Originally Posted by
PiggyBack
I am not a pilot so my view may not be correct but I do design systems with functional safety requirments and I profoundly disagree with this. A system which cannot tolerate a single fault without entering a dangerous state which requires prompt action to prevent a catastrophe is not safe paticularily when at least one of the failures can occur in a high workload situation, must be responded to within a time limit and will generate misleading and distracting warnings. I am confident that I and all the teams I have worked in would have anticipated this would cause problems and would not have considered it an acceptable design.
Yes we are all human and may overlook failure modes with common causes or fail to understand complex interactions between sub-systems but this was just straightforwardly poor design which should have been identified as such.
The idea that Boeings big mistake was 'to underestimate the public and to some extent the industry's interpretation of two failures' is shockingly callous given the death toll and relatively small timespan. As far as we know the scenario concerned has occured three times and only been survived once and then perhaps a little fortuitously.
There are many systems on an aircraft where one failure can cause entry to a "dangerous state".
MCAS was designed to be easily disabled by simply trimming the aircraft. There is no prompt action required. All that is need is for the pilot to FLY THE AIRCRAFT just as they were taught in their very first lesson.
ATTITUDES and MOVEMENTS
Pilots are taught to always control the aircraft and to TRIM the aircraft to maintain that control. If the aircraft is not doing what you want it to, it is up to the pilot to MAKE it happen.
The MCAS "problem" is just a form of un-commanded or un-wanted trim. In addition to being a memory item, it is also just common sense to disable a system that is not performing correctly. In this case MCAS was causing nose down trim. If repeated nose up trim did not stop the unwanted nose down trim, turn off the electric trim.
Problem solved.
You can't really blame Boeing any more than you can blame Airbus for not predicting that the AF447 crew would forget that you need to lower the nose to unstall an aircraft, or that Airbus had designed the side sticks so that they cancel each other out.