In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

Servo signalsAll of the flight control surfaces, including the elevators and ailerons, containedservo-controlled 76 hydraulic actuators and position sensors. To execute the controlorders from the master FCPC, and change the position of a control surface, acomputer sent servo signals to the relevant actuators.Each of the five computers acted as the servo-controller for different controlsurfaces. For example, FCPC 1 normally generated the servo signals for theelevators and the trimmable horizontal stabiliser (THS). With regard to the ailerons,FCPC 1 normally controlled the left inboard aileron servos, FCPC 2 normallycontrolled the right inboard aileron servos, and FCPC 3 normally controlled theoutboard aileron servos.For the purpose of redundancy, multiple computers were connected to each controlsurface. If a computer was unable to execute the master FCPC’s orders for aparticular control surface due to a fault, then another computer would take over thatservo-controller role. For example, the priority sequence for acting as theservo-controller for the elevators was FCPC 1, FCPC 2, FCSC 1 then FCSC 2.Not all of the computers could send servo signals to each of the flight controlsurfaces. For example, FCPC 3 could not perform the servo-control function for theelevators.2.1.2 Fault-tolerant design features‘Fault tolerance’ refers to a system’s ability to maintain its functionality in thepresence of faults. Fault-tolerant design features are used extensively in the designof hardware and software for safety-critical systems such as a flight control system.A fundamental assumption is that faults can never be fully eliminated, but theirprobability and consequences can be managed to an acceptable level.The A330/A340 EFCS included a range of design features to provide faulttolerance. These included:• Redundancy. The use of five different computers provided redundancy in theevent of a failure of one or more computers. In the presence of certain types offaults or processing problems, the role of master switched from one FCPC toanother FCPC. In addition, the servo-controller for a control surface couldswitch to another FCPC or FCSC.• Self-checking pairs. Each computer had two physically independent channels.The command (COM) channel computed the control orders and/or servo signals,and the monitor (MON) channel conducted the same computations andcompared the results. The two channels had their own processor, power supply,memories, and input/output circuits. The use of two channels helped to identifyhardware or processing problems (section 2.1.3).• Monitoring. Each computer had built-in test equipment (BITE) to monitor itsown performance and that of the other computers, as well as to monitor otherelements of the system such as actuators and sensors. The FCPCs also76A servo, or servo-mechanism, is a control device that uses an automated feedback loop to improveaccuracy. Servo-mechanisms are often used to allow a low-power signal to drive a higher-powerdevice.- 68 -