ON BOARD MAINTENANCE SYSTEMS (ATA 45)

Central Maintenance Computers, Data Loading System, Printing

OBMS - On-Board Maintenance System makes use of microprocessors operating as complete

computers with hardware and software. OBMS operation is independent of the system control
computers for various aircraft systems and for BITE - Built In Test Equipment - which is used for
system monitoring. Essentially BITE monitors and measures the inputs, measures the outputs
and checks that the outputs are within limits.
BITE can operate in the following three forms;
1. Start-up
2. Interruptive
3. Continuous (sometimes referred to as cycle or BIT - Built In Test)

1. Start-up BITE, though limited in its ability to detect failures during system operation, performs
the following checks at power-up:
A Checks that the power supplies are good by looking for correct phase rotation,
frequency and voltage.
B Checks the processors and the RAM, ensuring all are clear and functioning properly.
C Through the Built In Operating System (BIOS): initiates the loading of the main
operating software and any airline modifiable software, in a manner quite similar to
the boot up sequence of a personal computer.

2. Interruptive BITE is initiated by maintenance personnel or by the flight crew. In its simplest
form it is press to test but with OBMS it is much more. Generally, the inputs and outputs of
the system computer are electronically (but not physically) disconnected. The BITE then
starts to systematically inject a signal into each channel or lane and looks for the
corresponding output. It will inject signals across the entire design range of the system. This
form of BITE is referred to as Ground Tests. Maintenance personnel should be mindful of
what happens during the Ground Tests.

1
The term "aircraft effects" is used to indicate what is going to move during interruptive BITE /
Ground Tests. Air/Ground sensing protection is applied in the interruptive BITE to prevent
serious aircraft disturbance with the possibility of fatal consequences.

3. Continuous BITE is carried out all the time during normal system operation and does not
involve extreme functions that are considered for the case of interruptive BITE/ Ground
Tests.

Inside the LRU (which is also a microprocessor/computer) there are at least two channels called
command and monitor channels. If there are three channels the third is called standby. Input
signals are applied to all channels. The channels calculate the output solution. The command
channel output is connected to the unit being operated and the monitor channel will use its
output to cross check that the command channel is functioning correctly.

Development of BITE:

BITE developed as computing (using very basic microprocessors) became available on aircraft.
BITE enabled monitoring of outputs against given inputs. Initially BITE was housed in a big box
bolted on to the side of the LRU and was used in much the same way as ground test equipment
was used at that time.

The BITE was a microprocessor itself that provided input and output monitoring. Initiation of the
BITE was done on the LRU by pressing the test button. Typically LEDs would come on to
indicate system faults. This provided coded information for follow up using the Maintenance
Manual for trouble shooting.

A further development was done to centralize the location of the LEDs. For example, a bank of
LEDs was located close the refuelling panel and were available for checking on the ground. As
the BITE picked up failures, the relevant LED illuminated.

To ensure that LRU removal was done as a result of reliable LED indication, BITE design was
improved to allow the LEDs to remain illuminated after a fault was detected until reset manually.
After the aircraft landed, the reset button was pressed and the LEDs that remained illuminated

2
were noted. This design ensures that LRU removal is done only in the case of existing faults and
not as a result of BITE microprocessor failures.

Failures are of two types –

1. Soft failure - where there is a fault that has subsequently cleared
2. Hard failure - where the fault is still apparent (LED is still illuminated after reset is
pressed).

Soft failures illuminate the relevant LED which will stay illuminated till reset manually.

After manual reset, the LED does not illuminate again. In case of hard failure, the LED will reset
but illuminate again.

Some aircraft systems do not operate normally on ground, for example, pressurization system,
where faults become apparent only during flight conditions. By the time the aircraft has landed,
the fault would have cleared. These failures are 'soft' failures. BITE can be manually initiated to
check the system operation.

More recent developments in BITE technology moved the BITE box to a central location. The
BITE box is itself a computer. Boeing refers to this box as CMC - Central Maintenance
Computer. It forms the basis for all on-board maintenance systems and is described under ATA
chapter 45. Airbus calls the BITE box Centralized Fault Display System - CFDS.

