Pilots Say MAX MCAS Software Updates Prove Effective In Simulator Demo
Pilots Say MAX MCAS Software Updates Prove Effective In Simulator Demo
Fred George Aviation Week & Space Technology Apr 11, 2019
Boeing has demonstrated the old and new versions of the MAX’s Maneuvering Characteristics Augmentation System (MCAS) to pilots and regulators in its 737 MAX engineering cab simulator in Seattle. The MCAS is a new flight-control-computer (FCC) function added to the MAX to enable it to meet longitudinal stability requirements for certification.
However, the system is only needed to enhance stability with slats and flaps retracted at very light weights and full aft center of gravity (CG). The aircraft exhibits sufficient natural longitudinal stability in all other parts of the flight envelope without the MCAS to meet the rules. Boeing emphasizes that the MCAS is not an anti-stall or stall-prevention system, as it often has been portrayed in news reports.
The new software load [P12.1] has triple-redundant filters that prevent one or both angle-of-attack (AOA) systems from sending erroneous data to the FCCs that could falsely trigger the MCAS. It also has design protections that prevent runaway horizontal stabilizer trim from ever overpowering the elevators. Boeing showed pilots that they can always retain positive pitch control with the elevators, even if they don’t use the left and right manual trim wheels on the sides of the center console to trim out control pressures after turning off the trim cut-out switches.
Most important, the MCAS now uses both left and right AOA sensors for redundancy, instead of relying on just one. The FCC P12.1’s triple AOA validity checks include an average value reasonability filter, a catastrophic failure low-to-high transition filter and a left versus right AOA deviation filter. If any of these abnormal conditions are detected, the MCAS is inhibited.
Three secondary protections are built into the new software load. First, the MCAS cannot trim the stabilizer so that it overpowers elevator pitch control authority. The MCAS nose-down stab trim is limited so that the elevator always can provide at least 1.2g of nose-up pitch authority to enable the flight crew to recover from a nose-low attitude. Second, if the pilots make electric pitch trim inputs to counter the MCAS, it won’t reset after 5 sec. and repeat subsequent nose-down stab trim commands. And third, if the MCAS nose-down stab trim input exceeds limits programmed into the new FCC software, it triggers a maintenance message in the onboard diagnostics system.
According to a pilot who was shown the changes in a simulator session, the demonstration begins with the original MCAS software load. During a normal takeoff, at rotation, the left AOA indication moves to its maximum reading—as seen from the flight data recorder in the Ethiopian Airlines accident. Pilots currently do not experience this during initial or recurrent simulator training. The stickshaker fires continuously, using loud sound and control wheel vibration to focus the pilot’s attention on the critically high AOA indication. The erroneous AOA reading also creates large-scale indicated airspeed (IAS) and altitude errors on the primary flight display (PFD) which can be both distracting and disorienting.
AOA is used by the aircraft’s air data computers to correct pitot and static pressure variations induced by changes in nose attitude in relation to the relative wind. Large errors in AOA can cause 20-40-kt. errors in IAS and 200-400-ft. errors in indicated altitude. This is accompanied by the illumination of annunciators on both PFDs that warn of disparities in the IAS and altitude between the left and right displays. As part of the MCAS redesign, Boeing also is upgrading the MAX with AOA dial indicator displays and AOA disagree warning annunciators on the PFDs.
After the high-AOA indication, pilots then follow the checklist for “airspeed unreliable,” which assures that auto-pilot, auto-throttles and flight directors are turned off. They then pull back power to 80% fan speed, set 10-deg. nose-up pitch attitude and climb to 1,000 ft. above ground level. At that point, they lower the nose, start accelerating and begin retracting slats and flaps at 210 kt. indicated airspeed. When the slats and flaps are fully retracted—the MCAS kicks in.
“It’s a good thing we knew what to expect. Otherwise tunnel vision from the ‘airspeed unreliable’ event could have blinded us to the subsequent MCAS nose-down trim input. When I noticed the trim wheels racing, I grabbed the left wheel. It was easy to stop the trim with hand pressure, but I knew in advance what was happening,” says the pilot flying. “We followed the checklist for runaway stabilizer, checking again for auto-pilot off and auto-throttle off. We turned off both trim cut-out switches and cranked the ‘frisbees’ [manual trim wheels on both sides of the center console] to relieve control pressures. We used manual trim for the remainder of the flight to landing touchdown and rollout. That was quite an eye-opener, as I had never been exposed to that during sim training,” he notes.
It is critical to follow the checklist memory items: Pull back thrust to 75% after retracting slats and flaps and set attitude at 4 deg., nose up. If speed builds up beyond 220-250 kt., controllability becomes increasingly difficult, he adds.
Pilots for three U.S. air carriers tell Aviation Week that during their sim training they had never been exposed to extreme and continuous AOA indication errors, they’ve not experienced AOA induced airspeed and altitude deviations on PFDs and have not had to deal with continuous stall-warning stickshaker distractions. They also note that they have never been required to fly the aircraft from the point at which a runaway stab trim incident occurred all the way to landing using only the manual trim wheels. “We’re just checking boxes for the FAA,” says one Seattle-based pilot.
A full aerodynamic stall with the MCAS inoperative is another exercise pilots experience in the MAX engineering cab simulator. “We reduced thrust at 5,000 ft. and slowed the aircraft at about 1 kt. per sec. We were at a midrange cg [center of gravity] with gear, slats and flats up. We trimmed until we reached 30% above stall speed and then just continued to ease back on the control wheel,” one of the pilots says.
“Pitch feel was natural, progressively increasing as airspeed decayed. Somewhere between the audible low airspeed warning and stickshaker, I felt the slightest lightening on control pressure in my fingertips. Quite candidly, if I had not been watching for it, I don’t think I would have noticed any difference between the MAX and the Next Gen [NG] models. I kept pulling back through stickshaker, then buffet, then elevator feel shift [a function that doubles the artificial control feel forces near stall] and finally until the yoke was buried in my lap. The nose just flopped down gently at the stall, and I initiated recovery as I would in most other airplanes I’ve flown,” he adds.
During design of the MAX, Boeing added two more leading-edge vortilons [generating vortices over the top of the wing at high AOA] in 2018, for a total of six per side and also lengthened and raised the inboard leading-edge stall strips to assure stall behavior would be as docile as that of the NG.
Repeating many of the same maneuvers in the engineering cab simulator with the new software load would have been academic at best, as the triple-redundant AOA validity checks all but assure that the MCAS will not be triggered by erroneous AOA inputs in the future. But, FCC P12.1 changes do not protect against erroneous AOA causing stickshaker or large-scale distortions in indicated airspeed and altitude values. Those malfunctions still can cause distraction and disorientation, especially when flying at night and/or in instrument conditions.
The new MCAS protections built into the P12.1 software load preserve its essential role in enhancing the MAX’s longitudinal stability, while virtually guaranteeing that it won’t be triggered by erroneous AOA. And when it does activate, its nose-down stabilizer trim command authority will be limited to assure the pilots always can control aircraft pitch with the elevators.
However, the FCC software upgrades are not the only critical changes needed to boost safety margins for operators. Pilots who underwent the demonstration also say the sessions underscored the need for additional simulator training for dealing with compound emergencies involving AOA and runaway trim failures.