744 Forum

Hi :)

Was clicking through a Flight Controls-CBT and I think I found an error in PSX?
When setting the STAB trim cutout switches for Hydr. System 2&3 to off, the Hydraulic power of the stabilizer is totally lost and trimming should not be possible anymore I guess. In PSX, I still can with the ALTN stab trim switches ...
Tried it with the PMDG, there I get no trimming possibility anymore (besides an autoland caution when I disable one system only -> in PSX it didn't show up). In doubt, I would normally consider PSX more realistic than PMDG, but since I also expect the different behaviour... ;)

Any ideas? Maybe I'm missing something?

Hi,

it's intentionally programmed like this. I've learned that those cutout switches affect the stab trim/rudder ratio modules (SRMs) which control the trim rate and which command the stab trim control modules (STCMs). The trim switches on the yokes are connected to the SRMs. When alternate trim is used, however, trim commands are sent directly to the STCMs and full trim rate is applied, and the trim limits are extended as well.

Does your CBT explicitely refer to this cutout function, or does it mean the shutdown of hydraulic systems 2 & 3? Of course, when hydraulic systems 2 & 3 are depressurized, the alternate stab trim will be inop as well.


Regards,

|-|ardy

Quote from: sbergert on Mon,  7 Aug 2017 14:39
When setting the STAB trim cutout switches for Hydr. System 2&3 to off, ...

These switches do not cutout any hydraulic systems. Hydraulic systems 2 & 3 remain operative when you set these switches to the CUT position. There is no OFF position either. You need to set the demand pump and EDP switches to OFF (on the overhead panel).

Hi Hardy,

off course I meant cutting off the hydraulic power to the stabilizer with the two cutout switches, not the complete hydraulic system 2 & 3 :)

Still, the alternate trim works in PSX even if both switches are in cutout...  the stab trim indication moves and I can trim.
Also, should the EICAS caution "autoland" be shown with one of the two cutout switches in cutout?

It's the Atlas Air 747 CBT (availabe on youtube, flight controls) I was watching.

https://youtu.be/Zh-vv_0i2Rs?t=996

At 16:36 there is a picture showing the trim switches on the yoke, not the alternate trim.

At 16:53 he says when 1 cutout switch is in CUT, half trim rate is applied. That's correct for the trim switches on the yoke; I say this doesn't affect the alternate trim which is always full rate because it bypasses the trim rate system.

So this CBT doesn't clearly disagree with PSX.

If someone can prove the alternate trim is incorrectly modelled in PSX, I'll modify it. But I'm not convinced yet :-)


|-|

Hi Hardy,

Here's the FCOM diagram:

(https://www.dropbox.com/s/i48pxgva5tpkhj5/744_stab_trim.PNG?raw=1)

According to the text:

QuoteStabilizer Trim Cutout
Hydraulic systems 2 and 3 power stabilizer trim. Two guarded Stabilizer Trim Cutout switches control stabilizer trim. With the guards closed, the switches are held in AUTO position, allowing automatic cutout of the related hydraulic system if unscheduled stabilizer trim is detected. With a Stabilizer Trim Cutout switch in CUTOUT, hydraulic power to the related trim control module is shut off.

Positioning a switch to ON overrides the automatic cutout function and supplies hydraulic power to the related control module. If automatic cutout has occurred, hydraulic power remains shut off until the respective cutout switch is placed ON.

If one actuator fails to operate, trim commanded by the flight crew reduces to half the normal scheduled rate.

It looks to me as though both the alternate and control column trim switches feed in to the STCMs, and the cutout switches shut off the hydraulic power to the trim actuator. Thus my inclination is that there should be no trim at all (normal or alternate) with the switches in CUTOUT.

However, I obviously can't vouch for what the real aeroplane does, and the FCOM diagrams may not tell the whole story!

Thank you. But this doesn't convince me either :-)

I always refer to maintenance books as they are more detailed ...


|-|ardy


P.S.: Actually, it's easy to understand: Just ask yourself why does the ALTN trim provide full trim rate when one system is cutout and the yoke trim applies half rate? Why does one cutout not affect the rate of the ALTN trim? (Rhetorical question.) So why should two cutouts affect the ALTN trim? There is more inside these modules than those simplified diragrams show.

All the Alternate Switches do is bypass the SRMs and activate separate solenoids on the STCM. But the switches do cut off hydraulics to the STCM. If you have no hydraulics, no trim.

Hardy, are you thinking of the flt control "Tail shutoff" switches on the maintenance panel? These have no effect on stab trim.

Cheers
JHW

Strange. It's been working like this in PSX all the time. I think we discussed this in the alpha team over 7 years ago. I haven't changed it, as far as I recall ...

I'm thinking of the stab cutout, not tail shutoff.


Cheers,

|-|ardy

The stab trim cutout switches have direct control of the motor operated shutoff valve (MOV)

From one of the earlier forums...

QuoteLooking at single stab trim motor operation:

MOV (Motor operated shutoff valve): This allows hydraulic fluid to get to the other 2 valves (CONTROL/ARM) in the STCM and, ultimately, the stab trim drive motor.
If the respective thrust quadrant CUTOUT switch is in "AUTO", the control of fluid to the STCM (valve control module) is controlled by the SRMs (Stab Trim Rudder Ratio Modules). 5 seconds after a CUTOUT switch is placed to AUTO, both SRMs command each MOV to open.

I don't know how this slipped by Avi :D

Here's a page from the MEL.

(http://www.hoppie.nl/forum/var/b744f-mel.jpg)

Quote from: John H Watson on Tue,  8 Aug 2017 04:04
I don't know how this slipped by Avi :D

I'm asking the same question  :D

OK, sufficiently convinced!

I was so used to this "feature" over the years, and nobody complained until now, that I always thought it was correct :-)

I'll modify it in update 10.1.8.


Questions:

Are any EICAS messages missing when one or two switches are in CUTOUT?

Is it correct that with ALTN trim the full trim rate is achieved even when one switch is in CUTOUT?


Thanks,

|-|ardy

Quote from: Hardy Heinlin on Tue,  8 Aug 2017 11:52
Is it correct that with ALTN trim the full trim rate is achieved even when one switch is in CUTOUT?

The FCOM makes no mention of this. It does say that the STCM outputs are mechanically summed and therefore if only one is operating then trim will be approximately half rate, and makes no distinction between normal and alternate trim in this regard (though it does say that alternate trim gives a wider range).

