11 ms·

The problem isn’t failure, but detecting failure. If the sensor had just stopped responding, there wouldn’t have been any problem. The planes would keep flying

The problem isn’t failure, but detecting failure. If the sensor had just stopped responding, there wouldn’t have been any problem. The planes would keep flying, the sensors would get replaced, and everyone would be fine. What happened was that the sensor gave erroneous readings. The MCAS system reacted to those erroneous reading and crashes the plane. With two sensors, you can detect failure. It’s very unlikely that both would fail simultaneously. If they did, it’s very unlikely that both would provide the same erroneous readings.

codedokode 7y ago
It is not unlikely, I don't remember details, but I remember the case when two broken sensors voted over working sensor. The problem is that in order to save tiny amount of money Boing made plane rely on unreliable sensors.
- BonesJustice 7y ago
  Assuming that’s true, the fact that it has happened before does not mean simultaneous failure is not incredibly unlikely. Unlikely things do happen. One might call it extraordinarily bad luck.
- mikeash 7y ago
  It’s not unlikely... because of some vague memory you have?
  - fhars 7y ago
    It's not unlikely because it happened repeatedly: https://www.pprune.org/rumours-news/558483-iced-aoa-sensors-send-a321-into-deep-dive.html https://www.pprune.org/rumours-news/558483-iced-aoa-sensors-... http://avherald.com/h?article=410c9cec/0015 http://avherald.com/h?article=410c9cec/0015
- bonzini 7y ago
  Maybe you're thinking of QF72 where erroneous data was "too wrong" to be smoothed out by the computer?
runciblespoon 7y ago
> With two sensors, you can detect failure You get a reading of 20 on one sensor and get a reading of 34 on the second, which one is correct. To achieve reliability a minimum of five sensors need be used. four primary and one back-up. If three primary agree then system normal. If two primary disagree then switch to backup.
- mikeash 7y ago
  If you get a reading of 20 on one and 34 on the other, you disregard both and disable the system. There’s a big difference between a system which must work and a system which must not go wrong. For example, the fly by wire system in an Airbus must work. A failed sensor must not disable the system. Thus, you need at least triple redundancy to keep functioning in the event of a failure. Boeing’s MCAS system, on the other hand, doesn’t need to work. The plane flies just fine without it. It merely needs to not go crazy. Two sensors is sufficient.
  - kejaed 7y ago
    Yup, the difference between Fail Safe and Fail Operational.
  - Gibbon1 7y ago
    > and disable the system When you do that you now have an aircraft the pilots aren't certified to fly.
    - Majromax 7y ago
      > When you do that you now have an aircraft the pilots aren't certified to fly. It would increase risk. But for that increased risk to materialize into harm, the plane would also need to experience an unlikely, near-edge-of-flight-envelope situation that the working MCAS was intended to handle. This would be comparable to a plane with any other mechanical defect that is discovered in-flight. If the above situation is expected to be too-risky to continue the flight and repair on the ground, then it would give cause for an emergency landing.
kds3 7y ago
> It’s very unlikely that both would fail simultaneously. If they did, it’s very unlikely that both would provide the same erroneous readings. They don't have to fail simultaneously in a flight. And they don't have to fail by internal sensor problems. There are many cases in which they can simultaneously fail and give same readings, article even mentioned such types of events: >> That probability may have underestimated the risk of so-called external events that have damaged sensors in the past, such as collisions with birds, bumps from ramp stairs or mechanics’ stepping on them. And AF447 gives an example when such erroneous readings combined with pilot errors may lead to.
- mikeash 7y ago
  If they’re damaged on the ground, surely it’ll be noticed that the sensors are claiming an extreme AoA while just sitting there, and they’ll be fixed. AF447 is an example of a fly by wire system that has to keep working no matter what happens, thus a bunch of redundant systems and a series of alternate modes the system can fall back on to operate in a degraded state. MCAS, in contrast, is not a critical system. It could shut down with no problems at all. These crashes happened only because it didn’t shut down when faced with a failed sensor, because it couldn’t detect the failure.
  - kds3 7y ago
    > If they’re damaged on the ground, surely it’ll be noticed that the sensors are claiming an extreme AoA while just sitting there, and they’ll be fixed. AoA sensors by design don't work reliable in low speed and they don't work at all on the ground. > AF447 is an example of a fly by wire system that has to keep working no matter what happens, thus a bunch of redundant systems and a series of alternate modes the system can fall back on to operate in a degraded state. AF447 is a good example that two AoA sensors can simultaneously have same erroneous readings. It's not that unlikely.
    - mikeash 7y ago
      Can you elaborate on AF447? I’ve never heard of the AoA sensors being connected with that crash, and a quick search indicates that they were working fine.
