6 ms·

I won’t fly one unless it has 3 angle of attack sensors. Since that can’t be easily found out, I’ll avoid them.

by adrr 8y ago

darkpuma 8y ago
Three angle of attack sensors seems unnecessary to me. They simply need to make MCAS pay attention to both (2) and cut out if one disagrees with the other.
- leesalminen 8y ago
  How would it know which one is the malfunctioning one?
  - janc_ 8y ago
    That's not important; you disable that “autopilot feature” and sound an alarm in the cockpit explaining what the exact error is. Should be enough for the human pilots to react properly.
  - darkpuma 8y ago
    You don't.... That's why I said "and cut out if one disagrees with the other." If they don't both give the same reading, MCAS turns off.
- jarym 8y ago
  The reason there should be 3 is likely because the odds of 2 failing are not unlikely enough from a safety perspective. There’s no problem if one fails but what if both fail and both corroborate a bad reading? Certainly the cost of 3 such sensors would not be as high as the cost of another crash.
  - maxmunzel 8y ago
    As far as i know you use three sensors, so you can automatically compensate for one failing/misreporting sensor without human intervention.
    - darkpuma 8y ago
      You can't compensate because you don't know which one is wrong. However you can make MCAS inactive whenever the two sensors are disagreeing with each other.
      - Macha 8y ago
        With the current two sensor setup, that is true. This is why the parent poster is arguing for 3 sensors (and the real reason for tripling). If not all sensors agree but 2/3 do, it is more probable that the two sensors are correct than the 1 sensor disagreeing.
        darkpuma 8y ago
        Right, but the MCAS system as it was implemented during those two crashes did not disable itself when the two sensors disagreed. It could have, but didn't. Boeing is apparently changing that, and I believe that change to be sufficient. MCAS being automatically disabled when the sensors agree but leaving the pilots with electronic trim control seems like a perfectly adequate solution. The MCAS system was never even necessary for flight, it was only necessary for certification. In the situations where it's meant to be active, which are a limited subset of all high angle of attack scenarios, it's fine system to have if it's working correctly. But it should never be active outside of that limited set of scenarios. It should never be active when both angle of attack sensors aren't indicating a high angle of attack within a reasonable distance of each other. Frankly, if two sensors are indicating a high angle of attack and one is not, it's probably still sensible to disable MCAS. I don't have any of the real numbers, but the chance of a 737 being in a low speed high angle of attack scenario is low in the first place, possibly sufficiently low that "two sensors being wrong and the aircraft being in level flight" might be more likely than "aircraft is near stall and one sensor is wrong." To know for sure we'd need at least the hard data on what modes of failure these sensors have, how likely any of those modes is to occur and what the expected readouts from those failure modes are, and how likely a 737 is to encounter a low speed stall scenario. We, or at least I, don't have any of that. But my gut says that two sensors are sufficient iff the MCAS system is only active when they agree. Furthermore, the chance of two sensors being wrong actually goes up if you have three sensors, rather than two. Correct me if I'm wrong, stats was never my strong point, but it seems to me like the cumulative binomial distribution is relevant here: #lang racket (require math/number-theory) (define (general-binomial p k n) (* (binomial n k) (expt p k) (expt (- 1 p) (- n k)))) (define (cumulative-general-binomial p k1 k2 n) (apply + (map (λ (k) (general-binomial p k n)) (range k1 (add1 k2))))) Chance of a single sensor failing, if each has a 1% chance of failure (sanity check): > (cumulative-general-binomial .01 1 1 1) 0.01 Chance of two or three out of three sensors failing, if each has a 1% chance of failure: > (cumulative-general-binomial .01 2 3 3) 0.00029800000000000003 Chance of two out of two sensors failing, if each has a 15 chance of failure: > (cumulative-general-binomial .01 2 2 2) 0.0001 Two out of three sensors failing is three times more likely than two out of two sensors failing! (In other words, two broken sensors voting out a third working sensor is more likely than two out of two sensors being broken.)
mrpippy 8y ago
No 737 has 3 AoA vanes, and it’s extremely unlikely they’ll ever change the design to accommodate that. Every MAX will have an indicator to show if they disagree though.
- anoncake 8y ago
  Does adding a sensor really significantly change the design?
- fanf2 8y ago
  The AOA disagree indicator was an optional extra that was missing on the planes that crashed - https://arstechnica.com/information-technology/2019/04/boeing-delays-737-max-software-fix-delivery/ https://arstechnica.com/information-technology/2019/04/boein...
  - mrpippy 8y ago
    Correct, and the AoA disagree indicator will be added to every plane (for free) as part of the MCAS software fix.
noncoml 8y ago
The problem is not the missing extra angle of attack sensor, but incompetence at every step. If I understood correctly, MCAS trimmed it so much that the pilots were unable to bring it back manually. This sounds like Boeing engineers didn’t even put a limit on the maximum trimming that MCAS can do, not even to the maximum theoretical limit for the plane/engines.
- HarryHirsch 8y ago
  MCAS trimmed it so much that the pilots were unable to bring it back manually. Not only that, MCAS controlled an electric motor which turned the trim wheel and which could apply more torque than a human turning it manually. The only way to disable MCAS was to cut power to that motor. MCAS pointed the aircraft at the ground, and it was impossible to trim the aircraft to achieve level flight again. Mind, MCAS was supposed to be a crutch to fly at the edges of the flight envelope, something that a regular pilot would never encounter because under normal conditions pilots wouldn't find themselves in a regime where MCAS would be activated. That was the idea, instead we had two hull losses within 6 months!
  - Obi_Juan_Kenobi 8y ago
    The electric trim adjustment is obviously going to be more powerful, that's just the reality of large planes. That's not the issue. The issue from the Ethiopian crash was that, in the extreme trim angle, there was simply too much force on the screw to turn manually. This condition is trained for, and the solution is to let the plan angle down to relieve the aerodynamic pressure on the control surface. That gives you an opportunity to manually control the trim wheels. The pilots did not have the benefit of altitude to perform this maneuver, so (likely) instead re-enabled the electric trim in a bid to use it to reduce the nose-down trim before the MCAS would re-engage. This proved fatal.
    - matt-attack 8y ago
      Are you suggesting with the auto-trim disabled, the two pilots working together, with those handles extended on the trim wheel, were not strong enough to crank the trim wheel?
dreamcompiler 8y ago
It's very easy to see the two AOA sensors on a Boeing jet when it's parked at the gate--there's one on each side of the plane. What I don't know is where Airbus puts the third one.
- Zak 8y ago
  Airbus puts two on one side and one on the other.

