4 ms·

An angle of attack sensor is loosely equivalent to a G-meter in a car. Calling it a safety device is a bit of tabloid reporting. That said, given the sensors a

An angle of attack sensor is loosely equivalent to a G-meter in a car. Calling it a safety device is a bit of tabloid reporting. That said, given the sensors are used directly as input having a disagree light is a reasonable thing to expect.

tyingq 8y ago
It's standard equipment on new Cessna 172's and marketed as "Safe Flight", specifically called out as a way to avoid a stall, etc. When the industry says it's a safety thing, it's hard to blame a reporter.
- VBprogrammer 8y ago
  Yeah, marketers aren't any better. If I was buying a new 172 I'd probably be more interested in a BRS (whole airframe parachute) than an AoA sensor. https://www.ainonline.com/aviation-news/general-aviation/2016-12-30/cessna-adds-safe-flight-aoa-new-skyhawks%3Famp&ved=2ahUKEwil3Pvvo5PhAhUr2OAKHT7rDygQFjAAegQIAhAB&usg=AOvVaw2KnayYMbyI7efq78lKx9EK&ampcf=1 https://www.ainonline.com/aviation-news/general-aviation/201... Since these are twin engine aircraft, you could make many arguments about blue line speeds and balanced runway lengths but I'll take your point.
Someone1234 8y ago
> Calling it a safety device is a bit of tabloid reporting. It become a safety critical sensor as soon as flight inputs are directed as a result of its data. For example, bad data has now resulted in 346 deaths, if that isn't safety critical I don't know what the criterion would be.
- VBprogrammer 8y ago
  To be blunt, hitting the ground at 300kts is what caused 346 deaths. There hasn't even been a preliminary report on the Ethiopian crash so we can't say with any certainty that the failure was the same. It is quite likely that the pilots were overwhelmed with warnings (e.g. stick shaker activation) and conflicting data. It's not clear that presenting yet more conflicting data would have averted the disasters. Limiting the authority of the MCAS system is likely to be the real fix.
  - Someone1234 8y ago
    > There hasn't even been a preliminary report on the Ethiopian crash so we can't say with any certainty that the failure was the same. But there has been on Lion Air, compelling ADS-B data for Ethiopian, and every regulatory agency in the world agrees they're similar enough to warrant grounding the entire fleet. > Limiting the authority of the MCAS system is likely to be the real fix. They're already changing it to take data from both sensors, and there's been talk of requiring a third for voting logic. So the "real fix" is treating a safety critical sensor as a safety critical sensor.
    - VBprogrammer 8y ago
      > They're already changing it to take data from both sensors, and there's been talk of requiring a third for voting logic. So the "real fix" is treating a safety critical sensor as a safety critical sensor. Not according to the press release. https://boeing.mediaroom.com/news-releases-statements?item=130402 https://boeing.mediaroom.com/news-releases-statements?item=1... Interconnects like that are quite unusual. For example the autopilot is typically driven from either the same data source as pilot or the co-pilots system. There are some exceptions, for example in full auto-land mode both systems are engaged. But that really is an exception, only a fraction of the worlds runways have CATIII certification and they require special ground operations to support them. There are procedures designed to ensure the systems agree on certain critical data, for example the 'pilot not flying' will usually call out 80 knots and cross check that the speed agrees between both sides.
