> (1) Add a third AoA sensor, with voting among them.

Interestingly enough, poor software 'voting' was one of the things that lead to Qantas' A330 suddenly diving downwards mid-flight a few years back https://en.wikipedia.org/wiki/Qantas_Flight_72

> In the usual case, when all three AOA values were valid and consistent, the average value of AOA 1 and AOA 2 was used by the FCPCs for their computations. If either AOA 1 or AOA 2 significantly deviated from the other two values, the FCPCs used a memorised value for 1.2 seconds. The FCPC algorithm was very effective, but it could not correctly manage a scenario where there were multiple spikes in either AOA 1 or AOA 2 that were 1.2 seconds apart.

They never did actually determine why the sensor data was corrupted.

Afaik FAA does cannot certify anything because the engineers are all hired by the manufacturers because they pay much better. The FAA can just trust the manufacturers (more details here: https://spectrum.ieee.org/aerospace/aviation/how-the-boeing-...).

Behind paywall. Here's an investigative piece from 2016 on Boeing engineers representing the FAA:

https://www.aljazeera.com/news/2016/06/regulators-complain-u...

It's interesting to add a disagree warning.

I wonder how many of those there are currently. When I read crash reports (granted this is a very specific group of reports that don't apply to every day flight) it is interesting how often there are "too many / confusing alarms" and at the same time the fundamental instrument "disagreement" is sometimes not one of those alarms. Often in those reports a pilot(s) simply didn't recognize the instrument "disagreement" and / or didn't know what to do when that type of situation occurs (granted some in the reports were proven to be poor pilots and so I'm not generalizing about all).

I don't know if it would really help to have those types of alarms too as a misbehaving instrument often has it's own alarm due too, sometimes even the "right" one goes off too ... granted considering the situation with this aircraft it might be a different situation and worth adding even as a one off.

Lots of complicated decisions.

The thing I find interesting is that even in the military, people who fly planes frequently are selected for their ability to fly the plane over understanding the plane.

Which generally works fine up until your design becomes so complex the pilot can't reliably map control/environmental inputs to plane behavior/outputs.

Given this natural limitation, I find it interesting we keep escalating avionics complexity beyond the point a pilot can reasonably model the plane mentally. In fact, I'm surprised we've gone the route of doing away with flight engineers entirely in day-to-day operations. I get the attractiveness in cost savings, but you're just running into too much information to parse while simultaneously having to fly the plane. It's two completely different mental regimes that eventually will start to interfere with each other.

But hey that's the market for ya. Local optimization or bust right?

I know little about flying, so I'm not sure if this would be useful, or even if it's done already, but I wonder if it isn't possible to arrange the flight warnings/alarms into some kind of heirarchy or order them by priority?

> (5) Have the whole thing re-certified - by FAA, not by Boeing itself.

I don't think that the rest of the world will trust the FAA on this anymore.

I think this is about right. (1) and (5) will be really costly -- enough that a fine may not be necessary as such, but still, set a minimum total cost, and if they don't exceed that then the balance must be paid as a fine, that way Boeing has a decent incentive to spend that much money fixing the problems correctly.

(3) is obvious once you accept (2) and (4).

(2) and (4) would have been very cheap by comparison to the cost of all the above. Even all of the above would have been much cheaper done up front than it will be now.

What about

(6) Investigate how the decision of letting unsafe flight was made.

(7) Anyone who signed off on the aircraft would be reprimanded or go to jail for some time.

I'm not trying to get blood sacrifice out of this, but thus far the story seems like corporate malfeasance and somehow with 300+ dead there is no talk of anyone who signed off on the project being held responsible.

Totally agree. Punishing people has some value as a warning to others, but it's secondary here. The primary point IMO is that the people who made or signed off on these decisions have proven themselves unsuited to those roles. The most important thing is to get them out of those roles, so that people who have the right priorities or temperament can be moved in.

I'd add to that having a cutout that disabled just the MCAS system from the electronic trim system. It seemed part of the problem in the crashes was that after the MCAS applied it's huge trim the forces were too high to manually recover so they turned the trim back on and MCAS started forcing the dive again.

Would it be possible to completely remove MCAS, and simply train pilots that this version of the plane stalls more easily? Stalls are a known phenomena that all pilots are very competent to manage.

If I understand correctly, no. Once you cross a threshold, it takes less and less force on the controls to move you closer and closer to a stall. That's completely not acceptable, with or without training.

Yes. That works great. There are however two troubles:

1. it would definitely be a different aircraft with different training

2. the more-difficult flight behavior is prohibited for commercial passenger planes

> Add a third AoA sensor

Ignorant question time. Why stop at 3? Why not 5? Why not more? If the plane literally crashes when they mess up, and apparently they mess up somewhat frequently, wouldn’t you want a lot of them? And then implement voting across all of them? Are they incredibly expensive or incredibly big or something?

Depends on the failure rate of the AoA indicators, but this seems like a reasonable question based on the current rate of failure. At least 2 failed in ~10,000 flights, so you'd expect simultaneous unrelated [0] failure roughly every 10,000,000 flights. There are 100,000 scheduled flights a day worldwide, so that's 3 catastrophic crashes a year if those were all 737s.

That seems a bit too high for comfort, but if they got another order of magnitude of reliability on the AoA sensor it would be OK. Alternatively, they can reduce the incident severity so that everyone doesn't die when the sensors fail.

[0] If there are multiple related failures, on the other hand, adding redundant sensors doesn't fix that.

I think that each AOA sensor has consequences. It's a bit of additional weight, it's a bit of additional drag, it's another hole through the skin of the plane that has to remain relatively sealed, it's another item to maintain.

While in principle more is better, in practice it doesn't always work that way.