EC155 incident, SNS, 6 Nov 2013
Things move on a bit... We have 4 lanes of AFCS in 2 x 2 mutually monitored APs (ie 4 processors running in 2 boxes). We have triplicated AHRS with the AFCS automatically rejecting a "runaway" AHRS. Ditto for the air data.
We have two series actuators on each channel (except the collective which only has 1 series actuator) of different technologies: 1 analogue open - loop hydraulic servo in the AP hydraulics, one closed loop digital electrical series actuator (I say "closed loop, but ARINC data is sent to position the actuator, the actuator just responds with an "OK" (or not) when it's done it). The series actuators are of similar authority so one can cancel out a hard-over on the other.
The parallel actuators are of course relatively slow, but each one has inputs from both APs and dual RVDTs reporting position to each AP. I am not quite sure what would happen if one channel went hard motor-on, whether the other could cancel it out or not.
So what I am saying is the degree of redundancy and fail-passive makes hardovers pretty hard to envisage and I guess that is why they managed to significantly increase the authority of the series actuators over the previous incarnations of the Super Puma.
We can do parallel actuator hard motor-on failures (maybe a short in the wiring to the motor?) in the sim, but there is no RFM procedure for it, and it all seems very improbable compared to earlier autopilot incarnations (FLW!)
We have two series actuators on each channel (except the collective which only has 1 series actuator) of different technologies: 1 analogue open - loop hydraulic servo in the AP hydraulics, one closed loop digital electrical series actuator (I say "closed loop, but ARINC data is sent to position the actuator, the actuator just responds with an "OK" (or not) when it's done it). The series actuators are of similar authority so one can cancel out a hard-over on the other.
The parallel actuators are of course relatively slow, but each one has inputs from both APs and dual RVDTs reporting position to each AP. I am not quite sure what would happen if one channel went hard motor-on, whether the other could cancel it out or not.
So what I am saying is the degree of redundancy and fail-passive makes hardovers pretty hard to envisage and I guess that is why they managed to significantly increase the authority of the series actuators over the previous incarnations of the Super Puma.
We can do parallel actuator hard motor-on failures (maybe a short in the wiring to the motor?) in the sim, but there is no RFM procedure for it, and it all seems very improbable compared to earlier autopilot incarnations (FLW!)
Failure Modes
Yes, HC, your point re the 225 and the like is valid. The FBW aircraft of course, use the same approach except that the failure mode consequences increase the degree of electrical power, computing and sensor redundancy yet further.
For the case that started the discussion, and like equipped machines though, trainable failure modes do exist. That brings to mind something that has yet to be mentioned re this case: the pitch attitudes that are described in the reports are pretty extreme. I saw no mention of any command pitch attitude limits within the 155's AFCS/Autopilot software ( and I'd assume they are there, with numbers far less than the aircraft achieved ) or was the situation that those attitudes were achieved by the aircraft with the systems disabled?
For the case that started the discussion, and like equipped machines though, trainable failure modes do exist. That brings to mind something that has yet to be mentioned re this case: the pitch attitudes that are described in the reports are pretty extreme. I saw no mention of any command pitch attitude limits within the 155's AFCS/Autopilot software ( and I'd assume they are there, with numbers far less than the aircraft achieved ) or was the situation that those attitudes were achieved by the aircraft with the systems disabled?
Did We Do It?
Boudreaux, that wasn't the only thing the UTTAS program had us doing that was perhaps a bit " outre ".
Charlie Crawford, who ran the Army Avn Sys Cmd Flight Standards Division, and hence was the person running the tech side of the fly-off, came in to visit and left us with instructions to get standard flight loads data at 120 degrees bank angle, which we dutifully did. Steady state data at 120 degrees takes some doing. Having done that, the US Army flight manual* for the fly-off aircraft had a published bank angle chart vs speed. From 34 to 136 Kias, the limit was 90 degrees so there was some margin. I never did learn why Charlie, who never did anything like that without some issue, somewhere, needed that data and the somewhat high limit, for a flyoff done in the main ( two of the three machines were flown by this group ) by a picked-for-diversity group of Army pilots from Ft Campbell units.
* I did retain a copy of this manual.
Charlie Crawford, who ran the Army Avn Sys Cmd Flight Standards Division, and hence was the person running the tech side of the fly-off, came in to visit and left us with instructions to get standard flight loads data at 120 degrees bank angle, which we dutifully did. Steady state data at 120 degrees takes some doing. Having done that, the US Army flight manual* for the fly-off aircraft had a published bank angle chart vs speed. From 34 to 136 Kias, the limit was 90 degrees so there was some margin. I never did learn why Charlie, who never did anything like that without some issue, somewhere, needed that data and the somewhat high limit, for a flyoff done in the main ( two of the three machines were flown by this group ) by a picked-for-diversity group of Army pilots from Ft Campbell units.
