4
$\begingroup$

The related question "Is it common for automated control systems to use non-redundant sensors?" does not ask about a specific example, nor are specific examples provided in the answer.

The criteria for my question:

  • Activates on its own, or always active.
  • No light/text indication of it being active.
  • No specific disable switch.
  • Relies on 1 sensor when 2+ exist.
  • The system is not disabled when the 2+ sensors disagree.

As you can see, these properties are modeled after what is known about MCAS.

This question isn't about the 737 in particular but about any commercial (fly-by-wire or not) airplane, so eventually the answers should specify the model, and if possible the justification of the design.

Improve this question
$\endgroup$
13
  • 4
    $\begingroup$ Note that the 737 is not a fly-by-wire airplane. $\endgroup$
    – user14897
    Commented Mar 27, 2019 at 22:39
  • 4
    $\begingroup$ Neither 737 Max. $\endgroup$
    – user14897
    Commented Mar 27, 2019 at 22:43
  • 1
    $\begingroup$ I deleted my answer because thrust idling is displayed on the FMA. Kindly take the following as a constructive comment: I agree (and I voted leave open) that the questions are related but different. However, as you say, you wrote a tedious list, which actually makes for a laborious read. My recommendation is to rewrite the question in as few words as possible. If the question can't be summarized in a short title, then it won't find audience, and given the many unknowns about MCAS, may give the impression of a leading question. $\endgroup$
    – user14897
    Commented Mar 29, 2019 at 7:40
  • 1
    $\begingroup$ Related (and may answer the underlying question): Why are on-board computers allowed to change controls without notifying the pilots? $\endgroup$
    – user14897
    Commented Mar 29, 2019 at 7:56
  • 1
    $\begingroup$ I have applied my recommendation as a way of helping, kindly see the revision notice. $\endgroup$
    – user14897
    Commented Mar 29, 2019 at 10:13

2 Answers 2

Reset to default
5
$\begingroup$

Irrespective of 737 MAX MCAS, I haven't seen similar decision relying on a single sensor on 777 or on 757.

Similarly I found nothing similar on Airbus 320, 330, 340, 350, or 380. On these Airbuses, 3 sensors are used for critical decisions, thus the faulty sensor is isolated by voting the data. If the 3 sensors are diverging (no 2 sensors giving similar data), the system goes into safe degraded mode, and the pilots are informed by automatic displayed message.

Improve this answer
$\endgroup$
11
  • 2
    $\begingroup$ I’m not surprised. Aeronautical engineering 101: never rely on only one single input if it can cause loss of control. $\endgroup$
    – Koyovis
    Commented May 28, 2019 at 22:11
  • 2
    $\begingroup$ There's another puzzling matter rambling in my mind and that I feel (maybe wrongly) it should be 101 fact: if the autopilot disconnects because of sensors disagreement, any other automatic system which uses one of those now-disagreeing sensors should be disconnected too (with loud warnings or whatever): disconnecting the autopilot but needing an active action by the pilots to disable those other systems seems very illogical to me. $\endgroup$
    – ShinTakezou
    Commented May 29, 2019 at 19:11
  • $\begingroup$ If I understand, you believe, it would have been better to inhibit automatically any MCAS trim in case of AOA disagree, probably it will be like that in the future when the aircraft will be allowed to fly. $\endgroup$
    – user40476
    Commented May 30, 2019 at 9:43
  • $\begingroup$ @ShinTakezou That would make those systems dependent on (in this case) the autopilot, which seems to me to add to the possible failure modes. What if it's the autopilot code that reaches the wrong conclusion for whatever reason, and not a problem that would affect other systems? You risk suddenly disconnecting a whole slew of perfectly working systems, throwing warnings and errors at the pilots as you go. Take something like QF32, but made worse by the plane actually acting up beyond spewing messages at the flight crew. Basically pretending that a system doesn't exist seems the worse approach. $\endgroup$
    – user
    Commented May 30, 2019 at 22:31
  • 1
    $\begingroup$ @aCVn No, it would make activation of both systems dependent upon correct functionality of the sensors. $\endgroup$
    – Koyovis
    Commented May 31, 2019 at 3:06
4
$\begingroup$

Speed Trim System (STS) is very similar to MCAS and is used on the same aircraft. Moreover, Boeing maintains that it did not have to notify pilots about MCAS because MCAS is a part of STS, running on the same computer and controlling the same surface — the stabilizer.

In a way, MCAS is just an extension of the system that already existed on prior versions of the 737. Just like MCAS, STS can cause stabilizer to run away, and if pilots catch it too late, they can get themselves into a situation similar to Ethiopian Airlines Flight 302, because the recovery procedure is the same.

Recently it has been reported that another glitch had been found in the 737 MAX software. The details are sketchy, here is what the Seattle Times reports:

Exercises on a Boeing 737 MAX simulator in recent days showed pilots might have difficulty responding to the newly identified failure. Just as MCAS uses a motor to move a small wing at the tail of the plane to lower the nose, the latest issue could prompt that same wing to move without pilot commands. The tail wing is known as a horizontal stabilizer.

To me this looks like a bug with STS software. Because STS is used on earlier 737 versions, Boeing does not seem to appreciate too much noise around this issue, because it may affect the entire 737 fleet.

Improve this answer
$\endgroup$
2
  • $\begingroup$ About MCAS being part of STS, I bookmarked this where you read: “Elwell clarified that MCAS is not an anti-stall system, but a supplement to the speed-trim system”. Anyway for some reasons this STS unextended by MCAS didn't cause too much trouble in the past, it seems. Maybe it has less authority? $\endgroup$
    – ShinTakezou
    Commented Jun 28, 2019 at 22:09
  • 1
    $\begingroup$ @ShinTakezou Yes, has less authority. Also, on the NG a pilot can turn STS off while keeping electric trim switches operable. On the MAX it is not possible. So yeah, even if STS goes haywire on the NG, there is better chance to recover than on the MAX — if pilots know about the function of EACH switch, because the recovery procedure tells them to turn BOTH switches off. I think they will know it now after the crashes. I expect Boeing to re-wire stab trim cutoff switches on the MAX to the NG configuration if it wants to fix the issue the way it should be fixed. $\endgroup$
    – Rusty Core
    Commented Jun 28, 2019 at 22:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .