STAB trim cutout - still able to trim??

[John H Watson]

Can we be sure that a PSM needs to see -- during preflight and inflight -- both channels to produce a VALID signal?

We can't be sure... In fact, after reading the notes, it does seem to be saying that VALID is not required all the time.

About the VALID signals...  The diagrams shows  2 x channel "ok" logic gates in series, so both need to be ok. The 2 channel ok valid only comes out of the PSM on one pin. Each SRM is capable of getting two VALID signals (on separate pins). Only the Left SRM would be able to get VALID signals from two PSMs, and I'd agree that as long as one pin on the SRM is getting a VALID signal from any PSM, it will be happy.

The diagrams don't show what happens to the VALID signals when they are received. The SRM will have it's own fault processors and if it detects a fault and if it's not getting a VALID signal from the PSM, it might assume that there is nothing wrong with itself, but simply an external power failure.

The text does seem to indicate that the SRM will look for a VALID signal on power-up (i.e. SRM power-up on the ground... or in flight if SRM power is lost and recovered in flight).

Maybe it checks whether the DC failure occurs preflight or inflight.

The SRMs don't actually use the power from the DC CBs (C10, C11, C15 and C17). The VALID signal is more an AC power ok signal. However, I understand, for PSX purposes, it probably won't matter if you code it that way.   The PSMs do output DC voltages, but these are derived from the AC CBs.
I wish I could remember the results of the circuit breaker tests I did. If I did pull both PSM DC CB's (not the AC) and nothing happened, it would help prove that the SRM doesn't need the DC CBs (if it has already run through its internal microprocessors checks). 

[Hardy Heinlin]

Your comment is making me happy :-)

So how about this? In the PSX code an SRM is powered when its related AC is available and:
related DC is available or not in preflight* phase.

* Power-up phase whatever ...


|-|ardy

[John H Watson]

So how about this? In the PSX code an SRM is powered when its related AC is available and:
related DC is available or not in preflight* phase.

* Power-up phase whatever ...

Using the expression "powered" has confused me.

For the SRM to be powered and functioning normally, it should really only need "related" AC (= 5vdc and +/-15Vdc). The quality/stability of this 5vdc and +/-15vdc may not be perfect (but will the SRM still use it if it isn't?).
The "related" DC is used in the PSM to analyse the quality of the "related" AC (after it enters the PSM) and for SRM switching. The "related" DC is only used in the SRM for the purpose of fault annunciation/or fault differentiation. When it used is the problem.

I need to have a look at the FIM to see what EICAS and CMC messages appear on the flight deck when the SRM loses "related" AC.

[Hardy Heinlin]

Yes, the question is: When is the "valid signal" used?

That means, when is the "related DC" relevant to the SRM? Perhaps only during power-up.

That's why I want to combine the "related DC available" condition with another OR-condition,
e.g. with "OR not in power-up phase".

So when in the power-up phase, the "related DC" must be available.
When not in the power-up phase, it doesn't care about the "related DC".

...


This is the current version:

SRM L operates if these are powered: ( C10 or C12 ) and ( C11 or C13 )
This means: SRM L operates if these are valid: Fce1L or Fce2L

Fce1L = ( Dc.C11 or Dc.C13 ) and Ac.C12
Fce2L = ( Dc.C11 or Dc.C13 ) and Ac.C10


That could be the new version:

Fce1L = ( Dc.C11 or Dc.C13 or AfterPowerUp ) and Ac.C12
Fce2L = ( Dc.C11 or Dc.C13 or AfterPowerUp ) and Ac.C10

Or even with an AND in the DC pairs:

Fce1L = ( ( Dc.C11 and Dc.C13 ) or AfterPowerUp ) and Ac.C12
Fce2L = ( ( Dc.C11 and Dc.C13 ) or AfterPowerUp ) and Ac.C10

Or less radical:

Fce1L = ( ( Dc.C11 and Dc.C13 ) or ( ( Dc.C11 or Dc.C13 ) and AfterPowerUp ) ) and Ac.C12
Fce2L = ( ( Dc.C11 and Dc.C13 ) or ( ( Dc.C11 or Dc.C13 ) and AfterPowerUp ) ) and Ac.C10

Note that "Fce1L" and "Fce2L" in this text only refers to this SRM logic expression:
"This means: SRM L operates if these are valid: Fce1L or Fce2L"
This modification doesn't affect the other systems.

