Quote:
Originally Posted by Hardlyrob
I find it hard to understand why a critical system would be based on one sensor, when multiple sensors are already available.
|
Because you have to distinguish which one is good and which one is bad.
In my experience (again, non-aviation) sensors provide signal status, so you default to one, and switch to another if the status goes bad. It is very, very rare for sensors to go bad and provide a
significantly bad process value without also throwing a bad status somewhere.
You can also generate an alarm if redundant signals deviate from each other by a certain amount, but then you have to decide how to respond, i.e. continue to operate or go to held/faulted state. It would be poor design to just take an average of multiple signals, without determining which one is bad, and by how much.