The testing in 2012, with air flow approaching the speed of sound, allowed engineers to analyze how the airplane's aerodynamics would handle a range of extreme maneuvers. When the data came back, according to an engineer involved in the testing, it was clear there was an issue to address.
Engineers observed a tendency for the plane's nose to pitch upward during a specific extreme maneuver. After other efforts to fix the problem failed, the solution they arrived at was a piece of software -- the Maneuvering Characteristics Augmentation System (MCAS) -- that would move a powerful control surface at the tail to push the airplane's nose down.
This is the story, including previously unreported details, of how
Extensive interviews with people involved with the program, and a review of proprietary documents, show how
The revised design allowed MCAS to trigger on the inputs of a single sensor, instead of two factors considered in the original plan.
In the wake of the two crashes, despite an outcry from the public and from some pilot and airline industry officials,
The grounding of the MAX has entered its 15th week. Safety officials around the world are scrutinizing the changes to MCAS that
"Safety is our top priority,"
This investigation examines what's known about the origins and operation of MCAS ahead of the final official accident-investigation reports, expected late this year for Lion Air Flight 610 and next year for Ethiopian Airlines Flight 302.
Wind-tunnel and simulator tests
During flight tests to certify an airplane, pilots must safely fly an extreme maneuver, a banked spiral called a wind-up turn that brings the plane through a stall. While passengers would likely never experience the maneuver on a normal commercial flight, it could occur if pilots for some reason needed to execute a steep banking turn.
Engineers determined that on the MAX, the force the pilots feel in the control column as they execute this maneuver would not smoothly and continuously increase. Pilots who pull back forcefully on the column -- sometimes called the stick -- might suddenly feel a slackening of resistance. An
The lack of smooth feel was caused by the jet's tendency to pitch up, influenced by shock waves that form over the wing at high speeds and the extra lift surface provided by the pods around the
This was verified in early simulator modeling, with planes tested in scenarios at about 20,000 feet of altitude, according to one of the workers involved.
While the problem was narrow in scope, it proved difficult to cope with. The engineers first tried tweaking the plane's aerodynamic shape, according to two workers familiar with the testing. They placed vortex generators -- small metal vanes on the wings -- to help modify the flow of air, trying them in different locations, in different quantities and at different angles. They also explored altering the shape of the wing.
Two people familiar with the discussions said 737 MAX chief test pilot
But the aerodynamic solutions didn't produce enough effect, the two people said, and so the engineers turned to MCAS.
It was simple in concept but powerful in effect, quickly solving the issue.
In the midst of a wind-up turn, the software would automatically swivel up the leading edge of the plane's entire horizontal tail, known as the horizontal stabilizer, so that the air flow would push the tail up and correspondingly push the nose down.
As the pilot pulled on the control column, this uncommanded movement in the background would counter the jet's tendency to pitch up and smooth out the feel of the column throughout the maneuver.
An engineer recalled Craig testing MCAS for the first time in the simulator.
"Yeah! This is great," Craig gushed after seeing how MCAS responded, according to the engineer. (Craig left
This original version of MCAS, according to two people familiar with the details, was activated only if two distinct sensors indicated such an extreme maneuver: a high angle of attack and a high G-force.
Angle of attack is the angle between the wing and the oncoming air flow. G-force is the plane's acceleration in the vertical direction.
How much MCAS moved the tail when activated was a function of the angle of attack and the jet's speed, said one of the people familiar with the MCAS design who, like many of the sources in this story, asked for anonymity because of the sensitivity of ongoing investigations.
The fix didn't stir much controversy.
Under the proposal, MCAS would trigger in narrow circumstances. It was designed "to address potentially unacceptable nose-up pitching moment at high angles of attack at high airspeeds,"
In a separate presentation made for foreign safety regulators that was reviewed by The
Two people involved in the initial design plans for MCAS said the goal was to limit the system's effect, giving it as little authority as possible. That 0.6-degree limit was embedded in the company's system safety review for the
Virtually all equipment on any commercial airplane, including the various sensors, is reliable enough to meet the "major failure" requirement, which is that the probability of a failure must be less than 1 in 100,000.
A "major failure" is not expected to produce any serious injuries and is defined more as something that would increase the cockpit crew's workload. Such systems are therefore typically allowed to rely on a single input sensor.
It also calculated what would happen on a normal flight if somehow the system kept running for three seconds at its standard rate of 0.27 degrees per second, producing 0.81 degrees of movement, thus exceeding the supposed maximum authority.
Why three seconds? That's the period of time that
Hazardous events typically demand more than one sensor -- except when they are outside normal flight conditions and unlikely to be encountered, such as a wind-up turn.
According to a document reviewed by The
So even though this original version of MCAS required two factors -- angle of attack and G-force -- to activate,
In flight test, MCAS changes
About a third of the way through flight testing in 2016, as first reported by The
The flight-test pilots had found another problem: The same lack of smooth stick forces was also occurring in certain low-speed flight conditions. To cover that issue too, engineers decided to expand the scope and power of MCAS.