I can't see how the alternate trim could possibly drive the stab any faster with only half the hydraulic power available.

I think it works like this...
Left Alternate trim switch directs #1 pressure provided it is available - i.e. Left cutout is not activated
Right Alternate trim directs #2 pressure in the same way provided right cutout is not activated.

If you have a left cutout, for example - then if you push both Alternate trim switches (which is what you would normally do) then only the right one will work so you will get half rate.

Peter.

Perhaps what I'm having in mind is not the hydraulic dependent rate but the airspeed dependent rate. Below 225 KIAS, the commanded normal rate is 2.5 times higher than it is above 225 KIAS. The commanded rate by the alternate trim is always the highest rate. Airspeed doesn't influence the alternate trim.

And after this command stage there is the second stage: the hydraulics. They may decrease the final physical rate by 50 % when half powered.


|-|ardy

I'm in the sim tomorrow - I can have a fiddle about if you like..
Peter

Thanks, Peter, but I think it's not necessary; there are no doubts anymore.


Regards,

|-|ardy

Glad it is solved :)

Concerning an EICAS-message I did only notice the amber "autoland " on the PMDG...though I don't know where they have it from...

Some of the alpha notes...

QuoteNoted today on a real aircraft, when selecting CUTOUT, the >STAB TRIM 2/3 message takes about 1 second to appear, but 7.5 seconds to disappear (when returning the switch to AUTO).

Quote(A training manual) has some details about the STAB TRIM 2/3 messages.

The Advisory messages are latched in the SRM's (except when caused by moving the Cutout switch to CUTOUT - In this case, returning the switch to AUTO removes the message after 5 seconds).

The SRM monitors the hydraulic pressure used to release the brakes on the hydraulic motors. If a trim command is given and hydraulic pressure is not present to release the brakes, then the STAB TRIM message will be set. I don't think the Stab Trim system declares itself inoperature simply because you have turned off the hydraulics. There has to be a valid trim command, too.

If a fault causes the SRM to shut the MOV, the CUTOUT switch has to be moved away from AUTO to reset the message (5 second delay on this, also).

The wording of the text is a little ambiguous. We may have to discuss this.

The manuals say 5 second delays, but IRL 7.5 seconds.

Thanks for the quotes. I just rechecked PSX; all these details are modeled in PSX, including stab trim runaway malfunctions to test the protection logic.

(There are no notes re autoland, as far as I can see. The stab cutout keeps the autopilots operative. Pitch control remains possible without stab trim.)


|-|ardy

Sorry.. crossposted again... I'll answer your last post in my next message...

Quote(There are no notes re autoland, as far as I can see. The stab cutout keeps the autopilots operative. Pitch control remains possible without stab trim.)

Surely as soon as the stabiliser doesn't move, the SRM will send a (autotrim) fault signal to the FCCs?

From my manuals...

The autotrim valid discrete from the Left SRM is transmitted to the Left and Centre FCC and from the Right SRM to the Right FCC. This discrete is used by the FCC to control autotrim and for engage interlocks.

Autotrim valid from the SRM is required for single channel to stay engaged.

If there is a single autopilot channel engaged, the loss of the autotrim valid signal causes the autopilot to disconnect...

Page 306/7
During triple-engage [and, say the Left A/P was first in command], the Left FCC uses the Left SRM. If dead trim is detected, the autotrim function will autosequence to the Right FCC and the Right SRM.

OK, thanks.

In PSX, the A/P single channel validation checks if either SRM is powered. That's OK. But the cutout switch doesn't remove power from the SRM model. Power is set by the electrical busses and CBs, not by the cutout.

QuoteThe autotrim valid discrete from the Left SRM is transmitted to the Left and Centre FCC and from the Right SRM to the Right FCC.

Is that "autotrim valid" discrete sent continuously? If so, FCC L & C should be inop when SRM L is unpowered, and FCC R should be inop when SRM R is unpowered. In the current PSX version, any FCC can operate as long as SRM L or R is powered (referring to electrical busses and CBs, not to the cutout).

QuoteIs that "autotrim valid" discrete sent continuously?

I'd say that dead trim will be reported whenever a trim command is given and nothing happens (e.g. if no hydraulics to move the stab). SRM power failures should be detected immediately (I assume with a small time delay to limit nuisance messages).

QuoteIf so, FCC L & C should be inop when SRM L is unpowered, and FCC R should be inop when SRM R is unpowered.

Certainly with single A/P engagement. Here's where it gets confusing. The notes do say that the Left and Right SRM's send "autotrim valid" discretes to the FCCs (The Left SRM sends it to the Left and Centre FCCs, the Right SRM sends it to the Right FCC and the Centre FCC. I don't know what happens if only one SRM is operating with the Centre A/P in command.

"Autotrim valid from the stabilizer trim/rudder ratio module (SRM) is required for single channel to stay engaged"

During multi-engage, there is crosstalk between the FCCs. I don't know how this affects engagement if one SRM fails.

Stab position has always been a requirement for engagement. "Local" sensors are required for engagement after Service Bulletin SB 22-2197 (Local stab and local IRU for single A/P engagement)

In all PSX versions so far, stab position data is always crosstalked across all FCCs, even in single channel mode. So to get rid of the data, all three FCCs need to be unpowered, and then there is no FCC operative anyway :-)

Regarding local sensors..  There are 3 RVDTs for stab position which report to their respective Flap Control Unit (L/C/R). Each flap control unit provides stab position data to the respective FCC (ref SSM 27-51-04).

Even if the data is shared, that still contradicts the local sensor rule (during single A/P ops)

Quote from: John H Watson on Wed,  9 Aug 2017 11:49
The autotrim valid discrete from the Left SRM is transmitted to the Left and Centre FCC and from the Right SRM to the Right FCC.

Are these assignments of SRM L & R only related to autotrim monitoring? In PSX, before any single channel validation and multichannel validation there is an initial check when a CMD switch is pressed *; this initially checks whether a related SRM is powered. And the "related SRM" in this particular check (in PSX) is assigned like this:

FCC L requires SRM L
FCC C requires SRM L or R
FCC R requires SRM R

I can't remember whether this was based on a theory or on a maintenance manual. Maybe this part of the logic should have the same assignment like the autotrim validation, namely:

FCC L requires SRM L
FCC C requires SRM L
FCC R requires SRM R


Cheers,

|-|ardy


* This is that check which also tests the Auto Flight Warning system before it allows A/P engagement.

