Originally Posted by
Ian W
I think that a point has been missed that is to do with the apparent architecture of the system.
1, An AOA disagree causes the ADIRUs to have problems and leads to Unreliable Airspeed indications
2. However, a lot now depends on which of the AOAs is being used by MCAS which apparently depends on the random squat switch (weight on wheels) swap from one to the other
3. If AOA disgree AND PF is on the non-failed AOA side AND MCAS is using the non-failed AOA - then the aircraft can be treated as if it has an unreliable airspeed only and recovered (as in the previous flight)
ELSE IF AOA disagree AND PF is on the Failed AO side and MCAS is using the FAILED AOA then MCAS believes the failed AOA AND IF that failure indicates a stalled aircraft THEN MCAS will start trimming nose down only stopping briefly with PF trim inputs.
So it is not a simple if AOA fails then MCAS crashes you. MCAS has to be using the failed AOA and the failure has to indicate stall. IF at any stage the crew switch off stab trim with the cutoff then the problem goes away.
There are more slices of cheese that have to line up than appreciated. However, the design decision to switch from one AOA to the other effectively at random rather than have a system that discards all AOA input on AOA disagree seems to be a little shaky.
It is quite bit more than shaky.
The way the system is architectured means if the AOA on standby side fails, it may be undetected and henced unfixed, since it is not used for function. The failure becomes latent. Now when the active control side AOA fails after, you have BOTH AOA faulty. Flight crew would have no chance to even diagnose the issue themselves.
That is why the industry standard approach is to have system detect and respond/announce to failure in real time