Fair enough. I guess I’m just wondering if at some point the inputs from the various systems coming all at the same time produce a situation where it’s beyond the normal capacity of the pilot to process and respond -especially if they are following procedures set out by the manufacturer.
Thanks for all the responses to my very non-aviator questions. You are a mensch and I heartily commend you for all the info you cheerfully (it would seem :)) provide on all matters of Surly Earth-Bond Slippage.
OK, I can understand Boeing deciding only one sensor instead of two would “inform” MCAS if it’s simply a craven, selfish decision that allows Boeing shareholders to buy an extra racehorse or two. It seems a bad decision but greed explains a lot of bad decisions.
You already hinted at an answer but I’d like to ask (everyone) directly: would incorporating both AoA vanes instead of just one with MCAS have been a negligible expense, perhaps simply re-writing a few lines of software code? Or would there be significant costs involved?
Yes, it would be a very confusing situation. My earliest memories of learning to fly was how disorienting it got when the plane didn’t respond the way I thought it should. If you want to experience how it feels take your car out to an empty parking lot and switch feet. then imagine what it would be like if you were on a busy street. Keep in mind this is a very dangerous thing to do in a car and should be done away from all people or things you can hit.
Understand when I say there was pilot error involved it does not represent 100% of the fault of the crash but that it was a contributing factor. They really didn’t have much time to figure it out.
The AoA issue shouldn’t have existed in the first place. I would expect Boeing to have tested a failure of one or both of them and made changes in the system. I don’t know why they didn’t use a stick pusher. It seem more logical and doesn’t create a condition that would overpower the input of the elevator.
Somebody earlier explained that using both vanes would require pilot training re: MCAS concerning what to do if the two AoA vanes disagree. I did not know about that and I missed reading that before I posted. So I guess there would have been an expense if they had done that. It seems rather unforgivable at this point but there could be more to the story.
Thanks for the comments, Richard Pearse and Magyver. Doing my best to follow your skilled discussion.
I was going to say this exactly. Although I like to think I’d be more careful with spelling 
It’s fantastic to have experts here.
A stick pusher has a different purpose to MCAS. A stick pusher’s task is to abruptly initiate a push to avoid stalling. You aren’t supposed to pull against a stick pusher.
My understanding of MCAS is that it is designed to give the pilot more to pull against. You are supposed to pull against MCAS. Once you have stopped manoeuvring with high AoA the MCAS removes its trim input.
Additionally, a stick pusher would have required sim training.
You’re welcome. It is unfortunate that LSLGuy has stopped posting. He is currently flying the B737 (not the MAX) and would have more specific info than the rest of us do.
I miss him. If you have a chance tell him hello.
Given that we have y know part of the story, and Monday morning quarterbacking is so easy, it just seems unbelievable.
Ditto. I miss LSL Guy - give him my best wishes, if you’re in contact with him.
As a student, I worked for a while as a tech for a control system company. We put in a bid for a particular project and tried to cover up a serious hardware flaw with a software fix. Thankfully we didn’t get the bid but I was getting nightmares over the bad design.
Th
Didn’t have a chance to edit.
That paper brought back those bad memories.
If the author is correct, this is absolutely unforgivable.
wow, you must be much more strongly “handed” than I am. Or you drive a standard? I have automatic transmission, and use one foot. And I’ve sometimes switched feet when I am driving just because my primary foot was sore or tired, and it didn’t feel dangerous at all. It’s just a little awkward where to put my limbs.
On the other hand, I am trying to learn to play Nintendo Switch, with a controller with more buttons than I have fingers, and let’s just say I’m going VERY SLOWLY because I’m finding it confusing as hell, especially when I need to react quickly. That’s what I was envisioning the pilot has to do – react to way too much data using an unusual combination of unpracticed moves.
Yikes!!
I am SOOOO happy that nothing that I do at work has any real potential to kill anyone. (I mean, I suppose I could leave a coffee cup on the floor, and trip someone who fell exactly wrong. But there’s nothing I’m supposed to be doing that could lead to bodily harm.)
Sully has weighed in on it. Besides the beating that Boeing had coming to it he brought up the FO’s hours. I don’t think it’s been confirmed yet but if the airline put a 200 hr pilot in the right seat that would be disappointing. I hope it’s not true.
200 hr pilots have been going into the right seat of airliners for donkey’s years, particularly in Europe where they don’t have much of a general aviation industry to get experience in.
