4
$\begingroup$

this article states that the original version of MCAS was suppose to rely on two sensors,

One sensor will detect a high angle of attack, therefore activating MCAS

The other sensor will detect a high G force and therefore activate MCAS.

But what I don’t understand, is why people use this as an argument against Boeing, as if they should have went with that idea? If the high g force sensor was faulty, wouldn’t it technically need a second sensor looking at a high g force, in order to compare the two?

So basically if they had stuck with that idea, we’d still be here today?

Improve this question
$\endgroup$
2
  • 1
    $\begingroup$ The combined “2 input” AOA and G load design was only used in testing and never used in the production aircraft. The final MCAS design uses only 1 of 2 AOA indications available. The system automatically switches from the left to the right AOA for each flight. $\endgroup$
    – Mike Sowsun
    Commented Feb 14, 2020 at 13:26
  • $\begingroup$ No, the Seattle Times article says "two factors," not "two sensors." The reporter doesn't know the difference between a parameter and a sensor and thinks that the two parameters originally used to trigger MCAS (AOA and g-loading) were replaced by one AoA sensor, when in fact the new triggering parameters were: AOA, Flaps retracted, Autopilot off. The system used one AOA sensor per FCC before, and STILL used one per FCC when the MAX entered service. Just another example of the utter rubbish that the news media put out while doing a crash investigation although utterly incompetent in aviation. $\endgroup$
    – Pete P.
    Commented Aug 4, 2022 at 20:42

2 Answers 2

Reset to default
10
$\begingroup$

The problem is that there is no redundancy in the sensor input. The quote from the article is:

This original version of MCAS, according to two people familiar with the details, was activated only if two distinct sensors indicated such an extreme maneuver: a high angle of attack and a high G-force.

So on the original design, MCAS activation required two sensors detecting an input over a certain threshold, and in itself this creates protection against false positives.

There are two major failure modes for sub-systems:

  • Zero output, where the sub-system simply stops outputting a signal.
  • Hard-Over failure, where the sub-system outputs a false positive. This is what happened with the AoA sensor in the two MCAS disasters.

With the original design, if one sensor would go hard-over, MCAS would not activate and the system would be protected against a single failure. But in the certified config, the activating input was not checked against any signal and MCAS repeatedly activated.

Further notes on the AoA sensors, from the final accident report page 45:

  • There are two AoA indicators on the B737Max, and only one was used for MCAS input.

  • There was an AOA disagree detection installed - as an option which Lion Air had not selected at the time of the accident:

    Accordingly, the software activated the AOA DISAGREE alert only if an airline opted for the AOA indicator. At the time of the accident, Boeing advised that the AOA indicator has been selected by approximately 20% of airlines.

    When the discrepancy between the AOA display requirements and the software was identified, Boeing determined that the absence of the AOA DISAGREE alert did not adversely impact aircraft safety or operation. Accordingly, Boeing concluded that the existing functionality was acceptable until the originally intended functionality could be implemented in a display system software upgrade, scheduled for the third quarter of 2020.

    Lion Air did not select the optional AOA indicator feature on the PFD of their 737- 8 (MAX) aircraft. As a result, the AOA DISAGREE did not appear on PK-LQP aircraft, even though the necessary conditions were met.

The safety analysis of the certified system has proven to be fatally incorrect, and this is what is so baffling. A single mode of failure was allowed to activate a flight critical system, by the most experienced aerospace company on earth. Plus: the incorrect safety analysis was accepted by the aviation authority whose function it is to protect us, the passengers.

Improve this answer
$\endgroup$
13
  • 1
    $\begingroup$ I think you can also add that Boeing and the FAA also decided that the pilots didn't need to be trained on this system. $\endgroup$
    – Robin Bennett
    Commented Jan 17, 2020 at 13:58
  • $\begingroup$ But even if they use one sensor, how can it not reject just based off the sensors differing? I know they work simultaneously, but couldn’t they have been an easy change? $\endgroup$
    – George Clooney In a Mooney
    Commented Jan 21, 2020 at 21:34
  • $\begingroup$ @Firefighter1 Very, very good point! $\endgroup$
    – Koyovis
    Commented Jan 28, 2020 at 0:08
  • 1
    $\begingroup$ @PeteP. I'd have thought that was obvious. Pilots should know that the system is there, that's it's vulnerable to a failure of the AoA sensor, how to recognise a failure and how to disable the system and regain control. $\endgroup$
    – Robin Bennett
    Commented Aug 5, 2022 at 7:58
  • 1
    $\begingroup$ @Robin Bennett The pilots can't detect normal MCAS operation, can't control/adjust it, can't turn it ON or OFF, there is no mention of it in system fault messages, checklists or procedures. Nonnormal operation manifests as a runaway stabilizer trim, which has multiple causes and is handled without fault isolation, by the same NNC regardless of cause, and for which initial and recurrent simulator training is standard. The system is transparent to the flight crew, so no MCAS-specific flight-sim training is necessary or even possible and there is no need for its inclusion in the FCOM. $\endgroup$
    – Pete P.
    Commented Aug 8, 2022 at 20:56
3
$\begingroup$

That's a completely incorrect understanding of the article. The summary should be:

MCAS activates if: a) Sensor detects a high angle of attack and b) Sensor detects a high normal G load

If one sensor is erroneous and and the other one isn't, then MCAS would not erroneously activate.

Improve this answer
$\endgroup$
6
  • $\begingroup$ And what happens if the high g force sensor is faulty and not reading correctly, but the plane is experiencing a high g force and high angle of attack? $\endgroup$
    – George Clooney In a Mooney
    Commented Jan 16, 2020 at 22:23
  • $\begingroup$ @Firefighter1 Then MCAS would not kick in. You may encounter a stick force reversal and a pitch up as a result. You will still have the stick shaker activated in this flight regime. $\endgroup$
    – JZYL
    Commented Jan 16, 2020 at 22:34
  • $\begingroup$ Actually, the article itself is nonsensical. The author lacks basic competence in engineering and has confused the various conditions that must be satisfied for the system to activate as being "multiple points of failure," not realizing that they are independent and unrelated parameters. He also doesn't realize that the modified system required Flaps_Up and Autopilot_Off in addition to AOA_High in order to trigger MCAS, which blows his "single point of failure" conspiracy to bits. $\endgroup$
    – Pete P.
    Commented Jul 19, 2022 at 23:41
  • $\begingroup$ @JZYL True, MCAS would not kick in, but there would not be any stick force reversal, that is not a characteristic of the airplane. There would also not be any pitch up, whether due to stick forces or anything else (other than pilot induced); that is also not a characteristic of the airplane. And whether the stick shaker goes off or not depends solely on the angle of attack: if it is high enough to trigger the stall warning, it will activate; doesn't have anything to do with MCAS. For clarity—MCAS is NOT an anti-stall system or stall-recovery system, regardless of what a news reporter says. $\endgroup$
    – Pete P.
    Commented Aug 4, 2022 at 21:10
  • $\begingroup$ @PeteP. I never claimed MCAS was originally designed for anti-stall. As far as I understand based on publicly available sources, it's required for certification and adhere to the requirements Part 25 related to stall characteristics and maneuver stability. $\endgroup$
    – JZYL
    Commented Aug 5, 2022 at 15:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .