The Maneuvering Characteristics Augmentation System (MCAS) is a flight stabilizing feature developed by Boeing that became notorious for its role in two fatal accidents of the 737 MAX in 2018 and 2019, which killed all 346 passengers and crew among both flights.
Because the CFM International LEAP engine used on the 737 MAX was larger and mounted further forward from the wing and higher off the ground than on previous generations of the 737, Boeing discovered that the aircraft had a tendency to push the nose up when operating in a specific portion of the flight envelope (flaps up, high angle of attack, manual flight). MCAS was intended to mimic the flight behavior of the previous Boeing 737 Next Generation. The company indicated that this change eliminated the need for pilots to have simulator training on the new aircraft.
After the fatal crash of Lion Air Flight 610 in 2018, Boeing and the Federal Aviation Administration (FAA) referred pilots to a revised trim runaway checklist that must be performed in case of a malfunction. Boeing then received many requests for more information and revealed the existence of MCAS in another message, and that it could intervene without pilot input. According to Boeing, MCAS was implemented to compensate for an excessive angle of attack by adjusting the elevators on the horizontal stabilizer before the aircraft would potentially stall. Boeing denied that MCAS was an anti-stall system, and stressed that it was intended to improve the handling of the aircraft while operating in a specific portion of the flight envelope. Following the fatal crash of Ethiopian Airlines Flight 302 in 2019, the Civil Aviation Administration of China ordered the grounding of all 737 MAX planes in China, which led to more groundings across the globe.
Boeing admitted MCAS played a role in both accidents, when it acted on false data from a single angle of attack (AoA) sensor. In 2020, the FAA, Transport Canada, and European Union Aviation Safety Agency (EASA) evaluated flight test results with MCAS disabled, and suggested that the MAX might not have needed MCAS to conform to certification standards. Later that year, an FAA Airworthiness Directive approved design changes for each MAX aircraft, which would prevent MCAS activation unless both AoA sensors register similar readings, eliminate MCAS's ability to repeatedly activate, and allow pilots to override the system if necessary. The FAA began requiring all MAX pilots to undergo MCAS-related training in flight simulators by 2021.
Background In the 1960s, a device known as the stick shaker was installed on the control columns of Boeing 707 aircraft to alert the pilots that the angle of attack was too high and stalling was an imminent risk.
Later, a similar system to avoid stalling, in this case specifically called the Maneuvering Characteristics Augmentation System (MCAS), was implemented on the Boeing KC-46 Pegasus military aerial refueling tanker. The KC-46, which is based on the Boeing 767, requires MCAS because the weight and balance shifts when the tanker redistributes and offloads fuel. On that aircraft, the MCAS is overridden and disengaged when a pilot makes a stick input.
Another MCAS implementation was developed for the Boeing 737 MAX, because its larger, repositioned engines changed the aircraft's flight characteristics compared to the preceding 737 generations. When a single angle of attack (AoA) sensor indicated that the angle was too high, MCAS would trim the horizontal stabilizer in the nose-down direction. Boeing did this to meet the company's objective of minimizing training requirements for pilots already qualified on the 737NG, which Boeing felt would make the new variant more appealing to aircraft customers that would prefer not to bear the costs of differences training. However, according to interviews with agency directors describing assessments undertaken after the MCAS-induced crashes had occurred, both the FAA and EASA felt that the aircraft would have had acceptable stability without MCAS.
Role of MCAS in accidents
On Lion Air Flight 610 and Ethiopian Airlines Flight 302, investigators determined that MCAS was triggered by falsely high AoA inputs, as if the plane had pitched up excessively. On both flights, shortly after takeoff, MCAS repeatedly actuated the horizontal stabilizer trim motor to push down the airplane nose. Satellite data for the flights showed that the planes struggled to gain altitude. Pilots reported difficulty controlling the airplane and asked to return to the airport. The implementation of MCAS has been found to disrupt autopilot operations.
On March 11, 2019, after China had grounded the aircraft, Boeing published some details of new system requirements for the MCAS software and for the cockpit displays, which it began implementing in the wake of the prior accident five months earlier: If the two AoA sensors disagree with the flaps retracted, MCAS will not activate and an indicator will alert the pilots. If MCAS is activated in non-normal conditions, it will only "provide one input for each elevated AoA event." Flight crew will be able to counteract MCAS by pulling back on the column.
On March 27, Daniel Elwell, the acting administrator of the FAA, testified before the Senate Committee on Commerce, Science, and Transportation, saying that on January 21, "Boeing submitted a proposed MCAS software enhancement to the FAA for certification. ... the FAA has tested this enhancement to the 737 MAX flight control system in both the simulator and the aircraft. The testing, which was conducted by FAA flight test engineers and flight test pilots, included aerodynamic stall situations and recovery procedures." After a series of delays, the updated MCAS software was released to the FAA in May 2019. On May 16, Boeing announced that the completed software update was awaiting approval from the FAA. The flight software underwent 360 hours of testing on 207 flights. Boeing also updated existing crew procedures.
