OT:The Boeing 737 Max and its *optional safety features*

[newshound]

Not a third crash, the first one might just have crashed earlier.

[newshound]

Well said. Good job they don't design nuclear power stations. Don't they do *any* design verification?

Some sources suggest there are two sensors but it's tripped by one failure.

[michael adams]

But car manufacturers would certainly be liable if it could be shown that crashes were a direct result from their having fitted an ABS which malfunctioned in some way.

Which is the direct analogy here,

The MCAS which was designed to prevent stalling in nose-up situations malfunctioned as a result of getting conflicting sensor readings.

However there was already an option to instal alert systems designed to warn pilots when sensors produce contradictory readings, as would have happened in the case of the MCAS.

However the question remains - assuming that instruments showing conflicting sensor readings are clearly indicative of a problem somewhere, why are alert systems designed to highlight such situations only an "optional extra" ? Why aren't they fitted as standard ?

michael adams

...

[F]

You can get a reasonably accurate indication of which aircraft will operate the flight from seatguru.com though, as you observe, there can be changes nearer departure.

[Jac Brown]

The software in planes isnt done like that.

[Jethro_uk]

Two crashed 737s says it is ......

[The Natural Philosopher]

It was more that the new engines were angled up because they are larger, and needed to miss the ground. That means there is a temdency to power on nose up trim

[The Natural Philosopher]

two sensors, only one is used by this software. BAD mistake

[Paul]

The issue is the engine cowlings create lift & more when tilted up so when the pilot pulls up a bit the extra lift causes the plane to keep nosing up. MCAS was designed to neutralise that by trimming down but it can do so more than it should and pilots were not told about it.

Details on pprune and other places.

Paul.

[Jac Brown]

That change was deliberate, the initial down trim was found to be inadequate to handle some actual stall situations.

[Jac Brown]

No they don?t. The problem is that MCAS uses just one of the two sensors on the plane, not because a software update broke the system.

[tabbypurr]

Hmm, how does that work? No light comes on because there's nothing wrong... how is that a MOT fail? I had one car pass the mot years ago with its brake warning light on all the time. The brakes passed the tests. And of course older vehicles never had brake warning lights or dual circuits, no MOT problem there either.

NT

[tabbypurr]

ABS can't triger when neither ABS nor tyre pressure monitoring are fitted. The point is safety features are always optional until the law decides they've become mandatory - which of course can occasionally happen after you've shipped the product. The Pinto was a good example of this. Their early assessment was based on the working of the law as they understood it, and any lawyer at that time would have agreed with their assessment (I don't mean necessarily their decision, just the assessment). Later that changed. It's very easy to criticise the Pinto tank decision, but let's be real here, cost & safety sacrificing decisions are made routinely in car design. Those involved understand the results, and the companies involved seldom get pintoed.

Well... one should try & make it that way, but IRL that doesn't really happen more than partially. There are still catastrophic single point failures possible on new cars. If you doubt that, what do you think will happen if the steering column fractures or a suspension strut mounting rusts through & gives way at 70mph? Or a tyre goes pop at 70. They happen.

A major oops not because it was a single point failure, but because it was an unnecessary single point failure.

NT

[tabbypurr]

I can't comment on whether that's a good assessment. But I can tell you one thing: ABS systems that cause dangerous brake failures are common. These systems detect one wheel losing grip & back off the brakes on all 4 wheels. Result: instant brake failure.

NT

[dennis]

Because the light has to come on as part of the check process done when starting the car, if it doesn't its an MOT fail.

things change.

[Jethro_uk]

It might have a built in limited number of times it can be used. Once we've established the design is obviously flawed, it's not really possible to rule out any possibility - even the moronic ones.

Given the quality displayed so far, I'd happily believe that the override could only be used 8 times before a buffer overrun caused it to freeze.

[Andy Burns]

If you realise you need to override the MCAS you can physically wind the trim wheels in the cockpit, or grab them to stop the MCAS moving the tail stabilizer.

[Jac Brown]

It didn?t originally but will have now with the modifications.

It clearly is given that it used just one of the two sensors and doesn?t even bother to check if that sensor is working properly while the plane is still on the ground.

Yes it is when it happened to two brand new planes.

There is no buffer to overrun. The electric trim is entirely electric, the 737 isnt fly by wire so it can't freeze.

[DJC]

Even with two sensors, if there is a disagreement which do you trust? You need three, with only two, one failure disables the system.

[Martin Brown]

Three with voting would be nice but the option of switching to the other one if the control system is obviously misbehaving would be a start.

The thing that is mystifying is that there appear to have been no sanity checks on this "anti-stall" system. It was so dedicated to preventing aerodynamic stalls that it would happily fly the plane into the ground.