* I did retain a copy of this manual.
... That brings to mind something that has yet to be mentioned re this case: the pitch attitudes that are described in the reports are pretty extreme. I saw no mention of any command pitch attitude limits within the 155's AFCS/Autopilot software ( and I'd assume they are there, with numbers far less than the aircraft achieved ) or was the situation that those attitudes were achieved by the aircraft with the systems disabled?
Here is a presentation by one of industry's experts on the subject of autopilots - both the slides and associated audio-feed are in this folder (it is best to watch and listen concurrently):
https://www.dropbox.com/sh/6ru1dtrp2...1dHS_MPSrPJlra
The presentation starts with basic principles that most contributing to this thread will know but still, the distinctions between 3-axis, four-axis-analogue and four-axis-digital will be interesting for a number of contributors who have not yet been exposed to the latest incarnations. Where the presentation becomes more interesting is when discussing the reduction of complexity by integration and simplifying HMIs. It concludes with a view of what more should be done - not just in autopilot design and control laws, but holistically within the system (design, procedures, training, provision of information etc.).
One of the most interesting elements of the latest discussion here, is the point where redundancy and 'fail operative architecture' lead to a situation where elements becomes just a box in the 'conceptual model' and 'apparent' complexity reduces almost to zero. When that point is reached, we have moved from technology-led-design to human-centric-design. Perhaps the issue is that we are not yet at that point, are approaching the average pilot's knowledge saturation level and are having to discuss compensatory measures in the form of knowledge, training and procedures.
Jim
https://www.dropbox.com/sh/6ru1dtrp2...1dHS_MPSrPJlra
The presentation starts with basic principles that most contributing to this thread will know but still, the distinctions between 3-axis, four-axis-analogue and four-axis-digital will be interesting for a number of contributors who have not yet been exposed to the latest incarnations. Where the presentation becomes more interesting is when discussing the reduction of complexity by integration and simplifying HMIs. It concludes with a view of what more should be done - not just in autopilot design and control laws, but holistically within the system (design, procedures, training, provision of information etc.).
One of the most interesting elements of the latest discussion here, is the point where redundancy and 'fail operative architecture' lead to a situation where elements becomes just a box in the 'conceptual model' and 'apparent' complexity reduces almost to zero. When that point is reached, we have moved from technology-led-design to human-centric-design. Perhaps the issue is that we are not yet at that point, are approaching the average pilot's knowledge saturation level and are having to discuss compensatory measures in the form of knowledge, training and procedures.
Jim
Join Date: Dec 2006
Location: UK and MALTA
Age: 61
Posts: 1,297
Likes: 0
Received 18 Likes
on
4 Posts
JIM I think we are at the technoligical point where we must stop teaching pilots utter trivia and concentrate only on what is important for him to safely operate the aircraft.
For some systems this requires a degree of in depth knowledge. Puma LH Hydraulics being a good example. For others, the detail is rather unimportant and only the method of HMI needs serious attention. For me the AP fits into this category. It is not at all necessary to know the way the AP works and which actuator moves the most. It is more important to understand the safest way to fly in helicopter in all the possible modes the AP might have. What the indications mean in terms of what the pilots response should be.
The EC225 is arguably once of the most technologically challenging helicopters on the planet but the HMI has been greatly simplified. I am routinely asked by pilots what are the probable causes of FADEC failure and my answer is why should we care. The light comes on, we follow the checklist, it resolves or it does not. Simple. There is nothing more I can about it.
In some areas we press for too much knowledge at the expense of others.
A modern digital helicopter AP may have up to six modes of operation with up to 5 methods of changing attitude in some of those modes. It is here where the complexity lies. Explaining these modes fully and then experiencing each mode, each method is just a start. Understanding the relevance of each mode and therefore choosing which mode/HMI provides the optimum solution for each task or even phase of a task is the challenge we all face. In this respect there is absolutley no substitute for time spent at the controls working these modes.
DB
For some systems this requires a degree of in depth knowledge. Puma LH Hydraulics being a good example. For others, the detail is rather unimportant and only the method of HMI needs serious attention. For me the AP fits into this category. It is not at all necessary to know the way the AP works and which actuator moves the most. It is more important to understand the safest way to fly in helicopter in all the possible modes the AP might have. What the indications mean in terms of what the pilots response should be.
