Misplaced Pages

#475524

99-490: The goal of any engine control system is to allow the engine to perform at maximum efficiency for a given condition. Originally, engine control systems consisted of simple mechanical linkages connected physically to the engine. By moving these levers the pilot or the flight engineer could control fuel flow, power output, and many other engine parameters. The Kommandogerät mechanical/hydraulic engine control unit for Germany's BMW 801 piston aviation radial engine of World War II

198-479: A Rolls-Royce Olympus Mk 320. In the 1970s, NASA and Pratt and Whitney experimented with their first experimental FADEC, first flown on an F-111 fitted with a highly modified Pratt & Whitney TF30 left engine. The experiments led to Pratt & Whitney F100 and Pratt & Whitney PW2000 being the first military and civil engines, respectively, fitted with FADEC, and later the Pratt & Whitney PW4000 as

297-444: A fail-fast component is designed to report at the first point of failure, rather than generating reports when downstream components fail. This allows easier diagnosis of the underlying problem, and may prevent improper operation in a broken state. A single fault condition is a situation where one means for protection against a hazard is defective. If a single fault condition results unavoidably in another single fault condition,

396-415: A minimal layout, to ensure wide accessibility and outreach , such as on game consoles with limited web browsing capabilities. A highly fault-tolerant system might continue at the same level of performance even though one or more components have failed. For example, a building with a backup electrical generator will provide the same voltage to wall outlets even if the grid power fails. A system that

495-439: A "separate" cowling attached to the fuselage of the aircraft. Engines were typically delivered from BMW complete in their cowling, ready to be bolted to the front of the aircraft or nacelle, since 1942 as Motoranlage (M) and 1944/1945 as Triebwerksanlage (T) . The Motoranlage was the original form of the interchangeable Kraftei , or " power-egg ", unitized powerplant installation concept used in many German wartime aircraft. It

594-471: A FADEC. The flight crew first enters flight data such as wind conditions, runway length, or cruise altitude, into the flight management system (FMS). The FMS uses this data to calculate power settings for different phases of the flight. At take-off, the flight crew advances the power lever to a predetermined setting, or opts for an auto-throttle take-off if available. The FADECs now apply the calculated take-off thrust setting by sending an electronic signal to

693-637: A completely interchangeable unit. Both M and T formats were also used with various inline engines, like the Daimler-Benz DB 603 used for both the inline-engined versions of the Do 217 and the enormous BV 238 flying boat, and the Junkers Jumo 213 powerplants used for later marks of the Ju 88 multirole aircraft. The M and T unitized engine formats added secondary designator suffixes, which especially for

792-572: A flat piece of road on which to stop. Alternatively, on shallow gradients, the transmission can be shifted into Park, Reverse or First gear, and the transmission lock / engine compression used to hold it stationary, as there is no need for them to include the sophistication to first bring it to a halt. On motorcycles, a similar level of fail-safety is provided by simpler methods; first, the front and rear brake systems are entirely separate, regardless of their method of activation (that can be cable, rod or hydraulic), allowing one to fail entirely while leaving

891-404: A hardware level. The figure of merit is called availability and is expressed as a percentage. For example, a five nines system would statistically provide 99.999% availability. Fault-tolerant systems are typically based on the concept of redundancy. Research into the kinds of tolerances needed for critical systems involves a large amount of interdisciplinary work. The more complex the system,

990-412: A number of penalties: increase in weight, size, power consumption, cost, as well as time to design, verify, and test. Therefore, a number of choices have to be examined to determine which components should be fault tolerant: An example of a component that passes all the tests is a car's occupant restraint system. While the primary occupant restraint system is not normally thought of, it is gravity . If

1089-412: A system for injecting a 50–50 water-methanol mixture known as MW50 into the supercharger primarily for its anti-detonation effect, allowing the use of increased boost pressures. Secondary effects were cooling of the engine and charge cooling. Some performance was gained, but at the cost of engine service life. This was replaced by a system that injected fuel instead of MW50, known as C3-injection, and this

SECTION 10

#1732776640476

1188-468: A system's capability to handle faults without any degradation or downtime. In the event of an error, end-users remain unaware of any issues. Conversely, a system that experiences errors with some interruption in service or graceful degradation of performance is termed 'resilient'. In resilience, the system adapts to the error, maintaining service but acknowledging a certain impact on performance. Typically, fault tolerance describes computer systems , ensuring

1287-409: A warning to the operator, and it is still the most common form of level one fault-tolerant design in use today. Voting was another initial method, as discussed above, with multiple redundant backups operating constantly and checking each other's results. For example, if four components reported an answer of 5 and one component reported an answer of 6, the other four would "vote" that the fifth component

