6 ms·

A question I've been meaning to ask. I've always heard flight critical systems have to be at least doubly or triply redundant. Why was there only 1 pitot tube?

A question I've been meaning to ask. I've always heard flight critical systems have to be at least doubly or triply redundant. Why was there only 1 pitot tube? It's clearly flight critical.

milesdyson_phd 7y ago
There’s five sets of pitot tubes on the 737...
- AnotherGoodName 7y ago
  Aftbt corrected me above. There was only one angle of attack indicator specifically.
  - HeWhoLurksLate 7y ago
    There were two, but IIRC only one was ever used at a time.
aftbit 7y ago
There are actually 5 pitot tubes on the Boeing 737[1]. There was only one Angle of Attack sensor. I don't know why for sure, but armchair speculation is that it was considered non-critical before the introduction of MCAS and nobody re-evaluated after. 1: https://aviation.stackexchange.com/questions/50797/why-does-the-boeing-737-have-a-pitot-tube-on-the-tail https://aviation.stackexchange.com/questions/50797/why-does-...
- gbjw 7y ago
  There were actually two AoA sensors (on either side of the aircraft) each connected to different sides of the panel. The issue was/is what to do when they disagree (with respect to MCAS). EDIT: Source: https://aviation.stackexchange.com/questions/61011/how-many-aoa-sensors-does-the-737-max-have https://aviation.stackexchange.com/questions/61011/how-many-...
  - AnotherGoodName 7y ago
    My next question would be are they adding a third? Everything I hear sounds like a software update rather than the more expensive hardware changes.
    - zaxomi 7y ago
      There is no need to add a third. The software update make MCAS to use both existing angle of attack sensors, and if they disagree MCAS will be disabled and a warning indication will be shown.
      - mantap 7y ago
        Then you risk a stall. If MCAS is non-essential why not remove it completely? And if it's essential, then you need >2 sensors to ensure it can operate all the time.
        Tomte 7y ago
        Not everything that is non-critical should be removed. Autopilot? Not necessary, pilots can fly themselves. Still, it is added for convenience (and its consequences, less mental burden, more mental capacity to do other stuff).
        zaxomi 7y ago
        MCAS is not essential. It exist to make the airplane behave like the older B737.
        mantap 7y ago
        This just isn't true. MCAS was added because it is a safety requirement that stick forces strictly increase. You don't want the thing to start stalling itself.
        zaroth 7y ago
raverbashing 7y ago
There are two AoA sensors but only one used for MCas because someone pushed the idea that by using 2 it would require extra training so let's go for the least redundant solution
7952 7y ago
Obviously redundancy is better. But some allowance can be made for pilot skill to work around a problem. For example, a loss of airspeed at cruise should not cause a disaster. The pilot can select a know good thrust/pitch setting and use other data (such as engine performance). There will always be this kind of failure that needs a workaround rather than complete redundancy. The risk is possibly in how pilots interpret and respond to that information.
Someone1234 7y ago
MCAS uses AoA (angle of attack) not Pitot Tube. There are two AoA on the 737 Max, MCAS only used a single one (but switched every time you started the aircraft). Reporting in Seattle Times suggests that it was originally designed to use one AoA combined with a G-Sensor[0]. The two in combination would trigger MCAS to make a small adjustment. The problem is that the aircraft's actual design was failing to be "common type" compatible (i.e. no re-training). So they kept on expanding MCAS's usage to compensate. For low speed the G-Sensor didn't work, so was removed, and flight authority was increased. More from the article: > This original version of MCAS, according to two people familiar with the details, was activated only if two distinct sensors indicated such an extreme maneuver: a high angle of attack and a high G-force. [...] About a third of the way through flight testing in 2016, as first reported by The Seattle Times in March, Boeing made substantial changes to MCAS. > The flight-test pilots had found another problem: The same lack of smooth stick forces was also occurring in certain low-speed flight conditions. To cover that issue too, engineers decided to expand the scope and power of MCAS. > Because at low speed a control surface must be deflected more to have the same effect, engineers increased the power of the system at low speed from 0.6 degrees of stabilizer nose-down deflection to 2.5 degrees each time it was activated. > On the stabilizer, maximum nose down is about 4.7 degrees away from level flight. So with the new increased authority to move the stabilizer, just a couple of iterations of the system could push it to that maximum. > Because there are no excessive G-forces at low speed, the engineers removed the G-force factor as a trigger. But that meant MCAS was now activated by a single angle-of-attack sensor. > One of the people familiar with MCAS’s evolution said the system designers didn’t see any need to add an additional sensor or redundancy because the hazard assessment had determined that an MCAS failure in normal flight would only qualify in the “major” category for which the single sensor is the norm. [0] https://www.seattletimes.com/seattle-news/times-watchdog/the-inside-story-of-mcas-how-boeings-737-max-system-gained-power-and-lost-safeguards/ https://www.seattletimes.com/seattle-news/times-watchdog/the...
dredmorbius 7y ago
As many people have noted: AoA sensors, not pitot tubes. What hasn't been mentioned: the fact that MCAS repeatedly engages, over many minutes, whilst both pilots were repeatedly fighting the system, and the elevation-over-ground track was highly anomalous. A major problem with automated systems is that few of them have any awareness that they are ever doing the wrong thing, operationg far outside the bounds of their own design, and will, in this case, fly a plane into the ground. If multiple pilot actions and flight track indicate disagreement, automation should probably disengage. There are other problems with pilots, of course. AF447 was a failure of pilots, but one exacerbated by automated and fly-by-wire controls not revealing conflicting inputs by Bonin and Dubois. Germanwings 9525, and by appearances MA370 are among cases where a single pilot acting alone sabotaged or crashed a commercial passenger flight. See: https://www.huffpost.com/entry/pilots-crashing-on-purpose_n_6948448 https://www.huffpost.com/entry/pilots-crashing-on-purpose_n_... and https://en.wikipedia.org/wiki/Suicide_by_pilot https://en.wikipedia.org/wiki/Suicide_by_pilot But outside notable hijacking incidents of 18 years ago, concerted efforts by multiple pilots are unheard of.

