This page describes the new 737 MAX Maneuvering Characteristics Augmentation System (MCAS)
The 737 MAX was produced with several differences from the NG. Many of these differences were obvious such as the new LEAP engines or the larger flight display screens. Some were less obvious but well documented such as the FBW spoiler system. It also now appears that some differences were almost hidden, certainly from the flight crew. MCAS is one such difference.
MCAS is a longitudinal stability enhancement. It is not for stall prevention (although indirectly it helps) or to make the MAX handle like the NG (although it does); it was introduced to counteract the non-linear lift generated by the LEAP-1B engine nacelles at high AoA and give a steady increase in stick force as the stall is approached as required by regulation.
The LEAP engine nacelles are larger and had to be mounted slightly higher and further forward from the previous NG CFM56-7 engines to give the necessary ground clearance. This new location and larger size of nacelle cause the vortex flow off the nacelle body to produce lift at high AoA. As the nacelle is ahead of the C of G, this lift causes a slight pitch-up effect (ie a reducing stick force) which could lead the pilot to inadvertently pull the yoke further aft than intended bringing the aircraft closer towards the stall. This abnormal nose-up pitching is not allowable under 14CFR §25.203(a) "Stall characteristics". Several aerodynamic solutions were introduced such as revising the leading edge stall strip and modifying the leading edge vortilons but they were insufficient to pass regulation. MCAS was therefore introduced to give an automatic nose down stabilizer input during elevated AoA when flaps are up.
On the face of it, MCAS seemed like a reasonable solution to the low speed handling certification problem. However, two accidents occurred to the MAX which were attributed to MCAS - Lion Air MAX-8 PK-LQP on 29 October 2018 and Ethiopian MAX-8 ET-AVJ on 10 March 2019, both of which crashed shortly after take-off following erroneous data from a single AoA probe. MCAS used this erroneous AoA data to command nose down stabiliser trim which was not counteracted successfully by the crew until impact.
The MCAS design at the time of these accidents would trim the Stabilizer down for up to 9.26 seconds (2.5 deg nose down) then pause for 5 seconds and repeat if the conditions (high AoA, flaps up and autopilot disengaged) continued to be met. If the pilots used electric pitch trim, it would only pause MCAS for 5s; to deactivate it you have to switch off the STAB TRIM CUTOUT switches.
As details emerged about the similarities between the two accidents, the 737 MAX was grounded by many countries unilaterally. The FAA followed suit on 13 March. Boeing issued the following statement: “After consultation with the US FAA, the US NTSB, and aviation authorities and its customers around the world, Boeing has determined—out of an abundance of caution and in order to reassure the flying public of the aircraft’s safety—to recommend to the FAA the temporary suspension of operations of the entire global fleet of 371 737 MAX aircraft. Boeing makes this recommendation and supports the decision by the FAA.”.
The MAX is likely to be grounded until summer 2020 and Boeing reported in Jan 2020 that the 737 Max problems have cost the company $18.6 billion due to production delays, lost deliveries and compensation to airlines.
*** Updated 18 Apr 2019 ***
14CFR §25.203 Stall characteristics.
(a) It must be possible to produce and to correct roll and yaw by unreversed use of the aileron and rudder controls, up to the time the airplane is stalled. No abnormal nose-up pitching may occur. The longitudinal control force must be positive up to and throughout the stall. In addition, it must be possible to promptly prevent stalling and to recover from a stall by normal use of the controls.
Technical Description of MCAS (Pre-2019)
The original design of MCAS was that it would only activate "at extreme high speed pitch-up conditions that are outside the normal operating envelope" (see extract from the Mainenance Training Manual below). However during flight testing it became apparent that the engine nacelles were also creating a pitch-up effect under certain conditions at very low speeds. So the scope of MCAS was broadened to include low speed activation as well as high speed activation.
Above an extract from the MTM showing the original scope of MCAS was at high speed only
MCAS (Maneuvering Characteristics Augmentation System) is implemented on the 737 MAX to enhance longitudinal stability characteristics with flaps UP and at elevated Angles of Attack (AoA). The MCAS function commands nose down stabilizer to enhance pitch characteristics during steep turns with elevated load factors and during flaps up flight at airspeeds approaching stall. MCAS is activated without pilot input and only operates in manual, flaps up flight. The system is designed to allow the flight crew to use column trim switch or stabilizer aislestand cutout switches to override MCAS input. The function is commanded by the Flight Control Computer (FCC) using input data from sensors and other airplane systems.
The MCAS function becomes active when the AoA exceeds a threshold based on airspeed and altitude. MCAS will activate for up to 9.26 seconds before pausing for 5 seconds. Stabilizer incremental commands are limited to 2.5 degrees and are provided at a rate of 0.27 degrees per second. The magnitude of the stabilizer input is lower at high Mach number and greater at low Mach numbers (for the same AoA above the activation threshold).
After AoA falls below the hysteresis threshold (0.5 degrees below the activation angle), MCAS commands nose up stabilizer to return the aircraft to the trim state that existed before the MCAS activation.
The function is reset once angle of attack falls below the Angle of Attack threshold or if manual stabilizer commands are provided by the flight crew. If the original elevated AOA condition persists, the MCAS function commands another incremental stabilizer nose down command according to current aircraft Mach number at actuation.
To summarise; MCAS will trim the Stabilizer down for up to 9.26 seconds (2.5 deg nose down) and pause for 5 seconds and repeat if the conditions (high angle of attack, flaps up and autopilot disengaged) continue to be met. MCAS will turn the trim wheel. Using electric pitch trim will only pause MCAS for 5s; to deactivate it you need to switch off the STAB TRIM CUTOUT switches.
The AoA source
Since MCAS is an FCC function, the AoA source for MCAS is that of the FCC in use; ie FCC 1 uses the Captains AoA probe and FCC 2 uses the F/Os AoA probe. When the 737 is powered up the FCC used is FCC 1 for that flight, this changes for each subsequent flight until the aircraft is powered down. Therefore the AOA sensor that is used for MCAS changes with each flight post power-up.
During The House Committee on Transportation & Infrastructure hearing in October 2019, an email exchange was disclosed between Boeing employees from 2015 which read: "Are we vulnerable to single AOA sensor failures with the MCAS implementation?" The response from CEO Dennis Muilenburg was that the email showed that "our engineers do raise questions, in an open culture," but that the single-sensor design met the standards. John Hamilton, chief engineer for Boeing’s commercial airplane division, who testified alongside Muilenburg, said that single points of failure are allowed in airplane design depending on the hazard assessment. Any dissent the committee could present on the final assessment that a single sensor was merited “highlights that our engineers do raise questions and it’s an open culture.”
