Two weeks after an international committee declared Boeing’s changes to the Boeing 737 MAX software “safe,” a Canadian official has suggested the only way he and his colleagues can “sleep at night” is if the problematic Maneuvering Characteristics Augmentation System (MCAS) is scrapped. Jim Marko, a 30-year veteran at Transport Canada and its engineering manager for Aircraft Integration and Safety Assessment, said in an email to colleagues in the U.S., Brazil and Europe that he doesn’t think the fixes proposed by Boeing are guaranteed to cover all potential failure scenarios and MCAS needs to be removed. “The only way I see moving forward at this point … is that MCAS has to go.” The full text of his email and his suggested engineering alternative was published by The Air Current.
Marko told his peers the fixes proposed by Boeing have exposed other unspecified flaws and he can’t support the process moving forward. “Judging from the number and degree of open issues that we have, I am feeling that final decisions on acceptance will not be technically based,” Marko wrote. “This leaves me with a level of uneasiness that I cannot sit idly by and watch it pass by.”
Boeing has been saying it expects recertification of the airplane with MCAS by the end of the year and a return to service shortly afterward but Marko suggests that will cause him and his colleagues anxiety. He said in the email that removing MCAS, which moves the horizontal stabilizer to counter stall characteristics not present in earlier models of the 737, will help “get some confidence back to us all that we as Authorities can sleep at night when that day comes when the MAX returns to service.
“MCAS introduced nasty behaviors that have to be suppressed which are not on the (older model 737) NG,” he wrote. “Are we all smart enough to think that we have wrapped a net around anything that can go wrong from hereon in?”
The New York Times first reported the existence of the email and the FAA responded to its inquiry by saying that Marko’s recommendations will be reviewed and Marko’s email is just an example of the thoroughness of the process. “The FAA and its international partners have engaged in robust discussions at various stages in this process as part of the thorough scrutiny of Boeing’s work,” the FAA told the Times. “This email is an example of those exchanges.”
If Marko’s fears gain traction, however, the effect on the return to service could be profound. MCAS was designed to automatically push the nose down and prevent a stall under specific conditions if the autopilot is not on. The system was installed to counteract pitch forces introduced by the bigger engines on the MAX and make it handle like earlier iterations of the 737. Faulty data from angle of attack sensors on a Lion Air MAX in October of 2018 and an Ethiopian Airlines aircraft in March of 2019 triggered the system while those aircraft were climbing at high power and the result in both cases was the aircraft dove at high speed and killed all 346 people aboard those planes.
Boeing’s MCAS fixes are designed to keep MCAS for its original purposes but to address its unintended consequences. Without the MCAS, handles differently than earlier 737s in some circumstances.
Boeing sold the MAX based on it having a common type rating with the earlier 737NGs, thus requiring minimal training for pilots, and MCAS is a key system in that. In fact, few airlines bought MAX simulators because they were assured their NG sims would handle all their training and currency needs. Marko acknowledges scrapping MCAS will cause some certification issues but says they will be “something we (regulators) could easily find a way to accept.”
Marko’s suggestion amounts to:
“I’d rather have ham-fisted pilots stall the aircraft.”
Recent history demonstrates that some pilots simply cannot be trusted to fly this thing.
Does the FAA (or any other regulatory body) really want to propose and defend a requirement for full-envelope-protection FBW on a go-forward basis – for ALL Part 25 aircraft?
Honestly, it would be easier – technically; not politically – to just remove the crew and the cockpit. Because there’s no such thing as a pilot-proof airplane.
> “Are we all smart enough to think that we have wrapped a net around anything that can go wrong from hereon in?”
You’re right. Time to scrap all the aircraft and start walking again. Oh wait, we might trip on a crack in the sidewalk. Thankfully we have Uber Eats!
“a Canadian official has suggested…”
Yeah, well, you know, that’s just, like, your opinion, man. -The Dude
The MCAS system may have been poorly implemented, but it was installed for a valid reason. Removing it now would require a total recertification of the MAX which would easily take a year or more. At this point MCAS is the most thoroughly reviewed system on any operating airliner today – reviewed by just about everybody on earth. They consider it to be an acceptable system. Not sure where this guy is coming from but I guess there will always be a few doubters in any major project. Maybe he owns stock in Airbus?
I think the comment about Mr Marko owning stock in Airbus is out of line.
I was waiting for someone to hold up their hand and say enough lipstick on this pig.
Boeing did not want to spend the money on a modern FBW control system, then fine but it is got to fly like a normal airplane at all the corners of the flight envelope with out electronic bandaids.
This is what happens when Boeing adopted the company culture of “You Engineers will never get time or money to do the job right, and by way we only want you taking the absolute minimum time and money to do it over to a just good enough standard to smoke it through the regulators”
Actually, David, I was being kind. I find it interesting that a Canadian is finding fault with Boeing’s design. I’m sure the fact that Airbus has a manufacturing site in Mirabel, and Pratt & Whitney Canada makes the engines for Airbus has nothing to do with it. Canada has had it out for Boeing ever since the company tried it’s ill-fated attempt at blocking the sale of Bombardier aircraft to Delta. I harbor no defense of Boeing: They screwed up and deserve all the brick bats everyone has thrown at them. But, at this point, the MCAS system has been thoroughly reviewed and signed off by everyone including the Euorpeans where Airbus resides. This smacks of a little grandstanding so someone can say “I told you so” if anything goes wrong.
The “problem” was seen in faulty maintenance and sending a plane with a known serious problems back into the air. The 2nd crash was well after the first and everyone should have known about TCAS (I did as a private pilot) and it should not have been a hard thing to figure out.
Point is that flying is a dangerous business and PILOTS and MECHANICS are paid to go beyond the perfunctory monkey work that their jobs have devolved into. Overcome, adapt, improvise.
Mark, MCAS was a secret. No one was trained on it and the mechanics did not know about it. There were
changes made after the first test flights and no one knew about that including the FAA.
Not a bad idea to scrap that system. If I remember correctly the MD-80 had problems with stalls. In that plane when it stalled the nose wanted to keep rising up and and go over backwards on it’s back. The fix was to raise the speed the stall warning activated. The aerodynamic problem was never fixed. The Max seems to be another example of a plane that was stretched one too many times. Boeing’s fix with the MCAS didn’t work out. Maybe they should try the MD-80 fix, raise the stall warning activation speed.
MD-80’s have strakes and stabilator boost.
The problem is really that the MAX has a horizontal tail that is too small.
MCAS is a Software Kluge to fix an Aerodynamic problem; trying to do so for less money and time than a proper aerodynamic solution.
IF Boeing had enlarged the horizontal stabiliser, instead of attempting a flawed software fix, the airplane would still be flying; two crashes would not have occurred, and Boeing would have saved a massive amount of money and time, not to mention keeping their reputation intact.
Quick and Cheap is not usually the answer to an actual problem.
Sorry Brian, I have to disagree with your opinion. You are approaching this from a mistaken viewpoint. The size of the stab would make no difference in solving the issue that the Max supposedly has. When you get into
the the corner of the air that Boeing was trying to fix, the stab / elevator gets really “light” and moves too easily, more so that the average pilot would understand. It takes a really light touch on the yoke, something that the majority of pilots don’t need to learn. That really light feel can be too effective and one ends up in a stall way to easily.
I also tend to disagree with the Canadian Official’s view. It comes across as “cover my fanny”. This is a simple matter now of defaulting to turning off the trim switches if you don’t understand what just happened.
I doubt there is a Boeing pilot in the world that doesn’t understand that by now. The other part of the equation is to actually write-up the system if it hiccups,
“Pilots override with manual trim” Says it all.
I think we should let it go and let the free market do it’s job. The MCAS override originated on Wall St where it belongs.
Frankly I’m surprised the White House hasn’t yet come up with a ‘perfect’ solution, a ‘Sharpie’ tweek to the software.
I’ve never worked with airliners. Perhaps someone can explain to me why the pilots of these things which they will fly in pairs for thousands of hours CANNOT be trained to deal with some unusual handling characteristics, but CAN be trained to perform complex responses to system failure whenever software hiccups.
Seems like both things require simulator time. Is it just that much more expensive to train one over the other?
Somehow, you’ve missed the point. (Don’t sweat it – you have lots of company.) It’s a certification requirements issue. The RULES disallow the lighter control forces.
Pitch-twitchy airplanes are not a good thing, either.
I think the last paragraph says it all; “Boeing sold the MAX based on it having a common type rating with the earlier 737NGs, thus requiring minimal training for pilots, and MCAS is a key system in that.” Therein lies the problem.
For as all the reporting and resulting postulating from experts to less than experts ( me included), I have not seen or heard of pilot reactions reported when put into a simulator programmed to duplicate the Lion Air and Ethiopia Airlines MCAS failures.
Shortly after the Sioux Falls DC-10 crash landing, many highly expediences DC-10 captains were put in the same predicament as Haynes and crew, which to my knowledge, could not do what they did…even though it was well known how Haynes and crew handled the situation. There was no arm-chair quarterbacking by virtually anyone as a result.
As much simulator technology that is out there today vs what was available then, I have not heard any reporting regarding the performance of MAX/NG 737 captains and FO’s put into the same situation. If what was required flight-wise is so slam dunk as simply turning off the stab trim switches, why no news on the performance that several Captain Averages with FO ClosetoAverages, a couple of Captain Yeagers with FO Hoovers, plus a couple of Captains HiTym and FO LoTym from those less trained, highly suspect, foreign airlines so many want to criticize, and finally the sim results of FAA Administrator Steven Dickson under the same circumstances. If I was a Boeing lawyer, and Mr Muilenberg, I would be all over those results if they were positive.
Boeing has admitted that some pilot reaction to rogue MCAS activation was not as anticipated by Boeing engineers. How extensive and pervasive are/was those flight crew actions to force Boeing to acknowledge pilots reacted quite differently than expected? We know that two MAX captains and two MAX FO,s did not react as planned resulting in taking 342 others with them to their graves.
I would suggest that post-crash sim results, even with all the preparedness any 737 crew is now blessed with regarding MCAS being on-board, including finally, proper training for crew and maintenance, the crew’s flight performance coping with bogus MCAS activation is still showing unexpected crew responses with less than safe results. I am sure Mr. Marko is aware of those results. I am also sure the Southwest Airlines Pilot Union is also aware of those results…hence their lawsuit against Boeing for that and a host of other reasons.
As pointed out by many within these blogs since the first MAX crash, MCAS is part of the certification process for the MAX series of airplanes. Eliminating MCAS or anything that deviates from that intentional design, good or bad as it may be, calls for a completely new certification for those MAX airplanes once flying and those waiting for delivery. Or, as they are attempting to do today, write enough “fixes” into the existing MCAS software to cover any potential issues yet to surface or be anticipated. If I were someone tasked with accessing when those “fixes” are sufficient, I too, would have a hard time sleeping.
Can MAX only MCAS equipped airplanes be “fixed” to make an aerodynamically different 737 from all its predecessors fly like a legacy 737 through out it’s entire flight envelope? This arm-chair quarterback is suspicious if that is possible. But as an arm-chair quarterback, I am comfortable in my suspicion as I am not a MAX or 737 caption nor first officer with a very high likelihood that I will never be in either chair. Nor will I ever be in a MAX sim. And until this is sorted out to the global aviation regulatory alphabet groups satisfaction, the likelihood I will be a passenger on a MAX aircraft is equally unlikely. As a result, it is quite comfortable and extremely easy for me to continue to be an arm-chair quarterback.
Maybe, Garmin has an Auto-Land solution with BRS adding it’s technology for a Boeing 737 MAX chute for those pilot impossible situations MCAS has a propensity to thrust crews into at this time. It will probably be cheaper for Boeing than the present course they are taking.
It seems to me that Boeing have painted themselves into a bit of a corner (and it’s easy to say this in hindsight, of course) by deciding years ago to soldier on with the 737 rather than a new narrow body airliner designed for high bypass turbofans. Let’s face it: the 737 was designed for long skinny low bypass engines, and to be a fairly small airliner: indeed its original appearance got it the nickname “The Guppy” because it kind of looks short and fat.
The 737 MAX 10 on the other hand is basically an ersatz Boeing 757. It’s trying to be a 757 and not doing it very well. It needs not just MCAS, but weird monkey motion in the landing gear so the wheels will still fit the original 1960s design (which itself was a development of a 1950s design, the fuselage of the newest B737 now traces its roots to a design that’s over 60 years old). The MAX 10 seems like a complete bodge job to make it fit the old 1960s type certificate.