1386-470: Is pair-and-spare . Two replicated elements operate in lockstep as a pair, with a voting circuit that detects any mismatch between their operations and outputs a signal indicating that there is an error. Another pair operates exactly the same way. A final circuit selects the output of the pair that does not proclaim that it is in error. Pair-and-spare requires four replicas rather than the three of TMR, but has been used commercially. Failure-oblivious computing

1485-403: Is a technique that enables computer programs to continue executing despite errors . The technique can be applied in different contexts. It can handle invalid memory reads by returning a manufactured value to the program, which in turn, makes use of the manufactured value and ignores the former memory value it tried to access, this is a great contrast to typical memory checkers , which inform

1584-409: Is a technique to avoid catastrophic failures in distributed systems. Redundancy is the provision of functional capabilities that would be unnecessary in a fault-free environment. This can consist of backup components that automatically "kick in" if one component fails. For example, large cargo trucks can lose a tire without any major consequences. They have many tires, and no one tire is critical (with

1683-618: Is available to stream an online video, a lower-resolution version might be streamed in place of the high-resolution version. Progressive enhancement is another example, where web pages are available in a basic functional format for older, small-screen, or limited-capability web browsers, but in an enhanced version for browsers capable of handling additional technologies or that have a larger display. In fault-tolerant computer systems, programs that are considered robust are designed to continue operation despite an error, exception, or invalid input, instead of crashing completely. Software brittleness

1782-422: Is being used as a one-time backup for the footbrake, will not cause immediate danger if it is found to be nonfunctional at the moment of application. Therefore, no redundancy is built into it per se (and it typically uses a cheaper, lighter, but less hardwearing cable actuation system), and it can suffice, if this happens on a hill, to use the footbrake to momentarily hold the vehicle still, before driving off to find

1881-412: Is designed to fail safe , or fail-secure, or fail gracefully , whether it functions at a reduced level or fails completely, does so in a way that protects people, property, or data from injury, damage, intrusion, or disclosure. In computers, a program might fail-safe by executing a graceful exit (as opposed to an uncontrolled crash) to prevent data corruption after an error occurs. A similar distinction

1980-498: Is further classified into hardware, software and information redundancy, depending on the type of redundant resources added to the system. In time redundancy the computation or data transmission is repeated and the result is compared to a stored copy of the previous result. The current terminology for this kind of testing is referred to as 'In Service Fault Tolerance Testing or ISFTT for short. Fault-tolerant design's advantages are obvious, while many of its disadvantages are not: There

2079-495: Is in error when a two-to-one vote is observed. In this case, the voting circuit can output the correct result, and discard the erroneous version. After this, the internal state of the erroneous replication is assumed to be different from that of the other two, and the voting circuit can switch to a DMR mode. This model can be applied to any larger number of replications. Lockstep fault-tolerant machines are most easily made fully synchronous , with each gate of each replication making

SECTION 20

#1732776640476

2178-409: Is made between "failing well" and " failing badly ". A system designed to experience graceful degradation , or to fail soft (used in computing, similar to "fail safe" ) operates at a reduced level of performance after some component fails. For example, if grid power fails, a building may operate lighting at reduced levels or elevators at reduced speeds. In computing, if insufficient network bandwidth

2277-503: Is still working, as of early 2022. Hyper-dependable computers were pioneered mostly by aircraft manufacturers, nuclear power companies, and the railroad industry in the United States. These entities needed computers with massive amounts of uptime that would fail gracefully enough during a fault to allow continued operation, while relying on constant human monitoring of computer output to detect faults. Again, IBM developed

2376-508: Is the opposite of robustness. Resilient networks continue to transmit data despite the failure of some links or nodes. Resilient buildings and infrastructure are likewise expected to prevent complete failure in situations like earthquakes, floods, or collisions. A system with high failure transparency will alert users that a component failure has occurred, even if it continues to operate with full performance, so that failure can be repaired or imminent complete failure anticipated. Likewise,

2475-462: Is to provide optimum engine efficiency for a given flight condition. FADEC not only provides for efficient engine operation, it also allows the manufacturer to program engine limitations and receive engine health and maintenance reports. For example, to avoid exceeding a certain engine temperature, the FADEC can be programmed to automatically take the necessary measures without pilot intervention. With

2574-619: The Pratt & Whitney Hornet engines. By the mid-30s they had introduced an improved version, the BMW 132 . The BMW 132 was widely used, most notably on the Junkers Ju 52 , which it powered for much of that design's lifetime. In 1935 the RLM funded prototypes of two much larger radial designs, one from Bramo , the Bramo 329, and another from BMW, the BMW 139 . BMW's design used many components from

