3 ms·
The power grid is in fact a graph, not a tree, and not a grid. It is automatically able to route around failures, and it does route around the failures. These f
by nwallin 5y ago
The power grid is in fact a graph, not a tree, and not a grid. It is automatically able to route around failures, and it does route around the failures. These failures happen every day, but people almost never notice. Almost.
The trouble is that the power grid just operates on the electrical principle of electricity following the path of least resistance. So if there's low resistance but low capacity line between generation and usage, the electricity will flow through it, and there is no QoS on the line that can limit how much power goes through it, besides on/off.
The on/off nature of the interconnections is what makes the power grid fragile. If a interconnection has a rating of 100MW or whatever, and the grid attempts to pump 110MW through it, you either leave it on and hope it doesn't break or shut it off and pump 0MW. The grid will then automatically route that 110MW through other interconnects. If there is a nearby 500MW interconnect that is currently pumping 350MW, you're fine, but if it's pumping 475MW, you're probably not. This can lead to cascading failures.
The grid does have the ability to shut down usage if there's a danger of a cascading failure. For instance, if your 100MW rated interconnect has 101MW coursing through it, you can shut down a neighborhood that's using 10MW or whatever, and keep the 100MW interconnect online with just 91MW running through it. This is what brownouts and rolling blackouts are.
The grid can have major failures, but these major failures don't happen unless there are multiple overlapping minor failures. Similarly, if your 737 MAX has 2 MCAS sensors and 1 manual MCAS override button, and both your sensors and your manual override all fail, you're going to have a bad time. Look at the sequence of events of the 2003 Northeast blackout: https://en.wikipedia.org/wiki/Northeast_blackout_of_2003#Sequence_of_events https://en.wikipedia.org/wiki/Northeast_blackout_of_2003#Seq... There are at least half a dozen failures between the initial problem at 12:15pm and until the point of no return failure at 4:05pm that if handled properly would have averted the crisis and turned it into a minor inconvenience. At least half a dozen instances of human error plus multiple instances of equipment failures. If an aircraft had that many things go wrong all at once, the plane's going down.
Note that the Texas power outage last year wasn't like this at all. The grid actually kept working fine, the problem is that there were lots of generators that failed as a result of the cold, mostly due to impure natural gas freezing. The generation capacity of the grid was cut to a fraction of its capacity, and as a result, they shut down a bunch of cities to reduce load. For whatever reason, they just left power off in several cities for days instead of doing rolling blackouts. I don't know enough about the circumstances to speculate on what the reason for that is.
- WalterBright 5y agoThe MAX failure illustrates what happens when one relies on one "cannot fail" component. But you should know that there was a backup. 3 crews experience MCAS failure. 2 crashed. The 3rd crew simply turned off the stab trim system and completed the flight safely. You almost never hear about crew #3. I can't really offer any suggestions for the power grid, as I don't know enough about it, except that I'm sure there's a way :-)
- bombcar 5y agoAnd a key there is “never fix software or hardware by depending on humans” because we’re always the weak link. And in cases like zero trust it may mean things like “make sure it works so well you don’t have people resetting access over the phone” or requiring an in-person replacement of a security token, etc.
- WalterBright 5y agoI agree that the MAX design should have been fully redundant. But the only reason there are pilots at all on an airliner is to deal with the unexpected. I was told about one case where the elevator actuators froze in the slightly nose up position. The pilot called the cabin, and asked everyone to pack themselves into the front. With that he managed to bring enough pitch control to land it safely, but it surely was a terrifying ordeal for everyone on board. (The actuators froze because of water buildup turning to ice at altitude. Actuators are now heavily designed and tested with freezing water. The stab trim test for this was quite thorough - the motors were very powerful and the ice scrapers on the nut would just peel the ice off. I also enlarged the drain holes in my car doors to Boeing spec so water wouldn't build up in them and rust.)
- unscaled 5y agoThe Ethiopian Airlines crew that crashed also turned off the stab trim[1]. The problem is that you couldn't turn off MCAS separately from the fly-by-wire trim control, so you could either have fly-by-wire with MCAS or manual trim control without it. Unfortunately for the Ethiopian Airlines crew, they were too late. By the time they set the stabilizer trim to CUT OUT, MCAS already pushed the plane nose down too much and they couldn't manage them manual controls, which were pretty hard to use under extreme conditions[2]. I'm not an expert or even an amateur, but the engineering issue I see here is that Boeing really left no contingency plan for a catastrophically failing AoA sensor on take-off. You can't turn off MCAS directly, and the recommended indirect method for turning it off require skills that many (most?) commercial airline pilots are not trained for. The worst thing, of course, is that the Lion Air crew that crashed wasn't even aware of MCAS. The 737 MAX manuals made no mention of it. [1]: https://en.wikipedia.org/wiki/Ethiopian_Airlines_Flight_302 https://en.wikipedia.org/wiki/Ethiopian_Airlines_Flight_302 [2]: https://www.cliffordlaw.com/boeing-faa-knew-manual-stab-trim-was-unlikely-at-high-speed-but-failed-to-warn-after-lion-air/ https://www.cliffordlaw.com/boeing-faa-knew-manual-stab-trim...