On B777 aircraft, BITE is done through MAT - Maintenance Access Terminal. Access to tests
and checks are now via a centralized menu.

3
Central Maintenance Computing – Basics

Figure 1 gives details of a basic system. Note the two way flow of information from all the other
computers to the CMC with this data being converted into graphical symbols for transmission to
the CRTs on the flight deck. (CRT = Cathode Ray Tube. The Graphics Generator may be called
a Symbol Generator.)

Figure 1 CMC System – Basic Layout

The CMC - Central Maintenance Computer has two way flow of information from all other
aircraft system computers which work continuously and carry out calculations as defined by their
loaded software. Each aircraft system computer knows what the inputs and outputs should be
and these are continuously monitored. If any parameter goes outside of limits, a message is
sent to the CMC through a serial data bus. The CMC does the following steps to perform defect
correlation:
1. Checks the reported fault against programmed criteria.
2. Checks that the reported fault is in a 'reportable period'
3. Checks that another failed unit is not causing the reported fault.

If the defect correlation is correct, the CMC will indicate the failure to the flight deck. This
indication could be in a number of ways. The CMC also stores the fault information in Fault
History (Data Bank) for long term analysis.

4
The CMC generates the following types of messages/code:
1. Status Message - appears on a status display screen and gives a true indication of
system failure. Flight crew do not have immediate access to the status page display can
look at it when 'cued' to do so. For an aircraft to be dispatched (ready for flight), there
should be no status messages (or a very good reason for having one).

2. Maintenance Message - After defect correlation, CMC sets this message in the form -
XX-YYYYY, where XX relates to the ATA chapter, e.g. 27, flight controls. This Message is
not displayed to the aircrew as it is only ground engineers that use the The information
contained in the maintenance message. 'YYYYY' is the message number.

3. Fault Codes - are set by the failed LRU and the CMC does the correlation. This code is
used for fault diagnosis and is available to ground engineers only.

4. Maintenance Memo - generated for insignificant failures. Sufficient back up is designed in

aircraft systems to allow safe operation until the next scheduled maintenance when such
minor defects can be rectified. This keeps maintenance costs minimized yet does not
compromise safety in any way.

5. Memo Message - Displayed for the aircrew to see and it gives them reminders of systems
that are in operation. APU running, Park Brake Set are two such examples. These are
strictly not related to the CMC.

6. Access to CMC is provided most commonly through a Control Display Unit - CDU. The
CMC divides a flight into flight phases as follows:
a. Power On / Power UP
b. Engine Start
c. Taxi
d. Take Off
e. Initial Climb
f. Climb
g. Cruise
h. Descent
i. Approach
j. Landing

5
 k. Taxi In
l. Engine Shut Down
m. Maintenance

The CMC is receiving signals from every system on the aircraft so it can easily work out which
phase is it in. At power up the CMC resets and puts itself into the first phase. When the first
engine is started, the engine start signal puts it into the second phase.

When the brakes are released, it moves into the third phase. When take-off power is set, it
moves into the fourth phase. Fifth phase is entered when the air/ground signal changes to air
mode (weight off wheels) Sixth phase is entered when the altitude exceeds a certain preset
value.

Cruise phase is signalled by sensing stable attitude for a set period of time. Descent phase is
entered when it is sensed that the aircraft is descending to lower altitudes after being in Cruise
for some time.

Approach phase is established by signals from systems sensing aircraft tracking navigation
radio signals. Landing phase is entered when the air/ground signal changes to the ground
mode. Taxi in phase established after the thrust reversers are set from reverse to forward thrust
and idle power has been selected for a period of time.

Engine shut down phase is entered when the run/cut-off switches are set to off. Each phase
change requires the previous phase to have been set before moving on.

The Maintenance phase is the phase before any specific functions are carried out after the
engines have been shut down. Maintenance phase can be manually selected by the ground
engineers to accommodate engine ground runs without moving into the Engine start phase.

The CMC will consider what flight phase the aircraft is in before it signals a specific defect. This
is called flight phase screening.

Basically any faults that occur in the flight phase will be recorded and hence stored in the fault
history.

6
Faults occurring outside the flight phase are displayed as existing faults only.

This means that all the faults that are induced on the ground do not clog up the fault history.