The final KNKT investigation report into the Lion Air accident, said as a contributing factor "The replacement AOA sensor that was installed on the accident aircraft had been mis-calibrated during an earlier repair. This mis-calibration was not detected during the repair." the angle it registered was 21 degrees too high. Following publication of this report, the FAA revoked the certificate of approval of Xtra Aerospace of Miramar, Fla., the company that supplied the faulty AoA sensor. Xtra subsequently issued a statement saying that “we respectfully disagree with the agency’s findings.” It added that the revocation of its certificate “is not an indication that Xtra was responsible for the accident.”
The MAX probes on the LHS. The AoA vane is the bottom of the three probes.
Pre-accidents, there was an option for airlines to have an AoA indicator displayed on the PFDs - for a fee. As far as I know this option was only been taken by Southwest and American Airlines before the accidents. As part of the post-grounding MCAS upgrade, the optional AoA indicator will now be available free of charge and the AOA DISAGREE alert will now be standard on all MAX aircraft.
The AoA Disagree Alert will display "AOA DISAGREE" in amber at the bottom right of the PFD if the AoA vanes disagree by more than 10 degrees for more than 10 continuous seconds.
The QRH AoA Disagree Procedure is as follows:
Boeing has said in a statement on Monday 29 April that an error on their part meant that the AOA DISAGREE alert was only enabled on aircraft in which the customers had selected the optional AOA indicator. The alert was intended to be enabled on all MAX aircraft as standard.
“The disagree alert was intended to be a standard, stand-alone feature on Max airplanes,” the company said. “However, the disagree alert was not operable on all airplanes because the feature was not activated as intended.”
The error was discovered in 2017, Boeing says a Safety Review Board it had convened confirmed the company’s view that that the absence of a 737 AOA disagree alerts did not present a safety issue, and this was shared with the FAA.
Note that the MAX will have a software update (CDS BP?) to allow the disagree alert to function without relying on any optional systems as it does on the NG. This of course is in addition to the FCC update for MCAS.
This is the full statement:
"On every airplane delivered to our customers, including the MAX, all flight data and information needed to safely operate the aircraft is provided in the flight deck on the primary flight deck displays. This information is provided full-time in the pilots’ primary field of view, and it always has been.
Air speed, attitude, altitude, vertical speed, heading and engine power settings are the primary parameters the flight crews use to safely operate the airplane in normal flight. Stick shaker and the pitch limit indicator are the primary features used for the operation of the airplane at elevated angles of attack. All recommended pilot actions, checklists, and training are based upon these primary indicators. Neither the angle of attack indicator nor the AOA Disagree alert are necessary for the safe operation of the airplane. They provide supplemental information only, and have never been considered safety features on commercial jet transport airplanes.
The Boeing design requirements for the 737 MAX included the AOA Disagree alert as a standard, standalone feature, in keeping with Boeing’s fundamental design philosophy of retaining commonality with the 737NG. In 2017, within several months after beginning 737 MAX deliveries, engineers at Boeing identified that the 737 MAX display system software did not correctly meet the AOA Disagree alert requirements. The software delivered to Boeing linked the AOA Disagree alert to the AOA indicator, which is an optional feature on the MAX and the NG. Accordingly, the software activated the AOA Disagree alert only if an airline opted for the AOA indicator.
When the discrepancy between the requirements and the software was identified, Boeing followed its standard process for determining the appropriate resolution of such issues. That review, which involved multiple company subject matter experts, determined that the absence of the AOA Disagree alert did not adversely impact airplane safety or operation. Accordingly, the review concluded, the existing functionality was acceptable until the alert and the indicator could be delinked in the next planned display system software update. Senior company leadership was not involved in the review and first became aware of this issue in the aftermath of the Lion Air accident.
Approximately a week after the Lion Air accident, on November 6, 2018, Boeing issued an Operations Manual Bulletin (OMB), which was followed a day later by the FAA’s issuance of an Airworthiness Directive (AD). In identifying the AOA Disagree alert as one among a number of indications that could result from erroneous AOA, both the OMB and the AD described the AOA Disagree alert feature as available only if the AOA indicator option is installed.
Boeing discussed the status of the AOA Disagree alert with the FAA in the wake of the Lion Air accident. At that time, Boeing informed the FAA that Boeing engineers had identified the software issue in 2017 and had determined per Boeing’s standard process that the issue did not adversely impact airplane safety or operation. In December 2018, Boeing convened a Safety Review Board (SRB) to consider again whether the absence of the AOA Disagree alert from certain 737 MAX flight displays presented a safety issue. That SRB confirmed Boeing’s prior conclusion that it did not. Boeing shared this conclusion and the supporting SRB analysis with the FAA.
Boeing is issuing a display system software update, to implement the AOA Disagree alert as a standard, standalone feature before the MAX returns to service. When the MAX returns to service, all MAX production aircraft will have an activated and operable AOA Disagree alert and an optional angle of attack indicator. All customers with previously delivered MAX airplanes will have the ability to activate the AOA Disagree alert."
Emergency AD and Runaway Stabilizer procedure
For full details of the evolution of the runaway stabilizer procedure over the history of the 737, follow this link.
Following the Lion Air accident, on 7 Nov 2018 the FAA issue an Emergency AD (2018-23-51) and Boeing issue an Ops Manual Bulletin (TBC-19) for MAX Runaway Stabilizer procedure directing operators to “existing flight crew procedures" to address circumstances involving erroneous angle-of-attack sensor information.
FAA Emergency AD 2018-23-51 - SUMMARY: We are adopting a new airworthiness directive (AD) for all The Boeing Company Model 737-8 and -9 airplanes. This emergency AD was sent previously to all known U.S. owners and operators of these airplanes. This AD requires revising certificate limitations and operating procedures of the airplane flight manual (AFM) to provide the flight crew with runaway horizontal stabilizer trim procedures to follow under certain conditions. This AD was prompted by analysis performed by the manufacturer showing that if an erroneously high single angle of attack (AOA) sensor input is received by the flight control system, there is a potential for repeated nose-down trim commands of the horizontal stabilizer. We are issuing this AD to address the unsafe condition on these products..