QuoteThe autotrim valid discrete from the Left SRM is transmitted to the Left and Centre FCC and from the Right SRM to the Right FCC

Sorry, that may be a misquote (unless there are parts of the manuals which disagree with each other). I did a quick search of my training manuals and I did find one part of the manual which agrees with my later message:

QuoteThe notes do say that the Left and Right SRM's send "autotrim valid" discretes to the FCCs (The Left SRM sends it to the Left and Centre FCCs, the Right SRM sends it to the Right FCC and the Centre FCC.

Quote from: HardyAnd the "related SRM" in this particular check (in PSX) is assigned like this:

FCC L requires SRM L
FCC C requires SRM L or R
FCC R requires SRM R

This does seem logical. During single engage, this would give the Centre A/P the ability to autosequence SRMs due to SRM failures.

Elec Book 15, page 306 shows autosequencing of SRMs during multi-engage. i.e. two or three A/Ps engaged.

I'll keep searching for more info...

Cheers
JHW

Thanks! :-)

From the book:

QuoteThe autotrim valid signals tell the FCC if the SRM is not valid or if manual trim switches are in use.

As far as I can see, autotrim is not valid when manual trim switches are pressed or when the SRM fails. This is already modelled in PSX (manual trim or SRM failure disengages the single channel A/P). Is the SRM also considered failed (invalid) when both hydraulics are cutout? If so, I would implement this condition in the "autotrim valid" section instead of making an extra validation check for this. Or is the cutout irrelevant and just the consequence of it, i.e. "dead trim", will invalidate the SRM?

I find the "dead trim" detector more interesting :-) E.g. no stab motion for, say, 3 seconds while commanded to move. (I don't know what exact timings are used in the detection.)


Cheers,

|-|ardy


P.S.: SRM internal malfunctions which cause "dead trim" are not modelled in PSX. So autosequencing to the other SRM is a job that will never be required. "Dead trim" can only occur by electrical or hydraulic power loss, and then it's not really a "dead trim" effect anymore as the trim command itself is already invalid (probably).


P.P.S.: Re "unscheduled trim" ... now I wonder whether alternate trim actions with A/P engaged cause the A/P pitch mode to level off with a yellow line through the pitch mode word. Alternate trim with A/P engaged triggers an "unscheduled trim" alert which now also triggers the >AUTOPILOT caution (as I just learned) which typically refers to a mode fault; in this case a pitch mode fault. But perhaps the mode fault (yellow line) will not occur because the elevator still has full authority even when the stab is extremely mistrimmed.

Sorry, too much reading for me to do at the moment (to fully understand the system). You would need to find a diagram showing the SRM fault monitoring module logic gates.

The SRM has a lot of information going to it.
Each cutout/auto/on Stab switch has two sets of contacts. One set of contacts tells the SRM (with an earth) if a switch is in ON or CUTOUT (on separate lines). If no earth on either, it assumes the switch is in AUTO. The other set of cutout switch contacts provides P7 CB power to each MOV (which shuts off hydraulics) and the SRM also knows the position of this switch (if power is available to the switch).
The SRM also knows the position of the MOV. It also knows the position of the stabiliser if the position circuits are powered. The SRM also knows hydraulic system pressure. The SRMs also talk to each other.

It's up to the SRM fault monitoring circuits to generate EICAS messages and to output an invalid signal to the FCC's with the above (and other) data.

Cheers
JHW

Thank you! It's enough information now anyway, and I'm finished with this chapter.

Since SRM autosequencing is not required (both SRMs report dead trim anyway), any dead trim detection will trigger "no autoland" and never "no land 3".


Cheers,

|-|ardy

The features discussed in this thread are now available in PSX 10.1.8 (items 1.8.006 + 1.8.007):

http://aerowinx.com/board/index.php?topic=4191.0


Cheers,

|-|ardy

Not sure if this will help: http://www.pprune.org/tech-log/599321-alt-pitch-trim-still-work-if-all-hyd-sources-got-cut.html

I was playing chess with various AC/DC bus configurations, and noticed a side effect of the above modifications introduced in version 10.1.8:

When bus 2 alone or bus 3 alone fails, LAND 2 mode activates. That's nice. But when bus 1 alone fails, NO AUTOLAND occurs. Not nice, is it?

During the single channel validation each FCC checks its dedicated SRM and servo control (among other things). The respective power supplies are assigned as follows. All CBs (C10..C17) are on P7.

SRMs:

FCC L uses SRM L
FCC C uses SRM L or R, whichever is powered
FCC R uses SRM R

SRM L operates if these are powered: ( C10 or C12 ) and ( C11 or C13 )
SRM R operates if these are powered: C15 and C16 and C17

C10 (C10263) "AC2L" powered by main standby bus
C11 (C10264) "DC2L" powered by main battery bus
C12 (C8782) "AC1L" powered by main standby bus
C13 (C8783) "DC1L" powered by main battery bus
C14 (C8784) "AC1R" powered by AC bus 1
C15 (C8785) "DC1R" powered by DC bus 1
C16 (C10265) "AC2R" powered by AC bus 2
C17 (C10266) "DC2R" powered by DC bus 2

Servos:

FCC L servo needs DC bus 3
FCC C servo needs DC bus 1
FCC R servo needs DC bus 2

Now ...
If bus 3 fails: Servo of FCC L fails -- I.e. just one FCC fails (LAND 2)
If bus 2 fails: Servo and SRM of FCC R fail -- I.e. just one FCC fails (LAND 2)
If bus 1 fails: Servo of FCC C and SRM of FCC R fail -- I.e. two FCCs fail (NO AUTOLAND)

A single failure of bus 2 or 3: no problem. A single failure of bus 1: problem. Can this be normal?


Cheers,

|-|ardy

Quote from: John H Watson on Thu, 10 Aug 2017 10:12
There are 3 RVDTs for stab position which report to their respective Flap Control Unit (L/C/R). Each flap control unit provides stab position data to the respective FCC (ref SSM 27-51-04).

If each flap control unit too can provide stab position data to its associated FCC, maybe I should use them when the respective SRM fails?

QuoteA single failure of bus 1: problem. Can this be normal?

