Re:Airplanes and Accounting Games: The Coming Boeing Collapse?
by toast0 on Thursday December 19, 2019 @06:14PM
(#21840269)
> Why didn't the sensor fall back to its backups?
MCAS was added to the autopilot/flight computer system, which was brought forward from previous 737 designs, where there are two flight computers, each with an independent set of sensors; in case of disagreement, between the flight computers, autopilot would disengage and return control to the pilot. And in general, the types of things a pilot would do in response to commanded nose down would disable the autopilot until manually engaged again.
Unfortunately, MCAS acts autonomously, was not disclosed to pilots, and was not able to be disabled without also disabling electric trim control. Because it was built on top of the existing flight computer, which is safe enough, the behavior doesn't appear to have been separately considered.
From what I've read of the proposed fixes in news stories, it doesn't really address the root issue in my mind that the pilots should be able to turn off MCAS; although it does seem likely that it would activate erroneously less often, and that the plane will remain more controllable in the event that it does activate erroneously, it still seems like the situation would be dangerous in case it arises; which would seem possible if both Angle of Attack sensors failed in the same way at the same time. A third AoA sensor might help detect broken sensors, and make it less likely that all three would return the same wrong value simultaneously, but a switch to turn off MCAS would follow the Boeing philosophy of giving pilots control and letting them handle rare events.
MCAS was added to the autopilot/flight computer system, which was brought forward from previous 737 designs, where there are two flight computers, each with an independent set of sensors; in case of disagreement, between the flight computers, autopilot would disengage and return control to the pilot. And in general, the types of things a pilot would do in response to commanded nose down would disable the autopilot until manually engaged again.
Unfortunately, MCAS acts autonomously, was not disclosed to pilots, and was not able to be disabled without also disabling electric trim control. Because it was built on top of the existing flight computer, which is safe enough, the behavior doesn't appear to have been separately considered.
From what I've read of the proposed fixes in news stories, it doesn't really address the root issue in my mind that the pilots should be able to turn off MCAS; although it does seem likely that it would activate erroneously less often, and that the plane will remain more controllable in the event that it does activate erroneously, it still seems like the situation would be dangerous in case it arises; which would seem possible if both Angle of Attack sensors failed in the same way at the same time. A third AoA sensor might help detect broken sensors, and make it less likely that all three would return the same wrong value simultaneously, but a switch to turn off MCAS would follow the Boeing philosophy of giving pilots control and letting them handle rare events.