Boeing: from redundancy to fault tolerant control

Boeing on the other hand, follows the fault tolerance through detailed hardware redundancy. It is achieved by providing two or more physical copies of a hardware component.

Boeing’s redundancy core lies on the triple redundancy of hardware resources for the Flight Control Computer.

FCC are configured as a Triple Modular Redundancy (TMR) system. IT implies that the three computers use three internal channels that use different processor hardware from different manufacturers.

Within each computer, the choice of which output is to be the output of the computer is determined using the principle of median value select. This approach considers:

1. A common area faults: by designing the systems to both component and functional separation requirements.
2. Segregated FCC components: isolation and separation of redundant flight control elements to the greatest extent possible.
3. Accurate FCC component distribution: allocation of electrical power to the primary flight computer and the actuator control electronics to provide maximum physical and electrical separation. The functional actuator control is distributed to maximize controllability in all axes after loss of function, while the hydraulic systems are also aligned with the actuator functions to…