I think it is. I don't think the aircraft was designed to carry out autolands with bus failures... only generator failures.

The battery chargers are on AC Bus #1. Wouldn't that be an issue?

I have this vague recollection that some QRHs have a special note about AC 1.

I just noticed that at least one real-life 744 says NO LAND 3 in case of AC bus 1 failure,
whereas PSX says NO AUTOLAND (see comments above from April 2018).

Can this really be aircraft specific?


|-|ardy


Edit:

Quote from: Hardy Heinlin on Wed, 18 Apr 2018 04:05
SRMs:

FCC L uses SRM L
FCC C uses SRM L or R, whichever is powered
FCC R uses SRM R

SRM L operates if these are powered: ( C10 or C12 ) and ( C11 or C13 )
SRM R operates if these are powered: C15 and C16 and C17

C10 (C10263) "AC2L" powered by main standby bus
C11 (C10264) "DC2L" powered by main battery bus
C12 (C8782) "AC1L" powered by main standby bus
C13 (C8783) "DC1L" powered by main battery bus
C14 (C8784) "AC1R" powered by AC bus 1
C15 (C8785) "DC1R" powered by DC bus 1
C16 (C10265) "AC2R" powered by AC bus 2
C17 (C10266) "DC2R" powered by DC bus 2

I think in the red text line there should be an "or" instead of an "and", like this in blue:

SRM R operates if these are powered: ( C15 or C17 ) and C16

SRM L has an OR between two DC sources, and another OR between two AC sources.
Similarly, I think SRM R should not have an AND between an AC source and a DC source; it should combine DC with DC, and AC with AC, and not mix AC with DC.
Also, SRM L can work with a single pair of a #1 and a #2 bus; it just needs two, not three like in the red line. I think SRM R should also need just two, not three. That is, the three sources shouldn't all be combined by AND operators. There should be at least one OR. And that should be between the two DC sources C15 and C17.

Now when AC bus 1 fails, SRM R still gets power from C16 and C17. And FCC R remains valid, and "NO LAND 3" replaces "NO AUTOLAND".

If you still have a copy of the basic PSM (FCE power supply) diagram...

Each SRM receives (and perhaps needs) from the PSMs:

1) +5vdc and +/-15Vdc (derived from the 115Vac CBs mentioned above)
2) PSM VALID signal (an earth signal)

Looking at the schematics, each PSM has two channels (1 & 2). Two DC sources go to each PSM. One DC source powers the fault monitoring circuits in Channel 1. The other DC source powers the fault monitoring circuits in Channel 2. Each PSM needs to see both channels producing an ok signal before a "PSM VALID" (earth) signal is sent to the SRMs. If a channel is dead, I can't see how it can generate a ok signal.

The Left SRM needs 115vac C10 or C12 (it has redundancy) for +5dc and +/-15vdc
The Right SRM needs 115vac C16 (no redundancy) for +5dc and +/-15vdc

The Left SRM also needs (as far as I can see) the respective PSM to have two sources of DC to produce a "PSM valid" signal. i.e. (C11 and C13).
The Right SRM also needs (as far as I can see) the respective PSM to have two sources of DC to produce a "PSM VALID" signal. i.e. (C15 and C17)

With my current understanding, it should be:

SRM L operates if these are powered: ( C10 or C12 ) and ( C11 and C13 )
SRM R operates if these are powered: (C16) and (C15 and C17)

To me, NO AUTOLAND is more likely as a result of power source failure.

I seem to remember pulling FCE CBs to see what messages would be generated (on the real aircraft), but I can't remember the results.

Hardy, ref: Blue Test forum post 13850

QuoteCan this really be aircraft specific?

Well, we know there are hundreds of options when it comes to autopilot stuff... Where do I begin?  ;)

Next theory...  Maybe I misunderstood the function of the PSM VALID signal...

From the books:

Quote- VALID: PSM internal monitors output (send) a valid discrete to the YDM,
SRM and FCU. Loss of all valid discretes will inhibit fault
annunciating by the operating modules resulting from an out of
tolerance power supply output. Receipt of a valid power discrete
is required prior to microprocessor initialization.

Assuming "loss of all valid discretes" can be produced by loss of  DC power to either channel in the PSM ...  and assuming "operating modules" means YDM, SRM, FCU.... then the loss of one or more DC voltage sources might simply stop the YDM, SRM and FCU generating a fail message (?).

However, on power up, the "operating modules" (YDM, SRM, FCU, etc) must receive a valid signal from the PSM. Otherwise they might generate fail messages...  and even fail to operate (?).

So, in theory, if both sources of PSM DC power is lost in flight (and an SRM is operating at the time), the SRM carries on with what it was doing. However, if the PSM were to lose AC power, the SRM would lose +5Vdc and +/-15Vdc and the SRM, etc, would definitely fail.

The PSMs also provide 26Vac (to various flight control systems). If both DC power sources are lost from the left PSMs, the backup source for 26Vac (in PSM 2L) won't be available (as the PSM internal switching relays and logic use DC voltage).

I don't really know how to prove this without a real aircraft to play on.

I haven't read post #37 yet. Here's my reply to post #35:

Quote from: John H Watson on Sat, 25 Aug 2018 01:07
Two DC sources go to each PSM. One DC source powers the fault monitoring circuits in Channel 1. The other DC source powers the fault monitoring circuits in Channel 2. Each PSM needs to see both channels producing an ok signal before a "PSM VALID" (earth) signal is sent to the SRMs. If a channel is dead, I can't see how it can generate a ok signal.

Problem A (Are always two DC sources required for a PSM-valid signal?)
Can we be sure that a PSM needs to see -- during preflight and inflight -- both channels to produce a VALID signal? I see no point in having a second source as a backup if the PSM will never work with just a single source anyway. The box promises to provide double safety, but it will stop operating when double safety is no longer assured?

Could it be that the validation logic implies more than just a power source check? Maybe it checks whether the DC failure occurs preflight or inflight. It may be a MEL item before takeoff, but may still allow autoland once the aircraft is in the air?

Problem B (Does SRM L need two PSM-valid signals? Not to confuse with problem A!)
Regarding your new suggestion that SRM L should get two FCE valid signals, i.e. two DC pairs (double-double). Since SRM R is able to operate with a single FCE, that is, with just one valid signal from FCE 2R, why should SRM L be different and require more than one FCE? SRM L gets a valid from FCE 1L and another valid from FCE 2L. Either valid signal already incorporates a pair of DC channels. I guess SRM L will work with the one pair or with the other pair; an SRM doesn't need 4 DC channels. 1 pair, i.e. one FCE is sufficient. The other pair is a backup. Only SRM L has a backup.