HarryHirsch 7y ago
It’s very unlikely that both would fail simultaneously. Birgenair 301 crashed into the Atlantic because mud dauber wasps built nests in both pitot tubes while the plane was on the ground. It happens.
- mikeash 7y ago
  Airspeed is required for safe flight. The failure on that flight was detected immediately, it just couldn’t be handled. AoA on a 737 MAX is not required for safe flight and the system just needs to refrain from taking any action if it fails.
  - phkahler 7y ago
    But MCAS was added because the plane doesn't handle well in some situations.
    - Filligree 7y ago
      It handles differently, yes. That could be handled with a bit of training.
      - anticensor 7y ago
        It will not satisfy the current handling requirements, hence either making it completely unairworthy or a special category with vastly different handling from usual passenger-rated airplanes.
    - cameldrv 7y ago
      I haven't heard of it ever activating except in the incident/accident flights. It's required for certification, but you would either have to be mishandling the plane or get in some extreme weather for MCAS to activate. Think about it like the Antilock brakes on your car. Suppose the wheel position sensor fails. It's fine if the car puts up a warning light and says that you don't have antilock brakes anymore. You can drive fine without them until you can get them fixed with a minor safety impact. It's not fine if the wheel position sensor fails and this causes the car to slam on the brakes going 65mph down the highway.
Pxtl 7y ago
That's why you need 5 sensors or so on something this mission-critical. Enough that you can have a clear democratic majority if one or two goes on the fritz.
- johannes1234321 7y ago
  ... or two sensors and a pilot who is in control.
- mikeash 7y ago
  My point is that it’s not mission critical. You can lose MCAS and be just fine. That’s why two sensors would suffice.
djsumdog 7y ago
Well the other issue is the system used that bad sensor data to automatically correct the pilots with no indication of why or how to even turn it off. The pilots knew the system was wrong and couldn't force the place to correct.
bwbw223 7y ago
Would you not need three sensors? With only two, wouldn’t it be difficult to determine which is correct?
- mikeash 7y ago
  You don’t need to determine which is correct. MCAS is not a safety critical system and can just shut down if the sensors disagree.
  - FartyMcFarter 7y ago
    That assumes the sensors are likely to disagree if they're broken, which may not be true.
- deleted 7y ago
  [deleted]
salawat 7y ago
Increased redundancy in airborne systems is very unintuitive. Double redundancy can be more dangerous than having a single system (at least when you're talking engines or sensors anyway). Triple redundancy is the norm for the specific reason that it's highly likely for symmetrically placed sensors to be prone to failing in the same way not long after each other, but having a third differently placed can keep you flying. Although there's at least one instance where an Airbus plane had two AoA sensors malfunction at the same time and outvote the last remaining sensor. This is why critical systems are built with higher degrees of redundancy and graceful degradation of operational envelope in mind. Training on how to deal with unaided flight is also absolutely essential. Many Airbus accidents where pilot's were caught off guard when the automation that kept them from breaking out of the operating envelope failed. Long story short; Boeing has put themselves in the unenviable position of having delivered a product in ways that are not only illegal, but deadly, and short of pilots accepting a significant burden in the form of being as good at or better than the MCAS system at this point; a lot of man hours and capital has been expended to end up in a situation where every MAX is in a not inconsiderable risk of being scrapped.
darkpuma 7y ago
> " it’s very unlikely that both would provide the same erroneous readings. " You're assuming that faulty sensors will tend to have random output. But since we're talking about a real life mechanism, it seems likely it has some erroneous states that are more likely to occur than others. For instance if the mechanism often fails up against one of it's mechanical limits, the sensor might erroneously read out the limit position every time. You can't actually say anything about the distribution of failure states for a sensor without evaluating that particular sensor.
droithomme 7y ago
> It’s very unlikely that both would fail simultaneously. Ice, insects, birds, and volcanic ash are all things that tend to cause the pitot and the static tubes to become blocked. When you encounter ice, insects, birds, and volcanic ash, it is often the case that you get multiple simultaneous blockages. Blockages of the various tubes are not statistically independent events in practice.
- mikeash 7y ago
  Pitot and static tubes are irrelevant here. Would it trouble everyone to get a basic grasp of what we’re talking about before replying? I’m getting a little tired of constantly correcting basic stuff in the replies.

codedokode 7y ago

It is not unlikely, I don't remember details, but I remember the case when two broken sensors voted over working sensor. The problem is that in order to save tiny amount of money Boing made plane rely on unreliable sensors.

