3 ms·

Really, flying by instrumentation is what you're saying is the problem and that's the truth. There's no way around that though. I did read that the sensor for t

Really, flying by instrumentation is what you're saying is the problem and that's the truth. There's no way around that though. I did read that the sensor for the MAX is on both sides but is only activated on the side of who is flying, the pilot or the co-pilot. If the sensor fails, the plane fails. They could at least have both sensors active as a failsafe in case one is acting up.

cperciva 8y ago
I don't think it's quite that simple. In the case of the Lion Air flight, one of the AoA sensors had been recently replaced due to problems on an earlier flight; in the case of the Air France flight, there were icing conditions which were known to affect the airspeed sensors. It's possible that both of those flights could have been saved given better awareness of how much those sensors could be trusted at the time -- for example, if Lion Air's engineers, upon fiddling with AoA sensors, had been able to tell the avionics systems "the AoA sensors might be unreliable; don't do anything automatically based on those sensors which might crash the plane".
- laydn 8y ago
  It is difficult to understand the design decisions made on these complex software systems without any real domain knowledge, but one can't help but wonder whether this whole MCAS system is pushed into the field prematurely. For example, we know that the flight control computer has access to altitude information. Why would it let the MCAS push the nose down, when it knows that you have very little altitude margin? (I am talking about the Lion Air flight).
  - sokoloff 8y ago
    Preventing a stall at low altitudes is arguably more important than preventing one at high altitudes. The MCAS is a compensation for extra powerful engines. Those engines are most powerful at low altitudes as well.
    - laydn 8y ago
      That is correct, but remember that the aircraft wasn't stalling, the AoA sensor was bad.
- xeromal 8y ago
  I think the problem is that this whole automatic system is to prevent crashes because the engines change how the plane behaves compared to a normal 737 which is the training Boing was trying to avoid in the first place. So for them to turn off the automatic system, they really need to be training on how to fly this variant of the 737.
Johnny555 8y ago
If the sensor fails, the plane fails I don't believe that's true - if the sensor gives an erroneous reading, it's up to the pilot to recognize uncommanded trim and disable it by shutting off power to the system that moves the stabilizer. Really, flying by instrumentation is what you're saying is the problem and that's the truth Flying by faulty instruments is clearly bad, but flying by (working) instruments is much better than the alternative, every pilot going through instrument training learns very quickly that he needs to trust the instruments when flying in poor visibility, his senses don't work. They could at least have both sensors active as a failsafe in case one is acting up If you have two sensors and one is acting up, how do you know which one is true and which one is false?
- yetihehe 8y ago
  > If you have two sensors and one is acting up, how do you know which one is true and which one is false? Typically it is possible to determine this by looking at reading stability. If one sensor is constantly stuck or changes values too fast (0-100% several times per second) or too slow, you know it's faulty. Those sensors should be engineered so that you can know if it's faulty. If you can't detect faulty sensor, it's just bad engineering.
  - Johnny555 8y ago
    If you have 2 sensors, how do you reliably detect that one of them is bent or installed incorrectly and gives an inaccurate, but stable, reading? If the sensor is completely malfunctioning it's easier to detect, but what about when it's just wrong?
    - yetihehe 8y ago
      > how do you reliably detect that one of them is bent or installed incorrectly During standard pre-launch or manufacturing tests. It should be verified by applying some change and checking that this change is measured correctly. Generally for critical sensors, you can add some circuitry or even mechanical means of checking (eg heater on temperature sensor). If mechanical side fails, whole sensor module is marked as failed. Critical sensors should be designed in a way that you know when it fails.
epse 8y ago
Usually, with things like airspeed indicators for example, there are two sensors, one on each side which get activated depending on who is flying, like you said. However with airspeed for example they are supposed to monitor the difference in reading and if one sensor goes faulty the system should switch over. Why that doesn't happen with these sensors I have no clue

cperciva 8y ago

I don't think it's quite that simple. In the case of the Lion Air flight, one of the AoA sensors had been recently replaced due to problems on an earlier flight; in the case of the Air France flight, there were icing conditions which were known to affect the airspeed sensors. It's possible that both of those flights could have been saved given better awareness of how much those sensors could be trusted at the time -- for example, if Lion Air's engineers, upon fiddling with AoA sensors, had been able to tell the avionics systems "the AoA sensors might be unreliable; don't do anything automatically based on those sensors which might crash the plane".

laydn 8y ago
It is difficult to understand the design decisions made on these complex software systems without any real domain knowledge, but one can't help but wonder whether this whole MCAS system is pushed into the field prematurely. For example, we know that the flight control computer has access to altitude information. Why would it let the MCAS push the nose down, when it knows that you have very little altitude margin? (I am talking about the Lion Air flight).
- sokoloff 8y ago
  Preventing a stall at low altitudes is arguably more important than preventing one at high altitudes. The MCAS is a compensation for extra powerful engines. Those engines are most powerful at low altitudes as well.
  - laydn 8y ago
    That is correct, but remember that the aircraft wasn't stalling, the AoA sensor was bad.
xeromal 8y ago
I think the problem is that this whole automatic system is to prevent crashes because the engines change how the plane behaves compared to a normal 737 which is the training Boing was trying to avoid in the first place. So for them to turn off the automatic system, they really need to be training on how to fly this variant of the 737.

Johnny555 8y ago

If the sensor fails, the plane fails I don't believe that's true - if the sensor gives an erroneous reading, it's up to the pilot to recognize uncommanded trim and disable it by shutting off power to the system that moves the stabilizer. Really, flying by instrumentation is what you're saying is the problem and that's the truth Flying by faulty instruments is clearly bad, but flying by (working) instruments is much better than the alternative, every pilot going through instrument training learns very quickly that he needs to trust the instruments when flying in poor visibility, his senses don't work. They could at least have both sensors active as a failsafe in case one is acting up If you have two sensors and one is acting up, how do you know which one is true and which one is false?

yetihehe 8y ago
> If you have two sensors and one is acting up, how do you know which one is true and which one is false? Typically it is possible to determine this by looking at reading stability. If one sensor is constantly stuck or changes values too fast (0-100% several times per second) or too slow, you know it's faulty. Those sensors should be engineered so that you can know if it's faulty. If you can't detect faulty sensor, it's just bad engineering.
- Johnny555 8y ago
  If you have 2 sensors, how do you reliably detect that one of them is bent or installed incorrectly and gives an inaccurate, but stable, reading? If the sensor is completely malfunctioning it's easier to detect, but what about when it's just wrong?
  - yetihehe 8y ago
    > how do you reliably detect that one of them is bent or installed incorrectly During standard pre-launch or manufacturing tests. It should be verified by applying some change and checking that this change is measured correctly. Generally for critical sensors, you can add some circuitry or even mechanical means of checking (eg heater on temperature sensor). If mechanical side fails, whole sensor module is marked as failed. Critical sensors should be designed in a way that you know when it fails.

epse 8y ago

Usually, with things like airspeed indicators for example, there are two sensors, one on each side which get activated depending on who is flying, like you said. However with airspeed for example they are supposed to monitor the difference in reading and if one sensor goes faulty the system should switch over. Why that doesn't happen with these sensors I have no clue