The EC225 is arguably once of the most technologically challenging helicopters on the planet but the HMI has been greatly simplified. I am routinely asked by pilots what are the probable causes of FADEC failure and my answer is why should we care. The light comes on, we follow the checklist, it resolves or it does not. Simple. There is nothing more I can about it.
In some areas we press for too much knowledge at the expense of others.
A modern digital helicopter AP may have up to six modes of operation with up to 5 methods of changing attitude in some of those modes. It is here where the complexity lies. Explaining these modes fully and then experiencing each mode, each method is just a start. Understanding the relevance of each mode and therefore choosing which mode/HMI provides the optimum solution for each task or even phase of a task is the challenge we all face. In this respect there is absolutley no substitute for time spent at the controls working these modes.
DB
Join Date: Mar 2005
Location: Holly Beach, Louisiana
Posts: 916
Likes: 0
Received 0 Likes
on
0 Posts
Some of us have been saying exactly that for years especially when comparing the FAA and CAA system of Pilot Written Exams as an example.
Do we really care about the inner workings of a Cereal Bowl Compass and how it works or does it suffice we understand how to use a Magnetic Compass and understand factors that influence its accuracy?
I have sat through and taught ground school classes on many different aircraft systems. Some used very detailed drawings, component cutaways, and systems trainers that displayed reactions to Switch movements and triggers to Warning/Caution Lights but in the end it mattered only that the Pilot understood how to recognize abnormal reactions or indications, know how to deal with those, and continue to operate the aircraft in a safe manner.
Determining "Must Know", "Should Know", "Good to Know" and "Nice to Know" and "Who Cares", levels of knowledge is the key. Unburden the amount of teaching needed to meet the Standard and far more attention can be given to the required, necessary, and really useful information.
My view is generally, if a Pilot cannot control the function of a component by means of a Switch, Control, Push Button, or Knob....then only a familiarity with the function of the item is needed.
Do I care which parts of a helicopter are made of Stainless Steel or what tolerance in Microns a filter has or do I care only to know if a filter is blocked and I get an in cockpit indication of that.....then what I should do when that happens? What remedial or corrective action is possible and what effect such an indication has on the conduct of continued flight should be my concern and not the inner workings of the filter itself.
Do we really care about the inner workings of a Cereal Bowl Compass and how it works or does it suffice we understand how to use a Magnetic Compass and understand factors that influence its accuracy?
I have sat through and taught ground school classes on many different aircraft systems. Some used very detailed drawings, component cutaways, and systems trainers that displayed reactions to Switch movements and triggers to Warning/Caution Lights but in the end it mattered only that the Pilot understood how to recognize abnormal reactions or indications, know how to deal with those, and continue to operate the aircraft in a safe manner.
Determining "Must Know", "Should Know", "Good to Know" and "Nice to Know" and "Who Cares", levels of knowledge is the key. Unburden the amount of teaching needed to meet the Standard and far more attention can be given to the required, necessary, and really useful information.
My view is generally, if a Pilot cannot control the function of a component by means of a Switch, Control, Push Button, or Knob....then only a familiarity with the function of the item is needed.
Do I care which parts of a helicopter are made of Stainless Steel or what tolerance in Microns a filter has or do I care only to know if a filter is blocked and I get an in cockpit indication of that.....then what I should do when that happens? What remedial or corrective action is possible and what effect such an indication has on the conduct of continued flight should be my concern and not the inner workings of the filter itself.
Up to a point I agree. For example, when I first became a training captain on the 332L we had a model of the main undercarriage leg hydraulic valves - all rubber bands and slidly bits of coloured cardboard. I was shown how to demonstrate how the undercarriage hydraulicy bits worked, but when I had to give my first groundschool, I totally floundered. I called in the boss to give the demonstration, which he did. I then asked the class if they understood what had been shown and they all said "No". So I never attempted to use that model again, and when I wrote the groundschool for the L2 and the EC225 it was totally skipped over. No-one has died as a consequence.
I think there was a tendency to fill a 2 week groundschool with "stuff" just to take up the time and provide fodder for an exam - and often (in Bristow anyway) these courses were written by folk with engineering, rather than flying, backgrounds.
Now, there is so much need-to-know knowledge that there is no space for any extraneous crap and it must be cut out! The only reason why we still teach silly limitation numbers of Ts and Ps is because we are required to ask such questions in the exam. As far as I am concerned a pilot doesn't need to know the numbers, just be able to understand the colour coding on the gauge and know when they are approaching or exceeding a limit. Once again, the legislation is way behind the aircraft, and is an impediment to good training, and hence to safety.
