5 ms·

Triple is not needed, just double with a redundant "disagree" alarm. Once the pilot knows there's one bad AOA, they can lock out the bad one as an input to the

Triple is not needed, just double with a redundant "disagree" alarm. Once the pilot knows there's one bad AOA, they can lock out the bad one as an input to the autopilot/MCAS, or hand fly without automation. Of course this is all a bunch of new software and training though.

frogblast 6y ago
This is what I don't get. If the solution is "install a AOA Disagree light, and disable MCAS in that scenario", why has it taken two years to develop this solution?
- na85 6y ago
  It's not like pushing a JavaScript change to the website. Aircraft software changes are subject to the same level of design review as a structural modification.
- salawat 6y ago
  There's way more to it actually. The Flight Computer as architected was found to be a single point-of-failure with a catastrophic failure mode with the software as delivered. That's a big fat no-no. Even if it was only under the most unlikely circumstances possible, you don't design a system that can fail that way, even in theory. Murphy is considered to always find a way, so you must be able to survive that casualty. Therefore, they had to rearchitect the software with greater redundancy, which in aerospace, comes with such a load of verification burden as to be a majority of the work on it's own, especially given as it will almost guaranteed change the operating interface procedurewise in some way for pilots. Throw in the issues getting all international regulators independent buy-in, and fix wish lists, negotiating through those, documenting and publishing training and maintenance material updates... https://www.seattletimes.com/business/boeing-aerospace/newly-stringent-faa-tests-spur-a-fundamental-software-redesign-of-737-max-flight-controls/ https://www.seattletimes.com/business/boeing-aerospace/newly... There were also deeper problems from at least a reading of regulations from my point of view with how interpretations of statutory regulation have evolved, but unfortunately, those are beyond any ability of me to confirm or comment on ongoing developments as a non-industry insider. (Read: practically just me being pissy because no one in the industry except maybe WalterBright has given me a sufficiently convincing reckoning of.) From my recollection of my digging at the time, there were various statutory test criteria that an MCAS-less MAX could not meet, and thus should not have been certified as a civil transport aircraft if evaluated strictly to the statute as written. Obviously, reading of statute doesn't directly translate to 100% accurate assessments of how it is enforced, as they are written to be understood and convey meaning within an intended audience of specialists (which is it's own problem in my opinion), but nevertheless, back in the bad old days, there were quite the number of test pilots who felt that as time went on, the loosening of airworthyness standards from "strictly as written" was resulting in a slippery slope which was resulting in aircraft that were increasingly less capable of being fully understood by pilots, and potentially more dangerous in the event of substantial problems developing with their automation systems. Obviously, we can see how history resolved that debate, but our forebearer's on the losing side of that argument sadly do win their "I told you so"s. See the D.P. Davies Interviews with the Royal Aeronautical Society for more on that and some good listening. https://www.aerosociety.com/news/audio-the-d-p-davies-interview-on-testing-the-comets-boeing-707-britannia-brabazon/ https://www.aerosociety.com/news/audio-the-d-p-davies-interv... https://www.aerosociety.com/news/audio-the-d-p-davies-interview-on-the-boeing-747-the-trident-vc10-one-eleven-the-boeing-727/ https://www.aerosociety.com/news/audio-the-d-p-davies-interv...
Someone1234 6y ago
> they can lock out the bad one as an input to the MCAS The 737 MAX didn't support that as delivered. Even with the warning (which some US airlines paid for), you couldn't "lock out the bad one" even assuming you knew which one that was (you don't). All you could do is disable the electronic horizontal stabilizer completely, so that MCAS couldn't command it into a dangerous and unrecoverable state. MCAS has been fixed, in the sense that it won't command continuously bad trim inputs until the aircraft is unrecoverable when bad AOA data is provided, but ultimately the aircraft either needs to be designed around trustworthy AOA data (i.e. triple) or you untrustworthy (i.e. double, even with the warning). Half measures are exactly how we got to this point, with two crashes. Both answers are actually acceptable. A lot of completely safe aircraft have untrustworthy AOA inputs, the key there though is that automated systems are designed around that assumption. MCAS had too much flight authority to be linked to untrustworthy inputs.
- WatchDog 6y ago
  > Even with the warning (which some US airlines paid for) Are you saying that a bad input warning was an optional(paid) extra?
  - mitchellgoffpc 6y ago
    Yep. The "AOA sensor disagreement" light is built into every cockpit, but it won't turn on unless the airline purchased a specific premium add-on. Boeing claims they initially didn't realize the light was bundled as an add-on, and then once they did realize, they decided it wasn't critical to the airplane's safety and just kept selling it as an add-on, which is... kind of alarming, to put it mildly. https://www.nytimes.com/2019/05/05/business/boeing-737-max-warning-light.html https://www.nytimes.com/2019/05/05/business/boeing-737-max-w...
    - AnssiH 6y ago
      > The "AOA sensor disagreement" light is built into every cockpit, While technically true, that sounds a bit misleading considering that the AOA DISAGREE warning "light" is just a text indicator on the primary flight display: https://www.boeing.com/resources/boeingdotcom/commercial/737max/assets/images/737-flightdeck-1242x272.png https://www.boeing.com/resources/boeingdotcom/commercial/737...
labcomputer 6y ago
How do you know which one is bad?
- imglorp 6y ago
  Attitude indicators are gyroscopic and themselves redundant. If you can get the plane into level flight and then examine the AOA sensors, they should be close to a known value (see picture) if you do some math. Not saying this is a good idea. https://orangeflighttraining.com.au/images/aviation-AoA-pitch.jpg https://orangeflighttraining.com.au/images/aviation-AoA-pitc...
- _ph_ 6y ago
  Strictly speaking, you cannot know which one is bad, but the correct reaction to bad AOA data is not to engage MCAS. The accidents were caused by MCAS activating on the input of a single defective AOA sensor.
tjmc 6y ago
Wasn't the second AOA sensor an optional upgrade? Seems it should be mandatory for a start. Edit: It had 2 AOA sensors but the indicators showing each reading and the disagree light if they differed were optional (https://www.nytimes.com/2019/03/21/business/boeing-safety-features-charge.html https://www.nytimes.com/2019/03/21/business/boeing-safety-fe...)

