EVALUATION OF MCAS SYSTEM

The aim of the article is to analyze the functionality of the Boeing MCAS system. MCAS is identified as the main culprit of two air accidents that impacted Boeing and grounded Boeing 737 MAX aircraft. Many findings indicate that the above type of aircraft was released into service with many errors that had an impact on aircraft control, and it is clear that Boeing knew about these errors and specifically kept them secret. Boeing kept the errors from affecting the production of the 737 MAX and at the same time losing competition against Airbus. Investigations and certification of this type are not completed even one year after their grounding and this process will have a long-term impact on the entire aviation industry.

ISSN 1339-9853 (online) http://acta-avionica.tuke.sk ISSN 1335-9479 (print) in September 2019, about the inspections of Boeing aircraft 737 NG after cracks were found on some planes [3]. Crespo A.M.F. in Less automation and full autonomy in aviation, dilemma or conundrum? said that the two recent fatal accidents involving the brand-new Boeing 737 Max 8 fourth generation airplane reignited the discussions on the suitability of the increasing aircraft automation levels [4]. Sarin A. in Boeing technological issues and challenges: Nosedive strategy points out that major aircraft manufacturing companies -Boeing & Airbus based at US & France respectively are in severe competition with each other. Therefore, both the companies tried to develop innovatory technological changes to offer their airplanes with better features and performance. Accordingly, Boeing developed 737 Max with special technical features and claimed on its website this model as its fastest selling airplane. The latest technological changes developed for 737 Max are not known to the industry [5].
Sqobba T. in B-737 MAX and the crash of the regulatory system said that The FAA is looking to develop streamlined launch and reentry licensing requirements for the evolving commercial space industry. A central goal is to move from prescriptive requirements to performance requirements. By focusing on outcomes, performance standards give to developer's flexibility and make it possible to find lowest-cost means to achieve compliance. Performance standards can generally accommodate technological change and the emergence of new technology driven hazards in ways that prescriptive standards cannot. However, how performance standards are designed and how they are implemented and enforced matters greatly. This paper uses the case of the Boeing B-737 MAX MCAS certification to illustrate the following mistakes to be avoided when using performance-based safety requirements: excessive trust on quantitative performance requirements, inadequate risk-based design process, and lack of independent design verification by experts [6].
Wong J.W. et al in flight test methodology for NASA advanced inlet liner on 737MAX-7 test bed (Quiet technology demonstrator 3) presented that the acoustic flight test results of an advanced nacelle inlet acoustic liner concept designed by NASA Langley, in a campaign called Quiet Technology Demonstrator 3 (QTD3). NASA has been developing multiple acoustic liner concepts to benefit acoustics with multiple-degrees of freedom (MDOF) honeycomb cavities, and lower the excrescence drag. Acoustic and drag performance were assessed at a lab-scale, flow duct level in 2016. Limitations of the lab-scale rig left open-ended questions regarding the in-flight acoustic performance. This led to a joint project to acquire acoustic flyover data with this new liner technology built into full scale inlet hardware containing the NASA MDOF Low Drag Liner. Boeing saw an opportunity to collect the acoustic flyover data on the 737 MAX-7 between certification tests at no impact to the overall program schedule, and successfully executed within the allotted time [7].

