LePost – TSM – QRH OEB – ACARS/ICAS Chatter – The Onion


As suggested in my post earlier today, the below “LePost” article now explains the interest by several on-line aviation professionals on the Lavatory Error Message beginning at 22:45:

Note: The below posting is translated from a foreign message board and is odd to me.  Need ACARS expertise explaining the references to the toilet messages.

Nevertheless, the first message after the toilet at 22:45 this post off autopilot

22 10/06 WRN WN0906010210 221002006AUTO FLT AP OFF 09-06-01 AF 447 22 10/06 WRN WN0906010210 221002006AUTO FLT AP OFF 09-06-01 AF 447
38 31/06 FLR FR0905312245 38310006VSC X2,,,,,,,LAV CONF 09-05-31 AF 447 38 31/06 FLR FR0905312245 38310006VSC X2 ,,,,,,, LAV CONF 09-05-31 AF 447

Bottom came first. Do not judge for errors in spelling, copy the text manually.  And remember, was a signal of problems with the toilet. Here you are, match the most important. I also think that this should start the investigation.

***Speculative Posting – Not Confirmed***

foto_5-09

I found it curious this door was not in any of the pictures when the wreckage was arranged inside the hangar for the press last week.  As I noted here on June 9th, and also here, this door was getting special attention by investigators.  As suspected, now we know that BEA has known the reason for the aircraft loss since the first night.

I guess the “show” in Paris this week was more important than telling the truth!  The French Press remained silent all week also.  Why?



lepost_logo

Flight AF447: a new track on the causes of the crash? (English Translation)(Emphasis mine)

20090620… The failure of the Pitot probes remains the case presented as the most plausible explanation for the crash of the Airbus A330. That is why the Air France replaced all probes A330 and A340 on 12 June.

…According to “informed sources” quoted in the first edition of the Journal du Dimanche, released Saturday, the Office of Investigations and Analysis (BEA) consider the track a leak in a water circuit water from the device, reported shortly after take-off by a first automated message warning of the Airbus A330. “What would be the case under consideration by investigators?

“The leak, detected by the crew” may have “caused a prolonged flow of water,” says Le Journal du Dimanche. Then, when the aircraft would have crossed temperatures from -50 ° C, water flow could be transformed into “a major freeze in the composite membrane (half metal, half-composite carbon-type)”, explains weekly.

The composite membrane is located inside the fuselage in the rear of the unit. According to “informed source” quoted by Le JDD, it would be “frost, which could cause a sudden rupture of the structure of the aircraft in flight.”

How confident would be granted to BEA? Odile Saugues, member of Socialist Puy-de-Dome, is preparing a report on the European Aviation Safety Agency (EASA). She remains skeptical about the neutrality of BEA: “It depends on the government.We do know that what we are willing to tell us (…) It seems that some things are settled with the family.” she told the JDD.

If the mystery of the Air France flight Paris-Rio remains, the Office of Investigations and Analysis (BEA) announced this week that it would publish a report by the end of the month …

A340_CockpitCrew_OxygenStorage_2009


From the A330 TroubleShooting Manual:
Source EFCS2 Class : 1 HARD
Identifiers : EFCS1,AFS
341115 – PROBE-PITOT 1+2 / 2+3 / 1+3 (9DA)
Le TSM (Trouble Shooting Manual)

34-11-15 EFCS2 : TASK 27-91-00-810-822
Disagree of the Pitot Probe Data in the FCPCs
1. Possible Causes

  • pitot probe

2. Job Set-up Information

  • A. Referenced Information
    • AMM 34-11-15-000-801 Removal of the Pitot Probe (9DA1, 9DA2, 9DA3)
    • AMM 34-11-15-200-801 Inspection/Check of the Pitot Probe (9DA1, 9DA2, 9DA3)
    • AMM 34-11-15-400-801 Installation of the Pitot Probe (9DA1, 9DA2, 9DA3)

3. Fault Confirmation

  • A. Test
    • (1)Not applicable, you cannot confirm this fault on the ground.

