Seattle Times:
”Ludtke didn’t work directly on the MCAS, but he worked with those who did. He said that if the group had built the MCAS in a way that would depend on two sensors, and would shut the system off if one fails, he thinks the company would have needed to install an alert in the cockpit to make the pilots aware that the safety system was off.
And if that happens, Ludtke said, the pilots would potentially need training on the new alert and the underlying system. That could mean simulator time, which was off the table.”
This is crucial information. If true, this would not only amount to gross negligence, but to criminal intent from Boeing’s side.
So - reasonably speculating - the decision making logic at Boeing went somewhere along this line:
Engineers:
We have two options to design the MCAS requirement into the MAX:
A) with redundancy in the data input, as required for such systems with potentially catastrophic influence on the flight performance. We need to install an alert in the cockpit if the system is switched off due to inconsistency in the data. That means the pilots will need to undergo simulator training for conversion to the MAX.
B) we poll only a single sensor and the system does not check for data integrity against other available data. Then the system can stay in the background and the pilots do not need to know. In case of sensor data corruption, the pilots would - best case - have a few seconds to recognize the problem as in effect comparable to a stabilizer runaway and use the cut out switches and apply manual counter trim. No need to mention this to anyone and no simulator training needed. What could go wrong? Well, in case of single sensor data failure, the airplane will want to fly itself and all on board with authority and high speed into the ground.
Management:
we do option B!