
Warning Indication a $80K Option
Boeing had a warning indication on the instrument panel for the 737 MAX that could have alerted pilots to an AOA sensor failure. The warning came with an AOA Disagree alert software program that relies on an optional AOA sensor. The AOA Disagree alert was sold by Boeing as an $80,000 option and neither the Lion Air or the Ethiopian Airlines flight ordered this option.
Even if they had, the system may not have worked. Boeing had known of the AOA Disagree alert not working as intended since November of 2017 — not long after the 737 MAX began commercial flights and before both crashes — but did not alert airlines of this until a year afterward. Upon questioning by U.S. lawmakers, Boeing revealed that it had not been planning to fix the warning light until 2020.
If Only They Had Known
Had pilots been informed of MCAS, could both the Lion Air and the Ethiopian Airlines disasters have been avoided? As is pointed out on Eng-Tips, on the center console of the MAX cockpit are two toggle switches under protective guards. Either pilot or copilot could flip up the guard and turn off the switch cutting off all electricity to the stabilizer, effectively neutralizing MCAS. Hand wheels the size of dinner plates on the sides of the console connect to cables that turn a screw that trims the stabilizers. That’s the theory.
In the Lion Air crash, evidence suggests that the pilots did not realize MCAS had taken over— or even that they knew about MCAS. They kept fighting MCAS which was convinced the plane was nose up (it wasn’t) and was bent in, “correcting” it. It ended up putting the aircraft into a dive.
Had they only known that a similar incident occurred on Indonesia’s full-service airline only a day before on a flight from Bali to Jakarta– and it was saved by a heroic, lightning-fast reaction of an off-duty pilot who just happened to be hitching a ride back home.
The pilot, unidentified in the Indonesian investigation, had leapt out of his jump seat in the cockpit and flicked off the stabilizer power switches, cutting off MCAS, returning manual control to the flight crew.
However, the pilots reported the incident only to maintenance staff. A mechanical check failed to find any malfunctioning equipment. And life went on. Except when it didn’t. Like the next day when the Lion Air crashed, and 89 people died.
Flying the Ethiopian Airline flight was a captain that had logged over 8,000 flight hours, over 1,400 hours in 737s and 103 hours in a 737 Max. From that fateful day, according to flight data, it looks as if he had succeeded in cutting off the power to the MCAS system when he encountered a problem.
A chart from the Wall Street Journal shows the MCAS signal received no input for almost three minutes which gave him back control of the aircraft and allowed him to ascend to a height of 7,000 ft. But at almost six minutes into the flight, the MCAS system was turned back on. If the sensor was indeed stuck and giving erroneous signals indicating the plane was nose up and in potential stall condition, MCAS may have acted swiftly flatten the plane out, but, in reality, sending it to an nosedive. It’s possible the pilots may have been struggling to control the stabilizers via hand wheels and succumbing to exhaustion, the forces against the overturned stabilizer too powerful to overcome. A nosedive from 7,000 feet made the aircraft hit the ground at 575 mph and left a crater 32-feet deep. All 157 on board perished.
Where Are We Now?
Despite multiple cases of MCAS incidents in the FAA database, protests by airline pilots who were not informed about MCAS, Boeing showed little sense of urgency and little admission of culpability. Subsequent to the first crash in October of last year, after Indonesia’s investigation blamed the faulty sensor, Boeing promised that a software upgrade for all 737 MAX aircraft would not be completed until six months later. In the meantime, the Ethiopian Airline flight crashed. Even after every 737 MAX was grounded, Boeing continued to claim the aircraft was safe, saying it had passed every test.
All airlines using the Boeing 737 MAX for passenger flights have withdrawn the aircraft from service. Boeing will be applying a fix that involves an angle of attack disagree indicator, incorporating input from a second sensor, reducing the force that MCAS can apply to less than the force the pilot can apply in a manual takeover, as well as additional training.
No timeline for getting the 737 MAX return to the skies has been approved by the FAA.