5 ms·

So if the sensors have a higher rate of failure then it looks like changing MCAS software to rely on both sensors may not be enough as there is a higher probabi

So if the sensors have a higher rate of failure then it looks like changing MCAS software to rely on both sensors may not be enough as there is a higher probability of both sensors malfunctioning and sending bad data to MCAS at the same moment. In that case, I am not sure how would MCAS behave.

stackola 8y ago
If these sensors have a common failure mode (eg. always showing lowest possible value after blowing up), this could be bad. If they just produce junk, it's unlikely they would agree, and MCAS would be turned off.
- cjbprime 8y ago
  The common failure mode would be e.g. freezing, perhaps in identical positions, while on the ground before takeoff. You can't easily detect it before takeoff because the sensor requires airflow.
  - blattimwind 8y ago
    I assume you can walk up to it and turn it by hand to at least see that the mechanical part is moving freely as-of now.
    - bgdam 8y ago
      Can't always test the mechanics like that. Ex: Pitot tubes are just hollow tubes. The interiors of pitot tubes getting iced over has crashed planes. This wouldn't even be visible from the outside, and there is no test you could do.
      - maxmunzel 8y ago
        Couldn’t you just blow in?
        chipsa 8y ago
        No. The tube leads to a pressure sensor. There's generally no actual airflow moving through the tube in use.
    - kayfox 8y ago
      It can freeze from icing or other low temperature conditions after takeoff. The sensors are heated to prevent this, with a system in place to detect if the heater has failed, but they can still jam from a heater failure that is not detected or heavy icing.
      - magicalhippo 8y ago
        Surely this could be easily detected, even with too low airspeed to give reliable readings the sensors should flap around slightly and thus provide noise. If they're frozen, there should be very little noise in comparison. In addition you should be able to cross-correlate with gyro and airspeed sensor, not to check the absolute AoA, but certainly determine if delta-AoA is near zero (frozen) or not.
        chipsa 8y ago
        The sensors should be on good bearings, in order to promote them moving freely. Them flapping around slightly won't provide much noise. Which is probably drowned out by all the other noise on an aircraft.
        magicalhippo 8y ago
        > Them flapping around slightly won't provide much noise. Which is probably drowned out by all the other noise on an aircraft. But the readings with the vane flapping around should have a significantly higher variance than the readings where the vane has frozen stuck. In addition, a sliding average should show the mean moving around significantly compared to the frozen readings. Surely they should be able to discriminate between these cases based on those factors, especially when cross-correlated with other sensors.
- tzs 8y ago
  Do any planes do cross-sensor sanity checks? For example, if the AoA sensors say the nose is too high and the flight control software trims down to compensate and then it doesn't see the AoA sensors report lower pitch, couldn't it check the Attitude Indicator (AI)? Angle of attack and attitude aren't necessarily the same, because the wind vector is not necessarily parallel to the ground, but AoA changes and AI changes should be well correlated most of the time. If trim changes are showing up in the AI data but not the AoA data, then you've probably got malfunctioning AoA sensors.
  - jsmith45 8y ago
    My understanding is that attitude is only a reasonable approximation of Angle of attack (assuming winds are parallel to the ground) if you are in level flight. My understanding is that with still air, AOA is basically the difference between the attitude and the vertical direction of travel. (i.e. in still air you are climbing at an angle of 5 degrees with the nose pointed up at 10 degrees, your AOA would be 5). So in my possibly flawed understanding the better way to approximate real angle of attack when the wind is parallel to the ground would probably be to take airspeed and rate of climb data, perform trig to get the angle of climb or descent as seen from the air reference frame (cf. airspeed vs groundspeed). Then subtract that from the gyro indicated attitude, and you get an angle of attack approximation that assumes no up or downdrafts. That combination might yield something better to compare against the AOA sensors than just the attitude value. (Although I would agree that if it changing the trim causes the attitude to change but not the AOA sensor output, something is probably wrong.)
VBprogrammer 8y ago
The other part of Boeings fix is to prevent MCAS from being reactivated repeatedly. If I remember correctly they are not allowing it to reactivate until the AoA returns to normal. I'm hopeful that they have analysed what happens if the AoA returns more or less random data.
- zepearl 8y ago
  > ...they are not allowing it to reactivate until the AoA returns to normal. Puah, but what is "normal"? This is probably kind of tricky to define if you cannot potentially rely on the sensor(s). Additionally I understand that the auto-trim of MCAS was created to actually react to "abnormal" situations (nose too high), which brings us here into a conflict :)
  - VBprogrammer 8y ago
    By normal I mean below its threshold for activation. According to Boeing this depends on speed and attitude. Of course this leaves the problem of what happens if the sensor data was wrong but fluctuating wildly. Which is what I was getting at in the other paragraph. In both the Lion Air and the Ethiopian incident the sensor data went to some very high value and stayed fixed basically until the aircraft hit the ground so perhaps they know that is the only failure mode or maybe they are accounting for other failures but don't feel the need to expand upon that in public.
- rasz 8y ago
  Good thing its easy to manually trim then https://vimeo.com/329558134 https://vimeo.com/329558134

stackola 8y ago

If these sensors have a common failure mode (eg. always showing lowest possible value after blowing up), this could be bad. If they just produce junk, it's unlikely they would agree, and MCAS would be turned off.