METHODOLOGY
The 737 MAX was produced with several differences from the NG. Many of these differences were obvious such as the new LEAP engines or the larger flight display screens. Some were less obvious but well documented such as the FBW spoiler system. It also now appears that some differences were almost hidden, certainly from the flight crew. MCAS is one such difference.
MCAS is a longitudinal stability enhancement. It is not for stall prevention (although indirectly it helps) or to make the MAX handle like the NG (although it does); it was introduced to counteract the non-linear lift generated by the LEAP-1B engine nacelles at high AoA (Angle of Attack) and give a steady increase in stick force as the stall is approached as required by regulation.
MCAS (Maneuvering Characteristics Augmentation System) is implemented on the 737 MAX to enhance longitudinal stability characteristics with flaps UP and at elevated Angles of Attack (AoA). The MCAS function commands nose down stabilizer to enhance pitch characteristics during steep turns with elevated load factors and during flaps up flight at airspeeds approaching stall. MCAS is activated without pilot input and only operates in manual, flaps up flight. The system is designed to allow the flight crew to use column trim switch or stabilizer aisle stand cutout switches to override MCAS input. The function is commanded by the Flight Control Computer (FCC) using input data from sensors and other airplane systems.
The MCAS function becomes active when the AoA exceeds a threshold based on airspeed and altitude. MCAS will activate for up to 9.26 seconds before pausing for 5 seconds. Stabilizer incremental commands are limited to 2.5 degrees and are provided at a rate of 0.27 degrees per second. The magnitude of the stabilizer input is lower at high Mach number and greater at low Mach numbers (for the same AoA above the activation threshold).
After AoA falls below the hysteresis threshold (0.5 degrees below the activation angle), MCAS commands nose up stabilizer to return the aircraft to the trim state that existed before the MCAS activation.
The function is reset once angle of attack falls below the Angle of Attack threshold or if manual stabilizer commands are provided by the flight crew. If the original elevated AOA condition persists, the MCAS function commands another incremental stabilizer nose down command according to current aircraft Mach number at actuation.
The LEAP engine nacelles are larger and had to be mounted slightly higher and further forward from the previous NG CFM56-7 engines to give the necessary ground clearance. This new location and larger size of nacelle cause the vortex flow off the nacelle body to produce lift at high AoA. As the nacelle is ahead of the C of G, this lift causes a slight pitch-up effect (ie a reducing stick force) which could lead the pilot to inadvertently pull the yoke further aft than intended bringing the aircraft closer towards the stall. This abnormal nose-up pitching is not allowable under 14CFR §25.203(a) "Stall characteristics". Several aerodynamic solutions were introduced such as revising the leadingedge stall strip and modifying the leading edge vortilons but they were insufficient to pass regulation. MCAS was therefore introduced to give an automatic nose down stabilizer input during elevated AoA when flaps are up.

Technical description
The original design of MCAS was that it would only activate "at extreme high-speed pitch-up conditions that are outside the normal operating envelope" (see extract from the Maintenance Training Manual below). However, during flight testing it became apparent that the engine nacelles were also creating a pitch-up effect under certain conditions at very low speeds. The scope of MCAS was broadened to include low speed activation as well as high speed activation.
The MCAS function becomes active when the AoA exceeds a threshold based on airspeed and altitude. MCAS will activate for up to 9.26 seconds before pausing for 5 seconds. Stabilizer incremental commands are limited to 2.5 degrees and are provided at a rate of 0.27 degrees per ISSN  second. The magnitude of the stabilizer input is lower at high Mach number and greater at low Mach numbers (for the same AoA above the activation threshold). After AoA falls below the hysteresis threshold (0.5 degrees below the activation angle), MCAS commands nose up stabilizer to return the aircraft to the trim state that existed before the MCAS activation. The function is reset once angle of attack falls below the Angle of Attack threshold or if manual stabilizer commands are provided by the flight crew. If the original elevated AOA condition persists, the MCAS function commands another incremental stabilizer nose down command according to current aircraft Mach number at actuation. Since MCAS is an FCC function, the AoA source for MCAS is that of the FCC in use; ie FCC 1 uses the Captains AoA probe and FCC 2 uses the F/Os AoA probe. When the 737 is powered up the FCC used is FCC 1 for that flight, this changes for each subsequent flight until the aircraft is powered down. Therefore, the AOA sensor that is used for MCAS changes with each flight post power-up.

Figure 2 AOA indicator
Pre-accidents, there was an option for airlines to have an AoA indicator displayed on the PFDs -for a fee. As far as I know this option was only been taken by Southwest and American Airlines before the accidents. As part of the post-grounding MCAS upgrade, the optional AoA indicator will now be available free of charge and the AOA DISAGREE alert will now be standard on all MAX aircraft. The AoA Disagree Alert will display "AOA DISAGREE" in amber at the bottom right of the PFD if the AoA vanes disagree by more than 10 degrees for more than 10 continuous seconds.

RESULTS
The initial analyses suggest that the MCAS software system was poorly designed and caused two plane crashes. But this is a complex situation, involving many people and organizations. In addition, other pilots had successfully struggled against the MCAS system and safely guided their passengers to their destination. Four contributing factors, observed in the Boeing case, have also been observed in other catastrophic software failures. They are: poor documentation, rushed release, delayed software updates, and humans out of the loop.

Poor Documentation
After the Lion Air crash, pilots complained that they had not been told about the MCAS or trained in how to respond when the system engages unexpectedly. This lack of documentation and training is especially dangerous when automated systems are involved and previous training does not fully apply. Tragically, black box recordings indicate Lion Air pilots frantically attempted to find answers in the manuals before they crashed. Pilots take their documentation extremely seriously. Following are three reports from the Aviation Safety Reporting System (ASRS), which is run by NASA to provide pilots and crews with a way to confidentially report safety issues. Three reports highlighted next focus on the insufficiency of Boeing 737 MAX documentation.

