That's interesting though I suppose unsurprising.

We did a PoC with Infineon, and demoed at CES this last January, something related to the limitations of Fail-Safe mechanisms in autonomous systems and what changes in deisgn & runtime context are essential for moving from Fail-Safe to Fault-Tolerant systems.

In the case of MCAS this probably works out okay because the remediation is to disable and hand control back to the human (something that I'm frankly shocked wasn't already part of the hazard and risk assessment) in loop. Alternative design approaches could probably extend the safe operational envelope for MCAS to tolerate more (or simultaneous) dimensions of failure, but outside of making MCAS a more valuable feature to market (which isn't that useful since it's baseline essential for the aircraft to even be certifiable) it's easy to see the calculation for not going down that redesign road.

> something that I'm frankly shocked wasn't already part of the hazard and risk assessment

That wasn't an option because they didn't want to tell pilots about the existence of the system, to avoid additional training requirements.

Yep. The flight characteristics of the 737 MAX in high angle of attack flight is either significantly different or it isn't, compared to prior 737's. Boeing said it is and created MCAS to mitigate/moderate that difference.

That MCAS can be disabled, means pilots need to know about, trained on, and demonstrate competency, on the ensuing natural (minus MCAS) flight characteristic.

And if the pilots are aware and demonstrate such competency, why even have MCAS? Rip it out.

Wow the report is very interesting ! In the paragraph about the mandatory AOA DISAGREE alert :

> Some 737 MAX airplanes were delivered without this alert feature, by error.

The FAA is useless ...

AFAIK the AOA disagree alert was an optional add-on sold by Boeing!

https://qz.com/1608362/boeing-says-it-didnt-deactivate-stand...

Sure, but without knowledge of MCAS, what would a pilot do with an AOA warning?

They would still most likely get an airspeed disagree warning (standard) because AOA is a parameter in the airspeed calculation. Again, they wouldn't know that was why the stabilizer trim kept moving to nose down, because the MCAS system was not disclosed to pilots.

> disable MCAS for the remainder of the flight.

My understanding is that the MCAS or something equivalent is necessary on the 737 MAX because the engines sit lower than they really should and the forward propulsion creates torque that raises the nose of the plane. Something needs to counteract that force.

If the MCAS is disabled, is the pilot able to trim the airplane manually similar to how MCAS works? Or will they have to just kinda hold the nose down with the main steering controls?

I don't know the specifics, but if MCAS is disabled, I'd assume the pilots would be able to manually trim the plane. In fact, one of the early flaws, IIRC, of MCAS was that it was tied to electric trim, meaning that to disable MCAS you also had to disable electric trim and and thereby go to manual. Since the 737 stabilizer trim is connected via wires and not fly-by-wire controls, the plane can get into an aerodynamic position where a pilot physically cannot bring the plane back into trim.

Boeing has a maneuver to correct this, but it involves descending to reduce aerodynamic forces on the stabilizer, adjusting trim, regaining altitude, and rinse and repeat until you're back in trim.

Personally, I wouldn't want to be a passenger on a 737 without electric trim and go through that maneuver, but it's better than crashing. Basically, the 737 should be considered too old an airframe to allow for non-type-rating-changing modifications (i.e. fly-by-wire stab trim, etc).

No, the engines are not low. They can't be, because the wing is low and the landing gear is short.

The engines are wider than the old ones. They are also much further forward, in order to avoid being low enough to hit the pavement. (part of the engine is higher up than the underside of the wing) These differences mean that the engines can act somewhat like canards, generating lift near the front of the aircraft. The engines themselves, even when not powered, generate lift.

The lift increases as the nose rises. This means that raising the nose becomes easier the more the pilot raises the nose, which is a hazardous way for controls to operate.

Basically all modern airliners with engines under the wing generate torque that tries to raise the nose of the plane. MCAS is to correct for nonintuitive behavior near the limit of the flight envelope when the wing is at a high angle of attack. Most flights never get anywhere near that, and disabling MCAS would not be noticeable.

This might be oversimplification, but I'll venture it and hope someone corrects me if I'm wrong:

If MCAS is disabled, then the airplane will fly very differently from the 737s that everyone with an existing 737 flight rating is used to.

So the plane can fly, but it'll feel different.

And that sure does seem like a problem to get back safely to the ground.

MCAS only kicks in at high angle of attack with the flaps up. I believe that most flights never come near having it activate.

If it disables due to faulty sensors and the pilots are told it is disabled, most flights won't have to do anything different at that point. The plane will handle just like it normally does.

