Let me say right at the beginning that not for one moment do I think that Boeing expected the aircraft to crash for a (known) fault of their making - it is not a Ford Pinto case, where decisions were based on probability calculations. And I do not think Boeing is technically incompetent. Given these let me put it the way I, admittedly a layman, see it.
Right at the beginning of the Max development, one technical flying characteristic was foreseen, and one (commercially motivated) ironclad rule was set out.
The first was Boeings realization that a 'normal' 737 pilot would have a high chance of putting the Max in a stall because its native flying characteristics were quite different from that of the other 737s.
The second was the requirement that ANY 737 pilot, with minimum retraining (30 mins on an iPad, as it turns out) should be able to fly the Max. The retraining was to be so minimal that a pilot certified for a 'normal' 737 was also certified for a Max, and I suppose vice versa.
Boeing's solution to this dilemma was the MCAS.
Boeing was so certain that in normal course of routine operations the aircraft would encounter a stall that it 'gave' the MCAS 'great authority'. In terms of the amount it could trim, and the persistence with which it refused to disengage.
(My view is that by itself it was not a big deal. What made it a big deal was how it interplayed with the second part).
The second part was that it could not be revealed how intrinsic and important the MCAS was to the operation of the Max. (Otherwise right now one of the easiest courses of action would be to remove/ disable MCAS permanently). Revealing that would likely have meant that for pilot certification the Max would be considered sufficiently different from the rest of the family to require recertification.
This started the series of unfortunate events - the importance of the MCAS being downplayed (essentially kept hidden from pilots with just enough done to cover Boeings backside), DESIGNATED as a secondary assisting feature, and most importantly, logically connected to only one AoA sensor, though there were two physically present and wired up. (Apparently to take the output of more than one sensor would have automatically meant bumping the MCAS from secondary to primary/ important status, with all its commercial problems).
And the die was cast.
Please read this post along with my thoughts on this matter, spread over three different threads.
@Jeroen - pls. tell me where I'm wildly off the mark.
Quote:
Originally Posted by A350XWB Not B787 MAX, it's B737 MAX.
… Quote:
The additional layers of protection include:
Flight control system will now compare inputs from both AOA sensors.
|
Boeing Statement on AOA Disagree Alert. |
This is where I feel we will have the greatest disagreement. With Boeing + FAA + entities with commercial interest on one side and EASA + possibly other regulators on the other side. Because the source of the disagreement will be philosophical, not technical.
By now nobody disputes the importance of the MCAS. Which automatically means that it has to (should? We are afterall in todays world!) follow the accepted norms of such safety critical subsystems for commercial aircraft - triple redundancy. Which also means three AoA sensors. Now that is really going to be a problem!
Regards
Sutripta