2673-635: The Royal Air Force Museum London (see photo above) also has unitized BMW 801 radials installed. The 801 was a radial engine with two rows of seven cylinders. The cylinders had both bore and stroke of 156 millimetres (6.1 in), giving a total capacity of 41.8 litres (2,550 cu in), just a bit less than the American Wright Cyclone 14 twin-row radial of some 1,600 to 1,900 hp output. The unit (including mounts) weighed from 1,010 to 1,250 kg and

2772-553: The cowling behind the engine in place of the original slots. The 801C was almost exclusively used in early variants of the Focke-Wulf Fw 190 A. The BMW 801L was an A model with the hydraulic prop control mechanism introduced with the 801C engine. The C and L models delivered the same power as the original A model. The 801C was replaced with the BMW 801 D-2 series engines in early 1942, which ran on C2/C3 100 octane fuel instead of

2871-404: The crash of an Airbus A400M aircraft at Seville Spain on 9 May 2015 . Airbus Chief Strategy Officer Marwan Lahoud confirmed on 29 May that incorrectly installed engine control software caused the fatal crash. "There are no structural defects [with the aircraft], but we have a serious quality problem in the final assembly." A typical civilian transport aircraft flight may illustrate the function of

2970-589: The mean time between failures should be long enough for the operators to have sufficient time to fix the broken devices ( mean time to repair ) before the backup also fails. It is helpful if the time between failures is as long as possible, but this is not specifically required in a fault-tolerant system. Fault tolerance is notably successful in computer applications. Tandem Computers built their entire business on such machines, which used single-point tolerance to create their NonStop systems with uptimes measured in years. Fail-safe architectures may encompass also

3069-571: The (most notoriously of all) TJ for the BMW 801J turbocharged radial subtype, and the TQ models, further confusing the issue. Data from Related development Comparable engines Related lists Fault tolerant Fault tolerance is the ability of a system to maintain proper operation despite failures or faults in one or more of its components. This capability is essential for high-availability , mission-critical , or even life-critical systems . Fault tolerance specifically refers to

FADEC - Misplaced Pages Continue

3168-465: The 801 radial (and perhaps others), did not always match the letter suffix that designated the bare radial engine used for a particular unitized installation, confusing the naming of the 801 engine series' subtypes considerably. These suffix designators initially referred to these complete kits and their "bare" engine counterparts almost interchangeably. The A, B and L models were known (logically) as Motoranlage style MA, MB and ML engines in this form, but

3267-477: The 801 was the Kommandogerät (command-device), a mechanical-hydraulic unit that automatically adjusted engine fuel flow, propeller pitch, supercharger setting, mixture and ignition timing in response to a single throttle lever, dramatically simplifying engine control. The Kommandogerät could be considered to be a precursor to the engine control units used for many vehicles' internal combustion engines of

3366-456: The A/B/C/L's B4 87 octane, boosting takeoff power to 1,700 PS (1,677 hp, 1,250 kW). The BMW 801G-2 and H-2 models were D-2 engines modified for use in bomber roles with lower gear ratios for driving larger propellers, clockwise and counterclockwise respectively. As with the 801B engine design, however, the 801H-2 engine did not leave the prototype stage. The D-2 models were tested with

3465-412: The BMW 132 to create a two-row engine with 14 cylinders, supplying 1,550 PS (1,529 hp, 1,140 kW). After BMW bought Bramo in 1939 both projects were merged into the BMW 801, learning from the problems encountered in both projects. The BMW 139 was originally intended to be used in roles similar to those of the other German radials, namely bombers and transport aircraft , but midway through

3564-402: The E model was not widely used. Instead, continued improvements to the basic E model led to the BMW 801F, which dramatically improved performance across the board, with takeoff power increasing to 2,400 hp (1,790 kW), making the 801 the only German aviation engine of an existing type that had a producible subtype that could exceed 1,500 kW from a proven military aircraft powerplant. It

3663-691: The Focke-Wulf Fw 190s that they powered in World War II. The first original Fw 190 to be restored to flight condition in the 21st century is the Fw 190A-5 discovered near St. Petersburg, Russia in 1989, bearing Werknummer 151 227 and formerly serving with JG 54 , was restored to flight condition along with its original BMW 801 powerplant. As of 2011, it is once again airworthy and located in Seattle , Washington , USA . The sole surviving Ju 388 , in