frogblast 6y ago

This is what I don't get. If the solution is "install a AOA Disagree light, and disable MCAS in that scenario", why has it taken two years to develop this solution?

na85 6y ago
It's not like pushing a JavaScript change to the website. Aircraft software changes are subject to the same level of design review as a structural modification.
salawat 6y ago
There's way more to it actually. The Flight Computer as architected was found to be a single point-of-failure with a catastrophic failure mode with the software as delivered. That's a big fat no-no. Even if it was only under the most unlikely circumstances possible, you don't design a system that can fail that way, even in theory. Murphy is considered to always find a way, so you must be able to survive that casualty. Therefore, they had to rearchitect the software with greater redundancy, which in aerospace, comes with such a load of verification burden as to be a majority of the work on it's own, especially given as it will almost guaranteed change the operating interface procedurewise in some way for pilots. Throw in the issues getting all international regulators independent buy-in, and fix wish lists, negotiating through those, documenting and publishing training and maintenance material updates... https://www.seattletimes.com/business/boeing-aerospace/newly-stringent-faa-tests-spur-a-fundamental-software-redesign-of-737-max-flight-controls/ https://www.seattletimes.com/business/boeing-aerospace/newly... There were also deeper problems from at least a reading of regulations from my point of view with how interpretations of statutory regulation have evolved, but unfortunately, those are beyond any ability of me to confirm or comment on ongoing developments as a non-industry insider. (Read: practically just me being pissy because no one in the industry except maybe WalterBright has given me a sufficiently convincing reckoning of.) From my recollection of my digging at the time, there were various statutory test criteria that an MCAS-less MAX could not meet, and thus should not have been certified as a civil transport aircraft if evaluated strictly to the statute as written. Obviously, reading of statute doesn't directly translate to 100% accurate assessments of how it is enforced, as they are written to be understood and convey meaning within an intended audience of specialists (which is it's own problem in my opinion), but nevertheless, back in the bad old days, there were quite the number of test pilots who felt that as time went on, the loosening of airworthyness standards from "strictly as written" was resulting in a slippery slope which was resulting in aircraft that were increasingly less capable of being fully understood by pilots, and potentially more dangerous in the event of substantial problems developing with their automation systems. Obviously, we can see how history resolved that debate, but our forebearer's on the losing side of that argument sadly do win their "I told you so"s. See the D.P. Davies Interviews with the Royal Aeronautical Society for more on that and some good listening. https://www.aerosociety.com/news/audio-the-d-p-davies-interview-on-testing-the-comets-boeing-707-britannia-brabazon/ https://www.aerosociety.com/news/audio-the-d-p-davies-interv... https://www.aerosociety.com/news/audio-the-d-p-davies-interview-on-the-boeing-747-the-trident-vc10-one-eleven-the-boeing-727/ https://www.aerosociety.com/news/audio-the-d-p-davies-interv...