This allows the fault history to record real defects and screen out the maintenance induced
defects (such as removing a component for replacement).

FDE

A Flight Deck Effect (FDE) is any effect that is noticeable in the flight deck. For example,
appearance of a status message will be FDE. Also appearance of failure flags or warning light
will be counted as flight deck effects.

Figure 2 FIM Chapter Subject

7
The CMC will display the fault code and also, the maintenance message, and these will be
correlated to a Flight Deck Effect (FDE). So the first indication that there is a problem will
probably come from the flight crew - either verbally or recorded in the sector record page of the
Tech Log. This provides a FDE to work from. Check the CMC present leg faults pages and find
the appropriate maintenance message.

Use the maintenance message with the Fault Isolation Manual (FIM), which is an essential tool
in today's integrated aircraft and supporting systems design. Sometimes a fault in one system
will show itself as a failure in another system and this type of 'fault hiding' can render traditional
fault diagnosis techniques useless.

The FIM is split into ATA chapters. Figure 2 shows the breakdown of a typical chapter, in this
case ATA 21, which is Air- conditioning.

Notice the index titles and two of these should be familiar to you by now.

21-Fault Codes Index is the numerical index of all the possible fault codes. Fault codes as you
might recall are set by the failing LRU and correlated by the CMC.

21-Maint MSG Index is the numerical index of the maintenance messages that the CMC sent.
The CMC sent these in response to the LRU failure.

For interrogation of the CMC pages on the aircraft, there will be certainly one, and possibly both
of these numbers.

Figure 3 shows what these indexes are like once opened. Assume that the fault code and one of
the maintenance messages are displayed. Notice the FIM tasks in the right hand column.

Referring to Figure 2, it can be seen that the other two sections of ATA21 are FIM tasks and
task support. The FIM task is the actions required to be performed for a specific maintenance
message. These tasks lead through a 'most likely' fault finding approach; figure 4 shows you an
example of a FIM task.

8
9
Finally there is sometimes task support that provides wiring diagrams and locations of
components. This section is not always available, however.

10
Fault Correlation

This is a process for linking an FDE with the corresponding maintenance message. The ground
engineers should be able to relate a flight crew reported defect (by FDE) and link that to a CMC
generated message. Fault correlation does that. Since a FDE needs to be correlated to a failure
message, the correlation function has details of all the fault codes, maintenance messages and
the FDE and is able to link them when set criterion is met. Some CMC systems categorize the
failures as follows:
 Class 1 – those failures that have operational consequence and require referral to MEL
 Class 2 – failures with no immediate operational consequence but ones that will require
speedy repair.
 Class 3 – Failures with no consequence on aircraft safety and can be left to the next
hangar scheduled visit.

Some CMC systems do not provide the above-stated categorization and require that all failures
be referred to MEL and the MEL provides the categorization. If the correlation function does not
operate, the failures are still displayed (as FDE) and show up as existing faults (for as long as it
stays active/hard). The engineer would then have to link the FDE with the failure.

Inhibits and Special case BITE. When the aircraft is powered for the first time or an engine is
started, it is expected that many failures could be reported. Processing of all of these failures is
not desirable and it is necessary to filter these failures out. It also removes failures caused when
the engines are shutdown or power is removed from the aircraft.

Cascaded Effects

If a key LRU were to fail, for example the IRS, it provides information to virtually all systems on
the aircraft and if the IRS failed, it would induce many failures in the other user systems. These
failures would be reported to the CMC but this sub-routine would detect the cause and reason
for the failure and filter them out.

11
Consolidation

Often several maintenance messages will be generated when something fails. This sub-routine
brings these related failures together. It is not like cascaded effect, which was about removing
faults that were caused by other failures. This is grouping together similar faults.

Present leg faults records ALL faults that have happened on this flight leg in the reportable flight
phases. This would include active (hard) and latched (soft) faults that have and have not been
correlated together with a FDE. If a fault reaches this sub-routine and has not occurred in the
reportable phases it will not go into the fault history, it will not be displayed in present leg faults,
instead it will be displayed in existing faults (for as long as it stays active (hard). As soon as the
fault clears it will be removed. Therefore, it can be concluded that "existing faults' displays real
time information, this makes existing faults very useful for maintenance engineers for dispatch of
an aircraft, as it shows exactly the failures the aircraft has.

