Originally Posted by
GlobalNav
I believe the notion that an AOA Disagree alert would have helped pilots deal with the accident scenarios is not valid. Pilots were unaware of the MCAS, therefore unaware of what causes it to trigger, or even that it had triggered. Making such a cognitive connection between AoA and the failure mode is highly unlikely.
I also believe that the notion of solving the problem with a software fix does not pass muster. The consequences of this failure mode are clearly catastrophic, and requires the type design to make its occurance extremely improbable. Of course using a single AoA sensor as input is insufficient because the probability of malfunction is on the order of 10E-5. Even using two sensors is hardly sufficient and could software fill the gap? Hardly. Considering that such a failure was not foreseen for the initial MAX certification, I wonder if it’s design assurance level is better than B, when it really needs to be A. If not, a lot more than coding changes is needed to make it so.
The statements made by Boeing are that the inputs from both AOA are now used and MCAS failed if AOA disagree. It is not just a software fix.