4 ms·
I find it surprising when a system is considered "redundant" when the _pilot_ is part of redundancy!? If this is an accepted solution then it is very easy to be
by crististm 8y ago
I find it surprising when a system is considered "redundant" when the _pilot_ is part of redundancy!? If this is an accepted solution then it is very easy to be abused: sensors fail, never mind, pilot has eyes and can deactivate a malfunctioning _whatever_.
- crocal 8y agoDepending on the mode of operation, the pilot will or will not be part of the redundancy. The trick in this type of application is the management of mode transitions. When sensors fail, the system will transition to degraded modes of operations where the pilot will have more responsibility. The safety case will rely on demonstrating that transition to such degraded modes is low enough to be compatible with the human rate of errors. A modern system should not be declared safe if it relies on pilot _whatever_. Not sayin’ it did not happen in the past. Unfortunately.
- crististm 8y agoI don't understand (all) your points. I'm questioning whether a system as the one I described can be abused to the point where redundancy is offloaded to pilot flying the plane even when it shouldn't be?
- crocal 8y agoIt can be abused, but it should not be possible if the process driving certification of such system is followed properly. The standards define checks and balances designed precisely to detect such abuse. In particular, the pilot’s rate of error is quantified and it should not be possible to abuse it without going unnoticed.