10
$\begingroup$

Many components of airliners are installed with three redundant systems to reduce the risk of equipment failure causing accidents. However, there are only two of the "components" most likely to "malfunction" and cause an accident: the pilots. Why are there not three pilots to match the triplicated redundancy of other critical systems?

$\endgroup$
1
  • $\begingroup$ Comments have been moved to chat; please do not continue the discussion here. Before posting a comment below this one, please review the purposes of comments. Comments that do not request clarification or suggest improvements usually belong as an answer, on Aviation Meta, or in Aviation Chat. Comments continuing discussion may be removed. $\endgroup$
    – DeltaLima
    Dec 26, 2023 at 15:52

6 Answers 6

23
$\begingroup$

Triple redundancy is often used when you need to know correct value even in case of single failure. Think (airspeed) sensor for example. (But the same can apply to output of flight computer or any other value in system.) The sensor has no (completely reliable) self-diagnostic, it is simply outputting one number. With only two sensors, one of which is malfunctioning, you get two different numbers and can't know which is the correct one. Average or any other "merge" will be for sure incorrect. With three sensors, you can sort the values by magnitude and take the middle one. It will be close to "correct" even if one sensor gone wild.

It is not intended for situations where 2 of three systems fail (because if failure rate is so high, that failing two systems simultaneously has still non-negligible chance, then failing all three won't be too far away). If you can isolate and identify failed system, double redundancy is sufficient. Or if it is enough to know "something is wrong", because there is particular action to be taken in response which is always safe.

Tricky part with failing systems is to know which has failed (and that it has failed). And here is triple redundancy and voting an useful approach.

Piloting of airplane is not decided by "voting", so adding a third pilot would not help in this sense. For human interaction and time-critical situations, having third independent opinion, even if maybe useful in theory, tends to not turn out so well in practice. I would expect (personal opinion only) that having three "redundant" pilots would make it less safe.

$\endgroup$
14
  • 3
    $\begingroup$ @ROIMaison: There were 3 pilots in that incident $\endgroup$
    – Ben Voigt
    Dec 22, 2023 at 16:53
  • 7
    $\begingroup$ @ROIMaison 3 pilots at the controls would have caused a “triple input” alarm so I’m not sure how adding another pilot would help $\endgroup$
    – Doryx
    Dec 22, 2023 at 18:24
  • 3
    $\begingroup$ If you read the article, there is one pilot who was pulling the nose up, and the other pilots (after each other) were putting the nose down. So if there would have been a 'vote', it would have been 2 votes for nose down, and one for nose up, and the plane could have recovered from the stall. $\endgroup$
    – ROIMaison
    Dec 22, 2023 at 18:45
  • 5
    $\begingroup$ How's that going to be programmed? One stick says 3 degrees down, one 5 degrees and one says 2 degrees up. What to take now? Maybe the middle ground is the only one that will fail? How would you know for every possible action which of the three to choose. Or how do you coordinate 2 wide range inputs to be "close enough" together? What's close enough? Which one do you use then? $\endgroup$
    – DonQuiKong
    Dec 23, 2023 at 9:17
  • 2
    $\begingroup$ @DonQuiKong: Good point. It's not a simple up vs. down vs. neutral input, and requiring two of three inputs to match within some small range would make it hard to do anything. Taking the median separately on all three axes (including rudder pedals) could lead to really wild behaviour if pilots didn't agree. (Like AlexanderThe1st pointed out.) The mean as a mixing function allows an outlier to have some effect, for good or ill. Yeah, no obviously-good solution, so yet another reason this isn't done in practice. $\endgroup$ Dec 24, 2023 at 1:58
10
$\begingroup$

Having three or more pilots on board does indeed offer a wider margin of safety than two. This is called "augmented crew". Augmented crews are mandatory on long-range flights to meet crew rest requirements, and also happen as a side effect on check-rides. They are also universally used, even if not mandated, on acceptance flights, early in the life of the new model, and on many non-standard flights.

This study details the performance of augmented crews extensively.

Additional pilots in an augmented crew don't have controls and act in an advisory or supervisory capacity. More than two sets of controls aren't necessary, and they would enlarge the flight deck, increase its cost, complicate control mixing, and possibly have a negative psychological effect when a regular 2-pilot crew is used.

The tradeoffs against mandating a larger crew are:

  • Cost: Pilot hiring, training, currency, and of course pay
  • Dispatch reliability: It's easier to get 2 pilots available than 3
  • Extra weight: Permanent station and rest areas for larger augmented crews

Pilot error can be both of a positive nature (taking the wrong action) and a negative one (failing to take the right action). Augmented crews improve the latter and help catch the former. Three sets of controls might have prevented one or two conflicting input accidents that have happened, but could also slightly increase the rate of positive errors.