All that said... Resilience requires us to have more knowledge that we might need on a normal day-to-day basis, in order to cope with the very rarely occurring abnormal. So a knowledge of how the systems behaves in both normal and abnormal / emergency modes is important, but we don't have to know the engineering detail beyond how it impacts on us in flight.
I think there was a tendency to fill a 2 week groundschool with "stuff" just to take up the time and provide fodder for an exam - and often (in Bristow anyway) these courses were written by folk with engineering, rather than flying, backgrounds.
Now, there is so much need-to-know knowledge that there is no space for any extraneous crap and it must be cut out! The only reason why we still teach silly limitation numbers of Ts and Ps is because we are required to ask such questions in the exam. As far as I am concerned a pilot doesn't need to know the numbers, just be able to understand the colour coding on the gauge and know when they are approaching or exceeding a limit. Once again, the legislation is way behind the aircraft, and is an impediment to good training, and hence to safety.
All that said... Resilience requires us to have more knowledge that we might need on a normal day-to-day basis, in order to cope with the very rarely occurring abnormal. So a knowledge of how the systems behaves in both normal and abnormal / emergency modes is important, but we don't have to know the engineering detail beyond how it impacts on us in flight.
Join Date: May 2012
Location: Aer
Posts: 431
Likes: 0
Received 0 Likes
on
0 Posts
The 332 was a step up in complexity from the 330 and the S-61 but not so much as to be hard to understand. Even the 332 started without collective input on the Autopilot and for some, it was complex enough then.
The L2 was an incremental step up,from the L and L1 but was manageable. It was then a step up again from L2 to 225 but more mature pilots found and still find the leap from L to 225 is a big one.
Part of this is generational, we have young software designers with the OEMs designing clever digital autopilots which are being flown by pilots with 25 years on the 332. Most older pilots will grasp the new technology if it's taught how they learn.
Not all that long ago, line avionics engineers would remove components and repair them with a soldering iron, that no longer happens and new engineers are diagnostically clever box changers. We need a more system functionality based approach, not how components work.
I think that Bob, DB and HC are right, we need to cut the unnecessary and include newer subject matter taught, for now how some of us older guys learn. Learning the Ng limit for an engine when the FLI does it for you is not necessary.
The L2 was an incremental step up,from the L and L1 but was manageable. It was then a step up again from L2 to 225 but more mature pilots found and still find the leap from L to 225 is a big one.
Part of this is generational, we have young software designers with the OEMs designing clever digital autopilots which are being flown by pilots with 25 years on the 332. Most older pilots will grasp the new technology if it's taught how they learn.
Not all that long ago, line avionics engineers would remove components and repair them with a soldering iron, that no longer happens and new engineers are diagnostically clever box changers. We need a more system functionality based approach, not how components work.
I think that Bob, DB and HC are right, we need to cut the unnecessary and include newer subject matter taught, for now how some of us older guys learn. Learning the Ng limit for an engine when the FLI does it for you is not necessary.
What, you mean I no longer need to retain the fact that the AS332L main gear tyre pressure is 7.2 Bar and the OEI 20 second transient Ng limit is 34,900 rpm? Or that the tail rotor goes to 1 degree and 6 seconds of pitch when the control cable snaps? Damn, no wonder I don't have any space in my head to remember other stuff - like people's names......
HC is correct that much of this detail was included a) to satisfy the CAA exams and b) because the groundschool was written by engineers and, to an extent, contained existing material from engineer's groundschool.
When I did the EC155 factory groundschool it was very apparent that their philosophy was rather different, and I remember the engines section comprising of "it has two engines and two yellow switches to turn them on and off" (to all intents and purposes). However, I also agree with HC that some degree of wider knoweldge is also an important thing, and the fact that I had previously learned in labourious detail how the hydro-pneumatic FCU on the PT-6 worked (in the B212) has done no harm. In fact I would say it has given a good understanding of what the basic principles of turbine governing are, which are essential in then understanding how a FADEC works too.
The key is to correctly identify the wood for the trees!
HC is correct that much of this detail was included a) to satisfy the CAA exams and b) because the groundschool was written by engineers and, to an extent, contained existing material from engineer's groundschool.
When I did the EC155 factory groundschool it was very apparent that their philosophy was rather different, and I remember the engines section comprising of "it has two engines and two yellow switches to turn them on and off" (to all intents and purposes). However, I also agree with HC that some degree of wider knoweldge is also an important thing, and the fact that I had previously learned in labourious detail how the hydro-pneumatic FCU on the PT-6 worked (in the B212) has done no harm. In fact I would say it has given a good understanding of what the basic principles of turbine governing are, which are essential in then understanding how a FADEC works too.
