Bjorn’s Corner: Analysing the Lion Air JT610 crash, Part 6.

leehamnews.com/2019/12/06/bjorns-corner-analysing-the-lion-air-jt610-crash-part-6/

December 6,
2019

December 6, 2019, ©. Leeham News: We now finalize the series

about the Lion Air JT610 crash by analyzing the changes Boeing has
made to the aircraft to avoid further problems with MCAS
(Maneuver Characteristics Augmentation System).

The changes bring MCAS to the level it should have had from entry
into service and in some aspects further.

By Bjorn Fehrm

The fixing of MCAS

We start with a change that does not involve MCAS. When the 737 MAX fleet starts flying
again the Angle of Attack (AoA) warning text AOA DISAGREE on the pilot’s Primary Flight
Display (PFD) will be active, Figure 1.

1/4
 Figure 1. The pilot’s Primary Flight Display of an updated 737 MAX. Source: Boeing.

For the MAX this warning went inactive due to a supplier incorrectly tying its appearance
to the presence of the optional PFD AoA indicator (top in Figure 1).

The revised logic is the AOA DISAGREE shall always be available and after the crashes,
the optional AoA indicator is a no-cost option for the airlines.

We now go to the changes made to MCAS and the systems participating in the
augmentation function.

The original design

The original MCAS relied on a single AoA signal passing a threshold value for activation.
This was allowed under FAR Part 25 for systems that had a safety hazard classification of
“Major” hazard if things went wrong.

The Lion Air accident was caused by an AoA sensor which was incorrectly calibrated. It
had a faulty bias of 21° AoA instead of 0°. For an MCAS function which is activated at say
12° AoA this meant MCAS was active from lift-off. Only the additional criteria of “flaps in”
held it back until these were retracted. In the Ethiopian Airlines case, it was with high
probability a bird strike that ripped off the sensor, causing the sensor rotor to swing to
over 70°.

AoA failures like these are not common. The report states Boeing statistics show a total
of ~20 failures over the last 17 years. To have two such failures a short time after another
precluded Boeing from have fielded at fixed MACS before the second AoA failure
happened.

2/4
The key problem was a non-fault proof trigger was combined with an unnecessarily
aggressive MCAS function, trimming the aircraft’s nose down at a high rate in repeated
activations. It could move a normal trimmed state of around 5° to full nose down (0°) in
two activations if not countered with the pilot using his manual trim to trim against. This
aggressiveness was not called for.

The aircraft needed one nose-down trim of 2.4° at the most (low speed and altitude) if it
had passed into the nose-up happy region before stall. Subsequently, the nose-down
trim is reversed once the AoA falls below the threshold. This re-passing of the threshold
value would have been the correct reactivation criteria for MCAS, not the fact the pilot
trimmed.

A pilot trims when a dynamic event is brought to a stable state. In a stable state, there is
no need for further augmentation. The correct criteria for a re-activation of MCAS is the
AoA has passed below the sensitive region and the nose-down trim has been reversed.
Now the reactivation was the same as for Speed Trim, the pilot had trimmed. Why this
can be the criteria for MCAS is not clear.

Finally, the original MCAS function had no global limit on its authority. At full nose-down
trim, the horizontal stabilizer controlled by MCAS could outcompete the pilot controlled
elevator. The aircraft would nose over when MCAS had trimmed full nose down
irrespective of how hard the pilots pulled on the Yokes. Only trimming would have
helped but it’s not in a pilot’s muscle memory to trim during correction of a nose
movement, you trim once you have achieved steady-state and can feel the stick forces.
Trim is to neutralize these forces for the pilot, not to control the pitch of the aircraft.

The revised design

The revised design, presently under scrutiny by the FAA and other airworthiness
agencies address weaknesses in all three areas.

The trigger now is only done when the two AoA vanes on a 737 MAX agree there is a case
of a high AoA, passing the threshold for MCAS activation. If there is disagreement
between the sensors the MCAS function will be disabled. As argued in the last Corner
this is OK as you can fly without MCAS and the probability this making the flying harder
for the pilot for a flight with an AOA DISAGREE is practically nil.

Initially, this comparison was made on a sensor signal level. For the final solution, the
check is done after the processing of the MCAS function. If there is a disagreement
between the active function chain and the monitoring chain MCAS will be deactivated.

This improvement checks all sensors and processes who participate in MCAS to see
there are no differences in computed actions.

An improved trigger is now followed by an MCAS function which checks the AoA value
has gone below the threshold and the nose-down trim is reset before it can activate for a
new augmentation. This should have been there from the first implementation. It’s
3/4
difficult to understand how the team around MCAS assumed a trim action by the pilot
means the augmentation is reversed and it shall be allowed to re-activate.

Finally, the updated MCAS can’t steal all pitch authority from the pilot. There is a global
limit on how much trim nose down MCAS can command. The pilot is always guaranteed
he can keep the nose level and pitch it up if he needs it.

The 737 MAX should now be safe

The Boeing 737 has a good safety record. The aircraft has no special vices and is void of
dangerous modes like a deep stall or aileron or rudder reversal. The larger MAX engines
called for a pitch augmentation to give the pilot a linear pitch feel all the way to stall.

The introduced augmentation to fix this had an uncharacteristically sloppy

implementation. The uproar over how this could pass into a certified air transport
aircraft was called for. But now the corrected augmentation is there. The enormous
amount of work which has gone into the update has made MCAS one of the most
analyzed and tested flight control augmentations ever. The updated MCAS is now safe,
measured with any standards.

In my opinion, MCAS is now fine and we should turn to more pressing issues in our air
safety work.

4/4