10
$\begingroup$

While reading an article about the Lion Air Crash with a Boing 737 Max 8, I was very surprised by the following paragraph:

In designing the 737 Max, Boeing decided to feed M.C.A.S. with data from only one of the two angle of attack sensors at a time, depending on which of two, redundant flight control computers — one on the captain’s side, one on the first officer’s side — happened to be active on that flight.

My naive assumption was that any system that is capable of pointing an airplane towards the ground would certainly have redundant sensor input, and switch off if there is serious disagreement between the sensors.

Is it common to have non-redundant sensors for this kind of purpose in commercial airplanes?

Improve this question
$\endgroup$
2
  • $\begingroup$ This article seems to say the automatic control was added as an after thought... $\endgroup$
    – user3528438
    Mar 11, 2019 at 16:07
  • $\begingroup$ @sean Since you voted to say that the first and only question of mine is a duplicate of this, would you at least care to attempt to do actual examples of this kind of system, beyond the one already provided by ymb1 in his answer to my supposedly duplicated question? $\endgroup$
    – ShinTakezou
    Mar 28, 2019 at 13:23

3 Answers 3

Reset to default
11
$\begingroup$

In general, yes. Except in certain configurations, namely autoland, autoflight functions are usually fed with one set of sensors.

This matches the fact that pilots flight instruments are fed from a single source as well. Therefore, the autopilot behavior and instruments should have a coherent and predictable response.

The main reason is fault isolation. If the flight crew identifies a fault with the captain's instruments, then disabling instrumentation and autoflight functions on the captain's side will guarantee the faulty data will not influence the copilot's instrumentation and controls.

If you have the system try to "intelligently" vote, you run the risk of not being able to isolate a faulty sensor, especially in 2 faulty of 3 sensor situations. Another classic problem is how to prevent the voting system from becoming a single point of failure.

Instruments are accompanied by a comparator, which detects significant differences between redundant readings and causes an appropriate warning. Most systems treat the warning as binary: the flight crew manually compares all readings and using human logic, decides which are discrepant.

Improve this answer
$\endgroup$
8
  • 1
    $\begingroup$ "not being able to isolate a faulty sensor" ...and that's when you end up with situations like XL Airways 888. $\endgroup$
    – user
    Mar 11, 2019 at 16:39
  • 1
    $\begingroup$ Apparently the discrepancy warning was just a paid option on the B737 MAX, until now, I suppose. $\endgroup$
    – Peter - Reinstate Monica
    Mar 16, 2019 at 13:14
  • 1
    $\begingroup$ There is a new article in the Seattle Times today with a lot of interesting information about the (flawed) FAA certification. It claims that devices which cause "“major failure,” meaning that it could cause physical distress to people", can rely on one sensor while potential causes of "“hazardous failure,” meaning that it could cause serious or fatal injuries", need at least two. In which category MCAS falls is therefore crucial. $\endgroup$
    – Peter - Reinstate Monica
    Mar 18, 2019 at 7:38
  • 1
    $\begingroup$ I wonder why books on safety-critical systems talk about TMR, vote criteria, and other stuffs like these, if at the end it is better to leave it to human logic and the purpose of those systems should be only to say "maybe there's a problem, look at it and see what you can do" (what about info's overload?). I suppose a vote system can be redundant too (who controls the controllers?), or, depending on the complexity of the component, one could state its unlikeliness of failing and say that it's sufficient to have one. (After all it's all about probabilities...) $\endgroup$
    – ShinTakezou
    Mar 28, 2019 at 8:30
  • 1
    $\begingroup$ @user71659 Since you voted to say that the first and only question of mine is a duplicate of this, would you at least care to attempt to do actual examples of this kind of system, beyond the one already provided by ymb1 in his answer to my supposedly duplicated question? $\endgroup$
    – ShinTakezou
    Mar 28, 2019 at 13:06
4
$\begingroup$

The first answer deals with avionics (displays, autopilot, annunciations, stall warning), whose single source failure is usually of minor criticality. If your stall warning misfires, it's not a big deal since the pilot is expected to cross-check against the other sources (co-pilot screen, ISI, etc.), and finally cut off the stick shaker (stick pusher, on the other hand, is a totally different matter). However, for a fly-by-wire aircraft, the other side of the story on automation is flight controls.

Since flight control laws modify the handling characteristics behind the scene, much more redundancy is required. By law, any single failure in flight controls, regardless of probability, must not be catastrophic. Then depending on the probability of combinations of failures, they need to be dealt with accordingly, as well. This means that critical sources into the flight control computers must have redundancy. This includes inertial data, air data, AOA, surface positions, etc. The computers themselves must also be redundant and sufficiently different to avoid common mode failures that will knock out all of them at once.

Now since MCAS is part of the flight controls, you would think redundancy is required to match the failure probability with its criticality (initially evaluated as hazardous, but not catastrophic). Therein lies the controversy.

Improve this answer
$\endgroup$
2
$\begingroup$

In general, no. Only in cases where system failure has very little impact on continued safe operation of the aircraft.

As mentioned in this question, an analysis needs to be made on:

  • Severity of the consequences of system failure.
  • Exposure time to the failure condition.
  • The failure rate of the hardware.

The consequences of a cruise autopilot failing are usually benign (except for some hard-over failures), plus there is lots of reserve in altitude and time for the flight crew to assess what is wrong. In a case like this, a single transducer is tolerable.

This answer gives an example of the redundancy in the CATIII autoland system, which has triple redundancy in all systems, including the sensors. It is an example of a critical system, but not the only one. As @Jimmy mentions, flight controls are by definition flight critical.

Improve this answer
$\endgroup$

You must log in to answer this question.