[John H Watson]

Channel 1 and 2 are required for a VALID signal, so I think an AND should be used:

Fce1L = ( ( Dc.C11 and Dc.C13 ) or AfterPowerUp ) and Ac.C12
Fce2L = ( ( Dc.C11 and Dc.C13 ) or AfterPowerUp ) and Ac.C10

Or less radical:

Fce1L = ( ( Dc.C11 and Dc.C13 ) or ( ( Dc.C11 or Dc.C13 ) and AfterPowerUp ) ) and Ac.C12
Fce2L = ( ( Dc.C11 and Dc.C13 ) or ( ( Dc.C11 or Dc.C13 ) and AfterPowerUp ) ) and Ac.C10

The second one sounds safer. Will it still give you the desired NO LAND 3?

However, the more I read, the more complicated it gets. We may have to go back to the drawing board. Now I've discovered that some of the 115Vac power going into the SRMs is converted to 19volts DC and can provide DC power for the voltage monitoring circuits in the SRM if DC power is lost:

"The +/-19v DC is also provided to monitor A to maintain monitor operation during normal
monitor 28v DC power interrupts. Monitor B receives +/-19v DC from PSM 2L."

I assume "monitor A" is channel 1. I can't find a signal path from PSM 2L to monitor B (aka Channel 2) in the schematics.

I'll have to take another look at this tomorrow with a fresh mind. 


I'm still trying to figure out what the PSM RESET line is. The schematic says "PSM RESET discrete provides advance warning to user equipment of loss of DC output regulation due to loss of 115vac input."
Either channel can send this to the SRM. As far as I can see, the logic requires at least one of the DC CBs (but who knows with that back-up AC).

[Hardy Heinlin]

The second one sounds safer. Will it still give you the desired NO LAND 3?

Yes, because in case of an Ac1 failure the remaining Dc2 and AfterPowerUp condition keeps the SRM alive.

[John H Watson]

Now I've discovered that some of the 115Vac power going into the SRMs is converted to 19volts DC and can provide DC power for the voltage monitoring circuits and other functions in the SRM if DC [CB] power is lost:

Sorry, I meant to say in the PSM.

The wiring schematics (if you piece four pages of them together) show the AC CB providing backup power to all the DC circuits in Channel 1 in the PSMs.
This agrees with the training notes.

Also, oddly, the engineering notes say:

[PSM1L] Monitor B [= Channel 2] receives +/- 19 vdc from PSM 2L.

... and display a diagram showing this. However, i can find no wiring in the official wiring schematics or wiring diagrams showing this. The official wiring schematics appear to show that both channels can be powered by the AC CB alone. If the whole system can run on AC, you have to wonder why they bothered with DC CB's (other than the fact that those DC CBs also provide direct power for the Yaw Damper Modules).

If the system worked according to my training notes:

Both PSM 1L channels would be powered if there was power to the following CBs:
C13 and C11 (normal)
C13 and C10
C11 and C12

Both PSM 2L channels would be powered if there was power to the following CBs:
C13 and C11 (normal)
C13 and C12
C11 and C10

Both PSM 1R channels would be powered if there was power to the following CBs:
C15 and C17 (normal)
C15 and C16
C17 and C12

Both PSM 2R channels would be powered if there was power to the following CBs:
C15 and C17 (normal)
C15 and C12
C17 and C16

If you believe the wiring schematics, Channels 1 and 2 can either be powered by the normal DC CB's or by the respective AC CB (DC CB's optional).

