Originally Posted by
MechEngr
The customer drumbeat of "no new training/no new endorsement" was clear.
The Max was supposed to ship with the AoA disagree alert, but it does not appear that it specifically alerts that that's the reason for other systems to be unreliable, nor does it appear to pass that status within the FCC currently in control of the stabilizer trim functions. It's this latter function that is being added to the new software.
https://www.satcom.guru/2018/11/737-...n-command.html description claims that each FCC gets data from both ADIRUs, including AoA data, but that description seems to be about autopilot operations. Other information says that each FCC was dependent on the same-side AoA sensor for handling MCAS when it was their turn. Quite confusing.
Short answer: The autopilot and MCAS are different sub-systems running on each FCC.
The autopilot is a 3-axis system, and demands high integrity data from muliple sensors to operate safely.
MCAS is a subroutine of the speed-trim system, and both operate on a single axis of pitch via the horizontal stabiliser.
IMO this is where things went wrong. Speed trim is a closed-loop system, with limited authority in pitch, and failure is not catastrophic. MCAS was supposed to be closed-loop, but due to AOA failure it became open-loop. It also had larger authority, and unlimited scope.
Thus a safe and trusted sub-system became a monster, due to a combination of hardware error, faulty design, and lack of foresight.