Originally Posted by
Musician
Exceptions most often end up in the type certificate as ”Special conditions” vs a specific rule where the manufacturer has shown an alternate way that is as safe or safer. So the risk assessment is showing safe enough solution.
In the case above it is due to fact that UHT has been found to not be coped with as easy as earlier thought. And (as I read it) virtually all aircraft engine has a single control unit for thrust. You would need to either show that that single failure doesn’t end up in a catastrophic scenario by being able to recognize the situation and also to control the aircraft, OR not have the single failure that can end up there OR get an exempt just as several other types has.
For the case of the TCMA I couldn’t find any exemptions in the Type Certificate coupled to TCMA or gear position sensors.
I wouldn’t think it is possible to get an exempt from “
no single failure” and
“extremely improbable” criteria for using one single sensor for the TCMA as you would need to show that your solution is as safe as the rule states.
The sensor showing wrong value, is this risk at 10^-9 or less? No it is clearly not.
Adding several sensors to the logic might take us to the 10^-9 level, and if we find the unsafe scenario to be to be in the air but the logic states “on ground” we can safe by adding the logic “if unsure - consider being in air. A logic that inhibits the shut down of a engine if the other one already was shut down could also be incorporated.
I’m sure the Boeing and GE engineers is as smart as it takes, so the single sensor question would not have been overlooked.