Cheers,

|-|ardy


P.S.: Re problem B -- just in case my code text is being misunderstood ... just in case ...
"SRM L operates if these are powered: ( C10 or C12 ) and ( C11 or C13 )"
This means: "SRM L operates if these are powered: Fce1L or Fce2L"

Fce1L = ( Dc.C11 or Dc.C13 ) and Ac.C12
Fce2L = ( Dc.C11 or Dc.C13 ) and Ac.C10

Either Fce gets the same blue stuff. So in the programming language it needs to be written just once. This line ...

( Ac.C10 and ( Dc.C11 or Dc.C13 ) )  or  ( Ac.C12 ) and ( Dc.C11 or Dc.C13 ) )

... is equal to this line ...

( Ac.C10 or Ac.C12 ) and ( Dc.C11 or Dc.C13 )

Note that this P.S. refers to problem B :-)

Quote from: John H Watson on Sat, 25 Aug 2018 04:09
Next theory...  Maybe I misunderstood the function of the PSM VALID signal...

From the books:

Quote- VALID: PSM internal monitors output (send) a valid discrete to the YDM,
SRM and FCU. Loss of all valid discretes will inhibit fault
annunciating by the operating modules resulting from an out of
tolerance power supply output. Receipt of a valid power discrete
is required prior to microprocessor initialization.

I interprete this as "a single valid discrete is sufficient to provide fault annunciating".

QuoteCan we be sure that a PSM needs to see -- during preflight and inflight -- both channels to produce a VALID signal?

We can't be sure... In fact, after reading the notes, it does seem to be saying that VALID is not required all the time.

About the VALID signals...  The diagrams shows  2 x channel "ok" logic gates in series, so both need to be ok. The 2 channel ok valid only comes out of the PSM on one pin. Each SRM is capable of getting two VALID signals (on separate pins). Only the Left SRM would be able to get VALID signals from two PSMs, and I'd agree that as long as one pin on the SRM is getting a VALID signal from any PSM, it will be happy.

The diagrams don't show what happens to the VALID signals when they are received. The SRM will have it's own fault processors and if it detects a fault and if it's not getting a VALID signal from the PSM, it might assume that there is nothing wrong with itself, but simply an external power failure.

The text does seem to indicate that the SRM will look for a VALID signal on power-up (i.e. SRM power-up on the ground... or in flight if SRM power is lost and recovered in flight).

QuoteMaybe it checks whether the DC failure occurs preflight or inflight.

The SRMs don't actually use the power from the DC CBs (C10, C11, C15 and C17). The VALID signal is more an AC power ok signal. However, I understand, for PSX purposes, it probably won't matter if you code it that way.   The PSMs do output DC voltages, but these are derived from the AC CBs.
I wish I could remember the results of the circuit breaker tests I did. If I did pull both PSM DC CB's (not the AC) and nothing happened, it would help prove that the SRM doesn't need the DC CBs (if it has already run through its internal microprocessors checks). 

Your comment is making me happy :-)

So how about this? In the PSX code an SRM is powered when its related AC is available and:
related DC is available or not in preflight* phase.

* Power-up phase whatever ...


|-|ardy

Quote from: HardySo how about this? In the PSX code an SRM is powered when its related AC is available and:
related DC is available or not in preflight* phase.

* Power-up phase whatever ...

Using the expression "powered" has confused me.

For the SRM to be powered and functioning normally, it should really only need "related" AC (= 5vdc and +/-15Vdc). The quality/stability of this 5vdc and +/-15vdc may not be perfect (but will the SRM still use it if it isn't?).
The "related" DC is used in the PSM to analyse the quality of the "related" AC (after it enters the PSM) and for SRM switching. The "related" DC is only used in the SRM for the purpose of fault annunciation/or fault differentiation. When it used is the problem.

I need to have a look at the FIM to see what EICAS and CMC messages appear on the flight deck when the SRM loses "related" AC.

Yes, the question is: When is the "valid signal" used?

That means, when is the "related DC" relevant to the SRM? Perhaps only during power-up.

That's why I want to combine the "related DC available" condition with another OR-condition,
e.g. with "OR not in power-up phase".

So when in the power-up phase, the "related DC" must be available.
When not in the power-up phase, it doesn't care about the "related DC".

...


This is the current version:

SRM L operates if these are powered: ( C10 or C12 ) and ( C11 or C13 )
This means: SRM L operates if these are valid: Fce1L or Fce2L

Fce1L = ( Dc.C11 or Dc.C13 ) and Ac.C12
Fce2L = ( Dc.C11 or Dc.C13 ) and Ac.C10


That could be the new version:

Fce1L = ( Dc.C11 or Dc.C13 or AfterPowerUp ) and Ac.C12
Fce2L = ( Dc.C11 or Dc.C13 or AfterPowerUp ) and Ac.C10

Or even with an AND in the DC pairs:

Fce1L = ( ( Dc.C11 and Dc.C13 ) or AfterPowerUp ) and Ac.C12
Fce2L = ( ( Dc.C11 and Dc.C13 ) or AfterPowerUp ) and Ac.C10

Or less radical:

Fce1L = ( ( Dc.C11 and Dc.C13 ) or ( ( Dc.C11 or Dc.C13 ) and AfterPowerUp ) ) and Ac.C12
Fce2L = ( ( Dc.C11 and Dc.C13 ) or ( ( Dc.C11 or Dc.C13 ) and AfterPowerUp ) ) and Ac.C10

Note that "Fce1L" and "Fce2L" in this text only refers to this SRM logic expression:
"This means: SRM L operates if these are valid: Fce1L or Fce2L"
This modification doesn't affect the other systems.

Channel 1 and 2 are required for a VALID signal, so I think an AND should be used:

QuoteFce1L = ( ( Dc.C11 and Dc.C13 ) or AfterPowerUp ) and Ac.C12
Fce2L = ( ( Dc.C11 and Dc.C13 ) or AfterPowerUp ) and Ac.C10

Or less radical:

Fce1L = ( ( Dc.C11 and Dc.C13 ) or ( ( Dc.C11 or Dc.C13 ) and AfterPowerUp ) ) and Ac.C12
Fce2L = ( ( Dc.C11 and Dc.C13 ) or ( ( Dc.C11 or Dc.C13 ) and AfterPowerUp ) ) and Ac.C10

The second one sounds safer. Will it still give you the desired NO LAND 3?

However, the more I read, the more complicated it gets. We may have to go back to the drawing board. Now I've discovered that some of the 115Vac power going into the SRMs is converted to 19volts DC and can provide DC power for the voltage monitoring circuits in the SRM if DC power is lost:

"The +/-19v DC is also provided to monitor A to maintain monitor operation during normal
monitor 28v DC power interrupts. Monitor B receives +/-19v DC from PSM 2L."

I assume "monitor A" is channel 1. I can't find a signal path from PSM 2L to monitor B (aka Channel 2) in the schematics.

I'll have to take another look at this tomorrow with a fresh mind. 


I'm still trying to figure out what the PSM RESET line is. The schematic says "PSM RESET discrete provides advance warning to user equipment of loss of DC output regulation due to loss of 115vac input."
Either channel can send this to the SRM. As far as I can see, the logic requires at least one of the DC CBs (but who knows with that back-up AC).

Quote from: John H Watson on Sat, 25 Aug 2018 15:40
The second one sounds safer. Will it still give you the desired NO LAND 3?

Yes, because in case of an Ac1 failure the remaining Dc2 and AfterPowerUp condition keeps the SRM alive.

QuoteNow I've discovered that some of the 115Vac power going into the SRMs is converted to 19volts DC and can provide DC power for the voltage monitoring circuits and other functions in the SRM if DC [CB] power is lost:

Sorry, I meant to say in the PSM.

The wiring schematics (if you piece four pages of them together) show the AC CB providing backup power to all the DC circuits in Channel 1 in the PSMs.
This agrees with the training notes.

Also, oddly, the engineering notes say:

Quote[PSM1L] Monitor B [= Channel 2] receives +/- 19 vdc from PSM 2L.

... and display a diagram showing this. However, i can find no wiring in the official wiring schematics or wiring diagrams showing this. The official wiring schematics appear to show that both channels can be powered by the AC CB alone. If the whole system can run on AC, you have to wonder why they bothered with DC CB's (other than the fact that those DC CBs also provide direct power for the Yaw Damper Modules).

If the system worked according to my training notes:

QuoteBoth PSM 1L channels would be powered if there was power to the following CBs:
C13 and C11 (normal)
C13 and C10
C11 and C12

Both PSM 2L channels would be powered if there was power to the following CBs:
C13 and C11 (normal)
C13 and C12
C11 and C10

Both PSM 1R channels would be powered if there was power to the following CBs:
C15 and C17 (normal)
C15 and C16
C17 and C12

Both PSM 2R channels would be powered if there was power to the following CBs:
C15 and C17 (normal)
C15 and C12
C17 and C16

If you believe the wiring schematics, Channels 1 and 2 can either be powered by the normal DC CB's or by the respective AC CB (DC CB's optional).

This doesn't take into account the power-up stuff (if it does behave in the way we think it does)

Breaking news: This will fix the autoland SRM validation problem too:

http://aerowinx.com/board/index.php?topic=4862.msg51834#msg51834

If you assume the PSM can also operate with AC power alone after power-up, then that would now add even more redundancy than I initially wanted.


|-|ardy

I still can't get my head around that VALID.

Here's the stuff on the RESET line function:

QuoteA reset discrete is provided [by the PSM] to the operating modules[e.g. SRM], to provide
advance warning of loss of DC power regulation due to loss of 115v
AC input*. This discrete puts the microprocessor [in the SRM or PSM???] in a reset mode on
power-up [what is powering up?] until Valid is achieved, and on power-down before Invalid
is determined. In the reset mode all outputs [to the SRMs, etc] are set to the fail safe
state.

*I don't know why they mention DC power regulation. If you lose AC you lose +5Vdc and +/-15vdc completely.

QuoteVALID
PSM internal monitors output a valid discrete to the YDM, SRM,
FCU and CMC. Valid is "all voltages are within tolerances".
Any voltage out of tolerance causes a loss of the valid discrete,
this inhibits fault annunciating by the operating modules [SRM, etc].
Receipt of a valid power discrete is required prior to
microprocessor [which unit?] initialization.

Quote from: John H Watson on Sun, 26 Aug 2018 09:21

Quote... to provide advance warning of loss of DC power ...

*I don't know why they mention DC power regulation. If you lose AC you lose +5Vdc and +/-15vdc completely.

Maybe a capacitor will hold the DC output up for some seconds before the DC goes down. Perhaps the SRM wants to quit working before the DC starts going down, hence the SRM's wish for an advance warning.


Edit: I just modified the AC bus short circuit malfunction simulation, so that the DCIR remains closed now. The EICAS messages are correct now (NO LAND 3 instead of NO AUTOLAND) ... until autoland actually engages. At that point it starts flip-flopping LAND-2 and NO-AUTOLAND. From there on the PSM logic actually needs a modification so that the SRM remains operative -- as promised by "NO LAND 3". If the SRM fails after DC bus 1 autoland isolation, the advance advisory "NO LAND 3" message is a lie :-)


So back to your last suggestion. I assume there is an OR between each of your lines? And the logic is for the power to the SRMs only? In my code, it will look like this:

1L = ( dc.C13 and ( dc.C11 or ac.C10 ) )    or    ( dc.C11 and ac.C12 )

2L = ( dc.C13 and ( dc.C11 or ac.C12 ) )    or    ( dc.C11 and ac.C10 )

1R = ( dc.C15 and ( dc.C17 or ac.C16 ) )    or    ( dc.C17 and ac.C12 )

2R = ( dc.C15 and ( dc.C17 or ac.C12 ) )    or    ( dc.C17 and ac.C16 )

This way it won't work with AC alone. But it doesn't matter. The blue part (AC/DC bus 2 stuff) will keep SRM R alive for FCC R and autoland in case of AC bus 1 failure.

Finally:

SRM L is powered if 1L or 2L
SRM R is powered if 2R

(1R is not used by SRMs)

QuoteMaybe a capacitor will hold the DC output up for some seconds before the DC goes down. Perhaps the SRM wants to quit working before the DC starts going down, hence the SRM's wish for an advance warning.