I won’t fly one unless it has 3 angle of attack sensors. Since that can’t be easily found out, I’ll avoid them.

by adrr 8y ago

I won’t fly one unless it has 3 angle of attack sensors. Since that can’t be easily found out, I’ll avoid them.

Three angle of attack sensors seems unnecessary to me. They simply need to make MCAS pay attention to both (2) and cut out if one disagrees with the other.

leesalminen 8y ago
How would it know which one is the malfunctioning one?
- janc_ 8y ago
  That's not important; you disable that “autopilot feature” and sound an alarm in the cockpit explaining what the exact error is. Should be enough for the human pilots to react properly.
- darkpuma 8y ago
  You don't.... That's why I said "and cut out if one disagrees with the other." If they don't both give the same reading, MCAS turns off.
jarym 8y ago
The reason there should be 3 is likely because the odds of 2 failing are not unlikely enough from a safety perspective. There’s no problem if one fails but what if both fail and both corroborate a bad reading? Certainly the cost of 3 such sensors would not be as high as the cost of another crash.
- maxmunzel 8y ago
  As far as i know you use three sensors, so you can automatically compensate for one failing/misreporting sensor without human intervention.
  - darkpuma 8y ago
    You can't compensate because you don't know which one is wrong. However you can make MCAS inactive whenever the two sensors are disagreeing with each other.
    - Macha 8y ago
      With the current two sensor setup, that is true. This is why the parent poster is arguing for 3 sensors (and the real reason for tripling). If not all sensors agree but 2/3 do, it is more probable that the two sensors are correct than the 1 sensor disagreeing.
      - darkpuma 8y ago
        Right, but the MCAS system as it was implemented during those two crashes did not disable itself when the two sensors disagreed. It could have, but didn't. Boeing is apparently changing that, and I believe that change to be sufficient. MCAS being automatically disabled when the sensors agree but leaving the pilots with electronic trim control seems like a perfectly adequate solution. The MCAS system was never even necessary for flight, it was only necessary for certification. In the situations where it's meant to be active, which are a limited subset of all high angle of attack scenarios, it's fine system to have if it's working correctly. But it should never be active outside of that limited set of scenarios. It should never be active when both angle of attack sensors aren't indicating a high angle of attack within a reasonable distance of each other. Frankly, if two sensors are indicating a high angle of attack and one is not, it's probably still sensible to disable MCAS. I don't have any of the real numbers, but the chance of a 737 being in a low speed high angle of attack scenario is low in the first place, possibly sufficiently low that "two sensors being wrong and the aircraft being in level flight" might be more likely than "aircraft is near stall and one sensor is wrong." To know for sure we'd need at least the hard data on what modes of failure these sensors have, how likely any of those modes is to occur and what the expected readouts from those failure modes are, and how likely a 737 is to encounter a low speed stall scenario. We, or at least I, don't have any of that. But my gut says that two sensors are sufficient iff the MCAS system is only active when they agree. Furthermore, the chance of two sensors being wrong actually goes up if you have three sensors, rather than two. Correct me if I'm wrong, stats was never my strong point, but it seems to me like the cumulative binomial distribution is relevant here: #lang racket (require math/number-theory) (define (general-binomial p k n) (* (binomial n k) (expt p k) (expt (- 1 p) (- n k)))) (define (cumulative-general-binomial p k1 k2 n) (apply + (map (λ (k) (general-binomial p k n)) (range k1 (add1 k2))))) Chance of a single sensor failing, if each has a 1% chance of failure (sanity check): > (cumulative-general-binomial .01 1 1 1) 0.01 Chance of two or three out of three sensors failing, if each has a 1% chance of failure: > (cumulative-general-binomial .01 2 3 3) 0.00029800000000000003 Chance of two out of two sensors failing, if each has a 15 chance of failure: > (cumulative-general-binomial .01 2 2 2) 0.0001 Two out of three sensors failing is three times more likely than two out of two sensors failing! (In other words, two broken sensors voting out a third working sensor is more likely than two out of two sensors being broken.)

