2 ms·

I'm a tad late, but I'm curious about where you said > they use different software and hardware Does this mean different architectures? If it does my respect

by i336_ 11y ago

I'm a tad late, but I'm curious about where you said > they use different software and hardware Does this mean different architectures? If it does my respect for the redundant-hardware approach just went through the window. Also, how is the watchdog redundant? I can't imagine there's only one; how does this work? Are both watchdogs somehow wired in parallel, are they cross-connected to each other, or...?

justsid 11y ago
It litereally means two completely different architectures, on two physically disconnected computers. Here is a diagram: https://i.imgur.com/Tj0GKbQ.png https://i.imgur.com/Tj0GKbQ.png Also visible in the diagram is that each side has its own watchdog, both connected to each other. The way this whole thing work is fail safe, so if one computer fails the backup can jump in, and if that fails too the flight controls will either retract or stop in their current position depending on what makes the most sense. It’s also mirrored, so for example if spoiler 2 on the right wing fails and is retracted, spoiler 2 on the left wing will also retract. Here is a description about the flight controls and how pilot input gets passed through to the control surfaces: http://www.smartcockpit.com/docs/A320-Flight_Controls.pdf http://www.smartcockpit.com/docs/A320-Flight_Controls.pdf And here is a general overview about the architecture: http://www.skybrary.aero/bookshelf/books/2313.pdf http://www.skybrary.aero/bookshelf/books/2313.pdf
- i336_ 11y ago
  Oh, wow, that's amazing. Now I understand why avionics are so expensive - verifying the correctness of such a system sounds like a lot of "fun," or at least a lot of time. (I wonder if there are any systems built on multiple architectures where each unit is itself a redundant system with CPUs in lockstep.....) Am I to intuit from this diagram that the watchdog watches all the components - power, I/O, memory, and CPU? That's very impressive. Or does it watch a central bus/backplane everything is connected to? Also, how does either side decide/figure out the other side has failed? Simply deciding that the other half is wrong if it doesn't match this half's output could fail catastrophically if one of the sides reaches this conclusion after entering an invalid state (ie, it's the other side that is correct, and this side is wrong). I'm also mildly curious as to why the I/O on one side has two connections to the actuators, while the other has only one.

by i336_ 11y ago

justsid 11y ago

It litereally means two completely different architectures, on two physically disconnected computers. Here is a diagram: https://i.imgur.com/Tj0GKbQ.png https://i.imgur.com/Tj0GKbQ.png Also visible in the diagram is that each side has its own watchdog, both connected to each other. The way this whole thing work is fail safe, so if one computer fails the backup can jump in, and if that fails too the flight controls will either retract or stop in their current position depending on what makes the most sense. It’s also mirrored, so for example if spoiler 2 on the right wing fails and is retracted, spoiler 2 on the left wing will also retract. Here is a description about the flight controls and how pilot input gets passed through to the control surfaces: http://www.smartcockpit.com/docs/A320-Flight_Controls.pdf http://www.smartcockpit.com/docs/A320-Flight_Controls.pdf And here is a general overview about the architecture: http://www.skybrary.aero/bookshelf/books/2313.pdf http://www.skybrary.aero/bookshelf/books/2313.pdf

i336_ 11y ago
Oh, wow, that's amazing. Now I understand why avionics are so expensive - verifying the correctness of such a system sounds like a lot of "fun," or at least a lot of time. (I wonder if there are any systems built on multiple architectures where each unit is itself a redundant system with CPUs in lockstep.....) Am I to intuit from this diagram that the watchdog watches all the components - power, I/O, memory, and CPU? That's very impressive. Or does it watch a central bus/backplane everything is connected to? Also, how does either side decide/figure out the other side has failed? Simply deciding that the other half is wrong if it doesn't match this half's output could fail catastrophically if one of the sides reaches this conclusion after entering an invalid state (ie, it's the other side that is correct, and this side is wrong). I'm also mildly curious as to why the I/O on one side has two connections to the actuators, while the other has only one.