Because they’re going on large commercial aircraft, these are scrutinized very closely by the FAA. This has both advantages and disadvantages: on the plus side, we’re using the very best practices we *know* work; on the negative side, we’re extremely slow to adopt practices that have yet to be compelling to the most skeptical safety engineers. From an economic stand point, it is much easier and faster to defend a scheme by demonstrating similarity to an already approved one than show that a new one is in all ways superior.

With triply-identical sensors, after verifying that the sensors think they’re healthy, the values are reasonable (both on their own and relative to earlier data from the same sensor), and filtering, then we compare the readings from the three and choose the middle one. This minimizes the magnitude of any erroneous data.

With doubly-identical sensors for which there exists some combination of other sensor readings from which we can infer what this sensor ought to be reading, we choose the sensor that is closest to the synthesized reading, provided it is sufficiently close to the synthesized reading.

The question has always been: with only two sensors (one of the three has declared itself bad or the synthetic reading is unavailable) that disagree, what do you do in circumstances where there is no fail-safe value?

Lance ==)——————–

The way we implemented voting was this: There was a hardware path and a software path, each giving an output. These two outputs were ANDed together, and when the result was true, the system could lock.

Each of these paths used three separate inputs, and each of these inputs were tested against other system parameters to insure that they were true.

For example, the car had to be in PARK and the engine was off to lock the steering column. The hardware path looked at the Park switch and the state of the key cylinder, while the software looked at the Park status message on the CAN bus.It also looked to see the ignition status, the engine status (OFF) and vehicle speed (0).

Even if the software was completely wrong, the hardware path would prevent the Steering Column Lock Module from locking the steering column while the car was in motion.