Air Data Computer failure

[tubby linton]

What are the certification criteria for an ADC system when it is failing?
For instance if you have an ADC that has an internal problem and is producing erroneous data ,is there any requirement for the aircraft architecture to remove this data so that it does not affect other systems and for the ADC to produce a failure warning or crew alert.?
If the faulty ADC is replaced with data from a working ADC should not the faulty data be no longer available to other systems on the aircraft so that unnecessary system failures are not induced?

[Mach E Avelli]

Every country will have its own certification rules, based on ICAO Annex 8 Sub-part F.1.3 which says:
'Means shall be provided to warn the crew of unsafe system operating conditions and to enable them to take corrective action'

That is a good catch-all because it means the systems require warning flags, lights etc and also by 'corrective action' the means to de-select the faulty system.

[muduckace]

Most aircraft (RVSM) have dual digital ADC's that can be compared with the "steam guage" standby altimiter and A/S indicator to determine what is the likely faulty component/system.

[411A]

Most aircraft (RVSM) have dual digital ADC's that can be compared with the "steam guage" standby altimiter and A/S indicator to determine what is the likely faulty component/system.

Long before RVSM, as well.
Most aircraft with dual ADC's have mode failure indicators for disagreements between each others individual instruments and, on many, instrument transfer capabilities to isolate individal faulty indications.
Individual failures of an entire ADC are quite rare in my present type (L1011), in fact, I can't remember one...and I've been flying the same type for a very long time.

[tubby linton]

The problem was on a relatively modern aircraft with 2 ADC.The defective ADC showed incorrect data but when the alternate ADC was selected the faulty ADC was still putting out false data to other systems such as autothrust ,altitude alerter etc.There were no failure flags or warnings of any kind on any of the flight instruments just a major discrepancy in speed on the pfd and the altimeter over reading.The faulty ADC recovered itself in the descent at about FL100 and after we had been on the gate a few minutes it eventually produced a failure message.

[happybiker]

The certification criteria is FAR/CS 25.1309 the extract below is quite specific

(a) The aeroplane equipment and systems must be designed and installed so that:
(1) Those required for type certification or by operating rules, or whose improper functioning would reduce safety, perform as intended under the aeroplane operating and environmental conditions.
(2) Other equipment and systems are not a source of danger in themselves and do not adversely affect the proper functioning of those covered by sub-paragraph (a)(1) of this paragraph.
(b) The aeroplane systems and associated components, considered separately and in relation to other systems, must be designed so that -
(1) Any catastrophic failure condition
(i) is extremely improbable; and
(ii) does not result from a single failure; and
(2) Any hazardous failure condition is extremely remote; and
(3) Any major failure condition is remote.
(c) Information concerning unsafe system operating conditions must be provided to the crew to enable them to take appropriate corrective action. A warning indication must be provided if immediate corrective action is required. Systems and controls, including indications and annunciations must be designed to minimise crew errors, which could create additional hazards.

In practice there has been at least one instance where software in so called fault tolerant computers has enabled data from faulty sensors in an ADIRU to used. The resulted in a serious in flight event to a Malaysian B777 investigated by the ATSB

200503722 (http://www.atsb.gov.au/publications/investigation_reports/2005/AAIR/aair200503722.aspx)

[tubby linton]

Thank you all for your replies.It was fairly obvious what was causing the problem ,the disconcerting element was that the faulty ADC was producing corrupt data and this was affecting so many other systems. We had a page of seemingly unrelated ecam and had to paste the pieces together to confirm our initial thoughts on what the root cause was.
When the ecam recognizances that the ADC has failed the procedure is to select the alternate ADC.Performing this action based on the indications we had did not stop all the related failures produced by the erroneous data.,possibly because the Ecam had not recognized the failure and it failed to do so until after engine shutdown.