The key is to correctly identify the wood for the trees!
I think they do still find it a big leap, but once made it is a welcome one. I recently saw 2 of my ex colleagues, both close to retirement age and both "joe line pilot". Both had flown the 332L for many years, then the 225 for perhaps 6 years before the grounding. They went back to the 332L, but are now finally back on the 225. I asked them whether they found it harder going from the 225 back to the 332L, or from the 332L again back to the 225. The answer was categorically that it was harder going back to the 332L, and they seriously missed all the fantastic kit on the 225 which made the job so much easier and more relaxing.
Join Date: Mar 2005
Location: Holly Beach, Louisiana
Posts: 916
Likes: 0
Received 0 Likes
on
0 Posts
212man,
Remember the Black Marble Theory?
Our Brain is very much like a Jar of Marbles with a finite volume of knowledge it can store. All those Memory Bits are like Marbles of different colors connoting the importance of each.
Let's assume the Black Marbles are the most important and the Red Marbles are the next most important and the Pink and Mauve's are the least two important.
Should we not do our best to have a Jar full of Black and Red Marbles with as few Pink and Mauve as possible?
It isn't the Data Points about names and faces that is getting to you but all those Thousands of Bottles of Gulder you gulped down those Years ago that is getting to you.
Remember the Black Marble Theory?
Our Brain is very much like a Jar of Marbles with a finite volume of knowledge it can store. All those Memory Bits are like Marbles of different colors connoting the importance of each.
Let's assume the Black Marbles are the most important and the Red Marbles are the next most important and the Pink and Mauve's are the least two important.
Should we not do our best to have a Jar full of Black and Red Marbles with as few Pink and Mauve as possible?
It isn't the Data Points about names and faces that is getting to you but all those Thousands of Bottles of Gulder you gulped down those Years ago that is getting to you.
Re yr #134, HC, I remember you telling me about that French SID and I believe I said, "Excellent practical solution, but would you have passed an OPC blindly following a SID out of the FMS without time to find the supporting plate?"
I think your remarks suggesting that if only pilots could be bothered to achieve your level of expertise there would be no problem, are a bit severe. No doubt you put in a lot of work to achieve the eminence and reputation you have, but you need a particular aptitude to start with and we (the trainers) have to provide guidance for those less gifted. From where I sit, automation distracts people from the big picture and commits them to a disproportionate amount of time, and detail, "verifying" that what they THINK they've asked the aircraft to do is what the automatics are about to do.
I am aware of some studies which suggest the next generation of automation will be prioritised towards monitoring what the pilot does, not asking the pilot to monitor what the automation does. I think that would be a better way.
I think your remarks suggesting that if only pilots could be bothered to achieve your level of expertise there would be no problem, are a bit severe. No doubt you put in a lot of work to achieve the eminence and reputation you have, but you need a particular aptitude to start with and we (the trainers) have to provide guidance for those less gifted. From where I sit, automation distracts people from the big picture and commits them to a disproportionate amount of time, and detail, "verifying" that what they THINK they've asked the aircraft to do is what the automatics are about to do.
I am aware of some studies which suggest the next generation of automation will be prioritised towards monitoring what the pilot does, not asking the pilot to monitor what the automation does. I think that would be a better way.
Keith - well I think any TRE who gave a major change of SID at 200' on climb out would be being a bit harsh. Yes of course the FMS should be checked against the plates under normal circumstances, but those were not normal circumstances and I consider my actions were the best under the circumstances. What else should I have done - continued on the old SID towards the conflicting traffic? Personally I think it was a mild example of "resilience".
I'm surprised at your comments about the overall "usefulness" of automation bearing in mind the sort of comments I got from line pilots. Are you really advocating a reversion to "mandraulic" flying with mechanical dials etc? In the fixed wing world the introduction of automation is considered to have had a measurable safety benefit and I don't see why, 20 years down the line, we won't see the same result for RW. Sure, the FW boys still crash, and sometimes automation is at the root of it, but overall they crash less often.
Anyway, to be harsh (again!), Automation is here to stay so best get used to it and make the most of it!
I'm surprised at your comments about the overall "usefulness" of automation bearing in mind the sort of comments I got from line pilots. Are you really advocating a reversion to "mandraulic" flying with mechanical dials etc? In the fixed wing world the introduction of automation is considered to have had a measurable safety benefit and I don't see why, 20 years down the line, we won't see the same result for RW. Sure, the FW boys still crash, and sometimes automation is at the root of it, but overall they crash less often.
Anyway, to be harsh (again!), Automation is here to stay so best get used to it and make the most of it!
