The aim of the certification process is to ensure the safety (and reliability) of aircraft. The required mindset shall be that the certification process helps to highlight defects in order to build a better aircraft. Here, the mindset was that the certification process is a burden with arbitrary constraints that have to be fulfilled even if this means a worse aircraft.

IMHO, the people (managers) with the wrong mindset shall be replaced and the faulty airframe of 737 shall be killed.

There are other height issues with ground support equipment for luggage, fuel, passengers, maid service, sewage, etc.

Your #2 is flawed. Shifting the center of gravity forward would cause the plane to nose down relative to the older model. The problem is that the engines are more powerful, mounted higher and further forward shifting the point of thrust to a location where the plane would rotate further (nose 'up'), that is why MCAS attempts to push the nose down by trimming the tail plane if it senses the plane to be in a too high angle of attack.

No, the MCAS system is not in any way responsible for feedback to the control stick. It engages the stabilizer (tail plane) trim motors based on AOA sensor readings, the state of the autopilot and whether the flaps are engaged or not. It has a limit of 2.5 degrees change but this limit is reset every time the system is reset in effect allowing it to fully deflect the tailplane until the limit stops kick in.

At this point, it seems clear that MCAS had something to do with the crashes, but it's far too early to point to the root cause.

The sensor on the Lion Air flight was 20 degrees off. While it wouldn't have "prevented the issue", a simple disagree light in the cockpit would have told the pilots that the AOA sensor was "wrong" while they were still on the runway. Simply put, the plane was unfit to fly and had this light been installed on that plane, the flight would have never left the ground and the crash wouldn't have happened.

Boeing charged extra for this light.

Since this has come to light, Boeing have announced that the disagree light will now come as standard on all 737MAX's at no additional cost.

Anyway, thanks for the correction.

The engines are further away from the plane's fulcrum, and this means that they can now cause the plane to tilt up more efficiently.

Sadly, MCAS introduced unintended side-effects and is not as transparent as it was supposed to be, from what looks like.

Therefore, if you remove MCAS, the plane should be easier to predict; but who knows what that implies now that the plane has been sold and flying for a lot of time (financially, legally...).

And the prediction is: the plane would then not pass the "is it safe?" tests which don't exist "just so" but to make sure that the plane can avoid to crash as soon as something small and insignificant happens.

Without the MCAS the input from the pilot would lead to plane failing easier in higher angles of attack. The MCAS was added to avoid that. So MCAS should work and should not have a single point of failure, as long as 737 MAX flies. MAX is indeed less stable in higher angles of attack.

All Boeing claims "they can simply turn it off" are misleading. The plane is actually more dangerous without properly functioning MCAS. But to properly function the sensors have to be redundant and reliable, and the control that activates it too. And the control software which deactivates it should also be smart enough that "activate/deactivate" cycle isn't itself the crash cause, which is what it looks like was what directly caused the last two crashes:

- the sensor used was only one, i.e. was not redundant.

- the control software blindly trusted it.

- the software, apart from blindly trusting the input of the sensor, was not even properly tested in the condition of the faulty sensor, specifically, the impact on the pilots.

- the whole feature of MCAS was intentionally downplayed, and even hidden initially, to hide the fact that the pilots would have to train for the conditions in which MCAS fails (it can happen, as it at the end depends on mechanical and computer devices) -- the pilots have to be trained to "save" the plane without MCAS functioning, even if the plane is less stable. Note: MCAS should properly function as much as possible to minimize the chance for any small error causing big crash, but in the case when MCAS is not functioning the pilot still has the chance to save the plane only if he is trained exactly in the simulator which simulates the plane with no MCAS (when the controls don't behave "normally", which is what MCAS provides when working). That kind of training was not made at all because the selling point of MAX was "it's the same old, no need to pay for pilot's training." (Or maybe, then the pilots would know that the chance to save the plane was so reduced that they would complain more about the overall plane design?)

- the decision to "just let pilot turn it off" was based on the false assumption that the faulty MCAS behavior is "obvious" to the pilots so that they turn it off easily.

All that was not implemented in Boeing 737 MAX.

By the way, the sensor looks like this:

https://aviation.stackexchange.com/questions/2317/how-does-a...

And the need for the redundancy was commonly known also before the crash:

"The AOA values are never averaged. Depending on the AOA computer, logic is used to determine if one of the vanes is giving bad data"

#5 is: a fault in a single, non-redundant sensor could cause the MCAS system to falsely believe the plane was stalling, and push the nose down as hard as it could. Which (see above) was harder than a pilot could override by just pulling in the other direction, as is apparently intuitive for them.