mrpippy 8y ago

No 737 has 3 AoA vanes, and it’s extremely unlikely they’ll ever change the design to accommodate that. Every MAX will have an indicator to show if they disagree though.

anoncake 8y ago
Does adding a sensor really significantly change the design?
fanf2 8y ago
The AOA disagree indicator was an optional extra that was missing on the planes that crashed - https://arstechnica.com/information-technology/2019/04/boeing-delays-737-max-software-fix-delivery/ https://arstechnica.com/information-technology/2019/04/boein...
- mrpippy 8y ago
  Correct, and the AoA disagree indicator will be added to every plane (for free) as part of the MCAS software fix.

noncoml 8y ago

The problem is not the missing extra angle of attack sensor, but incompetence at every step. If I understood correctly, MCAS trimmed it so much that the pilots were unable to bring it back manually. This sounds like Boeing engineers didn’t even put a limit on the maximum trimming that MCAS can do, not even to the maximum theoretical limit for the plane/engines.

HarryHirsch 8y ago
MCAS trimmed it so much that the pilots were unable to bring it back manually. Not only that, MCAS controlled an electric motor which turned the trim wheel and which could apply more torque than a human turning it manually. The only way to disable MCAS was to cut power to that motor. MCAS pointed the aircraft at the ground, and it was impossible to trim the aircraft to achieve level flight again. Mind, MCAS was supposed to be a crutch to fly at the edges of the flight envelope, something that a regular pilot would never encounter because under normal conditions pilots wouldn't find themselves in a regime where MCAS would be activated. That was the idea, instead we had two hull losses within 6 months!
- Obi_Juan_Kenobi 8y ago
  The electric trim adjustment is obviously going to be more powerful, that's just the reality of large planes. That's not the issue. The issue from the Ethiopian crash was that, in the extreme trim angle, there was simply too much force on the screw to turn manually. This condition is trained for, and the solution is to let the plan angle down to relieve the aerodynamic pressure on the control surface. That gives you an opportunity to manually control the trim wheels. The pilots did not have the benefit of altitude to perform this maneuver, so (likely) instead re-enabled the electric trim in a bid to use it to reduce the nose-down trim before the MCAS would re-engage. This proved fatal.
  - matt-attack 8y ago
    Are you suggesting with the auto-trim disabled, the two pilots working together, with those handles extended on the trim wheel, were not strong enough to crank the trim wheel?

dreamcompiler 8y ago

It's very easy to see the two AOA sensors on a Boeing jet when it's parked at the gate--there's one on each side of the plane. What I don't know is where Airbus puts the third one.

Zak 8y ago
Airbus puts two on one side and one on the other.