Hacker News Reader

This question -- if it is a safety feature, why is it acceptable that it can it be disabled -- comes up a lot, so I think we should recognize that, in general, there is an answer, though whether it was the right answer for MCAS goes a step beyond.

Whenever you have something that would usually improve safety, but which presents a risk if it fails, then the rational response is to ask whether it demonstrably improves safety overall. This calculus depends on how much it improves safety when working, how much harm it does when failing, and how likely it is to fail. These considerations can be modified by limitations on operations both when things are working and when they fail, as is the case of twin-engined aircraft use on trans-oceanic flights.

If, in addition, this thing can be disabled, the principle is the same, but there are more cases: what are the chances it be disabled even though working, or (as in this case) not be disabled when failing.

Disabling MCAS does not itself put an airplane in a dangerous situation, it merely increases the risk somewhat. The part of the analysis that seems to have been flawed is that covering the risk introduced when it fails but is left engaged.

MCAS isn’t needed to fly the 737 MAX, you can perform a perfectly fine flight without it — the autopilot directly trims, pilots could fly via trimming themselves using the control on the stick, and there’s a manual wheel for emergencies when the jackscrew motor fails (or is disabled to override MCAS).

Rather, MCAS is needed to fly the 737 MAX like other 737 type aircraft.

MCAS has the capacity to override pilot control via continued trimming; MCAS is not a safety requirement, but can trigger a critical failure; MCAS was not built to critical failure specs; pilots were not trained on MCAS; MCAS is required to maintain the type rating, because otherwise the plane would handle differently during a stall. (This is the only purpose — tipping the nose to fake handling characteristics during a stall.)

It sounds like a reckless design, made out of political rather than safety considerations.

That's a bit of a misunderstanding. MCAS is needed to satisfy the certification requirements for an aircraft under part 25. It only makes the 737 Max more like the 737NG in that it also makes it more like any other certified aircraft.

To put it another way, the alternative to MCAS was not more training for the pilots. It was the 737 Max not passing certification.

This is still a bit unclear to me. It's possible that it was originally intended to provide equivalent handling characteristics to the NG, but after flight testing, the magnitude of the MCAS correction increased by over 4X. It's possible that based on the predicted performance, the MAX would have met FAR 25 but not had equivalent handling to the NG, but after flight testing, MCAS took on a more important role in making the MAX certifiable at all.

Do you have a source?

My information suggests that while all modern aircrafts require trim control for stabilization, particularly near stall, the way that MCAS operates isn’t required. Rather, pilots would simply have to fly slightly differently to control the 737 MAX compared to the 737 NG. However, that difference in stall prevention would require the 737 MAX to be certified fresh, as opposed to the same type as the 737 NG.

In short, that MCAS trimming is only required if you’re not going to train pilots to trim correctly on the new airframe, because you’re trying to assert type compatibility.

I admit it's not as authoritative as I'd like but this is the best source I've found:

> MCAS is a longitudinal stability enhancement. It is not for stall prevention or to make the MAX handle like the NG; it was introduced to counteract the non-linear lift of the LEAP-1B engine nacelles and give a steady increase in stick force as AoA increases. The LEAP engines are both larger and relocated slightly up and forward from the previous NG CFM56-7 engines to accommodate their larger fan diameter. This new location and size of the nacelle cause the vortex flow off the nacelle body to produce lift at high AoA; as the nacelle is ahead of the CofG this lift causes a slight pitch-up effect (ie a reducing stick force) which could lead the pilot to further increase the back pressure on the yoke and send the aircraft closer towards the stall. This non-linear/reducing stick force is not allowable under FAR §25.173 "Static longitudinal stability". MCAS was therefore introduced to give an automatic nose down stabilizer input during steep turns with elevated load factors (high AoA) and during flaps up flight at airspeeds approaching stall.

http://www.b737.org.uk/mcas.htm

However, on Boeing's own website they give the 'makes it fly just like the NG' explanation. On balance of probabilities I think that's unlikely to be the engineering justification.

My reasoning being I don't believe that there is any formal requirement for an aircraft to exhibit the same handling behaviours to be counted on the same type rating. For example the 757 and the 767 shared a common type rating. The 757 was a pilots favourite precisely because it was sporty in comparison to the 767.

This is a good source: https://www.satcom.guru/2019/03/regulations-around-augmentat...

