Originally Posted by
Just This Once...
So in sum, we have a non-DAL A system integrated with a secondary control system with no redundancy, monitoring, crew warnings or a dedicated means to disengage. Strap it to an aircraft where the trim system is more powerful than the primary controls and give it authority to move the stab at a far faster rate than normal trim and give it no limits of travel other than mechanical end-stops. If it goes wrong, force the crews to disable all powered stab control and equip them with manual trim wheels that are difficult and slow to operate at the best of times. Modify said wheels to make them slightly smaller and insert a more powerful damper to counteract the spring and backlash effect of the stab being moved at a faster rate than ever before - requiring an undocumented increase in physical effort. Finally inform the crews of this system's existence and get the company test pilots to retest all of this after a quick fatal crash, but do so only at a relatively slow speed. Second accident crew become the unexpected test pilots collecting a datapoint that suggests the trim wheel is impossible to move when at a higher airspeed. Cumulogranite awaits.
Apart from the flight envelop defining the configuration, CofG, AuW and airspeed/mach beyond which the manual wheels cannot be moved at an effective rate, what are we missing?
OTOH:
* build it all in a rush after being caught out by the competition
* while maxxed out on the rush job, expend some precious resources on changing stuff that didn't need to be changed (bigger displays must be better, must-have new feature, just like on phones )
* take a marketing claim - differences training will not need sim time - and turn it into a design requirement
* sign a sales contract that turns it into a financial requirement so we can beat the engineers with that one as well
* screw up the aero modelling of the effect that lead to the system in the first place, find it is much worse in flight tests, make the system several times more powerful to fix it
* don't tell the regulator what you just did
* don't tell aircrews anything because they don't need to know because of the no-training requirement above
* make all failure cases for the system the crew doesn't know about be handled by existing procedures, however mismatched or badly, because can't train any new procedures
* hang it all off a single sensor
because if it used two it would need a warning if a disagree caused it to disable itself, and new warning means new training so it can't be done that way
* rewire the cutout switches, which have been the same for decades, so that now a really clever crew cannot turn off just the automatic trim and leave the manual electric on to regain control
And between both of us we've probably still missed something.