A question I've been meaning to ask. I've always heard flight critical systems have to be at least doubly or triply redundant. Why was there only 1 pitot tube? It's clearly flight critical.

milesdyson_phd 7y ago

There’s five sets of pitot tubes on the 737...

AnotherGoodName 7y ago
Aftbt corrected me above. There was only one angle of attack indicator specifically.
- HeWhoLurksLate 7y ago
  There were two, but IIRC only one was ever used at a time.

aftbit 7y ago

There are actually 5 pitot tubes on the Boeing 737[1]. There was only one Angle of Attack sensor. I don't know why for sure, but armchair speculation is that it was considered non-critical before the introduction of MCAS and nobody re-evaluated after. 1: https://aviation.stackexchange.com/questions/50797/why-does-the-boeing-737-have-a-pitot-tube-on-the-tail https://aviation.stackexchange.com/questions/50797/why-does-...

gbjw 7y ago
There were actually two AoA sensors (on either side of the aircraft) each connected to different sides of the panel. The issue was/is what to do when they disagree (with respect to MCAS). EDIT: Source: https://aviation.stackexchange.com/questions/61011/how-many-aoa-sensors-does-the-737-max-have https://aviation.stackexchange.com/questions/61011/how-many-...
- AnotherGoodName 7y ago
  My next question would be are they adding a third? Everything I hear sounds like a software update rather than the more expensive hardware changes.
  - zaxomi 7y ago
    There is no need to add a third. The software update make MCAS to use both existing angle of attack sensors, and if they disagree MCAS will be disabled and a warning indication will be shown.
    - mantap 7y ago
      Then you risk a stall. If MCAS is non-essential why not remove it completely? And if it's essential, then you need >2 sensors to ensure it can operate all the time.
      - Tomte 7y ago
        Not everything that is non-critical should be removed. Autopilot? Not necessary, pilots can fly themselves. Still, it is added for convenience (and its consequences, less mental burden, more mental capacity to do other stuff).
      - zaxomi 7y ago
        MCAS is not essential. It exist to make the airplane behave like the older B737.
        mantap 7y ago
        This just isn't true. MCAS was added because it is a safety requirement that stick forces strictly increase. You don't want the thing to start stalling itself.
        zaroth 7y ago

raverbashing 7y ago

There are two AoA sensors but only one used for MCas because someone pushed the idea that by using 2 it would require extra training so let's go for the least redundant solution

