5 ms·

As I understand a simple software fix is not possible according to regulation. The problem is as follows, as you described it partly: 2 sensors are not enough.

As I understand a simple software fix is not possible according to regulation. The problem is as follows, as you described it partly: 2 sensors are not enough. If the MCAS is an important part for the flight safety, a simple redundant safety system is not enough. Because an airplane is not about functional safety but mission critical safety. In functional safety, if there is an error the safety function is triggered and the system is transferred into a safe state. But there is no safe state here. If the system is mission critical, then it is not safe to assume to switch it off in case of an error. That means for mission critical system we need at least 3 readings and with a vote can decide on which reading is most likely the correct reading. If the MCAS would not be part of the mission critical path, then we could ask why is there in the first place? There must be reason why it was introduced. I assume, it is not done by a simple software update, if there are only 2 sensors. It will be partly redesigned to fit the requirements and regulations. But of course, this will not be publicly announced. Think about the share price. They will maintain a communication that assumes that this is an easy (and cheap) fix, a software update.

bravo22 8y ago
Yes! But even if you have 2 out of 3 vote you can still have two sensors that can fail, say due to a bird strike or something else and MCAS would have to be disabled which means pilots need to learn to fly the plane w/o MCAS. The one part of the narrative that Boeing has tried to Jedi Mind Trick away is that even if the pilots knew to disable MCAS by pulling the fuse, they're still left with having to fly a plane which no longer flies as the previous generation that they were trained on -- which is what MCAS was designed to do. So you still have a safety issue.
- ams6110 8y ago
  In normal flight, MCAS is not active. The plane handles pretty much like any other 737. MCAS becomes active at high angles of attack, near the stall, to meet handling requirements for certification.
  - salawat 8y ago
    Doesn't matter. The flight characteristics are still drastically different toward the extremes, and you never assume away the extremes. You now have to guarantee that every crew when faced with an MCAS disable situation that required piloting in a way that the MCAS would kick in can successfully mimic the action of the MCAS with only the manual trim wheels. I'm not saying that's impossible, but you'd want your aircrew to have sufficient training to be a stand in for the automation.
    - VBprogrammer 8y ago
      I think "drastically different" is probably overstating the truth. It certainly doesn't jibe with anything I've read. It's worth bearing in mind that, from what we know, neither of the two crashes had anything to do with handling difficulties in the new aircraft near the stall.
      - salawat 8y ago
        I say drastically different because no one pays the complexity tax of increased automation to deal with something that isn't important. In this case, to the certifiability of the airframe. I understand your caution against overstating things, but I'm not trying to be hyperbolic. If you think about the consequences of doing basic maneuvers in adverse conditions (weather/load/engine power conditions), you rapidly begin to get into areas where what seems minor would get into uncharted territory without a working MCAS. It is a different plane in terms of manual flying. The automation non-withstanding.
        VBprogrammer 8y ago
        I get where you are coming from, and it's true that "the FARs are written in blood" but I'm not convinced that a non-linear stick force would have caused any real world issues. For a start, all of the critical phases of flight (takeoff, landing and go-around) usually involve some amount of flaps, for which MCAS is apparently unnecessary.
ams6110 8y ago
> If the MCAS would not be part of the mission critical path, then we could ask why is there in the first place? There must be reason why it was introduced. It was added to meet certification requirements for handling at high angles of attack. Specifically, to counter an increased pitch up tendency due to the larger, more forward engine nacelles. As to how mission-critical it is I don't know, but as I understand it the angles of attack where it would become active are not encountered in normal commercial flight. It's more of a system that is there to meet requirements for handling near the "edge of the envelope."
- VBprogrammer 8y ago
  I read this thread earlier and became frustrated by the number of times people repeated the same old misunderstandings. Thanks for taking the time to try to correct them. Having a critical system, whether mechanical, electric or hydraulic is an unavoidable fact of aviation. For example on the airbus if there is a complete failure of the fly by wire system the plan is to fly the aircraft using only the trim for pitch control and the rudder for lateral control. I'm sure pilots routinely give this a go in the simulator, but I'd be very surprised if the expected outcome was much above a controlled crash. It's a case of managing the risk of a problem against the hazards. An AoA disagree warning will probably be written up as a fault requiring written authorization to depart from a maintenance base. The pilot would be expected to be extra vigilant in avoiding flight close to the stall until the error was corrected. Perhaps settling for easier approaches, longer runways etc. All pretty normal aviation practice.
mannykannot 8y ago
This question -- if it is a safety feature, why is it acceptable that it can it be disabled -- comes up a lot, so I think we should recognize that, in general, there is an answer, though whether it was the right answer for MCAS goes a step beyond. Whenever you have something that would usually improve safety, but which presents a risk if it fails, then the rational response is to ask whether it demonstrably improves safety overall. This calculus depends on how much it improves safety when working, how much harm it does when failing, and how likely it is to fail. These considerations can be modified by limitations on operations both when things are working and when they fail, as is the case of twin-engined aircraft use on trans-oceanic flights. If, in addition, this thing can be disabled, the principle is the same, but there are more cases: what are the chances it be disabled even though working, or (as in this case) not be disabled when failing. Disabling MCAS does not itself put an airplane in a dangerous situation, it merely increases the risk somewhat. The part of the analysis that seems to have been flawed is that covering the risk introduced when it fails but is left engaged.
- FakeComments 8y ago
  MCAS isn’t needed to fly the 737 MAX, you can perform a perfectly fine flight without it — the autopilot directly trims, pilots could fly via trimming themselves using the control on the stick, and there’s a manual wheel for emergencies when the jackscrew motor fails (or is disabled to override MCAS). Rather, MCAS is needed to fly the 737 MAX like other 737 type aircraft. MCAS has the capacity to override pilot control via continued trimming; MCAS is not a safety requirement, but can trigger a critical failure; MCAS was not built to critical failure specs; pilots were not trained on MCAS; MCAS is required to maintain the type rating, because otherwise the plane would handle differently during a stall. (This is the only purpose — tipping the nose to fake handling characteristics during a stall.) It sounds like a reckless design, made out of political rather than safety considerations.
  - VBprogrammer 8y ago
    That's a bit of a misunderstanding. MCAS is needed to satisfy the certification requirements for an aircraft under part 25. It only makes the 737 Max more like the 737NG in that it also makes it more like any other certified aircraft. To put it another way, the alternative to MCAS was not more training for the pilots. It was the 737 Max not passing certification.
cameldrv 8y ago
The answer is FAR 25.672 (c)(2). "It must be shown that after any single failure of the stability augmentation system or any other automatic or power-operated system - ... The controllability and maneuverability requirements of this part are met within a practical operational flight envelope (for example, speed, altitude, normal acceleration, and airplane configurations) which is described in the Airplane Flight Manual" MCAS is only required in high AoA, flaps up, manual flight. To get high AoA, you generally need some combination of slow speed, a steeply banked turn, and abrupt maneuvering. If you tell the pilots to keep the speed up, keep the bank angles down, and fly gently in the event of an MCAS failure, it meets the requirements. From a practical standpoint, the aircraft should never see an AoA that would trip MCAS in normal flight. The only time a jetliner would typically see an AoA over ten degrees is on takeoff and landing, when the flaps are down (and MCAS is inhibited), or momentarily in turbulence. From a risk control standpoint, you're multiplying probabilities together (of course assuming uncorrelated failures). Spitballing the failure probability chain, flights that would trigger MCAS are probably about 10^-4 to 10^-5 probability, and the lack of MCAS might cause an unrecoverable stall in perhaps 10^-1 to 10^-2 flights, so figure 10^-6 probability per flight of the airframe's poor stability leading to an accident. This is too high to be certified. If you have MCAS, but it's disabled when an AoA vane fails, figure the probability of an AoA vane failure is 10^-4, you get an accident probability of 10^-10, which is acceptable.
- m_mueller 8y ago
  I don't understand how your post squares with what happened in reality.
  - cameldrv 8y ago
    Boeing has delivered 376 737MAXes since May 2017. About as many were delivered in 2019 as 2017, so figure their median age is 9 months. Figure a month from delivery to going into full service. That makes for 90,578 flight days of service. Figure 6 flights per day, you get about half a million flights. We know that the AoA vane had a failure in at least 3 flights, and we should probably assume that there were another three failures on the alternate side. That gives a failure rate of 6/500,000 = 1.2*10^-5. That's about 8x better than my spitball 10^-4. The reason two planes have gone down is that the MCAS cure is worse than the instability disease. MCAS incorrectly activates at 10^-5, and empirically this failure is 66% fatal. If you can get MCAS to only activate when it's needed, the fact that it won't always be there to protect you is not so crucial. Think about it like this: Would it bother you if the airbag in your car only went off 99.9% of the time when you got in an accident? It shouldn't, and it would hardly make any difference in auto fatalities. On the other hand, if the airbag in your car randomly went off on 0.1% of drives you took, you'd have that happen to you once a year or so, and there's a good chance that it would eventually cause you lose control of your car and crash.