12
Storage and Display

This CMC function uses the flight phase screening and decides whether the fault is in a
reportable phase or not. If it is in a reportable phase, it will move the fault into the fault history
and usually display it in a section called Present Leg Faults (sometimes termed Inbound
Faults/Defects).

Present Leg Faults (PLF) records ALL faults that have occurred on the current /Present flight leg
in the reportable flight phases. This would include active (hard) and latched (soft) faults that
have and have not been correlated with a FDE. (Flight Phase Screening and Correlation are
distinctly separate functions).

A bit more about “soft” faults; some faults appear as intermittent faults. The fault causes a fault
message to appear in the flight deck and when the fault disappears, the fault message is
removed. The soft / intermittent fault is latched into the CMC memory.

The CMC attempts to correlate the latched fault with the FDE. Whether the CMC is able to do
the correlation or not, the fault is recorded under the PLF. If the fault did not occur in a
reportable phase (failed the flight phase screening), the fault is not recorded and is not displayed
in the PLF. Instead it will be displayed in Existing Faults (for as long as it stays active (hard).

Fault History

Fault history records all defects that have occurred in the reportable phases (have passed flight
phase screening) and will retain them for future analysis.

All aircraft records have to be stored and a “reasonable” amount of fault history on-board the
aircraft is kept as part of the Tech Log and is invaluable to the engineers when trying to locate
defects that have only occurred during flight. It is also a useful tool to recognize a trend of failure
and assists in the correct fault diagnosis first time.

Engineers look through the aircraft log book for the past ten or so sectors and the CMC has the
same ability with the electronic collection of information regarding defects recorded during
flights.

13
All fault codes and maintenance messages are stored in a memory that is volatile, that is, it is
lost when power is removed. 28 V DC is supplied from the Hot Battery Bus to keep the memory
of the fault history alive. Aircraft power is kept applied during battery replacement on modern
digital aircraft. (Although the above practice is considered to be wrong for basic electrical safety
principles on the older aircraft)

Additionally, consideration should be done for long term parking and hangar maintenance. Long
term parking will drain the aircraft battery, so we must record the fault history as part of our
preparation for long term parking process. Hangar maintenance will cause all sorts of faults to
be recorded in the fault history, for various reasons. Again, we need to record the fault history
prior to starting in-depth hangar work.

Fault history information is used for fault analysis and to provide assistance during fault
diagnosis. Fault History will show:
1. Date and time of event
2. Flight Leg or legs
3. Fault Code
4. Maintenance Message Number (including ATA reference)
5. Short description of the fault
6. Flight Phase
7. Type of Failure, i.e., hard (active) or soft (latched)

It is useful to know when the fault occurred. For example, if the flight crew reports that the
aircraft had to be flown with a constant rudder trim and we carry out an interruptive BITE check
that reveals nothing, what should be the next step?

Check the fault history and if it reveals that this fault has occurred on all previous sectors
following the replacement of one of the flight computers, we have information to accurately
analyse a fault that we would otherwise be unable to trace.

14
15
Flight Leg Logic

A Flight Leg is a sector (that is: doors closed, engines started and aircraft airborne). The flight
leg ends when the flight crew shut down engines after landing. Flight legs are defined
electronically. All the parameters mentioned above are sent to the CMC which calculates the
flight leg. The CMC counts backwards so that the current sector is flight leg 00, the one before
that is -01, the one before that is -02, and so on. Have a look at figure 8 that shows the flight leg
logic for the Boeing 777. Similar logic is used on other aircraft.

Looking at the flight leg transition logic, with the aircraft on the ground and the engine started we
start a new flight leg. As we start the flight leg notice that we provide an input, to the bi-stable
RSQ, that prevents the next transition by removing the logic 1 from the AND gate.

To regain the Enable logic 1, the aircraft has to take-off (park brake released AND engine at
take- off thrust AND groundspeed of 80kts). This provides an input to the 'S' leg of the bi-stable
and then resets the enable logic.