FAR 25 has a number of specific requirements around pitch stability, specifically, FAR 25.255(b)(1) and FAR 25.203(a), and some others. FAR 25.203(a) says "No abnormal nose-up pitching may occur. The longitudinal control force must be positive up to and throughout the stall"

My understanding is that on the MAX, without MCAS, once you've pitched up beyond some AoA beyond 12 degrees or so, you can let go of the yoke, and the plane will continue to pitch up further until it stalls. That does not comply with the regs, and so you have MCAS which dials in some nose down trim in this situation to counteract the aircraft's natural tendency to pitch up further.

If the chart presented in the article below [1] is fairly accurate and not merely representational, I think that the 737 MAX, without MCAS, does not actually become statically unstable in pitch at least until after the stall, but the response was still unacceptable, and the reason MCAS was needed for certification.

There is a complication here in that the stick forces are generated by an elevator Feel and Centering Unit, which is fed by a dedicated pitot tube and the stabilizer position.

Pitch instability after the stall was part of the rear-engined jet deep stall problem, and the reason for stick pushers [2].

[1] https://leehamnews.com/2019/02/15/bjorns-corner-pitch-stabil...

[2] https://leehamnews.com/2018/12/07/bjorns-corner-pitch-stabil... Figure 3.

The answer is FAR 25.672 (c)(2). "It must be shown that after any single failure of the stability augmentation system or any other automatic or power-operated system - ... The controllability and maneuverability requirements of this part are met within a practical operational flight envelope (for example, speed, altitude, normal acceleration, and airplane configurations) which is described in the Airplane Flight Manual"

MCAS is only required in high AoA, flaps up, manual flight. To get high AoA, you generally need some combination of slow speed, a steeply banked turn, and abrupt maneuvering. If you tell the pilots to keep the speed up, keep the bank angles down, and fly gently in the event of an MCAS failure, it meets the requirements.

From a practical standpoint, the aircraft should never see an AoA that would trip MCAS in normal flight. The only time a jetliner would typically see an AoA over ten degrees is on takeoff and landing, when the flaps are down (and MCAS is inhibited), or momentarily in turbulence.

From a risk control standpoint, you're multiplying probabilities together (of course assuming uncorrelated failures). Spitballing the failure probability chain, flights that would trigger MCAS are probably about 10^-4 to 10^-5 probability, and the lack of MCAS might cause an unrecoverable stall in perhaps 10^-1 to 10^-2 flights, so figure 10^-6 probability per flight of the airframe's poor stability leading to an accident. This is too high to be certified. If you have MCAS, but it's disabled when an AoA vane fails, figure the probability of an AoA vane failure is 10^-4, you get an accident probability of 10^-10, which is acceptable.

I don't understand how your post squares with what happened in reality.

Boeing has delivered 376 737MAXes since May 2017. About as many were delivered in 2019 as 2017, so figure their median age is 9 months. Figure a month from delivery to going into full service. That makes for 90,578 flight days of service. Figure 6 flights per day, you get about half a million flights. We know that the AoA vane had a failure in at least 3 flights, and we should probably assume that there were another three failures on the alternate side. That gives a failure rate of 6/500,000 = 1.2*10^-5. That's about 8x better than my spitball 10^-4.

The reason two planes have gone down is that the MCAS cure is worse than the instability disease. MCAS incorrectly activates at 10^-5, and empirically this failure is 66% fatal. If you can get MCAS to only activate when it's needed, the fact that it won't always be there to protect you is not so crucial.

Think about it like this: Would it bother you if the airbag in your car only went off 99.9% of the time when you got in an accident? It shouldn't, and it would hardly make any difference in auto fatalities. On the other hand, if the airbag in your car randomly went off on 0.1% of drives you took, you'd have that happen to you once a year or so, and there's a good chance that it would eventually cause you lose control of your car and crash.

> If the MCAS would not be part of the mission critical path, then we could ask why is there in the first place? There must be reason why it was introduced.

It was added to meet certification requirements for handling at high angles of attack. Specifically, to counter an increased pitch up tendency due to the larger, more forward engine nacelles.

As to how mission-critical it is I don't know, but as I understand it the angles of attack where it would become active are not encountered in normal commercial flight. It's more of a system that is there to meet requirements for handling near the "edge of the envelope."

I read this thread earlier and became frustrated by the number of times people repeated the same old misunderstandings. Thanks for taking the time to try to correct them.

Having a critical system, whether mechanical, electric or hydraulic is an unavoidable fact of aviation. For example on the airbus if there is a complete failure of the fly by wire system the plan is to fly the aircraft using only the trim for pitch control and the rudder for lateral control. I'm sure pilots routinely give this a go in the simulator, but I'd be very surprised if the expected outcome was much above a controlled crash. It's a case of managing the risk of a problem against the hazards.

An AoA disagree warning will probably be written up as a fault requiring written authorization to depart from a maintenance base. The pilot would be expected to be extra vigilant in avoiding flight close to the stall until the error was corrected. Perhaps settling for easier approaches, longer runways etc.

All pretty normal aviation practice.

Yes! But even if you have 2 out of 3 vote you can still have two sensors that can fail, say due to a bird strike or something else and MCAS would have to be disabled which means pilots need to learn to fly the plane w/o MCAS.

The one part of the narrative that Boeing has tried to Jedi Mind Trick away is that even if the pilots knew to disable MCAS by pulling the fuse, they're still left with having to fly a plane which no longer flies as the previous generation that they were trained on -- which is what MCAS was designed to do. So you still have a safety issue.

In normal flight, MCAS is not active. The plane handles pretty much like any other 737. MCAS becomes active at high angles of attack, near the stall, to meet handling requirements for certification.

Doesn't matter. The flight characteristics are still drastically different toward the extremes, and you never assume away the extremes. You now have to guarantee that every crew when faced with an MCAS disable situation that required piloting in a way that the MCAS would kick in can successfully mimic the action of the MCAS with only the manual trim wheels.

I'm not saying that's impossible, but you'd want your aircrew to have sufficient training to be a stand in for the automation.

I think "drastically different" is probably overstating the truth. It certainly doesn't jibe with anything I've read.

It's worth bearing in mind that, from what we know, neither of the two crashes had anything to do with handling difficulties in the new aircraft near the stall.

I say drastically different because no one pays the complexity tax of increased automation to deal with something that isn't important. In this case, to the certifiability of the airframe.

I understand your caution against overstating things, but I'm not trying to be hyperbolic. If you think about the consequences of doing basic maneuvers in adverse conditions (weather/load/engine power conditions), you rapidly begin to get into areas where what seems minor would get into uncharted territory without a working MCAS.

It is a different plane in terms of manual flying. The automation non-withstanding.

I get where you are coming from, and it's true that "the FARs are written in blood" but I'm not convinced that a non-linear stick force would have caused any real world issues. For a start, all of the critical phases of flight (takeoff, landing and go-around) usually involve some amount of flaps, for which MCAS is apparently unnecessary.

I'd like to point you here, https://news.ycombinator.com/item?id=19527543

This is an interview with D.P. Davies, a test pilot of the Aviation Review Board of the UK. He faced many of the same arguments back in the 1950's with regards to the certifiability of the 707-300 I believe, but nevertheless rejected it for non compliance.

In that case, even if the plane stalled itself, it would immediately pitch back down, making it a "benign" aberrant flight characteristic. However, as he successfully argued, certifying that plane as is would set a precedent Which would deteriorate the overall airworthyness of airframes over time as the goal posts were allowed to slip further and further away from what was required by law.

We call this Normalization of Deviance, and it's an Engineering firms favorite way to get people killed in high profile ways.

I am far from the best example of a person who doesn't exceed the boundaries of "rules" when they keep me from getting something done, but once you have the thing done in a non-compliant way, it is absolutely imperative to bring it back into compliance somehow or ensure every stakeholder (regulator/customer/user alike) is aware of the exceptionality of the non-compliant piece, and owning it in whatever capacity is required to get the job done safely.

Creators, designers, manufacturers, etc are given a great deal of leeway when it comes to doing things; part of that is the expectation that you know the rules you are breaking, and you are making the best effort to either communicate or remedy the non-compliance.

Don't know as it will change your mind, but I hope it makes where I'm coming from clearer.

Fully agree that Boeing should have disclosed MCAS, why it's there, and details of its operation to the folks flying the planes. If I were a pilot I would certainly want to know about such a system, even if its behavior is not normally something I have to deal with. Sort of like a stick shaker. It's there for safety near the extremes, but it's not something a pilot ever encounters during line flying.