3
$\begingroup$

this article states that the original version of MCAS was suppose to rely on two sensors,

One sensor will detect a high angle of attack, therefore activating MCAS

The other sensor will detect a high G force and therefore activate MCAS.

But what I don’t understand, is why people use this as an argument against Boeing, as if they should have went with that idea? If the high g force sensor was faulty, wouldn’t it technically need a second sensor looking at a high g force, in order to compare the two?

So basically if they had stuck with that idea, we’d still be here today?

$\endgroup$
  • $\begingroup$ The combined “2 input” AOA and G load design was only used in testing and never used in the production aircraft. The final MCAS design uses only 1 of 2 AOA indications available. The system automatically switches from the left to the right AOA for each flight. $\endgroup$ – Mike Sowsun Feb 14 at 13:26
9
$\begingroup$

The problem is that there is no redundancy in the sensor input. The quote from the article is:

This original version of MCAS, according to two people familiar with the details, was activated only if two distinct sensors indicated such an extreme maneuver: a high angle of attack and a high G-force.

So on the original design, MCAS activation required two sensors detecting an input over a certain threshold, and in itself this creates protection against false positives.

There are two major failure modes for sub-systems:

  • Zero output, where the sub-system simply stops outputting a signal.
  • Hard-Over failure, where the sub-system outputs a false positive. This is what happened with the AoA sensor in the two MCAS disasters.

With the original design, if one sensor would go hard-over, MCAS would not activate and the system would be protected against a single failure. But in the certified config, the activating input was not checked against any signal and MCAS repeatedly activated.

Further notes on the AoA sensors, from the final accident report page 45:

  • There are two AoA indicators on the B737Max, and only one was used for MCAS input.
  • There was an AOA disagree detection installed - as an option which Lion Air had not selected at the time of the accident:

    Accordingly, the software activated the AOA DISAGREE alert only if an airline opted for the AOA indicator. At the time of the accident, Boeing advised that the AOA indicator has been selected by approximately 20% of airlines.

    When the discrepancy between the AOA display requirements and the software was identified, Boeing determined that the absence of the AOA DISAGREE alert did not adversely impact aircraft safety or operation. Accordingly, Boeing concluded that the existing functionality was acceptable until the originally intended functionality could be implemented in a display system software upgrade, scheduled for the third quarter of 2020.

    Lion Air did not select the optional AOA indicator feature on the PFD of their 737- 8 (MAX) aircraft. As a result, the AOA DISAGREE did not appear on PK-LQP aircraft, even though the necessary conditions were met.

The safety analysis of the certified system has proven to be fatally incorrect, and this is what is so baffling. A single mode of failure was allowed to activate a flight critical system, by the most experienced aerospace company on earth. Plus: the incorrect safety analysis was accepted by the aviation authority whose function it is to protect us, the passengers.

$\endgroup$
  • 1
    $\begingroup$ I think you can also add that Boeing and the FAA also decided that the pilots didn't need to be trained on this system. $\endgroup$ – Robin Bennett Jan 17 at 13:58
  • $\begingroup$ But even if they use one sensor, how can it not reject just based off the sensors differing? I know they work simultaneously, but couldn’t they have been an easy change? $\endgroup$ – Firefighter1 Jan 21 at 21:34
  • $\begingroup$ @Firefighter1 Very, very good point! $\endgroup$ – Koyovis Jan 28 at 0:08
3
$\begingroup$

That's a completely incorrect understanding of the article. The summary should be:

MCAS activates if: a) Sensor detects a high angle of attack and b) Sensor detects a high normal G load

If one sensor is erroneous and and the other one isn't, then MCAS would not erroneously activate.

$\endgroup$
  • $\begingroup$ And what happens if the high g force sensor is faulty and not reading correctly, but the plane is experiencing a high g force and high angle of attack? $\endgroup$ – Firefighter1 Jan 16 at 22:23
  • $\begingroup$ @Firefighter1 Then MCAS would not kick in. You may encounter a stick force reversal and a pitch up as a result. You will still have the stick shaker activated in this flight regime. $\endgroup$ – JZYL Jan 16 at 22:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.