Originally Posted by
Water pilot
This is the crux of the design problem and one of the "holes in the cheese" that led to a fatal engineering decision. Computer programmers love it when they can reuse code for a different purpose; it seems elegant not to require an "off" switch for MCAS because you already have an "off" switch for the electric trim. Smart! In addition, any MCAS failure kind of sort of looks like runaway trim, so you don't have to tell pilots about it because if it misbehaves they will recognize it as a runaway trim and do the right thing automatically. I can see this argument being made in the design room by people who never actually have to deal with humans.
In retrospect, the flaws in the thinking are obvious. A faulty MCAS resembles runaway trim in the way that a slow hydraulic leak resembles a broken hydraulic hose. A faulty MCAS and a short in the electric trim do both eventually result in a fully trimmed down plane, but the way you get there and the clues that you get on the way are quite different. A runaway trim will not stop running away when the pilot clicks on the trim button and then start again five seconds later unless something fairly complex is happening electrically.
Additionally, having to turn off the entire electric trim system to disable MCAS is like having to turn off hydraulic brake assist and power steering in your car to disable a faulty autonomous driving system (especially one about which you have not told the drivers!)
So far there has been nothing to indicate that the four pilots involved in the crash were particularly unskillful. Obviously it is in Boeing's interest to appeal to ethnocentrism (bad pilots, bad maintenance) but the fact that these were practically new planes points the finger right at the manufacturer. Do we honestly think that, say, the pilots of Colgan Air would have been able to respond any more successfully to this challenge?
I am 100% in agreement with everything you say, MCAS should not use single input, there should have been an AOA disagree light, pilots should have been trained and informed by Boeing about MCAS, and mostly MAX/MCAS is just a bad design in general. I was more replying to the suggestion of having a button that would rapidly reset the THS, which would bring it's own set of issues, I don't have an issue with MCAS disabling itself with AOA disagree plus the pilots having a button to switch it off and keep thumb trim input working for failures MCAS doesn't recognize. I think a lot of us could have gotten into trouble with MCAS before we knew about it, what surprises me a little is the second crash.