Overall, commercial aviation is a field of tradeoffs. More crew members can be useful, but they cost more as well. It's done when necessary. So far, the accepted compromise is to provide two sets of controls, but include jump seats to augment the crew occasionally.

P.S.

Personally, I feel that there is room for improvement in cockpit tech. AR helmets, as used in the military, can help in zero visibility and replace smoke hoods. ML can be used to augment autopilots with human input derived models, for higher autonomy. But overall the level of safety is good already, so it's not a priority in commercial design.

$\endgroup$
2
  • $\begingroup$ Do you have evidence that three sets of controls might prevent conflicting input accidents? It's not obvious. What is the "correct" input if one pilot banks right, one banks left, and one pushes the stick forward? $\endgroup$ Dec 22, 2023 at 2:51
  • 1
    $\begingroup$ @DJClayworth It's "might" precisely because there's no evidence. In your case, there's no correct input. But in the case that one pilot has died / LOC / lost control, and voting logic was implemented over just mixing, two other pilots would take over more reliably than one. $\endgroup$
    – Therac
    Dec 22, 2023 at 2:58
9
$\begingroup$

Props to Therac for mentioning it, but a large number of these answers sidestep or ignore a very important point: everything must be a calculated tradeoff. Especially in commercial airline operations, every decision is made in terms of cost and benefit.

It may be nice to think that anyone may practice, "safety at any cost." However, this is not reasonable.

The safest option is not to fly.

To prevent airliner crashes, prevent airliner flights. This doesn't work out for a commercial airline. The whole point of the business is to fly people around. There are already trains and buses, which serve other purposes and have other advantages and disadvantages, for various reasons. An intentional choice is made, to be unsafe, and fly people around in pressurized metal tubes.

(I am not ignoring that commercial aviation is much safer than many other modes of transportation. Taking a human being off the ground, especially at Mach 0.8, is just inherently a risk, regardless how much you make it safer.)

Why stop at 3?

If you make the argument that 2 pilots is not enough, why do you think that 3 will solve all of the problems? Why not 4, or 7, or 118?

The existing number, 2, isn't arbitrary. Decades of experience has shown that for an average commuter hop, 2 pilots minimizes the dollars per safely arriving customer. Other longer flights are staffed differently.

Adding another pilot (or flight engineer, navigator, etc.) costs a lot of money. I suspect most passengers would answer no to:

If I charged you 650 instead of 300 for your 1-hour flight, and instead of a one-in-a-million chance of dying in a plane crash, you had a one-in-a-trillion chance, would you pay extra?

(The numbers are arbitrary but they're reasonable and demonstrative. Also most people are really bad at probability.)

Adding a third airspeed sensor also costs money. The amount of money it costs is way less though, and it provides a giant benefit when units 1 and 2 fail or give faulty readings. Redundant hydraulic systems are much more expensive, but commercial airliners tend to have them anyway because the benefit is sufficient to match the extra cost.

Note that this decision is also made very differently in military aviation because there are more and greater risks.

The more common solution to this problem is to make the airplane easier for a single person to fly (in the case of catastrophic failure of one of the pilots), and still be able to land in the case of a fairly significant problems. This solution is more common because there are many more means to solve it rather than requiring more pilots in the cockpit.

$\endgroup$
1
  • $\begingroup$ Military treade-offs are not so different, and survivability is the wrong discipline to look at for that. Look instead for reliability or System Safety. $\endgroup$
    – fectin
    Dec 24, 2023 at 23:07
9
$\begingroup$

The short answer is humans have more means to tell whether another person is making mistakes, compared to systems with limited, and predetermined, functions and test capabilities.

On the other hand it's not exact the common aerospace rule is triple redundancy. Actuators are as important as the pilots, they are needed to execute pilot orders, still most actuators are not triple-redundant.

The triple-redundancy is first used for sensors and computers, when you can't decide if a sensor/computer is delivering wrong data unless you can compare with (not one but) two other.

Before answering your question, let's keep in mind a reality: Risks cannot be completely mitigated.

Basic principle: Statistical significance

Any engineering activity is imperfect, and failures are expected to occur. The rate of failures can be further limited by adding protections. But protection design, implementation and maintenance have a cost.

A balance has to be found between cost, failure likeliness/consequences. This is globally known as risk management, and this is based on statistics.

The manufacturer, the operator, the crews and the passengers have no choice but to accept the unmitigated risks. Of course nothing prevent a manufacturer to design more safe aircraft, but usually this means a higher price and less sales.

However in order to protect crews, passengers and public, this industry is regulated to limit the residual risks to an acceptable likelihood. If we judge by the current frequency and consequences of incidents and accidents, this industry if by far safer than most other activities.

