Manual Fault Controlling

The manual fault controlling that is conducted by the crew pilots of aircraft is one of the prominent examples of un-automated fault controlling. Pilots are provided with a quick reference handbook as guidance on controlling potential failures. Based on the alarm and the feedback that are provided by the monitoring instrument of the flight deck, the pilots are trained to initially relate the abnormal condition to the corresponding control (remedial) procedure.

They are also trained to apply the correct procedure with vigilant monitoring of evolutionary conditions (Holder, 2003).

For instance, the loss of electrical power (Alternating Current) of the left and right buses of a Boeing 767 aircraft would result in illuminating the “AC BUS OFF” light and a message being presented by the Engine Indication and Crew Alerting System (EICAS), as shown in Figure 2-20. In response to this failure, the crew pilots would open the quick reference handbook to select the corresponding checklist and control procedure.

L AC BUS OFF R AC BUS OFF

BUS OFF

BUS OFF EICAS Message:

Lights:

Figure 2-20: EICAS Message and Alert Light (Holder, 2003).

Figure 2-21 shows the corresponding checklist page of the reference handbook. To make sure that the selected procedure is able control the failure, the pilots apply the required actions and at the same time monitor the conditions through the EICAS and the alarm lights. One of the lines

41 in that page shows that if the Auxiliary Power Unit (APU) is available “If APU available” it should be started. After starting the APU, two actions should be taken; the first is “LEFT BUS TIE SWITCH, OFF, THEN AUTO” and the second is “RIGHT BUS TIE SWITCH, OFF, THEN AUTO”. If, following these measures, the “AC BUS OFF” lights are still illuminated then further actions will need to be taken.

Condition: An AC BUS OFF light illuminated indicates the AC bus is unpowered.

GENERATOR CONTROL SWITCH ……….……….. OFF, THEN ON Attempt only one reset.

APU SELECTOR

(If APU available) ……….………. START, RELEASE TO ON [Provide an additional source of electrical power.]

After APU running:

LEFT BUS TIE SWITCH………... OFF, THEN AUTO Attempt only one reset.

RIGHT BUS TIE SWITCH………..………... OFF, THEN AUTO Attempt only one reset.

If both AC BUS OFF lights were illuminated and AC power is restored:

FMC ROUTE ………..……….. ACTIVATE

FMC PERFORMANCE DATA ………...…...………..…….………....ENTER

If an IRS ALIGN light is illuminated:

IRS MODE SELECTOR

AC BUS OFF

(Affected IRS(s) only) ……….……...…...………..…….………...ATT

Enter heading on IRS control panel or FMC POS INIT page.

HEADING ………...……...…...………..…….………....ENTER

Continued on next page

Figure 2-21: A Page of the Quick Reference Handbook of Boeing 767 (Holder, 2003).

Taking advantage of features that become available through electronic alarm annunciation, several techniques have been proposed to automate the notion of the quick reference handbook and reduce the workload of pilots and ultimately achieve effective fault control. Hill (1993) has defined three questions, which can be arisen from the occurrence of multiple dependent failures, to be addressed prior to the development of such a technique:

- The first question is how to provide the operators with control procedures that do not contradict each other in the case of the synchronous occurrence of multiple failures. For example, the two conflicting procedures that cure the faults of high fuel temperature and

42 engine stall of an aircraft. While the former requires increasing the thrust of the linked engine to aid cooling, the latter requires reducing the thrust.

- The second question is how to raise the operators’ awareness of the combined results of applying more than one corrective procedure. Such a case might be faced when two or more faults occur in a temporal sequence. For example, when one of the two packs of an aircraft overheats, the corrective procedure then requires shutting the pack down. Similarly, the shutdown procedure should also be applied if the second pack overheats. In this case the cabin of the aircraft would be left without air pressurisation and temperature conditioning and an emergency descent should be launched.

