I have read that some airplanes have multiple autopilots, specifically airliners.
What is the reason for this, and how does that system work?
$\begingroup$
$\endgroup$
1
-
$\begingroup$ Among others, one reason is higher cosmic radiation at high altitude, e.g. compared to sea level, neutron flux is ~4X at 1.5km (Denver's height) and ~300X at 12km(where airplanes fly). This causes soft errors in electronic components. See this survey paper for reference (Section 2.3). $\endgroup$– user984260Jul 12, 2015 at 22:56
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
8
Redundancy, particularly during autoland operations.
How it works depends on the specific airplane type. In the most advanced systems with triple (or more) flight guidance computers (FGCs), a "voting" concept is used during critical operations like autoland. All 3 computers calculate their commands independently, and vote on what to do. The middle value, or sometimes the average of the 2 "most similar" values, is then passed to the flight control actuators. In this way, if any one of the computers fails and starts producing garbage commands, those erroneous commands will not be selected (they are automatically rejected by the voting scheme). A monitoring system can also detect a failed computer in this way and take it offline, allowing "fail-active" functionality — an autoland can continue on the 2 remaining functional computers.
Less complex aircraft, and aircraft without autoland, still sometimes have 2 FGCs, but do not support fail-active operation. In these systems only one of the two computers is active or selected at any given time. A transfer switch in the cockpit allows the pilot to transfer control from one computer to the other if one fails.
And it's not just airliners. Business jets commonly also have dual FGCs, and in recent times even small general aviation airplanes like the Diamond DA-42 have dual systems (Garmin G1000 in dual-GFC700 configurations).
This photo (click for high res version) shows a Cessna Citation CJ business jet with dual Garmin autopilots. At the top of the PFD, notice there is a small green arrow pointing left; this indicates the left FGC is currently selected. The photo also shows the XFR (transfer) button on the mode select panel, top center, just underneath the master caution/warning annunciator panel. Pushing this button would switch to the right (#2) FGC and change the arrow on the PFD to point to the right. These indications are fairly representative of other dual-FGC systems.
Here's another photo of a Hawker 800 with Rockwell Collins Pro Line 21. You can see the same arrow on the PFDs. In this aircraft the transfer switch is labeled "AP XFR" and is again on the autopilot panel just underneath the glareshield at the top of the panel toward the left hand side.
And finally a photo of a 767 with 3 FGCs and full autoland capability. It's a bit hard to read in this photo, but just above the autopilot disengage bar (the "spacebar" looking thing on the right side of the mode select panel just under the glareshield) the 3 buttons are labeled "A/P ENGAGE", "L" "C" and "R" for the left, center and right FGCs. During an autoland all 3 would be selected and illuminated.
-
$\begingroup$
if any one of the computers fails and starts producing garbage commandsAs the FGC is a piece of software, and all software is prone to bugs and errors, it is likely that any given FGC will produce garbage from time. The voting system prevents the plane from crashing when this happens. $\endgroup$ Apr 16, 2014 at 21:06 -
5$\begingroup$ @Jumbogram Actually it's extremely unlikely. FGC and other flight-critical software is painstakingly designed and tested under rigorous software development guidelines. It is then extensively analyzed and tested prior to flight certification. Erroneous commands due to a software error are extremely unlikely (but, yes, technically possible, and designed to be tolerated via redundancy). $\endgroup$– TypeIAApr 16, 2014 at 21:09
-
1$\begingroup$ @dvnrrs Obligatory CS/Engineering lecture case study -- always expect failure, hence the voting system :-) $\endgroup$– voretaq7Apr 16, 2014 at 21:13
-
2$\begingroup$ @voretaq7 Yep, and note that the incident you refer to led to the creation of the IEC 62304 software standard, which is probably less restrictive than DO-178B used in aviation. I'm a software engineer myself and I assert that although software bugs have occurred in safety-critical areas in the past, they are still extremely unlikely in flight-critical avionics due to the rather extreme levels of caution in use today. $\endgroup$– TypeIAApr 16, 2014 at 21:16
-
1$\begingroup$ @Jumbogram Most avionics software failures have been found to arise from errors in the design and specification, or a failure to identify possible corner cases. $\endgroup$– SimonMar 24, 2015 at 22:38