9 ms·

Is this only me, or all this one-vs-two AoA sensor talk seems some kind of diversion from the real problem with this plane. I mean, if one-sensor based MCAS fa

Is this only me, or all this one-vs-two AoA sensor talk seems some kind of diversion from the real problem with this plane. I mean, if one-sensor based MCAS failed twice so early in the life span of the plane model, what is the probability that a two-sensor model will fail pretty soon as well? The math should be simple, we have all data needed: combined hours flown by all planes of the type and number of failures (at least two known, which can help us to estimate a MTBF of the sensor).

Aloha 7y ago
The AOA sensors are effectively a consumable, and would undergo regular replacement over the life of the aircraft, the odds of BOTH of them failing at the same moment in the same flight is very very small.
- aivisol 7y ago
  Ok, that makes sense. But are the hours at which they got replaced are on order (or several) of magnitude lower than a two-sensor failure can occur? I hope it is calculated.
  - CydeWeys 7y ago
    The point is that, as safety-critical equipment, you can't fly the plane if one is broken. So you'd need to have two fail within a single flight, and fail in the same way, in order to cause an incorrect activation of MCAS. With just one sensor, it's much more likely. Note that Airbus uses three of these sensors on their planes, so that when one fails you know which one it is, and can still rely on the signals from the two remaining good ones. Then you replace the failed sensor before the next flight.
    - aivisol 7y ago
      That was my original question. What is the probability of them failing at the same flight in the same way (say they got frozen at the same angle, hit by blizzard, etc, etc). Intuition is that the chances are high given their low MTBF.
      - deleted 7y ago
        [deleted]
    - konspence 7y ago
      This works until two sensors fail in the same direction: >The aircraft's computers received conflicting information from the three angle of attack sensors. The aircraft computer system’s programming logic had been designed to reject one sensor value if it deviated significantly from the other two sensor values. In this specific case, this programming logic led to the rejection of the correct value from the one operative angle of attack sensor, and to the acceptance of the two consistent, but wrong, values from the two inoperative angle of attack sensors. This resulted in the system's stall protection functions responding incorrectly to the stall, making the situation worse, instead of better. https://en.m.wikipedia.org/wiki/XL_Airways_Germany_Flight_888T https://en.m.wikipedia.org/wiki/XL_Airways_Germany_Flight_88...
- rightbyte 7y ago
  If they are replaced simultaneously the chance of them simultaneously not working the next take off is non negligible.
mikeash 7y ago
The problem isn’t failure, but detecting failure. If the sensor had just stopped responding, there wouldn’t have been any problem. The planes would keep flying, the sensors would get replaced, and everyone would be fine. What happened was that the sensor gave erroneous readings. The MCAS system reacted to those erroneous reading and crashes the plane. With two sensors, you can detect failure. It’s very unlikely that both would fail simultaneously. If they did, it’s very unlikely that both would provide the same erroneous readings.
- codedokode 7y ago
  It is not unlikely, I don't remember details, but I remember the case when two broken sensors voted over working sensor. The problem is that in order to save tiny amount of money Boing made plane rely on unreliable sensors.
  - BonesJustice 7y ago
    Assuming that’s true, the fact that it has happened before does not mean simultaneous failure is not incredibly unlikely. Unlikely things do happen. One might call it extraordinarily bad luck.
  - mikeash 7y ago
    It’s not unlikely... because of some vague memory you have?
    - fhars 7y ago
      It's not unlikely because it happened repeatedly: https://www.pprune.org/rumours-news/558483-iced-aoa-sensors-send-a321-into-deep-dive.html https://www.pprune.org/rumours-news/558483-iced-aoa-sensors-... http://avherald.com/h?article=410c9cec/0015 http://avherald.com/h?article=410c9cec/0015
  - bonzini 7y ago
    Maybe you're thinking of QF72 where erroneous data was "too wrong" to be smoothed out by the computer?
lisper 7y ago
> what is the probability that a two-sensor model will fail pretty soon as well It's actually higher than the probability that a one-sensor version will fail. With two sensors, you have an effective failure if either sensor fails, and the probability of that happening is roughly twice the probability that a single sensor will fail (assuming failures are independent, which is not necessarily a valid assumption). However, with two sensors you can tell when one has failed (even though you may not know which one it was) and so the consequences of the failure might be less severe. The problem is: now pilots need to be prepared to fly the plane with a failure sensor, which is to say, without MCAS. To do that, they will need additional training. Avoiding that was the whole point of MCAS in the first place. That's the reason it's taking so long to sort this out. Technically, it's an easy problem to solve. It's the economics that are daunting.
xvf22 7y ago
If MCAS is disabled for some reason because of sensor failure, how does that factor into the common type rating? Same goes for if they significantly lower how much input it provides.
gnarlysasquatch 7y ago
Not necessarily a diversion, but certainly not the only cause in a proper failure analysis.
piadodjanho 7y ago
I have the impression that people are overlooking the sensors. They are suppose to be very, very, reliable. Two different planes got wrong reading from sensor in the same side, this seems to be a red flag for me. I wonder in what side of the sensor cable the problem is.
- tlb 7y ago
  They’re not expected to be that reliable. They’re small vanes sticking out the side of the nose, vulnerable to bird strikes. The article mentions hundreds of reported failures over the years. The way to make the system reliable is redundancy.
  - piadodjanho 7y ago
    The article says it had 122 failure due bird strikes plus 85 unnamed problems in about 30 years of data. Considering the number of flights, that does sounds reliable to me. I still think two failures in the same sensor, in the same airplane, under the same condition, in less than one year did not happen by chance.
    - chimpburger 7y ago
      You have a very poor understanding of probability. At a mean failure rate of 0.66 per year, it is quite probable for 2 failures to be spaced 4.5 months apart.
2Ccltvcm 7y ago
I want to know why the Boeing flight computer needs pitot tube input at all. Modern ublox GPSes can easily obtain 3D lock on multiple satellite constellations within a minute of booting. Several of these in parallel for redundancy if you are paranoid. Flight controllers on fixed wings don't even need a magnetometer to stabilize. Just GPS path heading. If all else fails, solid state accelerometers are very reliable. Accelerometer only based dead reckoning works great. If all else fails, a single accelerometer should be sufficient to get the plane relatively stable. A barometer can help too, but doesn't seem necessary. These systems can be easily combined with fallback logic to keep the plane in the sky. I just don't understand what is so hard about this for Boeing. I understand airspeed is not the same as ground speed, but this should provide enough information to the flight computer to keep the plane in the air or at least stable.
- mnw21cam 7y ago
  If all you are using is ground-based position/speed, then you are ignoring the very real possibility that the air you are flying through is not stationary relative to the ground. In actual fact, especially at high altitudes, the air can be moving very fast, and the difference between ground speed and airspeed can be the difference between flying and stalling. Also, your GPS measurements give you position, direction, and speed, but they don't give you orientation. You would have to have another instrument to feed that into the system (such systems exist). But yes, it would be a sanity check.
  - 2Ccltvcm 7y ago
    Can a near-stall condition be detected solely with some combination of GPS, accelerometer, and barometer?
    - mgsouth 7y ago
      [Disclaimer: not an aeronautical enginner or pilot.] Unfortunately, no. Stalling is a function of the wing's _angle_ relative to the flow of air, not of speed. If the angle is too sharp the air can't follow the curve of the wing. The critical angle is (pretty much) independent of speed. For example: if you stick your hand out of the window of a car traveling at 60 MPH, and hold it almost flat to the wind (say 80 deg.), then the air can't follow down the back of your hand. All of the "push" is backwards, and there's no push up. If you hold it at 30 deg. then the air flows around your hand, which deflects the air down and your hand up, very strongly. Even if you're only traveling at 5 MPH, if you hold your hand at 30 deg. the air will flow around your hand and deflect it upward; it will just be a very weak effect. The angle between the wing and the air flow is what is called the "angle of attack", and what the AoA sensors measure. The only other instrument that comes close is the Attitude gauge (the globe thing). However, it measures the plane's angle relative to the horizon, and air moving relative to the plane usually isn't parallel to the ground in conditions where the AoA matters. Wikipedia article, with much detail, pictures, etc.: https://en.m.wikipedia.org/wiki/Angle_of_attack https://en.m.wikipedia.org/wiki/Angle_of_attack

Aloha 7y ago

The AOA sensors are effectively a consumable, and would undergo regular replacement over the life of the aircraft, the odds of BOTH of them failing at the same moment in the same flight is very very small.

aivisol 7y ago
Ok, that makes sense. But are the hours at which they got replaced are on order (or several) of magnitude lower than a two-sensor failure can occur? I hope it is calculated.
- CydeWeys 7y ago
  The point is that, as safety-critical equipment, you can't fly the plane if one is broken. So you'd need to have two fail within a single flight, and fail in the same way, in order to cause an incorrect activation of MCAS. With just one sensor, it's much more likely. Note that Airbus uses three of these sensors on their planes, so that when one fails you know which one it is, and can still rely on the signals from the two remaining good ones. Then you replace the failed sensor before the next flight.
  - aivisol 7y ago
    That was my original question. What is the probability of them failing at the same flight in the same way (say they got frozen at the same angle, hit by blizzard, etc, etc). Intuition is that the chances are high given their low MTBF.
    - deleted 7y ago
      [deleted]
  - konspence 7y ago
    This works until two sensors fail in the same direction: >The aircraft's computers received conflicting information from the three angle of attack sensors. The aircraft computer system’s programming logic had been designed to reject one sensor value if it deviated significantly from the other two sensor values. In this specific case, this programming logic led to the rejection of the correct value from the one operative angle of attack sensor, and to the acceptance of the two consistent, but wrong, values from the two inoperative angle of attack sensors. This resulted in the system's stall protection functions responding incorrectly to the stall, making the situation worse, instead of better. https://en.m.wikipedia.org/wiki/XL_Airways_Germany_Flight_888T https://en.m.wikipedia.org/wiki/XL_Airways_Germany_Flight_88...
rightbyte 7y ago
If they are replaced simultaneously the chance of them simultaneously not working the next take off is non negligible.

mikeash 7y ago

The problem isn’t failure, but detecting failure. If the sensor had just stopped responding, there wouldn’t have been any problem. The planes would keep flying, the sensors would get replaced, and everyone would be fine. What happened was that the sensor gave erroneous readings. The MCAS system reacted to those erroneous reading and crashes the plane. With two sensors, you can detect failure. It’s very unlikely that both would fail simultaneously. If they did, it’s very unlikely that both would provide the same erroneous readings.

codedokode 7y ago
It is not unlikely, I don't remember details, but I remember the case when two broken sensors voted over working sensor. The problem is that in order to save tiny amount of money Boing made plane rely on unreliable sensors.
- BonesJustice 7y ago
  Assuming that’s true, the fact that it has happened before does not mean simultaneous failure is not incredibly unlikely. Unlikely things do happen. One might call it extraordinarily bad luck.
- mikeash 7y ago
  It’s not unlikely... because of some vague memory you have?
  - fhars 7y ago
    It's not unlikely because it happened repeatedly: https://www.pprune.org/rumours-news/558483-iced-aoa-sensors-send-a321-into-deep-dive.html https://www.pprune.org/rumours-news/558483-iced-aoa-sensors-... http://avherald.com/h?article=410c9cec/0015 http://avherald.com/h?article=410c9cec/0015
- bonzini 7y ago
  Maybe you're thinking of QF72 where erroneous data was "too wrong" to be smoothed out by the computer?

lisper 7y ago

> what is the probability that a two-sensor model will fail pretty soon as well It's actually higher than the probability that a one-sensor version will fail. With two sensors, you have an effective failure if either sensor fails, and the probability of that happening is roughly twice the probability that a single sensor will fail (assuming failures are independent, which is not necessarily a valid assumption). However, with two sensors you can tell when one has failed (even though you may not know which one it was) and so the consequences of the failure might be less severe. The problem is: now pilots need to be prepared to fly the plane with a failure sensor, which is to say, without MCAS. To do that, they will need additional training. Avoiding that was the whole point of MCAS in the first place. That's the reason it's taking so long to sort this out. Technically, it's an easy problem to solve. It's the economics that are daunting.