Given that a system using low hour pilots has been proven to work, I’d be more concerned about the FO’s training regime rather than his actual experience, and only if that is found to be a factor. It was the FO who suggested using the cutout switches in the first place so he was doing ok out there.
Most of the 737-max planes are US owned. None of them crashed. The FO’s suggestion to use the cutout switches when the plane was trimmed nose down is the likely cause of the crash. He deactivated the only thing capable of resolving the problem in the time they had available.
200 hrs barely covers the certifying process from private single engine to Airline Transport Pilot. Donkey years not withstanding I’d rather avoid the next Colgan Air flight to the center of the Earth. Which for those who don’t know, is the reason the US raised minimum hrs to 1500.
I’m going to side with Sully on this. 200 hrs doesn’t cover much in the way of real world flying.
I didn’t want this post to fall through the cracks; it’s a fine point. It reminds me of Segal’s law (not actually a law), which says that a person with a watch knows what time it is, but a person with two watches is never sure. Ships that rely on chronometers typically carry three of them for just this reason.
In the design of fault-tolerant systems, this sort of arrangement is called “triple-modular redundancy,” and although voting is often implemented along with sensor triplets, it technically doesn’t have to be.
A voting system with two sensors would only make sense if you could somehow know with reasonable certainty which sensor was malfunctioning. Since you can’t, a voting system isn’t helpful.
However, if your two sensors’ disagreements are large enough, you can assume that at least one is malfunctioning and disable a system like MCAS. I agree that three sensors and a voting system would be better. But based on what we know now, the central issue was not the number of sensors but the default behavior when the two sensors disagreed.
Such disagreement should disable the MCAS system, but IIUC, that behavior would require more training for transitioning 737 pilots than Boeing was willing to tolerate. If that’s actually how this flaw made it to production, things look very ugly for Boeing.
Are you sure about that? Of 376 MAX deliveries so far, 261 are owned / operated by non US airlines or leasing companies. List of Boeing 737 MAX orders and deliveries - Wikipedia
If you read the report you will see that prior to using the cutout, the captain was not applying sufficient up trim to remove the MCAS inputs. By using the cutout the MCAS was deactivated and their time alive extended. Should they have fully trimmed out the MCAS first? Yes, but he didn’t, repeatedly, which means the best thing for the FO to do was use the cutout and try and trim manually.
The 1500 hours requirement in response to Colgan was stupid. The captain had over 3000 hours and the FO over 2000.
Hours are a really poor way of judging someone’s suitability to be on the flight deck. I’ve flown with an FO who had a little over 200 hours who was excellent and I’ve flown with FOs with thousands of hours including single pilot multi IFR time who were terrible, like really terrible, as in you wonder how they manage to pass checks at all. In fact the really high time FOS can be the worst as they are more likely to be pilots who have tried and failed to upgrade.
Having 200 hours in itself is fine. What matters is the quality of training. Airlines with great safety records all over the world put low time pilots in the right seat.
A few comments. Triple redundancy with voting is pertinent to entire computer subsystems, not individual sensors, and is used for core functions in mission-critical systems that require the highest possible level of reliability. It applies when computers making decisions in parallel don’t agree on the required actions for any reason, regardless of why. It seems like gross overkill in this case, where simple disagreement between two sensors can generate a simple alert and disable any automatic flight control functions that rely on it, without any significant consequences provided the pilots understand what is going on. But this, of course, requires training.
The problem that Boeing (and the FAA) now faces is that your last sentence is correct. The “disagree” alert was made an optional extra, and AIUI neither the Lion Air nor the Ethiopian planes had it. The use of a single AoA sensor by MCAS and the lack of any MCAS documentation appears indeed to be an issue of saving on retraining costs, savings estimated to have been between several hundred thousand dollars to well over a million dollars per plane based on the fatal assumption that “pilots don’t need to know about any of this”. Things look very ugly for Boeing indeed, particularly for a company whose major traditional selling point was a reputation for quality.
FWIW, it’s clear in retrospect that, regardless of hours, the captain of the Colgan flight was incompetent – he had failed some flight tests and did absolutely the wrong thing when the Q400 began to stall. All I know about the FO is that she was very young and was exhausted at the time due to the air commuting she was doing – IIRC she had slept at the airport before the fatal flight. So there was lots of incompetence on the flight deck regardless of flying hours logged.