8
$\begingroup$

While reading an article about the Lion Air Crash with a Boing 737 Max 8, I was very surprised by the following paragraph:

In designing the 737 Max, Boeing decided to feed M.C.A.S. with data from only one of the two angle of attack sensors at a time, depending on which of two, redundant flight control computers — one on the captain’s side, one on the first officer’s side — happened to be active on that flight.

My naive assumption was that any system that is capable of pointing an airplane towards the ground would certainly have redundant sensor input, and switch off if there is serious disagreement between the sensors.

Is it common to have non-redundant sensors for this kind of purpose in commercial airplanes?

$\endgroup$
  • $\begingroup$ This article seems to say the automatic control was added as an after thought... $\endgroup$ – user3528438 Mar 11 at 16:07
  • $\begingroup$ @sean Since you voted to say that the first and only question of mine is a duplicate of this, would you at least care to attempt to do actual examples of this kind of system, beyond the one already provided by ymb1 in his answer to my supposedly duplicated question? $\endgroup$ – ShinTakezou Mar 28 at 13:23
7
$\begingroup$

In general, yes. Except in certain configurations, namely autoland, autoflight functions are usually fed with one set of sensors.

This matches the fact that pilots flight instruments are fed from a single source as well. Therefore, the autopilot behavior and instruments should have a coherent and predictable response.

The main reason is fault isolation. If the flight crew identifies a fault with the captain's instruments, then disabling instrumentation and autoflight functions on the captain's side will guarantee the faulty data will not influence the copilot's instrumentation and controls.

If you have the system try to "intelligently" vote, you run the risk of not being able to isolate a faulty sensor, especially in 2 faulty of 3 sensor situations. Another classic problem is how to prevent the voting system from becoming a single point of failure.

Instruments are accompanied by a comparator, which detects significant differences between redundant readings and causes an appropriate warning. Most systems treat the warning as binary: the flight crew manually compares all readings and using human logic, decides which are discrepant.

$\endgroup$
  • $\begingroup$ "not being able to isolate a faulty sensor" ...and that's when you end up with situations like XL Airways 888. $\endgroup$ – a CVn Mar 11 at 16:39
  • 1
    $\begingroup$ Apparently the discrepancy warning was just a paid option on the B737 MAX, until now, I suppose. $\endgroup$ – Peter A. Schneider Mar 16 at 13:14
  • $\begingroup$ There is a new article in the Seattle Times today with a lot of interesting information about the (flawed) FAA certification. It claims that devices which cause "“major failure,” meaning that it could cause physical distress to people", can rely on one sensor while potential causes of "“hazardous failure,” meaning that it could cause serious or fatal injuries", need at least two. In which category MCAS falls is therefore crucial. $\endgroup$ – Peter A. Schneider Mar 18 at 7:38
  • $\begingroup$ I wonder why books on safety-critical systems talk about TMR, vote criteria, and other stuffs like these, if at the end it is better to leave it to human logic and the purpose of those systems should be only to say "maybe there's a problem, look at it and see what you can do" (what about info's overload?). I suppose a vote system can be redundant too (who controls the controllers?), or, depending on the complexity of the component, one could state its unlikeliness of failing and say that it's sufficient to have one. (After all it's all about probabilities...) $\endgroup$ – ShinTakezou Mar 28 at 8:30
  • 1
    $\begingroup$ @user71659 Since you voted to say that the first and only question of mine is a duplicate of this, would you at least care to attempt to do actual examples of this kind of system, beyond the one already provided by ymb1 in his answer to my supposedly duplicated question? $\endgroup$ – ShinTakezou Mar 28 at 13:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.