4 ms·

> So in this specific scenario what happened is that the flight computers for some reason didn’t transition between “normal law” and “ground law” simultaneously

> So in this specific scenario what happened is that the flight computers for some reason didn’t transition between “normal law” and “ground law” simultaneously (or close enough to simultaneously). So the COM computer significantly changed its rudder output as a result of changing law, but the MON computer didn’t, because it hadn’t changed law yet (the inverse of this is also possible). As a result they were producing very large differences in rudder orders, resulting in the monitoring watchdog killing the COM computer and failing over to the spare. Where the above situation happened a second time, resulting in all computers being shut down. Possible solution: always designate COM/MON computers which agree on the mode: flight or ground. Only disable a primary COM computer if it disagrees with the MON computer while both are running on the same mode. > There’s a separate watchdog system that monitors the outputs (orders) of both the COM and MON, and if their order values diverge by too much for too long, it shuts down the COM computer and passes control to the MON computer and the spare. So, if the MON computer is faulty it will always disable the 3 computers?

avianlyric 5y ago
> Possible solution: always designate COM/MON computers which agree on the mode: flight or ground. Only disable a primary COM computer if it disagrees with the MON computer while both are running on the same mode. I’m not sure that helps, how do know that the COM computer is correct and MON isn’t? Ultimately you only really care if the two computers are trying to the plane to do different things, if they’re in different modes but producing the same outputs I’m not sure how much you would care. > So, if the MON computer is faulty it will always disable the 3 computers? I’m just interpreting what I’ve read. If you know better then please do tell us.
- marcodiego 5y ago
  Actually, I know nothing about the subject; Please don't take my comments as such. Sorry, I should have made that clear. About the first proposal: redundancy using majority of votes is well known. Second, GP said: > There’s a separate watchdog system that monitors the outputs (orders) of both the COM and MON, and if their order values diverge by too much for too long, it shuts down the COM computer and passes control to the MON computer and the spare. What I read from this is: COM differs from MON; watchdog disables COM and uses MON and spare as a new COM/MON. But if previous MON was faulty, it will still differ from spare (except if both are failing in a sufficiently similar way).
flavius29663 5y ago
Another possible solution: if the mode change is not unanimous, ask the pilots! The pilots might not know, (e.g. when landing in fog - famous accidents happened because of this), but at that point a go round or diversion to another airport seems to be the safest plan of action.
- ahartmetz 5y ago
  The pilot in command has ~no spare capacity during touchdown, full focus is required for rudder and stick. Especially during crosswind landings. The other pilot probably shouldn't be expected to make such a decision in a second out of the blue.
  - flavius29663 5y ago
    The copilot could press a button as soon as the plane lands, if and only if he is certain the plane touched down. Then, if the computers can't decide, use that input for a decision. Literally asking and then awaiting a reply is slow indeed.

avianlyric 5y ago

> Possible solution: always designate COM/MON computers which agree on the mode: flight or ground. Only disable a primary COM computer if it disagrees with the MON computer while both are running on the same mode. I’m not sure that helps, how do know that the COM computer is correct and MON isn’t? Ultimately you only really care if the two computers are trying to the plane to do different things, if they’re in different modes but producing the same outputs I’m not sure how much you would care. > So, if the MON computer is faulty it will always disable the 3 computers? I’m just interpreting what I’ve read. If you know better then please do tell us.

marcodiego 5y ago
Actually, I know nothing about the subject; Please don't take my comments as such. Sorry, I should have made that clear. About the first proposal: redundancy using majority of votes is well known. Second, GP said: > There’s a separate watchdog system that monitors the outputs (orders) of both the COM and MON, and if their order values diverge by too much for too long, it shuts down the COM computer and passes control to the MON computer and the spare. What I read from this is: COM differs from MON; watchdog disables COM and uses MON and spare as a new COM/MON. But if previous MON was faulty, it will still differ from spare (except if both are failing in a sufficiently similar way).

flavius29663 5y ago

Another possible solution: if the mode change is not unanimous, ask the pilots! The pilots might not know, (e.g. when landing in fog - famous accidents happened because of this), but at that point a go round or diversion to another airport seems to be the safest plan of action.

ahartmetz 5y ago
The pilot in command has ~no spare capacity during touchdown, full focus is required for rudder and stick. Especially during crosswind landings. The other pilot probably shouldn't be expected to make such a decision in a second out of the blue.
- flavius29663 5y ago
  The copilot could press a button as soon as the plane lands, if and only if he is certain the plane touched down. Then, if the computers can't decide, use that input for a decision. Literally asking and then awaiting a reply is slow indeed.