bravo22 8y ago

Yes! But even if you have 2 out of 3 vote you can still have two sensors that can fail, say due to a bird strike or something else and MCAS would have to be disabled which means pilots need to learn to fly the plane w/o MCAS. The one part of the narrative that Boeing has tried to Jedi Mind Trick away is that even if the pilots knew to disable MCAS by pulling the fuse, they're still left with having to fly a plane which no longer flies as the previous generation that they were trained on -- which is what MCAS was designed to do. So you still have a safety issue.

ams6110 8y ago
In normal flight, MCAS is not active. The plane handles pretty much like any other 737. MCAS becomes active at high angles of attack, near the stall, to meet handling requirements for certification.
- salawat 8y ago
  Doesn't matter. The flight characteristics are still drastically different toward the extremes, and you never assume away the extremes. You now have to guarantee that every crew when faced with an MCAS disable situation that required piloting in a way that the MCAS would kick in can successfully mimic the action of the MCAS with only the manual trim wheels. I'm not saying that's impossible, but you'd want your aircrew to have sufficient training to be a stand in for the automation.
  - VBprogrammer 8y ago
    I think "drastically different" is probably overstating the truth. It certainly doesn't jibe with anything I've read. It's worth bearing in mind that, from what we know, neither of the two crashes had anything to do with handling difficulties in the new aircraft near the stall.
    - salawat 8y ago
      I say drastically different because no one pays the complexity tax of increased automation to deal with something that isn't important. In this case, to the certifiability of the airframe. I understand your caution against overstating things, but I'm not trying to be hyperbolic. If you think about the consequences of doing basic maneuvers in adverse conditions (weather/load/engine power conditions), you rapidly begin to get into areas where what seems minor would get into uncharted territory without a working MCAS. It is a different plane in terms of manual flying. The automation non-withstanding.
      - VBprogrammer 8y ago
        I get where you are coming from, and it's true that "the FARs are written in blood" but I'm not convinced that a non-linear stick force would have caused any real world issues. For a start, all of the critical phases of flight (takeoff, landing and go-around) usually involve some amount of flaps, for which MCAS is apparently unnecessary.

ams6110 8y ago

> If the MCAS would not be part of the mission critical path, then we could ask why is there in the first place? There must be reason why it was introduced. It was added to meet certification requirements for handling at high angles of attack. Specifically, to counter an increased pitch up tendency due to the larger, more forward engine nacelles. As to how mission-critical it is I don't know, but as I understand it the angles of attack where it would become active are not encountered in normal commercial flight. It's more of a system that is there to meet requirements for handling near the "edge of the envelope."

VBprogrammer 8y ago
I read this thread earlier and became frustrated by the number of times people repeated the same old misunderstandings. Thanks for taking the time to try to correct them. Having a critical system, whether mechanical, electric or hydraulic is an unavoidable fact of aviation. For example on the airbus if there is a complete failure of the fly by wire system the plan is to fly the aircraft using only the trim for pitch control and the rudder for lateral control. I'm sure pilots routinely give this a go in the simulator, but I'd be very surprised if the expected outcome was much above a controlled crash. It's a case of managing the risk of a problem against the hazards. An AoA disagree warning will probably be written up as a fault requiring written authorization to depart from a maintenance base. The pilot would be expected to be extra vigilant in avoiding flight close to the stall until the error was corrected. Perhaps settling for easier approaches, longer runways etc. All pretty normal aviation practice.

mannykannot 8y ago

This question -- if it is a safety feature, why is it acceptable that it can it be disabled -- comes up a lot, so I think we should recognize that, in general, there is an answer, though whether it was the right answer for MCAS goes a step beyond. Whenever you have something that would usually improve safety, but which presents a risk if it fails, then the rational response is to ask whether it demonstrably improves safety overall. This calculus depends on how much it improves safety when working, how much harm it does when failing, and how likely it is to fail. These considerations can be modified by limitations on operations both when things are working and when they fail, as is the case of twin-engined aircraft use on trans-oceanic flights. If, in addition, this thing can be disabled, the principle is the same, but there are more cases: what are the chances it be disabled even though working, or (as in this case) not be disabled when failing. Disabling MCAS does not itself put an airplane in a dangerous situation, it merely increases the risk somewhat. The part of the analysis that seems to have been flawed is that covering the risk introduced when it fails but is left engaged.

