Originally Posted by
Water pilot
Boeing appears to be blundering around trying to retrofit a fly by wire system onto an ancient design, and are facing enormous pressures to do it cheaply and quickly. The MAX program has a history of apparently compromising safety in favor of cost and time. What could go wrong?
The problems that MCAS was intended to solve have not been well documented, Boeing has been a little close with the details of the problems with the flight envelope that required such a dramatic departure from their "the pilot flies the plane" philosophy of the 737. "We use software to make the flight characteristics conform to spec" may be a valid approach to aircraft design but you had better be damn sure that the software and the sensors that it relies upon are bulletproof, and certainly the sensors are not there with the current state of the art. Using just two sensors will never be acceptable; three sensors with a voting protocol is the current state of the art but three sensors of the same type can suffer from correlated errors (such as the icing that initiated the events that brought down AF447.) So not retrofitting a third sensor is the first safety compromise with the proposed fix.
The proposed fix involves disabling MCAS and limiting its authority. All well and good, perhaps, but now we have a plane where the elevator feel can change based upon a random event. In at least some cases, MCAS will be disabled without informing the pilot. This is arguably worse in some ways than the original behavior; even the "golden hands" pilots are going to be thrown off if suddenly the flight characteristics of the good old 737 that you are flying become something quite different. Imagine that your car suddenly changes the amount of authority that the brake pedal has; you attempt to slow down and the brakes lock up. OK, you figure that out and hit the brakes very lightly the next time, and then the car doesn't slow down. Now make this happen on an icy road at night...
T
So it is a mess. It would be better to figure out how to engineer away the differences between the 737 NG and the 737 MAX without relying on software and sensors, or at least get it close enough. Obviously that won't be easy or they would have chosen that approach in the first place.
Surely more difficult than merely the control feel issue.
Other reporting indicates there was also an issue at low speeds, which is why the MCAS authority was quadrupled and its activation envelope expanded. So no MCAS means wonky low speed behavior, not an appealing prospect for low time pilots.
Boeing may be able to provide a set of software and sensor upgrades that provide reasonable assurance of reliable operation, but the regulators overseas will need convincing. Not easy after this debacle.