3762-580: The common D-2 was instead known as the MG. As the war wore on the confusion increased, the E model was delivered as the Triebwerksanlage style TG or TH, seemingly suggesting a relation to the G and H engines, but in fact those were delivered as the TL and TP. It is rather common to see the turbocharged versions referred to only with the T for the more completely unitized Triebwerksanlage installations, notably

3861-421: The compiled program binary directly and does not need to recompile to program. It uses the just-in-time binary instrumentation framework Pin . It attaches to the application process when an error occurs, repairs the execution, tracks the repair effects as the execution continues, contains the repair effects within the application process, and detaches from the process after all repair effects are flushed from

3960-584: The complex 803 four-row radial only receiving attention to its design-development. By contrast, Allied equivalents such as the American Wright Twin Cyclone , and the Soviet Shvetsov ASh-82 radials never needed to be developed beyond 1,500 kW as these nations possessed larger-displacement 18-cylinder radial aviation engines capable of more power. As just one result of the highest level of priority given to

4059-470: The computer software, for example by process replication . Data formats may also be designed to degrade gracefully. HTML for example, is designed to be forward compatible , allowing Web browsers to ignore new and unsupported HTML entities without causing the document to be unusable. Additionally, some sites, including popular platforms such as Twitter (until December 2020), provide an optional lightweight front end that does not rely on JavaScript and has

FADEC - Misplaced Pages Continue

4158-443: The concerns about drag. Tank felt that attention to detail could result in a streamlined radial that would not suffer undue drag, and would be competitive with inlines. The main concern was providing cooling air over the cylinder heads, which generally required a very large opening at the front of the aircraft. Tank's solution for the BMW 139 was to use an engine-driven fan behind an oversized, flow-through hollow prop-spinner open at

4257-410: The core could be controlled by moving the metal ring slightly forward or aft in order to open or close the gap. The reasons for this complex system were threefold. One was to eliminate any extra aerodynamic drag that a protruding oil cooler would produce, in this case eliminating the extra drag factor by enclosing it within the engine's forward cowling. The second was to warm the air before it flowed to

4356-593: The definition of FADEC. FADEC works by receiving multiple input variables of the current flight condition including air density , power lever request position, engine temperatures, engine pressures, and many other parameters. The inputs are received by the EEC and analyzed up to 70 times per second. Engine operating parameters such as fuel flow, stator vane position, air bleed valve position, and others are computed from this data and applied as appropriate. FADEC also controls engine starting and restarting. The FADEC's basic purpose

4455-399: The demands on it are in line with normal traffic flow. The cumulatively unlikely combination of total foot brake failure with the need for harsh braking in an emergency will likely result in a collision, but still one at lower speed than would otherwise have been the case. In comparison with the foot pedal activated service brake, the parking brake itself is a less critical item, and unless it

4554-426: The design of fault-tolerant computer systems for online transaction processing . Hardware fault tolerance sometimes requires that broken parts be taken out and replaced with new parts while the system is still operational (in computing known as hot swapping ). Such a system implemented with a single backup is known as single point tolerant and represents the vast majority of fault-tolerant systems. In such systems

4653-497: The design, including the use of sodium -cooled valves and a direct fuel injection system, manufactured by Friedrich Deckel AG of Munich. The supercharger was rather basic in the early models, using a single-stage two-speed design directly geared to the engine (unlike the DB 601 's hydraulically clutched version) which led to rather limited altitude performance, in keeping with its intended medium-altitude usage. One key advancement for

4752-730: The development in the so-called LLNM (Long Life, No Maintenance) computing was done by NASA during the 1960s, in preparation for Project Apollo and other research aspects. NASA's first machine went into a space observatory , and their second attempt, the JSTAR computer, was used in Voyager . This computer had a backup of memory arrays to use memory recovery methods and thus it was called the JPL Self-Testing-And-Repairing computer. It could detect its own errors and fix them or bring up redundant modules as needed. The computer

4851-605: The engine being used in higher-altitude fighter roles, a number of attempts were made to address the limited performance of the original supercharger. The BMW 801E was a modification of the D-2 using different gear ratios , of 6:1 at low speed and 8.3:1 at high speed, that tuned the supercharger for higher altitudes. Although takeoff power was unaffected, cruise power increased over 100 hp (75 kW) and "high power" modes for climb at nearly 1,500 to 1,650 PS; and combat were likewise improved by up to 150 hp (110 kW). The E model

4950-527: The engine fails. If the engine is controlled digitally and electronically but allows for manual override, it is considered to be an EEC or ECU . An EEC, though a component of a FADEC, is not by itself FADEC. When standing alone, the EEC makes all of the decisions until the pilot wishes to intervene. The term FADEC is often misused for partial digital engine controls, such as those only electronically controlling fuel and ignition. A turbocharged piston engine would require digital control over all intake airflow to meet