On 11 Dec 2019 House Transportation Committee Chairman Peter DeFazio referred to this AD and procedure by saying that “The FAA issued an emergency airworthiness directive that purported to inform pilots on how to respond to an erroneous activation of MCAS while actually never mentioning the system by name, In fact, during the certification of the 737 MAX Boeing actively pushed the FAA to remove references to the MCAS from the flight crew operating manual, as revealed in the emails and instant messages from Boeing executive Mark Forkner.”
Ops Manual Bulletin TBC-19
This is a copy of the bulletin, it has a different reference (MLI-15) because it is with a different airline; TBC = The Boeing Company
Stab Trim Cut-Out Switches
MAIN ELEC and AUTO PILOT Stab trim switches now either switch will cut-off both main electric and autopilot stab trim. They are renamed PRI and B/U (primary and backup). The switches are guarded in the NORMAL position (switch up) and CUTOFF is switch down.
737 MAX Stab Trim Cut Out Switches
Manual Trim Wheel Loads
The preliminary report into the Ethiopian accident, appears to show that after the crew had switched off the Stab trim cut-out switches they were unable to operate the trim wheel manually and subsequently switched them back on again to get electric trim which unfortunately also allowed MCAS to reactivate. The reason for why the trim wheel could not be operated manually is still unknown (hopefully only until the final report is issued) but it is probable that the control forces on the stab, and therefore the wheel, were too high due to the very high IAS at the time. It is now known that the FAA has doubts about the ability of some pilots (eg women) to have the level of strength required to operate the manual trim wheel at high IAS. This is applicable for all series of 737, not just the MAX.
On Friday 17 May, Boeing spokesman, Gordon Johndroe, said that Boeing has made corrections to 737 MAX simulator software and the company has provided additional information to device operators. He said the changes will ensure that the simulator experience is representative across different flight conditions and will improve the simulation of force loads on the manual trim wheel that helps control the airplane.
The comments came after the New York Times reported that Boeing recently discovered that the flight simulators airlines use to train pilots could not adequately replicate conditions that played a role in the 737 MAX crashes.
As a point of interest, the stab trim wheel on the MAX is 1 inch less in diameter than in all previous generations of 737. This would slightly reduce the force that the crew could turn the wheel as the handles are located near the circumference.
11 March 2019
The FAA issued a Continued Airworthiness Notification to the International Community (CANIC), providing information regarding FAA continued operational safety activity related to the Boeing 737-8 and Boeing 737-9 (737 MAX) fleet. (available here)
Situation description: Following the accident of an Ethiopian Airlines Boeing Model 737-8 airplane on March 10, 2019, the National Transportation Safety Board (NTSB) as the accredited representative, and the FAA as Technical Advisors, are supporting the Ethiopian Accident Investigation Bureau. The FAA has dispatched personnel to support the investigative authorities in determining the circumstances of this event. All data will be closely examined during this investigation, and the FAA will take appropriate action if the data indicates the need to do so.
External reports are drawing similarities between this accident and the Lion Air Flight 610 accident on October 29, 2018. However, this investigation has just begun and to date we have not been provided data to draw any conclusions or take any actions.
Following the Lion Air Flight 610 accident, the FAA has completed these activities in support of continued operational safety of the fleet:
- Issued FAA emergency Airworthiness Directive (AD) 2018-23-51 on November 7, 2018
Aircraft/engine make, model, and series: The Boeing Company Model 737-8 and 737-9 airplanes (737 MAX)
U.S.-registered fleet: 74 airplanes; Worldwide fleet: 387 airplanes
Operators: 59 operators worldwide: 9 Air, Aerolineas Argentinas, Aeromexico, Air Canada, Air China, Air Fiji, AIR ITALY S.P.A., American Airlines, Arkefly, Britannia Airways AB, Cayman Airways, China Eastern Airlines, China Southern Airlines, Comair, COPA Airlines, Corendon Airlines, Eastar Jet, Enter Air Sp. Z O.O., Ethiopian Airlines, Fertitta Enterprises, Inc., flydubai, Fuzhou Airlines Co., Ltd, Garuda Indonesia, Gol Linhas Aereas S.A., Hainan Airlines, Icelandair, Jet Airways, Jet Aviation Business Jets, JSC Aircompany SCAT, Kunming Airlines, Lion Air, Globus Airlines, LOT Polish Airlines, Lucky Air, Mauritania Airlines, Mongolian Airlines MIAT, Norwegian Air International Lt, Norwegian Air Norway, Norwegian Air Shuttle AS, Norwegian Air Sweden, Okay Airways Company Limited, Oman Air, Qatar Airways, Royal Air Maroc, Shandong Airlines, Shanghai Airlines, Shenzhen Airlines, SilkAir, Smartwings, Southwest Airlines, SpiceJet, Sunwing Airlines Inc., Thai Lion, TUI Airlines Belgium, TUI Airways, Turkish Airlines (THY), United Airlines, WestJet, Xiamen Airlines
13 March 2019
The FAA issued an Emergency Order of Prohibition, prohibiting the operation of any MAX in the US.
26 Nov 2019
The FAA said on 26 Nov 2019 that it has notified Boeing that the FAA will be the only issuer of aircraft-specific airworthiness certificates for all new 737 MAX planes, a role that it had shared with Boeing in the past.
In a letter sent to Boeing on Tuesday, the FAA said it "has determined that the public interest and safety in air commerce require that the FAA retain authority to issue airworthiness certificates and export certificates of airworthiness for all 737 MAX airplanes."
It said it will keep the authority to issue the certificates until it is confident Boeing has "fully functional quality control and verification processes in place" and that other Boeing procedures meet all regulatory standards.
23 May 2019
The FAA met with 30 international air regulators including China, the European Union, Brazil and Canada, in Texas to discuss progress on the MAX recertification including design changes, MCAS training and simulator requirements. When asked by reporters about a date for a return to service, the acting head of the FAA, Dan Elwell, said that he does not have a specific timetable to approve the 737 MAX for flight. “It’s a constant give and take until it is exactly right, It’s taking as long as it takes to be right,” he said, adding: “I’m not tied to a timetable.” “If you said October I wouldn’t even say that, only because we haven’t finished determining exactly what the training requirements will be, If it takes a year to find everything we need to give us the confidence to lift the [grounding] order so be it.”
