Diagnostic Solutions

On-Board Health Monitoring and Alarming

Overview

Helicopter Health and Usage Monitoring Systems (HUMS) provide many benefits, one of which is the ability to provide real time condition of aircraft systems on-board.  Providing the aircraft pilot with pending failure information increases safety and in most cases affords the pilot ample time to perform safe precautionary landings. The information displayed to the pilot must be specific as to the system affected to allow for an immediate, intelligent assessment of the aircraft condition.  The predominant challenge facing system engineering is establishing parameter and signal validity prior to generating parameter exceedance alarms. Data fidelity must be carefully considered and accomplished in every aspect prior to generating on-board alarms. The United States Marine Corp CH-46E aircraft program has installed over 130 Honeywell Aircraft Integrated Maintenance Systems (AIMS), which provides a method of providing on-board alarming in three categories. (1) Non-Abort, post flight maintenance required, (2) Pilot informational displayed on the Control Display Navigation Unit, (3) Master Caution panel illumination for flight abort alarms.  These three alarm categories represent the best approach to providing aircrew and maintenance personnel with system critical information for continued safe operation of the aircraft while performing maintenance in a field environment.  The AIMS’ current configuration has over 100 alarms programmed for cockpit display if advisory criteria are valid.    System architecture requires several faulting and alarming mechanisms working together to ensure data fidelity has been met prior to generating an alarm.  Several techniques are employed to validate incoming engine parameter signals, such as range checking and rate of change qualification. If signals do not pass validity, alarming is suppressed.       Vibration alarming is slightly different.  The alarming mechanism utilized is a time hysteresis method, which employs a band alarm with an amplitude and time duration trigger, as well as an amplitude and time duration release.  If validity fails, the alarming is suppressed.   The Safety aspects are obvious; however just as significant are the maintenance savings recognized from reduction of component collateral damage.  . With the belief that all pilots need to know the condition of the machine they are flying at all times, on-board alarming of critical flight components is a necessary function of HUMS.  Condition based maintenance starts with safe landing of the aircraft without mishap.  On-board alarming will provide increased safety, reliability, and maintainability for the fleet.  Savings are incalculable as prevention of the mishap is priceless.

Case Studies 

Aircraft HUMS provide many benefits; the most significant of which is the ability to monitor and alarm aircraft components real-time on-wing.  By capitalizing on these real-time monitoring features (monitoring vibration levels, speeds, temperatures, pressures, torques, etc.), the aircrew is empowered with critical system information in terms of impending failures on-wing, prior to collateral aircraft/component damage.   The Marine Corps CH-46E AIMS program quickly realized these savings on a number of aircraft components. For example, on-wing vibration monitoring and alarming revealed an internal engine compressor rotor failure which has historically lead to secondary collateral engine damage and posed a substantial in-flight safety risk.  As Figure 1 illustrates, the #1 and #2 engine compressor 1/revolution vibration amplitudes operated below 0.5 Inches Per Second (IPS) for several hours.  In a matter of minutes, the #2 engine compressor 1/revolution (green) increased to over 8.0 IPS, far exceeding the allowable vibration limit imposed.  The aircrew had no indication of this failure other than the AIMS alarm indication. 

Figure 1. Engine Compressor Vibration Trend Plot 

Upon disassembly, an internal failure (compressor air guide plate) was discovered (Figure 2.)  Prior to on-wing monitoring and alarming, an identical failure mode was experienced that essentially went undetected on-wing and consequently ruptured the exterior compressor casing.  Fortunately, an aircrew member noted the secondary damage on a pre-flight inspection and avoided further collateral damage. 

Figure 2.  Failed Compressor Air Guide Plate 

Another example from the CH-46E AIMS system is the detection and exploitation of a number of impending pump shaft failures.  Figure 3 illustrates one of several #2 flight control boost pump impending failures discovered by AIMS.  This specific failure mode is detected by the 1/revolution frequency on-wing.  Typically, aircraft that have experienced these alarms were found to have severely worn splines on the pump’s drive shaft. Loss of this pump in flight imposes an obvious safety concern as the aircrew looses hydraulic boost pressure to the rotor flight controls. 

Figure 3.  #2 Boost Pump Drive Spline 

An additional CH-46E AIMS example includes loosening mounting hardware on a transmission mixbox. This failure mode presents itself on-wing as a drive shaft 2/revolution amplitude alarm on both shafts entering the mixbox. When the maintenance crews investigated the AIMS' reported discrepancy, they found loose hardware. A quick re-torque corrected the problem, cleared the alarm, and prevented further collateral damage. 

Engine and drive system parameter alarming can also implemented on-wing. For example, AIMS monitors and alarms parameters such as engine torque, temperature, speed, oil pressure, aircraft main-rotor speed, transmission temperature, etc.  Since its inception, AIMS’ has documented several severe engine over temperatures and dual-engine over torques that may have otherwise went unnoticed by the aircrew.  Figure 4 illustrates a typical cockpit alarm indication for a Dual-Engine Over Torque (DUALQ) of the drive system.  

Figure 4.  AIMS Over Torque Alarm Indication 

Maintenance Practice Monitoring 

On-wing monitoring and alarming can also exploit improper maintenance practices.  In one reported case, maintenance crews neglected to tighten the engine drive shaft coupling bolts after performing maintenance in an adjacent area. The AIMS vibration alarms quickly identified this issue and the corrective maintenance was performed to correct the discrepancy, prior to aircraft flight. 

