Originally Posted by
DaveReidUK
Provided that, at 0.27 degrees per second, it is allowed to run uninterrupted for a tad over 9 seconds.
The design seems to fail "on" by which I mean to say a bad sensor is able to trigger the software to continue to say "Nosedown" to MCAS. This seems to be opposite to conventional wisdom where a device is designed to fail "safe" or in other words say to MCAS "do nothing". That's my understanding at this point.
Pretty simple to program if AoA = disagree then MCAS = off. That may be simplistic but may well be something like what Boeing is considering? Whether this or something else they come up with meets certification requirements is yet to be seen.
Exclusive: Boeing eyes Lion Air crash software upgrade in 6-8 weeks
https://www.reuters.com/article/us-i...-idUSKCN1NZ00S