Sounds reasonable...  But then we are left to wonder what the SRM does with this impending failure data? Does it:

1) Record that quickly in its memory for use when power is available?
2) Quickly send a fault message to the EIUs before it completely dies?
3) Not send a fault message before it completely dies? (because the SRM itself is not really broken).
4) Stop transmitting data to the stabiliser system because it will know it might be erroneous as the power fades away?

Quote... until autoland actually engages. At that point it starts flip-flopping LAND-2 and NO-AUTOLAND.

During bus isolation, what is the #1 DCIR commanded to do in PSX?

QuoteI assume there is an OR between each of your lines? And the logic is for the power to the SRMs only?

Correct.

QuoteDuring bus isolation, what is the #1 DCIR commanded to do in PSX?

Perhaps I should have asked "Is bus isolation commanded?"

The conditions for Bus Isolation are:
Triple Arm
All A/P channels agree that they have LAND 3 capability
Above 200 feet.

If the A/P has already deemed that LAND 3 is not possible, then it shouldn't Bus Isolate.

The flip-flop has been fixed yesterday and everythings works now, but I'll answer your question anyway:

The bus isolation check in PSX does this:

Count = 0
If AC bus 1 GCB closed and DC bus 1 TRU intact THEN increase Count
If AC bus 2 GCB closed and DC bus 2 TRU intact THEN increase Count
If AC bus 3 GCB closed and DC bus 3 TRU intact THEN increase Count
If AC bus 4 GCB closed and DC bus 4 TRU intact and BTB 4 closed THEN increase Count
If Count > 2 and BCU1 powered and BCU2 powered then check OK else check FAIL

This check is part of each FCC's multichannel validation.

When autoland is not engaged, PSX multichannel validation is performed every 3 seconds for the advance EICAS advisories NO LAND 2 and NO AUTOLAND. It is also performed instantly at various mode change events, and in a high speed loop when autoland is running.

When only two FCCs get a multichannel validation, the EICAS will show LAND 2 etc., and bus isolation for these two remaining channels is still allowed.

When AC bus 1 has a short circuit, autoland is still possible with LAND 2. As we know, LAND 2 uses bus isolation as well. When LAND 2 is engaged while AC bus 1 has a short circuit, LAND 2 will isolate DCIR 1 anyway although DC bus 1 is intact, otherwise it would be a "LAND 2.5": 2 AC busses and 3 DC busses. (Aside from bus 4 as a backup.)


|-|ardy

QuoteWhen autoland is not engaged, PSX multichannel validation is performed every 3 seconds for the advance EICAS advisories NO LAND 2 and NO AUTOLAND. It is also performed instantly at various mode change events, and in a high speed loop when autoland is running.

Maybe I have things back to front, but it was my understanding that the FCCs have no idea what the status of the electrical system is until APP is selected. The FCCs already know what is working with respect to IRUs, RA's, etc, directly, and makes an assessment of the capability of the autoland system based on this alone (NO LAND 3 in this case). In this case, I assumed one of two things might happen:

1) The APFD assumes LAND 2 (from the EICAS NO LAND 3), so doesn't bother requesting Bus Isolation (I assumed that "All A/P channels agree that they have LAND 3 capability" is a prerequisite for the Bus Isolation request)

OR (or AND)

2) The AFDS sends a request to BCU #1 after APP is pushed to consider the prospect of isolating the busses anyway. The BCUs know the current status of the bus ties, generators, etc, so base the isolation command on that status. For any (?) type of autoland, I assumed it was essential that AC/DC Busses 1, 2 and 3 have power from some source. I don't think the BCU would would treat an ELEC BUS AC 1 failure as a valid GEN + TRU pair, so would not trip the DCIR. The electrical system would then tell the AFDS that it is not able to isolate the busses. LAND 2 would occur as expected. [EDIT: ... with no isolation]

QuoteEICAS - Not Multi-Channel (EICAS)
The main EICAS display shows the degraded status of the autoland
system.
EICAS shows NO LAND 3 as a level C message if the autoland
capability has degraded from fail-operational to fail-passive. This
may be caused by:
*One IRU (inner or outer loop, ILS receiver, or radio altimeter fail.
*One flap/stab control unit failure
*One FCC, servo, or servo loop failure
.....
*Electrical buses do not isolate when requested

i.e. not prior to APP selection.

P.S. There is always the potential for the EICAS autoland status to lie. The aircraft has no way of knowing in advance, say, if the "open" coil on a BTB is operative. When Bus Isolation is requested, the GCU won't be able to open the BTB... and BCU2 will have to report to the AFDS that bus isolation has failed.

Would you conclude that DC bus 1 remains powered when AC bus 1 has a short circuit during LAND 2 autoland bus isolation?

In PSX, an AC/DC bus does not kill itself when a multichannel check fails e.g. due to a failed IRU. Aside from the fact that the other good channels keep isolating themselves anyway. In case of a short circuit, the affected bus kills itself in the first place by its own short circuit, not by its multichannel invalidation thereafter.

QuoteThe aircraft has no way of knowing in advance, say, if the "open" coil on a BTB is operative

Understood. But it will know in advance whether a short circuit exists?

I'll test it out at the weekend if you like. It will only take a moment..
Peter

What do you have in mind, Peter? Do you want to activate an AC bus 1 short circuit from the instructor screen before autoland engages?


|-|ardy

QuoteWould you conclude that DC bus 1 remains powered when AC bus 1 has a short circuit during LAND 2 autoland bus isolation?

Yes. You don't want less power than you had before.

QuoteIn PSX, an AC/DC bus does not kill itself when a multichannel check fails e.g. due to a failed IRU.

A failed IRU (say, in cruise) will be known by the FCCs and the EICAS may show >NO LAND 3 (or whavever is applicable for an IRU failure). If >NO LAND 3 is shown on the Upper EICAS, the books* say that bus isolation will not be commanded. This is irrespective of any bus failures.

*Elec Book 15 p69

Quote from: John H

    The aircraft has no way of knowing in advance, say, if the "open" coil on a BTB is operative

Quote from: HardyUnderstood. But it will know in advance whether a short circuit exists?

I deliberately chose something which is not detectable until after Bus Isolation has been commanded.. The BCU (or GCU?) will only know there is a failure when the auxilliary contacts on the BTB show that the BTB has not moved position (i.e. to open). The coil doesn't get power until a command is made. The Bus Tie Breakers are magnetically latched in position (and don't require power unless required to change position).