If there are flights that are supposed to have maneuvers that would trigger MCAS, pilots are going to need to be trained to avoid those maneuvers when MCAS is disabled.

But if a MCAS failure and an unexpected unusual attitude does line up, there will be another crater.

This seems to be the part that everyone's missing. "Oh, this rarely happens" is ambiguous, we don't have any data on how often MCAS operated correctly during flights.

Also, in events that 'rarely happen' one of which is approaching a stall (according to the FAA's report), is it safe to disable the system in the actual scenario when encountered? It doesn't seem so. I can't see how both "Need this system for extremely rare scenario" and "Disabling this system because scenario is extremely rare is okay" can both be true.

> I can't see how both "Need this system for extremely rare scenario" and "Disabling this system because scenario is extremely rare is okay" can both be true.

The benevolent interpretation is:

a) the plane being in a situation where the system is required is rare, but frequent enough that the risk wouldn't be acceptable without MCAS.

b) MCAS breaking is rare, but frequent enough that we can't allow it to fly the plane into the ground when it does (as has been demonstrated).

c) Both things happening at the same time is so exceedingly rare that a crater is an acceptable outcome, just like we accept that all engines simultaneously failing at the same time during take-off will likely result in a crash.

(compare: https://commons.wikimedia.org/wiki/File:FAA_8040.4B_Risk_mat...)

That said, I hope EASA takes a very close look instead of blindly trusting the FAA again...

These are fair points, but the FAA report used the wording "extremely rare" (or similar) instead of a concrete quantity, and I find that extremely reprehensible. As we all know, "extremely rare" needs to be quantified. There are 44k flights in the US alone every day (pre COVID).

> MCAS breaking is rare

This is the part I'm not particularly inclined to agree with. The scenario is no longer breaking, it's breaking OR disabling. There are a host of new conditions that will result in MCAS being disabled according to the report. Some of these conditions disable MCAS for the remainder of the flight, and the way that I read the scenarios, it's certainly possible for these conditions to stack together.

Reading the report gives the impression that the FAA is completely incompetent. They didn't specify any rate of failure or disabling of MCAS, and the 'failure scenarios' that are proposed to be carried out in the near future are lacking in exposing these disabled scenarios.

Also, the FAA stated in the report that the plane handles similar to the 737 NG when STS is disabled; however, the MCAS automation disables MCAS and STS. There is no information about the rate at which STS has been disabled in flights in NGs, and no comparison on how disabling STS during the 'near stall' portion of a 'rare event' behaves in those planes.

They wrote this long-winded document that's almost entirely devoid of meaningful factual detail. It reads like a Boeing PR piece if I've ever seen one.

But not as big a problem as having MCAS misbehaving, hence the change.

MCAS is only needed in situations with a very high angle of attack, that is a very steep climb which should not happen in normal flight situations. For example, MCAS is completely deactivated, if the flaps are extended. So unless you get into the steep angles, a 737 MAX with MCAS disabled, wouldn't even feel different in flying.

> seems to amount to about 20 lines of code

it's sobering to think that 20 lines of code could potentially have saved 346 lives :/

That doesn't sound right. If I understand correctly, the crashes were not due to a programmer making a mistake in a few lines of code. They were due to inadequate sensor redundancy, inadequate pilot retraining, and possibly a missing warning light [0] (the fault still lying with Boeing on all three points). At no point did the behaviour of the MCAS software deviate from its specification.

[0] https://www.nytimes.com/2019/05/05/business/boeing-737-max-w...

Deactivating MCAS on AOA disagree would have prevented both crashes. But yes, the program behaved to spec, so strictly speaking it is not a programmer error but a spec problem.

> It seems that in an AOA DISAGREE situation, the flight is still permitted to take off.

That requires the AOA sensors to disagree while on the ground. Do they even report meaningful values while on the ground? (I mean, I suppose on takeoff roll they begin to do so...)

To me, this reads as a total reduction in the effectiveness of the MCAS.

We still have no indication that operating the aircraft without MCAS is safe, therefor if the system fails during a critical moment or is otherwise unable to account for the increased angle of attack, we could see jets plummet to the earth in a stall scenario. Absolutely the worst thing that could happen.

MCAS is only useful in very extreme situations rarely seen in normal flight. Most pilots will never be in a situation where MCAS is useful.

> Most pilots will never be in a situation where MCAS is useful.

And if they are in the situation? Also, there's no data on how many times MCAS activated on non-crashing flights with valid data, so this statement is 100% speculation.

> we could see jets plummet to the earth in a stall scenario

To be fair, when a passenger airliner finds itself in a stall scenario, hitting the ground is not an uncommon result.