12
$\begingroup$

The KNKT's final report on last year's Air Indonesia QZ-8501 crash repeatedly mentions that the faulty solder joint on the Flight Augmentation Computer (FAC) caused an open circuit on "both channel A and B", leading to the repeated failure of the Rudder Travel Limiter Unit (RTLU). (Page 66 of the report has a photo of the offending solder joint and of the whole module.)

What are these "channels"? The only relevant mention I can find in the report is on p37, an extract from the Flight Crew Operation Manual, as follows (ellipsis mine):

In performing these functions the FAC uses independent channels:

  • Yaw damper
  • Rudder trim
  • Rudder travel limit
  • Flight envelope

...
If a failure is detected on any channel of FAC1, FAC2 takes over the corresponding channel.

Are the "channels A and B" two of the output "channels" mentioned here? The last quoted line suggests that each channel is redundant between the two computers, in which case why would both RTLUs fail together?

$\endgroup$
5
$\begingroup$

The problem is that you're using the Flight Operations Manual, and not the Schematic Manuals. Quite frankly, FOM's pretty much suck in terms of technical details, but that's not their purpose either.

In regards to your question about what the channels are:

Channels are really just a euphemism for system redundancy. The FAC's are two completely separate entities (with crosstalk capabilities) - kind of like flight crews. The PIC (pilot-in-command) has primary control of the aircraft, while the SIC (second-in-command) has the same independent authority. The PIC and SIC can talk to one another, and monitor what each is doing. If the PIC falls ill, becomes incapacitated, etc.. the SIC can take over the functions of the PIC.

The FAC's work the same way. They both receive the same information, and have full capability of performing the work of one another. Take note of this schematic, courtesy of Airbus (found on the web), and which I took the liberty of highlighting:

enter image description here

Basically, what this schematic is saying is that the ELAC's, under normal law, provide turn coordination and dutch roll damping to the FAC's. They do this by receiving inputs from the rudder pedals, sidesticks, FMGC's, ADIRU's, SFCC, LGCIU's, and hyd pressure. Based on those inputs, it computes the proper yaw commands and sends that to the FAC's. It should be noted that both FAC's receive the same information on, you guessed it, separate channels. What does that mean? The data from ELAC 1 is sent to BOTH FAC's on separate sets of wires. Inside the FAC's, those data paths are split as well (Channel A & Channel B) and a separate processor computes the data on Channel A & the data on Channel B. Never the two shall meet. Likewise, the data from ELAC 2 is sent to BOTH FAC's on separate sets of wires, and again, those two data paths shall never meet.

At the same time, both FAC's are receiving the same FMGC, ADIRU, SFCC, LGCIU data that the ELAC is. Again... Separate wires, separate outputs, and computed with two different processors inside the boxes. The FAC's are also receiving hydraulic pressure, commanded rudder trim position, and SEC fault data. Guess what? All on different channels.

Now, take note of the highlighted portion in red. Ordinarily, FAC 1 is in control of the servo loop for the RTL Motors. This essentially means that based on ALL of the inputs received from the ELAC's and other independent systems, the FAC 1 sends a signal to the rudder travel motor and says "Move here." The motor moves, and a feedback signal from the RTLU circuitry is sent to the FAC saying "Here I am." When the commanded position of the surface position minus the actual position of the surface is approximately ~0, the surface is nulled. This is a basic feedback loop/servoloop.

The FAC 2 has the exact same capabilities as FAC 1. The two are in constant communication, making sure that neither has failed. If FAC 1 reports a self-failure, or FAC 2 detects a problem with FAC 1 and/or its servo loop, FAC 2 can immediately take over.

Notice that FAC 2 is responsible for the M2 (second motor) of the rudder travel limit system, and FAC 1 is responsible for the M1 (primary motor) of the rudder travel limit system. The wiring for the motors and its associated servo loop are completely separate. Again, the idea is complete system isolation. As such, any one failure cannot take out the entirety of a system.

All of the above is under the presumption of NORMAL LAW. It appears that cracked solder joints, emphases on the plural form, caused failures of Channel A & Channel B of the RTLU (see page 66 of accident report). Basically, like I mentioned previously, FAC 2 was monitoring FAC 1 for faults with it or its associated servo loop. When RTL channel A failed (the servo loop feeding data back to FAC 1; associated with Motor 1), the FAC 2 picked up on it, and took over on its own separate channel. A cracked solder joint on RTL channel B caused FAC 2 to trigger a failure. At some point during these failures, the flight crew pulled the circuit breakers, presumably to reset the faults. The loss of both FAC's put the aircraft into alternate law.

Once the aircraft was in alternate law, it seemed that there was a lot of confusion as to what was happening. From there, things went from bad to disastrous.

$\endgroup$
  • $\begingroup$ Thanks for spelling everything out. There's just one detail at the end: the RTLU failures themselves didn't put the aircraft into alternate law. That only happened when the flight crew pulled the breakers for both FACs. The effect of both RTLUs failing is merely to leave the limiter stuck at its position at the time of the failure. It's spelled out later in the report. $\endgroup$ – Dan Hulme Dec 14 '15 at 21:47
  • $\begingroup$ Thanks for pointing that out, Dan. I missed that part in the accident report, and wasn't sure if the crew pulling the circuit breakers was media myth or not. You're also correct about the function of failed RTLU's. I have corrected my original post to reflect that, albeit on my iPad. So, if I missed something in the edit, I blame Apple. :-) $\endgroup$ – Frank Dec 14 '15 at 23:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.