BonesJustice 7y ago
Assuming that’s true, the fact that it has happened before does not mean simultaneous failure is not incredibly unlikely. Unlikely things do happen. One might call it extraordinarily bad luck.
mikeash 7y ago
It’s not unlikely... because of some vague memory you have?
- fhars 7y ago
  It's not unlikely because it happened repeatedly: https://www.pprune.org/rumours-news/558483-iced-aoa-sensors-send-a321-into-deep-dive.html https://www.pprune.org/rumours-news/558483-iced-aoa-sensors-... http://avherald.com/h?article=410c9cec/0015 http://avherald.com/h?article=410c9cec/0015
bonzini 7y ago
Maybe you're thinking of QF72 where erroneous data was "too wrong" to be smoothed out by the computer?

runciblespoon 7y ago

> With two sensors, you can detect failure You get a reading of 20 on one sensor and get a reading of 34 on the second, which one is correct. To achieve reliability a minimum of five sensors need be used. four primary and one back-up. If three primary agree then system normal. If two primary disagree then switch to backup.

mikeash 7y ago
If you get a reading of 20 on one and 34 on the other, you disregard both and disable the system. There’s a big difference between a system which must work and a system which must not go wrong. For example, the fly by wire system in an Airbus must work. A failed sensor must not disable the system. Thus, you need at least triple redundancy to keep functioning in the event of a failure. Boeing’s MCAS system, on the other hand, doesn’t need to work. The plane flies just fine without it. It merely needs to not go crazy. Two sensors is sufficient.
- kejaed 7y ago
  Yup, the difference between Fail Safe and Fail Operational.
- Gibbon1 7y ago
  > and disable the system When you do that you now have an aircraft the pilots aren't certified to fly.
  - Majromax 7y ago
    > When you do that you now have an aircraft the pilots aren't certified to fly. It would increase risk. But for that increased risk to materialize into harm, the plane would also need to experience an unlikely, near-edge-of-flight-envelope situation that the working MCAS was intended to handle. This would be comparable to a plane with any other mechanical defect that is discovered in-flight. If the above situation is expected to be too-risky to continue the flight and repair on the ground, then it would give cause for an emergency landing.

kds3 7y ago

> It’s very unlikely that both would fail simultaneously. If they did, it’s very unlikely that both would provide the same erroneous readings. They don't have to fail simultaneously in a flight. And they don't have to fail by internal sensor problems. There are many cases in which they can simultaneously fail and give same readings, article even mentioned such types of events: >> That probability may have underestimated the risk of so-called external events that have damaged sensors in the past, such as collisions with birds, bumps from ramp stairs or mechanics’ stepping on them. And AF447 gives an example when such erroneous readings combined with pilot errors may lead to.

mikeash 7y ago
If they’re damaged on the ground, surely it’ll be noticed that the sensors are claiming an extreme AoA while just sitting there, and they’ll be fixed. AF447 is an example of a fly by wire system that has to keep working no matter what happens, thus a bunch of redundant systems and a series of alternate modes the system can fall back on to operate in a degraded state. MCAS, in contrast, is not a critical system. It could shut down with no problems at all. These crashes happened only because it didn’t shut down when faced with a failed sensor, because it couldn’t detect the failure.
- kds3 7y ago
  > If they’re damaged on the ground, surely it’ll be noticed that the sensors are claiming an extreme AoA while just sitting there, and they’ll be fixed. AoA sensors by design don't work reliable in low speed and they don't work at all on the ground. > AF447 is an example of a fly by wire system that has to keep working no matter what happens, thus a bunch of redundant systems and a series of alternate modes the system can fall back on to operate in a degraded state. AF447 is a good example that two AoA sensors can simultaneously have same erroneous readings. It's not that unlikely.
  - mikeash 7y ago
    Can you elaborate on AF447? I’ve never heard of the AoA sensors being connected with that crash, and a quick search indicates that they were working fine.