Current techniques used for risk mitigation include both the triple redundancy and the two-pilot crew.

Triple redundancy: Need arbitration

If you have only two systems and they disagree, can you tell which one is wrong?

You can't know. You need a third one to bring out a majority. From Wikipedia:

enter image description here

In this case you will assume the majority is right. This assumption is most of the time right, though this is not guaranteed, and accidents have happened due to simultaneous errors occurring in triple-redundant systems.

Pilots: Crew resource management

Most large aircraft can be handled by a single pilot, though in a degraded way. Having two pilots is already a mitigation for pilot incapacitation. The statistics for both pilots incapacitation is insignificant despite being common in movies.

For pilots, there is no need to have a third pilot to know if the other is starting to make mistakes, or is failing to react. One pilot, assuming he/she is not incapacitated, can evaluate the condition of the other and take control over if required.

In case of doubt a discussion can occur to clarify the situation and decide what to do. This possibility is at the base of crew resource management, and doesn't require a crew of three.

This is not a perfect process, but triple-redundancy isn't either. It's not clear whether involving a third pilot in the process would be real improvement, e.g. an unnoticed slow depressurization may affect the third pilot as well.

Actuators: Rarely tripled

Beyond decision making, there is the special case of actuators, to execute the decision. E.g. after a flight controller has determined what to do with the ailerons, the corresponding action must be triggered. Of course the corresponding actuators can fail.

Some of the important actuators are actually dual, e.g. both electric and hydraulic (hybrid actuators). But they are rarely tripled:

enter image description here

Source.

The preference in case of total failure of an actuator (or in the transmission chain) is to use other actuators on other surfaces to get a more or less equivalent result. This is the principle used by Airbus with the control law reconfiguration:

enter image description here

See this answer for Airbus laws.

E.g. if the ailerons actuators have failed, or the ELACs controllers, using SECs controllers and spoilers is a bypass.

$\endgroup$
8
$\begingroup$

Some systems are "redundant" only two deep, or not redundant at all.

One or two engines. Two wings. One rudder. One nose gear.

Why aren't there "3" pilots? Because many decades of commercial airline ops have shown it to not be necessary.

$\endgroup$
3
  • $\begingroup$ I don’t think a second engine or second pilot is redundant. A failed engine or pilot will be generally much more survivable than one of two wings being inop. $\endgroup$ Dec 22, 2023 at 15:32
  • 3
    $\begingroup$ "A twin engine aircraft gets you to the scene of the accident more quickly" - pilot's aphorism $\endgroup$
    – FreeMan
    Dec 22, 2023 at 19:39
  • 1
    $\begingroup$ @FreeMan That was said about airplanes very different from modern airliners. $\endgroup$ Dec 22, 2023 at 23:10
1
$\begingroup$

It is a common mathematical problem in aerospace industry (especially in space industry), how to protect your system against component failure. And the solution to the problem is well known. And there are many solutions. If you need to protect your system from a component failure triplicate the number of components is not enough (although there is an exception). Say you want to protect your aircraft from a failure of a computer measuring the flight speed. You need at least four computers to be able to establish the real flight speed in case of a failure of a single computer.

A more general answer is you need 3n+1 computers to mitigate the failure of n computers.

And you can't just pick the mean, median, or mode of the results of all four computers. There is an algorithm to establish the correct answer. As I said, there are many well known, ready made, easy to find algorithms.

$\endgroup$
11
  • $\begingroup$ 2n+1, not 3n+1. Not only is 3n+1 excessive, it gives even numbers 50% of the time which is exceptionally bad for determining quorum. $\endgroup$
    – Shirik
    Dec 24, 2023 at 21:47
  • 3
    $\begingroup$ Explain the math behind the 3n+1. Don't just write it. $\endgroup$ Dec 25, 2023 at 4:12
  • 1
    $\begingroup$ This A,B,C reasoning also applies to A,B,C,D,...,Z. Where does the 3n+1 come from? Do these easy to find algorithms have published names? $\endgroup$ Dec 26, 2023 at 19:21
  • 1
    $\begingroup$ This answer (and, I fear, our comments so far) is a digression. It does not even address the question, as @mins noted. $\endgroup$ Dec 27, 2023 at 16:01
  • 1
    $\begingroup$ This answer might not be a digression, but in that case it is incomplete. If we model pilots as "subsystems that can fail, who might detect internal failures, and who might detect failures in adjacent subsystems by means other than disagreement", then we can apply math to come up with reasonable pilot numbers. But even then c*n+1 will never be 2. $\endgroup$
    – MSalters
    Dec 28, 2023 at 15:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .