(or is your question how do you choose which of two inputs to trust in real time and be assured you are picking correctly and that at least one is correct and can be trusted?)

That's why I always went for three sensors even when it was only protecting the equipment. Overall when the total equipment cost is in the millions, three sensors and the simple electronics needed to detect the odd one out rarely comes into the equation.

Unfortunately on airplanes, there is a left side and a right side. There isn't a center side to put a third sensor.

So do you have an answer for two sensors?

On the Ethiopian Airlines jet, the AOA vane feeding MCAS was reading accurately until just after take-off, when suddenly it veered off by 75 degrees, an impossible reading. This suggests the vane may have been sheared off by a bird strike.

The bird strike theory isn't news, it was first reported in April, and discussed a few weeks later after it reached the main stream media. And only leads to one question.

Why does the 737Max fight control system only use one AOA sensor?

You mean why did Boeing waste money and put a second sensor on the plane? Or is that second sensor used by other software and our prime source hasn't reported that?

(or is your question how do you choose which of two inputs to trust in real time and be assured you are picking correctly and that at least one is correct and can be trusted?)

I read the "... only use one AOA sensor?" as a damning rhetorical question.

No sane engineer risks an aircraft and all the lives riding that plane, and the lives of the collateral destruction on the ground, all to a singular unchecked sensor.

As already greatly discussed earlier in this thread - that single unnecessary critical singular fail point is just simply beyond all sane belief. People have died. TWICE over.

And yet Boeing have STILL not apologized? (Or admitted any responsibility?...)


All in our only one world,
Martin

---

See new freedom: Mageia Linux
Take a look for yourself: Linux Format
The Future is what We all make IT (GPLv3)

Unfortunately on airplanes, there is a left side and a right side. There isn't a center side to put a third sensor.

So do you have an answer for two sensors?

Two go on one side, spaced apart, the third goes on the other side, as is done on Airbus.


Simple.

At least that is simple when designed for from the outset...


All in our only one world,
Martin

---

See new freedom: Mageia Linux
Take a look for yourself: Linux Format
The Future is what We all make IT (GPLv3)

(or is your question how do you choose which of two inputs to trust in real time and be assured you are picking correctly and that at least one is correct and can be trusted?)

That's why I always went for three sensors even when it was only protecting the equipment. Overall when the total equipment cost is in the millions, three sensors and the simple electronics needed to detect the odd one out rarely comes into the equation.

Unfortunately on airplanes, there is a left side and a right side. There isn't a center side to put a third sensor.

So do you have an answer for two sensors?

Airbus uses 3 sensors

edit
If it was up to me, when considering the importance of human lives, even if it only the crew on cargo plane, I would put two on each side from different manufacturers, preferably using different methods of measurement.

(or is your question how do you choose which of two inputs to trust in real time and be assured you are picking correctly and that at least one is correct and can be trusted?)

That's why I always went for three sensors even when it was only protecting the equipment. Overall when the total equipment cost is in the millions, three sensors and the simple electronics needed to detect the odd one out rarely comes into the equation.

Unfortunately on airplanes, there is a left side and a right side. There isn't a center side to put a third sensor.

So do you have an answer for two sensors?

Airbus uses 3 sensors

So no answer for two.

Boeing swap between the two sensors, selecting which one to use depends on which pilot is "pilot flying", so for all practical purpose might just as well have one.

---

Bob Smith
Member of Seti PIPPS (Pluto is a Planet Protest Society)
Somewhere in the (un)known Universe?

Boeing swap between the two sensors, selecting which one to use depends on which pilot is "pilot flying", so for all practical purpose might just as well have one.

No, two independent systems. Pilot has the vote as to which system to use.
Just like there are two independent airspeed indicators, pilot has to decide which is correct.

