[SystemSafety] MCAS "a small wind gauge"

[Peter Bernard Ladkin]

On 2022-02-23 08:00 , Peter Bernard Ladkin wrote:
> is how it is described in a review of the documentary "Downfall"
> 
> https://www.theguardian.com/film/2022/feb/22/downfall-the-case-against-boeing-netflix-documentary-737-max 
> 
> 
> It doesn't give you much faith that the reviewer has been paying much attention.
For those who might have forgotten the details, MCAS is a piece of software that commands movement 
of the trimmable horizontal stabilizer (THS) outside of pilot control. There is a HW+SW system 
called the Stabilizer Trim System (STS) which moves the THS. Boeing nominally defined the MCAS as 
"part of" the STS; there has been some question whether this was appropriate engineering-wise.

MCAS took as aerodynamic input the measured value of relative wind from the angle-of-attack sensor 
(AoA), which measures the relative attitude of a small vane which sits in the airstream outside and 
adjacent to the fore fuselage. There are two AOAs; originally MCAS took the value from just one.

In the Lion Air accident, the vane from which MCAS took its readings was consistently some 21° above 
the reading from the second AoA. In the Ethiopian accident, the vane from which MCAS took its 
readings was consistently high (maxed out); the recovered AoA had no vane and damage consistent with 
the vane having sheared off; the AoA goes to max when a vane shears.

The vane input was evidently a single point of failure. Inquiries into how reliable AOAs are sourced 
an AAIB report which said they fail about every 90,000 hours, which cognoscenti will point out is 
rather less than "not to be expected during the total life of the fleet" required for 
single-failure-leading-to-catastrophe. Most of the failures of AOA, though, are when they stick, not 
when they go high. When they stick, they are generally reading within-flight-envelope values, which 
neither the Lion Air nor the Ethiopian cases were doing. I don't know that there are any reliability 
figures for "go high" cases of AOA malfunction.

There is an obvious argument that there should have been, and that they should have been provided by 
Boeing as part of the airworthiness certification. In fact, the HazAn provided by Boeing (now 
published in the Congressional Record) was, shall we say, inadequate to address the observations above.

PBL

Prof. i.R. Dr. Peter Bernard Ladkin, Bielefeld, Germany
Tel+msg +49 (0)521 880 7319  www.rvs-bi.de




-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.techfak.uni-bielefeld.de/pipermail/systemsafety/attachments/20220223/487e312f/attachment.sig>