4
$\begingroup$

The related question "Is it common for automated control systems to use non-redundant sensors?" does not ask about a specific example, nor are specific examples provided in the answer.

The criteria for my question:

  • Activates on its own, or always active.
  • No light/text indication of it being active.
  • No specific disable switch.
  • Relies on 1 sensor when 2+ exist.
  • The system is not disabled when the 2+ sensors disagree.

As you can see, these properties are modeled after what is known about MCAS.

This question isn't about the 737 in particular but about any commercial (fly-by-wire or not) airplane, so eventually the answers should specify the model, and if possible the justification of the design.

$\endgroup$
  • 3
    $\begingroup$ Note that the 737 is not a fly-by-wire airplane. $\endgroup$ – ymb1 Mar 27 at 22:39
  • 3
    $\begingroup$ Neither 737 Max. $\endgroup$ – ymb1 Mar 27 at 22:43
  • 1
    $\begingroup$ I deleted my answer because thrust idling is displayed on the FMA. Kindly take the following as a constructive comment: I agree (and I voted leave open) that the questions are related but different. However, as you say, you wrote a tedious list, which actually makes for a laborious read. My recommendation is to rewrite the question in as few words as possible. If the question can't be summarized in a short title, then it won't find audience, and given the many unknowns about MCAS, may give the impression of a leading question. $\endgroup$ – ymb1 Mar 29 at 7:40
  • 1
    $\begingroup$ Related (and may answer the underlying question): Why are on-board computers allowed to change controls without notifying the pilots? $\endgroup$ – ymb1 Mar 29 at 7:56
  • 1
    $\begingroup$ I have applied my recommendation as a way of helping, kindly see the revision notice. $\endgroup$ – ymb1 Mar 29 at 10:13
5
$\begingroup$

Irrespective of 737 MAX MCAS, I haven't seen similar decision relying on a single sensor on 777 or on 757.

Similarly I found nothing similar on Airbus 320, 330, 340, 350, or 380. On these Airbuses, 3 sensors are used for critical decisions, thus the faulty sensor is isolated by voting the data. If the 3 sensors are diverging (no 2 sensors giving similar data), the system goes into safe degraded mode, and the pilots are informed by automatic displayed message.

$\endgroup$
  • 1
    $\begingroup$ I’m not surprised. Aeronautical engineering 101: never rely on only one single input if it can cause loss of control. $\endgroup$ – Koyovis May 28 at 22:11
  • 2
    $\begingroup$ There's another puzzling matter rambling in my mind and that I feel (maybe wrongly) it should be 101 fact: if the autopilot disconnects because of sensors disagreement, any other automatic system which uses one of those now-disagreeing sensors should be disconnected too (with loud warnings or whatever): disconnecting the autopilot but needing an active action by the pilots to disable those other systems seems very illogical to me. $\endgroup$ – ShinTakezou May 29 at 19:11
  • $\begingroup$ If I understand, you believe, it would have been better to inhibit automatically any MCAS trim in case of AOA disagree, probably it will be like that in the future when the aircraft will be allowed to fly. $\endgroup$ – user40476 May 30 at 9:43
  • $\begingroup$ @ShinTakezou That would make those systems dependent on (in this case) the autopilot, which seems to me to add to the possible failure modes. What if it's the autopilot code that reaches the wrong conclusion for whatever reason, and not a problem that would affect other systems? You risk suddenly disconnecting a whole slew of perfectly working systems, throwing warnings and errors at the pilots as you go. Take something like QF32, but made worse by the plane actually acting up beyond spewing messages at the flight crew. Basically pretending that a system doesn't exist seems the worse approach. $\endgroup$ – a CVn May 30 at 22:31
  • 1
    $\begingroup$ @aCVn No, it would make activation of both systems dependent upon correct functionality of the sensors. $\endgroup$ – Koyovis May 31 at 3:06
3
$\begingroup$

Speed Trim System (STS) is very similar to MCAS and is used on the same aircraft. Moreover, Boeing maintains that it did not have to notify pilots about MCAS because MCAS is a part of STS, running on the same computer and controlling the same surface — the stabilizer.

In a way, MCAS is just an extension of the system that already existed on prior versions of the 737. Just like MCAS, STS can cause stabilizer to run away, and if pilots catch it too late, they can get themselves into a situation similar to Ethiopian Airlines Flight 302, because the recovery procedure is the same.

Recently it has been reported that another glitch had been found in the 737 MAX software. The details are sketchy, here is what the Seattle Times reports:

Exercises on a Boeing 737 MAX simulator in recent days showed pilots might have difficulty responding to the newly identified failure. Just as MCAS uses a motor to move a small wing at the tail of the plane to lower the nose, the latest issue could prompt that same wing to move without pilot commands. The tail wing is known as a horizontal stabilizer.

To me this looks like a bug with STS software. Because STS is used on earlier 737 versions, Boeing does not seem to appreciate too much noise around this issue, because it may affect the entire 737 fleet.

$\endgroup$
  • $\begingroup$ About MCAS being part of STS, I bookmarked this where you read: “Elwell clarified that MCAS is not an anti-stall system, but a supplement to the speed-trim system”. Anyway for some reasons this STS unextended by MCAS didn't cause too much trouble in the past, it seems. Maybe it has less authority? $\endgroup$ – ShinTakezou Jun 28 at 22:09
  • 1
    $\begingroup$ @ShinTakezou Yes, has less authority. Also, on the NG a pilot can turn STS off while keeping electric trim switches operable. On the MAX it is not possible. So yeah, even if STS goes haywire on the NG, there is better chance to recover than on the MAX — if pilots know about the function of EACH switch, because the recovery procedure tells them to turn BOTH switches off. I think they will know it now after the crashes. I expect Boeing to re-wire stab trim cutoff switches on the MAX to the NG configuration if it wants to fix the issue the way it should be fixed. $\endgroup$ – Rusty Core Jun 28 at 22:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.