QuoteIf >NO LAND 3 is shown on the Upper EICAS, the books* say that bus isolation will not be commanded.

I now see that you and the book refer to the "bus isolation" of that particular, failed bus, not of all busses in general. I thought you were saying that in LAND 2 none of the busses will be isolated -- which would be absurde, of course.

Even if there's no short circuit but just a single IRU failure, that single IRU failure will not cause all other busses to cancel their isolation. The mode will just change from LAND 3 to LAND 2.

So with your hint you just meant to say that DCIR 1 won't close for autoland if AC bus 1 has a short circuit, but the other good busses will isolate themselves?

Or are you saying that the NO LAND 3 message in cruise on that afore-mentioned real 744 (which had an AC 1 short circuit) would later turn into a NO AUTOLAND message when bus isolation is commanded?

Or are you saying there'll be no bus isolation command at all because there's no LAND 3 capability? But then it shouldn't say LAND 2. It should say NO AUTOLAND.

Assuming we have a LAND 2 because of an AC bus 1 short circuit. The other good busses are still isolated. Opening DCIR 1 will then have no tie effect as the other DCIRs are still closed. TRU 1 provides no power. DC bus 1 will fail because the other three DCIRs are closed. Or will DCIR 4 open?


|-|ardy


P.S.: I think there has been proven in a BA sim that a single engine failure, e.g. #2, will keep the LAND 3 mode active. Bus 4 will open its BTB and feed bus 2. The redundancy is reduced, but it's still LAND 3, not LAND 2. Only when just two of the three isolated busses (1, 2, 3) remain powered, LAND 2 will be displayed. That is, you can autoland when one AC bus fails. In other words: When one channel fails. Be it due to an RA failure or a short circuit.

QuoteOr are you saying there'll be no bus isolation command at all because there's no LAND 3 capability? But then it shouldn't say LAND 2. It should say NO AUTOLAND.

Quote from: Maintenance Manual(1) During the approach mode, three independent ac and dc power sources are required to
accomplish a fail-operational Category III autoland operation.

I can't find anywhere that it says that LAND 2 requires bus isolation. All the books say the same or similar thing:

From the AMM

Quote from: Maintenance Manual(6) These are the conditions for the bus isolation to occur:
....
(c) All the autopilot channels are not NO LAND 3 and not NO AUTOLAND (the main EICAS
display does not show NO LAND 3, or NO AUTOLAND).

LAND 2 simply gives redundancy of sensors, not isolation of power sources. You won't get NO AUTOLAND.

Quote from: HardyP.S.: I think there has been proven in a BA sim that a single engine failure, e.g. #2, will keep the LAND 3 mode active. Bus 4 will open its BTB and feed bus 2. The redundancy is reduced, but it's still LAND 3, not LAND 2.

I have no disagreement with this. An engine failure can still provide a valid solution for LAND 3. As far as we know, if you have an engine failure, you won't get ">NO LAND 3" on the EICAS because all sensors/computers remain powered prior to APP being pushed. Bus isolation can occur and the sensors will still remain powered. On the other hand, having a dead AC Bus 1, I'm sure one or more of the sensors will have already failed prior to APP being pushed.

QuoteLAND 2 simply gives redundancy of sensors, not isolation of power sources.

I'm impressed. I didn't know this. Thanks to the inhibited EICAS ELEC synoptics during autoland nobody has ever noticed it :-)


Edit: I'm still so impressed. Please confirm that I'm not dreaming:
When, say, a single radio altimeter fails during autoland, and everything else is normal, none of the AC/DC busses will be isolated anymore, although autoland continues with LAND 2?

Edit 2: It must be true. Another hour has passed, and I'm now already used to it (I just modified it). I also learned that multichannel TOGA will cancel the bus isolation (but the A/Ps still keep controlling the rudders).

Hardy - I was just going to see if the Stab Trim cutout stopped alternate trim. That is all..
Peter

But you did notice that the stab trim cutout comments in this thread are from last year and that they are not the subject of the current discussion anymore? :-)


|-|ardy

QuoteThanks to the inhibited EICAS ELEC synoptics during autoland nobody has ever noticed it :-)

I have to admit, I've always had trouble getting my head around this stuff at the best of times. I'm starting to wonder, though, if the Elec Synoptic is actually inhibited during Land 2 (as the busses won't be showing anything unusual apart from the failures)

The 767 is the same. The 767 notes say "Bus isolation request is initiated for triple channel approach only". The 767 notes are good for removing ambiguities when it comes to A/P stuff.

Things didn't start making sense when you said that bus isolation would occur with the ELEC BUS AC 1 message. This would mean as soon as you pushed the APP button (this can be done in cruise), that you would lose DC Bus 1, too. DC Bus 1 has around 70 things attached to it.

Quote(I just modified it)

WOW... I expected that hundreds of lines of code would have to be modified/deleted.

Not quite hundreds. For the bus isolation command there were just 50 lines :-)

Very nice. I can now even autoland with 3 engines out -- as long as the airspeed is high enough.

Do you think I'm on the safer side if I inhibit the ELEC synoptics only when "LAND 3" is on the PFD FMA? (That automatically considers conditions like multichannel TOGA with "CMD", and degradation to LAND 2 below 200 with "LAND 3" remaining displayed, and such degradation with "LAND 3" disappearing.)


Cheers,

|-|ardy

Ah.. just checked the Boeing Maintenance Manual:

QuoteWhen autoland status is annunciated on the Primary Flight Display (PFD), the entire
electrical synoptic display is replaced by a ELECTRICAL SYNOPTIC INHIBITED FOR
AUTOLAND message

So not necessarily LAND 3

Then I assume multichannel TOGA also belongs to "autoland" in this context (ELEC synoptics inhibit).

Possibly.

TOGA is multichannel, but on that Engineering page I mentioned, GA cancels Bus Isolation, so I guess you won't see much even if it is unblanked.

Do we know what happens on the real deck? 

Just to confirm that operating both stab trim cutout switches causes the alternate trim to be inoperative.
(BA sim).
Peter

Thanks, Peter. Engineering concurs ;)

Modification of SRM power logic and autoland bus isolation is now available in PSX 10.43:

http://aerowinx.com/board/index.php?topic=4191.0


|-|