Computer mixability An important issue
Source: Airbus Safety First URL: https://safetyfirst.airbus.com/computer-mixability-an-important-issue/ Published: 2009-07-14 Magazine Issue: 2009-07 Category: Archive PDF: Original PDF
By: Yannick VANHECKE
Section titled “By: Yannick VANHECKE”Group Manager Flight Control Systems A300/A310 & A330/A340 Customer Services
1 Introduction
Section titled “1 Introduction”Aircraft computers are subject to hardware and software evolutions, which generate different part numbers. Some of these are interchangeable, but are not necessarily mixable. Mixability, or compability, is about the ability of computers bearing different part numbers to interact correctly in a system. Part numbers, which are interchangeable but not mixable must therefore be changed as a set.
Non-compliance with this principle may lead to significant events, as illustrated by the three occurrences described in this article, where three aircraft were operated with an incorrect Flight Control Primary Computer (FCPC) configuration.
On review of these events, it appears worthwhile to repeat the importance of strictly adhering to the Illustrated Parts Catalog (IPC) when replacing any computer on an airplane.
2 Description of the flight control computers operating mode
Section titled “2 Description of the flight control computers operating mode”On the A330/A340 aircraft family, the flight controls are managed by five computers:
-
Three Flight Control Primary Computers (FCPC or PRIM)
-
Two Flight Control Secondary Computers (FCSC or SEC).
In normal operation, FCPC1 is declared to be master in law. It processes the pilot/ auto-pilot orders and sends them to the four other flight control computers (PRIM and SEC), which will then execute them on their related servo-controls.
Figure 1: A330/A340 Flight control computers architecture
3 Events
Section titled “3 Events”3.1 Untimely ground spoilers extension on ground
Section titled “3.1 Untimely ground spoilers extension on ground”While troubleshooting the events, the following FCPC configuration was noticed:
• FCPC1: PN LA2K1A100220000 (Standard L15) • FCPC2: PN LA2K1A100240000 (Standard L16A) • FCPC3: PN LA2K1A100230000 (Standard L16).
Two A340 operators reported events where all ground spoilers partially extended during the power-up sequence, whereas they should have remained fully retracted.
According to the IPC and to the Airbus Service bulletins (SB), this mixed configuration was not authorized.
Indeed, in the above configuration, an incom - patibility of the parameters exchanged between the three computers lead the “4 throttles in IDLE position” information sent by the two computers in standard L16/L16A to be interpreted as “Phased Lift Dumping (PLD) function activation” by the FCPC in standard L15.
According to the logics of the system, where a function is activated if ordered by at least two of
the three FCPC, FCPC1 ordered the partial deployment of the ground spoilers (Fig 2).
- Note: The Phased Lift Dumping function allows the spoilers to deploy with a reduced deflection when only one main landing gear is on the ground and both throttles are in the idle/reverse position
With two FCPCs in standard L16 or L16A
Section titled “With two FCPCs in standard L16 or L16A”
Figure 2: Untimely ground spoiler extension as a result of an unauthorized FCPC configuration
3.2 Hard landing
Section titled “3.2 Hard landing”One A330 operator reported an event, which resulted in a severe hard landing and subsequent main landing gear replacement.
During the flare phase, the elevators remained in the neutral position for several seconds in spite of side stick pitch movement orders by the pilot.
Investigation revealed that while two FCPC - of the same standard and same part number -
were fitted in the first and third computer installation position, the computer in the second position differed in both respects:
-
FCPC1 and FCPC3: PN LA2K1A100DA0000 (Standard P8/M17)
-
FCPC2: PN LA2K2B100D80000 (Standard P7/M16).
This incorrect FCPC configuration had no consequences on the elevators control during the flight as long as the flight controls were operating in “normal” mode.
In “normal” mode, the FCPC1 transmits the elevator movement orders to its related servocontrols. In parallel it sets the adjacent servocontrols, controlled by FCPC2, in “damping” mode.
In “damping” mode, the adjacent servo-controls ignore the permanent steady-state order sent by FCPC2.
Normal operation is illustrated in fig 3.
On landing, the Captain started the flare late (height of approximately 20-30ft) and pulled the stick Full Aft. This resulted in a commanded rate of elevator’s deflection of more than 30°/sec, and the consequent activation of the “double pressurization” mode.
In “double pressurization” mode, FCPC1 transmits the elevator movement orders to its related servocontrols and sets the adjacent servo-controls, controlled by FCPC2, in “active” mode. In parallel, it sends a request to FCPC2 to send elevator movement orders to its own related servo-controls. Double pressurization operation is illustrated in fig 4.
servo-controls receiving their orders from FCPC1 and those receiving theirs from FCPC2.
