3 ms·

There is a long list of errors and omissions, which contributed to these accidents, but the bottom line seems to be software development malpractice. MCAS syste

There is a long list of errors and omissions, which contributed to these accidents, but the bottom line seems to be software development malpractice. MCAS system was designed by Boeing and certified by FAA to keep operating with wildly diverging data from two AOA (angle of attack) sensors. Reports indicate that AOA was the only sensor type MCAS was using. There have to be at least 3 AOA sensors to have some level of reliability in case of a single sensor failure. MCAS should turn itself off in case of large difference between two AOA sensors readings. Whoever wrote and certified that code bears at least some level of responsibility.

lucio 8y ago
Agree. Not having 3 sensors is an objectively bad decision. Why did they keep the system on with diverging data? It will be nice to know what are the risks when MCAS is off. Maybe x% of pilots used to the old 737 consistently stall the plane on the simulator.
planteen 8y ago
The system does not necessarily need triple voting. Many aerospace systems are only primary and redundant. There are two highly trained human pilots aboard who can detect and isolate faulty equipment. And my guess is that these high level software requirements originated with an aerospace systems engineer, not a software engineer. Clearly that high level requirement was flawed (especially in a human factors sense), but we need to remember that passenger planes are not designed to be fully autonomous. It seems only one AOA sensor is currently used by software. The update will change that. "The company said it will change the MCAS software to give the system input from more than one AOA sensor. It will limit how much MCAS can move the horizontal tail in response to an erroneous AOA signal. And when activated, the system will kick in only for one cycle, rather than multiple times." https://www.seattletimes.com/business/boeing-aerospace/investigators-find-new-clues-to-potential-cause-of-737-max-crashes-as-faa-details-boeings-fix/ https://www.seattletimes.com/business/boeing-aerospace/inves...
- pauljurczak 8y ago
  < change the MCAS software to give the system input from more than one AOA sensor That's even worse than I thought. The data from both sensors was being logged. Some reports indicated cases of huge discrepancies (20 degrees) between sensors. It is incomprehensible to me that MCAS ignored the other sensor. The lawyers will have a field day with that and in this case I say: go for it!
  - planteen 8y ago
    What if the system was arranged such that there were 2 MCAS systems and 2 AOA sensors, each redundantly wired in a cross-strapped fashion? Then, in the cockpit there are two switches: MCAS PRI/RED and AOA PRI/RED. You could then tolerate a simultaneous failure of one MCAS and AOA sensor, as well as have a method to bypass and ignore any failing sensor/actuator. Disclaimer: I've never worked on aircraft software. I've worked on unmanned spacecraft and the scheme I described is very common for fault tolerance.

lucio 8y ago

Agree. Not having 3 sensors is an objectively bad decision. Why did they keep the system on with diverging data? It will be nice to know what are the risks when MCAS is off. Maybe x% of pilots used to the old 737 consistently stall the plane on the simulator.

planteen 8y ago

The system does not necessarily need triple voting. Many aerospace systems are only primary and redundant. There are two highly trained human pilots aboard who can detect and isolate faulty equipment. And my guess is that these high level software requirements originated with an aerospace systems engineer, not a software engineer. Clearly that high level requirement was flawed (especially in a human factors sense), but we need to remember that passenger planes are not designed to be fully autonomous. It seems only one AOA sensor is currently used by software. The update will change that. "The company said it will change the MCAS software to give the system input from more than one AOA sensor. It will limit how much MCAS can move the horizontal tail in response to an erroneous AOA signal. And when activated, the system will kick in only for one cycle, rather than multiple times." https://www.seattletimes.com/business/boeing-aerospace/investigators-find-new-clues-to-potential-cause-of-737-max-crashes-as-faa-details-boeings-fix/ https://www.seattletimes.com/business/boeing-aerospace/inves...

pauljurczak 8y ago
< change the MCAS software to give the system input from more than one AOA sensor That's even worse than I thought. The data from both sensors was being logged. Some reports indicated cases of huge discrepancies (20 degrees) between sensors. It is incomprehensible to me that MCAS ignored the other sensor. The lawyers will have a field day with that and in this case I say: go for it!
- planteen 8y ago
  What if the system was arranged such that there were 2 MCAS systems and 2 AOA sensors, each redundantly wired in a cross-strapped fashion? Then, in the cockpit there are two switches: MCAS PRI/RED and AOA PRI/RED. You could then tolerate a simultaneous failure of one MCAS and AOA sensor, as well as have a method to bypass and ignore any failing sensor/actuator. Disclaimer: I've never worked on aircraft software. I've worked on unmanned spacecraft and the scheme I described is very common for fault tolerance.