A further thought on the certification of a ‘commonly used’ architecture. Whilst ‘the highest AoA wins’ logic provides a fail-safe solution for ensuring stall warning, it still leaves a potential hazard of the flight crew responding (nose down) to an erroneous stick-shake; worst case shortly after lift-off.
Would a ‘commonly used’ safety case considered the availability of airspeed to cross check / monitor the overall flight situation ? If so, the probability of a false pilot response would be reduced, providing sufficient overall level of safety in conjunction with a highly reliable vane system.
This might cover Machinbird’s operational view, where all available instruments are used to clarify the situation, in a ‘commonly used’ design.
As much as I agree with the airmanship, common sense, ‘salt’, view, I doubt that these are acceptable terms in certification, but it does question design assumptions of human capability after system failure.
Following-on from the above; a difference with the specific system in 737 MAX is that because AoA is used in ADC corrections, an AoA disagree will also trigger an IAS disagree (and ALT disagree), increasing the pilots’ mental demand in resolving the overall situation by comparing speed - but airmanship and ‘salt’ still apply (even if the data corrections are minor).
If so then the certification argument for the 737 MAX is not equivalent to a ‘commonly used’ safety case.
This difference might be seen in the crew’s actions in the Lion incident and accident flights, where the focus of attention appeared to be on air-data, UAS, and establishing which seed display was correct. Sick-shake was a lesser concern, either because of the attention on airspeed due to the IAS disagree alert, or that stick-shake had been encountered on previous flights.
A further supposition if the coincident AirData disagree alerts mentally superseded the AoA disagree alert. If the the Air Data alerts were removed to improve the safety case, a erroneous AoA input and AoA disagree alert might be considered valid, particularly because of the erroneous low speed display overlaying the EFIS speed scale, suggests a stall.
If so, using an AoA disagree alert could increase the hazard of inappropriate crew response to an erroneous high AoA, because the EFIS display ‘confirms’ high AoA - remove both. (Catch 22, close-coupled systems, intractable) - dust off Eric Hollnagel’s views on safety.
All of which might have its roots in grandfather rights, and ‘genetic deficiencies’ in grandfather-design and certification thinking, possibly due to the intermix of old aircraft and modern digital systems within the same design organisation. Current designers were not born when 737 first certificated (1967).
‘Children of the digital designers line’ !