5 ms·

It's bewildering how even 2 would be sufficient. You'd expect some kind of 3 way setup where a single sensor failure is detected via majority quorum. Especially

It's bewildering how even 2 would be sufficient. You'd expect some kind of 3 way setup where a single sensor failure is detected via majority quorum. Especially for anything that directly has the ability to alter control planes on the aircraft.

cjbprime 8y ago
Two seems sufficiently airworthy as long as you warn the pilots that there's a failure they need to consider ("AOA disagree") and avoid control decisions based on the disagreeing system. It appears that the AOA disagree alert exists on the plane but is an optional paid feature (!).
- Rychard 8y ago
  Having optional safety features on an airplane (i.e. not standard equipment) strikes me as being significantly more egregious (Edit: more so than on vehicles like cars/trucks for the general population). Considering how complex these things are already, how does this not unnecessarily increase the cognitive load on pilots? "Oh, I guess I'm flying the basic trim level airplane today, I better be cognizant of the fact that it lacks features X, Y and Z"
  - cjbprime 8y ago
    I agree with you. I think in practise the feature choices are made per-airline, perhaps to avoid the pilot confusion you mention. "AOA disagree" specifically seems to have been purchased by only the North American airlines that use the MAX.
    - CydeWeys 8y ago
      I'm still trying to wrap my head around the fact that an error warning can be an optional paid extra, even when the error being reported is that sensors are malfunctioning in a way that will cause the plane to override stick input and fly itself into the ground.
      - cjbprime 8y ago
        There is some complicated explanation: the AOA disagree alert requires the presence of the visual AOA indicators, and it's those indicators that are the paid upgrade, and the alert comes along for the ride with them.
        CydeWeys 8y ago
        Why would AOA indicators be a paid upgrade? Isn't that a pretty fundamental display needed to safely fly the plane? And wouldn't having disparities here between planes create more confusion among pilots?
        cjbprime 8y ago
        Airlines and general aviation aircraft have totally ignored AoA as a relevant indicator until very recently. You won't find an AoA indicator in even a modern Cessna. As a student pilot you're taught about unsafe low airspeeds instead, even though AoA can technically cause a wing to stall at any airspeed, and even though that memorized stall airspeed ($V_s1$) actually varies with factors like plane weight. AoA is not considered fundamental in commercial aviation, but is considered fundamental in military aviation. Of course, if your commercial aircraft has a tendency towards stall, that changes the calculus on how important AoA is..
        CydeWeys 8y ago
        Thanks for the info. It sounds like commercial aircraft have some catching up to do if this is going to be increasingly important.
        HeyLaughingBoy 8y ago
        AoA is not considered fundamental in commercial aviation, but is considered fundamental in military aviation ISTR that after a carrier catapult takeoff, Naval aviators have 10 seconds for AoA to get into the "green zone." Otherwise it's an automatic eject. Forgot where I read that and if it's only for specific aircraft types, though.
- concerned_user 8y ago
  It is optional on 737NG but not on a MAX.
  - cjbprime 8y ago
    I don't think this is true.
- usrusr 8y ago
  A pilot might fire up that inference engine between his ears and make a very well educated guess when two sensors disagree, based on which one reacts more in line with how it should react to some exploratory control inputs or the recent control history. A control loop cannot do that, it is a stupid fact processor that we prefer to do one simple thing reliably than to venture off on inscrutably deep reasoning adventures. A general flight AI would be an entirely different beast than the arsenal of pilot assistance systems currently employed. And just two sensors, simply disengaging the control loop when they disagree, seem insufficient to me when we deemed the control loop necessary in the first place. And this is the easily overlooked bit here: disengaging the MCAS isn't the final step, then you still need to fly the plane that it's manufacturer did not trust pilots to safely operate unassisted by MCAS. (a general flight AI able to do the sensor trust inference could be an interesting game of adversarial programming though: plug it into a flight simulator, then try to down it with the smallest set of simulated malfunctions and weather) > It appears that the AOA disagree alert exists on the plane but is an optional paid feature (!). Oh, that is just crazy. And considering that a bad safe record is just as damaging for Boeing as for the airline, it doesn't seem particularly clever to leave that choice to the customers. Do you have an easily digestible source for that?
  - cjbprime 8y ago
    It's mentioned briefly in: https://ad.easa.europa.eu/blob/2018-23-51_Emergency.pdf/EAD_US-2018-23-51_1 https://ad.easa.europa.eu/blob/2018-23-51_Emergency.pdf/EAD_..., and it's optional as a consequence of the entire AoA set of visual indicators being optional.
concerned_user 8y ago
It is even worse than that, those 2 are independent each connected to one of the two FMS so the FMS has no idea there is another sensor at all, they are supposed to be alternated between flights. Also there is an indicator somewhere that lights up if AoA sensors are in disagreement but again FMS does not know this. How did this design got approved I have no idea.
dingaling 8y ago
Yes, all Airbus aircraft have at least three AoA sensors. Boeing standardised at two, even on the 787. And one of those is located where it is vulnerable to damage from a jetbridge.

cjbprime 8y ago

Two seems sufficiently airworthy as long as you warn the pilots that there's a failure they need to consider ("AOA disagree") and avoid control decisions based on the disagreeing system. It appears that the AOA disagree alert exists on the plane but is an optional paid feature (!).

