Moderators: richierich, ua900, PanAm_DC10, hOMSaR

 
devplane
Topic Author
Posts: 2
Joined: Sun Aug 10, 2014 7:30 pm

Redundancy of sensors

Mon Mar 11, 2019 10:16 pm

Reading different posts about non FEW and FBW airplanes, I got the impression that is it assumed 2 sets of sensors are enough for non FBW airplane. But a FBW airplane need 3. As long as the FBW airplane is as stable as an non-FBW airplane, I have no idea why they should have a difference redundancy. If I understood it correctly FBW just replaces mechanics with electronics and is not related to the sensor redundancy.

As for the software protection modes as in the Airbuses, I don't see the need for more redundancy. If the two sensors disagree, the protection can simply be turned off.

Additionally, I would assume a computer is able to predict the airplanes dynamics (pitch, roll, AOA, ...) much better with erroneous sensors data than any human. So this would rather indicates that more computer and automation means less redundancy.

Hence I wonder if computer and FBW are the reason for the increase in redundancy or if safety gotten more important over time? While writing the post I noticed that more redundancy could also be distraction for humans.

Even if the computer does something wrong, there is still the pilot, who can turn HAL9000 off. But not the otherway around ;)
 
stephanwintner
Posts: 79
Joined: Thu Jan 03, 2019 5:04 pm

Re: Redundancy of sensors

Mon Mar 11, 2019 11:19 pm

I'm speculating.

As an engineer, we like to have three measurements that should agree. When one doesn't, assume the other 2 are correct. If we only have 2, then we don't know which one is correct. One or both may be wrong. Worse, we often don't know which one is wrong. So with one bad sensor out of two we get zero data, as opposed to getting useful data from one bad sensor out of three.

In an FBW system, if one sensor out of three disagrees, the system could follow that same logic, and assume the 2 that are agreeing are the correct ones, and keep on going. If 2 disagree, well, which one is wrong? Is the plane 2 degrees nose up, or 8? The response required is drastically different. It is more likely that the system must assume both are wrong (fail-safe mode / logic). Yes, it can be turned off, but it is more sensitive to one bad sensor. Thus the system is less helpful to the pilot. And while the pilot may know whether 2 degrees or 8 degrees nose up is the correct value, they pilot may also be disoriented or flying through fog or otherwise have no more information than the computer.

If the system isn't an FBW system, it is already more reliant on the pilot. If the system fails, meh, not a big deal, the pilot is already doing the job. And the pilot, knowing the system is less capable, should have planned the flight accordingly (e.g. flown around the fog....)
 
User avatar
Florianopolis
Posts: 346
Joined: Sun Mar 29, 2015 2:54 pm

Re: Redundancy of sensors

Tue Mar 12, 2019 1:04 am

Your post is actually a topic for a PhD thesis. Several, actually. Human-machine flight control and failure modes and redundancy is big stuff.

devplane wrote:
If I understood it correctly FBW just replaces mechanics with electronics and is not related to the sensor redundancy.


I just want to make sure we're on the same page. 99% of the time, "fly by wire" means that pilot control inputs are made using the yoke/stick, and sent to a computer. The computer takes that pilot request and moves around the control surfaces (ailerons, elevators, etc) of the airplane to achieve what the pilot is asking for. For example, on most airliners, turning the stick/yoke tells the computer "I want the airplane to roll, and this fast", and the computer moves control surfaces to deliver that roll rate. The flight crew is not moving the control surfaces, even by means of electronic command instead of cables. The flight computers are responsible for moving flight control surfaces, and the pilots are just using the yoke/stick to tell the computer what they'd like to have happen.

devplane wrote:
I don't see the need for more redundancy. If the two sensors disagree, the protection can simply be turned off.


