[weaksauce]

> The idea with airplanes is not "design this component so it cannot fail" but "design the system so it can tolerate component failure".

that's not true. yes a lot of systems on airplanes are redundant but also there are plenty of you die if this breaks so we build it N times stronger than we can imagine it every happening... also, teach pilots not to do things that would bring that to be more possible. on a helicopter they have a single jesus nut that if it breaks the rotor is gone.

In rock climbing as well there is redundancy where there can be but some things are built strong to the point where under most foreseeable conditions the component will not break. (the most common dynamic ropes for lead climbing twins and half ropes aside, belay device, belay loop, belay carabiner, harness are all built for worst case without redundancy.)

[WalterBright]

> there are plenty of you die if this breaks so we build it N times stronger than we can imagine it every happening

That's simply not true. Every component is redundant. Nothing is built "N" times stronger. The safety factor is 50% stronger than the maximum anticipated load.

(I worked for 3 years at Boeing designing flight critical systems for the 757.)

> are all built for worst case without redundancy

Why I'm not going rock climbing.

[weaksauce]

is the jesus nut redundant? is the jackscrew nut for the elevator redundant?(one famously stripped and caused inverted flight for 30 min to try and save it but eventually crashed into the ocean)... they improved the design from that but it's still one mechanism and one screw. there are simply no completely reliable planes and helicopters without some form of single point reliability being required.

[WalterBright]

> is the jackscrew nut for the elevator redundant?

Yes. (It's for the stabilizer, not the elevator.) First off, the jackscrew is hollow and has a rod running through the center to keep it together if it cracks through. Secondly, the nut rides on steel balls in grooves. If the nut cracks and all the balls fall out, there are solid ice scrapers attached to the nut at each end that fit in the grooves, but don't contact them under normal operation. The ice scrapers peel any ice off the grooves so it doesn't jam the nut. But the scrapers are also strong enough to hold the nut in place if the balls fall out.

This is on the 757. I don't know the setup on the McDonnell-Douglas bird that crashed due to nut failure, except it's a much older design. I don't know if it had the ice scrapers on it, for example.

BTW, the jackscrew is made by Saginaw Gear. It's made from the finest steel forging money can buy, and Saginaw has been making them for a long time and knows what they're doing.

After the first trim gearbox assembly arrived, Boeing's test group had the job of applying the ultimate load, 150%, to it to see if it would buckle, crack, or bend. The test guys told me they were going to bust it. They put a big old steel I-Beam pinned at one end and my poor little jackscrew gearbox pinned at the other end. A hydraulic ram was applied to the I-beam, and the test guy cranked up the pressure.

The I-beam bent into a bow.

HAHAHAHAHAHAHAHAHHAHAHAAA I love Saginaw Gear.

> there are simply no completely reliable planes and helicopters without some form of single point reliability being required.

Helicopters, you're right. They won't survive losing a blade. Planes, you're incorrect.

[WalterBright]

P.S. My very first assignment at Boeing was to determine the size of that jackscrew needed to carry the load. I panicked, and went to my lead engineer. He laughed, and said "you know how to do column buckling calculations, right?" I said yes, and he said go to it.

After 3 years of working on the gearbox I knew everything there was to know about it, including all the failure modes anyone could think of. I was also fortunate to have a couple of Boeing's best engineers mentoring me.

It's redundant.

[HPsquared]

Is the main spar counted as a single component?

[WalterBright]

The main spar structure is redundant.

[HPsquared]

It's tolerant of random failure of individual components, yes, but the entire spar could fail under an overload condition. For this failure mode, the only way to ensure a suitably low failure rate is by setting an appropriate safety factor.

[WalterBright]

> but the entire spar could fail under an overload condition.

Each component individually is designed at 150% of the maximum load ever expected.

The spar has redundant components. Any part of the spar can crack all the way through, and it will still fly safely.

[HPsquared]

Redundancy protects against some failure modes (e.g. unrevealed fatigue cracking) but not overload, which is a common-mode failure that doesn't care about redundancy if the load is high enough. It becomes a matter of "probability of exceedance".

Electrical/mechanical systems are different and can usually be separated/segregated etc, but there is only one structure.