SHAME ON BOEING AND THE FAA.
Even a “humble” turboprop like the ATR constantly averages BOTH AoA values and self disables if mayor disagreement.
From the final report:
"……the design of MCAS relying on input from a single AOA sensor, made this Flight Control System susceptible to a single failure of AOA malfunction.
During the accident flight, the scenario was initiated by a single failure, a high bias in AOA sensor. This high bias resulted in several aircraft level effects including stick shaker, erroneous airspeed and altitude displays and MCAS….
The MCAS software uses input from a single AOA sensor only. Certain failure or anomalies of the AOA sensor corresponding to the master FCC controlling STS can generate an unintended activation of MCAS
The MCAS software uses input from a single AOA sensor only. Certain failure or anomalies of the AOA sensor corresponding to the master FCC controlling STS can generate an unintended activation of MCAS. Anticipated flight crew response including aircraft nose up (ANU) electric trim commands (which reset MCAS) may cause the flight crew difficultly in controlling the aircraft.
To incorporate MCAS, the basic column cutout function had to be inhibited during the MCAS activation. Pulling back on the column normally interrupts any electric stabilizer aircraft nose-down command, but for the MAX with MCAS operating, that control column cutout function is disabled.
The aircraft design should not have allowed this situation. The flight crew should have been provided with information and alerts to help them understand the system and know how to resolve potential issues. Flight crew procedures and training should be appropriate. The aircraft should have included the intended AOA
DISAGREE alert message functionally, which was installed on 737 NG aircraft.
Boeing and the FAA should ensure that new and changed aircraft design are properly described, analyzed, and certified.
The MCAS function was not a fail-safe design and did not include redundancy. A single failure to the AOA sensor corresponding with the FCC commanding STS resulted in erroneous activation of MCAS.
the design of MCAS relying on input from a single AOA sensor, made this Flight Control System susceptible to a single failure of AOA malfunction.
Since the FCC controlling the MCAS is dependent on a single AOA source, the MCAS contribution to cumulative AOA effects should have been assessed.
The MCAS software uses input from a single AOA sensor only. Certain failures or anomalies of the AOA sensor corresponding to the master FCC controlling STS can generate an unintended activation of MCAS.
The MCAS architecture with redundant AOA inputs for MCAS could have been considered but was not required…
If the uncommanded MCAS failure condition had been assessed as more severe than Major, the decision to rely on single AOA sensor should have been avoided.
MCAS was designed to rely on a single AOA sensor, making it vulnerable to erroneous input from that sensor.
UPDATES TO THE MCAS (TOO LATE FOR THE VICTIMS. SHAME ON BOEING AND THE FAA).
• THE FLIGHT CONTROL SYSTEM WILL NOW COMPARE INPUTS FROM BOTH AOA SENSORS. IF THE SENSORS DISAGREE BY 5.5 DEGREES OR MORE, MCAS WILL NOT ACTIVATE."