4. Fault Isolation

  • A. If the crew made a report that the F/CTL ALTN LAW or F/CTL DIRECT LAW warning was shown on the EWD for some seconds only:
    • – no trouble shooting is necessary.
  • B. If the F/CTL ALTN LAW or F/CTL DIRECT LAW warning is shown and stays on during the flight:
    • (1)Do the inspection of the pitot probe (9DA1, 9DA2, 9DA3)
      AMM TASK 34-11-15-200-801
    • replace the defective pitot probe (9DA1 or 9DA2 or 9DA3)
      AMM TASK 34-11-15-000-801 and AMM TASK 34-11-15-400-801

A330_ISIS_architecture_2009-06-1-1


RED OEB – RED OEB – RED OEB – RED OEB – RED OEB – RED OEB – RED OEB
Issued by STL
File in FCOM Vol 3
OEB N°: 74/4 DEC 08
Associated with QRH OEB PROC N°: 74/4
– This OEB covers a significant operational issue. Non-compliance with this OEB should have a significant impact on the safe operations of the aircraft. The Operators shall distribute its content to all flight crews without delay. An extract of this OEB is provided for insertion in the QRH.
– It is strongly recommended that all Operators accelerate the incorporation of all corrective Service Bulletins as soon as they are available.
SUBJECT:
IR FAILURE OR ATT FLAG ON PFD
APPLICABLE TO:
All A330 aircraft fitted with NORTHROP GRUMMAN – LITTON ADIRU
CANCELLED BY:
TBD
R
REASON FOR ISSUE 4:
RRRR
The previous OEB revision requested to de-energize the affected ADIRU if the IR and/or ADR OFF lights did not illuminate. The OEB procedure is now revised in order to recommend that the IR mode rotary selector be set to OFF in all cases in order to address all identified failure cases.
Page 1 of 5
Operations Engineering Bulletins are issued by Airbus as the need arises to quickly transmit technical and procedural information. They are distributed to all FCOM holders and to others who need advice of changes to operational information.
Information in this bulletin is recommended by Airbus but may not be approved by Airworthiness Authorities.
If the procedures contained in this OEB differ from the procedures in the AFM, the AFM remains the reference.
OEB N° Page 2 of 5
74/4
REASON FOR ISSUE:
This OEB is issued in order to provide a procedure enabling to mitigate the probability of occurrence of a sudden nose down order.
EXPLANATION:
An A330 aircraft experienced a sudden nose down order during cruise. This order was preceded by an automatic autopilot disconnection and triggering of the NAV IR 1 FAULT ECAM caution.
Investigations highlighted that at the moment of the event the ADR 1 was providing erroneous and temporary wrong parameters in a random manner. This abnormal behavior of the ADR 1 led to several consequences such as unjustified stall and over speed warnings, loss of attitude information on the Primary Flight Display, several ECAM warnings.
Among the abnormal parameters, the provided Angle of Attack value was such that the flight control computers commanded nose down movement.
The aim of the following procedure is to isolate both the IR and ADR when an IR is detected faulty in order to prevent the ADR from providing erroneous data to other aircraft systems.
TO BE CONTINUED ON NEXT PAGE
PROCEDURE:
RRRR
OEB N° Page 3 of 5
74/4
RRRR
• If all ADIRU operative before failure:
If one IR is self detected faulty or if the ATT red flag is displayed on the Captain or First Officer PFD, the affected IR and the corresponding ADR must be disconnected.
NAV IR 1(2)(3) FAULT, or ATT flag displayed on CAPT (F/O) PFD
-IR (affected) pb …………………………..…… OFF