FakeComments 8y ago
MCAS isn’t needed to fly the 737 MAX, you can perform a perfectly fine flight without it — the autopilot directly trims, pilots could fly via trimming themselves using the control on the stick, and there’s a manual wheel for emergencies when the jackscrew motor fails (or is disabled to override MCAS). Rather, MCAS is needed to fly the 737 MAX like other 737 type aircraft. MCAS has the capacity to override pilot control via continued trimming; MCAS is not a safety requirement, but can trigger a critical failure; MCAS was not built to critical failure specs; pilots were not trained on MCAS; MCAS is required to maintain the type rating, because otherwise the plane would handle differently during a stall. (This is the only purpose — tipping the nose to fake handling characteristics during a stall.) It sounds like a reckless design, made out of political rather than safety considerations.
- VBprogrammer 8y ago
  That's a bit of a misunderstanding. MCAS is needed to satisfy the certification requirements for an aircraft under part 25. It only makes the 737 Max more like the 737NG in that it also makes it more like any other certified aircraft. To put it another way, the alternative to MCAS was not more training for the pilots. It was the 737 Max not passing certification.

cameldrv 8y ago

The answer is FAR 25.672 (c)(2). "It must be shown that after any single failure of the stability augmentation system or any other automatic or power-operated system - ... The controllability and maneuverability requirements of this part are met within a practical operational flight envelope (for example, speed, altitude, normal acceleration, and airplane configurations) which is described in the Airplane Flight Manual" MCAS is only required in high AoA, flaps up, manual flight. To get high AoA, you generally need some combination of slow speed, a steeply banked turn, and abrupt maneuvering. If you tell the pilots to keep the speed up, keep the bank angles down, and fly gently in the event of an MCAS failure, it meets the requirements. From a practical standpoint, the aircraft should never see an AoA that would trip MCAS in normal flight. The only time a jetliner would typically see an AoA over ten degrees is on takeoff and landing, when the flaps are down (and MCAS is inhibited), or momentarily in turbulence. From a risk control standpoint, you're multiplying probabilities together (of course assuming uncorrelated failures). Spitballing the failure probability chain, flights that would trigger MCAS are probably about 10^-4 to 10^-5 probability, and the lack of MCAS might cause an unrecoverable stall in perhaps 10^-1 to 10^-2 flights, so figure 10^-6 probability per flight of the airframe's poor stability leading to an accident. This is too high to be certified. If you have MCAS, but it's disabled when an AoA vane fails, figure the probability of an AoA vane failure is 10^-4, you get an accident probability of 10^-10, which is acceptable.

m_mueller 8y ago
I don't understand how your post squares with what happened in reality.
- cameldrv 8y ago
  Boeing has delivered 376 737MAXes since May 2017. About as many were delivered in 2019 as 2017, so figure their median age is 9 months. Figure a month from delivery to going into full service. That makes for 90,578 flight days of service. Figure 6 flights per day, you get about half a million flights. We know that the AoA vane had a failure in at least 3 flights, and we should probably assume that there were another three failures on the alternate side. That gives a failure rate of 6/500,000 = 1.2*10^-5. That's about 8x better than my spitball 10^-4. The reason two planes have gone down is that the MCAS cure is worse than the instability disease. MCAS incorrectly activates at 10^-5, and empirically this failure is 66% fatal. If you can get MCAS to only activate when it's needed, the fact that it won't always be there to protect you is not so crucial. Think about it like this: Would it bother you if the airbag in your car only went off 99.9% of the time when you got in an accident? It shouldn't, and it would hardly make any difference in auto fatalities. On the other hand, if the airbag in your car randomly went off on 0.1% of drives you took, you'd have that happen to you once a year or so, and there's a good chance that it would eventually cause you lose control of your car and crash.