You're right, where the airplane's ability to continue flying is not in question (such as inherently unstable airplanes, which no airliners are), you can have two or three computers, and if they disagree, they just put their hands up and say "your airplane." And that's basically what your Airbus and modern Boeing do. I don't think there's as much redundancy as you think. If even one computer malfunctions, you're immediately into a degraded mode. On the other end of the spectrum, the space shuttle had five computers (something like 550 pounds in the first versions) and even carried a sixth in-flight spare on the first few flights. (this might be interesting reading: https://history.nasa.gov/computers/Ch4-4.html)

Oh, and you might enjoy reading http://www.atsb.gov.au/media/3532398/ao2008070.pdf
 
User avatar
Starlionblue
Posts: 20368
Joined: Fri Feb 27, 2004 9:54 pm

Re: Redundancy of sensors

Tue Mar 12, 2019 1:38 am

Two systems are not enough, because as stephanwintner says you want to implement a voting mechanism to remove the disagreeing system and keep the agreeing two. If you only have two systems and they don't agree, you have bigger problems than just the protections. Which set of sensor data to you trust for the autopilot to use? Which one do you use for manual flying?

The Airbus systems are way more complex than on/off. The concept of simply "turning off the protections" doesn't exist. Protections may deactivate due to a combination of malfunction, or an ECAM may tell the pilots to take an action that deactivates protections, but you would never turn them off proactively, so to speak.

Certainly, redundancy has been increasing over time. The A350, as an example, has three complete primary air data and inertial systems (ADIRS). If all those go down, there is a complete backup sensor suite (ISIS) and if you lose ISIS as well, engine air data from FADEC can be used.
"There are no stupid questions, but there are a lot of inquisitive idiots." - John Ringo
 
BoeingGuy
Posts: 6358
Joined: Fri Dec 10, 2010 6:01 pm

Re: Redundancy of sensors

Tue Mar 12, 2019 1:55 am

Starlionblue wrote:
Two systems are not enough, because as stephanwintner says you want to implement a voting mechanism to remove the disagreeing system and keep the agreeing two. If you only have two systems and they don't agree, you have bigger problems than just the protections. Which set of sensor data to you trust for the autopilot to use? Which one do you use for manual flying?

The Airbus systems are way more complex than on/off. The concept of simply "turning off the protections" doesn't exist. Protections may deactivate due to a combination of malfunction, or an ECAM may tell the pilots to take an action that deactivates protections, but you would never turn them off proactively, so to speak.

Certainly, redundancy has been increasing over time. The A350, as an example, has three complete primary air data and inertial systems (ADIRS). If all those go down, there is a complete backup sensor suite (ISIS) and if you lose ISIS as well, engine air data from FADEC can be used.


The 787 and 777X have a lot of redundancy too. If you lose Air Data Airspeed, or if it’s inaccurate, you can use a synthetic AOA Speed. Likewise, you can use GPS Altitude if Baro Altitude is unavailable or unreliable.

Who is online

Users browsing this forum: aca763er, Agent and 27 guests

Popular Searches On Airliners.net

Top Photos of Last:   24 Hours  •  48 Hours  •  7 Days  •  30 Days  •  180 Days  •  365 Days  •  All Time

Military Aircraft Every type from fighters to helicopters from air forces around the globe

Classic Airliners Props and jets from the good old days

Flight Decks Views from inside the cockpit

Aircraft Cabins Passenger cabin shots showing seat arrangements as well as cargo aircraft interior

Cargo Aircraft Pictures of great freighter aircraft

Government Aircraft Aircraft flying government officials

Helicopters Our large helicopter section. Both military and civil versions

Blimps / Airships Everything from the Goodyear blimp to the Zeppelin

Night Photos Beautiful shots taken while the sun is below the horizon

Accidents Accident, incident and crash related photos

Air to Air Photos taken by airborne photographers of airborne aircraft

Special Paint Schemes Aircraft painted in beautiful and original liveries

Airport Overviews Airport overviews from the air or ground

Tails and Winglets Tail and Winglet closeups with beautiful airline logos