Originally Posted by
bill fly
So when designing on probabilities of failure, it isn’t enough to examine a single system or to presume that everything else in the cockpit is normal. Some basic design rules need looking at here.
Bill, there is much suggestion this wasn't a mistaken analysis of the single system failure. On the contrary, it was a deliberate decision, for purely financial motivations to go against all established engineering philosophy and deliberately make it a single sensor system to avoid customer airline training costs. This process was enabled by the system of Authorised Representatives (AR) - Boeing employees who certify on behalf of the FAA that the design complies with the rules. Can you imagine the immense pressure on the Boeing AR to certify the MCAS in this configuration? Upton Sinclair prophetically once wrote "It is difficult to get a man to understand something, when his salary depends upon his not understanding it!".
Nothing in this MCAS certification process was accidental or missed, the only exception was the gross underestimation of the chance of the active AoA vane failure or damage. Boeing senior management appears to have come to believe the MCAS would never be seen in the wild, therefore they could get away with it. A certification hack, for a certification problem. That assumption came with tragic loss of life, and in time, enormous costs.