3 ms·

The aircraft could probably be safe and pass certification with MCAS in place, but the following issues made it dangerous: * It was undocumented. * It had too

by Zak 7y ago

The aircraft could probably be safe and pass certification with MCAS in place, but the following issues made it dangerous: * It was undocumented. * It had too much control authority. It was able to adjust the trim such that the elevator could not overcome the trim's pitch-down force, and such that the average pilot did not have enough strength to use the manual trim wheel to neutralize the trim in a dive. * They removed the switch to turn it off. On older 737s, there's one switch to turn off automated control of stabilizer trim, and another to disconnect power to the motor, completely disabling electric trim. On the Max, both switches perform the latter function. * They made it rely on only one sensor. I can't imagine the logic for that since two sensors are physically present, and damage to AOA sensors is not rare. * The AOA disagree warning light, which would have clued pilots in to the presence of a faulty sensor was not present in most aircraft, despite documentation to the contrary.

cesarb 7y ago
> They made it rely on only one sensor. I can't imagine the logic for that since two sensors are physically present, and damage to AOA sensors is not rare. The logic for that is really simple: each sensor is wired to one of the two computers. Each computer uses its own sensor. This was an already existing design, MCAS is just a new function added to these computers. (AFAIK, other aircraft like Airbus have multiple sensors wired to each computer, so for them it would be natural to use more than one sensor.)
- Zak 7y ago
  That makes a lot of sense actually; it wasn't a deliberate decision, just the path of least resistance.
- phire 7y ago
  Both computers have access to both sensor's data. The computers are networked together. This is how they implement the AoA disagree function (the one which was broken in 90% of MAXes for unrelated reasons). It's also how they managed to implement a software update which makes MCAS take data from both sensors. The logic for not implementing both sensors is much more insidious. If you implement both sensors, then you have to deal with the case that infomation from sensors might disagree. The computer has no idea sensor is providing correct data, so the only thing it can really do is disable itself when the sensors disagree. If MCAS has the ability to disable itself, then it must provide feedback to pilots it has done so, and have pilots follow some procedures. If there were procedures, then Boeing would have to add pilot training about what MCAS was and how things would be different when it disabled itself. Boeing made it rely on only a single sensor to bypass training requirements.
imtringued 7y ago
>They removed the switch to turn it off. You can't just add a switch to suddenly turn the aircraft into an illegal one. Any sane pilot would immediately turn it off for their own safety or be coerced to turn it off after launch by the airline companies. All the manufacturers would add an MCAS equivalent system to skip regulations. In the past the F1 went through this bullshit where cars were legal before the race started and the race ended with all cars turning on illegal features.
- Zak 7y ago
  It's not rare for envelope protection systems on commercial aircraft to have some sort of override. That it's required to be present in normal operation to pass certification does not mean that the plane is suddenly illegal if it's switched off under abnormal conditions. Pilots do not typically override safety systems that are functioning properly because they don't want to die. Airlines do not order them to do so because they don't like fines, plane crashes, or being ordered to shut down. It's not like turning MCAS off makes the plane go faster or burn less fuel. Nobody would turn it off unless it was malfunctioning.
tgsovlerkhgsel 7y ago
> I can't imagine the logic for that since two sensors are physically present My understanding for that is that if you look at two sensors, then a disagreement can happen, which has to be resolved somehow. In the case of MCAS, this would likely be turning MCAS off and telling the pilot, which would require training on what that extra warning light meant and would have required telling the pilots about it, jeopardizing the type rating. Looking at only one sensor means the system "cannot fail"...

by Zak 7y ago

cesarb 7y ago

> They made it rely on only one sensor. I can't imagine the logic for that since two sensors are physically present, and damage to AOA sensors is not rare. The logic for that is really simple: each sensor is wired to one of the two computers. Each computer uses its own sensor. This was an already existing design, MCAS is just a new function added to these computers. (AFAIK, other aircraft like Airbus have multiple sensors wired to each computer, so for them it would be natural to use more than one sensor.)

Zak 7y ago
That makes a lot of sense actually; it wasn't a deliberate decision, just the path of least resistance.
phire 7y ago
Both computers have access to both sensor's data. The computers are networked together. This is how they implement the AoA disagree function (the one which was broken in 90% of MAXes for unrelated reasons). It's also how they managed to implement a software update which makes MCAS take data from both sensors. The logic for not implementing both sensors is much more insidious. If you implement both sensors, then you have to deal with the case that infomation from sensors might disagree. The computer has no idea sensor is providing correct data, so the only thing it can really do is disable itself when the sensors disagree. If MCAS has the ability to disable itself, then it must provide feedback to pilots it has done so, and have pilots follow some procedures. If there were procedures, then Boeing would have to add pilot training about what MCAS was and how things would be different when it disabled itself. Boeing made it rely on only a single sensor to bypass training requirements.

imtringued 7y ago

>They removed the switch to turn it off. You can't just add a switch to suddenly turn the aircraft into an illegal one. Any sane pilot would immediately turn it off for their own safety or be coerced to turn it off after launch by the airline companies. All the manufacturers would add an MCAS equivalent system to skip regulations. In the past the F1 went through this bullshit where cars were legal before the race started and the race ended with all cars turning on illegal features.

Zak 7y ago
It's not rare for envelope protection systems on commercial aircraft to have some sort of override. That it's required to be present in normal operation to pass certification does not mean that the plane is suddenly illegal if it's switched off under abnormal conditions. Pilots do not typically override safety systems that are functioning properly because they don't want to die. Airlines do not order them to do so because they don't like fines, plane crashes, or being ordered to shut down. It's not like turning MCAS off makes the plane go faster or burn less fuel. Nobody would turn it off unless it was malfunctioning.

tgsovlerkhgsel 7y ago

> I can't imagine the logic for that since two sensors are physically present My understanding for that is that if you look at two sensors, then a disagreement can happen, which has to be resolved somehow. In the case of MCAS, this would likely be turning MCAS off and telling the pilot, which would require training on what that extra warning light meant and would have required telling the pilots about it, jeopardizing the type rating. Looking at only one sensor means the system "cannot fail"...