Swiss cheese. You hear that a lot in systems design and engineering.
It is often not possible to fail safe a system with 100% certainty.
Especially true when there is an unforeseen and/or unintended consequence and a fix is proposed to a problem.
Root cause may not be known with certainty, however, a fix could be put in place as a short term remedy to alleviate the cascade catastrophic failure.
If you stack up a few of them, then the likelihood of a through and through hole is quite low.
In fact, the entire aircraft systems design is based on this principle. With several redundancies and backup and backups for backups.
Engines being the most obvious example. There is computers, sensors etc that also have redundancies. Which is why the 737 Max and other Aircrafts cost $100Million.
So why then was this Autonmous MCAS System basing it’s entire activation on a single sensor input?
The proposed fix:
1) If the disagreement is less than 5.5 degrees which sensor is selected?
2) is the sensor failure being addressed? How often is the disagreement over that threshold? Why was it 20 degrees for Lion Air?
3) does taking altitude into consideration help?
— Shaker Cherukuri (@ProcessISInc) March 27, 2019
It appears that Ethiopian Air AOA sensor offset was also 20 degrees!!
What does that imply? MCAS won’t activate with 20 degree offset with the above fix.
However, it doesn’t fix the root of the issue. What is causing this offset?
Suggests systemic sensor and/or control system issue. No fix
The proposed fix simply won’t activate since variance is over 5 degrees.
— Shaker Cherukuri (@ProcessISInc) March 29, 2019
Could there be a deeper issue here which could be impacting other systems as well?
Could this be more than the unintended consequences of the MCAS algorithm discussed here:
To be continued…thoughts in progress.