5049-424: The engine. The design evolved throughout the war, including an extension to the engine mounts that allowed for larger cooling gills. This factory-supplied cowling also improved the simplicity of engine replacement in the field in more completely "unitizing" a BMW 801 radial engine, with as many of its auxiliary systems as possible being simultaneously replaceable with the engine itself, as opposed to opening or removing

SECTION 50

#1732776640476

5148-475: The engines; there is no direct linkage to open fuel flow. This procedure can be repeated for any other phase of flight. In flight, small changes in operation are constantly made to maintain efficiency. Maximum thrust is available for emergency situations if the power lever is advanced to full, but limitations can not be exceeded; the flight crew has no means of manually overriding the FADEC. Note: Most modern FADEC controlled aircraft engines (particularly those of

5247-517: The exception of the front tires, which are used to steer, but generally carry less load, each and in total, than the other four to 16, so are less likely to fail). The idea of incorporating redundancy in order to improve the reliability of a system was pioneered by John von Neumann in the 1950s. Two kinds of redundancy are possible: space redundancy and time redundancy. Space redundancy provides additional components, functions, or data items that are unnecessary for fault-free operation. Space redundancy

5346-549: The extreme front, blowing air past the engine cylinders, with some of it being drawn through S-shaped ducts over a radiator for oil cooling. However this system proved almost impossible to operate properly with the BMW 139; early prototypes of the Fw 190 demonstrated terrible cooling problems. Although the problems appeared to be fixable, since the engine was already fairly dated in terms of design, in 1938 BMW proposed an entirely new engine designed specifically for fan-cooling that could be brought to production quickly. The new design

5445-538: The fan absorbed little power directly as the vacuum effect of the airflow past the air exits provided the needed flow. The 801 used a relatively complex system, integral to the BMW-designed, matching forward cowling system, to cool the lubricating oil. A ring-shaped oil cooler core was built into the BMW-provided forward cowl, just behind the fan. The outer portion of the oil cooler's core was in contact with

5544-556: The first commercial "dual FADEC" engine. The first FADEC in service was the Rolls-Royce Pegasus engine developed for the Harrier II by Dowty and Smiths Industries Controls . True full authority digital engine controls have no form of manual override nor manual controls available, placing full authority over all of the operating parameters of the engine in the hands of the computer. If a total FADEC failure occurs,

5643-408: The first computer of this kind for NASA for guidance of Saturn V rockets, but later on BNSF , Unisys , and General Electric built their own. In the 1970s, much work happened in the field. For instance, F14 CADC had built-in self-test and redundancy. In general, the early efforts at fault-tolerant designs were focused mainly on internal diagnosis, where a fault would indicate something

5742-458: The first fundamental characteristic of fault tolerance in three ways: All implementations of RAID , redundant array of independent disks , except RAID 0, are examples of a fault-tolerant storage device that uses data redundancy . A lockstep fault-tolerant machine uses replicated elements operating in parallel. At any time, all the replications of each element should be in the same state. The same inputs are provided to each replication , and

5841-422: The gap between the cowl and outer lip of the metal ring produced a vacuum effect that pulled air from the front of the engine outward and forward within the cowl's frontmost inner area just behind the fan, flowing forward across the oil cooler core in a separate airflow path from the rearwards-direction flow that cooled the engine's cylinders, just to provide cooling for the 801's oil. The rate of cooling airflow over

5940-648: The hands of the Udvar-Hazy Center of the Smithsonian, has a pair of complete BMW 801J turbocharged engines still in its nacelles. There is an 801-ML (801L) on display mounted in a Dornier 217 nacelle, essentially a complete surviving Motoranlage unitized powerplant, at the New England Air Museum , Bradley International Airport , Windsor Locks, CT. Likewise, the Ju 88R-1 night fighter at

6039-416: The inner circumference of the rear cowl, just behind the rear row of cylinders. Not many of these engines ever entered production due to high costs, and the various high-altitude designs based on them were forced to turn to other engines, typically the Junkers Jumo 213 . A sizable number of BMW 801s exist in museums, some on display by themselves, with some 20 of them associated with surviving examples of

SECTION 60

#1732776640476

6138-536: The late 20th and early 21st centuries. There was a considerable amount of wind tunnel work done on the engine and BMW-designed forward cowling (incorporating the engine's oil cooler) at the Luftfahrtforschungsanstalt ( LFA ) facility in Völkenrode , leading to the conclusion it was possible to reduce drag equivalent to 150–200 hp (110–150 kW; 150–200 PS). It also maximized

