Originally Posted by
tdracer
I've posted this before, but some either didn't see or have forgotten:
The certification process groups failures into four categories - Minor, Major, Hazardous, and Catastrophic. These have associated acceptable probability numbers - 10-3, 10-5, 10-7, and 10-9 per flight hour, respectively (occasionally modified to per flight cycle).
The entire problem with MCAS started early in the design process were the malfunctioning of MCAS (either erroneous activation or failure to activate when needed) was judged to be "Major" - Major is considered to be no big deal, readily handled by the crew with a moderate increase in crew workload (I'm quite familiar with Major since most 'benign' engine failures are considered 'Major')
Since 'Major' failures are allowed to occur at a rate of 10-5/hour, redundancy is not required (BTW, apparently those who made that judgement also assumed that the flight crews would be told about and trained with regard to MCAS, but somewhere along the line that requirement was dropped).
Now, if someone had really sat down and thought about it - what the impact of a bad AOA sensor activation MCAS along with all the other bells and warnings that would be going off (stick shaker, unreliable airspeed, etc.) they might have realized that MCAS malfunction was at least Hazardous - but that obviously never happened prior to the first MAX crash. So the certification process for MCAS followed the (correct) process for a "Major" system. Now, if someone along the line realized that MCAS was worse than Major and withheld or hid that information - that's fraud and someone should be prosecuted for it. But if it was all an honest mistake - it's just that, a horrible, tragic, mistake, but humans design aircraft and humans make mistakes. I have it on good authority that there was at least one attempted suicide among the people who worked MCAS. These were not cold-blooded accountants that made these decisions - they were real, flesh and blood humans with feelings that made a horrible mistake. Was management pressure to keep things simple and 'on the cheap' a factor? Perhaps, but I know that I often experienced those pressures, and it never made me do or design something that I honestly believed was wrong.
Your level of knowledge of certification is not something I will ever approach. But either the KC-46 was over engineered/certified having dual channel MCAS and a comparator annunciator, or corners were cut with the MAX, when they made it single source. And they definitely made it single source to avoid training and the associated cost. Maybe they thought is was safe enough, but they would have known that is was less safe, and cheaper.......