The troubled (and grounded) Boeing 737 MAX, as widely reported, included a new system (MCAS) that automatically deployed when a single sensor detected the danger of a stall. MCAS strongly pushed the nose of the plane down, and pilots could not successfully countermand the activation unless they turned MCAS off. Astoundingly, writes MIT Prof. Arnold Barnett in OR/MS Today (Oct., 2019), “Boeing told airlines nothing about the existence of MCAS, let alone about the procedure to disable it.” Put bluntly, says Barnett, “MCAS was directly responsible for two fatal crashes, Lion Air Flight 610 in Indonesia and Ethiopian Airlines Flight 302.”
Why did Boeing initially say nothing about MCAS? The dependence on one sensor violates the principle of redundancy, under which no single failure can cause the loss of the aircraft. Boeing argued that redundancy did exist: the pilots (who were not even told of the existence of MCAS) were the backup system that would disable an improperly deployed MCAS.
There were actually 2 angle-of-attack sensors on the MAX, one of which did not affect MCAS. Boeing devised a cockpit warning light that would come on if the 2 sensors gave highly divergent readings. But a production error meant that the light that was supposedly a standard feature of the MAX could never come on, except when the airline customer bought some optional equipment. Boeing discovered the error in 2017 but did not mention it to airlines until after the first MAX crash a year later.
Now Boeing is fixing the problems with MCAS, with 2 sensors. If one detects a dangerous tilt while the other does not, MCAS will not deploy. But what if the erroneous sensor is the one that says things are normal? More prudent is the policy followed by Airbus, which uses 3 sensors and goes with the majority when there is disagreement. “Given that the feature is standard on Airbus planes,” writes Barnett, “it is far from obvious that having 3 sensors is infeasible or prohibitively expensive.”
Classroom discussion questions:
- Which formula in Ch. 17 (Maintenance and Reliability) applies to this issue?
- What impact on airline scheduling is the MAX grounding having?