I remember reading recently that the design and purpose of the MCAS system evolved over time. Originally, its purpose was to prevent excessive pitch-up at high airspeed and low AoA. The AoA data from a single sensor was crossed-checked with G forces on the airframe - exactly the two independent data points Yars is talking about. Then they added the stall protection requirement. Problem is there’s no increase in G load as you approach stall, so the G force cross-check was removed, making MCAS input dependent on just the single AoA sensor.
It’s a classic case of all the engineers sitting in their office cubes, each looking at their square inch of the system. No one was looking at the big picture on an ongoing basis.
I also fault Boeing for their decision to completely omit MCAS from the MAX’s documentation and training. It’s not possible to provide scenario-based training for every possible failure, but flight crews need to be aware of the systems on the aircraft and how they can behave. A well-understood technique for stopping runaway trim on the older 737s is a firm yank or shove on the yoke (in the direction opposite to the runaway). This technique, however, did not work for a runaway MCAS event on the MAX. The Ethiopian pilots tried this technique repeatedly, indicating that they hadn’t gotten the memo. Calling the Malaysian and Ethiopian flight crews incompetent is unfair. Inadequately trained is a much better characterization.
- Andy