Disclosure: I am not an engineer...my experience is pilot based, mostly in the F-4. I also have 19 years experience in Aerospace, mostly in program management. I do have experience with glass cockpit aircraft.
I have absolutely no knowledge of Boeing's designs or data. The information to be presented is generic and is only for discussion purposes.
A computerized aircraft would have a "central" computer system with dual or triple redundancy. In the military, this computer is called the mission computer. I am not going to discuss how redundancy is achieved as there are several ways this can be done, all acceptable. The central computer gets data from on-board and off-board sensors through a data bus architecture...the data bus also contains redundancy.
The on-board sensors can be analog or digital. If they are analog, then there is some type of adapter tied to the sensor that converts the analog signal to digital and puts the data on the data bus. The central computer then analyzes all of the data and displays some of the data on the pilot's displays. It also sends data to other on-board computers, such as the FADECs (which control the engines) and the auto-flight system. Note: auto-flight could be stand alone or integrated into the central computer.
When analyzing the sensor data, the central computer is comparing inputs from like sensors (data from the pilot's AOA sensor is compared to the data from the co-pilot's AOA sensor). If the data agrees, then there is no problem. Problems arise when the data disagrees. If there is a disagreement, the central computer can calculate what the AOA should be, based on airspeed, g-loading, bank angle, pitch angle. Based on that calculation, the central computer can determine which AOA sensor is malfunctioning.
So...based on what logi_cal869 and I have read, the MCAS only uses one AOA sensor and does not interface directly with the central computer. In fact, the MCAS has authority over the central computer and can command the pitch trim system to lower the nose (reduce AOA), even if the central computer knows that the aircraft is nowhere near stall.
To me, this design in unbelievable.
I plan to add some more comments later...feel free to comment and ask questions.
It is madness.
We have a system that will literally fly the aircraft into the ground.
This page is not being archived for whatever reason, so capture it if the need suits you.
It elaborates upon the general discussion with much detail, including Boeing looking at using input from both AOA sensors for MCAS. After reading this page, I’m satisfied that they grounded the model until the problem is worked out and that they are investigating its certification.
The prior paper I’d read was either unclear or I misunderstood the reason for the 2 AOA sensors: Clearly there is one for each station and MCAS gets data from one of these.
Here is the passage that concerns me most:
“In the event of erroneous AOA data, the pitch trim system can trim the stabilizer nose down in increments lasting up to 10 seconds.”
“Erroneous data” is not elaborated upon as yet. That’s a RED FLAG. Proper training is obviously a critical safety tool to ensure there is no flight departure at low altitudes during takeoff. Somebody effed up bigtime if the pilots of the crashed planes were never instructed. There is no time to read a damned manual at takeoff altitude for an aircraft that’s pitching down against pilot inputs. Furthermore, under “Runaway Stabilizer” it is stated that “the 737-8*-9 uses a Flight Control Computer command of pitch trim to improve longitudinal handling characteristics. In the event of erroneous Angle of Attack (AOA) input...” and you get responses from the aircraft outlined by AIRWORTHINESS DIRECTIVE 2018-23-51 https://ad.easa.europa.eu/blob/2018-23-51_FR_Correction.pdf/AD_US-2018-23-51_1:
> Continuous or intermittent stick shaker on the affected side only.
> Minimum speed bar (red and black) on the affected side only.
> Increasing nose down control forces.
> IAS DISAGREE alert.
> ALT DISAGREE alert.
> AOA DISAGREE alert (if the option is installed)
> FEEL DIFF PRESS light.
> Autopilot may disengage.
> Inability to engage autopilot.
Something is clearly wrong here...
http://www.b737.org.uk/mcas.htm