6237-469: The loss of either only reducing brake power by 50% and not causing as much dangerous brakeforce imbalance as a straight front-back or left-right split, and should the hydraulic circuit fail completely (a relatively very rare occurrence), there is a failsafe in the form of the cable-actuated parking brake that operates the otherwise relatively weak rear brakes, but can still bring the vehicle to a safe halt in conjunction with transmission/engine braking so long as

6336-451: The main components and they would add considerable weight. However, the similarly critical systems for actuating the brakes under driver control are inherently less robust, generally using a cable (can rust, stretch, jam, snap) or hydraulic fluid (can leak, boil and develop bubbles, absorb water and thus lose effectiveness). Thus in most modern cars the footbrake hydraulic brake circuit is diagonally divided to give two smaller points of failure,

6435-434: The main cowling's sheetmetal, to possibly act as a heat sink . Comprising the BMW-designed forward cowl, in front of the oil cooler was a ring of metal with a C-shaped cross-section, with the outer lip lying just outside the rim of the cowl, and the inner side on the inside of the oil cooler core. Together, the metal ring and cowling formed an S-shaped airflow path, with the oil cooler's core contained between them. Airflow past

6534-523: The more carefully all possible interactions have to be considered and prepared for. Considering the importance of high-value systems in transport, public utilities and the military, the field of topics that touch on research is very wide: it can include such obvious subjects as software modeling and reliability, or hardware design , to arcane elements such as stochastic models, graph theory , formal or exclusionary logic, parallel processing , remote data transmission , and more. Spare components address

6633-473: The oil cooler's circular-shaped core to aid warming the oil during starting. Finally, by placing the oil cooler behind the fan, cooling was provided even while the aircraft was parked. The downside to this design was that the oil cooler was in an extremely vulnerable location, and the metal ring was increasingly armoured as the war progressed. The design of the BMW 801's cowling was key to its proper cooling, which BMW designed and built themselves and supplied with

6732-503: The operation of the engines relying on automation, safety is a great concern. Redundancy is provided in the form of two or more separate but identical digital channels. Each channel may provide all engine functions without restriction. FADEC also monitors a variety of data coming from the engine subsystems and related aircraft systems, providing for fault tolerant engine control. Engine control problems simultaneously causing loss of thrust on up to three engines have been cited as causal in

6831-466: The other unaffected. Second, the rear brake is relatively strong compared to its automotive cousin, being a powerful disc on some sports models, even though the usual intent is for the front system to provide the vast majority of braking force; as the overall vehicle weight is more central, the rear tire is generally larger and has better traction, so that the rider can lean back to put more weight on it, therefore allowing more brake force to be applied before

6930-666: The overall system remains functional despite hardware or software issues. Non-computing examples include structures that retain their integrity despite damage from fatigue , corrosion or impact. The first known fault-tolerant computer was SAPO , built in 1951 in Czechoslovakia by Antonín Svoboda . Its basic design was magnetic drums connected via relays, with a voting method of memory error detection ( triple modular redundancy ). Several other machines were developed along this line, mostly for military use. Eventually, they separated into three distinct categories: Most of

7029-485: The plane easier to handle. There is no evidence the 801B ever left the prototype stage. The BMW 801A/B engines delivered 1,560 PS (1,539 hp, 1,147 kW) for takeoff. Major applications of the 801A/L engines include multiple variants of the Junkers Ju 88 and Dornier Do 217 . The BMW 801C was developed for use in single- or multi-engined fighters and included a new hydraulic prop control and various changes intended to improve cooling, including cooling "gills" on

7128-410: The power plant for the famous Focke-Wulf Fw 190 . The BMW 801 radial also pioneered the use of what would today be designated an engine control unit : its Kommandogerät engine management system took over the operation of several aviation engine management control parameters of the era, allowing proper operation of the engine with just one throttle lever. In the 1930s, BMW took out a license to build

7227-416: The process state. It does not interfere with the normal execution of the program and therefore incurs negligible overhead. For 17 of 18 systematically collected real world null-dereference and divide-by-zero errors, a prototype implementation enables the application to continue to execute to provide acceptable output and service to its users on the error-triggering inputs. The circuit breaker design pattern

7326-470: The program of the error or abort the program. The approach has performance costs: because the technique rewrites code to insert dynamic checks for address validity, execution time will increase by 80% to 500%. Recovery shepherding is a lightweight technique to enable software programs to recover from otherwise fatal errors such as null pointer dereference and divide by zero. Comparing to the failure oblivious computing technique, recovery shepherding works on