The affected IR is the one self-detected faulty or supplying the PFD displaying the ATT red Flag.
The OFF light may not illuminate
-ADR (corresponding) pb ………..…………… OFF
ADR 1 corresponds to IR 1.
ADR 2 corresponds to IR 2.
ADR 3 corresponds to IR 3.
The OFF light may not illuminate
-IR (affected) MODE rotary selector ……….. OFF
The IR mode rotary selector is set to OFF in order to de-energize the ADIRU. The OFF lights of the IR and ADR pushbutton will go off.
Setting the IR mode rotary selector to OFF is an irreversible action. Therefore, both PF and PNF must clearly identify the corresponding selector before setting it to OFF.
• If IR 1(2) affected:
In order to prevent possible failure of ADIRU 3, the flight crew must switch the AIR DATA and the ATT HDG in the following order:
-AIR DATA SWTG ………..………..……… CAPT (F/O) ON 3
-ATT HDG SWTG ..………….…………….. CAPT (F/O) ON 3
TO BE CONTINUED ON NEXT PAGE
CAUTION
RRRRR RRRR
• If one ADIRU already disconnected before failure:
In case of dispatch with one ADIRU under MMEL or one ADIRU already disconnected in flight, and an IR failure occurs, either detected by an IR 1+2 (1+3)(2+3) FAULT or with ATT red flag displayed on CAPT or F/O PFD, the affected IR and the corresponding ADR must be disconnected.
NAV IR 1+2(1+3)(2+3) FAULT, or ATT flag displayed on CAPT (F/O) PFD
-IR (affected) pb ………………..…….………… OFF
The affected IR is the one self-detected faulty or supplying the PFD displaying the ATT red Flag.
The OFF light may not illuminate
-ADR (corresponding) pb …………………….. OFF
ADR 1 corresponds to IR 1.
ADR 2 corresponds to IR 2.
ADR 3 corresponds to IR 3.
The OFF light may not illuminate
-IR (affected) MODE rotary selector ……….. OFF
The IR mode rotary selector is set to OFF in order to de-energize the ADIRU. The OFF lights of the IR and ADR pushbutton will go off.
Setting the IR mode rotary selector to OFF is an irreversible action. Therefore, both PF and PNF must clearly identify the corresponding selector before setting it to OFF.
CAUTION
• If IR 1+2 affected:
In order to prevent possible failure of ADIRU 3, the flight crew must switch the AIR DATA and the ATT HDG in the following order:
-AIR DATA SWTG ……….………………….CAPT ON 3
-ATT HDG SWTG …….……………..………CAPT ON 3
Note: First officer can recover IR information, by using the EFIS DMC selector (copy of the opposite side).
SPD BRK ………………………………….…….. DO NOT USE
• IF CG AFT 32%:
-T TANK MODE………………….……….. FWD
F/CTL ALTN LAW (PROT LOST)
MAX SPEED ………………………..………..…. 330/.82
OEB N° Page 4 of 5
74/4
OEB N° Page 5 of 5
74/4
OEB REMINDER:
On aircraft that have the OEB reminder function, the procedures of NAV IR 1(2)(3) and NAV IR 1+2(1+3)(2+3) FAULT ECAM cautions may be flagged.
The “refer to QRH PROC” line will then be displayed instead of the procedure itself.
To flag those procedures, the following codes should be entered in the FWC OEB database.
Code WARN STS
NAV IR 1 FAULT YES NO
34/10/050/061
NAV IR 2 FAULT YES NO
34/10/060/063
NAV IR 3 FAULT YES NO
34/10/070/065
NAV IR 1+2 FAULT YES NO
34/10/020/055
NAV IR 1+3 FAULT YES NO
34/10/030/057
NAV IR 2+3 FAULT YES NO
34/10/040/059
CORRECTIVE ACTION:
Under investigation
Note: The interchangeability code, given in the Illustrated Part Catalog (IPC), indicates the conditions for interchangeability of equipment. After installation of corrective modification(s)/SB(s), if an Operator reinstalls any equipment affected by this OEB it is the Operator’s responsibility to ensure that the recommendations given in this OEB are applied again for the applicable aircraft.


