The A350 has 4 AoA sensors: I suspect it is a lesson learned from an A320 that had 2 AoA sensors froze in the same position, outvoting the only AoA sensor that was still working. In other words: failures are not always independent.

Wouldn’t they eventually all freeze at roughly the same position when the AoA doesn’t change for a while? Can’t they be heated?

They definitely are now. If you want to see what they look like, the channel AvE on YouTube tears one down (Search for BOLTR AoA) and discusses the mechanics. You can see what they suspect to be small cables for heating go up into the element.

The A350 has two types of AoA sensor - vanes and multifunction probes - which should reduce the chance of everything failing together.

They are heated now, after the Air France loss. This incident was also the reason for the MCAS system in the first hand: "Don't trust the pilot, regulate it into safety by your own".

Are you referring to AF447? According to the BEA incident report, the AF447 plane was already equipped with heating systems for the pitot probes and AoA sensors.

"1.6.9.1 Probe heating The probes that are installed on the aircraft are heated electrically to remove water by vaporisation when the aeroplane is on the ground and to protect them from icing in flight."

Reference: https://www.bea.aero/docspa/2009/f-cp090601.en/pdf/f-cp09060...

Right, I mixed that up. With AF447 the initial problem was not the AOA but the very common pitot tube icing, which renders the airspeed indicator useless, thus leading to wrong stall warnings.

Even if the pitot tube is heated (mandatory), very often airframe icing leads to a blocked static port, rendering even more indicators useless.

https://en.wikipedia.org/wiki/Pitot-static_system

I still don't see how a frozen AoA sensor cannot be detected by the reduction in noise or correlation with other sensors (such as gyroscope or accelerometer).

The trick is to detect conditions like this with virtually zero false positives. Say the sensor fails one in 100,000 times and your algorithm has a 1/100 change of flagging a false positive in the case where the sensor is in fact working properly. Then the chance of a real failure successfully detected is:

    0.00001 * 0.99 = 0.0000099

The chance of a false alarm is:

    0.99999 * 0.01 ~= 0.01

Thus:

    P(failure|alarm) =  P(alarm|failure)*P(failure)
                        ---------------------------
                                P(alarm)

                     =   0.99 * 0.00001
                        ----------------
                        0.0000099 + 0.01

                    ~= 0.001

 

So alerts from your seemingly ok-ish algorithm will be false alarms 99.9% of the time!

Maybe you could have a pair of vanes. Each vane is physically limited to a portion of possible angles. Vane A would only work above say -10 degrees AOA and vane B below +10 degrees AOA. This would give you a regular test of both sensors when the AoA changes in normal flight. You have more bounding of correct values.

Majority vote is a very simple system to reason about. What you’re describing adds a whole bunch more complexity.

For the noise sensor scenario, is the sensor failing or is the ancillary (and single point of failure) noise sensor failing? What happens when you have a false positive like that and a false negative on another sensor?

For the correlation scenario, when you have two systems that disagree, how do you determine which one is failing? Are their precisions and tolerances sufficiently close that you’ll get a warning at a useful point in time?

It probably could, but you'd have to code for that, rather than expecting the majority of 3 sensors to always be right.

It is not certain that the 737 AOA ectually needs to be safety critical. You could just ignore the AOA data completely and divert. The pilot should still have sufficient instruments and training to land safely.

The problem is without MCAS and the AoA sensors that power it the 737MAX8 handles differently enough that it would be categorized as a different aircraft and require recertification of pilots. This happened because the 737 frame is relatively low to the ground and to increase fuel efficiency the only real option is a larger engine so Boeing pushed the engines up and forward. This changes the relation between the Center of Thrust and the Center of Mass on the plane causing it to have a tendency to pitch further up towards a stall when climbing so Boeing added the MCAS to make the new plane behave like the old plane by automatically performing the pitch down maneuver for the pilot.

This system is critical to the Max 8 remaining classified to 'fly the same' as the 50+ year old 737 air frame design so it's critical to pilots being certified to fly the plane at all. Ergo it is a critical system and needs more redundancy or the Max 8 needs to just have a new type certificate and pilots certified to fly it as well.

Boeing REALLY REALLY doesn't want to do this because it would require airlines to retrain their pilots to use it in their fleets making them less attractive to airlines. The whole fiasco is a confluence of 1) Cost of retraining pilots on a new air frame 2) need from airlines for a more efficient plane 3) the old 737 design not having any more room below the wing for a bigger engine (which is pretty much the main way we get more efficiency these days).