Because at low speed a control surface must be deflected more to have the same effect, engineers increased the power of the system at low speed from 0.6 degrees of stabilizer nose-down deflection to 2.5 degrees each time it was activated.
On the stabilizer, maximum nose down is about 4.7 degrees away from level flight. So with the new increased authority to move the stabilizer, just a couple of iterations of the system could push it to that maximum.
Because there are no excessive G-forces at low speed, the engineers removed the G-force factor as a trigger. But that meant MCAS was now activated by a single angle-of-attack sensor.
One of the people familiar with MCAS's evolution said the system designers didn't see any need to add an additional sensor or redundancy because the hazard assessment had determined that an MCAS failure in normal flight would only qualify in the "major" category for which the single sensor is the norm.
"It wasn't like it was there to cover some safety or certification requirement," the person said. "The trigger isn't a safeguard. It tells (the system) when to operate."
While the changes were dramatic,
"The change to MCAS didn't trigger an additional safety assessment because it did not affect the most critical phase of flight, considered to be higher cruise speeds," he said.
The person familiar with the details of MCAS' evolution said
"You turn in the answer," he said. "You don't have to document all your work."
MCAS as it was actually implemented differed in another way from what was described in the safety analysis turned in to the
The failure analysis didn't appear to consider the possibility that MCAS could trigger repeatedly, as it did on both accident flights. Moving multiple times in 0.6 or 2.5 increments depending on the speed, it effectively had unlimited authority if pilots did not intervene.
Discussions around this new MCAS design appear to have been limited during flight testing.
A variety of employees have described internal pressures to advance the MAX to completion, as
"It was all about loyalty," Rabin said. "I had a manager tell me, 'Don't rock the boat. You don't want to be upsetting executives.'"
Do pilots need more training?
The pilots' struggles to control their planes before both MAX crashes suggest that the
"If the three seconds is not an appropriate amount of time to be able to catch a runaway stabilizer, and it actually takes seven seconds, then ... we need to understand that," said the person familiar with the details of MCAS.
When MCAS is activated in the cockpit and moves the horizontal stabilizer, a large wheel beside each pilot that's mechanically connected to the stabilizer begins to spin. This is the manual trim wheel. As a last resort to stop a stabilizer moving uncommanded, a pilot can grab and hold the wheel.
The person familiar with MCAS said the wheel will spin noisily and fast, 30 or 40 times, for each activation. Meanwhile the stabilizer movement will increase the force needed to hold the control column, by about 40 to 50 pounds for a 2.5 degree movement. Such uncommanded movement that won't stop is referred to as a "runaway stabilizer."
However on both accident flights, the angle-of-attack sensor failure set off multiple alerts causing distraction and confusion from the moment of takeoff, even before MCAS kicked in.
Exactly what pilot training for MCAS is appropriate has become a big issue that threatens to prolong the grounding of the MAX.
Early in the process of selling the MAX, according to two people familiar with the discussions,
One former MAX worker,
Ludtke and two other former workers described internal pressures during the MAX certification to avoid any changes to the design of the plane that might cause the
It became a significant point of attention for
As first reported by The New York Times, Forkner suggested to the
"Mark never dreamed anything like this could happen," said Forkner's attorney,
For example, there is a cutout switch in the control column so that when a pilot pulls or pushes in the opposite direction to a runaway stabilizer, it cuts electric power to the stabilizer. When MCAS is active, this cutout switch doesn't work, which could surprise a pilot who didn't know about the system.
A single sensor
"The 737 MAX was certified in accordance with the identical
The most controversial detail of the MCAS design has been the reliance on a single angle-of-attack sensor. On both of the deadly flights, everything started with a faulty sensor. In the second crash in
There are two such sensors, one on either side of the fuselage. Why didn't
The thinking was that requiring input from two angle-of-attack sensors would mean that if either one failed the system would not function.
That has implications not only for safety but for airline costs. If the system is down, a pilot might fly into a situation where it's needed and find it unavailable. Or the airline might have to take the plane out of service and lose money.
Both factors point toward a principle of not adding complexity: Keep a system as simple as possible.
"You don't want to disrupt your customer's operations," said the person familiar with the MCAS details. And you don't want to "increase the risk that the system fails when you need it."
In this case, as simple as possible meant as minimal as the safety regulations allow. Since
But that's not the logic followed for a system on the
But they both move the horizontal stabilizer to smooth the pilot stick forces in a wind-up turn. Their basic design architecture can be compared to some extent.
Last Sunday at the Paris Air Show,
The fixes include relying on two sensors rather than one, limiting MCAS to one rather than multiple activations, and revising the software.
"We are confident that they will result in a safe airplane, one of the safest airplanes ever to fly, and that MCAS will not contribute to a future accident," he said.
(c)2019 The Seattle Times
Visit The Seattle Times at www.seattletimes.com
Distributed by Tribune Content Agency, LLC.