Re: Boeing and Dreamliner

["Robert I. Eachus" <rieachus@attbi.com>]

Alexander Kopilovitch wrote:

> I read this report yesterday, and now I'd like to make several comments.

Good.

>>... it doesn't take a 
>>genius to tell you what that ten second period of "pressure surges" in 
>>the flight control hydraulics was.  But of course the politics of the 
>>situation kept the fact that oscillations were building up in the stack 
> 
>>from being an obvious part of the official report--and from being left 
> 
>>out of it:

> "These nozzle deflections were commanded by the On-Board Computer (OBC)
> software on the basis of data transmitted by the active Inertial Reference
> System (SRI 2). Part of these data at that time did not contain proper flight
> data, but showed a diagnostic bit pattern of the computer of the SRI 2, which
> was interpreted as flight data."
> 
> "The reason why the active SRI 2 did not send correct attitude data was that
> the unit had declared a failure due to a software exception."

This happened at around 38 seconds.  The "hunting" of the flight 
guidance system was prior to that.  Ten Hertz (cycles per second) is 
almost certainly not due to any of the inertial moments of the system 
but a multiple of the SRI clock.

> First, there was protocol error, so the "bugs" weren't localized in SRI.
> Second, possibly there were other inconsistensies in SRI software. and those
> additional inconsistencies might influence that "diagnostic pattern". which
> was transmitted to OBC.

Correct, the OBC did no validation or sanity checks on the information 
sent from the SRI to the engine controls.  Nothing wrong with that--if 
you understand that the SRIs are category 1 systems. (Failure will cause 
system failure.) I didn't like at all the idea of sending diagnostic 
data over the bus from SRI to OBC, but it can be justified by this view 
that failure of the SRIs leads to failure of the system, and you want to 
get as much diagnostic information as possible before the telemetry 
fails as the Ariane is blown up.

But the other systemic mistake that I an nowhere near comfortable with 
was the implicit idea that that the SRI software must be correct.  I 
would prefer in the first Ariane 5 launched to allow for the possibility 
that the flight dynamics model doesn't perfectly match the actual 
system.  This would argue for a diagnostic data stream that shows the 
deviations between the model and the system, while still continuing the 
"best effort" to fly the Ariane.

In other words, the SRI should send both engine deflection commands and 
diagonstic data to the OBC.

 > They simply put the software written for previous model --
 > Ariane 4 (where it worked well) -- to new Ariane 5, and did not bother
 > themselves with testing it on the new rocket before the launch. So,
 > when the Ariane 4 software appeared (in the flight) incompatible with
 > new Ariane 5 they became very surprised -- and blamed the software.

Before the Ariane 501 disaster, the shorthand for this problem with 
reuse was that an M2 tank is not an M1 tank.  In other words, you have 
to repeat the requirements definition part of the effort. Even if you 
can, in the end, reuse the software without change.  Of course, now we 
just say Ariane 5.