ACARS/TCAS Chatter

I have been involved with the design and integration of the software on a number of avionic embedded systems; from a Fault Detection, Recovery and Reporting perspective I have some observations and some questions. I have been involved with the design and integration of the software on a number of avionic embedded systems; from a Fault Detection, Recovery and Reporting perspective I have some observations and some questions.

1. Only reporting ‘own’ failures to ACARS: IIRC on A320 there was an Airbus requirement on avionic systems that they had to have a 90% confidence level for detecting and reporting an internal failure, down to ‘sub-system’ level. Only reporting ‘own’ failures to ACARS: IIRC on A320 there was an Airbus requirement on avionic systems that they had to have a 90% confidence level for detecting and reporting an internal failure, down to ‘sub-system’ level. In order to avoid a ‘cascade’ of messages, it is obviously important not to generate a maintenance message when the fault is known to be external to that particular system. In order to avoid a ‘cascade’ of messages, it is obviously important not to generate a maintenance message when the fault is known to be external to that particular system.

This is possibly significance with the the IR2 message and the TCAS FAULT message; these should not have been generated because of an external ADR problem, but because of internally detected faults. This is possibly significance with the the IR2 message and the TCAS FAULT message; these should not have been generated because of an external ADR problem, but because of internally detected faults.

A question for an ISIS expert, would high ‘g’ loads cause an ISIS system to consider that outputs from its gyros or accelerometers were ‘out of spec’? A question for an ISIS expert, would high ‘g’ loads cause an ISIS system to consider that outputs from its gyros or accelerometers were ‘out of spec’?

A question for a TCAS expert, what would cause TCAS to generate an ACARS message, a GPS derived value (such as speed or rate of change of heading) out of spec? A question for a TCAS expert, what would cause TCAS to generate an ACARS message, a GPS derived value (such as speed or rate of change of heading) out of spec?

An earlier post referred to TCAS using Doppler to determine relative speed between aircraft; would ‘unbelievable’ changes in relative speed cause an internal fault to be flagged? An earlier post referred to TCAS using Doppler to determine relative speed between aircraft; would ‘unbelievable’ changes in relative speed cause an internal fault to be flagged?

2. Delay on ACARS messages: Once an Airbus avionic system detects a fault it should immediately mark its outputs as Invalid/Unavailable to its ‘users’ (including CFDS). Delay on ACARS messages: Once an Airbus avionic system detects a fault it should immediately mark its outputs as Invalid / Unavailable to its’ users’ (including CFDS). However, there may be a significant delay before the system can determine if this fault is a ‘hard’ internal failure. However, there may be a significant delay before the system can determine if this fault is a ‘hard’ internal failure. Its recovery process might include retrying an input a number of times, resets (of sub-elements of the system, or the complete system) or diagnostics (such as running loop-back tests on the ARINC 429 Input Port).

Its recovery process might include retrying an input a number of times, resets (of sub-elements of the system, or the complete system) or diagnostics (such as running loop-back tests on the ARINC 429 Input Port). So depending on the type of detected fault there might be a significant delay before a system is confident in reporting a failure. So depending on the type of detected fault there might be a significant delay before a system is confident in reporting a failure. For example, the loss of an external communication link for a minute or so may not be considered a ‘hard’ failure, loss for 10 minutes or so might be. For example, the loss of an external communication link for a minute or so may not be considered a ‘hard’ failure, loss for 10 minutes or so might be.

3. Timing sequence of ACARS messages: As pointed out in other posts, ACARS primary purpose is to provide maintenance data to Ground Crew. Timing sequence of ACARS messages: As pointed out in other posts, ACARS primary purpose is to provide maintenance data to Ground Crew. There is no particular urgency to providing maintenance data to the ground (as opposed to ASAP for fault information to the flight crew). There is no particular urgency to providing maintenance data to the ground (as opposed to ASAP for fault information to the flight crew).

