Not that 3 hours of simulator training would have helped in either crash. The problem wasn't that the ipad course was inadequate training for the new procedures (as he said there were no major procedural differences), but that any mention of MCAS had been removed from the manual to avoid needing new or modified procedures.
Even worse, MCAS was designed to be near-impossible to override, using data from only one sensor, to avoid the need for procedural changes.
Not to defend Boeing or the folks in these messages in any way, but as I understand it MCAS initially was making use of multiple sensors. It was changed at one point to only use 1[1]. It would be important to know the timing of these messages relative to the development.
Another _unverified_ thing I heard was that initially MCAS would only be able to issue a single nose down command, and was later modified to be able to issue multiple.
From what I understand, the decision to change it from using 2 sensors to 1 sensor was specifically because if the system used 2 sensors it was considered a safety system requiring simulator training for the failure scenarios.
IMO Boeing should be required to separate the military and civilian parts of the company and allow the military side to build civilian aircraft based on existing civilian models. I honestly think it's the only way to save the company, because right now airlines, regulators, pilots and passengers do not trust the current incarnation of Boeing. With their shady culture, we don't know what else is hiding in the airplane. Culture issues aren't solved overnight.
I fly a lot of miles and am the type of person who keeps the airlines in business, and I will not fly on a 737 MAX for the foreseeable future. My coworkers are in the same boat. I don't see the American carriers being able to return these planes to service before 2022. This is absolutely an existential threat to the US aviation industry, and I think the only solution is to split Boeing up.
What’s worse is that we will lose trust in FAA as they still allow for a single non-redundant sensor.
At this point FAA should require minimum 2 sensors for something like MCAS which can crash they plane. This should be without regard to any prior certification of the planes.
I think the FAA does require a minimum of 2 sensors for safety systems -- Boeing intentionally lied to hide the true purpose of MCAS from the FAA in order to make the planes easier to sell.
I don't disagree, but I don't think you can find a single person who is fully responsible for the failures. This was an institutional failure caused by a combination of regulatory capture and erosion of the firewall between sales and engineering.
> Another _unverified_ thing I heard was that initially MCAS would only be able to issue a single nose down command, and was later modified to be able to issue multiple.
My understanding is that it was never limited to one command.
Instead, all their failure analysis was based on the assumption the pilot would correctly identify the problem immediately after the first activation and follow the runaway stabilizer checklist (disabling all electric trim) before the second activation could occur.
Also in the emails, a discussion about renaming MCAS to make it seem like it was just a tweak to existing control software, rather than a new feature needing documentation and training....
Oh yeah, that was interesting. They were renaming it to be part of the Speed Trim System, with the MCAS name used only internally. After doing some looking, apparently the STS is a system on all 737s that adjusts the stabilizer in order to increase the stick force. This is necessary to ensure the plane meets the FAR speed stability requirement for the minimum increase in stick force as the plane moves away from the current speed. It does this by moving the stabilizer in a way that opposes the flight stick input, and is active 5 seconds after the last manual trim input when autopilot is off. If you've been following the discussion of MCAS, all of those details are probably feeling awfully familiar...
Not that 3 hours of simulator training would have helped in either crash. The problem wasn't that the ipad course was inadequate training for the new procedures (as he said there were no major procedural differences), but that any mention of MCAS had been removed from the manual to avoid needing new or modified procedures.
Even worse, MCAS was designed to be near-impossible to override, using data from only one sensor, to avoid the need for procedural changes.