Fullscreen HTML5Med Res (??MB)HTML4

The Boeing 737 MAX & MCAS A predictable disaster by Brandon Speedie Image source: Aka the Beav, www.flickr.com/photos/87117889<at>N04/23514088802 (CC-BY-2.0) Boeing’s MAX version of their venerable 737 aircraft has had its share of problems, from two deadly crashes in 2018 and 2019 to the latest drama with the door plug falling off in flight. This article explains how the failure of a single electronic part led to two fatal crashes. A merican aircraft manufacturer Boeing launched the 737 MAX in 2017 to much fanfare. It is the first narrow-body aircraft to be made predominantly of composite materials, which are lighter than the magnesium and aluminium alloys of its predecessor: the 737 NG (Next Generation). The MAX also features new high-­ bypass turbofan engines from CFM International, as well as reprofiled winglets to reduce drag. All of these improvements aim to increase fuel efficiency, one of the main operating expenses of a passenger flight. Unfortunately, the high bypass turbofan engines are also bulky; bulk that wasn’t compensated for with the rest of the aircraft design. Under load, the aircraft was inherently unstable and ultimately unsafe. Lion Air Flight 610 On 29th October 2018, a recently built 737 MAX took off from Jakarta. Shortly after taking to the air, its pilots were bombarded with warnings on the flight deck, and the aircraft began siliconchip.com.au to pitch downward into a dive. The pilots wrestled with the controls to try to maintain altitude, which would briefly arrest their descent, only for the nose of the aircraft to pitch down again moments later. This wrestle between the pilots and the aircraft continued for 13 minutes after take-off, before the plane crashed into the water off the coast of Jakarta, killing all 189 passengers and crew. Upon recovering the ‘black box’ flight recorder, investigators found an automated system was overriding pilot input, despite the autopilot being disengaged. Ethiopian Airlines Flight 302 On the 10th of March 2019, another recently-­ b uilt 737 MAX departed Addis Ababa in on route to Nairobi. Similarly to the Lion Air crash, the pilots were immediately bombarded with warnings after takeoff. The nose of the aircraft again pitched down, despite the pilots straining to pull back the control yoke. The aircraft crashed into a field six minutes after take-off, Australia's electronics magazine killing all 157 passengers and crew. The black box showed an almost identical scenario to the Lion Air flight: repeated nose up commands from the pilots, which would then be overruled by an automated system that placed the aircraft into a dive. The Airbus A320neo To understand how this automated system was permitted to overrule human input, we need to look across the Atlantic to Boeing’s main competitor, the European Union’s Airbus. Eight years prior, Airbus announced a new aircraft that would be in direct competition with Boeing’s 737. This new variant is called the neo (New Engine Option) which was groundbreaking for its ability to accept two different engines: the CFM LEAP 1-A or the Pratt and Whitney GTF. Airlines loved the choice, as it gave them the flexibility to select the highest fuel efficiency engine for a given configuration. The A320neo sold faster than any aircraft ever before. Boeing knew their August 2025  67 Fig.1: typical drive (red) and receive (cyan & green) waveforms for a resolver. Original Source: AD2S1210 data sheet Fig.2: the configuration of a resolver. A sinusoidal excitation applied between R1 and R2 inductively couples a current into the rotor. The resulting magnetic field induces voltages in orthogonal receive coils S1-S3 & S2-S4, which will vary in response to the rotor position. Original Source: Analog Devices – siliconchip.au/link/abwg existing 737 NG could only be fitted with the older CFM56, which was much hungrier on fuel. They didn’t have a product that could compete. Enter the 737 MAX Boeing executives scrambled to come up with a solution. Many engineers considered the 737 to be in need of a replacement; its original design was over 40 years old. There were existing plans to replace the 737 with a brand new plane. However, Boeing couldn’t afford the lengthy time to market for a new design, so they instead decided to update the 737 NG so that it could accept a new high efficiency engine from CFM International. The CFM LEAP 1-B is a high-bypass turbofan, meaning that most of the air that flows through the engine bypasses the turbine and is ejected without being used in combustion. This configuration is highly efficient, but requires a significantly larger diameter than the CFM56 that was used by the 737 NG. To fit the larger engine to the 737, Boeing engineered a compromise. Ideally, the engines should be mounted centrally to give the