By late August 2019, the FAA said its staff has spent over 110,000 man hours dealing with MAX issues since the grounding.
23 Sep 2019
The Federal Aviation Administration and a team of technical experts met today with safety regulators from around the world to discuss the continuing efforts to return the Boeing 737 MAX jetliner to service. FAA Administrator Steve Dickson and Deputy Administrator Dan Elwell delivered opening remarks to more than 50 invited officials, all of whom will play a role in clearing the aircraft for further flight in their respective nations. Ali Bahrami, the FAA’s Associate Administrator for Aviation Safety, provided details on the FAA’s many activities to certify the aircraft since the group of regulators first met four months ago in Fort Worth, Texas. A senior Boeing Co. executive provided a technical briefing on the company’s efforts to address the safety regulators’ shared concerns.
During the meeting, Administrator Dickson pledged that the FAA would continue to share information about the FAA’s activities to ensure the proposed changes to the automated flight control system on the 737 MAX meet certification standards. “In the name of continuous improvement, we welcome feedback from our fellow civil aviation authorities, the aviation industry and the important independent reviews of the MAX and the FAA’s certification process,” Dickson said. Dickson told the group that the last few months have made it clear that, in the mind of the traveling public, aviation safety recognizes no borders. “Travelers demand the same high level of safety no matter where they fly,” he said. “It is up to us as aviation regulators to deliver on this shared responsibility.” The FAA continues to follow a thorough process, not a prescribed timeline, for returning the aircraft to passenger service. The FAA has a transparent and collaborative relationship with other civil aviation authorities as we continue our review of changes to software on the Boeing 737 MAX. Our first priority is safety, and we have set no timeframe for when the work will be completed. Each government will make its own decision to return the aircraft to service, based on a thorough safety assessment.
FAA Updates on the MAX are given at this link: https://www.faa.gov/news/updates/?newsId=93206
Joint Authorities Technical Review panel
29 April 2019
The JATR panel, convened by the FAA, had their first meeting. The FAA said about the JATR: “The JATR team will conduct a comprehensive review of the certification of the aircraft’s automated flight control system, The team will evaluate aspects of the 737 Max automated flight control system, including its design and pilots’ interaction with the system, to determine its compliance with all applicable regulations and to identify future enhancements that might be needed.”
The JATR is led by veteran NTSB investigator, Chris Hart and has is comprised of representatives from the civil aviation authorities of Australia, Brazil, Canada, China, the European Union, Japan, Indonesia, Singapore and United Arab Emirates.
11 Oct 2019
The JATR publish a 69-page series of findings and recommendations saying: "The JATR team found that the MCAS was not evaluated as a complete and integrated function in the certification documents that were submitted to the FAA.". "The lack of a unified top-down development and evaluation of the system function and its safety analyses, combined with the extensive and fragmented documentation, made it difficult to assess whether compliance was fully demonstrated."
The report also said that the FAA's long-standing practice of delegating "a high level" of certification tasks to manufacturers like Boeing needs significant reform to ensure adequate safety oversight.
"With adequate FAA engagement and oversight, the extent of delegation does not in itself compromise safety," the report said. "However, in the B737 MAX program, the FAA had inadequate awareness of the MCAS function which, coupled with limited involvement, resulted in an inability of the FAA to provide an independent assessment of the adequacy of the Boeing-proposed certification activities associated with MCAS."
The report also questioned FAA's limited staffing to oversee certification tasks it designated to Boeing and said there were an "inadequate number of FAA specialists" involved in the 737 MAX certification. It added there were signs that Boeing employees conducting FAA work faced "undue pressure. ..which may be attributed to conflicting priorities and an environment that does not support FAA requirements."
Technical Advisory Board (TAB)
On 7 May 2019 the FAA said it had convened a multi-agency Technical Advisory Board (TAB) to review Boeing’s proposed software fix. The board consists of experts from the FAA, U.S. Air Force, NASA and the DOT's Volpe National Transportation Systems Center that were not involved in any aspect of the Boeing 737 Max certification. The board’s recommendations will “directly inform the FAA’s decision concerning the 737 Max fleet’s safe return to service.”. The new panel is separate from two other existing reviews created by FAA.
On 8 Nov 2019 a summary update to US lawmakers of proceeding in Congress revealed that the FAA told Congress: "The TAB presented its preliminary report to the FAA, detailing their finding that the MCAS design changes are compliant with the regulations and safe".
The TAB also made unspecified suggestions of actions that Boeing and FAA should complete before the MAX returns to flight, including final data submittals and document revisions, according to the summary. The TAB is also recommending “additional future activity” and FAA has agreed, according to the summary.
In its summary to Congress, the FAA said it is still in the process of determining how much training pilots on the plane will need before it returns to service. An FAA pilot group as well as a Joint Operations Evaluation Board made up of representatives from the FAA, Europe, Brazil and Canada will evaluate the need for training, according to the summary to lawmakers.
Joint Operational Evaluation Board (JOEB)
The Joint Operational Evaluation Board (JOEB), a multi-regulatory body, will conduct a multi-day simulator session with global regulatory pilots to validate training requirements. Following the simulator session, the Flight Standardization Board (FSB) will release a report for a public comment period, followed by final approval of the training.
The JOEB is primarily looking at the order and priority of checklists and memory items.
Flight Standardisation Board (FSB)
On 17 Apr 2019 the FAA issued a draft of the Flight Standardisation Board (FSB) report for the 737. The significant extracts are as follows:
The level of training specified for MCAS is "B" which corresponds to "Oral or written exam or Tutorial computer-based instruction self-test (TCBI)"
The draft report is available here:
The final FSB report is dependent on receipt of the JOEB review. This is not expected to be complete before the end of Jan 2020.
26 Sep 2019
The National Transportation Safety Board issued seven safety recommendations to the Federal Aviation Administration, calling upon the agency to address concerns about how multiple alerts and indications are considered when making assumptions as part of design safety assessments.
Aviation Safety Recommendation Report 19-01 was issued Thursday stemming from the NTSB’s ongoing support under International Civil Aviation Organization Annex 13 to Indonesia’s Komite Nasional Keselamatan Transportasi (KNKT) investigation of the Oct. 29, 2018, crash of Lion Air flight 610 in the Java Sea and the Aircraft Accident Investigation Bureau of Ethiopia’s investigation of the crash of Ethiopian Airlines flight 302 near Ejere, Ethiopia. All passengers and crew on board both aircraft – 346 people in all – died in the accidents. Both crashes involved a Boeing 737 MAX airplane.
