4 ms·

>The fact that Boeing is able to skate by with two and a software off-switch if they disagree, while Airbus continues to be required to have triple redundancy s

by carlmr 8y ago

>The fact that Boeing is able to skate by with two and a software off-switch if they disagree, while Airbus continues to be required to have triple redundancy says a lot about their respective regulators (EASA Vs FAA). I'm sure "cost" was discussed given the 350+ aircraft already produced and how impractical it is to add a third AoA sensor, but that's literally putting cost over safety. Looking at this image here: https://qz.com/1461400/pilots-werent-informed-of-risks-of-boeing-737-maxs-new-feature/ https://qz.com/1461400/pilots-werent-informed-of-risks-of-bo... My biggest doubt is regarding the symmetrical left-right placement of the AoA vanes. Isn't it realistic that they may freeze in the same position, thus not disagreeing, but still wrong? I'm not in aviation, so I'm not sure about this, but without deeper knowledge this seems like a realistic reason to ask for a 3rd sensor with a different placement at least.

danaliv 8y ago
Theoretically it’s possible that both AoA vanes could ice over, but that would mean failure of both vanes’ heating elements. (Not a jet pilot myself but I teach instrument and charter pilots, and I’m in the clouds a lot!)
cryptonector 8y ago
That Air France flight that crashed in the Atlantic had all its pitots freeze. No amount of redundancy will help with that sort of situation -- the sensors were not designed correctly, specifically they did not have heaters with enough power to keep them not frozen. While Boeing should have to add a third AoA sensor, it's important that the system have some additional fail-safes, such as using gyroscopes to estimate AoA relative to the ground -- a poor estimate of actual AoA, but a decent sanity check. Alarming and proper pilot training should be able to take care of the remaining risk. Indeed, alarming and proper pilot training would have been sufficient to avoid the two MAX crashes (I know, that's not a popular opinion around here).
- carlmr 8y ago
  Proper pilot training of course it's important. From what I've heard it's a very difficult process though, so there's definitely some room for improving the UX here. Using disparate sensors for plausibility is of course also useful and would be possible with a software update.
  - cryptonector 8y ago
    For MCAS there's a button to turn it off.
    - carlmr 8y ago
      From the articles it seemes like you needed to perform an esoteric sequence of 4 things to switch off MCAS and it wasn't clear if you succeeded or not, until it reenabled with a 20s time delay.
- Someone1234 8y ago
  Just for background: the Air France flight referenced (AF447) did in fact have the kind of software fail-safes you're describing, the aircraft entered alternate law (ALT2) when the bad sensor input was detected and several automated flight systems were disabled (including envelope protection). The pilots were notified of this. There's actually a lot of reasons why AF447 crashed[0], so I won't attempt to [badly] summarize it here, but I will say it wasn't simply an equipment malfunction or computer problem. That's just what started the entire chain of events that ultimately lead to the crash. [0] https://en.wikipedia.org/wiki/Air_France_Flight_447#Final_report https://en.wikipedia.org/wiki/Air_France_Flight_447#Final_re...
  - cryptonector 8y ago
    IIRC the biggest problem was cascading alarms -- that and the system's inability to either determine (I forget) or alert about the pilot stalling the craft over the din of all the alarms.

by carlmr 8y ago

danaliv 8y ago

Theoretically it’s possible that both AoA vanes could ice over, but that would mean failure of both vanes’ heating elements. (Not a jet pilot myself but I teach instrument and charter pilots, and I’m in the clouds a lot!)

cryptonector 8y ago

That Air France flight that crashed in the Atlantic had all its pitots freeze. No amount of redundancy will help with that sort of situation -- the sensors were not designed correctly, specifically they did not have heaters with enough power to keep them not frozen. While Boeing should have to add a third AoA sensor, it's important that the system have some additional fail-safes, such as using gyroscopes to estimate AoA relative to the ground -- a poor estimate of actual AoA, but a decent sanity check. Alarming and proper pilot training should be able to take care of the remaining risk. Indeed, alarming and proper pilot training would have been sufficient to avoid the two MAX crashes (I know, that's not a popular opinion around here).

carlmr 8y ago
Proper pilot training of course it's important. From what I've heard it's a very difficult process though, so there's definitely some room for improving the UX here. Using disparate sensors for plausibility is of course also useful and would be possible with a software update.
- cryptonector 8y ago
  For MCAS there's a button to turn it off.
  - carlmr 8y ago
    From the articles it seemes like you needed to perform an esoteric sequence of 4 things to switch off MCAS and it wasn't clear if you succeeded or not, until it reenabled with a 20s time delay.
Someone1234 8y ago
Just for background: the Air France flight referenced (AF447) did in fact have the kind of software fail-safes you're describing, the aircraft entered alternate law (ALT2) when the bad sensor input was detected and several automated flight systems were disabled (including envelope protection). The pilots were notified of this. There's actually a lot of reasons why AF447 crashed[0], so I won't attempt to [badly] summarize it here, but I will say it wasn't simply an equipment malfunction or computer problem. That's just what started the entire chain of events that ultimately lead to the crash. [0] https://en.wikipedia.org/wiki/Air_France_Flight_447#Final_report https://en.wikipedia.org/wiki/Air_France_Flight_447#Final_re...
- cryptonector 8y ago
  IIRC the biggest problem was cascading alarms -- that and the system's inability to either determine (I forget) or alert about the pilot stalling the craft over the din of all the alarms.