There was a third system, the fallback they used to prevent loss of life, legacy systems and a system shutdown.
You can argue thats not a sufficient third redundancy, I don't have enough context to throw an opinion out there on the safety of this particular infrastructure project.
I am confident that the fallback process was considered and kept in place as the tertiary backup.
Excellent point though. It took me some thinking to put myself back in SRM mindset and what they'd have considered here.
> Which is why many systems on most airliners are redundant in threes
Not really. Triplex redundancy is based on a failure model where failures can produce arbitrary output. Three systems allows majority voting (often, median select) to provide correct output in the presence of a single arbitrary failure. It allows detection of double-fail-silent failures and uncorrelated double failures, but that's not really the point, since continued operation under these conditions is at risk, and failing nonoperational isn't often acceptable for these systems. (You'll also see quadruplex systems that use the same voting mechanism to detect and disable failed channels, allowing handling two arbitrary non-simultaneous failures, for systems that need a longer window of continued operation after failure.)
If you change the failure modes, you change the architecture. These days you often see dual-dual systems where each pair of systems cross-checks and disables itself on mismatch, converting a single arbitrary failure to a single silent failure; which then allows downstream systems to accept inputs from two such fail-silent systems and trust either that is providing output, removing the need for a median select.
Very interesting, I’d love to learn more. Is there anything you’d recommend in terms of a general introduction to different kinds of fault tolerance? Literature, video material, could be whatever.
The 747 had 4 independent hydraulic systems (one for each engine). There were still failures that took out all 4. What comes to mind is the one where the rear pressure bulkhead failed (due to a faulty repair), and the decompression took out the rudder and all 4 hydraulics.
The pilot no longer had flight controls. He desperately tried to control the airplane using variable thrust, but it just wasn't good enough, and crashed into a mountainside.
The fix was to add automatic valves in the lines so loss of pressure wouldn't bleed out the whole system.
Which is why many systems on most airliners are redundant in threes (though under double fault may operate in a degraded mode).
There was a third system, the fallback they used to prevent loss of life, legacy systems and a system shutdown.
You can argue thats not a sufficient third redundancy, I don't have enough context to throw an opinion out there on the safety of this particular infrastructure project.
I am confident that the fallback process was considered and kept in place as the tertiary backup.
Excellent point though. It took me some thinking to put myself back in SRM mindset and what they'd have considered here.
> Which is why many systems on most airliners are redundant in threes
Not really. Triplex redundancy is based on a failure model where failures can produce arbitrary output. Three systems allows majority voting (often, median select) to provide correct output in the presence of a single arbitrary failure. It allows detection of double-fail-silent failures and uncorrelated double failures, but that's not really the point, since continued operation under these conditions is at risk, and failing nonoperational isn't often acceptable for these systems. (You'll also see quadruplex systems that use the same voting mechanism to detect and disable failed channels, allowing handling two arbitrary non-simultaneous failures, for systems that need a longer window of continued operation after failure.)
If you change the failure modes, you change the architecture. These days you often see dual-dual systems where each pair of systems cross-checks and disables itself on mismatch, converting a single arbitrary failure to a single silent failure; which then allows downstream systems to accept inputs from two such fail-silent systems and trust either that is providing output, removing the need for a median select.
Very interesting, I’d love to learn more. Is there anything you’d recommend in terms of a general introduction to different kinds of fault tolerance? Literature, video material, could be whatever.
3 replies →
The 747 had 4 independent hydraulic systems (one for each engine). There were still failures that took out all 4. What comes to mind is the one where the rear pressure bulkhead failed (due to a faulty repair), and the decompression took out the rudder and all 4 hydraulics.
The pilot no longer had flight controls. He desperately tried to control the airplane using variable thrust, but it just wasn't good enough, and crashed into a mountainside.
The fix was to add automatic valves in the lines so loss of pressure wouldn't bleed out the whole system.
JAL 123
“Two is one and one is none” as the saying goes.
> The primary was being inspected
So in reality you didn't have two systems.
otherwise you would have shut down operations until you had another connection live, so you had 2 online connections.