As it is an inefficient use of processing power to provide data at a rate faster than it is needed, an aircraft system could be designed to schedule a task every couple of minutes to check the system’s internal fault log to see if a maintenance message should be composed and sent to ACARS. As it is an inefficient use of processing power to provide data at a rate faster than it is needed, an aircraft system could be designed to schedule a task every couple of minutes to check the system’s internal fault log to see if a maintenance message should be composed and sent to ACARS.

So the sequence on messages generated by different systems could be quite random. So the sequence on messages generated by different systems could be quite random.

4. Failures unlikely to be caused by lightning: It is unlikely that any of the ACARS failure messages were due to damage by lightning as it is likely that the system’s vulnerable processing capability (CPU, RAM, etc.) would also have been affected to such an extent that the system would not be able to compose and send any messages to the ACARS. Failures unlikely to be caused by lightning: It is unlikely that any of the ACARS failure messages were due to damage by lightning as it is likely that the system’s vulnerable processing capability (CPU, RAM, etc.)

Would also have been affected to such an extent that the system would not be able to compose and send any messages to the ACARS. It is an important ‘fact’ that the reporting systems are still running; the failure they are reporting is unlikely to be due to lightning, power supply loss, fire or being shaken to destruction. It is an important ‘fact’ that the reporting systems are still running; the failure they are reporting is unlikely to be due to lightning, power supply loss, fire or being shaken to destruction.

5. Setting fault detection levels: Avionic system designers are well aware of the difficulties in getting the right balance between ‘nuisance false fault reports’ and ‘not detecting marginal faults’. Setting fault detection levels: Avionic system designers are well aware of the difficulties in getting the right balance between ‘nuisance false fault reports’ and’ not detecting marginal faults’. The limits within the software that are used to flag a fault on sensor input values (max/min, rate of change, comparison) are based on the ‘expected’ range of values during aircraft operation; persistent input values that are outside the aircraft’s operational limits should be considered as more likely to be an internal fault and hence flagged as such.

The limits within the software that are used to flag a fault on sensor input values (max / min, rate of change, comparison) are based on the ‘expected’ range of values during aircraft operation; persistent input values that are outside the aircraft’s operational limits should be considered as more likely to be an internal fault and hence flagged as such. A system that flags itself as failed and needing maintenance might in fact be working, it is just that what its sensors are telling it is ‘unbelievable’!” A system that flags itself as failed and needing maintenance might in fact be working, it is just that what its sensors are telling it is’ unbelievable ‘! “


theonion_logo

Investigators Determine Air France Disaster Caused By Plane Crash, 19 June 2009

PARIS—After more than two weeks of analyzing flight records, cockpit radio transmissions, and floating ocean debris, investigators determined Thursday that the tragic events of Air France Flight 447 were in all likelihood caused by a “giant plane crash.”

The shocking discovery, announced during a press conference Friday, finally sheds light on what took place in the early hours of June 1, and answers a number of puzzling questions about the mysterious mid-flight disaster.

“We can now say, with complete confidence, that Air France Flight 447 was brought down by an unscheduled and unforeseen plane crash,” lead French investigator Michel Villon stated. “Indeed, a survey of all the evidence indicates that this terrible tragedy was the direct result of a large airliner falling suddenly from the sky, dropping 30,000 feet, and colliding with the Atlantic Ocean at extremely high speeds.”

“It took us a long time to figure out exactly what led to this unspeakable event,” said Brazilian aviation expert Federico Lobão, who spent countless hours carefully studying footage of the wreckage. “Never could we have imagined that something like a plane crash could be behind such a catastrophic plane crash.”

“We are currently doing everything we can to stop any unnecessary collisions with the ground from taking place during our flights,” Air France CEO Pierre Sturges said. “While we work to figure out this whole not-crashing-planes-and-killing-passengers thing, people should keep in mind that the chances of their flight crashing are almost incalculably small and incredibly unlikely.”

onionlogo_ding_small“Unless, of course, it does,” he added.


Advertisements