Originally Posted by
tdracer
The entire problem with MCAS started early in the design process were the malfunctioning of MCAS (either erroneous activation or failure to activate when needed) was judged to be "Major"
…
(BTW, apparently those who made that judgement also assumed that the flight crews would be told about and trained with regard to MCAS, but somewhere along the line that requirement was dropped).
Now, if someone had really sat down and thought about it … they might have realized that MCAS malfunction was at least Hazardous - but that obviously never happened prior to the first MAX crash.
This points to a hole in the safety process. It's there, without getting into how I know it's there (non-attribution and all that).
The engineers that make changes are the ones that determine if safety needs to look at those changes. Often those engineers don't understand d how their changes impact the larger system, yet the process relies on them at least suspecting it could impact safety in order to bring it to the attention of others.