This doesn't take into account the power-up stuff (if it does behave in the way we think it does)

[Hardy Heinlin]

Breaking news: This will fix the autoland SRM validation problem too:

http://aerowinx.com/board/index.php?topic=4862.msg51834#msg51834

If you assume the PSM can also operate with AC power alone after power-up, then that would now add even more redundancy than I initially wanted.


|-|ardy

[John H Watson]

I still can't get my head around that VALID.

Here's the stuff on the RESET line function:

A reset discrete is provided [by the PSM] to the operating modules[e.g. SRM], to provide
advance warning of loss of DC power regulation due to loss of 115v
AC input*. This discrete puts the microprocessor [in the SRM or PSM???] in a reset mode on
power-up [what is powering up?] until Valid is achieved, and on power-down before Invalid
is determined. In the reset mode all outputs [to the SRMs, etc] are set to the fail safe
state.

*I don't know why they mention DC power regulation. If you lose AC you lose +5Vdc and +/-15vdc completely.

VALID
PSM internal monitors output a valid discrete to the YDM, SRM,
FCU and CMC. Valid is "all voltages are within tolerances".
Any voltage out of tolerance causes a loss of the valid discrete,
this inhibits fault annunciating by the operating modules [SRM, etc].
Receipt of a valid power discrete is required prior to
microprocessor [which unit?] initialization.

[Hardy Heinlin]

... to provide advance warning of loss of DC power ...

*I don't know why they mention DC power regulation. If you lose AC you lose +5Vdc and +/-15vdc completely.

Maybe a capacitor will hold the DC output up for some seconds before the DC goes down. Perhaps the SRM wants to quit working before the DC starts going down, hence the SRM's wish for an advance warning.


Edit: I just modified the AC bus short circuit malfunction simulation, so that the DCIR remains closed now. The EICAS messages are correct now (NO LAND 3 instead of NO AUTOLAND) ... until autoland actually engages. At that point it starts flip-flopping LAND-2 and NO-AUTOLAND. From there on the PSM logic actually needs a modification so that the SRM remains operative -- as promised by "NO LAND 3". If the SRM fails after DC bus 1 autoland isolation, the advance advisory "NO LAND 3" message is a lie :-)


So back to your last suggestion. I assume there is an OR between each of your lines? And the logic is for the power to the SRMs only? In my code, it will look like this:

1L = ( dc.C13 and ( dc.C11 or ac.C10 ) )    or    ( dc.C11 and ac.C12 )

2L = ( dc.C13 and ( dc.C11 or ac.C12 ) )    or    ( dc.C11 and ac.C10 )

1R = ( dc.C15 and ( dc.C17 or ac.C16 ) )    or    ( dc.C17 and ac.C12 )

2R = ( dc.C15 and ( dc.C17 or ac.C12 ) )    or    ( dc.C17 and ac.C16 )

This way it won't work with AC alone. But it doesn't matter. The blue part (AC/DC bus 2 stuff) will keep SRM R alive for FCC R and autoland in case of AC bus 1 failure.

Finally:

SRM L is powered if 1L or 2L
SRM R is powered if 2R

(1R is not used by SRMs)

[John H Watson]

Maybe a capacitor will hold the DC output up for some seconds before the DC goes down. Perhaps the SRM wants to quit working before the DC starts going down, hence the SRM's wish for an advance warning.

Sounds reasonable...  But then we are left to wonder what the SRM does with this impending failure data? Does it:

1) Record that quickly in its memory for use when power is available?
2) Quickly send a fault message to the EIUs before it completely dies?
3) Not send a fault message before it completely dies? (because the SRM itself is not really broken).
4) Stop transmitting data to the stabiliser system because it will know it might be erroneous as the power fades away?

... until autoland actually engages. At that point it starts flip-flopping LAND-2 and NO-AUTOLAND.

