A question I've been meaning to ask. I've always heard flight critical systems have to be at least doubly or triply redundant. Why was there only 1 pitot tube? It's clearly flight critical.
1: https://aviation.stackexchange.com/questions/50797/why-does-...
EDIT: Source: https://aviation.stackexchange.com/questions/61011/how-many-...
Autopilot? Not necessary, pilots can fly themselves. Still, it is added for convenience (and its consequences, less mental burden, more mental capacity to do other stuff).
Roughly speaking, stick force is the amount of force the pilot has to to apply to the stick to achieve a given movement of the control surfaces.
As the airplane gets closer to a stall, you want to make it harder for the pilot to pull it fully into the stall, by increasing the required stick force.
If the stick force decreased as the airplane approached a stall, then the pilot would have to actively push the stick back into more stable flight.
The triple redundancy only comes into play with systems with a severity of failure rated as catastrophic.
The MCAS system as originally designed was rated as merely hazardous. Which doesn't require redundancy. The decision to feed off of only one vane was intentional to avoid having to have pilots undergo level D simulator training as part of their type certification. Multi-sensor systems generally require Level D training.
See the 737 MAX Expose by 60 minutes, where the whistleblower testimony is first presented.
Somewhere inside Boeing there are decision-makers that lack ethics (or even long-term financial thinking). They need to be fired.
Specifically, because airlines wanted to save money on pilot training.
https://leehamnews.com/2019/03/20/boeing-didnt-want-to-re-en...
https://www.mymoneyblog.com/boeing-engineer-dream-job-nightm...
There's a Bloomberg article I've been trying to track down from back in the 2000's where a Boeing exec is quoted as saying that Boeing is going to undergo a financial transformation, part of which involved decreased "over thinking the box" and stripping all that wasteful effort (what engineers call the hard parts) from the process in order to bring Boeing into the mainstream as an optimized shareholder value generating machine.
This happened apparently shortly after the McDonnell Douglas merger as I understand it.
The more complex you make the plumbing, as it were, the easier it is to clog it all up.
Plus, there have been instances where a majority Ocala sensors have frozen in the same position, and outvoted the last remaining functional one. At the end of the day, software can only be considered an automation aid.
The human pilot must be able to make a reasonably safe go of flying the plane alone. Even Airbus planes have this quality in direct law. They are still stable, there are just fewer safeguards to keep you from doing something daft.
And even with airbus' approach, there's a case to be made that overreliance on the computer to safely operate the plane degrades basic piloting skills through atrophy or complacency.
What hasn't been mentioned: the fact that MCAS repeatedly engages, over many minutes, whilst both pilots were repeatedly fighting the system, and the elevation-over-ground track was highly anomalous.
A major problem with automated systems is that few of them have any awareness that they are ever doing the wrong thing, operationg far outside the bounds of their own design, and will, in this case, fly a plane into the ground. If multiple pilot actions and flight track indicate disagreement, automation should probably disengage.
There are other problems with pilots, of course. AF447 was a failure of pilots, but one exacerbated by automated and fly-by-wire controls not revealing conflicting inputs by Bonin and Dubois. Germanwings 9525, and by appearances MA370 are among cases where a single pilot acting alone sabotaged or crashed a commercial passenger flight. See: https://www.huffpost.com/entry/pilots-crashing-on-purpose_n_... and https://en.wikipedia.org/wiki/Suicide_by_pilot
But outside notable hijacking incidents of 18 years ago, concerted efforts by multiple pilots are unheard of.
There are two AoA on the 737 Max, MCAS only used a single one (but switched every time you started the aircraft). Reporting in Seattle Times suggests that it was originally designed to use one AoA combined with a G-Sensor[0]. The two in combination would trigger MCAS to make a small adjustment.
The problem is that the aircraft's actual design was failing to be "common type" compatible (i.e. no re-training). So they kept on expanding MCAS's usage to compensate. For low speed the G-Sensor didn't work, so was removed, and flight authority was increased.
More from the article:
> This original version of MCAS, according to two people familiar with the details, was activated only if two distinct sensors indicated such an extreme maneuver: a high angle of attack and a high G-force. [...] About a third of the way through flight testing in 2016, as first reported by The Seattle Times in March, Boeing made substantial changes to MCAS.
> The flight-test pilots had found another problem: The same lack of smooth stick forces was also occurring in certain low-speed flight conditions. To cover that issue too, engineers decided to expand the scope and power of MCAS.
> Because at low speed a control surface must be deflected more to have the same effect, engineers increased the power of the system at low speed from 0.6 degrees of stabilizer nose-down deflection to 2.5 degrees each time it was activated.
> On the stabilizer, maximum nose down is about 4.7 degrees away from level flight. So with the new increased authority to move the stabilizer, just a couple of iterations of the system could push it to that maximum.
> Because there are no excessive G-forces at low speed, the engineers removed the G-force factor as a trigger. But that meant MCAS was now activated by a single angle-of-attack sensor.
> One of the people familiar with MCAS’s evolution said the system designers didn’t see any need to add an additional sensor or redundancy because the hazard assessment had determined that an MCAS failure in normal flight would only qualify in the “major” category for which the single sensor is the norm.
[0] https://www.seattletimes.com/seattle-news/times-watchdog/the...