On April 4, 2019, Boeing publicly acknowledged that MCAS played a role in both accidents.
Purpose of MCAS and the stabilizer trim system
The FAA and Boeing both disputed media reports describing MCAS as an anti-stall system, which Boeing asserted it is distinctly not and instead a system that's designed to provide handling qualities for the pilot that meet pilot preferences. The aircraft had to perform well in a low-speed stall test. The (JATR) "considers that the /MCAS and elevator feel shift (EFS) functions could be considered as stall identification systems or stall protection systems, depending on the natural (unaugmented) stall characteristics of the aircraft".
The JATR said, "MCAS used the stabilizer to change the column force feel, not trim the aircraft. This is a case of using the control surface in a new way that the regulations never accounted for and should have required an issue paper for further analysis by the FAA. If the FAA technical staff had been fully aware of the details of the MCAS function, the JATR team believes the agency likely would have required an issue paper for using the stabilizer in a way that it had not previously been used; this [might have] identified the potential for the stabilizer to overpower the elevator."
Description
Background
The Maneuvering Characteristics Augmentation System (MCAS) is a flight control law built into the Boeing 737 MAX's flight control computer, designed to help the aircraft emulate the handling characteristics of the earlier Boeing 737 Next Generation. According to an international Civil Aviation Authorities team review (JATR) commissioned by the FAA, MCAS may be a stall identification or protection system, depending on the natural (unaugmented) stall characteristics of the aircraft. Boeing considered MCAS part of the flight control system, and elected to not describe it in the flight manual or in training materials, based on the fundamental design philosophy of retaining commonality with the 737NG. Minimizing the functional differences between the Boeing 737 MAX and Next Generation aircraft variants allowed both variants to share the same type rating. Thus, airlines can save money by employing and training one pool of pilots to fly both variants of the Boeing 737 interchangeably.
When activated, MCAS directly engages the horizontal stabilizer, which is distinct from an anti-stall device such as a stick pusher, which physically moves the pilot's control column forward and engages the airplane's elevators when the airplane is approaching a stall.
Boeing's then CEO Dennis Muilenburg said has been reported or described as an anti-stall system, which it is not. It's a system that's designed to provide handling qualities for the pilot that meet pilot preferences."
The 737 MAX's larger CFM LEAP-1B engines are fitted farther forward and higher up than in previous models. The aerodynamic effect of its nacelles contributes to the aircraft's tendency to pitch up at high angles of attack (AOA). The MCAS is intended to compensate in such cases, modeling the pitching behavior of previous models, and meet a certain certification requirement, in order to enhance handling characteristics and thus minimizing the need for significant pilot retraining.
The software code for the MCAS function and the computer for executing the software are built to Boeing's specifications by Collins Aerospace, formerly Rockwell Collins.
As an automated corrective measure, the MCAS was given full authority to bring the aircraft nose down, and could not be overridden by pilot resistance against the control wheel as on previous versions of the 737. Following the Lion Air accident, Boeing issued an Operations Manual Bulletin (OMB) on November 6, 2018, to outline the many indications and effects resulting from erroneous AOA data and provided instructions to turn off the motorized trim system for the remainder of the flight, and trim manually instead. Until Boeing supplemented the manuals and training, pilots were unaware of the existence of MCAS due to its omission from the crew manual and no coverage in training. Boeing first publicly named and revealed the existence of MCAS on the 737 MAX in a message to airline operators and other aviation interests on November 10, 2018, twelve days after the Lion Air crash.
Safety engineering and human factors As with any other equipment on board an aircraft, the FAA approves a functional "development assurance level" corresponding to the consequences of a failure, using the SAE International standards ARP4754 and ARP4761. MCAS was designated a "hazardous failure" system. This classification corresponds to failures causing "a large reduction in safety margins" or "serious or fatal injury to a relatively small number of the occupants", but nothing "catastrophic".
The MCAS was designed with the assumption, approved by the FAA, that pilots would react to an unexpected activation within three seconds.
Technology readiness
The MCAS design parameters originally envisioned automated corrective actions to be taken in cases of high AoA and g-forces beyond normal flight conditions. Test pilots routinely push aircraft to such extremes, as the FAA requires airplanes to perform as expected. Before the MCAS, test pilot Ray Craig determined the plane did not fly smoothly, in part due to the larger engines. Craig would have preferred an aerodynamic solution, but Boeing decided to implement a control law in software.
According to a news report in the Wall Street Journal, engineers who had worked on the KC-46A Pegasus tanker, which includes an MCAS function, suggested MCAS to the design team.