HarryHirsch 7y ago

It’s very unlikely that both would fail simultaneously. Birgenair 301 crashed into the Atlantic because mud dauber wasps built nests in both pitot tubes while the plane was on the ground. It happens.

mikeash 7y ago
Airspeed is required for safe flight. The failure on that flight was detected immediately, it just couldn’t be handled. AoA on a 737 MAX is not required for safe flight and the system just needs to refrain from taking any action if it fails.
- phkahler 7y ago
  But MCAS was added because the plane doesn't handle well in some situations.
  - Filligree 7y ago
    It handles differently, yes. That could be handled with a bit of training.
    - anticensor 7y ago
      It will not satisfy the current handling requirements, hence either making it completely unairworthy or a special category with vastly different handling from usual passenger-rated airplanes.
  - cameldrv 7y ago
    I haven't heard of it ever activating except in the incident/accident flights. It's required for certification, but you would either have to be mishandling the plane or get in some extreme weather for MCAS to activate. Think about it like the Antilock brakes on your car. Suppose the wheel position sensor fails. It's fine if the car puts up a warning light and says that you don't have antilock brakes anymore. You can drive fine without them until you can get them fixed with a minor safety impact. It's not fine if the wheel position sensor fails and this causes the car to slam on the brakes going 65mph down the highway.

Pxtl 7y ago

That's why you need 5 sensors or so on something this mission-critical. Enough that you can have a clear democratic majority if one or two goes on the fritz.

johannes1234321 7y ago
... or two sensors and a pilot who is in control.
mikeash 7y ago
My point is that it’s not mission critical. You can lose MCAS and be just fine. That’s why two sensors would suffice.

djsumdog 7y ago

Well the other issue is the system used that bad sensor data to automatically correct the pilots with no indication of why or how to even turn it off. The pilots knew the system was wrong and couldn't force the place to correct.

bwbw223 7y ago

Would you not need three sensors? With only two, wouldn’t it be difficult to determine which is correct?

mikeash 7y ago
You don’t need to determine which is correct. MCAS is not a safety critical system and can just shut down if the sensors disagree.
- FartyMcFarter 7y ago
  That assumes the sensors are likely to disagree if they're broken, which may not be true.
deleted 7y ago
[deleted]

salawat 7y ago

Increased redundancy in airborne systems is very unintuitive. Double redundancy can be more dangerous than having a single system (at least when you're talking engines or sensors anyway). Triple redundancy is the norm for the specific reason that it's highly likely for symmetrically placed sensors to be prone to failing in the same way not long after each other, but having a third differently placed can keep you flying. Although there's at least one instance where an Airbus plane had two AoA sensors malfunction at the same time and outvote the last remaining sensor. This is why critical systems are built with higher degrees of redundancy and graceful degradation of operational envelope in mind. Training on how to deal with unaided flight is also absolutely essential. Many Airbus accidents where pilot's were caught off guard when the automation that kept them from breaking out of the operating envelope failed. Long story short; Boeing has put themselves in the unenviable position of having delivered a product in ways that are not only illegal, but deadly, and short of pilots accepting a significant burden in the form of being as good at or better than the MCAS system at this point; a lot of man hours and capital has been expended to end up in a situation where every MAX is in a not inconsiderable risk of being scrapped.

darkpuma 7y ago

> " it’s very unlikely that both would provide the same erroneous readings. " You're assuming that faulty sensors will tend to have random output. But since we're talking about a real life mechanism, it seems likely it has some erroneous states that are more likely to occur than others. For instance if the mechanism often fails up against one of it's mechanical limits, the sensor might erroneously read out the limit position every time. You can't actually say anything about the distribution of failure states for a sensor without evaluating that particular sensor.

droithomme 7y ago

> It’s very unlikely that both would fail simultaneously. Ice, insects, birds, and volcanic ash are all things that tend to cause the pitot and the static tubes to become blocked. When you encounter ice, insects, birds, and volcanic ash, it is often the case that you get multiple simultaneous blockages. Blockages of the various tubes are not statistically independent events in practice.

mikeash 7y ago
Pitot and static tubes are irrelevant here. Would it trouble everyone to get a basic grasp of what we’re talking about before replying? I’m getting a little tired of constantly correcting basic stuff in the replies.