The seven safety recommendations issued to the FAA are derived from the NTSB’s examination of the safety assessments conducted as part of the original design of Boeing’s Maneuvering Characteristics Augmentation System (MCAS) on the 737 MAX and are issued out of the NTSB’s concern that the process needs improvement given its ongoing use in certifying current and future aircraft and system designs.
“We saw in these two accidents that the crews did not react in the ways Boeing and the FAA assumed they would,” said NTSB Chairman Robert Sumwalt. “Those assumptions were used in the design of the airplane and we have found a gap between the assumptions used to certify the MAX and the real-world experiences of these crews, where pilots were faced with multiple alarms and alerts at the same time. It is important to note that our safety recommendation report addresses that issue and does not analyze the actions of the pilots involved in the Lion Air and Ethiopian Airlines accidents. That analysis is part of the ongoing accident investigations by the respective authorities.” The NTSB notes in the report that it is concerned that the accident pilots’ responses to unintended MCAS operation were not consistent with the underlying assumptions about pilot recognition and response that were used for flight control system functional hazard assessments as part of the Boeing 737 MAX design.
The NTSB’s report further notes that FAA guidance allows such assumptions to be made in certification analyses without providing clear direction about the consideration of multiple, flight-deck alerts and indications in evaluating pilot recognition and response. The NTSB’s report states that more robust tools and methods need to be used for validating assumptions about pilot response to airplane failures in safety assessments developed as part of the U.S. design certification process.
The seven recommendations issued to the FAA urge action in three areas to improve flight safety:
Government investigations and reviews
US DoT Special Committee review of the FAA certification of the MAX
19 March 2019 - The U.S. Secretary of Transportation asked the Inspector General to ensure audit of Boeing 737-MAX 8 certification is part of review. (read letter here)
7 May 2019 - The US Department of Transportation appointed a committee to review the FAA’s process for certifying the Boeing 737 Max 8. The special committee is specifically tasked to review the 737 Max 8 certification process from 2012 to 2017. The findings from that review will provide the basis for recommendations for future improvements. The committee’s goal is to make proposals to improve “the FAA's aircraft certification process, including recommendations on delegations of authority and training, and improvements to other certification processes. Topics for investigation include the FAA’s certification process and timelines, and the process under which the FAA delegates some certification and oversight work to aircraft manufacturers and their employees.
The committee is led by co-chairs Lee Moak, the vocal former president of the Air Line Pilots Association (ALPA), and Darren McDew, former commander of the Air Force’s transportation command, a unit that oversees US military transportation. four other members hail from government, academia and industry. They include Amy Pritchett, head of The Pennsylvania State University’s aerospace engineering department and former director of NASA’s aviation safety programme, and Gretchen Haskins, chief executive of HeliOffshore, an association focused on safe offshore operation of helicopters. Other members include Amtrak’s chief safety officer Kenneth Hylander, who formerly was chair of the Flight Safety Foundation and has worked at Delta Air Lines and Northwest Airlines, and David Grizzle, a Republic Airways board member who formerly was the FAA’s chief counsel and head of its air traffic organisation.
16 Jan 2020 - The report on the FAA’s aircraft certification process, with particular focus on the Boeing 737 MAX 8 certification program was published.
The report made 35 recommendations and is available here:
US DoJ Fraud Section Review of the FAA and Boeing
On 18 Mar 2019, the Department of Justice’s Fraud Section opened a criminal investigation into the development and certification of the Boeing 737 MAX by the FAA and Boeing. The Department of Transportation’s Inspector General and the FBI are participating in the investigation. Federal attorneys are gathering evidence through a federal grand jury seated in Washington, D.C. Grand jury proceedings are conducted in secret and the Justice Department has declined to comment on the investigation. The FAA and Boeing have also declined to comment.
The former 737 MAX chief technical pilot, Mark Forkner, now a first officer for Southwest Airlines, has invoked his Fifth Amendment rights and refused to turn over documents subpoenaed by the Justice Department as part of its broad investigation into the crashes in Indonesia and Ethiopia. He referred questions to his attorney when reached by phone. His attorney, David Gerger, of Houston, did not respond to inquiries.
Forkner played a key role in the development of the aircraft and worked for Boeing from 2011 to 2018. He’s now a first officer for Southwest. As chief technical pilot, Forkner’s job would have been to “provide flight operations, safety and technical support to Boeing internal and external customers at multiple levels” according to a job posting for a chief technical pilot on another airframe.
While “taking the Fifth” is often perceived as an admission of guilt, it’s use to avoid supplying documents is relatively rare and may just imply some legal wrangling between Forkner and the Justice Department according to experts consulted by the Seattle Times. The Times has previously reported that it was Forkner who suggested to the FAA that MCAS was not included in the FCOM. He, his lawyer and officials with the Justice Department all declined to comment on the legal move.
U.S Senate Aviation and Space subcommittee Public Hearing
On 27 March 2019, the U.S Senate’s Aviation and Space subcommittee held a public hearing, where Daniel Elwell, the FAA’s acting administrator, defended the agency’s oversight of the jet. A second hearing, where Boeing officials might testify, is pending without a date
US Securities and Exchange Commission (SEC)
The mission of the U.S. Securities and Exchange Commission (SEC) is to protect investors, maintain fair, orderly, and efficient markets, and facilitate capital formation.
24 May 2019 - The US Securities and Exchange Commission (SEC) is investigating whether Boeing properly disclosed issues tied to the Max. Officials in the SEC’s enforcement division are examining whether Boeing was adequately forthcoming to shareholders about material problems with the plane.
The agency is also said to be reviewing the aircraft manufacturer's accounting to make sure its financial statements have appropriately reflected potential impacts from the problems.
The SEC declined to comment because the investigation is not public but Boeing confirmed the investigation in a statement issued 31 Jan 2020 that that it is "fully cooperating with U.S. government investigations related to the accidents and the 737 Max, including investigations by the U.S. Department of Justice and the Securities and Exchange Commission."
