Re: 2 big no-no's - if it's Boeing, I am NOT going!
"To your second point, it's actually even worse than just fail-safe: If I read the reports correctly, the two-sensor configuration was sold as an extra-cost option; the standard configuration had a single sensor, with no failover capability at all. Set negligence level to "criminal stupidity with a side order of arrogant avarice."
My understand is that all 737's have had two AoA sensors - before the 737MAX they were effectively unused. This appears to have led Boeing to believe the sensors are more reliable than they actually are.
In addition, most 737MAX's shipped with status indicators for the AoA's and western pilots were aware (trained? it's not clear why some pilots knew how to handle a fault that has happened significantly more than the number of crashes indicates) that in the event of a actual or suspected AoA failure to disable MCAS. It appears that the status indicators became an option at some point - again it is not clear when or why other than speculation around cost.
So the issues appear to be:
a) a design fault in MCAS in terms of handling AoA information during AoA faults
b) a misunderstood or under-designed system with the AoA sensors and their reliability
c) a reluctance to retrain pilots in the correct operation of the 737MAX's (in particular, MCAS)
d) an unclear understanding about the reliance on the AoA status indicators in the operational fleet masking the risks of the first three issues
The first two issues are design issues - it will likely mean Boeing has to certify all future design changes meet current safety standards. Costly, but manageable as it will affect competitors as well.
The third issue is a sales/cost issue - it suggests that Boeing let these decisions outweigh safety concerns. Boeing managements response seems to reinforce this point. Which implies Boeing will be hit by higher levels of regulation or safety inspections to address this. This is likely to be the area Boeing suffers the most as delays here will result in difficulties meeting customer orders.
The final issue is the one that alarms me the most. Normally pilot feedback on this type of issue would have resulted in swift action, either noting failure/reliability issues with the AoA sensors or noting the impact a failure had on MCAS requiring it to be disabled. Once the Air crash had happened and there were indications it was an MCAS issue, this should have become an even bigger issue. Why is this broken as this should have identified the issue and workarounds (training and equipment) sooner? Are airline safety bulletins etc being used effectively or are they just another area where cost cutting has led to no safety margin in the event of problems, or worse, near misses?
Biting the hand that feeds IT
