4 ms·

Three angle of attack sensors seems unnecessary to me. They simply need to make MCAS pay attention to both (2) and cut out if one disagrees with the other.

leesalminen 8y ago
How would it know which one is the malfunctioning one?
- janc_ 8y ago
  That's not important; you disable that “autopilot feature” and sound an alarm in the cockpit explaining what the exact error is. Should be enough for the human pilots to react properly.
- darkpuma 8y ago
  You don't.... That's why I said "and cut out if one disagrees with the other." If they don't both give the same reading, MCAS turns off.
jarym 8y ago
The reason there should be 3 is likely because the odds of 2 failing are not unlikely enough from a safety perspective. There’s no problem if one fails but what if both fail and both corroborate a bad reading? Certainly the cost of 3 such sensors would not be as high as the cost of another crash.
- maxmunzel 8y ago
  As far as i know you use three sensors, so you can automatically compensate for one failing/misreporting sensor without human intervention.
  - darkpuma 8y ago
    You can't compensate because you don't know which one is wrong. However you can make MCAS inactive whenever the two sensors are disagreeing with each other.
    - Macha 8y ago
      With the current two sensor setup, that is true. This is why the parent poster is arguing for 3 sensors (and the real reason for tripling). If not all sensors agree but 2/3 do, it is more probable that the two sensors are correct than the 1 sensor disagreeing.
      - darkpuma 8y ago
        Right, but the MCAS system as it was implemented during those two crashes did not disable itself when the two sensors disagreed. It could have, but didn't. Boeing is apparently changing that, and I believe that change to be sufficient. MCAS being automatically disabled when the sensors agree but leaving the pilots with electronic trim control seems like a perfectly adequate solution. The MCAS system was never even necessary for flight, it was only necessary for certification. In the situations where it's meant to be active, which are a limited subset of all high angle of attack scenarios, it's fine system to have if it's working correctly. But it should never be active outside of that limited set of scenarios. It should never be active when both angle of attack sensors aren't indicating a high angle of attack within a reasonable distance of each other. Frankly, if two sensors are indicating a high angle of attack and one is not, it's probably still sensible to disable MCAS. I don't have any of the real numbers, but the chance of a 737 being in a low speed high angle of attack scenario is low in the first place, possibly sufficiently low that "two sensors being wrong and the aircraft being in level flight" might be more likely than "aircraft is near stall and one sensor is wrong." To know for sure we'd need at least the hard data on what modes of failure these sensors have, how likely any of those modes is to occur and what the expected readouts from those failure modes are, and how likely a 737 is to encounter a low speed stall scenario. We, or at least I, don't have any of that. But my gut says that two sensors are sufficient iff the MCAS system is only active when they agree. Furthermore, the chance of two sensors being wrong actually goes up if you have three sensors, rather than two. Correct me if I'm wrong, stats was never my strong point, but it seems to me like the cumulative binomial distribution is relevant here: #lang racket (require math/number-theory) (define (general-binomial p k n) (* (binomial n k) (expt p k) (expt (- 1 p) (- n k)))) (define (cumulative-general-binomial p k1 k2 n) (apply + (map (λ (k) (general-binomial p k n)) (range k1 (add1 k2))))) Chance of a single sensor failing, if each has a 1% chance of failure (sanity check): > (cumulative-general-binomial .01 1 1 1) 0.01 Chance of two or three out of three sensors failing, if each has a 1% chance of failure: > (cumulative-general-binomial .01 2 3 3) 0.00029800000000000003 Chance of two out of two sensors failing, if each has a 15 chance of failure: > (cumulative-general-binomial .01 2 2 2) 0.0001 Two out of three sensors failing is three times more likely than two out of two sensors failing! (In other words, two broken sensors voting out a third working sensor is more likely than two out of two sensors being broken.)

leesalminen 8y ago

How would it know which one is the malfunctioning one?

janc_ 8y ago
That's not important; you disable that “autopilot feature” and sound an alarm in the cockpit explaining what the exact error is. Should be enough for the human pilots to react properly.
darkpuma 8y ago
You don't.... That's why I said "and cut out if one disagrees with the other." If they don't both give the same reading, MCAS turns off.

jarym 8y ago

The reason there should be 3 is likely because the odds of 2 failing are not unlikely enough from a safety perspective. There’s no problem if one fails but what if both fail and both corroborate a bad reading? Certainly the cost of 3 such sensors would not be as high as the cost of another crash.

maxmunzel 8y ago
As far as i know you use three sensors, so you can automatically compensate for one failing/misreporting sensor without human intervention.
- darkpuma 8y ago
  You can't compensate because you don't know which one is wrong. However you can make MCAS inactive whenever the two sensors are disagreeing with each other.
  - Macha 8y ago
    With the current two sensor setup, that is true. This is why the parent poster is arguing for 3 sensors (and the real reason for tripling). If not all sensors agree but 2/3 do, it is more probable that the two sensors are correct than the 1 sensor disagreeing.
    - darkpuma 8y ago
      Right, but the MCAS system as it was implemented during those two crashes did not disable itself when the two sensors disagreed. It could have, but didn't. Boeing is apparently changing that, and I believe that change to be sufficient. MCAS being automatically disabled when the sensors agree but leaving the pilots with electronic trim control seems like a perfectly adequate solution. The MCAS system was never even necessary for flight, it was only necessary for certification. In the situations where it's meant to be active, which are a limited subset of all high angle of attack scenarios, it's fine system to have if it's working correctly. But it should never be active outside of that limited set of scenarios. It should never be active when both angle of attack sensors aren't indicating a high angle of attack within a reasonable distance of each other. Frankly, if two sensors are indicating a high angle of attack and one is not, it's probably still sensible to disable MCAS. I don't have any of the real numbers, but the chance of a 737 being in a low speed high angle of attack scenario is low in the first place, possibly sufficiently low that "two sensors being wrong and the aircraft being in level flight" might be more likely than "aircraft is near stall and one sensor is wrong." To know for sure we'd need at least the hard data on what modes of failure these sensors have, how likely any of those modes is to occur and what the expected readouts from those failure modes are, and how likely a 737 is to encounter a low speed stall scenario. We, or at least I, don't have any of that. But my gut says that two sensors are sufficient iff the MCAS system is only active when they agree. Furthermore, the chance of two sensors being wrong actually goes up if you have three sensors, rather than two. Correct me if I'm wrong, stats was never my strong point, but it seems to me like the cumulative binomial distribution is relevant here: #lang racket (require math/number-theory) (define (general-binomial p k n) (* (binomial n k) (expt p k) (expt (- 1 p) (- n k)))) (define (cumulative-general-binomial p k1 k2 n) (apply + (map (λ (k) (general-binomial p k n)) (range k1 (add1 k2))))) Chance of a single sensor failing, if each has a 1% chance of failure (sanity check): > (cumulative-general-binomial .01 1 1 1) 0.01 Chance of two or three out of three sensors failing, if each has a 1% chance of failure: > (cumulative-general-binomial .01 2 3 3) 0.00029800000000000003 Chance of two out of two sensors failing, if each has a 15 chance of failure: > (cumulative-general-binomial .01 2 2 2) 0.0001 Two out of three sensors failing is three times more likely than two out of two sensors failing! (In other words, two broken sensors voting out a third working sensor is more likely than two out of two sensors being broken.)