xvf22 7y ago

If MCAS is disabled for some reason because of sensor failure, how does that factor into the common type rating? Same goes for if they significantly lower how much input it provides.

gnarlysasquatch 7y ago

Not necessarily a diversion, but certainly not the only cause in a proper failure analysis.

piadodjanho 7y ago

I have the impression that people are overlooking the sensors. They are suppose to be very, very, reliable. Two different planes got wrong reading from sensor in the same side, this seems to be a red flag for me. I wonder in what side of the sensor cable the problem is.

tlb 7y ago
They’re not expected to be that reliable. They’re small vanes sticking out the side of the nose, vulnerable to bird strikes. The article mentions hundreds of reported failures over the years. The way to make the system reliable is redundancy.
- piadodjanho 7y ago
  The article says it had 122 failure due bird strikes plus 85 unnamed problems in about 30 years of data. Considering the number of flights, that does sounds reliable to me. I still think two failures in the same sensor, in the same airplane, under the same condition, in less than one year did not happen by chance.
  - chimpburger 7y ago
    You have a very poor understanding of probability. At a mean failure rate of 0.66 per year, it is quite probable for 2 failures to be spaced 4.5 months apart.

2Ccltvcm 7y ago

I want to know why the Boeing flight computer needs pitot tube input at all. Modern ublox GPSes can easily obtain 3D lock on multiple satellite constellations within a minute of booting. Several of these in parallel for redundancy if you are paranoid. Flight controllers on fixed wings don't even need a magnetometer to stabilize. Just GPS path heading. If all else fails, solid state accelerometers are very reliable. Accelerometer only based dead reckoning works great. If all else fails, a single accelerometer should be sufficient to get the plane relatively stable. A barometer can help too, but doesn't seem necessary. These systems can be easily combined with fallback logic to keep the plane in the sky. I just don't understand what is so hard about this for Boeing. I understand airspeed is not the same as ground speed, but this should provide enough information to the flight computer to keep the plane in the air or at least stable.

mnw21cam 7y ago
If all you are using is ground-based position/speed, then you are ignoring the very real possibility that the air you are flying through is not stationary relative to the ground. In actual fact, especially at high altitudes, the air can be moving very fast, and the difference between ground speed and airspeed can be the difference between flying and stalling. Also, your GPS measurements give you position, direction, and speed, but they don't give you orientation. You would have to have another instrument to feed that into the system (such systems exist). But yes, it would be a sanity check.
- 2Ccltvcm 7y ago
  Can a near-stall condition be detected solely with some combination of GPS, accelerometer, and barometer?
  - mgsouth 7y ago
    [Disclaimer: not an aeronautical enginner or pilot.] Unfortunately, no. Stalling is a function of the wing's _angle_ relative to the flow of air, not of speed. If the angle is too sharp the air can't follow the curve of the wing. The critical angle is (pretty much) independent of speed. For example: if you stick your hand out of the window of a car traveling at 60 MPH, and hold it almost flat to the wind (say 80 deg.), then the air can't follow down the back of your hand. All of the "push" is backwards, and there's no push up. If you hold it at 30 deg. then the air flows around your hand, which deflects the air down and your hand up, very strongly. Even if you're only traveling at 5 MPH, if you hold your hand at 30 deg. the air will flow around your hand and deflect it upward; it will just be a very weak effect. The angle between the wing and the air flow is what is called the "angle of attack", and what the AoA sensors measure. The only other instrument that comes close is the Attitude gauge (the globe thing). However, it measures the plane's angle relative to the horizon, and air moving relative to the plane usually isn't parallel to the ground in conditions where the AoA matters. Wikipedia article, with much detail, pictures, etc.: https://en.m.wikipedia.org/wiki/Angle_of_attack https://en.m.wikipedia.org/wiki/Angle_of_attack