The Office of Special Counsel
This is a federal agency that investigates whistleblower complaints. A whistleblower alleged that many FAA inspectors performing safety assessments on the 737 Max weren’t properly qualified to certify pilots or assess pilot training. The Office of Special Counsel sided with the whistleblower and said some internal FAA reviews had concluded the same thing. It found that 16 of 22 FAA pilots conducting safety reviews, including making decisions on the 737 Max when it came into service two years ago, “lacked proper training and accreditation,” according to the Office of Special Counsel letter to President Trump.
The FAA, which disputed the findings, issued a second statement with a stronger denial. “The FAA stands behind its response to Senator Wicker’s questions about the qualifications of Flight Standardization Board members,” it said in the latest statement. The agency’s communications to the lawmaker were cited in the Office of Special Counsel report.
On 23 Sep 2019, the U.S Office of Special Counsel (OSC) sent letters to the President and Congress alerting them that numerous Federal Aviation Administration (FAA) safety inspectors were not sufficiently trained to certify pilots. A whistleblower disclosed the allegations to OSC, which were substantiated by an agency investigation that calls into question the operational review of several aircraft, including the Boeing 737 MAX and the Gulfstream VII. OSC also found that responses by FAA to congressional inquiries regarding these allegations appear to have been misleading in their portrayal of FAA employee training.
“The FAA is entrusted with the critically important role of ensuring aircraft safety," said Special Counsel Henry J. Kerner. “The FAA's failure to ensure safety inspector competency for these aircraft puts the flying public at risk." Safety inspectors participate in Flight Standardization Boards, which are responsible for ensuring pilot competency by developing training and experience requirements. Pursuant to FAA policy, safety inspectors must have both formal classroom training and on-the-job training. FAA policy states that on-the-job training “does not substitute for required classroom training."
In its investigation, the FAA's independent Office of Audit and Evaluation (AAE) determined that 16 out of 22 safety inspectors, including those at the Seattle Aircraft Evaluation Group, had not completed formal training. Further, 11 of the 16 undertrained safety inspectors did not have Certified Flight Instructor certificates, which are a basic position requirement. Based on information provided by the whistleblower and material obtained via an ongoing investigation, this also included safety inspectors assigned to the 737 MAX. According to the whistleblower, the unqualified inspectors administered hundreds of certifications, known as “check rides," that qualified pilots to operate new or modified passenger aircraft.
Despite the training deficiencies uncovered by the investigation, the FAA provided a response to the Senate Committee on Commerce, Science, and Transportation on April 4, 2019 claiming that “all of the flight inspectors who participated in the Boeing 737 MAX Flight Standardization Board certification activities were fully qualified for these activities."
US Senate Commerce Committee - “Aviation Safety and the Future of Boeing’s 737 MAX”
U.S. Sen. Roger Wicker, R-Miss., chairman of the Senate Committee on Commerce, Science, and Transportation, will convene a hearing titled, “Aviation Safety and the Future of Boeing’s 737 MAX,” at 10:00 a.m. on Tuesday, October 29, 2019. This hearing is intended to examine issues associated with the design, development, certification, and operation of the Boeing 737 MAX following two international accidents in the last year. The committee will first hear from Boeing on actions taken to improve safety and the company’s interaction with relevant federal regulators. The second panel will follow and be comprised of government officials and aviation experts to discuss the status of Boeing 737 MAX and relevant safety recommendations.
Witness Panel 1: Mr. Dennis Muilenburg, President and Chief Executive Officer, The Boeing Company, accompanied by: Mr. John Hamilton, Vice President and Chief Engineer, Boeing Commercial Airplanes
Witness Panel 2: The Honorable Robert Sumwalt, Chairman, National Transportation Safety Board The Honorable Christopher Hart, Chairman, Joint Authorities Technical Review
The House Committee on Transportation & Infrastructure
15 May 2019
The U.S. House Aviation Subcommittee of the Transportation and Infrastructure Committee held a 3 hour hearing on the status of the 737 MAX. Daniel Elwell, acting administrator of the FAA and NTSB chair Robert Sumwalt testified. The hearing was held to start producing answers on how the FAA certified the safety of the 737 MAX. So far, requested information from Boeing has not been forthcoming, noted Transportation and Infrastructure Committee Chairman Representative Peter DeFazio, a Democrat from Oregon who opened his statement by saying that Boeing has yet to turn over a single document as requested by the committee.
In this meeting, Elwell came under sharp questioning over how the FAA and Boeing had certified the plane as safe. The FAA has also been criticized for not requiring a clear description of the automated MCAS feature in documentation for pilots. House Transportation Committee Chairman Peter DeFazio, D-Ore., cited a Boeing engineer who was taped during a November meeting with a pilots' union saying MCAS might be seen just once in a million miles, and that "we try not to overload the crews with information that's unnecessary." "Do we really think that was unnecessary? It wasn't in the manual, and they didn't even know about it," DeFazio told Elwell.
19 June 2019
Airline pilots, including Chesley “Sully” Sullenberger, told the committee that the US FAA should require more frequent flight simulator training for pilots and ensure adequate aircraft information is provided during training.
Sullenberger and Dan Carey, who represented the union of pilots at American Airlines, said during their testimonies that Boeing did not provide pilots with any information about this manoeuvring characteristics augmentation system (MCAS) prior to the Lion Air Crash in October. Acting FAA chief Dan Elwell has also said pilots were not given adequate information about the flight control software. "This is a global aviation crisis of trust and will require global solutions to restore and bolster aviation’s global safety culture and reputation," Carey said.
24 July 2019
The NTSB Chairman Robert Sumwalt said that "We will let the facts drive us, but I am told that our staff is working on a recommendation package that I would suspect we would have out in the next 60 days regarding design certification issues."
30 Oct 2019
The following slides (Courtesy of House Transportation Committee) were presented:
An email exchange was disclosed between Boeing employees from 2015 and read: "Are we vulnerable to single AOA sensor failures with the MCAS implementation?" The response today from CEO Dennis Muilenburg was that the email showed that "our engineers do raise questions, in an open culture," but that the single-sensor design met the standards.
John Hamilton, chief engineer for Boeing’s commercial airplane division, who testified alongside Muilenburg, said that single points of failure are allowed in airplane design depending on the hazard assessment. Any dissent the committee could present on the final assessment that a single sensor was merited “highlights that our engineers do raise questions and it’s an open culture.”
