SAE Aerospace Control & Guidance Systems committee Presented by Pascal TRAVERSE And Isabelle Lacaze & Jean Souyris AIRBUS FLY-BY-WIRE A TOTAL APPROACH TO DEPENDABILITY Reference: by Pascal TRAVERSE, Isabelle LACAZE and Jean SOUYRIS, IFIP World Computer Conference, in Toulouse, August 2004. SAE/ACGS - Hilton Head
AIRBUS FLY-BY-WIRE A TOTAL APPROACH TO DEPENDABILITY Background What is «fly-by-wire» Dependability attributes Coverage of (some) dependability threats Physical faults Design & manufacturing errors Particular risks Human-Machine Interface Concluding words SAE/ACGS - Hilton Head October 2005 Page 2
AIRBUS FLY-BY-WIRE: BACKGROUND SAFETY AVAILABILITY SAE/ACGS - Hilton Head October 2005 Page 3
PHYSICAL FAULTS SAFETY COM MON COMMAND & MONITORING COMPUTER SAE/ACGS - Hilton Head October 2005 Page 4
PHYSICAL FAULTS AVAILABILITY P1 S1 S2 P2 REDUNDANCY ACTIVE / STAND-BY P1/Green Î P2/Blue Î S1/Green Î S2/Blue SAE/ACGS - Hilton Head October 2005 Page 5
DESIGN & MANUFACTURING ERROR Airbus Fly-by-Wire: system is developed to ARP 4754 level A Computers to DO178B & DO254 level A Fault avoidance (plus internal guidelines) Two types of dissimilar computers are used PRIM SEC Fault tolerance SAE/ACGS - Hilton Head P1 S1 October 2005 Page 6
DESIGN & MANUFACTURING ERROR FUNCTIONAL SPECIFICATION - interface between aircraft & computer sciences - automatic code generation - Classical V&V means, plus - virtual iron bird (simulation) - some formal proof SAE/ACGS - Hilton Head October 2005 Page 7
DESIGN & MANUFACTURING ERROR PROOF of PROGRAM Applied on A380 FbW software, on a limited basis credit for certification Method appraisal on-going on system functional specification SAE/ACGS - Hilton Head October 2005 Page 8
DESIGN & MANUFACTURING ERROR FAULT TOLERANCE P1 S1 S2 P2 - SEC simpler than PRIM - PRIM HW SEC HW - 4 different software - data diversity - From random dissimilarity to managed one - Comforted by experience SAE/ACGS - Hilton Head October 2005 Page 9
PARTICULAR RISKS COMMON POINT AVOIDANCE PRIM1-SEC1 2500 VU - Qualification to environment - Physical separation - Ultimate back-up PRIM3-SEC3- CPIOMC1 2100 VU PRIM2-SEC2- CPIOMC2 2200 VU SAE/ACGS - Hilton Head October 2005 Page 10
PARTICULAR RISKS ULTIMATE BACK-UP - Continued safe flight while crew restore computers - Expected to be Extremely Improbable - No credit for certification - From mechanical (A320) to electrical (A380 & A400M) 3000psi SAE/ACGS - Hilton Head October 2005 Page 11 r 28VDC
ELECTRICAL ACTUATION A320... A340 ELECTRICAL GENERATION HYDRAULIC GENERATION EMER GEN GEN 1 GEN 2 APU GEN GREEN PUMP YELLOW PUMP BLUE PUMP Avionics Flight Controls Actuators A380 A400M ELECTRICAL GENERATION HYDRAULIC GENERATION EMER GEN GEN 1 GEN 2 APU GEN GREEN PUMP YELLOW PUMP Avionics Flight Controls Actuators MORE REDUNDANCY DISSIMILAR (HYDRAULIC / ELECTRICAL) INCREASED SEGREGATION SAE/ACGS - Hilton Head October 2005 Page 12
HUMAN-MACHINE INTERFACE - Reduction of crew workload & fatigue - Situation awareness - System reconfiguration - Flight envelope protections -TCAS, TAWS - Airbus protections Let the crew concentrate on trajectory Stick released : Aircraft will fly inside normal Flight Envelope Normal Peripheral Stick on the stops : Aircraft will fly at the maximum safe limit SAE/ACGS - Hilton Head October 2005 Page 13
DEPENDABILITY PROCESS Safety & Reliability method and process - Research, - Standards, - Processes, - Methods, - Guidelines, - Tools, - In service follow up - S/R Rules and recom. - Regulation Cost requirements s y s t e m l i s t Multi program, multi disciplinary activities Top Level Top Level TOP (AIRCRAFT) Program Product Requirements Requirements Top level requirements document Previous A/C design and In service experience A/C constraints A/C Functions List (COMPONENT) Function /Systems allocation matrix Aircraft functions list requirements DOWN PROCESS allocation Multi system activities on one program 3- System S/R Requirements document SRD Airworthiness regulation, MMEL 1- S/R Common Data Document 2- Aircraft FHA (Functional Hazard Analysis 4- System function list and System FHA 5- : Prelim. system Safety Assessment FIA: Function Implantation Analysis IHA/ECHA: Intrinsic/Environment hazard Analysis 6- Equipment S/R Requirements 8- COMMON CAUSE ANALYSIS (CCA): - PRA (Particular Risk Analysis) - ZSA (Zonal Safety Analysis) - CMA (Common Mode Analysis) - HHA (Human Hazard Analysis 7- Equipment level Safety/Reliability studies (FMEA/FMES, etc.) SAE/ACGS - Hilton Head October 2005 Page 14 PTS PTS PTS A/C Requirements/CRI, Significant Items, Aircraft S/R Reviews System/equipment activities on one program Aircraft 11-Airworthiness 12-Lessons manufacturer BOTTOM - UP directives monitoring learned evaluation System S/R Reviews Common Cause activities on one program Aircraft in service Aircraft certification 10- Aircraft Safety/ Reliability Synthesis 9b- System Safety Assessment and MMEL safety justification 9a- first flight, Interface S/R Activities Multi disciplinary activities
