Comment by jpollock

The design of the system is very interesting, particularly how it expects to handle errors.

In 90's Telco, you used to have a pair of systems and if they disagreed, they would decide which side was bad and disable it.

In modern cloud, you accept there are errors. There's another request in ~10+ms. You only look when the error rate becomes commercially important.

My understanding of spacecraft is that there would be 3 independent implementations and they would vote.

The plane has a matrix of sensors and systems, allowing faults to be bubbled up and bad elements disabled independently.

The ADIRU does compare values to detect failures (median of 3 sensors), but they could only detect errors that last >1s. The flight computer used the raw data - because the sensors aren't interchangeable (they won't have consistent readings in all flight modes)!

Very nifty.

One thing, they say "memorisation period", I don't think it's a memorisation period? From my reading of the algorithm, it should be more "last value retention period"? Or "sensor spurious fault reading delay"?

Section 2.1 A330/A340 flight control system design "AOA computation logic"

https://www.atsb.gov.au/sites/default/files/media/3532398/ao...