During bus isolation, what is the #1 DCIR commanded to do in PSX?

I assume there is an OR between each of your lines? And the logic is for the power to the SRMs only?

Correct.

[John H Watson]

During bus isolation, what is the #1 DCIR commanded to do in PSX?

Perhaps I should have asked "Is bus isolation commanded?"

The conditions for Bus Isolation are:
Triple Arm
All A/P channels agree that they have LAND 3 capability
Above 200 feet.

If the A/P has already deemed that LAND 3 is not possible, then it shouldn't Bus Isolate.

[Hardy Heinlin]

The flip-flop has been fixed yesterday and everythings works now, but I'll answer your question anyway:

The bus isolation check in PSX does this:

Count = 0
If AC bus 1 GCB closed and DC bus 1 TRU intact THEN increase Count
If AC bus 2 GCB closed and DC bus 2 TRU intact THEN increase Count
If AC bus 3 GCB closed and DC bus 3 TRU intact THEN increase Count
If AC bus 4 GCB closed and DC bus 4 TRU intact and BTB 4 closed THEN increase Count
If Count > 2 and BCU1 powered and BCU2 powered then check OK else check FAIL

This check is part of each FCC's multichannel validation.

When autoland is not engaged, PSX multichannel validation is performed every 3 seconds for the advance EICAS advisories NO LAND 2 and NO AUTOLAND. It is also performed instantly at various mode change events, and in a high speed loop when autoland is running.

When only two FCCs get a multichannel validation, the EICAS will show LAND 2 etc., and bus isolation for these two remaining channels is still allowed.

When AC bus 1 has a short circuit, autoland is still possible with LAND 2. As we know, LAND 2 uses bus isolation as well. When LAND 2 is engaged while AC bus 1 has a short circuit, LAND 2 will isolate DCIR 1 anyway although DC bus 1 is intact, otherwise it would be a "LAND 2.5": 2 AC busses and 3 DC busses. (Aside from bus 4 as a backup.)


|-|ardy

[John H Watson]

When autoland is not engaged, PSX multichannel validation is performed every 3 seconds for the advance EICAS advisories NO LAND 2 and NO AUTOLAND. It is also performed instantly at various mode change events, and in a high speed loop when autoland is running.

Maybe I have things back to front, but it was my understanding that the FCCs have no idea what the status of the electrical system is until APP is selected. The FCCs already know what is working with respect to IRUs, RA's, etc, directly, and makes an assessment of the capability of the autoland system based on this alone (NO LAND 3 in this case). In this case, I assumed one of two things might happen:

1) The APFD assumes LAND 2 (from the EICAS NO LAND 3), so doesn't bother requesting Bus Isolation (I assumed that "All A/P channels agree that they have LAND 3 capability" is a prerequisite for the Bus Isolation request)

OR (or AND)

2) The AFDS sends a request to BCU #1 after APP is pushed to consider the prospect of isolating the busses anyway. The BCUs know the current status of the bus ties, generators, etc, so base the isolation command on that status. For any (?) type of autoland, I assumed it was essential that AC/DC Busses 1, 2 and 3 have power from some source. I don't think the BCU would would treat an ELEC BUS AC 1 failure as a valid GEN + TRU pair, so would not trip the DCIR. The electrical system would then tell the AFDS that it is not able to isolate the busses. LAND 2 would occur as expected. [EDIT: ... with no isolation]

EICAS - Not Multi-Channel (EICAS)
The main EICAS display shows the degraded status of the autoland
system.
EICAS shows NO LAND 3 as a level C message if the autoland
capability has degraded from fail-operational to fail-passive. This
may be caused by:
*One IRU (inner or outer loop, ILS receiver, or radio altimeter fail.
*One flap/stab control unit failure
*One FCC, servo, or servo loop failure
.....
*Electrical buses do not isolate when requested

i.e. not prior to APP selection.