Someone1234 6y ago

> they can lock out the bad one as an input to the MCAS The 737 MAX didn't support that as delivered. Even with the warning (which some US airlines paid for), you couldn't "lock out the bad one" even assuming you knew which one that was (you don't). All you could do is disable the electronic horizontal stabilizer completely, so that MCAS couldn't command it into a dangerous and unrecoverable state. MCAS has been fixed, in the sense that it won't command continuously bad trim inputs until the aircraft is unrecoverable when bad AOA data is provided, but ultimately the aircraft either needs to be designed around trustworthy AOA data (i.e. triple) or you untrustworthy (i.e. double, even with the warning). Half measures are exactly how we got to this point, with two crashes. Both answers are actually acceptable. A lot of completely safe aircraft have untrustworthy AOA inputs, the key there though is that automated systems are designed around that assumption. MCAS had too much flight authority to be linked to untrustworthy inputs.

WatchDog 6y ago
> Even with the warning (which some US airlines paid for) Are you saying that a bad input warning was an optional(paid) extra?
- mitchellgoffpc 6y ago
  Yep. The "AOA sensor disagreement" light is built into every cockpit, but it won't turn on unless the airline purchased a specific premium add-on. Boeing claims they initially didn't realize the light was bundled as an add-on, and then once they did realize, they decided it wasn't critical to the airplane's safety and just kept selling it as an add-on, which is... kind of alarming, to put it mildly. https://www.nytimes.com/2019/05/05/business/boeing-737-max-warning-light.html https://www.nytimes.com/2019/05/05/business/boeing-737-max-w...
  - AnssiH 6y ago
    > The "AOA sensor disagreement" light is built into every cockpit, While technically true, that sounds a bit misleading considering that the AOA DISAGREE warning "light" is just a text indicator on the primary flight display: https://www.boeing.com/resources/boeingdotcom/commercial/737max/assets/images/737-flightdeck-1242x272.png https://www.boeing.com/resources/boeingdotcom/commercial/737...

labcomputer 6y ago

How do you know which one is bad?

imglorp 6y ago
Attitude indicators are gyroscopic and themselves redundant. If you can get the plane into level flight and then examine the AOA sensors, they should be close to a known value (see picture) if you do some math. Not saying this is a good idea. https://orangeflighttraining.com.au/images/aviation-AoA-pitch.jpg https://orangeflighttraining.com.au/images/aviation-AoA-pitc...
_ph_ 6y ago
Strictly speaking, you cannot know which one is bad, but the correct reaction to bad AOA data is not to engage MCAS. The accidents were caused by MCAS activating on the input of a single defective AOA sensor.

tjmc 6y ago

Wasn't the second AOA sensor an optional upgrade? Seems it should be mandatory for a start. Edit: It had 2 AOA sensors but the indicators showing each reading and the disagree light if they differed were optional (https://www.nytimes.com/2019/03/21/business/boeing-safety-features-charge.html https://www.nytimes.com/2019/03/21/business/boeing-safety-fe...)