Transportation Committee Chair Peter DeFazio released a document showing that in June of 2018, after airlines had begun flying the new 737 Max planes, but months before the Lion Air crash, Boeing employees were raising concerns about how much time it would take for pilots to react to a potential MCAS failure. The document, called a "coordination sheet" and dated June 11, 2018, suggested some pilots would take more time than four seconds to react, and, "A slow reaction time scenario, (greater than) 10 seconds, found the failure to be catastrophic."
In the Ethiopian crash, the pilots are believed to have taken eight seconds to respond. John Hamilton acknowledged that engineers considered the impact of slow response times, but that simulator testing with a number of pilots supported its judgement that four seconds was a realistic expectation.
The NTSB Aviation Safety Recommendation Report 19-01 found Boeing was wrong in its assumptions and underestimated how long it would take pilots to react to such a failure, especially since the flight crew would be bombarded with multiple alerts and the stick shaker. Muilenburg told lawmakers he could not speak to that specific document but admitted "we made some mistakes on MCAS," and the company is now "revisiting these decades-long industry standards" on reaction time assumptions.
The above slide shows that the design requirements for MCAS stated that “MCAS shall not have any objectionable interactions with the piloting of the airplane,” and that “MCAS shall not interfere with dive recovery.” Rep. Greg Stanton challenged Muilenburg and Hamilton to admit that MCAS failed to meet those objectives. Hamilton asserted that pilots had the ability to counteract MCAS, but when challenged for a yes or no answer on whether it impacted dive recovery on the two fatal flights, Hamilton eventually answered “yes.”
The above slide is a proposed design from 2012 for an MCAS annunciator. Hamilton said that the design was not adopted because a failure of MCAS was incorporated into the failure indicator for the overarching speed trim system that MCAS is part of. Furthermore, an MCAS failure annunciator wouldn’t have helped pilots in the two crashes since the MCAS system didn’t fail; in each case MCAS was triggered by incorrect data from a faulty AoA sensor.
4 Nov 2019
The following update letter was written by the Committee Chairman to colleaugues:
It included the following paragraph:
"To summarize our key concerns, our investigation shows that from almost the start, Boeing had a bad design on MCAS with a single point of failure. Then, Boeing couldn’t even meet its own design requirements. MCAS was fundamentally flawed, and according to Boeing’s own analysis, could result in catastrophic consequences in certain cases. What’s more, Mr. Muilenburg’s answers to our questions were consistent with a culture of concealment and opaqueness and reflected the immense pressure exerted on Boeing employees during the development and production of the 737 MAX. Boeing leadership has said that if company officials knew during the design of the MAX what they know now about some of the technical flaws and other issues, they would have done things differently. Our investigation has already shown that Boeing leadership was aware of many of the problems that engineers are now attempting to fix during the design and development phase of the 737 MAX."
11 Dec 2019
The US House of Representatives Transportation Committee chairman Rep. Peter DeFazio requested FAA administrator Stephen Dickson to investigate why the agency did not ground the 737 MAX, when its own analysis performed after the Lion Air crash, predicted as many as 15 more fatal accidents over the model’s service life if its flight control problem went uncorrected. Addressing the fifth transportation committee hearing on the MAX crashes, DeFazio noted that the FAA also reached the conclusion that 99 out of 100 flight crews could comply with the airworthiness directive and successfully react within ten seconds to the “cacophony” of alarms and alerts recounted in the Lion Air crash report.
Facing the Congress, Dickson had to answer on an internal forecast of the regulator dating from December 2018, two months after the Lion Air crash. The memo suggested that, without modification, the MCAS design flaw in the 737 MAX "could result in as many as 15 future fatal crashes over the life of the fleet ". This translates into one crash every three years during the 45 years of the estimated life of the program, potentially leading to the death of 2,900 people.
“Such an assumption we know now was tragically wrong,” he said. “Despite its own calculations, the FAA rolled the dice on the safety of the traveling public and let the MAX continue to fly until Boeing could overhaul its MCAS software. Tragically, the FAA’s analysis, which never saw the light of day beyond the closed doors of the FAA and Boeing, was correct.”
Peter DeFazio also said that “The FAA issued an emergency airworthiness directive that purported to inform pilots on how to respond to an erroneous activation of MCAS while actually never mentioning the system by name, In fact, during the certification of the 737 MAX Boeing actively pushed the FAA to remove references to the MCAS from the flight crew operating manual, as revealed in the emails and instant messages from Boeing executive Mark Forkner.”
Boeing have been working on a software modification to MCAS since the Lion Air accident. Unfortunately although originally due for release in January it was not released due to both engineering challenges and differences of opinion among some federal and company safety experts over how extensive the changes should be.
6 Mar 2020
The House Committee on Transportation & Infrastructure published its Preliminary Investigative Findings on the 737 MAX Costs, Consequences, and Lessons from its Design, Development, and Certification.
The conclusions are as follows:
Boeing’s design and development of the 737 MAX was marred by technical design failures, lack of transparency with both regulators and customers, and efforts to obfuscate information about the operation of the aircraft. During development of the 737 MAX, Boeing engineers raised safety concerns about MCAS being tied to a single AOA sensor. Another Boeing engineer raised concerns about not having a synthetic airspeed sensor on the 737 MAX.
In the wake of the Lion Air and Ethiopian Airlines tragedies, Boeing has now acknowledged some of these issues by planning to have two AOA sensors feed into MCAS, for instance. In January 2020, despite the fact that Boeing’s internal directive for the 737 MAX program made crystal clear that nothing should jeopardize Level B non-simulator pilot training requirements, Boeing reversed course by recommending that pilot simulator training on the 737 MAX will be needed before it returns to service. Boeing’s responses to safety issues raised in the 737 MAX program have consistently been too late.
The Committee’s investigation has also found that the FAA’s certification review of Boeing’s 737 MAX was grossly insufficient and that the FAA failed in its duty to identify key safety problems and to ensure that they were adequately addressed during the certification process. The combination of these problems doomed the Lion Air and Ethiopian Airlines flights.
In the weeks after the Lion Air crash, Boeing defended its development of MCAS to the FAA, writing that there was “no process violation or non-compliance” on multiple issues, including: removal of reference to MCAS from the FCOM; Boeing’s evaluation of “repeated unintended MCAS” activation; the fact Boeing did not evaluate “loss of one AOA followed by erroneous AOA” in the simulator; and the fact that the analysis Boeing did conduct was “completed prior to the design change to MCAS control law.”
