Some of the questions raised above about the how and why of the MCAS are dealt with in a reasoned on well written explanation of the need for, the design of, verification process and shortcomings of the implementation in a report done after the Malaysian crash but BEFORE Ethiopia sourcing FAA safety engineers. In short, under pressure from "management" the FAA safety engineers delegated some of the certification oversight to Boeing, which would have had them marking their own homework, to be reviewed by the FAA. Other than the usual suspects of single AOA input source, lack of documentation for training, etc. the report names two new aspects I had not known of before: The original MCAS specification as reviewed and used in the risk assesment by the FAA reflected a maximum stabilizer deflection of 0.6 degreeds whereas the max deflection as implemented was 2.5 degrees; second The original design was for a once-off intervention by MCAS, whereas after each override of the system (by pulling back) the system applied another 2.5 degrees until full deflection was reached. So because it reset itself after each pilot input, it was in effect able to deflect to full nose down rather than to a maximum of 0.6 degrees. https://www.seattletimes.com/business/boeing-aerospace/failed-certification-faa-missed-safety-issues-in-the-737-max-system-implicated-in-the-lion-air-crash/
