Boeing 737 MAX Return to Service: MCAS and the 2020 Changes

The Boeing 737 MAX was grounded worldwide in March 2019 after two of its aircraft were lost shortly after takeoff: Lion Air flight 610 on 29 October 2018, with 189 people on board, and Ethiopian Airlines flight 302 on 10 March 2019, with 157. Both recorded an erroneous angle of attack (AOA) signal followed by repeated automatic nose-down stabilizer trim, and the investigators identified a new flight control law, the Maneuvering Characteristics Augmentation System (MCAS), as a key contributor.

Its return needed a package that EASA called complete only in its entirety: new flight control computer (FCC) and display software, rewired stabilizer trim circuits, revised checklists in the Airplane Flight Manual (AFM), a stricter master minimum equipment list (MMEL), new pilot training, and a sensor test and readiness flight for every aircraft. The FAA lifted its prohibition in November 2020; EASA set its conditions in Airworthiness Directive 2021-0039 and explained them in its Return to Service Report of 27 January 2021. All of this concerns the MAX, then the 737-8 and 737-9; the 737 NG has no MCAS.

The grounding and the investigations

Lion Air flight 610 crashed into the Java Sea while climbing out of Jakarta. The flight before, the first after an AOA sensor had been replaced, had shown the same failure: the stick shaker started at rotation and stayed on, and whenever the crew stopped trimming manually the aircraft trimmed itself nose-down again. After the third time they set the STAB TRIM switches to CUTOUT and flew on to their destination. The Indonesian investigators (KNKT) found that the replacement sensor had been mis-calibrated during an earlier repair, and that the error had not been detected.

As an interim measure, the FAA's Emergency AD 2018-23-51 of 7 November 2018, adopted by EASA the same day, required crews to use a revised runaway stabilizer procedure in these conditions.

Shortly after Ethiopian flight 302 lifted off from Addis Ababa, the left AOA sensor read 74.5° while the right read 15.3°, and the left stick shaker activated. After the autopilot disengaged, the recorder showed four automatic nose-down trim commands. According to the preliminary report, the crew ran the runaway stabilizer checklist, set the cutout switches to CUTOUT and found that the manual trim wheel was not working. The aircraft crashed about six minutes after takeoff.

China told its operators to stop flying the 737-8 on 11 March 2019. On 12 March EASA's Emergency AD 2019-0051 and a safety directive suspended all 737-8 and 737-9 flights in Europe, including those of third-country operators. On 13 March, once satellite ADS-B data and wreckage showing a configuration that would have armed MCAS had pointed to a link between the two accidents, the FAA issued an Emergency Order of Prohibition. The KNKT's final report, of October 2019, listed 89 findings and nine contributing factors. Both regulators reported while the Ethiopian investigation was still open.

What MCAS does

The MAX's LEAP-1B engines are larger than the NG's CFM56-7B and sit higher and farther forward. Approaching the stall and in high-g maneuvers they would make the control column feel lighter than the certification rules allow. MCAS, a control law in the FCC and part of the speed trim system (STS), restores the required pull force by trimming the stabilizer nose-down. It acts only in manual flight with the flaps up, above an AOA threshold that varies with Mach. It trims at 0.27° per second, the speed trim rate with flaps down, and a command can reach 2.5° at low Mach, where the stabilizer is least effective.

EASA's review found that MCAS plays only a limited role, and its flight tests confirmed that the MAX needs it for full compliance with the stall demonstration and pitch control requirements but remains stable and can be landed safely without it. It could not simply be deleted, though: the FAA would accept its removal only with a comparable replacement.

Either pilot can oppose MCAS with the electric trim switches on the control wheel. Unlike main electric trim, an MCAS command bypasses the aft column cutout switch, so pulling on the column does not stop it. Both STAB TRIM cutout switches at CUTOUT stop and disable it. See B737 pitch control and stabilizer trim.

Single-sensor design and its flaws

The FAA listed seven safety items that Boeing had to resolve:

With a continuous false high AOA, every pilot trim input reset MCAS and the mistrim grew until the elevator alone could not counter it. The FAA judged this the largest contributor to crew workload, and the only flight deck effect that prevented continued safe flight and landing. EASA added that the crews' reactions had not matched Boeing's assumptions, and that crews had not been trained on MCAS adequately. The KNKT found that Boeing had classified an unintended MCAS stabilizer movement in the normal flight envelope as a Major failure condition, not Hazardous or Catastrophic, which allowed a less rigorous analysis.

Revised MCAS and AOA comparison

Under FCC software P12.1.2 the activation thresholds are unchanged, but MCAS activates only when the AOA rises from below the threshold to above it, in manual flight with the flaps up. It makes one activation per high-AOA event, with a total nose-down command of at most 2.5°. Electric trim pauses it; after the switches are released it may continue if the AOA is still rising, but only up to what remains of that single command. It resets only when the AOA has fallen sufficiently below the threshold, and the five-second re-trigger is gone. Once the AOA is low again, MCAS trims nose-up back to the original position, or to the new one the pilot set.

Each FCC now receives both AOA values, one from each air data inertial reference unit (ADIRU):

• Split vane monitor. If the two valid values differ by more than 5.5° for a specified time, MCAS and speed trim are disabled for the rest of the flight. MASTER CAUTION and FLT CONT can be reset, but SPEED TRIM FAIL stays lit. The monitor works only once the flaps are retracted; the 5.5° allows for sensor tolerances and normal side-to-side aerodynamic differences.
• Middle value select. Within that limit the FCC uses the middle value of three, the two current values and its own previous output, which suppresses a small oscillating error.
• Detected failure. If the ADIRU flags a sensor as failed, the FCC uses the remaining one, and SPEED TRIM FAIL appears at the master caution recall in the descent. A second failure would still be limited to a single command.
• Maximum command limit. If the stabilizer moves too far from its position at the first activation, MCAS and speed trim are disabled, so that the column alone always keeps enough pitch control. The reference resets after one minute on the autopilot or five minutes of manual flight below the threshold.

