5 ms·

Mass media in general is stressing too much the fact that 737 MAX is allegedly based on dated designs. I think it's fair to say that MAX versions present some

by myth2018 8y ago

Mass media in general is stressing too much the fact that 737 MAX is allegedly based on dated designs. I think it's fair to say that MAX versions present some compromise solutions (like the now-infamous MCAS, which is there to compensate for the "unnatural" bigger engines). But I think that is not the main point. They would be good solutions it they worked as intended. There are some other more fundamental and more daunting, afaik unanswered questions. Like, why does such a critical system like MCAS take only a single AoA sensor as input, when there are two sensors available? Specially considering that the inputs from both are hardware-available to MCAS (the new software version is going to take data from both). Boeing affirmed in its manuals that the elevators would be able to compensate for the trimmed vertical stabilizers. Now the preliminary report in the Ethiopian's crash shows that the pilots wheren't able to perform such compensation, even by pulling the control columns all the way back. Those and some other issues are much more critical.

kacamak 8y ago
>Like, why does such a critical system like MCAS take only a single AoA sensor as input The classic approach is to have three sensors, so in case one fails you can know which one. Having two only indicates something is wrong but is not useful on the fly.
- flyinglizard 8y ago
  Three with a disagree algorithm is definitely what I’d expect out of such a critical system, but two with signal averaging would still be much better than just one.
  - cm2187 8y ago
    Or alternatively with two, and disabling MCAS if they disagree, seems a better solution than having one and having no way to tell if it is working (keeping in mind both can still fail simultaneously). Not an ideal solution but better.
    - myth2018 8y ago
      This is one of the features of the MCAS software update.
  - JauntyHatAngle 8y ago
    Unless I am misunderstanding what signal averaging is (quite possible) isn't it possible that in situations where the average of a signal is still going to crash the plane, a 50/50 guess is actually more likely to end up with a better chance? If true, it's possible signal averaging isnt necessarily the best choice
  - myth2018 8y ago
    Averaging would be disastrous in this case. You don't want to use faulty data to average inputs to a flight control computer.
- michaelt 8y ago
  Of course, even with triple-redundant systems failures can still occur. Air France 447 [1] three independent air data systems, two of them failed due to environmental conditions XL Airways 888T [2] three independent AOA sensors, two failed because the plane was washed without the right covers in place US Airways 1549 [3] two independent engines, both disabled by bird strike at the same time (No fatalities) Qantas Flight 72 [4] three independent inertial reference units, bug in voting system if a single sensor's output had multiple spikes 1.2 seconds apart (no fatalities) An in the data centre, no amount of power-supply redundancy will save you if a technician pulls out the power cables on the wrong server :) [1] https://en.wikipedia.org/wiki/Air_France_Flight_447#cite_ref-74 https://en.wikipedia.org/wiki/Air_France_Flight_447#cite_ref... [2] https://en.wikipedia.org/wiki/XL_Airways_Germany_Flight_888T https://en.wikipedia.org/wiki/XL_Airways_Germany_Flight_888T [3] https://en.wikipedia.org/wiki/US_Airways_Flight_1549 https://en.wikipedia.org/wiki/US_Airways_Flight_1549 [4] https://en.wikipedia.org/wiki/Qantas_Flight_72 https://en.wikipedia.org/wiki/Qantas_Flight_72
- myth2018 8y ago
