A Very Halting Affair to Remember

Air Safety Week, Feb 28, 2005

However, a latent and dormant fault within the Brake Dual Distribution Valve (BDDV) had disabled the Alternate System also. That failure was caused by a slushy frozen mixture of water and detergent restricting movement in the rocker arm in the lower part of the BDDV. Although a composite of failures, the inability to stop was kicked off by the BSCU's twin channels' simultaneous fault modes (per the later 2003 Skyservice Airlines C-FTDF event at Cardiff).

Peter Ladkin, professor of computer networks and distributed systems at Germany's University of Bielefeld, explains the BSCU's internal "interfereometry" as follows:

The BSCU has two identical channels, active ("hot") and standby, and there is a command (COM) and monitor (MON) function of the BSCU. MON checks COM for agreement before output is sent. Upon detection of a disagreement, a "disagree" condition is logged in the BSCU as well as sent to the Centralized Fault Data Interface Unit (CFDIU).

If a fault develops, it is detected in the hot channel. If hot and standby channels are both functioning, the system then transfers control to standby, which becomes hot and operates non-redundantly (that is, the faulty channel remains permanently cold). If standby is cold, hot remains active, control is not transferred, and one must then live with whatever functions are still provided by the faulty hot channel ... not exactly triple redundancy.

The BSCU performs a functional test on selection of Landing Gear Down, opening the Normal Selector Valve, which allows pressure from the Green hydraulic system to reach the four servo valves of the Normal system (Normal Servo Valves, NSVs). The BSCU then sends current momentarily to the NSVs and monitors the pressure rise. It then closes the NSVs, closes Normal Selector Valve, and then opens the NSVs again to release the pressure. This will have happened on the incident flight, the accident report says.

If the Normal braking system is inoperative, Alternate braking is made available by a spring-biased changeover valve (Automatic Selector Valve) which allows pressure from the Yellow hydraulic system to the Alternate braking system. Alternate braking is achieved through foot pedal pressure, transmitted hydraulically along a low-pressure line and ported through a Brake Dual Distribution Valve (BDDV) and a Dual Shuttle Valve to the Alternate servos on the brakes (these being separate devices from the NSVs). Antiskid is controlled by the BSCU, if still operative and selected.

One problem is as follows. The status of the BSCU switch is sampled every 20 msec asynchronously by the COM and MON functions. It is possible that a short switch operation, from 20 ms to 50 ms, could be detected by one function and not by the other, causing a "disagree" fault in one, or indeed in both, channels of the BSCU. The analysis concludes that this in fact happened. The crew saw the "BRAKES BSCU Ch 2 FAULT" message on the Electronic Centralized Aircraft Monitoring (ECAM) display on selection of the BSCU. The message is listed in the Operating Manual as being for "Crew Awareness" and there is no corresponding procedure. It turns out that the crew could have reset the BSCU but this info is not in the Abnormal and Emergency Procedures section of the Ops Manual, but in the Supplementary Techniques section, where it commences with the conditional "In case of braking /steering difficulty..." which they did not have ... because they were still in the air.