Flight control computer and display changes

A new cross-FCC trim monitor lets each FCC check the other's stabilizer commands, except in dual-channel autopilot operation or a fail-operational autoland or automatic go-around. After a cumulative one second of disagreement the detecting channel takes over speed trim and blocks the other's trim outputs. An autopilot engaged on the failed side disconnects and cannot be re-engaged there, and fail-operational aircraft show NO AUTOLAND. On the ground below 30 kt STAB OUT OF TRIM then lights, so the fault reaches maintenance even if the failed FCC cannot report itself.

Boeing also changed the autopilot at low speed. Outside dual-channel operation, in pitch modes without speed protection except flare, the autopilot disconnects one second after the stick shaker starts and the flight director bars bias out of view; with the flaps down, autopilot nose-up trim stops 3 kt below the amber band speed.

The MAX Display System update made AOA DISAGREE standard. It appears on both primary flight displays when the vanes differ by more than 10° for more than 10 seconds, no longer depends on the optional AOA gauge, and once shown stays below 400 ft radio altitude through landing. It does not say which vane is wrong (angle of attack and stall warning).

The review also found that the stabilizer trim-arm wiring was not separated from the trim-control wiring as 14 CFR 25.1707, the electrical wiring interconnection system (EWIS) rule of 2007, requires. A failure in one wire bundle could have caused an uncommanded runaway, so the wiring was rerouted in 12 areas of the electrical equipment bay and Section 48.

New procedures and training

Eight non-normal checklists were revised or added to the AFM:

• Runaway Stabilizer now covers stabilizer movement that is continuous or wrong for the conditions. Pitch control with the column and speed control with the thrust levers became memory steps, with main electric trim to reduce column forces; both cutout switches go to CUTOUT only if the runaway continues. A note says that reducing airspeed eases manual trimming.
• Stabilizer Trim Inoperative gained the same airspeed note.
• AOA DISAGREE and IAS DISAGREE send the crew to Airspeed Unreliable, as ALT DISAGREE does when IAS DISAGREE also shows. Airspeed Unreliable gained a step to find a reliable airspeed without the pitch and power tables (unreliable airspeed).
• SPEED TRIM FAIL states that the speed trim system is inoperative for the rest of the flight, and STAB OUT OF TRIM lit on the ground forbids takeoff.

View full schematic

After a Joint Operational Evaluation Board of US, Canadian, Brazilian and EU authorities and airline crews, completed at London Gatwick on 22 September 2020, the FAA's Flight Standardization Board (FSB) report, Revision 17 of 16 November 2020, added Appendix 7, the special training every pilot completes before operating the MAX. Ground training, possibly computer-based, covers seven of the revised checklists, MCAS, the autopilot changes, manual trim and unreliable airspeed. In a Level C or D simulator each pilot flies an MCAS activation in an approach to stall, a runaway stabilizer using each Boeing manual trim technique, including two-pilot intervention, and manual trim on approach, go-around and level-off; a cross-FCC trim monitor trip and an erroneous high AOA on takeoff complete it. The two manual trim exercises may be flown in an NG simulator. Stabilizer trim, runaway stabilizer and unreliable airspeed then recur at least every 36 months (B737 NG and MAX differences).

FAA and EASA approvals

The FAA, as State of Design, retained every compliance finding for the change, in a review of more than 22 months and over 60,000 hours. It rescinded the Emergency Order once it had approved the design and issued an airworthiness directive (AD) requiring, on delivered aircraft, the new FCC and display software, the wiring change, a revised AFM, an AOA sensor system test and an operational readiness flight. The MMEL now requires both FCCs for passenger dispatch, and speed trim, the SPEED TRIM FAIL light and the control wheel trim switches can no longer be deferred. US air carrier pilots must complete the FSB special training first. Each State of Registry decides on the return to service of its own aircraft; the FAA asked them to adopt its AD and, as a minimum, the FSB training.

EASA made its own assessment, extended to the whole flight control system and the crew alerting system. Its AD superseded the grounding AD, requires the software, wiring, MMEL and test package, and adds:

• five training areas of special emphasis: stabilizer trim, runaway stabilizer, FCC and MCAS functions, unreliable airspeed, and multiple flight deck alerts in non-normal conditions, all covered by a one-time exercise before return to service (the FSB report gives the same subjects special emphasis);
• an Airspeed Unreliable procedure that allows an erroneous stick shaker to be silenced with its circuit breaker, an option the FAA rejected after its own tests, in which pilots could not pull the breaker with their harness fastened;
• an AFM limitation prohibiting RNP AR operations, and an autopilot minimum use height based on a one-second recognition time instead of 0.5 seconds;
• AFM procedures for handling alerts and running checklists, because the review found weaknesses in the 737's inherited crew alerting system.

Boeing also agreed to develop an AOA Integrity Enhancement, built into the 737-10 and retrofitted to the fleet, and to a human factors evaluation of the crew alerting system within 12 months.

Library articles are written for study and exam preparation. They do not replace your aircraft's approved documentation, your operator's procedures or the regulations themselves.