Generally a sensor with such a critical failure mode would be triple-redundant - if one fails, the discrepancy between sensors is flagged and the aircraft runs on the other two until the broken one is fixed. In this case, the aircraft had two sensors of the type (Angle-of-Attack), but MCAS was only listening to one of them.

I've seen pictures of it ( https://aviation.stackexchange.com/questions/2317/how-does-a... ) and seems to be a simple mechanical component.

Why isn't this compounded with something that works by estimating the AoA from other factors? A few simple gravity based sensors would be able to tell the vector of the plane, and simply assuming that wind (airflow) is parallel to the ground would go a long way. Or is the vertical component of the local airflow so variable?

Cost, probably. The 777 and 787 still only use two alpha vanes, but they calculate a synthetic angle-of-attack value as well.

Sure, this would probably worth next to nothing in turbulence, but in a simple take off and landing (where MCAS is already active and depends on AoA) it might help.

And of course I might be completely ignorant of most of the relevant problems with using any kind of gyroscopic or acceleration based sensor.

An edit as response to the followup mentioning Einstein, due to HN throttle:

Yes, yes... and it doesn't matter for this purpose, because you can measure gravity at multiple points within the aircraft and because gravity falls off with distance.

https://en.wikipedia.org/wiki/Inverse-square_law#Gravitation

We have built equipment sensitive enough to measure this difference and we have flown it in satellites.

https://www.physicsoftheuniverse.com/topics_relativity_gravi...

Also, it does seem like Boeing dropped the ball here to not build further redundancy here.

This sounds like spectacularly bad design that manages to extract negative value from having two sensors. What is the logic behind this?

There is no good reason for only listening to one sensor.

There is a sort of good reason for having a split between pilot/copilot side: the instruments are redundant (both physically and electrically), so in the event of malfunction you can failover to the other side.

It just seems to be that this is some terrible engineering done on Boeing's end of not fully understanding the critical situation here.

Generally two failures: 1. a lack of redundancy in a mission critical sensor 2. a blind trust on MCAS's priority over pilots

There is redundancy in the sensors, but the sensors are not being used in a redundant manner. There are whispers that the 767 fuel tanker (KC-46/KC-767) has a system similar to MCAS that will look at both alpha vanes for disagreement, which is a bit damning to say the least.

a blind trust on MCAS's priority over pilots

The entire purpose of MCAS is to engage only when the pilot is flying to prevent the pilot from doing something dangerous. Previous generations of 737 had the same problem but the MAX is more delicate and compounds it with nacelles that generate lift.

Plus the bug with the resets on the limiter.

Half the industry uses three or four AoA sensors with majority voting.

The other half ( Boeing ) uses two.

Instead, the sensors should detect failure, for example by using a motor to detect if the vane is stuck and cannot turn freely.

The flight controls should also be able to fly even if all sensors of a certain type have failled. Angle of attack for example can be approximated with an accelerometer and gyro well enough to keep the plane in the air.

I'm prepared to be wrong but that sounds impossible to me. A steady-state descending stall is inertially indistinguishable from cruise.

The point is, there are lots of data sources, and with even a subset of them, it's possible to fly the plane to a safe landing.

Failure isn't really the problem - it's silent failure which is deadly.

Imagine you're on final into a busy airport and you have to abort your descent because $reasons. If you slam the throttles forward, the thrust is all below the aerodynamic centre of the aircraft, so you have a net nose-up pitching moment created. In other words, when you slam the throttles forward the aircraft tends to nose up. A 737 pilot told me recently that in a take-off/go-around situation you actually need to push the yoke forward to restrain the aircraft's nose-up tendency until you can re-trim for climb.

MCAS was introduced because the new engines on the MAX, essentially, make the airframe more dangerous at high Angle of Attack than the previous generations of the 737, and so MCAS was intended to automagically keep pilots from entering the dangerous regime.

MCAS was required in order to keep to the "zero training delta" commitment. The solution might be removing MCAS, but that will/would require more pilot training which would essentially render the MAX a completely new aircraft as far as regulation is concerned.

Just like 95% of airliners. In fact the Max engine thrust line is higher and closer to the datum than most.

The Max's problem is not thrust line, it is additional lift generated by the forward-mounted engine nacelles at high AoA which reduces stick-load and makes pitch-up to a stall likely. Nothing to do with thrust.

Pitching up on thrust was a problem with the 737 Classic, why wouldn't it be a problem on the MAX?

Correct.

>The Max's problem is not thrust line, it is additional lift generated by the forward-mounted engine nacelles at high AoA which reduces stick-load and makes pitch-up to a stall likely. Nothing to do with thrust.

