Originally Posted by
infrequentflyer789
I still don't get how only one sensor failure can upset MCAS, I can't (or don't want to) believe they took a direct output from one sensor into the stab trim.
True there. Odd & tragic & stupid how just ONE AOA (alpha) sensor can cause nose down pitch trim. One can argue about the Human Factors involved here concerning stress, panic, time to decide what to do, etc., but I tend to come down on the side of "don't over-stress tired human brains", from the Flight Controls Engineer viewpoint I have.
Assuming the crash was caused by the AOA alpha vane ... continuing on:
"Analytical Redundancy" would have prevented this problem, as it would add a third alpha to the dual vane measurement to break the tie between 2 vane sensors. ... Note that alpha = theta - gamma, received through air data & inertial sensors apart from the alpha vanes. That caclulated third alpha makes the system triple redundant, along with using median value selection.
You could even apply a (fourth redundancy!) reasonableness test on the alpha vane's sensor values by writing more software that applies plain old logical common sense: --> Can that high alpha value, seen all of a sudden, and when the airspeed is good, and when g's aren't being pulled, be a valid value of alpha? Remember we have pitch rate sensors, accelerometers, pitot-static tubes, etc. to help the alpha fault detection out. Remember alpha-dot = pitch rate - (accelerometer / speed); we can use all the kinematic laws to do this.
All the above is what a very fast, sharp, smart pilot or flight engineer would do in a millisecond if they saw an alpha vane sensor measurement hard-over (high) all of a sudden. It would be obvious to an observer actually seeing the sensor values along with the trimmed aircraft state to decide it's a bad sensor. That is if a human could see & monitor the raw sensor values in real-time to make that clear judgement. Computers can.
Algorithms such as the above, along with complementary or Kalman filtering to filter out spectral noise and emphasize the short term estimation of valid alpha would also help. I won't go into the signal processing or kinematic blending algorithms here, but I will say you wouldn't need much.
And, finally, where was the FTA & FMEA in all this? I guess they thought the nose-down trim would be easily countered by pilots & was not deemed catastrophic. Again, Human Factors, and I'm on the side of "don't put the plane in peril and expected tired or paniced pilots figure it out".