4 ms·

The system does not necessarily need triple voting. Many aerospace systems are only primary and redundant. There are two highly trained human pilots aboard who

The system does not necessarily need triple voting. Many aerospace systems are only primary and redundant. There are two highly trained human pilots aboard who can detect and isolate faulty equipment. And my guess is that these high level software requirements originated with an aerospace systems engineer, not a software engineer. Clearly that high level requirement was flawed (especially in a human factors sense), but we need to remember that passenger planes are not designed to be fully autonomous. It seems only one AOA sensor is currently used by software. The update will change that. "The company said it will change the MCAS software to give the system input from more than one AOA sensor. It will limit how much MCAS can move the horizontal tail in response to an erroneous AOA signal. And when activated, the system will kick in only for one cycle, rather than multiple times." https://www.seattletimes.com/business/boeing-aerospace/investigators-find-new-clues-to-potential-cause-of-737-max-crashes-as-faa-details-boeings-fix/ https://www.seattletimes.com/business/boeing-aerospace/inves...

pauljurczak 8y ago
< change the MCAS software to give the system input from more than one AOA sensor That's even worse than I thought. The data from both sensors was being logged. Some reports indicated cases of huge discrepancies (20 degrees) between sensors. It is incomprehensible to me that MCAS ignored the other sensor. The lawyers will have a field day with that and in this case I say: go for it!
- planteen 8y ago
  What if the system was arranged such that there were 2 MCAS systems and 2 AOA sensors, each redundantly wired in a cross-strapped fashion? Then, in the cockpit there are two switches: MCAS PRI/RED and AOA PRI/RED. You could then tolerate a simultaneous failure of one MCAS and AOA sensor, as well as have a method to bypass and ignore any failing sensor/actuator. Disclaimer: I've never worked on aircraft software. I've worked on unmanned spacecraft and the scheme I described is very common for fault tolerance.

pauljurczak 8y ago

< change the MCAS software to give the system input from more than one AOA sensor That's even worse than I thought. The data from both sensors was being logged. Some reports indicated cases of huge discrepancies (20 degrees) between sensors. It is incomprehensible to me that MCAS ignored the other sensor. The lawyers will have a field day with that and in this case I say: go for it!

planteen 8y ago
What if the system was arranged such that there were 2 MCAS systems and 2 AOA sensors, each redundantly wired in a cross-strapped fashion? Then, in the cockpit there are two switches: MCAS PRI/RED and AOA PRI/RED. You could then tolerate a simultaneous failure of one MCAS and AOA sensor, as well as have a method to bypass and ignore any failing sensor/actuator. Disclaimer: I've never worked on aircraft software. I've worked on unmanned spacecraft and the scheme I described is very common for fault tolerance.