Originally Posted by
Speed of Sound
Why in god’s name was this offered as an optional extra?
The AoA indicator was the option, not the disagree warning. The disagree warning was supposed to be standard. It was a mistake, due to be fixed in the next update. It was not considered serious enough to warrant a special release for just that.
Comes back to the FHA/FMECA and the criticality of the AoA sensor, MCAS, and a host of other systems.
Originally Posted by
Peter H
Naively as SLF I assumed that this would be identified by some sort of dependency-tree analysis at design-time, and their occurrence identified and prevented if possible, or at least allowed for in operating procedures.
FHAs/FMECAs only look at single faults. They do look at how that fault propagates through the system, though it is up to humans to determine the likelihood of a given fault and how critical the effects are.
What they don't do is look at multiple faults. There are just too many possible combinations.
Just like exhaustive testing is impossible (at least impractical) on complex systems.