I can sympathise with Boeing: when Airbus started with their narrow body short haul airliner, high bypass turbofans were already in vogue and so the A320 series was designed to fit a much larger diameter engine from the get go, whereas the poor old 737 needed that weird engine cowling and intake shape so that even a CFM56 wouldn’t scrape on the ground. But at some point Boeing need to bite the bullet: the 737 really can’t take too much more modification, and with the MAX, the pigeons have already come home to roost.
+1
Install Garmin Autoland. Push one button and the plane will be safe.
Faulty data from angle of attack SENSORS? Should be changed to Sensor (1). System should have dual sensors and Computers to get secondary shake then push. This redundancy should have been a mandatory requirement from the get go… In the course of my 45 years of maintenance of aircraft it was always assumed this type of design was like breathing, automatically accepted……
I am amazed of all manufactures, Boeing would’ve let this tried and true design of stall barrier prevention systems slip through it’s engineering staff that probably are to young to know or cared of the beginnings of these systems (ie Trident and BAC1-11 Flight testing disasters, all flown by WWII seasoned pilots.
The recent FAA administrators comments that we need a more Zen (Holistic Approach) defines the current state of affairs and mind set that is taking place in our current Apple, Droid worlds out there… Sadly….
It seems the one thing everyone can agree on is that the 737 MAX is aptly named – it’s the maximum extent that the 737 can be modified before a whole new clean-sheet design is needed.
I think it also proves that Boeing’s cultural change to pleasing the shareholders over the engineers was a faulty move. Given that it’s basically Boeing and Airbus as the two main players, both are essentially “too big to fail” and so Boeing will almost certainly survive, but I am disappointed in them. I just hope Boeing upper-management is smart enough to recognize needing a cultural shift.
Whatever happened to “triple-redundancy” of computer systems in aircraft? Only one angle of attack sensor is totally unsafe, IMHO, and if there are two and one fails you are still living in uncertainty. Considering the cost of the first two accidents Boeing can likely afford to install 3 angle of attack sensors in all future aircraft..
Redundancy is not a valid design objective. RELIABILITY is. The more identical sensors you include in a design, the more software you need – to determine whether any or all of those sensors are heralding good/bad news or just good/bad data.
This discussion has switched tracks, so to speak. We’ve confronted an elephant in the conceptual design review:
Is the very CONCEPT of this additional LAYER of automation valid?
Old “Yars-ism:”
“Even the best implementation of a flawed concept is, itself, conceptually flawed.” In other words, you can’t “fix” anything that relies upon a flawed concept.
Complicating matters is this:
Boeing RELIED upon human pilots, to identify and mitigate problems arising from the INTENDED behavior of the MCAS system. Old School. But these days, Joe Everyman expects (demands?) that aircraft automation will protect the vehicle (and its occupants) from pilot insufficiencies, small and great. New School.
Well, the Boeing 737 is by no means “New School.” Nor do current Rules require it to be. And so, we confront… less-than-stellar design engineering like MCAS. Which, when you think about it, is just another Stick Pusher. So… is the MCAS a bad concept? Or just a bad implementation of a valid concept?
All of these efforts to FIX the MCAS PRESUME the latter. Keep that in mind, gentle pilots.
Marko scares the hell out of me.
“Marko told his peers the fixes proposed by Boeing have exposed other unspecified flaws and he can’t support the process moving forward …
“This leaves me with a level of uneasiness that I cannot sit idly by and watch it pass by.”
“Boeing has been saying it expects recertification of the airplane with MCAS by the end of the year and a return to service shortly afterward but Marko suggests that will cause him and his colleagues anxiety. “
“MCAS introduced nasty behaviors that have to be suppressed which are not on the (older model 737) NG,” he wrote. “Are we all smart enough to think that we have wrapped a net around anything that can go wrong from hereon in?”
If it’s a MAX Boeing I ain’t goin’!
The problem, as always, is who’s maintaining it and who’s flying it.
Ask Asiana pilots: Sum Ting Wong and Wee Tu Lo
Words of a scholar… Great to see you are still in the game. From an old student in Detroit.