7425-612: The program the Focke-Wulf firm's chief designer, Kurt Tank suggested it for use in the Focke-Wulf Fw 190 fighter project. Radial engines were rare in European designs as they were considered to have too large a frontal area for good streamlining and would not be suitable for high speed aircraft. They were most popular on naval aircraft, where their easier maintenance and improved reliability were highly valued. Efforts to improve these designs led to new cowling designs that reduced

7524-399: The rest of the machine, like a lot of low-priced bikes after their first few years of use, is on the point of collapse from neglected maintenance. The basic characteristics of fault tolerance require: In addition, fault-tolerant systems are characterized in terms of both planned service outages and unplanned service outages. These are usually measured at the application level and not just at

7623-423: The same outputs are expected. The outputs of the replications are compared using a voting circuit. A machine with two replications of each element is termed dual modular redundant (DMR). The voting circuit can then only detect a mismatch and recovery relies on other methods. A machine with three replications of each element is termed triple modular redundant (TMR). The voting circuit can determine which replication

7722-466: The same state transition on the same edge of the clock, and the clocks to the replications being exactly in phase. However, it is possible to build lockstep systems without this requirement. Bringing the replications into synchrony requires making their internal stored states the same. They can be started from a fixed initial state, such as the reset state. Alternatively, the internal state of one replica can be copied to another replica. One variant of DMR

7821-399: The shape of the housing and the engine itself carried the air to the outside of the cowling and across the cylinders. A set of slots or gills at the rear of the cowling allowed the hot air to escape. This provided effective cooling although at the cost of about 70 PS (69 hp, 51.5 kW) required to drive the fan when the aircraft was at low speed. Above 170 miles per hour (270 km/h),

7920-414: The successful 801 design's further development, a number of attempts were made to use turbochargers on the BMW 801 series as well. The first used a modified BMW 801D to create the BMW 801J, delivering 1,810 PS (1,785 hp, 1,331 kW) at takeoff and 1,500 hp (1,103 kW) at 12,200 m (40,000 ft), an altitude where the D was struggling to produce 630 hp (463 kW). The BMW 801E

8019-617: The third test is passed. Therefore, adding seat belts to all vehicles is an excellent idea. Other "supplemental restraint systems", such as airbags , are more expensive and so pass that test by a smaller margin. Another excellent and long-term example of this principle being put into practice is the braking system: whilst the actual brake mechanisms are critical, they are not particularly prone to sudden (rather than progressive) failure, and are in any case necessarily duplicated to allow even and balanced application of brake force to all wheels. It would also be prohibitively costly to further double-up

8118-539: The turboshaft variety) can be overridden and placed in manual mode, effectively countering most of the disadvantages on this list. Pilots should be very aware of where their manual override is located, because inadvertent engagement of the manual mode can lead to an overspeed of the engine. NASA has analyzed a distributed FADEC architecture rather than the current centralized one, specifically for helicopters . Greater flexibility and lower life cycle costs are likely advantages of distribution. BMW 801 The BMW 801

8217-446: The two failures are considered one single fault condition. A source offers the following example: A single-fault condition is a condition when a single means for protection against hazard in equipment is defective or a single external abnormal condition is present, e.g. short circuit between the live parts and the applied part. Providing fault-tolerant design for every component is normally not an option. Associated redundancy brings

8316-564: The use of positive air pressure to aid cooling of cylinders, heads, and other internal parts. The first BMW 801As ran in April 1939, only six months after starting work on the design, with production commencing in 1940. The 801B was to be identical to the 801A except for the gearbox, which reversed the direction of the propeller rotation to counterclockwise as seen from behind the engine. The A and B models were intended to be used in pairs on twin-engine designs, cancelling out net torque and making

8415-453: The vehicle rolls over or undergoes severe g-forces, then this primary method of occupant restraint may fail. Restraining the occupants during such an accident is absolutely critical to safety, so the first test is passed. Accidents causing occupant ejection were quite common before seat belts , so the second test is passed. The cost of a redundant restraint method like seat belts is quite low, both economically and in terms of weight and space, so

8514-409: The wheel locks. On cheaper, slower utility-class machines, even if the front wheel should use a hydraulic disc for extra brake force and easier packaging, the rear will usually be a primitive, somewhat inefficient, but exceptionally robust rod-actuated drum, thanks to the ease of connecting the footpedal to the wheel in this way and, more importantly, the near impossibility of catastrophic failure even if

8613-429: Was a powerful German 41.8-litre (2,550 cu in) air-cooled 14-cylinder- radial aircraft engine built by BMW and used in a number of German Luftwaffe aircraft of World War II . Production versions of the twin-row engine generated between 1,560 and 2,000 PS (1,540–1,970 hp, or 1,150–1,470 kW ). It was the most produced radial engine of Germany in World War II with more than 61,000 built. The 801

