But it seems to me that the whole failure could have been prevented with a bunch of temperature sensors spread throughout the engine, and a good anomaly detection system.
Don't know why you're getting faded out, because having worked on exactly this engine, software mitigations were put in place. That's exactly your `anomaly detection system`
It was a belt-and-braces fix, because the primary fix was of course to manufacture the engines correctly in the first place.
The "lots of temperature sensors" thing is actually easier said than done; jet engines already have lots of temperature sensors, and they will turn the engine off if a huge overtemperature is detected, but it's not a free win to add more of them. It increases the risk of a faulty sensor shutting down a perfectly good engine in flight, which from a safety-critical perspective is a borderline disaster condition all by itself.
(technically you usually cross-correlate temperature sensor readings with pressure sensor readings to prevent sensor faults turning engines off, but still, extra sensors isn't always a free win.)
Comments
But it seems to me that the whole failure could have been prevented with a bunch of temperature sensors spread throughout the engine, and a good anomaly detection system.
Don't know why you're getting faded out, because having worked on exactly this engine, software mitigations were put in place. That's exactly your `anomaly detection system`
It was a belt-and-braces fix, because the primary fix was of course to manufacture the engines correctly in the first place.
The "lots of temperature sensors" thing is actually easier said than done; jet engines already have lots of temperature sensors, and they will turn the engine off if a huge overtemperature is detected, but it's not a free win to add more of them. It increases the risk of a faulty sensor shutting down a perfectly good engine in flight, which from a safety-critical perspective is a borderline disaster condition all by itself.
(technically you usually cross-correlate temperature sensor readings with pressure sensor readings to prevent sensor faults turning engines off, but still, extra sensors isn't always a free win.)
Though in this case the software mitigation was turbine overspeed detection, not overtemperature detection.