Originally Posted by
MechEngr
Are false alarms are OK? Wasn't it the startle effect from the false alarm that caused the ET302 crew to ignore that full thrust remained as the plane exceeded the velocity envelope? Wasn't it the false alarm that forced the autopilot to go offline and allow MCAS to operate?
I prefer to focus on the origin of the problem and not the edge of the last chance to correct it.
1) Why wasn't the autopilot software designed to choose the correct AoA sensor? 2) Why when it went off line didn't the autothrottle also go off line? These are also decades old decisions. 3) Why is the AoA sensor not fail-safe? But, sure, multiple decades of depending on all these bad ideas.
Very much agree with the first paragraph, but based on what you post here normally, I am not sure if your last paragraph is as clear as you normally are...
1) How can the AP decide what is the correct one if there is two inputs that are different from each other? You need 3 AOAs to vote, or another input like AHRS attitude and GS to rule out the faulty one (currently being studied (implemented?) by Boeing)
2) If the AT had gone offline, it would not have reduced power either. If anything, the AT could have had a function to automatically reduce thrust in an overspeed. (like the A320 has had for 3+ decades for underspeed)
3) What do you mean by fail-safe? How would it know the data it provides is incorrect without being able to compare to other data?
But yes. You are totally correct the B737 design is decades overdue for a systems and cockpit design change. The B737NG was launched 10 years after the A320, over 25 years ago. The A320 has mostly triple sensors that vote, or let the pilot make a more informed choice about what is the correct one, (can still go wrong, look at the crash of the
Airbus in Perpignan, where 2 of the 3 sensors were wrong).
The 737NG still makes mostly do with 2, and when 1 breaks, it is up to the pilot to decide. Add the non-cancelable stick-shaker, stall warning and overspeed warning for some AOA faults for some added confusion in the cockpit.
The MAX was the last chance for Boeing to get it right, but they didn't. And the MCAS system, borrowed from the KC-46, initially for high altitude flight characteristics, and later put on steroids for low and slow flight was just the rotting cherry on that already moldy cake. In the KC-46 MCAS takes info from both AOAs. In order to prevent extra training due to the comparator annunciation that came on if there was a difference between the two AOA inputs into MCAS, Boeing decided to do the wrong thing, and make the MCAS single source. It would only be getting the info from 1 AOA, alternating between legs (power cycles). It was a deliberate design choice, to save money, and we know from the confirmed 3 flight that happened in that condition (failed AOA feeding into MCAS) that the first one almost crashed, and the other two ended with a crash.
Some false alarms are inevitable, and every effort should be made to design them out, and make it easy to diagnose and rectify.
But the MCAS part of the story isn't so much about the false alarm IMO. It is about Boeing deliberately stepping backwards in an already outdated design.