  Boeing has been using only two for quite a time. Having a failed and a working one would simply indicate that something is wrong, but this information is valuable anyway -- it could be used to prevent MCAS from engaging based on wrong data, exactly one of the features the new software update is bringing. Besides, those AoA sensors are EXTREMELY reliable. So reliable that some have raised the hypothesis that the real problem is not in the sensors themselves, but in some piece of hardware or software between them and the flight computers. It seems plausible to me since failures in those sensors are too rare in the other planes but, despite that, they allegedly failed in two 737 Max 8s and in a really short timespan.
- js2 8y ago
  > The classic approach is to have three sensors Which can also fail: In 2008, on a customer-acceptance flight of an Airbus A320, two of the angle-of-attack sensors froze and those two sensors then outvoted the third. When the pilots went to demonstrate the stall-prevention system, they were not aware of the malfunctioning sensors. The plane crashed, killing the seven people on board. The same problem arose again on a 2014 Airbus A321 Lufthansa flight leaving Spain. Eight minutes after takeoff, two of the angle-of-attack sensors froze at the same pitch. This time, after a drop in altitude, the pilots were able to regain control and complete the flight. [1] I don't think the fundamental problem with MCAS was the number of sensors, but that it was too difficult for the pilots to override MCAS when it faulted. 1. https://www.seattletimes.com/business/boeing-aerospace/a-lack-of-redundancies-on-737-max-system-has-baffled-even-those-who-worked-on-the-jet/ https://www.seattletimes.com/business/boeing-aerospace/a-lac...
JauntyHatAngle 8y ago
>Like, why does such a critical system like MCAS take only a single AoA sensor as input, when there are two sensors available? Specially considering that the inputs from both are hardware-available to MCAS (the new software version is going to take data from both). Are you saying the answer in the article didn't give enough information? "Airbus addressed this potential problem on some of its planes by installing three or more such sensors. Former Max engineers, including one who worked on the sensors, said adding a third sensor to the Max was a nonstarter. Previous 737s, they said, had used two and managers wanted to limit changes. The angle of attack sensor, bottom, on a Boeing 737 Max 8.CreditRuth Fremson/The New York Times “They wanted to A, save money and B, to minimize the certification and flight-test costs,” said Mike Renzelmann, an engineer who worked on the Max’s flight controls. “Any changes are going to require recertification.” Mr. Renzelmann was not involved in discussions about the sensors."
- cm2187 8y ago
  No it doesn’t answer the question. If there are two sensors already installed, not requiring change, how come the MCAS only uses one, not both?
  - VBprogrammer 8y ago
    Instrumentation on an aircraft is usually designed with a pilot and copilot set. Everything down to the pitot tubes which feed the information is unique to that side of the aircraft. This harks back to the day when it was the only sensible solution when your guages are actually just directly reading airpressure differences. Clearly these signals can be cross connected, because that's the solution Boeing are testing at the moment, but it's outside the normal design of aircraft systems.
    - myth2018 8y ago
      Uhm.. I don't know.. I'm aware this is the case of airspeed indicators and many others, but, for instance, the autopilot is fed with readings of Pitot tubes from both sides and it disengages when the sensors disagree beyond sensible thresholds. Besides, such issue is brought clearly to the knowledge of pilots. In the MCAS case, however, we are speaking about a computer which not only interferes in the flight controls, but also does that in a way impossible to override and it's too difficult for the pilots to spot the root cause.
et2o 8y ago
They designed it precisely like this because it's a dated design. To use two sensors (or three) would have required new cockpit components and new pilot training, which is what they were trying to avoid by reusing the same Type certificate originally from 1968.

