Originally Posted by
Water pilot
So they understood that a single failure of a sensor would cause the plane to pitch nose down shortly after takeoff and they did not feel that it was necessary to inform pilots of this quirk?
First, I'm not defending Boeing here, but I would like to add in some background regarding 737 system design that might shed some light how the Boeing design team might have overlooked the significance of the single sensor failure issue with MCAS.
The 737 has a number of warning and assist systems that activate when an approach to stall is detected. Determination of the approach to stall condition is accomplished by the Stall Management Yaw Damper (SYMD) computer and the Air Data Inertial Reference Unit (ADIRU) using inputs from various sensors to include the AOA vane and pitot-static system. (There is also a completely independent and uncompensated standby attitude/airspeed/altitude instrument on the center forward instrument panel, but it does not generate any warnings.)
The SYMD's and ADIRU's work independently, although divergent outputs can generate specific warnings like IAS Disagree and ALT Disagree.
Each side can independently generate a stall signal. This is a conservative approach since it is better to receive a stall signal when you are not in a stall (false positive) than to receive none when you are (false negative).
When a stall signal is generated, a number of systems can activate to provide warning and assistance to the pilot in the subsequent stall recovery - Stick Shaker, Elevator Feel Shift, Speed Trim Stall ID function, Autoslats, and reduced Yaw Damper input.
The important point here is that it only takes one stall signal (possibly erroneous) to activate these systems. While erroneous activation of these systems is an annoyance, they are not existential threats.
In terms of design philosophy, MCAS was no different than these other stall-related systems. If fact, in at least one Boeing document MCAS is referred to as a sub-function of the Speed Trim System (STS) and MCAS responds to a stall in almost the exact same manner as the STS does currently.
With one important difference, and that difference was crucial.
First of all, some of you might be surprised to learn that in a stall condition, the STS will trim the stab nose down at the exact same speed as MCAS and can do so
continuously until it hits the stop. This is far more authority than MCAS ever had. Why is not a problem?
Because the STS will respect the control column trim cutout switches. These are not the pedestal switches that are activated by the pilot. These limit switches are located at the base of the control column and prevent trimming opposite the direction of column displacement. That is, if a pilot is pulling back on the yoke, then nose down trim is inhibited. If someone is pushing forward on the yoke, nose up trim is inhibited. Thus the authority of STS is limited by the control inputs of the pilot.
Because MCAS was needed to activate during an accelerated stall (i.e. turning, nose low recovery), this system was designed to
bypass the aft control column cutout switch. Someone at Boeing did not connect the dots and realize that by removing this important barrier, it now created a new threat in the case of an erroneous stall signal.
I'll speculate here that since the folks at Boeing apparently considered MCAS to merely be an additional function of the existing STS, no further education was required.
Obviously, they were wrong and now everyone is powerfully aware of the significance of this oversight.