Indeed, given the MCAS system’s ability to control the aircraft’s pitch and engine thrust, and to fight the pilot’s attempts to override it. (I should have been specific that it was a single angle-of-attack sensor.)

That’s what I would have told someone before the 737 MAX 8 crash(es): that flight computers never rely on a sole sensor either, they cross-check flight data just like humans do, and they will never take action based on data that the cross-checking indicates may be unreliable.

The 737 MAX 8 apparently broke all those rules.

I’m not a pilot either, but I have a strong interest in aviation, specifically aviation safety. I do have programming experience, so I can understand the software logic behind flight computers.

I have an idea of how the Airbus A330 flight computers work from my research into the Air France 447 crash. If you’re interested in this stuff, I recommend checking out the book “Understanding Air France 447” by Bill Palmer. He’s an Airbus pilot, and his book helped me understand and appreciate the Airbus design philosophy. (Many popular narratives about AF447 are really misinformed, as well as IMO disrespectful to the pilots who are no longer alive to defend themselves.)

The A330 has at least three copies of all the sensors that I’m aware of. For instance, it has three pitot probes, three static ports, etc. I assume it also has three angle of attack vanes, because it has three different “bundles” of flight data overall.

An analogy: You ask three different people to go measure the temperature, humidity, and wind speed outside your house. You tell them to work independently of each other, and you give them each their own set of instruments to use.

Each of their weather reports is like one of the “bundles” of flight data. These are called “air data inertial reference units” or ADRIUs. The relevant part here is just the “air data reference unit” or ADR.

Imagine that all three people bring back the same weather data. Maybe their measurements differ from each other by a few decimal points, but that’s all. The data is also believable: they’re not claiming that it’s 100 C/212 F outside. You could safely assume that their measurements are correct. That’s what the A330 does when all the ADRs agree.

Now imagine that two people bring you weather reports that agree with each other, and the third person brings you one that’s different from the other two. You could safely assume that the third person’s data was incorrect. That’s what the A330 does when one ADR differs. There are rare situations where you can have two sensors being wrong in the exact same way, but it’s *far* more likely that the “odd one out” is the wrong one. (Pilots can still disable the erroneous ADRs in those rare situations.)

Now imagine that all three people bring you significantly different weather reports. You truly have no idea what the weather is like outside. You trust all three people equally (it’s not like you know that one of them is meticulous and the other two are careless). So you *still* have no idea what the weather is like. You would be right to reject all three reports. This is what the A330 does when all three ADRIUs disagree. (This can happen when they all start disagreeing at once, or when it’s already started ignoring the “odd one out” and the two remaining ADRIUs no longer agree.)

Finally, imagine that all three people bring you the same data, but the data is implausible. They’re saying that it’s 100 C/212 F outside. It doesn’t matter if all three of them agree, because all three of them are obviously wrong. You would be right to reject all three of their reports. This is what the A330 does as well. If the airspeed drops in a way that’s incompatible with the laws of physics, it will reject that data.

Whenever the A330 doesn’t have at least two ADRIUs agreeing and being “plausible” about a parameter (e.g. angle of attack), it will stop taking action based on that parameter. That means it will not provide flight envelope protections (e.g. stall protection, overspeed protection) that are based on that data.

That sucks, but it’s the only option. The Air France 447 crash happened for many reasons (like all crashes). But it *didn’t* happen because of the flight computer. The flight computer did exactly what it should have. It noticed an implausible drop in airspeed, it knew the pitot-static system could not be trusted, and it no longer took action based on data from that system. It said: “I can no longer protect you from stalls, because I no longer know if the plane is stalling.”

(Well, it probably would have helped if it did literally say that. The plane could have done a better job at telling the pilots what protections were lost and why. But that’s a completely different issue. It’s a human interface and design issue, not a fundamental flight controls issue.)

Before the Lion Air crash, I would not only have said “this is the only possible option”, but I would have told you that it’s how Boeing’s flight computers work as well (at least any that have flight envelope protections or “flight envelope suggestions.”) I mean, there is no other way to program them. I wouldn’t need to know the details to know that a Boeing plane isn’t going to fly itself into the ground over one faulty sensor.

It seems I was horribly wrong.

Because that’s apparently what the Lion Air 737 did. The two angle of attack sensors disagreed, but instead of saying “I don’t know what the AoA is anymore, I can’t provide stall protection”, it decided that the plane was stalling and it had to push the nose down to get out of the stall.

Over one sensor. One.

It doesn’t matter to me if the pilots can override it or not. A plane should never take action based on a flight parameter unless at least two data sources agree about that parameter. Having to turn off the faulty ADRs in the “two sensors agree, but are wrong” in an Airbus is a different matter. That is such a freak occurrence, and the only way to avoid that would be to not use a flight computer for anything. Even Boeing doesn’t do that – I’m pretty sure all their planes have stall warning systems like stick shakers.

You could help it a bit by adding more layers of backup sensors, which IIRC is what Airbus has done on the A350 (for one). I heard it has like five layers of backups.

Before this crash, I would have told you that Boeing and Airbus planes were equally safe. Now I am not so sure, especially considering the things discussed in this post.

Yes, the statistics overall have been the same up to this point, which is why I would have said they were equally safe. But what about the future? How can I trust Boeing now? This is so unthinkably bad. It’s not something that is only obvious in retrospect. It’s not a freakish edge case. It is blatantly wrong. And flight envelope protections are not new! Airbus has been doing them correctly for decades, and Boeing has also, in different ways.

This is totally subjective, but I feel like Boeing needing to tack on stall protection just because the 737 MAX 8 is too stall-prone is also weird. Airbus added flight envelope protections because they *wanted to*, not because their plane designs wouldn’t be considered airworthy without them. The MCAS system is not compatible with Boeing’s philosophy or image at all. Boeing fans would have said they like Boeings because they don’t have things like MCAS.

And this is wild speculation that you should take with a massive grain of salt, but part of me wonders if that’s why they didn’t tell pilots about it. I’m sure most Boeing pilots have nothing against Airbus, even if they personally prefer Boeings. They know it’s the aviation equivalent of Apple vs. Microsoft.

But I have seen some who vehemently oppose anything Airbus, or anything with the Airbus philosophy (e.g. flight computers providing any kind of protections). They call Airbus “Scarebus.” They don’t really understand the Airbus flight computers, but they’re convinced that Airbuses are going to fly themselves into the ground because they think they know better than the pilots. (You know … like a Boeing just did.)

I have no idea how many of those pilots there are, or if Boeing has any reason to care about their opinions. But they exist, and even a correctly designed MCAS system is basically their arch-nemesis.

I believe he had time to figure it out because, as the third pilot on the flight deck, he was not actively fighting the controls and trying to fly the aircraft.

It does boggle the mind: the computer had extensive control over pitch and engine thrust. But because it controlled maneuvers Boeing tells us were outside the normal flight envelope, the pilot didn’t need to know a thing about what the computer could do. I don’t think “arrogant” adequately describes that particular “attitude.”