[QUOTE=wheelsright;10461419]The direction of this thread is difficult to understand. There seems to be a surprising focus on the cut-out switches but no rational explanation for the changes in the MAX series. If there are no circumstances that only one cut-out should be operated there, is clearly no point in having two cut-out switches. If two contacts are needed to be operated it could be mechanically interlocked into one lever. The current information suggest the two switches are a product of muddled thinking... hardly a confidence builder.
Purely speculating, the reason that MCAS is not automatically disabled in the event of conflicting sensor inputs may be because MCAS needed to be permanently active to comply with 14CFR §25.203(a) "Stall characteristics". However, it is difficult to believe that the designers could have considered it a better option to leave it to the pilots to disable MCAS rather than by the automatic system that would be immediately aware of AoA sensor malfunction. It seems to be possible that focus was on conforming to wording of regulations rather than designing an adequate system.
A critical system that is intended to work in all circumstance must be designed in a way that reduces risks of malfunction to an acceptable level. Reliance on a single sensor or system does not appear to satisfy this obvious requirement. In the event that a critical sensor is no longer reliable, the system must automatically fall back to an alternate. That could be an alternate duplicate system or the manual control of the pilot or a combination or several nested fall-back options. The evidence so far is quite clear that Boeing failed to properly consider these options and required pilot intervention on scant information. In my view, it was negligent design and I suspect that I am not alone.
Many of the comments on this thread focus on the failure of the pilots to resolve the situation. There is good evidence that if the captain had handed control to the right hand seat or used the cut-outs earlier that they would have been successful. However, it does not excuse the fundamental design defects. In actual fact, Boeing could have easily prevented any uncertainty created by unreliable AoA through additional training automation and notification. There is no excuse for the design defects.
Further, much has been made of additional pilot training or improved memory items, QRH etc. Unfortunately, it is trying to close the stable door after the horse has bolted. The existing MCAS system will never be used again and any training or manuals will be based on a substantially different systems. Really all the focus at this stage must be on correcting the design defects... any manuals and training will fall from the new systems and will hopefully learn from the inadequacy of the previous systems and training.
I look forward to learning exactly how the MCAS electric trim system worked and how the situation will be resolved. One of the issues that I would like to further understand is why the pilots only appeared to make shortly electric trim corrections when it seemed likely that they would be trying to make large corrections. The FDR trace combines MCAS and electric trim... it is therefore uncertain what the thumb switch position was in.
Would permanently holding the thumb switch for nose-up, override AND from MCAS? Does MCAS cyclically override the thumb switch input in the 10s 5s cycle that requires further release and activation of the thumb switch. ie is the Boeing Ops Manual Bulletin TBC-19 entirely accurate... namely:
In the event of erroneous AOA data, the pitch trim system can trim the stabilizer
nose down in increments lasting up to 10 seconds. The nose down stabilizer trim
movement can be stopped and reversed with the use of the electric stabilizer trim
switches but may restart 5 seconds after the electric stabilizer trim switches are
released.
If this is true then it would be possible (not desirable) to use electric trim to override MCAS without using the cutout switches. MCAS could be interrupted and corrected every time it kicked in. I suspect it is not entirely accurate... I wonder if anyone has an authoritative answer? None of this excuses MCAS remaining active with unreliable AoA information.[/Q
Good explanation of MCAS story up to date
737 MAX - MCAS