most stable flight characteristics. But even with longer landing gear, the new LEAP was too large to fit under the wings. Boeing had to mount the new engine higher and further forward than was optimal. This caused the aircraft to tend to nose-up under thrust, giving the 737 MAX significantly differing flight characteristics to its predecessor. This was enough of a departure from the previous design that 737 pilots would need training in the new handling characteristics. Boeing knew that airlines would prefer to avoid additional flight training. Removing pilots from the air to spend days in a simulator is costly and disruptive. To avoid this requirement, they instead decide to write some software to compensate. Unfortunately, this code was reliant on a single point of failure: the AoA sensor. Angle of attack (AoA) sensor Protruding externally from the side of the aircraft’s nose is a small fin (see Photos 1 & 2). This winglet rotates with the direction of airflow during Photo 2: an angle of attack sensor on the 737 MAX (below the antennas near the nose). Like most other jets, the 737 MAX has a second sensor on the other side of the nose for redundancy. Source: Business Insider – siliconchip.au/ link/abwh Photo 1: An angle of attack sensor showing a winglet that aligns with the airflow direction. Source: https:// bluemarble.ch/wordpress/tag/aoavane/ 68 Silicon Chip flight, thereby giving an indication of the relative angle of the wing with respect to oncoming air. This is known as the wing’s angle of attack (AoA), an important indication for the pilot to ensure they don’t exceed the aircraft’s performance envelope. When flying level at cruise altitude, the plane should have a shallow angle of attack, meaning low lift and low drag from the wings. At take-off, the wings will have a higher angle of attack as the aircraft pitches into a climb, providing more lift but with greater drag. Should the pilot attempt to climb too aggressively, the angle of attack could exceed a critical threshold, at which point the wing will begin to experience flow separation. The resulting turbulence results in a sudden loss of lift, a dangerous situation known as a stall. Given the angle of attack sensor is located in a vulnerable position on the side of the aircraft’s nose, it is commonly damaged by bird strikes or debris. It is also vulnerable to freezing up in icy conditions (there is a heater to prevent that but it can fail or be Australia's electronics magazine siliconchip.com.au overwhelmed). Therefore, many passenger planes have an AoA sensor on each side of the nose to provide redundancy in case of damage or a fault in one of them. The resolver The AoA winglet is attached to an angular position sensor known as a resolver. This sensor is similar to a rotary encoder, except it is analog, in contrast to the digital quadrature output of the encoder. Resolvers are favoured in high-reliability applications due to their rugged build quality. Its theory of operation compares to an induction motor – see Fig.2. An excitation signal is applied to the signal coil, typically in the order of 10kHz and 10V. This excitation induces a current in the rotor, which in turn induces a signal in the two receive coils. These receive coils are perpendicular, so they are 90° out of phase of each other, as shown in Fig.1. Given a sinusoidal excitation, the received signals will be complimentary sine and cosine pairs. If the rotor’s angular position changes, the coupling between the excitation signal and the two received signals will change, ie, their mutual inductance varies. This property can be used to sense the angular position of the rotor, using the scheme shown in Fig.3. Effectively, this is a phased-locked loop (PLL) that includes the resolver itself, facilitating an angular accuracy better than 0.01°. The Boeing 737 MAX that was involved in the Lion Air flight 610 crash. Source: PK-REN – www.flickr.com/photos/pkaren/45953419622/ (CC-BY-SA-2.0) An Airbus A320neo aircraft. Source: BriYYZ – www.flickr.com/photos/ bribri/28915135713/ (CC-BY-SA-2.0) Circuit Analysis Fig.4 shows an example resolver sense circuit based on the Analog Devices AD2S1210 “resolver to digital converter”. An advantage of this circuit is it combines both the excitation and sensing circuitry into a single IC. This allows the sensed signals to be used as feedback to adjust the phase of the excitation signal and therefore null out any angular position errors. The excitation signal is derived from the nominal 8.192MHz crystal clock, which is internally divided down to a range between 2kHz and 20kHz, as set by an internal configuration register. The synthesised waveform is sent to the digital-to-analog converter (DAC), which drives complementary outputs EXC and EXC at around 3.6V peak-topeak, giving a total voltage swing of 