What Can the Automotive Industry Learn from MCAS and the 737 MAX?

The best way to consider the technological trends that are transforming the automotive industry is to recognize that, by and large, they are technological trends that have already transformed other verticals before filtering their way into the notoriously cautious and hesitant automotive industry. This is perhaps most visible in connected infotainment; the capacitive touchscreen displays and application frameworks that are now commonplace in most new vehicles were first introduced to consumers via their smartphones. Similarly, automakers are now enthusiastically adopting voice assistants such as Amazon Alexa and Google Assistant, which have come to define the smart home user interface.

This lagged adoption applies not only to superficial multimedia and connected infotainment applications, but also to core driving functions. While semi-autonomous operation in automotive is still in its infancy, it has been the norm in aviation for decades. As the software complexity of cars grows and takes responsibility for more core driving functions, it is important for the automotive industry to look to the best practices and learn the lessons of an industry that has already used software-defined functions to enable the safest transit mode.

While civil aviation has an impressive safety record, there are notable exceptions. As is the case with road accidents, the vast majority of fatal aviation accidents can be attributed to human error, 75% of which in the United States is pilot error. There is therefore a considerable argument to be made for the introduction of greater automation in civil aviation, just as there is in automotive.

However, the Maneuvering Characteristics Augmentation System (MCAS) should not be confused for an autonomous system. In automotive parlance, MCAS is best described as an Advanced Driver (or pilot) Assistance System (ADAS), subtly intervening on behalf of the pilot to make the task of flying safer. The inclusion of this software was made necessary by the equipment of the CFM LEAP-1B engines, which are larger and sit further forward than previous 737 generations. This had the effect of making the nose of the aircraft tip upward, increasing the risk of aerodynamic stall. MCAS leveraged an angle of attack sensor to help the aircraft right itself by automatically moving the horizontal stabilizers to lower the nose if the angle of attack became too high. This allowed Boeing to opt for larger, more efficient engines, while retaining the 737 platform along with all of the existing regulatory approval for this aircraft type and enabling any pilot familiar with previous 737 generations to pilot the aircraft safely and comfortably.

MCAS failures have been widely identified as the cause of two major 737 MAX crashes. Investigations are ongoing, but preliminary findings suggest that the failure of the angle attack sensor caused MCAS to incorrectly identify a steep angle of attack when the aircraft was in fact level. Therefore, the MCAS system forced the nose of the aircraft downward. Numerous pilots have since complained that they were not aware of the existence of MCAS, and that no clear procedure to deactivate the system was made available to them. The entire fleet has since been grounded by numerous aviation authorities, including the Federal Aviation Administration (FAA), causing major disruption for airline operators due to the large number of 737 MAXs ordered in recent years.

These incidents exemplify every fear that the automotive industry has about the deployment of semi-autonomous vehicles: human operators unfamiliar with the software in their vehicles, crashes caused by component failure and insufficient redundancy, catastrophic human-machine interface failings, and the widespread and costly grounding of an affected fleet.

• Semi-Autonomous Operation Requires Robust HMI: As stated above, the inability of pilots to deactivate the MCAS system proved disastrous. As the automotive industry turns its back on fully driverless vehicles in favor of semi-autonomous deployments, it must address a host of Human-Machine Interface (HMI) complications governing driver engagement and handover. Technologies to address these issues include Augmented Reality (AR) and camera-based driver monitoring
• Essential Systems Require Redundancy:The MCAS system only used one angle of attack sensor to determine pitch, despite the 737 MAX being equipped with two such sensors. Automotive components fulfilling key safety goals must be robust and, where possible, supported with fail-operational redundancy.
• Software Updates in Software-Defined Vehicles: The MCAS system highlights the importance of pilots understanding the operation and capabilities of their vehicles. In an Over-the-Air (OTA) automotive environment, the problem of ensuring that consumers understand their vehicles’ current level of autonomous capabilities is even more acute. Increasingly, Original Equipment Manufacturers (OEMs) are considering an overdesign strategy, which will see vehicles ship in the short term with excess hardware capacity from compute, bandwidth, and memory perspectives, with the intention of enabling higher levels of automation in future. Managing consumer understanding of their vehicles’ changing autonomous capability over time will be a significant challenge.