4 ms·

That's not true. The MAX always had two sensors, it's just that the software design only ever used one of them at a time.

theGnuMe 4y ago
Man imagine being on that development team. I wonder if anyone thought it was a bad requirement at the time and whose job it was to identify that (and was the issue flagged and if not why not). A programmer isn’t an aeronautical engineer but it really says how a whole systems view is necessary. I work in a field with increased specialization but we build systems and sometimes similar things come up. There are few who see the end to end system for itself. I imagine rockets and the space shuttle get that level of scrutiny and that books have been written about it.
- salawat 4y ago
  They knew a dual/multi-sensor system would be required. They aldo knew putting one in would have mandated simulator training; and they had to avoid that at all costs. That's why the MAX accidents are so notably engineering failures; the industry knew what needed to be engineered, but business shot it down, and forced them to build something fundamentally unsafe in the interests of maximizing profit, and not sweating the product in the box.
himinlomax 4y ago
Well, having two is functionally the same as having just one since you fundamentally can't tell which one is good when there's a single failure.
- tzs 4y ago
  Two in an improvement. With only one you can be in one of 3 states: S1. The sensor is returning correct readings. S2. The sensor is returning readings but they are not correct. S3. The sensor is not returning readings. To the pilot (or automation) using the sensor there are only two states: U1 = S1 + S2. U2 = S3. With two you can be in 7 states. S1. Both sensors are returning correct readings. S2. Both sensors are returning the same incorrect readings. S3. One sensor is returning correct readings and one sensor is returning incorrect readings. S4. Both sensors are returning incorrect readings which do not match. S5. One sensor is returning correct readings and one is not returning readings. S6. One sensor is returning incorrect readings and one is not returning readings. S7. Neither sensor is returning readings. The states the pilot (or automation) sees are U1 = S1 + S2 U2 = S3 + S4 U3 = S5 + S6 U4 = S7 This is an improvement. If you get readings that agree (U1) or just one reading (U3) you can be more confident that the reading is correct than in the case of only one sensor. Here are some numbers. If the sensor works fine 98% of the time, but 1% of fails in a way that gives false readings, and 1% of the time fails in a way that gives no readings, then when the pilot gets a reading on the single sensor plane there is a 98.99% chance it is right. On the two sensor plane when the pilot gets a reading that is the same on both sensors there is a 99.99% chance that reading is right. If the pilot only gets a reading from one sensor then it is the same as the single sensor plane case, 98.99%. Overall, on the two sensor plane if the pilot checks the sensors and accepts the result when the two sensors agree on a reading or when only one sensor gives a reading, they will be getting a correct result 99.97% of the time.
- WalterBright 4y ago
  With two, you can tell that one is wrong, so you shut off any automatic systems that depend on it. This is where MCAS went wrong.

theGnuMe 4y ago

Man imagine being on that development team. I wonder if anyone thought it was a bad requirement at the time and whose job it was to identify that (and was the issue flagged and if not why not). A programmer isn’t an aeronautical engineer but it really says how a whole systems view is necessary. I work in a field with increased specialization but we build systems and sometimes similar things come up. There are few who see the end to end system for itself. I imagine rockets and the space shuttle get that level of scrutiny and that books have been written about it.

salawat 4y ago
They knew a dual/multi-sensor system would be required. They aldo knew putting one in would have mandated simulator training; and they had to avoid that at all costs. That's why the MAX accidents are so notably engineering failures; the industry knew what needed to be engineered, but business shot it down, and forced them to build something fundamentally unsafe in the interests of maximizing profit, and not sweating the product in the box.

himinlomax 4y ago

Well, having two is functionally the same as having just one since you fundamentally can't tell which one is good when there's a single failure.

tzs 4y ago
Two in an improvement. With only one you can be in one of 3 states: S1. The sensor is returning correct readings. S2. The sensor is returning readings but they are not correct. S3. The sensor is not returning readings. To the pilot (or automation) using the sensor there are only two states: U1 = S1 + S2. U2 = S3. With two you can be in 7 states. S1. Both sensors are returning correct readings. S2. Both sensors are returning the same incorrect readings. S3. One sensor is returning correct readings and one sensor is returning incorrect readings. S4. Both sensors are returning incorrect readings which do not match. S5. One sensor is returning correct readings and one is not returning readings. S6. One sensor is returning incorrect readings and one is not returning readings. S7. Neither sensor is returning readings. The states the pilot (or automation) sees are U1 = S1 + S2 U2 = S3 + S4 U3 = S5 + S6 U4 = S7 This is an improvement. If you get readings that agree (U1) or just one reading (U3) you can be more confident that the reading is correct than in the case of only one sensor. Here are some numbers. If the sensor works fine 98% of the time, but 1% of fails in a way that gives false readings, and 1% of the time fails in a way that gives no readings, then when the pilot gets a reading on the single sensor plane there is a 98.99% chance it is right. On the two sensor plane when the pilot gets a reading that is the same on both sensors there is a 99.99% chance that reading is right. If the pilot only gets a reading from one sensor then it is the same as the single sensor plane case, 98.99%. Overall, on the two sensor plane if the pilot checks the sensors and accepts the result when the two sensors agree on a reading or when only one sensor gives a reading, they will be getting a correct result 99.97% of the time.
WalterBright 4y ago
With two, you can tell that one is wrong, so you shut off any automatic systems that depend on it. This is where MCAS went wrong.