cjbprime 8y ago
The common failure mode would be e.g. freezing, perhaps in identical positions, while on the ground before takeoff. You can't easily detect it before takeoff because the sensor requires airflow.
- blattimwind 8y ago
  I assume you can walk up to it and turn it by hand to at least see that the mechanical part is moving freely as-of now.
  - bgdam 8y ago
    Can't always test the mechanics like that. Ex: Pitot tubes are just hollow tubes. The interiors of pitot tubes getting iced over has crashed planes. This wouldn't even be visible from the outside, and there is no test you could do.
    - maxmunzel 8y ago
      Couldn’t you just blow in?
      - chipsa 8y ago
        No. The tube leads to a pressure sensor. There's generally no actual airflow moving through the tube in use.
  - kayfox 8y ago
    It can freeze from icing or other low temperature conditions after takeoff. The sensors are heated to prevent this, with a system in place to detect if the heater has failed, but they can still jam from a heater failure that is not detected or heavy icing.
    - magicalhippo 8y ago
      Surely this could be easily detected, even with too low airspeed to give reliable readings the sensors should flap around slightly and thus provide noise. If they're frozen, there should be very little noise in comparison. In addition you should be able to cross-correlate with gyro and airspeed sensor, not to check the absolute AoA, but certainly determine if delta-AoA is near zero (frozen) or not.
      - chipsa 8y ago
        The sensors should be on good bearings, in order to promote them moving freely. Them flapping around slightly won't provide much noise. Which is probably drowned out by all the other noise on an aircraft.
        magicalhippo 8y ago
        > Them flapping around slightly won't provide much noise. Which is probably drowned out by all the other noise on an aircraft. But the readings with the vane flapping around should have a significantly higher variance than the readings where the vane has frozen stuck. In addition, a sliding average should show the mean moving around significantly compared to the frozen readings. Surely they should be able to discriminate between these cases based on those factors, especially when cross-correlated with other sensors.
tzs 8y ago
Do any planes do cross-sensor sanity checks? For example, if the AoA sensors say the nose is too high and the flight control software trims down to compensate and then it doesn't see the AoA sensors report lower pitch, couldn't it check the Attitude Indicator (AI)? Angle of attack and attitude aren't necessarily the same, because the wind vector is not necessarily parallel to the ground, but AoA changes and AI changes should be well correlated most of the time. If trim changes are showing up in the AI data but not the AoA data, then you've probably got malfunctioning AoA sensors.
- jsmith45 8y ago
  My understanding is that attitude is only a reasonable approximation of Angle of attack (assuming winds are parallel to the ground) if you are in level flight. My understanding is that with still air, AOA is basically the difference between the attitude and the vertical direction of travel. (i.e. in still air you are climbing at an angle of 5 degrees with the nose pointed up at 10 degrees, your AOA would be 5). So in my possibly flawed understanding the better way to approximate real angle of attack when the wind is parallel to the ground would probably be to take airspeed and rate of climb data, perform trig to get the angle of climb or descent as seen from the air reference frame (cf. airspeed vs groundspeed). Then subtract that from the gyro indicated attitude, and you get an angle of attack approximation that assumes no up or downdrafts. That combination might yield something better to compare against the AOA sensors than just the attitude value. (Although I would agree that if it changing the trim causes the attitude to change but not the AOA sensor output, something is probably wrong.)

VBprogrammer 8y ago

The other part of Boeings fix is to prevent MCAS from being reactivated repeatedly. If I remember correctly they are not allowing it to reactivate until the AoA returns to normal. I'm hopeful that they have analysed what happens if the AoA returns more or less random data.

zepearl 8y ago
> ...they are not allowing it to reactivate until the AoA returns to normal. Puah, but what is "normal"? This is probably kind of tricky to define if you cannot potentially rely on the sensor(s). Additionally I understand that the auto-trim of MCAS was created to actually react to "abnormal" situations (nose too high), which brings us here into a conflict :)
- VBprogrammer 8y ago
  By normal I mean below its threshold for activation. According to Boeing this depends on speed and attitude. Of course this leaves the problem of what happens if the sensor data was wrong but fluctuating wildly. Which is what I was getting at in the other paragraph. In both the Lion Air and the Ethiopian incident the sensor data went to some very high value and stayed fixed basically until the aircraft hit the ground so perhaps they know that is the only failure mode or maybe they are accounting for other failures but don't feel the need to expand upon that in public.
rasz 8y ago
Good thing its easy to manually trim then https://vimeo.com/329558134 https://vimeo.com/329558134