16
Ground Testing

A wide variety of ground tests can be done using the CMC which is capable of performing
interruptive BITE checks. The aircraft must be on ground and the airspeed below 80 knots.

The interruptive BITE test actually electrically disconnects the inputs and outputs and then
injects a whole series of inputs and monitors for the correct outputs. Interruptive BITE has the
advantage that it will test the system beyond the ‘normal’ expected range of inputs. It tests the
system right to the design limits. Results of Pass / Fail are given through screen displays on the
CDU

The MAT terminal of the B777 consists of a screen, tracker ball (same function as a mouse),
and a select button, with the keyboard stowed within the console. It is situated on the flight deck-
deck just behind the crew.

17
Data Load

This is an important function and one that is often overlooked. We need a data load facility for a
number of reasons:
 To load new software into various system LRU's.
 To extract variable data from the CMC such as fault history data.
 To speak directly with the FDR if required.
 To load route information.
 To load navigational database(s).

18
So straight away you can see that data load is in fact read or write information, not simply a
loading (write) facility.

Originally data load facility was provided by an external test set that plugged into a test
connection, often on the front of the main aircraft computing system. Data transfer would then
be from / to a magnetic tape in the test set. The set would convert the magnetic \information into
coded decimal and often something like gray code was used.

Prior to loading any software we need to ensure certain things. Firstly we must satisfy ourselves
of the origin and the fact that it is virus free. We must then check that the software we are about
to load is the correct part number and is compatible with the LRU we are about to load it into.
Finally after load we must ensure that the correct entries are made in the aircraft log to ensure
all data is updated and correct.

Incidentally all aircraft that have a centralized maintenance facility must have a copy of the
correct software on the flight deck. This is usually carried as part of the Tech Log.

Data loads for the other functions we mentioned are performed in much the same manner. Fault
history can be read and copied from the CMC and reloaded again, this is useful for the reasons
we stated when we looked at fault history

19
Printing

Most aircraft with these types of systems have an on-board printer. On a CMC generated
screen, whether that is through a multifunction display or a specific screen, the information can
be printed if required. This enables hard copy information to be taken away from the aircraft to
research faults in the FIM etc. Figures 11 and 12 show a typical thermal printer and schematic
diagram.

The printer is usually located on the flight deck centre stand. Both flight crew and engineers
require access to it. Information is sent to the printer from the CMC (NOTE the diagram shows
the B777 layout and on that aircraft the CMC resides within AIMS). This information usually
comes in ARINC 429 binary coded decimal form, but you may see it in other forms also.

Inside the printer the processing board converts the data into the language the printer uses. This
is fed to the interconnection board, which controls the printing process. At the correct sequence
the head moves and is heated, this passes over thermally sensitive paper, which is moved by a
stepper motor.

Defects of the printer are notified by way of lamps on the front of the panel. The printer normally
doesn't fault report to the CMC; it is part of the CMC and so is not really necessary. Paper rolls
are loaded in a number of ways but the instructions are always located in the AMM and often on
the inside of the printer top cover. As the paper is thermally activated it must be kept away from
heat and direct sunlight.

20
21
Structure Monitoring

General

Structure monitoring comprises the instrumentation of a structure with a sensor system that
monitors how the surroundings load the structure. An advanced software system receives the
data, interprets it and reports the structure’s condition to the operator. Real-time feedback to the
operator means that overloading may be avoided and any damage to the structure may be
discovered quickly. Comprehensive knowledge of the objective condition of the structure allows
condition-based maintenance, black-box recorder functionality and investigation of incidents.

The technology is well suited for applications such as condition monitoring of oil platforms, wind
turbines and bridges. In civil aviation such systems come into action only during development
and certification of an aircraft

Damage Tolerance Monitoring

The term “Damage Tolerance Monitoring” describes correctly what it exactly does. A good
example is the permanent monitoring of vertical acceleration of an aircraft during landing. A hard
landing can seriously damage the structure and must be avoided.

If it happens, the computer registers the excessive acceleration during touchdown. This is
reported, for example, to the pilot or maintenance personnel and the necessary action can be
carried out.

22