      - Someone1234 8y ago
        > Not according to the press release. Questionable conclusion, the press release doesn't go into details either way. To quote this NYT article: > Boeing is updating the software to require data from both sensors for the system to kick in, according to pilots at several major airlines and two lawmakers briefed on the matter. https://www.nytimes.com/2019/03/15/business/boeing-ethiopian-crash.html https://www.nytimes.com/2019/03/15/business/boeing-ethiopian... > Interconnects like that are quite unusual. Not in aviation, for example the Airbus A330 has triple redundant Pitot tubes, the B737CL (Boeing 737 "classic") has four, the B737NG has three (737 Next Gen), etc. So this "quite unusual" system appears on the very airplane we're discussing for the Pitot-Static System, a safety critical sensor.
wlesieutre 8y ago
If your car uses the G-meter to deploy airbags and not having one results in hundreds of people dying, then yeah I'd call it a safety feature.
- VBprogrammer 8y ago
  In that analogy, the aircraft does currently have 2 sensors. It just doesn't show the outputs to the driver.
  - mannykannot 8y ago
    I think it will turn out to be significant that there are two, but not three. This means that MCAS could not have been made triply-redundant through software alone.
    - VBprogrammer 8y ago
      See my response upthread. I don't think this is likely to be all that relevant. Aircraft systems are surprisingly dumb at times. They could easily have calculated an approximate AoA from their known reference data, rate of change of altitude (for extra credit they could use GPS and pressure altitude) and attitude and used that for a sanity check.
      - mannykannot 8y ago
        For AofA from those inputs, you also would need to need to know what the air is doing. Over a period of time I imagine you could approximate it, but for what MCAS does with it, I would think you need near-instantaneous (~ 1 sec.) figures, especially in turbulence or a downburst. On the other hand, there is indicated airspeed, the traditional proxy for AofA. It, too, has its dependencies, but I think they are either measurable (e.g. flaps (, outside air temp.?)) or can be estimated from slowly changing values (e.g. weight from initial gross weight and fuel burn.)
        8y ago
mannykannot 8y ago
As air bags are activated by accelerometers, and having an air bag inflate while you are driving could cause a crash, I think your analogy is appropriate in a way that might not be immediately obvious. In an emergency, too many warnings can be harmful. This can be a problem in hospitals, where every device beeps for all sorts of reasons. At Three Mile Island, the control panel became a 'christmas tree' of colored lights, when there was really only one problem: a stuck valve. It is especially a problem when the significance of the alarm is not clear, as when a sensor is a control input to multiple systems with complex algorithms. I would guess a warning light would be most useful in pre-flight checks, as a go/no-go indicator. It could also be an item in troubleshooting checklists (if the stick is shaking, yet the airspeed is good, is the AofA light on?)

tyingq 8y ago

It's standard equipment on new Cessna 172's and marketed as "Safe Flight", specifically called out as a way to avoid a stall, etc. When the industry says it's a safety thing, it's hard to blame a reporter.

VBprogrammer 8y ago
Yeah, marketers aren't any better. If I was buying a new 172 I'd probably be more interested in a BRS (whole airframe parachute) than an AoA sensor. https://www.ainonline.com/aviation-news/general-aviation/2016-12-30/cessna-adds-safe-flight-aoa-new-skyhawks%3Famp&ved=2ahUKEwil3Pvvo5PhAhUr2OAKHT7rDygQFjAAegQIAhAB&usg=AOvVaw2KnayYMbyI7efq78lKx9EK&ampcf=1 https://www.ainonline.com/aviation-news/general-aviation/201... Since these are twin engine aircraft, you could make many arguments about blue line speeds and balanced runway lengths but I'll take your point.

Someone1234 8y ago

> Calling it a safety device is a bit of tabloid reporting. It become a safety critical sensor as soon as flight inputs are directed as a result of its data. For example, bad data has now resulted in 346 deaths, if that isn't safety critical I don't know what the criterion would be.

VBprogrammer 8y ago
To be blunt, hitting the ground at 300kts is what caused 346 deaths. There hasn't even been a preliminary report on the Ethiopian crash so we can't say with any certainty that the failure was the same. It is quite likely that the pilots were overwhelmed with warnings (e.g. stick shaker activation) and conflicting data. It's not clear that presenting yet more conflicting data would have averted the disasters. Limiting the authority of the MCAS system is likely to be the real fix.
- Someone1234 8y ago
  > There hasn't even been a preliminary report on the Ethiopian crash so we can't say with any certainty that the failure was the same. But there has been on Lion Air, compelling ADS-B data for Ethiopian, and every regulatory agency in the world agrees they're similar enough to warrant grounding the entire fleet. > Limiting the authority of the MCAS system is likely to be the real fix. They're already changing it to take data from both sensors, and there's been talk of requiring a third for voting logic. So the "real fix" is treating a safety critical sensor as a safety critical sensor.
  - VBprogrammer 8y ago
    > They're already changing it to take data from both sensors, and there's been talk of requiring a third for voting logic. So the "real fix" is treating a safety critical sensor as a safety critical sensor. Not according to the press release. https://boeing.mediaroom.com/news-releases-statements?item=130402 https://boeing.mediaroom.com/news-releases-statements?item=1... Interconnects like that are quite unusual. For example the autopilot is typically driven from either the same data source as pilot or the co-pilots system. There are some exceptions, for example in full auto-land mode both systems are engaged. But that really is an exception, only a fraction of the worlds runways have CATIII certification and they require special ground operations to support them. There are procedures designed to ensure the systems agree on certain critical data, for example the 'pilot not flying' will usually call out 80 knots and cross check that the speed agrees between both sides.
    - Someone1234 8y ago
      > Not according to the press release. Questionable conclusion, the press release doesn't go into details either way. To quote this NYT article: > Boeing is updating the software to require data from both sensors for the system to kick in, according to pilots at several major airlines and two lawmakers briefed on the matter. https://www.nytimes.com/2019/03/15/business/boeing-ethiopian-crash.html https://www.nytimes.com/2019/03/15/business/boeing-ethiopian... > Interconnects like that are quite unusual. Not in aviation, for example the Airbus A330 has triple redundant Pitot tubes, the B737CL (Boeing 737 "classic") has four, the B737NG has three (737 Next Gen), etc. So this "quite unusual" system appears on the very airplane we're discussing for the Pitot-Static System, a safety critical sensor.

wlesieutre 8y ago

If your car uses the G-meter to deploy airbags and not having one results in hundreds of people dying, then yeah I'd call it a safety feature.

VBprogrammer 8y ago
In that analogy, the aircraft does currently have 2 sensors. It just doesn't show the outputs to the driver.
- mannykannot 8y ago
  I think it will turn out to be significant that there are two, but not three. This means that MCAS could not have been made triply-redundant through software alone.
  - VBprogrammer 8y ago
    See my response upthread. I don't think this is likely to be all that relevant. Aircraft systems are surprisingly dumb at times. They could easily have calculated an approximate AoA from their known reference data, rate of change of altitude (for extra credit they could use GPS and pressure altitude) and attitude and used that for a sanity check.
    - mannykannot 8y ago
      For AofA from those inputs, you also would need to need to know what the air is doing. Over a period of time I imagine you could approximate it, but for what MCAS does with it, I would think you need near-instantaneous (~ 1 sec.) figures, especially in turbulence or a downburst. On the other hand, there is indicated airspeed, the traditional proxy for AofA. It, too, has its dependencies, but I think they are either measurable (e.g. flaps (, outside air temp.?)) or can be estimated from slowly changing values (e.g. weight from initial gross weight and fuel burn.)
      - 8y ago

mannykannot 8y ago

As air bags are activated by accelerometers, and having an air bag inflate while you are driving could cause a crash, I think your analogy is appropriate in a way that might not be immediately obvious. In an emergency, too many warnings can be harmful. This can be a problem in hospitals, where every device beeps for all sorts of reasons. At Three Mile Island, the control panel became a 'christmas tree' of colored lights, when there was really only one problem: a stuck valve. It is especially a problem when the significance of the alarm is not clear, as when a sensor is a control input to multiple systems with complex algorithms. I would guess a warning light would be most useful in pre-flight checks, as a go/no-go indicator. It could also be an item in troubleshooting checklists (if the stick is shaking, yet the airspeed is good, is the AofA light on?)