[John H Watson]

P.S. There is always the potential for the EICAS autoland status to lie. The aircraft has no way of knowing in advance, say, if the "open" coil on a BTB is operative. When Bus Isolation is requested, the GCU won't be able to open the BTB... and BCU2 will have to report to the AFDS that bus isolation has failed.

[Hardy Heinlin]

Would you conclude that DC bus 1 remains powered when AC bus 1 has a short circuit during LAND 2 autoland bus isolation?

In PSX, an AC/DC bus does not kill itself when a multichannel check fails e.g. due to a failed IRU. Aside from the fact that the other good channels keep isolating themselves anyway. In case of a short circuit, the affected bus kills itself in the first place by its own short circuit, not by its multichannel invalidation thereafter.

The aircraft has no way of knowing in advance, say, if the "open" coil on a BTB is operative

Understood. But it will know in advance whether a short circuit exists?

[Britjet]

I'll test it out at the weekend if you like. It will only take a moment..
Peter

[Hardy Heinlin]

What do you have in mind, Peter? Do you want to activate an AC bus 1 short circuit from the instructor screen before autoland engages?


|-|ardy

[John H Watson]

Would you conclude that DC bus 1 remains powered when AC bus 1 has a short circuit during LAND 2 autoland bus isolation?

Yes. You don't want less power than you had before.

In PSX, an AC/DC bus does not kill itself when a multichannel check fails e.g. due to a failed IRU.

A failed IRU (say, in cruise) will be known by the FCCs and the EICAS may show >NO LAND 3 (or whavever is applicable for an IRU failure). If >NO LAND 3 is shown on the Upper EICAS, the books* say that bus isolation will not be commanded. This is irrespective of any bus failures.

*Elec Book 15 p69

    The aircraft has no way of knowing in advance, say, if the "open" coil on a BTB is operative

Understood. But it will know in advance whether a short circuit exists?

I deliberately chose something which is not detectable until after Bus Isolation has been commanded.. The BCU (or GCU?) will only know there is a failure when the auxilliary contacts on the BTB show that the BTB has not moved position (i.e. to open). The coil doesn't get power until a command is made. The Bus Tie Breakers are magnetically latched in position (and don't require power unless required to change position).

[Hardy Heinlin]

If >NO LAND 3 is shown on the Upper EICAS, the books* say that bus isolation will not be commanded.

I now see that you and the book refer to the "bus isolation" of that particular, failed bus, not of all busses in general. I thought you were saying that in LAND 2 none of the busses will be isolated -- which would be absurde, of course.

Even if there's no short circuit but just a single IRU failure, that single IRU failure will not cause all other busses to cancel their isolation. The mode will just change from LAND 3 to LAND 2.

So with your hint you just meant to say that DCIR 1 won't close for autoland if AC bus 1 has a short circuit, but the other good busses will isolate themselves?

Or are you saying that the NO LAND 3 message in cruise on that afore-mentioned real 744 (which had an AC 1 short circuit) would later turn into a NO AUTOLAND message when bus isolation is commanded?

Or are you saying there'll be no bus isolation command at all because there's no LAND 3 capability? But then it shouldn't say LAND 2. It should say NO AUTOLAND.

Assuming we have a LAND 2 because of an AC bus 1 short circuit. The other good busses are still isolated. Opening DCIR 1 will then have no tie effect as the other DCIRs are still closed. TRU 1 provides no power. DC bus 1 will fail because the other three DCIRs are closed. Or will DCIR 4 open?


|-|ardy


P.S.: I think there has been proven in a BA sim that a single engine failure, e.g. #2, will keep the LAND 3 mode active. Bus 4 will open its BTB and feed bus 2. The redundancy is reduced, but it's still LAND 3, not LAND 2. Only when just two of the three isolated busses (1, 2, 3) remain powered, LAND 2 will be displayed. That is, you can autoland when one AC bus fails. In other words: When one channel fails. Be it due to an RA failure or a short circuit.