PPRuNe Forums - View Single Post - How Boeing lost their way
View Single Post
Old 25th Nov 2019, 11:49
  #53 (permalink)  
infrequentflyer789
 
Join Date: Jan 2008
Location: uk
Posts: 806
Originally Posted by DingerX View Post
This is already a classic study. The engineers are handed a series of hard parameters and told to come up with something. Their solution is brilliant: develop a system by tapping into an existing system; normally, this would cause a huge problem, since the existing system wasn't built for that, and, in effect, you're relying on a single sensor input to move a secondary flight control, but, hey, with small adjustments that can easily be overridden manually and countered by primary flight controls, that's not a problem. So it passes the regulatory hurdle. Then in testing, surprise surprise, we're going to need more authority. Well, you know safety, in for a dime, in for a dollar..
Your classic study may need a few accuracy tweaks (or your recollection of thread history may be more accurate than mine :-) ):
1. MCAS was an existing system taken from another aircraft (KC-46) - this meant it did not need to be certified as "new or novel" (see JATR).
2. That existing system had dual AOA input.
3. Even after they removed the other AOA input, it was still not single-sensor dependent because it was triggered on both AOA and g conditions.
4. It wasn't just "more authority" required after flight testing, it was also removal of the g sensor condition
5. Don't forget, after removing the g condition, and increasing the authority of the system, don't bother reviewing the safety case for the system in case you turn up anything that might impact schedule...

As to "who did this" I'd start with those who said this design would fly right except in wind-up turns, way before it was actually built, and then those who said nothing when flight tests showed it didn't - that was the moment the cord should have been pulled and the whole program reviewed to determine (a) how we got it wrong (b) what else we might have got wrong knowing (a) and (c) how do we fix it properly (not just whack up the gain and remove a sensor from an existing system and call it safe because it was assessed as safe before). Six months delay to the MAX wouldn't have hurt anywhere near as bad as what's happened since.

infrequentflyer789 is offline