MCAS: How 737 MAX system gained power and lost safeguards

The real fix is to never fly on a 737 MAX

Not really: person A is tasked with remeditating risk X (dangerous pitch-up at high AoA), persons B, C are tasked with remediating some other risks Y, Z, or just generally keeping an eye on the big picture. Now if person A is better than the others at pushing the needs of their particular target metric (or just more stubborn, a particularly easy form of "strength"), that plane will surely never crash due pitch up at high AoA, but maybe more likely due to other dangers that became more likely for the sake of never crashing from that pitch up problem that A was sent out to solve. This cost will be seen as a consequence of the weakness of B, C, not of the "strength" of A.

The high-resolve powerplayer who pushes their assigned task ahead of big-picture concerns is the hero of ambitious middle management culture. We see that happen many times, just rarely in domains as deadly as aviation.

I don't accept that fly-by-wire airplanes are not FAR 25 airworthy in direct law where zero safe guards are in place. Those planes still have all the aerodynamic stability requirements in all three axis. Control surfaces move consistently with pilot stick input. You can't say the airplane is only airworthy when these safe guards are in place, and as soon as you're in some alternate law that the airplane is flying illegally (unairworthy).

Otherwise, every time such an airplane departs normal law, it should be reported (by plane's computer and pilots) that the flight became unairworthy in-flight. It became an illegal and unsafe flight. How does the mandatory incident reporting requirements get ignored in this case? Or maybe they aren't ignored by the aviation community, and merely go unreported to the public just how often airplanes depart normal law and are illegal flights? That'd be incredible, if it were true.

However, I think what we have in the case of the 737 MAX is altogether different from fly-by-wire. It's not clear to me from available reporting if the airplane, minus MCAS, did conform to FAR 25.173, all of it. If MCAS is required for the plane to conform to this section, and it either fails or is disabled, the pilots need to know the natural behavior of the airplane. They need to know they're in some equivalent of "direct law" (term used in fly-by-wire which the 737 is not) and the different flight behavior in place. And yet they didn't know, we now know they were intentionally not informed or trained.

So we have a case where something, MCAS, is so important that it's required for airworthiness, but has no redundancy, and totally insufficient self testing to know if it's spewing bogus data; and yet failure is not likely enough and/or not likely a big enough of a deal that pilots don't need any difference training for? Yeah I don't buy that shit and some heads absolutely need to roll for that, but at this point I have zero confidence they will. At least, not the correct heads will roll.

>I don't accept that fly-by-wire airplanes are not FAR 25 airworthy in direct law where zero safe guards are in place. Those planes still have all the aerodynamic stability requirements in all three axis. Control surfaces move consistently with pilot stick input. You can't say the airplane is only airworthy when these safe guards are in place, and as soon as you're in some alternate law that the airplane is flying illegally (unairworthy).

I absolutely hope that all fly-by wire aircraft meet minimum airworthyness standards in their minimum automation state. And I will admit my use of fly-by-wire is specifically constrained to the more general concept of a computer stabilized airframe rather than a more common assumption of it being associated with Airbus' particular implementation of fly-by-wire (I.e. Airbus Control Laws). The point I hope we can both agree on is that if you have an uncertifiable behavior corrected by an automation routine in a flight computer; the criterion of certifiability to be met is that the airworthy aircraft is airframe plus automation; not airframe without automation.

In that sense, there absolutely must be either sufficient redundancy to ensure that a pilot can land before the automation airworthyness is dependent on fails, or there must be enough training that should the automation fail, pilots are prepared to safely recover and land the plane. Neither of those is the case with MAX.

>Otherwise, every time such an airplane departs normal law, it should be reported (by plane's computer and pilots) that the flight became unairworthy in-flight. It became an illegal and unsafe flight. How does the mandatory incident reporting requirements get ignored in this case? Or maybe they aren't ignored by the aviation community, and merely go unreported to the public just how often airplanes depart normal law and are illegal flights? That'd be incredible, if it were true.

Dealing with the issue you describe here is/was a big part of the difference in philosophy between Airbus/Boeing.

With Airbus, they build the plane from the ground up with some degree of minimal automation in mind. These systems are designed to fail-operational, and with gradual decay of automated functionality in mind. I.e; the automation does as much as it can with the information it has available. Once inputs start disappearing, increased reliance on a pilot to replace the envelope protection software starts. An Airbus, to my current level of awareness, will never suffer an automation casualty that renders the frame unairworthy; and any such casualty that happens in flight that turns out to be recoverable in the sense of not resulting in an impact crater should be handled as an in-flight emergency.

With the MAX though, MCAS being disabled means that the aircraft no longer complies in terms of consistent stick force response curves in all requisite flight regimes. No matter how loudly Boeing protests it should never happen in normal flight, the rules are the rules. If it can't wind up turn, and maintain consistent stick force response curves, it shouldn't be flying as a civil transport aircraft. I.e. an MCAS casualty should be considered an in flight emergency.

This means, if you propagate through the fault tree, that AoA sensor malfunction/disagreement means a MAX should not be in the air as a civil transport. This is especially problematic, because unless you were Airbus, AoA sensors have hitherto rarely if ever been considered safety critical devices. So it would not be immediately intuitive to a pilot that a malfunction of an AoA sensor would potentially lead to a reasonable risk of catastrophic loss of the aircraft; at the hands of an undocumented and hidden automation system doubly so.

>It's not clear to me from available reporting if the airplane, minus MCAS, did conform to FAR 25.173

It did not. It failed to comply in terms of stick force response curves. That was why MCAS was created in the first place. To patch that non-compliance.

>So we have a case where something, MCAS, is so important that it's required for airworthiness, but has no redundancy, and totally insufficient self testing to know if it's spewing bogus data; and yet failure is not likely enough and/or not likely a big enough of a deal that pilots don't need any difference training for? Yeah I don't buy that shit and some heads absolutely need to roll for that, but at this point I have zero confidence they will. At least, not the correct heads will roll

Got it in one. The reason behind not training pilot's or making this system's importance clear to the FAA was because Boeing would then be liable for $1,000,000 per aircraft sold to Southwest if the pilots were required to undergo simulator training.

The plane needs to be refused certification, forcing Boeing to take them all back and scrap them. They need to go back to the drawing board and design a new jet to take its place. If that forces them into bankruptcy, then this should serve as a good lesson about what happens when your company that makes safety-critical products cuts corners and kills people.