jul-aug2012

Flight Safety Australia
Issue 87 July–August 2012
41
Under the federated model of system architecture, the various
computers in an aircraft could be thought of as like member
states of the European Union (or any other federation,
Australia even). They worked for a common purpose, but
each component was unique. There was a ‘black box’ for the
autopilot, and a separate black box for the inertial navigation
system, for example. They were able to cooperate closely
in some tasks, but not as closely in others. To stretch
the metaphor: they all used the euro, but their individual
economies were very different.
In contrast, integrated modular avionics, as used on the latest
generation of transport aircraft, including the Airbus A380
and Boeing 787 do away with discrete black boxes. They are
replaced by racks of computer modules, which are, in the
words of an Airbus presentation on the A380, ‘non systemspecific’.
It’s like the way a laptop computer can do duty as
a DVD player. As long as the right peripherals (sensors and
actuators in an aircraft) are in place, a computer can turn
its hand to whatever its software allows. Moreover, multiple
systems applications can be executed on the same computer.
The aircraft’s computers speak to each other on a high-speed
multiplexed network.
Integrated modular avionics bring obvious advantages of
system redundancy and robustness. But they also bring new
and subtle hazards in the way they differ from the old federal
architecture.
The Airbus presentation notes: ‘Resource sharing has a direct
impact on the way to design and implement systems since
it creates new dependencies between them, both from a
technical and a process point of view.’
‘With modern aircraft there are more functions, but not items,
included in the MEL’, Nikolic says. ‘Each of these functions
may be carried out by more than one system, some of which
could be critical systems in the aircraft. You might have a
function that is MEL-able, and to repair that function you need
to replace a critical component. However, we have noticed a
significant number of events that were not reported because
the function was MEL-able.’
One example illustrates the potential hazard. An operator flying
a new technology aircraft reported through the SDR system
that its engineers had removed the thrust control quadrant—
the thrust levers and mounting—twice.
A subsequent audit of the operator revealed 17 removals
over 14 months. ‘We asked “why didn’t you report the other
events?” and they said “they were all MEL-able—we didn’t
have to report them”,’ Nikolic says.
Further reading
Jean-Bernard Itier, Airbus presentation on A380 integrated
modular architecture. http://tinyurl.com/bpn6edq
‘Two removals of the quadrant signified nothing much, but
17 was an unambiguous trend. Here was a serious reliability
issue with a major component—and we didn’t know about it.’
‘We realised from this how the MEL could hide potential
defects. Many of these could be precursors to a major event.
If we are not aware of these failures we are not aware of the
reduced reliability of a critical component and we can’t act. ‘
In modern aircraft everything is connected, Nikolic explains.
‘Unless you do a thorough investigation into the
causes, you cannot establish whether any small
functional failure is related, or not, to a potential
major defect that must be reported.’
Under the revised CAAP 51, the MEL provision not to report
a defect does not exist, and it is up to the operator to do a full
investigation and establish whether a defect is major, after
considering the root cause. If the root cause points towards
the major defect, an SDR must be submitted.
The other reason for redrafting CAAP 51 was a significant
number of questions coming from the industry about
corrosion levels.
‘The previous version did not have specific corrosion level
definitions, or details of the corrosion level that required
reporting to CASA,’ Nikolic says. ‘The new draft provides
specific corrosion level definitions and also explains what
corrosion levels need to be reported through the SDR system.’
One result, Nikolic says, is that aircraft makers will be able to
coordinate their internal corrosion reporting systems with the
new CASA one. ‘If there is an issue in future with corrosion
levels everyone will be on the same page. It reduces ambiguity
in communication.’
Two other significant details have been changed. The revised
CAAP 51 says that when a service difficulty investigation
takes more than two months to complete the submitter should
provide follow-up interim reports every two months.
‘In other words: you need to report every two months, even if
it is only to say you are still working on it,’ Nikolic adds.
And a short but significant sentence, added as item (w) to
appendix A, encourages operators not only to submit major
defects that match examples listed in appendix A, but also any
other information they consider to be important.
To sum up: aviation safety in the age of the Reason model
multi-factor accident depends on information. What information
is reported depends on the reporting system. That has been
fixed—for now—but the game will continue to evolve.