3 ms·
Depending on the mode of operation, the pilot will or will not be part of the redundancy. The trick in this type of application is the management of mode transi
by crocal 8y ago
Depending on the mode of operation, the pilot will or will not be part of the redundancy. The trick in this type of application is the management of mode transitions.
When sensors fail, the system will transition to degraded modes of operations where the pilot will have more responsibility.
The safety case will rely on demonstrating that transition to such degraded modes is low enough to be compatible with the human rate of errors.
A modern system should not be declared safe if it relies on pilot _whatever_.
Not sayin’ it did not happen in the past. Unfortunately.
- crististm 8y agoI don't understand (all) your points. I'm questioning whether a system as the one I described can be abused to the point where redundancy is offloaded to pilot flying the plane even when it shouldn't be?
- crocal 8y agoIt can be abused, but it should not be possible if the process driving certification of such system is followed properly. The standards define checks and balances designed precisely to detect such abuse. In particular, the pilot’s rate of error is quantified and it should not be possible to abuse it without going unnoticed.