BUT the pilot had NO indication what either probe was indicating, no way of swapping over from one probe to another, so could not male a valid decision as to what to do. You for get that the MCAS system, was declared "non-critical" and "non-safety" by Boeing, not "advertised" to the airlines properly, an indicator was an "optional, non-critical, non-safety" feature, it's impact on the aircraft was not properly discussed in the pilot training material, there was no proper isolation control or procedure (there was a sort of isolation control, but that was intended for a totally different set of failures.....).

I would hope that the revised software, and other associated modifications will provide the pilot with adequate indication of "invalid AoA status", will provide the pilot with an adequate isolation for an "invalid status" AoA probe, will include proper redundancy checks on both the AoA probes and the MCAS system as a whole, will include adequate training for the pilot, will include adequate training for ground service and maintenance crews, that Boeing will take this as s serious wake-up call, that the FAA will take this as a serious wake-up call, that legislators around the globe will take this as a wake-up call to ensure that their local civil aviation authorities will take this as a wake-up call.

---

Bob Smith
Member of Seti PIPPS (Pluto is a Planet Protest Society)
Somewhere in the (un)known Universe?

They didn't put the AoA sensor on the nose just for MCAS did they? What else does it do? Any of those functions critical? Is this issue far deeper than MCAS?

The primary use of the AoA sensors is during low-speed flight (takeoff and landing) - where they appear to be used as a redundant pair, and cross check with other sensors (yaw detection, airspeed, air density, air temperature etc). This is obviously a critical function.
Secondary use was for trimming to the "correct" AoA in normal flight - again the appear to be used as a redundant pair.
In neither case do they show individual outputs, just a "calculated mean" taking into account airspeed, yaw & pitch.
The flight crew have no way of knowing if a particular sensor has failed, but can see one of those systems is "problematic" - ground crew have access to the diagnostics ports that may lead them to a failed sensor - this has "always" been the case on the B737 family - so why haven't they fallen out of the sky due to failed AoA sensors?

As far as I can ascertain these two functions have been used on the B737 family without any significant changes since pre-B737NG days (I would guess that they got back to about the time of the first "stretch" from the base 100 seat fuselage), further withou, any implication in any accidents. (Lest we forget the B737 has a very good safety record, or at least it did until just under a year ago).

---

Bob Smith
Member of Seti PIPPS (Pluto is a Planet Protest Society)
Somewhere in the (un)known Universe?

The primary use of the AoA sensors is during low-speed flight (takeoff and landing) - where they appear to be used as a redundant pair, and cross check with other sensors (yaw detection, airspeed, air density, air temperature etc). This is obviously a critical function.

Am I correct is assuming that all critical things would appear on the Minimum (required) Equipment List? So when the first plane was allowed out of the gate with a failed AoA this was a violation?

Secondary use was for trimming to the "correct" AoA in normal flight - again the appear to be used as a redundant pair.
In neither case do they show individual outputs, just a "calculated mean" taking into account airspeed, yaw & pitch.
The flight crew have no way of knowing if a particular sensor has failed, but can see one of those systems is "problematic" - ground crew have access to the diagnostics ports that may lead them to a failed sensor - this has "always" been the case on the B737 family - so why haven't they fallen out of the sky due to failed AoA sensors?

Asking for speculation?

As far as I can ascertain these two functions have been used on the B737 family without any significant changes since pre-B737NG days (I would guess that they got back to about the time of the first "stretch" from the base 100 seat fuselage), further withou, any implication in any accidents. (Lest we forget the B737 has a very good safety record, or at least it did until just under a year ago).

Asking for speculation?

Speculation, not enough events to have data.

Yes, but unfortunately the AoA sensors need a stable airflow to test properly - they can pass bench test OK, but not the airflow test :-(
Which is why most other aircraft continuously monitor and report their status (including others from Boeing).

---

Bob Smith
Member of Seti PIPPS (Pluto is a Planet Protest Society)
Somewhere in the (un)known Universe?

Asking for speculation - the continuous monitoring and reporting of the AoA sensors used on other aircraft (including that on earlier B737) works "properly", but the insertion of MCAS into the chain on the B737MAX was done very poorly, and effectively blocked the correct reporting of faults to the pilot/ground-crew.

As you have said on a number of occasions "AoA sensors fail" - yes, and if the implementer of a system using them knows that and understand that they take steps to mitigate against such failures (redundancy, "sanity checking", checking against other systems etc), which Boeing did not do in the case of using a single AoA sensor to drive the MCAS system.


(sanity checking - e.g. Could that input really go from +5 to -100 in 1 second? Ooops, we have a problem with that input, let's check again/shot off that input/tell someone about it)

---

Bob Smith
Member of Seti PIPPS (Pluto is a Planet Protest Society)
Somewhere in the (un)known Universe?

Speculation
Blame game

Data
Failed sensor/s
Faulty software
Pilots fighting against controls
2 downed aircraft
346 dead

Ford Pinto. Fault found after they started rolling down the assembly line. No one with the balls to say stop, fix it.

Boeing MAX. Fault found very late in testing, hurry hurry make a fix -- assembly line is rolling. No one with the balls to say stop, fix it right.

If you actually want to know what is wrong, it is the power structure in a corporate environment. The people who know that STOP needs to be shouted don't have the authority to say so. The bosses who have the authority don't have the knowledge to understand that STOP is required. Buck passed even higher and they ask bean counters who make bad estimates but buy insurance to paper the shareholders rear ends.

It may start with sales people who are on commission and want a nice fat check so the moon is promised.

Fault found late in testing???

Fault designed in at the very early stages of the process - what really gets me is that Boeing already had an "MCAS" system flying very safely on their larger twins (757, 767, 777) but decided not to import it onto the 737MAX design.

---

Bob Smith
Member of Seti PIPPS (Pluto is a Planet Protest Society)
Somewhere in the (un)known Universe?

In other words, an inherent faith in profits & fiduciary duty.

In other words, an inherent faith in profits & fiduciary duty.

BINGO!

There's an awful lot of blind faith exhibited by the followers of the economic writings of Milton Friedman and his ilk.

This latest snippet, to my ignorant personal view, to me suggest that Boeing have learnt nothing from the ongoing 737 MAX deadly greedy stupidity:


New issues could keep Boeing 737 Max jets grounded into December: report

Boeing Max 737 jets could remain grounded into December because of friction between the manufacturer and international air safety authorities...

... the latest setback is tied to a briefing where regulators complained that Boeing failed to provide technical details and answer specific questions about modifications in the operation of Max flight control computers. Boeing now reportedly has to resubmit briefing documents describing proposed software changes.

The changes, which have to be vetted by the U.S. Federal Aviation Administration (FAA), could significantly reduce the likelihood that many of the planes would be back flying passengers during the Christmas holidays...



IATA chief 'worried' about global regulators' discrepancy over Boeing 737 MAX

... The head of global airlines lobby IATA warned on Tuesday (Sep 3) that a discrepancy among global regulators over reapproving Boeing Co's 737 MAX for commercial flight could set a worrying precedent for future aircraft programmes...

... Normally, the US Federal Aviation Administration has taken the lead on certifying Boeing aircraft and other aviation regulators globally follow suit, a process supported by the International Air Transport Association (IATA).

But global regulators have indicated they would pursue their own analysis of the 737 MAX and Boeing's proposed updates, rather than simply following the FAA, which has suffered a dent to its credibility following the two crashes...



Is this where the deadly greed of Boeing management grounds both themselves and the FAA into disrepute?...

Is this all just a deadly game of corruption??

All just a 'game' of dangerously deadly greed, where people have died, all at what cost?

To my mind, this continues to be despicably deadly damnable indeed.


All in our only one world,
Martin

---

See new freedom: Mageia Linux
Take a look for yourself: Linux Format
The Future is what We all make IT (GPLv3)