4 ms·

Not having three AoA sensors seems either insane or criminally negligent.

ozmaverick72 8y ago
I'm with you on that. It also seems completely against the Boeing ethos of when the auto pilot is off you should be hand flying the plane and your control inputs dictate the movement of the flight surfaces. That has been a perceived difference in philosophy between Boeing and Airbus. MCAS sounds like a hastly thrown together work around and a disaster waiting to happen.
- deleted 8y ago
  [deleted]
arcticbull 8y ago
Yep, there’s going to be a lot of hand wringing, finger pointing and hot air expended over the next few years and this is basically it. Boeing had two options: (1) 3 sensors plus majority voter. (2) A mandatory AoA disagree indication plus some training on how to react to it. They chose option (3): Neither. Frankly when I heard there were just two sensors and no disagree indication, my first thought was well that’s just as good as one sensor and hoping for the best, isn’t it? The “challenger moment” would have been after the meeting they decided on this.
- Animats 8y ago
  That's what really amazes me. Especially since AoA vanes are known to be troublesome.[1] In most aircraft they just trigger the stall warning horn and stick shaker; they don't directly affect aircraft control. [1] https://mooneyspace.com/topic/19801-stall-warningaoa-failure-poll/ https://mooneyspace.com/topic/19801-stall-warningaoa-failure...
  - cjbprime 8y ago
    I think Airbus will disable the autopilot in case of AoA sensor failure, which is why it has three of them instead of two.
- cjbprime 8y ago
  It's more literally "just one sensor" than you say, I think. MCAS doesn't average or anything: it just picks one sensor at a time arbitrarily and uses it. (This will change in next month's software fix.) (2) sounds like it could be airworthy, but I think Boeing might instead find that it has to add that third sensor. Airbus has three, and any rationale that Boeing only needs two because the disagreement consequences are not severe seems atop quicksand at this point.
- D_Alex 8y ago
  Option (4): input from other sensors (altitude, climb rate, gyroscope/artificial horizon, pilot actions etc) for a sense check...?
  - arcticbull 8y ago
    My gut tells me aerospace errs on the side of simplicity and reproducibility. It could work, though ideally system errors wouldn’t interfere with other systems.
  - 7952 8y ago
    And the engine stats should be a good source of data.
- 7952 8y ago
  It is worth pointing out that an AOA sensor should not be critical for normal flight. If a sensor is faulty then why not simply stop using angle of attack as a data point. It should still be perfectly possible to fly safely and using a configuration that will avoid a stall. Pilots should be able to fly on a minimum set of instruments.
Invictus0 8y ago
Has it been established that the AoA sensor malfunctioned?
- cjbprime 8y ago
  I believe the Lion Air investigators have made public that there was a 20 degree differential between the two AoA sensors even when they were sitting on the runway before flight. (I don't have a source easily accessible.)
  - newacct77 8y ago
    That's almost like saying two compasses should agree while standing on the north pole. These sensors need airflow to operate and provide meaningful indication.
    - cjbprime 8y ago
      It was during taxi for takeoff: https://theaircurrent.com/aviation-safety/the-world-pulls-the-andon-cord-on-the-737-max/ https://theaircurrent.com/aviation-safety/the-world-pulls-th...
    - dgritsko 8y ago
      Is that necessarily true? Based on this article (https://www.flyingmag.com/how-it-works-angle-attack-indicator#page-2 https://www.flyingmag.com/how-it-works-angle-attack-indicato...) it seems like they should be accurate regardless.
    - inferiorhuman 8y ago
      Sure, but they maintained their twenty degree difference for the duration of the flight. That's why the one stick shaker started going off shortly after rotation, why autopilot wouldn't engage, and why MCAS was going nuts.
    - pintxo 8y ago
      Why should an AoA sensor require airflow? And if we are talking about airflow, we are talking about measuring pressur differentialsm right? How to do calculate an angle using a pressure differential?
Osiris 8y ago
They could have also used inputs from other systems as a sanity check such as altitude, air speed, pilot input, etc. I'm really surprised the software didn't take any other available data into consideration.
- function_seven 8y ago
  The horizon indicator alone should serve as a check. If you (the computer) think the plane is about to stall, it makes sense to nose it down to compensate. Ok, cool. But if you think it's stalling, and you see that you're at a negative attitude, then it's much more likely that trimming the horizontal stab is a bad idea. I'm sure there are other checks as well. Also not sure if I'm missing something with this armchair analysis.
crumpets 8y ago
Not if the engineers were assured the pilots would be trained to quickly recognize trim issues and flip off the MCAS when it started misbehaving.
- frostburg 8y ago
  No, it's still obvious fail-deadly insanity. Having to say that the pilots would need to quickly notice issue is even worse (have you seen how you disable the system? It's not a button that you push). The point of the plane variant was to not perform any additional training, too. Anyone saying that to the engineers should be considered a criminal. There is probably a whole incentive structure that lead to this and that should be upended completely.
  - dboreham 8y ago
    "Oh darn! The pesky flight control system decided to go into crash the plane mode again. Let me reset it before I take another sip of my latte".
cmurf 8y ago
As a pilot myself, that doesn't strike me as disqualifying. The minor problem I have is that it has has no self-verification/disqualification mechanism; even in the face of having two sensors available! The far bigger problem I have is, the automation discounts pilot input as if it's the pilots who are wrong. That's obscene. And it strikes me as a violation of CRM. I do not accept that pilots must have disabled auto trim in order to prove they are the more valid input source, compared to a single alpha vane sensor. That's perverse. Pilots have to flip switches to prove they are working correctly? Yet the sensors don't have to have self-verification/disqualification, or cross check with an available second sensor?

I'm with you on that. It also seems completely against the Boeing ethos of when the auto pilot is off you should be hand flying the plane and your control inputs dictate the movement of the flight surfaces. That has been a perceived difference in philosophy between Boeing and Airbus. MCAS sounds like a hastly thrown together work around and a disaster waiting to happen.

deleted 8y ago
[deleted]

arcticbull 8y ago

Yep, there’s going to be a lot of hand wringing, finger pointing and hot air expended over the next few years and this is basically it. Boeing had two options: (1) 3 sensors plus majority voter. (2) A mandatory AoA disagree indication plus some training on how to react to it. They chose option (3): Neither. Frankly when I heard there were just two sensors and no disagree indication, my first thought was well that’s just as good as one sensor and hoping for the best, isn’t it? The “challenger moment” would have been after the meeting they decided on this.

Animats 8y ago
That's what really amazes me. Especially since AoA vanes are known to be troublesome.[1] In most aircraft they just trigger the stall warning horn and stick shaker; they don't directly affect aircraft control. [1] https://mooneyspace.com/topic/19801-stall-warningaoa-failure-poll/ https://mooneyspace.com/topic/19801-stall-warningaoa-failure...
- cjbprime 8y ago
  I think Airbus will disable the autopilot in case of AoA sensor failure, which is why it has three of them instead of two.
cjbprime 8y ago
It's more literally "just one sensor" than you say, I think. MCAS doesn't average or anything: it just picks one sensor at a time arbitrarily and uses it. (This will change in next month's software fix.) (2) sounds like it could be airworthy, but I think Boeing might instead find that it has to add that third sensor. Airbus has three, and any rationale that Boeing only needs two because the disagreement consequences are not severe seems atop quicksand at this point.
D_Alex 8y ago
Option (4): input from other sensors (altitude, climb rate, gyroscope/artificial horizon, pilot actions etc) for a sense check...?
- arcticbull 8y ago
  My gut tells me aerospace errs on the side of simplicity and reproducibility. It could work, though ideally system errors wouldn’t interfere with other systems.
- 7952 8y ago
  And the engine stats should be a good source of data.
7952 8y ago
It is worth pointing out that an AOA sensor should not be critical for normal flight. If a sensor is faulty then why not simply stop using angle of attack as a data point. It should still be perfectly possible to fly safely and using a configuration that will avoid a stall. Pilots should be able to fly on a minimum set of instruments.

Invictus0 8y ago

Has it been established that the AoA sensor malfunctioned?

cjbprime 8y ago
I believe the Lion Air investigators have made public that there was a 20 degree differential between the two AoA sensors even when they were sitting on the runway before flight. (I don't have a source easily accessible.)
- newacct77 8y ago
  That's almost like saying two compasses should agree while standing on the north pole. These sensors need airflow to operate and provide meaningful indication.
  - cjbprime 8y ago
    It was during taxi for takeoff: https://theaircurrent.com/aviation-safety/the-world-pulls-the-andon-cord-on-the-737-max/ https://theaircurrent.com/aviation-safety/the-world-pulls-th...
  - dgritsko 8y ago
    Is that necessarily true? Based on this article (https://www.flyingmag.com/how-it-works-angle-attack-indicator#page-2 https://www.flyingmag.com/how-it-works-angle-attack-indicato...) it seems like they should be accurate regardless.
  - inferiorhuman 8y ago
    Sure, but they maintained their twenty degree difference for the duration of the flight. That's why the one stick shaker started going off shortly after rotation, why autopilot wouldn't engage, and why MCAS was going nuts.
  - pintxo 8y ago
    Why should an AoA sensor require airflow? And if we are talking about airflow, we are talking about measuring pressur differentialsm right? How to do calculate an angle using a pressure differential?

Osiris 8y ago

They could have also used inputs from other systems as a sanity check such as altitude, air speed, pilot input, etc. I'm really surprised the software didn't take any other available data into consideration.

function_seven 8y ago
The horizon indicator alone should serve as a check. If you (the computer) think the plane is about to stall, it makes sense to nose it down to compensate. Ok, cool. But if you think it's stalling, and you see that you're at a negative attitude, then it's much more likely that trimming the horizontal stab is a bad idea. I'm sure there are other checks as well. Also not sure if I'm missing something with this armchair analysis.

crumpets 8y ago

Not if the engineers were assured the pilots would be trained to quickly recognize trim issues and flip off the MCAS when it started misbehaving.

frostburg 8y ago
No, it's still obvious fail-deadly insanity. Having to say that the pilots would need to quickly notice issue is even worse (have you seen how you disable the system? It's not a button that you push). The point of the plane variant was to not perform any additional training, too. Anyone saying that to the engineers should be considered a criminal. There is probably a whole incentive structure that lead to this and that should be upended completely.
- dboreham 8y ago
  "Oh darn! The pesky flight control system decided to go into crash the plane mode again. Let me reset it before I take another sip of my latte".

cmurf 8y ago

As a pilot myself, that doesn't strike me as disqualifying. The minor problem I have is that it has has no self-verification/disqualification mechanism; even in the face of having two sensors available! The far bigger problem I have is, the automation discounts pilot input as if it's the pilots who are wrong. That's obscene. And it strikes me as a violation of CRM. I do not accept that pilots must have disabled auto trim in order to prove they are the more valid input source, compared to a single alpha vane sensor. That's perverse. Pilots have to flip switches to prove they are working correctly? Yet the sensors don't have to have self-verification/disqualification, or cross check with an available second sensor?