Nothing you've written here contradicts what I wrote previously, so I'm not sure if you're just aggressively agreeing with me, but I'll assume that this is the case. Yes, the aircraft is dangerous at high AoA, as I wrote in my previous comment.

https://en.wikipedia.org/wiki/Stabilizer_(aeronautics)#/medi...

So the issue is that MCAS was controlling the big control surfaces, the pilots' attempts to correct with yoke input operated on the small control surfaces? The former overpowered the latter.

Interesting that MCAS wasn't like cruise control where any significant input deactivates the automated controls. But then again, I know next to nothing about how big airliner control systems work.

It would disengage... but then would immediately re-engage if the bad sensor readings were still there. And would, in the meanwhile, have reset its control limiter so it would push even harder than the first time.

That "omission" was intentional as the Boeing selling point was "it is the same old, no new pilot training needed." That's how they have "sold" the worth of 600 billion dollars of the MAX planes!

The probable strategy for Boeing was "we will blame the pilots" and had the two crashes not happened so fast one after another they would have probably got away with it!

Those involved in the testing hadn’t fully understood just how powerful the system was until they flew the plane on a 737 Max simulator, according to the two people.

1: https://www.nytimes.com/2019/03/25/business/boeing-simulatio...

It's like if you are driving and the road starts to curve. If you do nothing, yes you will get to a point where a crash is unavoidable. But you know that when your car is not following the road, you turn the steering wheel. Pilots know that when they have to pull the yoke to keep the plane level, they need to trim.

MCAS has control authority when the autopilot is _off_.

The 777 and 787 are full-time FBW, there is no manual reversion. There is no way to move the control surfaces directly. The only difference with the AP engaged is the origin of the control demands.

There is big big difference between FBW and the aircraft generating control inputs on it's own. Boeing aircraft had two modes, 'manual' and 'auto pilot' The 737 MAX adds a third case, 'sometimes'

Boeing never told the pilots about the 'sometimes' part. And never told them that 'sometimes' has ultimately more control authority than they do.

The Max does indeed have a hybrid approach ( manual actuation, FBW spoilers, mystery MCAS ) but that's not Boeing's current philosophy.

1. earlier 737 models didn't pitch up and Boeing wanted the plane to "feel" the same and not have to re-train the pilots

2. there is some certification requirement that the pitch has to be constant during climb (or something like this); if the plane doesn't have this, it is not certified to fly. It wouldn't pass FAA certification without MCAS.

I'm really suspicious, in a variety of ways, of cutoff switches effectively decertifying a plane in flight. And then how it's OK for pilots to not at least be made aware of that potential situation in advance?

An airplane suddenly rendered not airworthy, and pilot suddenly rendered without a proper type rating. It's absurd. I don't know how a software update gets them out of this predicament, if it's true.

Airbus fly-by-wire aircraft have numerous layers of safeguards (laws) in place. Each can be removed or degraded depending on the circumstances. But pilots are expected to know all of them, and know the consequences of each safeguard being removed, including the ensuing natural flight behavior of the airplane.

Anyway the story still isn't fully out yet.

So what I gather is the issue was that the MAX didn't fit this requirement for steady pitch (hence the airframe problem referenced in the linked article), and MCAS was supposed to be the band-aid to fix this essentially by automatically pushing forward on the yoke during high angle of attack.

If that's the case then the following is especially concerning:

> Boeing offered the single angle-of-attack sensor as standard equipment, and charged extra for a second along with a “disagree” indicator that would allow 737 MAX pilots to “cross-check” a faulty sensor.

Seems pretty sketchy to ask airlines to cough up extra dough for redundancy on a safety critical system. Who knows what other systems are subject to the same cost/benefit tradeoffs.

Yeah, that's factually incorrect. All 737 NG/MAX planes have two alpha vanes to detect the angle-of-attack. MCAS only ever uses one at a time.

Edit: You can see them both plainly in pictures:

https://www.planespotters.net/photo/806268/pk-lqg-lion-air-b...

https://www.jetphotos.com/photo/8686917

That design decision meant the 737 MAX would tend to pitch up while accelerating.

So the MCAS was there to counter that behaviour by automatically pushing the nose down when it detected this nose up situation.

My personal approach to Software QA is generally more in line with the role fulfilled by a Systems Engineer, so I'm intensely uncomfortable having read Quality may be culturally interpreted in such a perverse manner.

Funny thing about Quality is you find exactly what you look for. Start out making a system that only suffers traceable disasters, and you get a different product than one which focuses on not suffering disasters in the first place.

The gear is retracted inboard, so lengthening was a non starter given the rapidly escalating hardware changes that would be required to the gear bays.

Once you start changing the fundamental structure of the air raft, you also start weakening your case for a common type certificate as well.