This “force fighting” prevented the elevators to move, thereby contributing to the hard landing. This “double pressurization mode” with incorrect FCPC configuration is illustrated in Fig 5.
FCPC2 therefore continued to send the “by default” steady state order to its servo-controls. This lead to “force fighting” between the elevator
4 A330/A340 FCPC Enhancements
Section titled “4 A330/A340 FCPC Enhancements”Airbus has developed a new FCPC mixability monitoring to avoid an incorrect FCPC configuration. This monitoring is based on a “compatibility” code exchanged and compared between the FCPC.
With this monitoring, the FCPC will not start with an unauthorized configuration.
A caution is triggered on the Electronic Centralized Aircraft Monitoring (ECAM), associated to a “FAULT” message on the Central Maintenance System (CMS).
This new monitoring is currently available on all A340-500/600 (FCPC standard W9, PN: LA2K2B100G80000, since Oct. 2005).
Similar monitoring has been developed for all A330/A340 aircraft and will be available with the following FCPC standards:
| Basic (pre mod 49144) | Basic (pre mod 49144) | Enhanced (post mod 49144) | Enhanced (post mod 49144) | |
|---|---|---|---|---|
| A330 | A340 | A330 | A340 | |
| FCPC standard | P10/M19 | L20 | P9/M18 | L19 |
| Service bulletin | 27-3144 | 27-4144 | 27-3148 | 27-4148 |
Note: A similar monitoring is available on all A380 FCGU (Flight Control and Guidance Unit).
5 Conclusion
Section titled “5 Conclusion”Incorrect A330/A340 FCPC configurations may lead to undesirable operational situations. A new monitoring function has therefore been developed which will, in case of unauthorized configuration, prevent the starting of the FCPC.
SIL 27-150 with detailed flowcharts has been issued as an additional help to quickly determine the interchangeability status of the FCPC Part Numbers.
A wide-ranging lesson may be learned from these particular occurrences, which pertains to all calculators aboard all types of aircraft:
It is important, when replacing computers, to adhere to the interchangeability and mixability rules laid out in the Illustrated Parts Catalog (IPC) and Service Bulletins.
This insures that the aircraft remains in a certified configuration. Deviation from these rules means flying in an uncertified configuration that may result in unexpected operation of the systems.
Operator Information Telex (OIT) Ref. 999.0085/04, Ref. 999.0079/08 and EASA Safety Information Bulletin Ref. 2008-86 were issued to remind operators of the importance of adhering to the interchangeability and mixability rules that are given in the IPC and Airbus Service Bulletins.
作者：Yannick VANHECKE
Section titled “作者：Yannick VANHECKE”A300/A310 及 A330/A340 飞行控制系统客户服务集团经理
