No arguments with any of the above. For a while in $DAY_JOB, I worked as a reliability engineer on Big_Honking_Telecom_Gear, where the failure of any one (or several) components would not bring the system down. Something about ATC and people being able to call the Fire Department
.
But that kind of reliability has costs. For the safety-critical stuff, we used to run 1+1 protection where two pieces of hardware and associated software would run in parallel, ideally switching in zero time in case of fault (Yes, one can do this kind of thing: Forward Error Correction to the fore!), but sometimes with a standby/active scheme where the standby would have to boot and become active in order to regain operation. (That works OK in the control plane, but not so much with clocks..)
It's one thing if one is talking about One Extra Card per shelf that's the standby: But doing this properly, especially around the core, involves duplicating entire shelves, cabling, and custom ASICs left, right, and center, sometimes more than doubling the cost of the overall system. In one notable case we managed to do a (1/2)/(1/2)/(1/2) protection scheme, which sounds evil, but resulted in a total card count that was something like 3/2x, rather than a 1+1 that would have been a card count of 2x. And what with FEC would manage to do hitless switch and survive a bunch of cards going bad at once.
But there's
costs involved. Yep, one does not want the telecom network to barf and die when a single transistor gives up the ghost; between the FCC and other national telecom regulators and the companies they regulate, the world has a fairly reliable telecom network. Users pay through the nose for this, but get the chance to call the fire department in an emergency. And, yes, losing that capability would means Dead Bodies on the ground. There's Reasons I wear an Order of the Engineer ring on my pinkie.
So, great: Fun, safety critical stuff with a (nearly) unlimited budget to build duplicated remote controls on the flight surfaces of the shuttle; multiple redundant power supplies, multiple duplicated wiring harnesses. Don't forget the triplicated flight control computers; triplicated because if one has two, and the outputs aren't the same, how does one figure out which has failed in real-time? With three, one gets a vote-of-three algorithm. And the hardware to support all that was built in. (If I remember right, there were actually different software companies doing the algorithms on all all three computers, the idea being that if a coding error took down one computer, it wouldn't take down all three!) All of that jazz was justified since losing a space shuttle on approach would be a Bad Thing. And, no question, NASA has the chops to make that all happen. The things that took down Space Shuttles had nothing to do with any of that. But, man, the
cost of all that!
So.. now we're talking a consumer-grade vehicles that get built in the millions. Tesla (and other car companies) have a maniacal focus on costs. There are the NHTSA, the SAE, and other national agencies that do like the FCC and mandate reliability and safety numbers. And now we talk about brakes.
Current brake techology is, as far as I know, somewhat resistant to single points of failure. Lose a brake line, down on the bottom of the body where hoses hang out and small tubes are exposed to road hazards? One might lose two wheels worth of braking, but the other two still work. Lose the power assist? Awkward, but doable muscle power makes the brakes still work.
Electric brakes... First thought that crosses my mind is lack of electrical power. Blow the Pyro fuse? Well, one still has the 12V/48V battery. But, if one is powered off that battery, and the fuseable link to the battery blows, where's the power for the brakes? Duplicated batteries? Um. Cost is creeping up. Controller with diode-ORd battery supply? How worried are we that the dual-diode might blow? In my experience, electronics over a large enough population (like millions of cars) are going to end up with a $RANDOM part that shorts out, like, say, on the controller board. So, duplicated controllers. Duplicated supplies. Separate power supplies for the actuators, with separate power wires going everywhere? Or batteries on each wheel? You guys can see where this is going.
It's probably not that one needs a gold-plated solution: Being safer than the (probable single-point failure mode of a hydraulic system) is probably doable,
but at what cost? If it costs more to put that electric system in a Tesla than to stick with the hydraulics, Tesla will stick with the hydraulics.
As I said in the beginning of this discussion: I'm not adverse to the idea of an electric braking system. Inventive engineers can come up with amazing stuff. But, believe you me, I sure want to see what it is they come up with. And, just because airplanes can pull it off.. it's a different operating environment. We'll see.
www.theinoxincolor.com
It's a purposeful style, got my attention, learned lots, donated.