The fact that multiple technical design missteps or certification blunders were deemed “compliant” by the FAA points to a critical need for legislative and regulatory reforms. Developing a transport category commercial aircraft that is compliant with FAA regulations but fundamentally flawed and unsafe highlights an aviation oversight system in desperate need of repair.
These preliminary investigative findings make clear that Boeing must create and maintain an effective and vigorous safety culture and the FAA must develop a more aggressive certification and oversight structure to ensure safe aircraft designs and to regain the confidence of the flying public. We hope these preliminary findings will help pave the way for legislative reforms as the Committee’s investigation continues to identify the actions and events that undermined the design, development, and certification of the 737 MAX aircraft and led to the tragic death of 346 people.
Emails discussing MAX differences from NG and differences to reduce certification and training impact
The The House Committee on Transportation & Infrastructure (above) asked Boeing to release documents and emails surrounding the design decisions on the MAX. These documents became public in Jan 2020 and contain astonishing revelations about the decision making process of certain MAX differences from NG. These include:
25 Feb 2020 - Three Democratic U.S. senators introduced sweeping legislation to reform how new airplanes are certified and overseen by U.S. regulators after the Boeing 737 MAX crashes. The bill would create an independent aircraft certification commission, bar Boeing Co and other manufacturers from tying employee compensation to delivery of airplanes and increase oversight of manufacturers that handle delegated certification tasks on behalf of the FAA. The legislation would also set new requirements for individuals handling delegated certification tasks and require regular audits.
The Proposed Fix
Note that as MCAS is an FCC function, the modifications to MCAS are made in the FCC software. The revision will be known as FCC P12.1
There are three significant changes to MCAS software being worked on by Boeing:
Furthermore there is expected be:
On 16 Apr 2019 the MCAS flight test program concluded after 120 flights / 203 hours flight test time. The Boeing CEO, Dennis Muilenburg flew on a 737 Max demonstration flight, where he “saw first-hand this software in its final form, operating as designed across a range of flight conditions”.
On 29 May 2019 the Boeing CEO, Dennis Muilenburg said in an interview with CBS Evening News "The implementation of that software — we did not do it correctly. Our engineers discovered that. We are fixing it now. And our communication on that was not what it should have been. We clearly fell short. And the implementation of this [alert] was a mistake," he added. "We did not implement it properly."
On 5 Aug 2019 the Boeing CEO, Dennis Muilenburg said that the MAX has conducted almost 500 test flights with the new FCC software. Muilenburg said that he has personally flown on two of the test flights, and that Boeing employees are “eager to do the same.”
A MAX MCAS flight test. Note the airspeed and offshore location.
Details from Boeing here:
The Return to Service of the MAX
Update 8 Apr 2020
A key test flight of the Boeing 737 MAX has been delayed by a month to May due to the coronavirus crisis. The certification flight, to be overseen by the FAA had been targeted for April. Boeing has been saying that it expected to receive regulatory approval to resume flights on the MAX in mid-2020, and a company spokesman confirmed that timeframe still holds. An FAA spokesman said "work is still ongoing" on the MAX certification. Social distancing policies enacted throughout the United States to address COVID-19 have forced teams from Boeing and the FAA to work remotely and posed challenges for the test flight itself because of the need for closer physical contact. Even after the test flight, other hurdles remain. Officials also need to settle on pilot and crew training requirements for the upgraded MAX, which includes an update to a flight handling system implicated in fatal crashes of Lion Air and Ethiopian Airlines planes.
Update 18 Oct 2019
From the press: "Final Simulator Tests For Boeing 737 MAX Expected To Begin In Early November". If successful, this would suggest that the MAX could be recertified in December and that the type could be back in service by January, subject to crew training requirements and de-mothballing of stored aircraft.
Update 25 Aug 2019
The certification test flight for the changes to Boeing’s 737 MAX flight architecture is now expected to occur in early October. If succussful, a return to service should occur sometime in the fourth quarter of 2019.
Update 5 Aug 2019
Boeing now plan to submit a certification package to the FAA in September, and then expect the MAX to return service early in the fourth quarter.
Update 31 May 2019
Boeing is planning the return to service of the MAX. CEO Dennis Muilenburg has described a disciplined schedule that would start with Boeing teams helping to take about 500 parked 737 jets out of storage. That total includes about 100 newly built aircraft that can't be delivered until the grounding is lifted. They are stored around the Seattle area and on a large Boeing maintenance base in San Antonio. Boeing has two other sites where it could park planes if needed.
Boeing doesn't plan to increase the production rate, dropped from 52 to 42 aircraft per month in April, nor reinstate its financial forecast, until it's clear that its supply-chain is healthy and moving in sync.
CFM International, in a break from its earlier struggles with delays, is starting to deliver turbofans on schedule, Muilenburg said. They are also feeding a pool of spare engines.
Boeing is still responding to questions from the FAA and international regulators. EASA Director Patrick Ky wrote in a letter dated May 27 that EASA will do a separate, in-depth review to examine the 737 Max's entire flight-control system, including the plane's displays, alerts and air-data systems, as well as the aircraft's autopilot function,
"The regulators aren't on the same page," said De Juniac, the IATA chief. "Otherwise they'd have a similar time line, a similar set of measures."
The EASA Position
The European Aviation Safety Agency (EASA) has said it will want to satisfy itself about the MAX's suitability for return to service with no delegation to the FAA.
In a presentation by Patrick Ky, Executive Director of EASA, on 3 Sep 2019 to the European Parliament’s transport committee, the EASA chief showed extracts from a letter he wrote to the FAA on 1 Apr 2019 giving a list of four conditions which would have to be met before EASA would allow the MAX to return to service:
Ky noted that the FAA now finds itself in a “very difficult situation”, indicating that the hierarchy between certification authorities and the US agency may be forever changed, saying, “It is very likely that international authorities will want a second opinion, or a further opinion … It was not like this a year ago.”
The presentation can be viewed here: https://www.europarl.europa.eu/cmsdata/186500/20190903_EASA_Ky-original.pdf (Slides 6-16 apply)
The presentation was not exclusively about the MAX and these slides deal with other non-MAX issues such as EASA Strategic Priorities etc
Title Page (Slide 6)
Lion Air accident (Slide 7)
Ethiopian accident (Slide 8)
Decision to ground / ban (Slide 9)
Preliminary information On the Contributing factors (Slide 10)