LAND 3 annunciation

[Hardy Heinlin]

Good morning,

PSX contains zillions of validation checks of zillions of autoland related variables (busses, receivers, ADCs, IRUs, RAs, hydraulics, etc. pp.), and a very complex algorithm determines whether LAND 3 or LAND 2 is to be annunciated. I just noticed in my code an additional line that checks whether less than 4 AC busses are powered; if this condition is true, LAND 2 is annunciated, regardless of all the other complex validations.

I think that additional line in my code was based on a theory or misunderstanding, not exactly on original documents, and I should be removing this line now. If I remove it, and AC bus 1 and 2 and 3 are powered (no matter whether one of them is powered by AC bus 4 or not), the LAND 3 annunciation will remain displayed.

Does anybody think I should not remove that line and keep it as is?


Regards,

|-|ardy

[Hardy Heinlin]

I just removed that line for a test and it looks good.

When AC bus 1 or 2 or 3 (one of the 1-2-3-trio) fails and remains isolated from the sync bus, LAND 2 is annunciated as usual, and the redundancy is such that AC bus 4 will be able to power the remaining two busses of the 1-2-3-trio should either of them fail; autoland remains available.

A redundancy problem now occurs only when the AC 4 bus tie is switched to ISLN: when isolated, AC bus 4 can no longer take over in case of a failure.

So, for example, when AC 1 remains unpowered (tie 1 off), and AC 2 and 3 are powered:
• LAND 2 is annunciated as long as the AC 4 bus tie is not switched to ISLN; autoland operates with two AC busses.
• When the AC 4 bus tie is switched to ISLN, those other two AC busses remain powered just as before, but AC 4 can no longer serve as a backup, thus autoland is disabled.


|-|

[DougSnow]

UAL explains it that way too. For LAND 3, you need Bus Tie Breakers and DC Isolation Relays 1, 2, and 3.

[John H Watson]

For info:

The autopilot system sends an electrical bus isolation command to Elec Bus Control Unit #1. After isolation, Elec Bus Control Unit #1 sends a signal to BCU #2 confirming that the busses have been isolated and BCU#2 sends a confirmation signal to the autopilot system. i.e. both BCUs are required.

JHW

[Jeroen Hoppenbrouwers]

It's ironical that LAND3 initiates all busses in isolation mode for safety, but as soon as a bus goes dead, isolation is rapidly abandoned for safety.  And still it is the right thing to do.


Hoppie

[John H Watson]

but as soon as a bus goes dead, isolation is rapidly abandoned for safety.

That doesn't really explain why the busses remain isolated if the system degrades to NO LAND 3 below 200'

[Hardy Heinlin]

The autopilot system sends an electrical bus isolation command to Elec Bus Control Unit #1. After isolation, Elec Bus Control Unit #1 sends a signal to BCU #2 confirming that the busses have been isolated and BCU#2 sends a confirmation signal to the autopilot system. i.e. both BCUs are required.

Both BCUs are already required to control the four bus ties. This is modelled in PSX. So, for example, when BCU 2 is unpowered, bus ties 1 and 2 cannot be isolated anyway, and the AFDS model will invalidate the bus status as there is, in fact, no isolation present.

It's ironical that LAND3 initiates all busses in isolation mode for safety, but as soon as a bus goes dead, isolation is rapidly abandoned for safety. And still it is the right thing to do.

But AC bus 4 will power only the failed bus. The other two good busses remain isolated.

Check the EICAS ELEC page with the 5.555 55 trick :-)


|-|ardy

[Hardy Heinlin]

I just rediscovered that my bus tie isolations (correctly) won't latch in the last position when the associated BCU is unpowered. E.g. when BCU 1 is unpowered (in flight with battery power OK, by pulling both BCU CBs), bus ties 1 and 2 will isolate.

So, since someone might pull both BCU CBs (P6 G6 & G7), I'll have to add this BCU check to my autoland bus isolation validation.


Regards,

|-|ardy


To unpower BCU 1 it is already sufficient to turn off the battery switch (unless EXT PWR 1 is available).

[kevmac86]

Hi All,

In reply to your question, as far as I understand it, with a bus loss below 200ft, the system is "fail operational", the annunciation of LAND 2 at this altitude would cause distraction and nothing could be done about it in time.  As the flight crew should be monitoring the approach, then if things go wrong, then they would take over, or commit to a go-around.

Below is the text from my training manual regarding bus isolation, sorry it's a bit long, there is two diagrams that go with it but I can't upload them from here, currently in Tokyo doing a B777 B1/B2.  Hope this helps to clarify, but probably won't.

General
After BCU 1 receives an autoland isolation request from the FCCs, it determines the number of generators and TRUs that are operating.

Based upon this information the BCU directs the appropriate GCUs to operate the BTBs and DCIRs to configure the electrical system in one of five possible configurations labeled A, B, C, D and E.

The configurations for generator failures are:
A no generators inoperative
B No. 1 generator inoperative
C No. 2 generator inoperative
D No. 3 generator inoperative
E No. 4 generator inoperative

Autoland Operation
A generator and TRU on the same channel are called a Generator Channel ( G C ) . If more than o n e GC is inoperative, BCU 1 ignores the autoland request. When the autoland request is made the BCU determines how many GCs are available and configures the system accordingly.

Configuration
If there are four generators and four TRUs operating BCU 1 directs the GCUs to configuration A. Configuration A is the normal mode for triple channel autoland.

If one GC is inoperative, BCU 1 configures the system to B, C, D or E depending upon which GC is inoperative.

NOTE: The SSB or any BTB opened prior to the autoland isolation request will not be closed during the autoland mode.

GC Failures
If a GC fails while in configuration A, BCU 1 re-configures the system to B, C, D or E depending upon which GC failed.

If more than one GC becomes inoperative during autoland, the confirmation signal from BCU 2 to the FCCs is removed and the system reconfigure according to the radio altitude of the aircraft.

Above 200 feet the FCCs remove the autoland request and the BTBs and DCIRs return to their original position before autoland.

Below 200 feet the autoland request remains and the DCIRs close maintaining isolation of the ac power.

Kev Mac

[kevmac86]

Just to clarify something from my previous post, with a generator failure, then the TRU re-configures to get power using the BTB's and the SSB.

sorry forgot to mention that.

Kev Mac

[John H Watson]

The Hamilton Sunstrand manual says that if a BCU power supply fails, autoland is cancelled anyway.

A BCU transmits an "alive" signal to the adjacent GCUs and opposite BCU. If power is lost to the BCU, the "alive" signal disappears causing a chain of effects (among these, a degradation of the ability of the electrical system to use back up power sources for Autoland).

Rgds
JHW