7.2V peak-to-peak. Fig.3: a block diagram of a resolver sense circuit. A DAC synthesises a sinusoidal waveform from the reference oscillator, which excites the drive coil, ultimately inducing a flux in the rotor. A “type II tracking loop” is used to cancel errors in the sensed angular position, which allows the AD2S1210 IC to achieve excellent accuracy. Original Source: Analog Devices – siliconchip.au/link/abwg siliconchip.com.au Australia's electronics magazine August 2025  69 Fig.4: a simplified circuit diagram of the AD2S1210-based resolver sense circuit. The reference oscillator is derived from the 8.192MHz crystal. The EXC outputs have weak drive strength and need to be amplified by op amps and complementary emitterfollower transistors pairs to match the low input impedance of the resolver sense circuit. Original Source: AD2S1210 data sheet The output DAC has weak drive strength (100μA), which is a poor match for the low input impedance of the resolver excitation coil, typically around 100W. Two external pushpull current amplifiers are needed. These amplify the complimentary EXC outputs to drive most resolvers with ease. The EXC voltage is applied to the inverting input of the op amp via a 10kW input resistor. The non-inverting input is supplied with +3.75V, derived from a 22kW || 10kW voltage divider tapping off the 12V rail. This provides a DC offset to avoid the need for a separate negative supply rail. The output of the opamp drives a push-pull output made up of complementary BC846B and BC856B pairs. Biasing for this pair is provided by the 2.2kW and 3.3W resistors, in combination with diodes D1 and D2. The voltage gain is set by the ratio of the 10kW input resistor and 15.4kW feedback resistor. A 120pF parallel capacitor provides some high-frequency filtering to improve stability. Additional filtering is provided by the supply bypassing capacitors, parallel 4.7μF and 10nF types. The 5V supply and ground are separated for the digital, analog and reference supplies, further improving noise immunity. The two sense coils are connected to the SIN, SINLO, COS, and COSLO inputs on the AD2S1210 via input protection circuitry. Series resistance and zener diodes provide circuit protection, while the anti-aliasing capacitors low-pass filter the sensed voltage to make it suitable for driving the downstream receive circuit. Optional voltage dividers formed using added resistors Ra and/or Rb can be used to attenuate the voltage if its amplitude is too great to suit the differential ADC on the AD2S1210. As the resolver output is analog, its angular resolution is only limited by the resolution of this ADC. In the AD2S1210, up to 16 bits are provided, which gives an impressive 0.005° resolution. Once digitised, the sine and cosine inputs are compared to the excitation signal using a so-called Type II tracking loop. This feedback loop constantly adjusts the excitation phase to minimise the angular position error. The calculated position is made available Australia's electronics magazine siliconchip.com.au 70 Silicon Chip to the flight computer over a digital interface, which can be a 4-wire serial or 16-bit parallel interface. For more on how this circuit works, see siliconchip.au/link/abwf On the 737 MAX, the flight computer erroneously received the wrong angle of attack from the resolver, ultimately causing two plane crashes (another was narrowly avoided by an alert copilot). Air Crash Investigation In the aftermath of the Lion Air crash, investigators discovered an irregularity with the resolver attached to the left side AoA sensor. In the weeks prior, the angular position readings had shown intermittent errors. Detailed analysis revealed a crack in the resolver, which presented as an open circuit when the aircraft was out of service and the resolver cooled below 60°C. This wasn’t detected by maintenance staff while the aircraft was in service due to the action of the AoA heater, which caused the resolver to expand and close the circuit, restoring normal operation. The Ethiopian airlines investigation revealed a similar problem with the left side AoA sensor, likely caused by a bird strike 44 seconds after lift-off. Wind tunnel tests revealed an impact with a bird weighing 226 grams at 170 knots was enough to snap off the AoA winglet, and leave the resolver misoriented. In both crashes, bad readings from the left side AoA resolver caused some automated software to activate: the Manoeuvring Characteristics Augmentation System. The MCAS (Manoeuvring Characteristics Augmentation System) Modern passenger airliners are ‘flyby-wire’ systems, meaning that the pilot’s control yoke is not directly connected to the control surfaces on the jet by wires or hydraulics like in older aircraft. Pilot inputs (like pressure on or movement of a control stick or yoke) are