Aviation Stack Exchange is a question and answer site for aircraft pilots, mechanics, and enthusiasts. It only takes a minute to sign up.
Sign up to join this community
The KC-46 has a two-sensor MCAS system, which “compares the two readings,” the Air Force said.
I’m aware that the 737 uses two sensors and always has, but the computer reads them simultaneously based off which pilot is flying the plane. So if the Captain is flying it’s reading data from the left side, correct?
At this point I’m assuming Boeing’s decision to pull data from one sensor was to reduce the workload and make for a earlier introduction?
According to the article, the KC-46 uses the dual FCC/AoA sensor for computing both FCC channels and comparing the command signals. With two disagreeing signals there is no way to determine which one is correct and the usual remedy is to disengage both, warn the pilot, and engage in the appropriate crew procedure. And that requires training.
The B737MAX was promoted as requiring only very limited differences training relative to the NG, so the setup for the KC-46 could not be copied. The original design of MCAS in the B737MAX also used two transducers for activation - two different types of transducers, both of which had to be over a threshold value, as mentioned in this answer. Original design MCAS only had limited authority of 0.8 deg stabiliser. From the crash report of Lion Air 610, page 204:
MCAS is designed to function only during manual flight (autopilot not engaged), with the aircraft’s flaps up, at an elevated AOA. As the development of the 737-8 (MAX) progressed, the MCAS function was expanded to low Mach numbers and increased to maximum MCAS command limit of 2.5 of stabilizer movement.
The report states that in the failure analysis, Boeing classified the uncommanded MCAS failure condition as Major (which may not occur more than once in 10$^5$ flying hours), instead of Hazardous (1:10$^7$) or Catastrophic (1:10$^9$) allowing for indeed a single transducer input. Again from the report, page 206:
If the probability of an undesirable failure condition is not below the maximum allowable probability for that category of hazard, redesign of the system should be considered. If the uncommanded MCAS failure condition had been assessed as more severe than Major, the decision to rely on single AOA sensor should have been avoided.
Why all of this was done for the B737, while the KC-46 uses two sensors, is a conglomeration of factors. Two sensors is best. Time pressure for plane delivery, airline customer pressure for limiting differences training, the observation that previous versions of B737s with accumulated flying hours of 250 million had experienced no catastrophic failures due to AoA sensor failure (reference again from the crash report), all led to the perhaps justifiable belief that the one sensor was sufficient. If rapid action was taken by the crew to contain the failure - but the failure could not be reognised in time. Again page 206:
During the single and multiple failure analysis from the air data system worst case scenario of “failure of one AOA followed by erroneous AOA”, Boeing concluded that the effect would be hazardous until the flight crew recognized the problem and took appropriate action to mitigate it. Since the training or the guidance for actions taken in such situation were not provided, the effect category should have remained hazardous.
Since the FCC controlling the MCAS is dependent on a single AOA source, the MCAS contribution to cumulative AOA effects should have been assessed.
