JF Mezei wrote:
On 2016-10-23 18:15, jacob navia wrote:
http://www.esa.int/var/esa/storage/i...images/2016/02
/exomars_2016_schiaparelli_descent_sequence_16_9/15826994-1-eng-GB/ExoMars_2016_Schiaparelli_descent_sequence_16_9.jp g


Sometimes, it has to be "learned".

Airbus had fancy software on its A320 to protect against accidental
deployment of spoilers and thrust reversers. (which had caused some
crashes in the past). It required the nose wheel to spin AND pressure
switch indicating wheight on the wheel.

Problem happened when plane landed during storm, and hyroplaned, so nose
wheel did not spin and pilot unable to deploy spoilers/thrust reversers.
They likely changed the "and" to a "or".


What if the heat shield did not get out of the way and the craft got
within 4m from it, triggering the radar to say "4m altitude, turn off
the thrusters" ?

The "software" solution would have to consider vertical descent speed
"do not turn off thrusters if vertical speed is greater than 4km/h no
matter what altitude you're at". So the shield obstructig radar would
not have caused thrusters to turn off. But as long as hield was in the
way, it would have to use IMU to deduct its vertical speed and be flying
bnlind.

When the radar does not work correctly so there is no correct height
figure available, there probably will be no correct vertical speed
figure either (which is likely derived from the changing height).

In Turkish Airlines 1951 the radar altimeter was defective and indicated
a constant value near zero, which caused the plane to flare and the
engines to go to idle while it was still 300ft in the air.
Curiously there were redundant altimeters (radar and barometric) but
only the value of a single radar altimeter was used for this function
even when it is defective. Clearly a design error.

Redundant hardware also isn't always the solution, especially when it
is identical and running the same software. See Ariane 501.