飞机计算机因硬件和软件升级而产生不同的件号。其中部分件号可互换，但不一定可混装。互换性（或兼容性）是指不同件号的计算机在系统中正确交互的能力。因此，可互换但不可混装的件号必须整套更换。
违反此原则可能导致重大事件，正如本文所描述的三起案例，三架飞机因飞行控制主计算机（FCPC）配置错误而运行。
重新审视这些事件后，有必要再次强调在飞机上更换任何计算机时严格遵守图解零件目录（IPC）的重要性。
2 飞行控制计算机工作模式说明
Section titled “2 飞行控制计算机工作模式说明”在 A330/A340 机型家族中，飞行控制由五台计算机管理：
- 三台飞行控制主计算机（FCPC 或称 PRIM）
- 两台飞行控制辅助计算机（FCSC 或称 SEC）
在正常运行中，FCPC1 被设定为主控制律计算机。它处理飞行员/自动驾驶仪的指令，并将其发送至其他四台飞行控制计算机（PRIM 和 SEC），由它们在各自的伺服控制器上执行。
图 1：A330/A340 飞行控制计算机架构
3.1 在地面时意外伸出地面扰流板
Section titled “3.1 在地面时意外伸出地面扰流板”在故障排除过程中，发现以下 FCPC 配置：
• FCPC1：件号 LA2K1A100220000（标准 L15）
• FCPC2：件号 LA2K1A100240000（标准 L16A）
• FCPC3：件号 LA2K1A100230000（标准 L16）
两架 A340 运营人报告了此类事件：在通电序列期间，所有地面扰流板部分伸出，而它们本应保持完全收回状态。
根据 IPC 和空客服务通告（SB），这种混合配置未经授权。
事实上，在上述配置中，三台计算机之间交换的参数存在不兼容，导致标准 L16/L16A 的两台计算机发送的”四个油门杆处于怠速位置”信息被标准 L15 的 FCPC 解读为”分阶段升力卸载（PLD）功能激活”。
根据系统逻辑，某一功能需要至少三台 FCPC 中的两台发出指令才会被激活，因此 FCPC1 指令地面扰流板部分伸出（图 2）。
- 注：分阶段升力卸载功能允许在只有一个主起落架触地且两个油门杆处于怠速/反推位置时，以减小的偏转角度展开扰流板
当两台 FCPC 为标准 L16 或 L16A 时
Section titled “当两台 FCPC 为标准 L16 或 L16A 时”
图 2：因未经授权的 FCPC 配置导致的意外地面扰流板伸出
3.2 硬着陆
Section titled “3.2 硬着陆”一架 A330 运营人报告了一起事件，导致严重的硬着陆，随后更换了主起落架。
在拉平阶段，尽管飞行员发出侧杆俯仰指令，升降舵仍保持中立位置数秒。
调查发现，虽然第一和第三计算机安装位置安装的两台 FCPC 标准和件号相同，但第二位置的计算机在这两方面均不同：
- FCPC1 和 FCPC3：件号 LA2K1A100DA0000（标准 P8/M17）
- FCPC2：件号 LA2K2B100D80000（标准 P7/M16）
这种错误的 FCPC 配置在飞行控制以”正常”模式运行时对升降舵控制没有影响。
在”正常”模式下，FCPC1 将升降舵移动指令发送至其相关的伺服控制器。同时，它将 FCPC2 控制的相邻伺服控制器设置为”阻尼”模式。
在”阻尼”模式下，相邻伺服控制器忽略 FCPC2 发送的永久稳态指令。正常操作如图 3 所示。
在着陆时，机长拉平开始较晚（高度约 20-30 英尺）并将侧杆拉至全后位置。这导致升降舵偏转指令速率超过 30°/秒，随之激活了”双加压”模式。
在”双加压”模式下，FCPC1 将升降舵移动指令发送至其相关的伺服控制器，并将 FCPC2 控制的相邻伺服控制器设置为”主动”模式。同时，它向 FCPC2 发送请求，要求其将升降舵移动指令发送至自身的伺服控制器。双加压操作如图 4 所示。
因此，FCPC2 继续向其伺服控制器发送”默认”稳态指令。这导致接收来自 FCPC1 指令的伺服控制器与接收来自 FCPC2 指令的伺服控制器之间产生”对抗力”。
这种”对抗力”阻止了升降舵移动，从而导致硬着陆。这种错误 FCPC 配置下的”双加压模式”如图 5 所示。
4 A330/A340 FCPC 增强
Section titled “4 A330/A340 FCPC 增强”空客开发了新的 FCPC 混用性监控功能，以避免不正确的 FCPC 配置。该监控功能基于在 FCPC 之间交换和比较的”兼容性”代码。
有了此监控功能，FCPC 将不会启动未授权的配置。
警告会在电子中央飞机监控（ECAM）上触发，同时在中央维护系统（CMS）上显示”FAULT”信息。
这种新监控功能目前适用于所有 A340-500/600（自 2005 年 10 月起，FCPC 标准 W9，件号 LA2K2B100G80000）。
类似的监控功能已为所有 A330/A340 飞机开发，并将通过以下 FCPC 标准提供：
| 基本型（改装49144前） | 基本型（改装49144前） | 增强型（改装49144后） | 增强型（改装49144后） | |
|---|---|---|---|---|
| A330 | A340 | A330 | A340 | |
| FCPC 标准 | P10/M19 | L20 | P9/M18 | L19 |
| 服务通告 | 27-3144 | 27-4144 | 27-3148 | 27-4148 |
注意：所有 A380 FCGU（飞行控制和引导组件）均提供类似的监控功能。
不正确的 A330/A340 FCPC 配置可能导致不良的运行情况。因此开发了新的监控功能，该功能将在出现未授权配置时阻止 FCPC 启动。
SIL 27-150 附带详细流程图，作为快速确定 FCPC 件号互换性状态的额外帮助。
从这些特定事件中可以总结出一个适用于所有类型飞机上所有计算机的广泛教训：
在更换计算机时，遵守图解零件目录（IPC）和服务通告中规定的互换性和混用性规则至关重要。
这确保飞机保持在经认证的配置中。违反这些规则意味着在未经认证的配置下飞行，可能导致系统出现意外运行。
已发布操作员信息电报（OIT）Ref. 999.0085/04、Ref. 999.0079/08 和 EASA 安全信息公报 Ref. 2008-86，以提醒运营商遵守 IPC 和空客服务通告中给出的互换性和混用性规则的重要性。