Hacker News Reader

Comment by frostburg | Hacker News Reader

Not having three AoA sensors seems either insane or criminally negligent.

Yep, there’s going to be a lot of hand wringing, finger pointing and hot air expended over the next few years and this is basically it. Boeing had two options:

(1) 3 sensors plus majority voter.

(2) A mandatory AoA disagree indication plus some training on how to react to it.

They chose option (3): Neither. Frankly when I heard there were just two sensors and no disagree indication, my first thought was well that’s just as good as one sensor and hoping for the best, isn’t it? The “challenger moment” would have been after the meeting they decided on this.

That's what really amazes me. Especially since AoA vanes are known to be troublesome.[1] In most aircraft they just trigger the stall warning horn and stick shaker; they don't directly affect aircraft control.

[1] https://mooneyspace.com/topic/19801-stall-warningaoa-failure...

I think Airbus will disable the autopilot in case of AoA sensor failure, which is why it has three of them instead of two.

It's more literally "just one sensor" than you say, I think. MCAS doesn't average or anything: it just picks one sensor at a time arbitrarily and uses it. (This will change in next month's software fix.)

(2) sounds like it could be airworthy, but I think Boeing might instead find that it has to add that third sensor. Airbus has three, and any rationale that Boeing only needs two because the disagreement consequences are not severe seems atop quicksand at this point.

Option (4): input from other sensors (altitude, climb rate, gyroscope/artificial horizon, pilot actions etc) for a sense check...?

My gut tells me aerospace errs on the side of simplicity and reproducibility. It could work, though ideally system errors wouldn’t interfere with other systems.

And the engine stats should be a good source of data.

It is worth pointing out that an AOA sensor should not be critical for normal flight. If a sensor is faulty then why not simply stop using angle of attack as a data point. It should still be perfectly possible to fly safely and using a configuration that will avoid a stall. Pilots should be able to fly on a minimum set of instruments.

As a pilot myself, that doesn't strike me as disqualifying. The minor problem I have is that it has has no self-verification/disqualification mechanism; even in the face of having two sensors available! The far bigger problem I have is, the automation discounts pilot input as if it's the pilots who are wrong. That's obscene. And it strikes me as a violation of CRM.

I do not accept that pilots must have disabled auto trim in order to prove they are the more valid input source, compared to a single alpha vane sensor. That's perverse. Pilots have to flip switches to prove they are working correctly? Yet the sensors don't have to have self-verification/disqualification, or cross check with an available second sensor?

They could have also used inputs from other systems as a sanity check such as altitude, air speed, pilot input, etc. I'm really surprised the software didn't take any other available data into consideration.

The horizon indicator alone should serve as a check. If you (the computer) think the plane is about to stall, it makes sense to nose it down to compensate. Ok, cool. But if you think it's stalling, and you see that you're at a negative attitude, then it's much more likely that trimming the horizontal stab is a bad idea.

I'm sure there are other checks as well. Also not sure if I'm missing something with this armchair analysis.

I'm with you on that. It also seems completely against the Boeing ethos of when the auto pilot is off you should be hand flying the plane and your control inputs dictate the movement of the flight surfaces. That has been a perceived difference in philosophy between Boeing and Airbus. MCAS sounds like a hastly thrown together work around and a disaster waiting to happen.

Has it been established that the AoA sensor malfunctioned?

I believe the Lion Air investigators have made public that there was a 20 degree differential between the two AoA sensors even when they were sitting on the runway before flight. (I don't have a source easily accessible.)

That's almost like saying two compasses should agree while standing on the north pole. These sensors need airflow to operate and provide meaningful indication.

It was during taxi for takeoff: https://theaircurrent.com/aviation-safety/the-world-pulls-th...

Is that necessarily true? Based on this article (https://www.flyingmag.com/how-it-works-angle-attack-indicato...) it seems like they should be accurate regardless.

Sure, but they maintained their twenty degree difference for the duration of the flight. That's why the one stick shaker started going off shortly after rotation, why autopilot wouldn't engage, and why MCAS was going nuts.

Why should an AoA sensor require airflow? And if we are talking about airflow, we are talking about measuring pressur differentialsm right? How to do calculate an angle using a pressure differential?

It’s literally just a metal plate that rotates with the oncoming air.

Ok, makes sense.

Not if the engineers were assured the pilots would be trained to quickly recognize trim issues and flip off the MCAS when it started misbehaving.

No, it's still obvious fail-deadly insanity. Having to say that the pilots would need to quickly notice issue is even worse (have you seen how you disable the system? It's not a button that you push).

The point of the plane variant was to not perform any additional training, too.

Anyone saying that to the engineers should be considered a criminal. There is probably a whole incentive structure that lead to this and that should be upended completely.

"Oh darn! The pesky flight control system decided to go into crash the plane mode again. Let me reset it before I take another sip of my latte".

Reply on news.ycombinator.com