DEPENDABILITY PROCESS Cost requirements Top Level Program Requirements Top Level Product Requirements Previous A/C design and In service experience Airworthiness regulation, MMEL Aircraft manufacturer directives 11-Airworthiness monitoring 12-Lessons learned Aircraft in service Safety & Reliability method and process - Research, - Standards, - Processes, - Methods, - Guidelines, - Tools, - In service follow up - S/R Rules and recom. - Regulation s y s t e m l i s t Multi program, multi disciplinary activities Function /Systems allocation matrix A/C constraints Aircraft functions list Top level requirements document LESSONS LEARNED A/C Functions List Multi system activities on one program 3- System S/R Requirements document SRD 1- S/R Common Data Document 2- Aircraft FHA (Functional Hazard Analysis 4- System function list and System FHA 5- : Prelim. system Safety Assessment FIA: Function Implantation Analysis IHA/ECHA: Intrinsic/Environment hazard Analysis 6- Equipment S/R Requirements 8- COMMON CAUSE ANALYSIS (CCA): - PRA (Particular Risk Analysis) - ZSA (Zonal Safety Analysis) - CMA (Common Mode Analysis) - HHA (Human Hazard Analysis 7- Equipment level Safety/Reliability studies (FMEA/FMES, etc.) SAE/ACGS - Hilton Head October 2005 Page 15 PTS PTS PTS A/C Requirements/CRI, Significant Items, Aircraft S/R Reviews System/equipment activities on one program IN-SERVICE AIRCRAFT System S/R Reviews Common Cause activities on one program Aircraft certification 10- Aircraft Safety/ Reliability Synthesis 9b- System Safety Assessment and MMEL safety justification 9a- first flight, Interface S/R Activities Multi disciplinary activities
DEPENDABILITY PROCESS Safety & Reliability method and process Cost requirements Top Level Program Requirements Top Level Product Requirements Top level requirements document Previous A/C design and In service experience - Research, A/C constraints A/C Functions List - Standards, - Zonal Safety Analysis - Processes, - Methods, - Guidelines, - Tools, - In service follow up - S/R Rules and recom. - Regulation s y s t e m l i s t Aircraft functions list 3- System S/R Requirements document SRD Airworthiness regulation, MMEL COMMON CAUSE ANALYSIS: - Particular Risk Analysis - Common Function /Systems Mode Analysis allocation matrix - Human Hazard Analysis Multi program, multi disciplinary activities Multi system activities on one program 1- S/R Common Data Document 2- Aircraft FHA (Functional Hazard Analysis 4- System function list and System FHA Aircraft manufacturer directives 5- : Prelim. system Safety Assessment FIA: Function Implantation Analysis IHA/ECHA: Intrinsic/Environment hazard Analysis 6- Equipment S/R Requirements 8- COMMON CAUSE ANALYSIS (CCA): - PRA (Particular Risk Analysis) - ZSA (Zonal Safety Analysis) - CMA (Common Mode Analysis) - HHA (Human Hazard Analysis 7- Equipment level Safety/Reliability studies (FMEA/FMES, etc.) SAE/ACGS - Hilton Head October 2005 Page 16 PTS PTS PTS A/C Requirements/CRI, Significant Items, Aircraft S/R Reviews System/equipment activities on one program 11-Airworthiness monitoring System S/R Reviews Common Cause activities on one program 12-Lessons learned Aircraft in service Aircraft certification 10- Aircraft Safety/ Reliability Synthesis 9b- System Safety Assessment and MMEL safety justification 9a- first flight, Interface S/R Activities Multi disciplinary activities
AIRBUS FLY-BY-WIRE A TOTAL APPROACH TO DEPENDABILITY CONCLUDING WORDS Joint effort for improvement - FAA/JAA/ Airbus/Boeing/ - Regulations and practices improvement based on - Type certifications experience - In-service incidents & accidents - For in-service airplane & under design SAE/ACGS - Hilton Head October 2005 Page 17
This document and all information contained herein is the sole property of AIRBUS S.A.S. No intellectual property rights are granted by the delivery of this document and the disclosure of its content. This document shall not be reproduced or disclosed to a third party without the express written consent of AIRBUS S.A.S. This document and its content shall not be used for any purpose other than that for which it is supplied. The statements made herein do not constitute an offer. They are based on the mentioned assumptions and are expressed in good faith. Where the supporting grounds for these statements are not shown, AIRBUS S.A.S. will be pleased to explain the basis thereof. SAE/ACGS - Hilton Head October 2005 Page 18