4 ms·
You need at least three in any system that can deliver conflicting data so that if one faults then the other two can 'out vote' the faulty one. That allows the
by PuffinBlue 8y ago
You need at least three in any system that can deliver conflicting data so that if one faults then the other two can 'out vote' the faulty one.
That allows the system to have at least one failure and still operate.
With just two sensors any fault is an unidentifiable failure - how does the system know which is correct when there are just two votes?
It may be there's a third input from some other sensort, but then technically we're back to at least 3 sensors voting on the issue.
- crocal 8y agoThis could be true in avionics where availability and safety are more or less the same. In other applications where there is a fail safe mode like nuclear (stop fission) or land transportation (hit the brakes), you do not need that. The statement « any » is too strong.
- dreamcompiler 8y agoIt's an AoA sensor. Planes flew without AoA sensors for 100 years; it's a useful sensor but not a critical sensor. Pilots and autopilots are perfectly capable of flying planes without it. If two AoA sensors disagree, you just stop making decisions based on the AoA sensor and fly the plane without it.
- inferiorhuman 8y agoThe crux of the problem is that the NG/MAX isn't certified to fly with malfunctioning alpha vanes. On the NG and MAX the effort required to move the control column varies based on the angle-of-attack (a.k.a. elevator feel system). On the MAX the airspeed calculation is influenced by the AoA and MCAS is triggered by data from a single alpha vane with no sanity checking. Functioning alpha vanes are critical on the MAX and NG.
- dreamcompiler 8y agoThat's the huge design flaw. They should have made the AoA sensors either critical and triply redundant, or not critical at all (as is typical).