Critical Systems in Electrical Engineering

Electrical Engg.
Critical Systems
Student Name –
Student ID -

Contents
Assessment of Possible reasons for the crash............................................................................3
Safety Case for the museum when no failures occurs................................................................6
Safety Case for the museum when failures occurs.....................................................................7
Analysis of algorithm and safety argument...............................................................................8
Modification in algorithm ( if an unsafe state(s) is reached)..................................................10
References................................................................................................................................11

Exercise 1
Assessment of Possible reasons for the crash
Boeing 737 Max 8 MCAS safety system
The Boeing 737 Max 8 aircraft were grounded after two serious crashes in 2018 and 2019
which left 189 and 157 people dead, respectively. In both cases, the pilots tried to control the
aircraft but it began nose diving. An automated safety system - known as the Manoeuvring
Characteristics Augmentation System (MCAS) - was implicated in both the crashes. Some
reports related to the MCAS system are - Indonesian crash report, Ethiopian crash report and
Boeing 737 Max 8 MCAS system.
MCAS is a law for controlling flight ( implemented on 737MAX). It is a system which is
added to enhance the characteristics for handling an aircraft MCAS ( Maneuvering
Characteristics Augmentation System).
MCAS can push the jet’s nose down and reduces the risk of stalling. The system gets
automatically activated if the angle of attack ( AOA ) is large, the autopilot is off, the flaps
are up and there is steep turn. The system gets deactivated if the angle of attack is decreased
or the pilot overrides with a manual trim. MCAS is capable of moving the horizontal
stabilizer trim upwards at 0.27 degree per second ( upto 2.5 degree ) and 9.26 s at a time. The
normal electric trim control is thumb – control of the stabilizer trim. The stabilizer trim cut
out disables automated trim control. The manual trim control has a hand cranked wheel to set
the trim. The normal electric trim control can stop the MCAS-driven movement of the
stabilizer. But within next 5 s, the MCAS is activated again after the software is released is

the sensed AOA is very high. The pilot can deactivate the MCAS and stabilizer trim’s
automated control and can use hand crank the trim wheels.
The main problem is that the system was not mentioned in the FCOM ( Flight Crew
Operations Manual ) which is the master document related to the aircraft for a pilot. The
explanation provided for this is to prevent overload of technical data for a pilot and that the
aircraft has high g load and near stall ( so pilot must not notice operation of MCAS ). Some
extra layers have been added to enhance protection. The system compares the inputs of the 2
AOA sensors. If the difference is more than 5.5 degree, the MCAS is not activated. It
prevents the activation of MCAS due to data with error.
The system is used for anti – stalling and does not allow the plane to enter into a stall or lose
lift. The plane crashed soon after the take off after steep climbs and descents and varying air
speeds ( in the Ethiopian crash ). Both the accidents ( also the Lion Air Accident, Indonesia )
may have the same cause.
In MCAS, the engines are heavy and have better fuel efficiency. It can lead to the pitch up of
the plane’s nose ( in certain conditions in a manual flight). It can point the nose down in case
of a danger of stalling. So, MCAS does not come into play for normal operation but comes in
operation in extreme cases. The problem in both the accidents was that the pilots had to
struggle for controlling the airplane ( as the MCAS got activated and pushed down the
plane’s nose after the take off ).