7952 7y ago

Obviously redundancy is better. But some allowance can be made for pilot skill to work around a problem. For example, a loss of airspeed at cruise should not cause a disaster. The pilot can select a know good thrust/pitch setting and use other data (such as engine performance). There will always be this kind of failure that needs a workaround rather than complete redundancy. The risk is possibly in how pilots interpret and respond to that information.

Someone1234 7y ago

MCAS uses AoA (angle of attack) not Pitot Tube. There are two AoA on the 737 Max, MCAS only used a single one (but switched every time you started the aircraft). Reporting in Seattle Times suggests that it was originally designed to use one AoA combined with a G-Sensor[0]. The two in combination would trigger MCAS to make a small adjustment. The problem is that the aircraft's actual design was failing to be "common type" compatible (i.e. no re-training). So they kept on expanding MCAS's usage to compensate. For low speed the G-Sensor didn't work, so was removed, and flight authority was increased. More from the article: > This original version of MCAS, according to two people familiar with the details, was activated only if two distinct sensors indicated such an extreme maneuver: a high angle of attack and a high G-force. [...] About a third of the way through flight testing in 2016, as first reported by The Seattle Times in March, Boeing made substantial changes to MCAS. > The flight-test pilots had found another problem: The same lack of smooth stick forces was also occurring in certain low-speed flight conditions. To cover that issue too, engineers decided to expand the scope and power of MCAS. > Because at low speed a control surface must be deflected more to have the same effect, engineers increased the power of the system at low speed from 0.6 degrees of stabilizer nose-down deflection to 2.5 degrees each time it was activated. > On the stabilizer, maximum nose down is about 4.7 degrees away from level flight. So with the new increased authority to move the stabilizer, just a couple of iterations of the system could push it to that maximum. > Because there are no excessive G-forces at low speed, the engineers removed the G-force factor as a trigger. But that meant MCAS was now activated by a single angle-of-attack sensor. > One of the people familiar with MCAS’s evolution said the system designers didn’t see any need to add an additional sensor or redundancy because the hazard assessment had determined that an MCAS failure in normal flight would only qualify in the “major” category for which the single sensor is the norm. [0] https://www.seattletimes.com/seattle-news/times-watchdog/the-inside-story-of-mcas-how-boeings-737-max-system-gained-power-and-lost-safeguards/ https://www.seattletimes.com/seattle-news/times-watchdog/the...

dredmorbius 7y ago

As many people have noted: AoA sensors, not pitot tubes. What hasn't been mentioned: the fact that MCAS repeatedly engages, over many minutes, whilst both pilots were repeatedly fighting the system, and the elevation-over-ground track was highly anomalous. A major problem with automated systems is that few of them have any awareness that they are ever doing the wrong thing, operationg far outside the bounds of their own design, and will, in this case, fly a plane into the ground. If multiple pilot actions and flight track indicate disagreement, automation should probably disengage. There are other problems with pilots, of course. AF447 was a failure of pilots, but one exacerbated by automated and fly-by-wire controls not revealing conflicting inputs by Bonin and Dubois. Germanwings 9525, and by appearances MA370 are among cases where a single pilot acting alone sabotaged or crashed a commercial passenger flight. See: https://www.huffpost.com/entry/pilots-crashing-on-purpose_n_6948448 https://www.huffpost.com/entry/pilots-crashing-on-purpose_n_... and https://en.wikipedia.org/wiki/Suicide_by_pilot https://en.wikipedia.org/wiki/Suicide_by_pilot But outside notable hijacking incidents of 18 years ago, concerted efforts by multiple pilots are unheard of.