kacamak 8y ago

>Like, why does such a critical system like MCAS take only a single AoA sensor as input The classic approach is to have three sensors, so in case one fails you can know which one. Having two only indicates something is wrong but is not useful on the fly.

flyinglizard 8y ago
Three with a disagree algorithm is definitely what I’d expect out of such a critical system, but two with signal averaging would still be much better than just one.
- cm2187 8y ago
  Or alternatively with two, and disabling MCAS if they disagree, seems a better solution than having one and having no way to tell if it is working (keeping in mind both can still fail simultaneously). Not an ideal solution but better.
  - myth2018 8y ago
    This is one of the features of the MCAS software update.
- JauntyHatAngle 8y ago
  Unless I am misunderstanding what signal averaging is (quite possible) isn't it possible that in situations where the average of a signal is still going to crash the plane, a 50/50 guess is actually more likely to end up with a better chance? If true, it's possible signal averaging isnt necessarily the best choice
- myth2018 8y ago
  Averaging would be disastrous in this case. You don't want to use faulty data to average inputs to a flight control computer.
michaelt 8y ago
Of course, even with triple-redundant systems failures can still occur. Air France 447 [1] three independent air data systems, two of them failed due to environmental conditions XL Airways 888T [2] three independent AOA sensors, two failed because the plane was washed without the right covers in place US Airways 1549 [3] two independent engines, both disabled by bird strike at the same time (No fatalities) Qantas Flight 72 [4] three independent inertial reference units, bug in voting system if a single sensor's output had multiple spikes 1.2 seconds apart (no fatalities) An in the data centre, no amount of power-supply redundancy will save you if a technician pulls out the power cables on the wrong server :) [1] https://en.wikipedia.org/wiki/Air_France_Flight_447#cite_ref-74 https://en.wikipedia.org/wiki/Air_France_Flight_447#cite_ref... [2] https://en.wikipedia.org/wiki/XL_Airways_Germany_Flight_888T https://en.wikipedia.org/wiki/XL_Airways_Germany_Flight_888T [3] https://en.wikipedia.org/wiki/US_Airways_Flight_1549 https://en.wikipedia.org/wiki/US_Airways_Flight_1549 [4] https://en.wikipedia.org/wiki/Qantas_Flight_72 https://en.wikipedia.org/wiki/Qantas_Flight_72
myth2018 8y ago
Boeing has been using only two for quite a time. Having a failed and a working one would simply indicate that something is wrong, but this information is valuable anyway -- it could be used to prevent MCAS from engaging based on wrong data, exactly one of the features the new software update is bringing. Besides, those AoA sensors are EXTREMELY reliable. So reliable that some have raised the hypothesis that the real problem is not in the sensors themselves, but in some piece of hardware or software between them and the flight computers. It seems plausible to me since failures in those sensors are too rare in the other planes but, despite that, they allegedly failed in two 737 Max 8s and in a really short timespan.
js2 8y ago
> The classic approach is to have three sensors Which can also fail: In 2008, on a customer-acceptance flight of an Airbus A320, two of the angle-of-attack sensors froze and those two sensors then outvoted the third. When the pilots went to demonstrate the stall-prevention system, they were not aware of the malfunctioning sensors. The plane crashed, killing the seven people on board. The same problem arose again on a 2014 Airbus A321 Lufthansa flight leaving Spain. Eight minutes after takeoff, two of the angle-of-attack sensors froze at the same pitch. This time, after a drop in altitude, the pilots were able to regain control and complete the flight. [1] I don't think the fundamental problem with MCAS was the number of sensors, but that it was too difficult for the pilots to override MCAS when it faulted. 1. https://www.seattletimes.com/business/boeing-aerospace/a-lack-of-redundancies-on-737-max-system-has-baffled-even-those-who-worked-on-the-jet/ https://www.seattletimes.com/business/boeing-aerospace/a-lac...

JauntyHatAngle 8y ago

>Like, why does such a critical system like MCAS take only a single AoA sensor as input, when there are two sensors available? Specially considering that the inputs from both are hardware-available to MCAS (the new software version is going to take data from both). Are you saying the answer in the article didn't give enough information? "Airbus addressed this potential problem on some of its planes by installing three or more such sensors. Former Max engineers, including one who worked on the sensors, said adding a third sensor to the Max was a nonstarter. Previous 737s, they said, had used two and managers wanted to limit changes. The angle of attack sensor, bottom, on a Boeing 737 Max 8.CreditRuth Fremson/The New York Times “They wanted to A, save money and B, to minimize the certification and flight-test costs,” said Mike Renzelmann, an engineer who worked on the Max’s flight controls. “Any changes are going to require recertification.” Mr. Renzelmann was not involved in discussions about the sensors."

cm2187 8y ago
No it doesn’t answer the question. If there are two sensors already installed, not requiring change, how come the MCAS only uses one, not both?
- VBprogrammer 8y ago
  Instrumentation on an aircraft is usually designed with a pilot and copilot set. Everything down to the pitot tubes which feed the information is unique to that side of the aircraft. This harks back to the day when it was the only sensible solution when your guages are actually just directly reading airpressure differences. Clearly these signals can be cross connected, because that's the solution Boeing are testing at the moment, but it's outside the normal design of aircraft systems.
  - myth2018 8y ago
    Uhm.. I don't know.. I'm aware this is the case of airspeed indicators and many others, but, for instance, the autopilot is fed with readings of Pitot tubes from both sides and it disengages when the sensors disagree beyond sensible thresholds. Besides, such issue is brought clearly to the knowledge of pilots. In the MCAS case, however, we are speaking about a computer which not only interferes in the flight controls, but also does that in a way impossible to override and it's too difficult for the pilots to spot the root cause.

et2o 8y ago

They designed it precisely like this because it's a dated design. To use two sensors (or three) would have required new cockpit components and new pilot training, which is what they were trying to avoid by reusing the same Type certificate originally from 1968.