8712-426: Was about 1.29 m (51 in) across, depending on the model. The BMW 801 was cooled by forced air with the cooling fan made from a magnesium alloy (probably Elektron ), 10-bladed in the initial models, but 12-bladed in most engines. The fan rotated at 1.72 times the crankshaft speed (3.17 times the propeller speed). Air from the fan was blown into the center of the engine in front of the propeller gearing housing, and

8811-486: Was also used as the basis for the BMW 801R, which included a much more complex and powerful two-stage four-speed supercharger, as well as die cast hydronalium cylinder heads , strengthened crankshaft and pistons, and chromed cylinders and exhaust valves; it was anticipated this version would produce over 2,000 hp (1,500 kW; 2,000 PS), or over 2,600 hp (1,900 kW; 2,600 PS) with MW 50 methanol -water injection. In spite of these improvements,

8910-416: Was failing and a worker could replace it. SAPO, for instance, had a method by which faulty memory drums would emit a noise before failure. Later efforts showed that to be fully effective, the system had to be self-repairing and diagnosing – isolating a fault and then implementing a redundant backup while alerting a need for repair. This is known as N-model redundancy, where faults cause automatic fail-safes and

9009-410: Was faulty and have it taken out of service. This is called M out of N majority voting. Historically, the trend has been to move away from N-model and toward M out of N, as the complexity of systems and the difficulty of ensuring the transitive state from fault-negative to fault-positive did not disrupt operations. Tandem Computers , in 1976 and Stratus were among the first companies specializing in

9108-482: Was given the name BMW 801 after BMW was given a new block of "109-800" engine numbers by the RLM to use after their merger with Bramo. The 801 retained the 139's older-style single-valve intake and exhaust, while most in-line engines of the era had moved to either three (as Junkers had done) or four valves per cylinder, or in British use for their own radials, sleeve valves . Several minor advances were worked into

9207-502: Was just one notable example of this in its later stages of development. This mechanical engine control was progressively replaced first by analogue electronic engine control and, later, digital engine control. Analogue electronic control varies an electrical signal to communicate the desired engine settings. The system was an evident improvement over mechanical control but had its drawbacks, including common electronic noise interference and reliability issues. Full authority analogue control

9306-451: Was likewise modified to create the BMW 801Q, delivering a superb 1,715 hp (1,261 kW) at 12,200 m (40,000 ft), power ratings no existing Allied radial engine of a similar displacement could match. The turbocharger was fitted behind the engine at a 30° forward tilt off a vertical axis, possessed hollow turbine blades in the exhaust section, and in a photo from Flight magazine, appears to have intercooler units fitted around

9405-408: Was most often used with twin and multi-engined designs, with some need for external add-ons. The more comprehensive Triebwerksanlage format for unitization consolidated more of the engine's required accessory systems beyond what the earlier Motoranlage concept could, plus some external mountings, such as an integrally complete exhaust system (including a turbocharger, if fitted as part of the design), as

9504-472: Was originally intended to replace existing radial types in German transport and utility aircraft. At the time, it was widely agreed among European designers that an inline engine was a requirement for high performance designs due to its smaller frontal area and resulting lower drag. Kurt Tank successfully fitted a BMW 801 to a new fighter design he was working on, and as a result the 801 became best known as

9603-417: Was planned to use the F on all late-model Fw 190s, but the war ended before production started. BMW had been required to create priorities for the 14-cylinder production 801 radial, the 18-cylinder BMW 802 and liquid-cooled 28-cylinder BMW 803 radial engines. The first priority was for the 801 to be developed "to its limits", with the second priority the 802's design and prototype construction, and lastly

9702-642: Was used in the 1960s and introduced as a component of the Rolls-Royce/Snecma Olympus 593 engine of the supersonic transport aircraft Concorde . However, the more critical inlet control was digital on the production aircraft. Digital electronic control followed. In 1968, Rolls-Royce and Elliott Automation , in conjunction with the National Gas Turbine Establishment , worked on a digital engine control system that completed several hundred hours of operation on

9801-496: Was used until 1944. The serious fuel shortage in 1944 forced installation of MW50 instead of C3-injection. With MW50 boosting turned on, takeoff power increased to 2,000 PS (1,470 kW), the C3-injection was initially only permitted for low altitude use and increased take-off power to 1,870 PS. Later C3-injection systems were permitted for low-to-medium altitude use and raised take-off power to more than 1,900 PS. With

#475524