Rushed release of Boeing 737 MAX
Tight deadlines and rushed releases are not uncommon. When presented with a contract deadline or other similar requirement, the tendency can be to cut corners, make concessions, and ignore or mask problemsall to release a product by a specific date so the company does not lose business. At times like this, problems can be downplayed, and when they are observed by the customer, the work is deferred to a patch. Apparently, the 737 MAX project was subject to the same treatment. As we estimate 737 MAX was nine months behind the new A320neo. Boeing managers had prodded engineers to speed up the production process, and if there wasn't time for FAA staff to complete a review, FAA managers either signed off on the documents themselves or delegated the review to Boeing. The FAA explained this by noting a lack of funding and resources to carry out due diligence.
As a result of this rushed process, a major change slipped through; the system safety analysis on MCAS claimed the horizontal tail movement was limited to 0.6 degrees. Boeing engineers later found this number to be insufficient for preventing a stall in worst-case scenarios, so it was increased by a factor of four. The FAA was never informed of this engineering change, and FAA engineers did not learn about it until Boeing released the MCAS bulletin following the Lion Air crash.

Faulty signals and their effects
The Indonesian crash investigators have said the 737 MAX involved in the crash has flown with unreliable airspeed information in the last four flights. We interpret this as one of the primary ADIRU systems has delivered unreliable airspeed. The flight crew prior to JT610 identified the unreliability to the captain's displays, which should mean the left ADIRU with sensors had a problem. Exactly what's the root cause of this unreliable information.
The actions to correct the problem after the prior flight seem not to have worked. In the crash flight, the problem seems to have affected the Angle Of Attack information. Whether the Alpha Vane or some other part of the system generated this false reading is not known. The AOA sensor measures how large the angle is between the approaching air and the wings pitch incidence. If this angle is too large, the wing stalls (loses lift). To combat such a situation, the 737 (as other airliners) has an implemented Stall warning and recovery system.
The angle of attack is also used to control an Automatic trim action during manual flight to gradually relieve the pilot of any constant stick forces. This action is not described in the 737NG FCOM and might be the reason why the bulletin is restricted to the 737 MAX type, which has implemented this to increase longitudinal stability for this type.

Figure 4
Boeing 737 NG and MAX primary air data sensors with processing systems Any such Automatic trim action which doesn't makes sense has the feel of a runaway pitch trim which is a very common emergency simulator training scenario. In isolation, this should be easy to spot and the correct action (Cut out the trim as described below) could be taken in relative calmness. I'm inclined to think the JT610 crew had to handle a more difficult and stressing false Stall warning and recovery situation, which is the same between the 737NG and the 737 MAX.

DISCUSSION
Preliminary investigations of Lion air flight 610 revealed serious flight control problems that traumatized passengers and crew on the aircraft's previous flight, as well as signs of angle-of-attack (AoA) sensor and other instrument failures on that and previous flights, tied to a design flaw involving the Maneuvering Characteristics Augmentation System (MCAS) of the 737 MAX series. The preliminary report tentatively attributed the accident to the erroneous angle-of-attack (AoA) data and automatic nose-down trim commanded by MCAS.
The initial reports for Flight 302 operated by Ethiopian Airlines found that the pilots struggled to control the airplane in a manner similar to the Lion Air flight 610 crash. On March 13, 2019, the FAA announced that evidence from the crash site and satellite data on Flight 302 suggested that it might have suffered from the same problem as Lion Air Flight 610 in that the jackscrew controlling the pitch of the horizontal stabilizer of the crashed Flight 302, was found to be set in the full "nose down" position, similar to Lion Air Flight 610. This further implicated MCAS as contributory to the crash. Both above-mentioned air accidents are a chain of errors Boeing committed in the construction of a new type of aircraft Boeing 737 MAX. The aim of Boeing was to maintain its market position and not ISSN  to allow Airbus to gain a competitive advantage. The investigation revealed a number of errors that Boeing specifically concealed in order not to jeopardize the production of Boeing 737 MAX.

CONCLUSION
Research suggests that Boeing has committed several flaws in the construction of the aircraft type Boeing 737 MAX, which had fatal consequences. The consequences of these bad decisions are not yet complete, given that one year after the grounding of the above-mentioned type of aircraft, the FAA has not issued a license to operate these aircraft and the investigation is still ongoing. Boeing has decided to put the Boeing 737 MAX into operation as quickly as possible in the face of Airbus's competitive struggle without the need for tests, simulations, and with minimal pilot training on a new type of aircraft.