Earlier quoted context omitted.
I disagree. The hardware design of the cockpit is intended to be such that any computer inputs also move the pilot's controls, so that the pilots can countermand computer inputs if necessary. In this case, software was written such that this was not possible. The software that operates MCAS operates on a garbage-in-garbage-out model, like most software. There was no software written to determine if the incoming data…
> At the end of the day, if the person who wrote that software had written it differently, then those planes would not have crashed and hundreds of people would not have died. You can't really blame the software engineers. This was all thought out and tightly specified by Boeing to their avionics subcontractor (Collins, IIRC). This is how it was designed and engineered to work at a systems level - it is a design hack…
It's more like buying an expensive car/enterprise software. There are options. Options cost extra....
excerpts from https://www.nytimes.com/2019/03/21/business/boeing-safety-fe...:
As the pilots of the doomed Boeing jets in Ethiopia and Indonesia fought to control their planes, they lacked two notable safety features in their cockpits.
One reason: Boeing charged extra for them.
For Boeing and other aircraft manufacturers, the practice of charging to upgrade a standard plane can be lucrative. Top airlines around the world must pay handsomely to have the jets they order fitted with customized add-ons.
Boeing’s optional safety features, in part, could have helped the pilots detect any erroneous readings. One of the optional upgrades, the angle of attack indicator, displays the readings of the two sensors. The other, called a disagree light, is activated if those sensors are at odds with one another.
Boeing will soon update the MCAS software, and will also make the disagree light standard on all new 737 Max planes, according to a person familiar with the changes, who spoke on condition of anonymity because they have not been made public. Boeing started moving on the software fix and the equipment change before the crash in Ethiopia.
The angle of attack indicator will remain an option that airlines can buy. Neither feature was mandated by the Federal Aviation Administration. All 737 Max jets have been grounded.
“They’re critical, and cost almost nothing for the airlines to install,” said Bjorn Fehrm, an analyst at the aviation consultancy Leeham. “Boeing charges for them because it can. But they’re vital for safety.”
“There are so many things that should not be optional, and many airlines want the cheapest airplane you can get,” said Mark H. Goodrich, an aviation lawyer and former engineering test pilot. “And Boeing is able to say, ‘Hey, it was available.’”
But what Boeing doesn’t say, he added, is that it has become “a great profit center” for the manufacturer.
The three American airlines that bought the 737 Max each took a different approach to outfitting the cockpits.
American Airlines, which ordered 100 of the planes and has 24 in its fleet, bought both the angle of attack indicator and the disagree light, the company said.
Southwest Airlines, which ordered 280 of the planes and counts 36 in its fleet so far, had already purchased the disagree alert option, and it also installed an angle of attack indicator in a display mounted above the pilots’ heads. After the Lion Air crash, Southwest said it would modify its 737 Max fleet to place the angle of attack indicator on the pilots’ main computer screens.
United Airlines, which ordered 137 of the planes and has received 14, did not select the indicators or the disagree light. A United spokesman said the airline does not include the features because its pilots use other data to fly the plane.
When it was rolled out, MCAS took readings from only one sensor on any given flight, leaving the system vulnerable to a single point of failure. One theory in the Lion Air crash is that MCAS was receiving faulty data from one of the sensors, prompting an unrecoverable nose dive.
In the software update that Boeing says is coming soon, MCAS will be modified to take readings from both sensors. If there is a meaningful disagreement between the readings, MCAS will be disabled.