read by sensors and fed to the flight computer. Software ingests these readings, along with other sensors on the aircraft such as airspeed, air density, temperature, and so on. It then commands the appropriate movements of the control surfaces to affect the aircraft’s attitude, matching the pilot’s commands. siliconchip.com.au Fig.5: a vertical airspeed comparison of Lion Air flight 610 and Ethiopian Airlines Flight 302. You can see how the pilots were fighting with MCAS to try to gain altitude. Original Source: https://w.wiki/AGgf MCAS is an addition to the normal flight software on the 737 MAX to compensate for the suboptimal positioning of the engines. As mentioned earlier, the compromises to the design forced by reusing the existing airframe created a nose-up tendency under thrust. This could allow pilots to inadvertently approach a stall condition. As that did not happen with previous 737 models, pilots migrating to the MAX from an earlier model would not be expecting it. Boeing reasoned that they could write software to compensate for the resulting tendency to lift the nose under thrust, by programming in opposing control movements. That would make the plane feel similar to operate to its predecessor, avoiding the need to retrain pilots. Australia's electronics magazine This software (MCAS) uses the angle-of-attack sensor to determine if the aircraft is pitching nose up. If the plane is reaching the critical AoA, the flight computer operates the motorised ‘speed trim’, actuating the rear aileron to pitch the nose back down again. The speed trim is an existing system on the 737 that allows pilots to ‘trim’ the aircraft to a neutral attitude, by providing an adjustable offset to the rear aileron to compensate for uneven weight distribution. This avoids the need for them to constantly press on the control stick to stop the aircraft from pitching up or down. Boeing deliberately decided not to mention MCAS in their flight manuals. Pilots were not briefed or trained in its operation, as they wanted to be able to sell the aircraft to airlines as not August 2025  71 needing any pilot retraining. In combination with two other fatal flaws, that turned out to be a big mistake. Grounding Following the Ethiopian Airline crash, many countries around the world moved to ground the 737 MAX. The USA eventually followed, taking the unprecedented step of banning all 737 MAXes from flying until Boeing could confirm their airworthiness with the FAA. The grounding lasted 20 months, during which time Boeing was forced to wind back the influence of the MCAS software and train pilots on its use. New simulator sessions were also conducted to provide pilots familiarity with the differing flight characteristics of the plane. Boeing was ultimately penalised US$20 billion in fines and compensation, and lost an estimated US$67 billion in cancelled orders. Conclusion It is now mandatory for the MCAS system to use two AoA sensors. This brings MCAS in line with other critical flight systems, which must not have a single point of failure. We still can’t quite figure out why MCAS only Undelivered Boeing 737 MAX aircrafts at Boeing Field in Seattle. Source: SounderBruce – https://w.wiki/AGhr (CC-BY-SA-4.0) used the data from one sensor when two were already fitted to the aircraft! It seems like a baffling oversight. Apparently, Boeing believed that MCAS was not ‘safety critical’. Early iterations of the MCAS system could not move the aileron enough to cause a loss of control, but that was changed before the first aircraft were delivered, without revisiting the decision not to use the data from the second AoA sensor. If its existence had initially been disclosed to the pilots, simply having an off switch for the MCAS system while leaving the trim motors under manual control might also have saved SC hundreds of lives. PIC Programming Adaptor Our kit includes everything required to build the Programming Adaptor, including the Raspberry Pi Pico. The parts for the optional USB power supply are not included. Use the Adaptor with an in-circuit programmer such as the Microchip PICkit or Snap to directly program DIP microcontrollers. Supports most newer 8-bit PICs and most 16-bit & 32-bit PICs with 8-40 pins. Tested PICs include: 16F15213/4, 16F15323, 16F18146, 16F18857, 16F18877, 16(L)F1455, 16F1459, 16F1709, dsPIC33FJ256GP802, PIC24FJ256GA702, PIC32MX170F256B and PIC32MX270F256B Learn how to build it from the article in the September 2023 issue of Silicon Chip (siliconchip.au/Article/15943). And see our article in the October 2023 issue about different TFQP adaptors that can be used with the Programmer (siliconchip.au/Article/15977). Complete kit available from $55 + postage siliconchip.com.au/Shop/20/6774 – Catalog SC6774 72 Silicon Chip Australia's electronics magazine siliconchip.com.au