Q: Pilots or robots in the cockpit?
You have written many times about the potentials of automation in improving air transportation safety and efficiency. Besides writing your columns, have you done anything about that? Is ISA, NASA or anybody else taking advantage of our automation and control experience gained in the processing industries?
A: The answer to the question of "pilots or robots in the cockpit?" changes slowly because it is cultural. The airline industry could benefit from the experience gained in the processing industries, which also faced the question of "manual or automatic safety controls?"
While on an average flight, the autopilot is in control all the time, and the human pilot normally takes over only for a few minutes each trip—it is the pilot who can overrule the autopilot at any time. In the processing industries (chemical, power, etc.) the well- designed plants do the opposite. Under normal conditions, the operation of the plant can be modified by the operator, but if conditions approach a highly accident-prone life-safety threatening region of operation, override safety control (OSC) takes over. In these advanced designs, OSC can not be turned off or overruled by anything or anybody. In the process industries, OSC has saved many lives in the past and could in the future certainly prevent airliners from flying into mountains.
My point is that we do not have to choose between the traditional pilot and the remotely piloted or robot-operated aircraft (Figure 1). We can have the benefits of both while also preventing unsafe acts from being initiated by either.
We can use land controller beams to operate pilotless drones or to land planes if the pilot is incapacitated; we can increase airport capacity by automatic coordination of the speed and separation of hundreds of aircraft simultaneously; we can use GPS, artificial intelligence, voice recognition and speech synthesis to integrate man-machine systems; and we can lower costs by reducing human presence in the cockpit. Yes, we can do all that.
What we cannot do is to make passengers set foot on a plane piloted by robots. We can not make the travelers trust the instruments alone, because they believe that pilots can see, smell, hear and feel, and machines cannot. It is for this reason that OSC is the direction to follow. After all, nobody can object to a system that overrules unsafe instructions no matter whether they come from a human pilot, an autopilot or possibly from cyber attacks through the Internet.
Q: Improving level detection reliability. I am looking for three level transmitters measuring the same level. Please confirm whether three gauges for same level measurement is applicable or not necessary. I need clarification on how to install three level gauges (reflex/transparent type) in a vessel to measure same level. How should the nozzle projection be? Is it possible to install three numbers LG/ILT (magnetostrictive type) in a 2oo3 (2 out of three 3 configuration). Please forward any sample sketch/isometric drawing for level gauge for reference and review. If using three magnetostrictive indicating lever transmitters is not necessary, how do you install two level gauges (reflex/transparent type) in a vessel to measure same level?
A: You bring up two questions.
- The correct installation of magnetostrictive level detectors
- The obtaining of 2oo3 reliability.
Magnetostrictive level transmitters charge a wire with electrical current so that when the wire's field intersects the float's magnetic field, a pulse is generated, which travels back to the source at the speed of sound, and the time of travel indicates the float's position (the level). These detectors are similar to float type sensors in that a permanent magnet is sealed inside a float that travels up and down a stem in which a magnetostrictive wire is sealed. The specific gravity of the two floats that can measure both interface and total level have to be carefully selected to match the specific gravity of the two process fluids.
As to their installation, they can be directly installed into the tank (Figure 2 left) or can be externally mounted. In case of internal mounting, the unit can only be replaced when the process is shut down or depressurized, and the probe tip should be secured by a clamp if during maintenance, pressure cleaning is used. If maintenance is to be performed while the tank is in operation, the external design is used (Figure 2 right), where the magnetostrictive float transmitter is inserted inside a magnetic level gauge, where it travels up and down.
Now coming to the issue of obtaining 2oo3 reliability, which means that the system will properly function unless and until two out of the three transmitters fail. This can be implemented several ways:
- Because of its simplicity, most people like to use the "median selection" configuration (Figure 3) which assumes that out of the three readings the center one is the correct one.
- Others like to use the “voting system" where the logic assumes that the two readings that are closest to each other are the correct ones, and their average can be used as the measurement, while the third is disregarded, and if it differs by, say, 2% from the measured value, it is selected for maintanance.
- In large or agitated tanks, one might use a similar "averaging method" where the average of all three readings is used so long as all three are within, say, 1% of each other. If they are not, the average of the two that are closer to each other is used as the measurement, while the third is disregarded, and if it differs by more than, say, 2% from the measured value, it is selected for maintanance.
- All three strategies provide the same level of safety, but only methods 2 and 3 will also identify the faulty transmitter.
A: In my experience, we now use a median selector in all cases and do not use averaging when using three measurements. The only time we are using averaging for level measurement is on large-diameter tanks when there would be measurement differences due to some wave being set up.