AvWeek ( https://aviationweek.com/air-transport/ ... -third-aoa
) has some extended comments from EASA's Patrick Ky from the same event:
Among FAA-mandated changes Boeing made to the MCAS is ensuring the two sensors compare readings and are within 5.5 deg. before triggering nose-down stabilizer inputs. The third sensor required by EASA will independently calculate a reading to supplement the two existing ones, Ky said. In the meantime, EASA will approve operational protocols that allow pilots to safely manage a scenario where the two sensors disagree significantly.
“This was one of the essential criteria for us, that we have confidence in the fact that one sensor breakdown does not lead to a catastrophe,” Ky said. “My pilots and safety analysts all said that what was planned as a provisional measure for the coming two years was easy enough in terms of security.”
“We spent an enormous amount of time looking at this problem,” Ky added. “It is not so much the number of probes which is important but more the probability that if one of both of the sensors give incorrect information that would spark a catastrophic chain of events.”
It seems EASA did spend a lot of time going through the exercise of figuring out exactly what procedures to follow when one of the two AoAs is faulty, which is a good thing.
He also reiterated the need to be able to disable the stick shaker, as has several pilot's unions.
I found it very interesting that he emphasized EASA has re-certified
MAX's flight controls and information about altitude and speed:
The European agency’s insistence on ensuring multiple failure scenarios were either manageable by pilots or improbable enough to present risks helped expand Boeing’s work beyond the MCAS software into other areas. Runaway trim scenarios figured prominently, prompting extensive analysis of how much time pilots have to respond, and the difficulties presented by the last-ditch step of using a manual trim wheel to move the stabilizer.
“We worked very hard on our side to insist on independently re-certifying all the elements we considered critical,” Ky said. “We have recertified all the flight controls, including information about altitude and speed. That made for a number of difficulties with our Boeing and FAA colleagues as we were going beyond simply correcting the contributing factors. If we had listened to the FAA and Boeing we would have settled for making modifications to the MCAS which was the contributing factor for both accidents.”
By independently re-certifying MAX's flight controls and information about altitude and speed and ensuring that multiple failure scenarios are either manageable or very improbable, EASA is all aboard with MAX meeting all relevant regulations even though it does not have EICAS.
It seems all this extra scrutiny has improved safety without noticeably stretching the RTS time line, other than maybe a week or two for EASA's flights.
They apparently did get Boeing to agree to a third AoA source but apparently Boeing has two years to deploy a solution.