- The last issue is how to raise the operators’ awareness of the consequential (or dependent) results of applying different corrective procedures. For example, when an aircraft depends for conditioning its cabin on one pack as the second one has been shut down due to an overheat fault, the occurrence of a bleed air leak failure in the engine on which the operative pack depends should be cured by cutting off bleed air. That would result in no air supply to the operative pack and the cabin would consequently be unpressurised and, again, an emergency descent should be launched.

In the same work, Hill (1993) has proposed an approach that can address the above questions and automate the notion of the quick reference handbook. In that approach the corrective procedures are (a) prioritised through exploiting a model of Goal Order Search Tree (GOST);

(b) arranged in a way that does not imply contradictions through exploiting a network propagation algorithm that counts the contradictions among the goals in the GOST; (c) provided to the pilots as electronic guidance through the Central Warning System (CWS¹).

Figure 2-22 shows an excerpt of the GOST of an initial configuration of an aircraft. GOST consists of a number of nodes, arrows and rules (logic gates) arranged in several levels. Nodes represent component statuses and critical functions of the aircraft. Arrows link the nodes to each other through rules (AND or OR) and show the paths in which statuses of the components and functions are propagated across different levels. Two types of arrows are used, the solid arrows representing direct propagation and the dashed arrows representing the inverse (not propagation). Every node encloses three attributes which are illustrated as follows:

(v, p, d)

Where v: is the value that shows whether the represented state is achieved or not;

p: is the priority that represents the importance of the given component or function in the overall functionality.

d: is the denied priority that represents the maximum priority of the state when it is not achieved and as required by the optimum configuration.

1 In modern aircraft the CWS has different names. For example, in the Airbus A320 it is called Electronic Centralised Aircraft Monitor (ECAM) and in the Boeing 757 and 747-400 it is called Engine Indicating and Crew Alerting System (EICAS) (Hill, 1993).

43 Figure 2-22: An Excerpt of the GOST of Initial Configuration of an Aircraft (Hill, 1993).

In Figure 2-22, GOST incorporates goals ENGINE1-SAFE, ELECTRIC, FUEL-SAFE and DOMESTICS, which are associated with the respective attributes (1, 40, 40), (1, 10, 10), (1, 30, 30) and (1, 5, 5). The occurrence of a high fuel temperature, for instance, is represented by the node FUEL-HI-TEMP in which the value (v) of the enclosed attributes would be changed from 0 to 1, consequently. This fault may occur due either to there being extra load on the Inertial Drive Generator (IDG) or to there being insufficient cooling fuel.

Fuel overheating can be controlled either by disconnecting the IDG or by switching the galley off to reduce the load on the IDG and increasing the thrust to increase the flow of the fuel.

According to the associated priorities and functional dependability, switching the galley off is the best corrective action. After achieving that action the associated attributes of the relevant nodes would be calculated and updated according to the new configuration.

Nodes whose attributes would be changed are DOMISTIC, HI-TEMP, FUEL-ACTIONS, THRUST-HI, GALLEY, ENG-STALL and THRUST-LOW to become respectively as follows: (0, 10, 0), (1, 50, 50), (1, 10, 30), (1, 10, 30), (0, 10, 30), (0, 10, 40) and (0, 10, 30).

As such, the up-to-date priorities would contribute similarly to the decision on the best procedure to control future faults (Hill, 1993).

Despite the attractive control abilities of exploiting GOST, Hill (1993) has also identified a number of limitations. As the aircraft system has a number of different flying phases, the calculation of priorities must take the impact of those phases into account. Another limitation is that as the value (v) of the nodes’ attributes is a binary value, the presentation of the statuses of functions and components is restricted to two digital values (1 or 0). This does not align with the need of analogue values in different cases, e.g. presenting the thrust level. The last limitation

44 is the lack of identification of the transitory actions that are applied to obtain temporary statuses; such statuses are needed to serve specific controlling purposes and would be changed thereafter.