Maneuvering Characteristics Augmentation System
[citation needed] After the fatal crash of Lion Air Flight 610 in 2018, Boeing and the Federal Aviation Administration (FAA) referred pilots to a revised trim runaway checklist that must be performed in case of a malfunction.
Boeing denied that MCAS was an anti-stall system, and stressed that it was intended to improve the handling of the aircraft while operating in a specific portion of the flight envelope.
[7] Another MCAS implementation was developed for the Boeing 737 MAX, because its larger, repositioned engines changed the aircraft's flight characteristics compared to the preceding 737 generations.
[11] However, according to interviews with agency directors describing assessments undertaken after the MCAS-induced crashes had occurred, both the FAA and EASA felt that the aircraft would have had acceptable stability without MCAS.
[19] On March 11, 2019, after China had grounded the aircraft,[20] Boeing published some details of new system requirements for the MCAS software and for the cockpit displays, which it began implementing in the wake of the prior accident five months earlier:[12] On March 27, Daniel Elwell, the acting administrator of the FAA, testified before the Senate Committee on Commerce, Science, and Transportation, saying that on January 21, "Boeing submitted a proposed MCAS software enhancement to the FAA for certification.
[40] As an automated corrective measure, the MCAS was given full authority to bring the aircraft nose down, and could not be overridden by pilot resistance against the control wheel as on previous versions of the 737.
[41] Boeing first publicly named and revealed the existence of MCAS on the 737 MAX in a message to airline operators and other aviation interests on November 10, 2018, twelve days after the Lion Air crash.
[44] As with any other equipment on board an aircraft, the FAA approves a functional "development assurance level" corresponding to the consequences of a failure, using the SAE International standards ARP4754 and ARP4761.
This classification corresponds to failures causing "a large reduction in safety margins" or "serious or fatal injury to a relatively small number of the occupants", but nothing "catastrophic".
[46] The MCAS design parameters originally envisioned automated corrective actions to be taken in cases of high AoA and g-forces beyond normal flight conditions.
It had already approved the previous version of MCAS, and the agency's rules did not require it to take a second look because the changes did not affect how the plane operated in extreme situations.
[52] Due to the amount of trim the system applies to the horizontal stabilizer, aerodynamic forces resist pilot control effort to raise the nose.
[65] Boeing's own internal design guidelines related to the 737 MAX's development stated that the system should "not have any objectionable interaction with the piloting of the airplane" and "not interfere with dive recovery".
It would suggest the emergency procedure laid out by Boeing and passed along by the FAA after the Lion Air crash is wholly inadequate and failed the Ethiopian flight crew.
Mike Sinnett, vice president and general manager for the Boeing New Mid-Market Airplane (NMA) since July 2019, repeatedly described the procedure as a "memory item".
"[86] In November 2018, Boeing told airlines that MCAS could not be overcome by pulling back on the control column to stop a runaway trim as on previous generation 737s.
[87] Nevertheless, confusion continued: the safety committee of a major U.S. airline misled its pilots by telling that the MCAS could be overcome by "applying opposite control-column input to activate the column cutout switches".
[88] Former pilot and CBS aviation & safety expert Chesley Sullenberger testified, "The logic was that if MCAS activated, it had to be because it was needed, and pulling back on the control wheel shouldn't stop it.
"[89] In October, Sullenberger wrote, "These emergencies did not present as a classic runaway stabilizer problem, but initially as ambiguous unreliable airspeed and altitude situations, masking MCAS.
Note that in the Ethiopian flight, the autothrottle was not disengaged and the aircraft entered overspeed conditions at low altitude which resulted in extraneous aerodynamic forces on the control surfaces.
[98] During the groundings, special flights to reposition MAX aircraft to storage locations, as per 14 CFR § 21.197, flew at lower altitude and with flaps extended to circumvent MCAS activation, rather than using the recovery procedure after the fact.
Any fault in this sensor, perhaps due to physical damage,[89] creates a single point failure, and the flight control system lacks any basis for rejecting its input as faulty information.
Reporter Useem said in The Atlantic it was "showing both a misunderstanding of the term and a sharp break from Boeing's long-standing practice of having multiple backups for every flight system".
[105] A former professor at Embry-Riddle Aeronautical University, Andrew Kornecki, who is an expert in redundancy systems, said operating with one or two sensors "would be fine if all the pilots were sufficiently trained in how to assess and handle the plane in the event of a problem".
[106] In November 2017, after several months of MAX deliveries, Boeing discovered that the AoA Disagree message, which is indicative of potential sensor mismatch on the primary flight display,[107] was unintentionally disabled.
[12] Clint Balog, a professor at Embry-Riddle Aeronautical University, said after the Lion Air crash: "In retrospect, clearly it would have been wise to include the warning as standard equipment and fully inform and train operators on MCAS".
[117][118] In March 2019, after the second accident of Ethiopian Airlines Flight 302, a Boeing representative told Inc. magazine, "Customers have been informed that AoA Disagree alert will become a standard feature on the 737 MAX.
[133] Early news reports were inaccurate in attributing the problem to an 80286[138] microprocessor overwhelmed with data, though as of April 2020 the concern remains that the MCAS software is overloading the 737 MAX's computers.
This switch to a fail-safe two-channel redundant system, with each computer using an independent set of sensors, is a radical change from the architecture used on 737s since the introduction on the older model 737-300 in the 1980s.
[140][141] In November 2020, an Airworthiness Directive required corrective actions to the airplane's flight control laws (embodied in the Speed Trim System software):
