Originally Posted by
LDRA
It is quite bit more than shaky.
The way the system is architectured means if the AOA on standby side fails, it may be undetected and henced unfixed, since it is not used for function. The failure becomes latent. Now when the active control side AOA fails after, you have BOTH AOA faulty. Flight crew would have no chance to even diagnose the issue themselves.
That is why the industry standard approach is to have system detect and respond/announce to failure in real time
If the AOA on the 'standby' side fails - that is the one that is not feeding the MCAS then the result is a UAS because the ADIRUS are fed by both. When a technician gets a UAS report from the crew the first things to check (as in the first thread posts here) are pitot covers left on - or static vent blocked. But it was the AOA information that was incorrect. I would have thought an AOA disagree would lead to failing both AOAs (it is not possible in the air to detect which is right) and the ADIRUS stop using them and a warning is provided to the crew. Ideally there should be logic (discussed in the thread above) to calculate from other flight parameters the likely AOA and use that value to identify the bad AOA sensor and fail it.