Best practices matter when designing control systems
When lives depend on control system design (and even when they don’t), best practices matter. Here’s what I’d like control system designers to know.
Nov. 18, 2020, UPDATE to this Nov. 13, 2019, “Think Again” Control Engineering commentary: On Nov. 18, the FAA approved Boeing’s request to resume Boeing 737 Max (737-8 and 737-9) operations.
Addressing design changes, Boeing said in an Oct. 25, 2019, statement: “Boeing has redesigned the way angle of attack (AoA) sensors work with a feature of the flight control software known as maneuvering characteristics augmentation system (MCAS). Going forward, MCAS will compare information from both AoA sensors before activating, adding a new layer of protection. In addition, MCAS will now only turn on if both AoA sensors agree, will only activate once in response to erroneous AOA, and will always be subject to a maximum limit that can be overridden with the control column. These software changes will prevent the flight control conditions that occurred in this accident from ever happening again. In addition, Boeing is updating crew manuals and pilot training, designed to ensure every pilot has all of the information they need to fly the 737 MAX safely.”
Addressing changes to Boeing company policies, a Nov. 18 Boeing statement said: “In addition to changes made to the airplane and pilot training, Boeing has taken three important steps to strengthen its focus on safety and quality.
- Organizational alignment: More than 50,000 engineers have been brought together in a single organization that includes a product and services Safety unit, unifying safety responsibilities across the company.
- Cultural focus: Engineers have been further empowered to improve safety and quality. The company is identifying, diagnosing and resolving issues with a higher level of transparency and immediacy.
- Process enhancements: By adopting next-generation design processes, the company is enabling greater levels of first-time quality. For more information, visit www.Boeing.com/737-max-updates.”
Original Nov. 13, 2019, post follows.
When lives depend on an automated control system, the system should fail safely. When components fail in a control system, operators should receive clear, immediate guidance on status so proper decisions can be made immediately in manual mode. If a set of circumstances could occur where the failure of one sensor causes a control system failure before operators can recover safely, then the system needs a sensor backup or two to provide data instead. Best two-out-of-three voting designs decrease risk.
Education and training matter
Information continue to emerge in the Boeing 737 Max grounding, and some details seem contrary to what was said earlier. Through it all, I keep thinking:
- People get degrees in control engineering for a reason.
- People earn safety certifications for a reason.
- Listen to people with training and experience who use standards and best practices.
- Listen to operators who know the process.
- If you see something that doesn’t seem right, and lives (and/or livelihoods) depend on it, be a whistleblower.
Before I get onto another Boeing 737 Max, I will find out if there’s a backup angle of attack sensor also delivering measurements and what happens to the control system when that sensor and/or the backup sensor fails. If I don’t like the answer, I’ll think again and book another aircraft.
Mark T. Hoske is content manager, Control Engineering, CFE Media, mhoske@cfemedia.com.
KEYWORDS: Critical control systems, safety systems, single point of failure
Control system design best practices
Safety system design best practices
Be a whistleblower if something doesn’t look right.
CONSIDER THIS
Will you be a whistleblower when lives and/or livelihoods are on the line?
Control Engineering has many articles on related topics; it’s hard to pick a few.
- Avoiding nuisance trips from SIFS
- Four overlooked aspects of risk management, process safety
- Safety instrumented systems: Applying measurement best practices
- Comparing conventional and sustainable safety instrumented systems
- Process safety: Shutdown failures
- Sustainable cybersecurity architecture for safety instrumented systems
Do you have experience and expertise with the topics mentioned in this content? You should consider contributing to our CFE Media editorial team and getting the recognition you and your company deserve. Click here to start this process.