Rychard 8y ago
Having optional safety features on an airplane (i.e. not standard equipment) strikes me as being significantly more egregious (Edit: more so than on vehicles like cars/trucks for the general population). Considering how complex these things are already, how does this not unnecessarily increase the cognitive load on pilots? "Oh, I guess I'm flying the basic trim level airplane today, I better be cognizant of the fact that it lacks features X, Y and Z"
- cjbprime 8y ago
  I agree with you. I think in practise the feature choices are made per-airline, perhaps to avoid the pilot confusion you mention. "AOA disagree" specifically seems to have been purchased by only the North American airlines that use the MAX.
  - CydeWeys 8y ago
    I'm still trying to wrap my head around the fact that an error warning can be an optional paid extra, even when the error being reported is that sensors are malfunctioning in a way that will cause the plane to override stick input and fly itself into the ground.
    - cjbprime 8y ago
      There is some complicated explanation: the AOA disagree alert requires the presence of the visual AOA indicators, and it's those indicators that are the paid upgrade, and the alert comes along for the ride with them.
      - CydeWeys 8y ago
        Why would AOA indicators be a paid upgrade? Isn't that a pretty fundamental display needed to safely fly the plane? And wouldn't having disparities here between planes create more confusion among pilots?
        cjbprime 8y ago
        Airlines and general aviation aircraft have totally ignored AoA as a relevant indicator until very recently. You won't find an AoA indicator in even a modern Cessna. As a student pilot you're taught about unsafe low airspeeds instead, even though AoA can technically cause a wing to stall at any airspeed, and even though that memorized stall airspeed ($V_s1$) actually varies with factors like plane weight. AoA is not considered fundamental in commercial aviation, but is considered fundamental in military aviation. Of course, if your commercial aircraft has a tendency towards stall, that changes the calculus on how important AoA is..
        CydeWeys 8y ago
        Thanks for the info. It sounds like commercial aircraft have some catching up to do if this is going to be increasingly important.
        HeyLaughingBoy 8y ago
        AoA is not considered fundamental in commercial aviation, but is considered fundamental in military aviation ISTR that after a carrier catapult takeoff, Naval aviators have 10 seconds for AoA to get into the "green zone." Otherwise it's an automatic eject. Forgot where I read that and if it's only for specific aircraft types, though.
concerned_user 8y ago
It is optional on 737NG but not on a MAX.
- cjbprime 8y ago
  I don't think this is true.
usrusr 8y ago
A pilot might fire up that inference engine between his ears and make a very well educated guess when two sensors disagree, based on which one reacts more in line with how it should react to some exploratory control inputs or the recent control history. A control loop cannot do that, it is a stupid fact processor that we prefer to do one simple thing reliably than to venture off on inscrutably deep reasoning adventures. A general flight AI would be an entirely different beast than the arsenal of pilot assistance systems currently employed. And just two sensors, simply disengaging the control loop when they disagree, seem insufficient to me when we deemed the control loop necessary in the first place. And this is the easily overlooked bit here: disengaging the MCAS isn't the final step, then you still need to fly the plane that it's manufacturer did not trust pilots to safely operate unassisted by MCAS. (a general flight AI able to do the sensor trust inference could be an interesting game of adversarial programming though: plug it into a flight simulator, then try to down it with the smallest set of simulated malfunctions and weather) > It appears that the AOA disagree alert exists on the plane but is an optional paid feature (!). Oh, that is just crazy. And considering that a bad safe record is just as damaging for Boeing as for the airline, it doesn't seem particularly clever to leave that choice to the customers. Do you have an easily digestible source for that?
- cjbprime 8y ago
  It's mentioned briefly in: https://ad.easa.europa.eu/blob/2018-23-51_Emergency.pdf/EAD_US-2018-23-51_1 https://ad.easa.europa.eu/blob/2018-23-51_Emergency.pdf/EAD_..., and it's optional as a consequence of the entire AoA set of visual indicators being optional.

concerned_user 8y ago

It is even worse than that, those 2 are independent each connected to one of the two FMS so the FMS has no idea there is another sensor at all, they are supposed to be alternated between flights. Also there is an indicator somewhere that lights up if AoA sensors are in disagreement but again FMS does not know this. How did this design got approved I have no idea.

dingaling 8y ago

Yes, all Airbus aircraft have at least three AoA sensors. Boeing standardised at two, even on the 787. And one of those is located where it is vulnerable to damage from a jetbridge.