How do redundancies work in aircraft systems?

Question

I've read about many aircraft systems having redundancies. For example, both Boeing's 787, and Airbus's A380 have a triple-redundant FCS. In this case, it makes sense to act upon the majority's decision. If all three components disagree, how is it decided which one wins? Is there any record of disagreement amongst redundant systems in airplanes?

The primary differences I have compared to the question about Airbus's control systems (How does the Airbus flight computer's voting system work?), is verification for non-deterministic systems, as well as optics for visibility. Given that the entire systems run in parallel up until the verification component (from sensor input, onwards), there will be some, obvious delta in their "decisions." -- Although, most of the time, this isn't perceivable, is there any visibility into what's going on with the FCS?

Answer 1

Triple-redundant systems have four independent members, so if one fails, a two-to-one vote of the remaining three is still possible.

One system    = No redundancy.
Two systems   = Simple redundancy.
Three systems = Double redundancy.
Four systems  = Triple redundancy.

However, often the term "triple redundant" is used when the system has only three members. And if all three disagree, two of them must be faulty already, so this is a case of multiple failures.

In case of Airbus, besides the three main FCS computers two backup systems are available to help isolate the faulty one. Inside, each has two channels which run software written by a different team, run on a processor different to the one in the other channel and which are supplied by two different suppliers. This helps to reduce systematic errors, when all together would fail because of a common malfunction.

Airbus flight control system diagram (picture source). Only the first system of each is expanded; the boxes for system 2 and 3 look the same on the inside. Input is from the side sticks, and output goes to the hydraulic valves at the control surfaces. The voting happens first in the comparator step (between the two channels) and again in the filters (between the single systems).

Answer 2

Your question also makes the implicit assumption that redundancy involves multiple systems trying to come up with the same answer. This isn't necessarily the case.

I've worked on a multiply-redundant hybrid electric vehicle controller. These things are drive-by-wire as far as go/stop are concerned, so a lot of the same safety principles apply. A primary control system ran the whole thing, managed emissions, best driver response, and all that good stuff. A secondary system had a simpler model of how things should behave, checking for when the primary system was outside some tolerance of its simpler model for some time. Because it was a simpler model, testing could be more complete. And a tertiary system checked that the primary and secondary systems were coming up with valid behaviour, using an even simpler (and hence even-easier-to-validate) model. For added fun, the secondary and tertiary systems periodically injected spurious faults and checked their fault-reporting mechanisms were detecting them correctly, so they knew a real fault would trigger correctly.

In this case the fallback behaviour was simply to pull the plug on the car if the primary system went dodgy, because for a car that's reasonable. In principle though the secondary system could have been the basis of a perfectly competent fallback strategy if we'd thought it was necessary.

Answer 3

In general, the number of redundancy indicates the number of independent members i.e. triple redundancy indicates three independent members, while a quadraplux redundancy indicates four independent members. A triple redundant system used in Flight Control Systems would look something like this:

Image from A Novel Family of Weighed Average Voters for Fault-tolerant Computer Control Systems by Latif-Shabgahi et.al.

There are two ways the 'Voter' can determine the output from redundant systems:

• Agreement based voting system produces an output only if a certain number (e.g. majority) of the voter inputs agree. This is usually the method used in Flight Control Systems (like Airbus).

• The other system produces an output even if there is no agreement between the redundant systems, usually by 'combining' (for e.g. averaging) selecting one of them based on some metric (for e.g. median).

Consider the air data input in case of Airbus: there are three Air Data and Inertial Reference Units. The input of the 'voter' (each flight computer) comes from all three ADIRUs. The FCS needs two matching (with some allowed variation) values to generate output. The Flight computers degrade to alternate law or direct law under two circumstances:

• More than one unit fails.
• No two units agree.

In case of Air France flight 447, the FCS reverted to alternate law due to temporary inconsistency between the measured speeds (likely due to obstruction of the pitot tubes by ice crystals) of two ADRIUs. The another one had already been diagnosed as faulty and excluded from consideration. This and the consequent pilot actions resulted in the crash.