On-condition maintenance philosophies can be utilized if the aircraft has a mature health monitoring system installed. The potential exists for components to be operated beyond their published service lives if the data is available to demonstrate that the component health is still acceptable and has not been “abused” in service. For example, most Original Equipment Manufacturer (OEM) imposed service lives are extremely conservative, and if the component has not experienced extreme loads or been operated at excessive vibration levels, the component could remain in service beyond the conservative life estimate. If implemented correctly and effectively, the aircraft HUMS can be used to provide the data required to justify an extension of component life. Parts usage is maximized and the cost of hourly based inspections, as well as the consumable parts discarded during these inspections, may be significantly reduced.  

On-Wing Monitoring and Alarming Considerations 

The examples above are tangible benefits of effectively utilizing HUMS on-wing monitoring and alarming; however, these benefits did not come without significant system design considerations and forethought to assure success.  In the case of AIMS, the predominant challenge that faced system engineering was establishing parameter and signal validity prior to generating parameter exceedance alarms. Data fidelity and realistic alarm levels of the parameters being monitored were carefully considered and accomplished in every aspect, prior to releasing on-wing alarms to the fleet.  And finally, careful consideration was given to alarm criticality and aircrew notification. 

Data Fidelity: 

False parameter exceedances are detrimental to  HUMS, as crew confidence will depreciate if excessive false alarms are indicated.  The parameter’s signal integrity must be examined in terms of data fidelity in order to identify all compromised signals before any alarming logic is applied.   

AIMS, for example, validates incoming vibration signals for clipping, shorts, and several other indications of compromised data fidelity prior to sending the information to the alarm process.  Vibration channels are tested from the sensor’s internal circuits back to the entry point of the Acquisition Unit (AU). If any signal error is detected, the respective sensor is flagged as suspect and reported to the maintenance personnel for attention via a “BIT Fail” Light Emitting Diode (LED) located on the AIMS’ AU, as well documented in a fault log file. More importantly the alarming logic for the respective sensor is suppressed while the signal is in a faulted state.  

In the case of engine parameters, the data is sent through a series of screening filters at 5 HZ, prior to reaching the alarming mechanism. The first filter checks for clipping, null readings, and ADC conversion errors, as well as applies a preliminary broad transfer function range check to the raw parameter signal. The second filter applies a range check of realistic values for the parameter. In the example of torque on the H-46, the validity range applied is -10% to 150%. Any issues found during this process are documented as faults and the alarming mechanism is suppressed for the respective parameter, as well as any computation dependent parameters for the affected engine (i.e.:  engine performance computations). 

The net result is avoiding alarms induced by erroneous data and inaccurate engine performance computations.   

Alarm Levels: 

As with data fidelity induced false alarms, alarm levels that are too stringent are just as detrimental to a HUMS.  The H46 program has experienced success in alarm setting by deriving vibration alarm levels statistically, from the fleet of aircraft.  However, alarm limitations will inherently evolve as the HMS matures and lessons learned.  

Alarm Criticality and Aircrew Notification 

There are a number of options for crew notification.  The CH-46E AIMS system utilizes three alarm levels for each component alarm.   

Level 1 Alarms (AU LED Illumination – Post-Flight Notification): 

Level 1 is the lowest level, and if exceeded, a “Check Logs” LED is illuminated on the AIMS’ AU located mid-cabin in the aircraft’s fuselage (Figure 5).  The intent of this alarm level is to indentify potential issues that require post-flight inspection of non-critical components.  A post-flight inspection step is in place to monitor the “Check Logs” LED on the AIMS and determine if data download is required.  These Level 1 alarms are also ideal for testing new alarm levels, since the aircrew are notified upon shutdown that the data should be downloaded and sent in for analysis rather than burdened in-flight. 

Figure 5. Engine AIMS Acquisition Unit “Check Alarms” LED 

Level 2 Alarms (CDNU Alarm Annunciation – In-Flight Aircrew Notification): 

Level 2 alarms illuminate the “Check Logs” LED on the AIMS AU, transmit a “üAlarms” annunciation to the Control Display Navigation Unit (CDNU) (Figure 6) via the 1553 data bus, as well as list specific component information relative to the alarm on the AIMS CDNU alarms page (Figure 7) for in-flight aircrew notification.  Level 2 alarms are not “mission abort” alarms but are critical enough that aircrew notification is warranted. The intent of this alarm level is to inform the aircrew of impending issues that require corrective action in the immediate future.  With this information, the aircrew is empowered with valuable information used to make informative decisions on whether or not a mission abort is warranted, given consideration to current mission requirements and circumstances.  In many cases, Level 2 alarms can also help the aircrew determine the origin of a noise or other suspicious aircraft behavior, or to validate existing cockpit instrumentation. In the case the CH-46E, AIMS is far more accurate than many of the analog cockpit instruments. 

Figure 6. AIMS CDNU “üAlarms” Annunciation 

Figure 7. AIMS CDNU Alarms Page 

Level 3 Alarms (Master Caution Panel Illumination – In-Flight Aircrew Notification, Mission Abort): 

Level 3 alarms are the most severe and could be considered “mission abort” inflicting emergency procedures. The level 3 alarms illuminate the “Check Logs” LED on the AIMS AU, transmit a “üAlarms” annunciation to CDNU, lists the parameter alarm on the AIMS CDNU alarms page, as well as illuminates a Master Caution Panel (MCP) “AIMS EXCEEDANCE” lens (Figure 8). The intent of this alarm level is to notify the aircrew of an imminent component failure. 

Figure 8. AIMS MCP “AIMS Exceedance” Lens 

Given careful consideration to the severity and criticality of the on-wing parameter alarm, aircrew notification is essential to safety of flight. 

Summary 

On-wing parameter monitoring and alarming is the biggest safety aspect of on-wing HUMS, and the culmination of all the ground work and development which matured the system.  The prevention of all false alarms is nearly impossible; however this should not paralyze the implementation of an on-wing health monitoring system considering the inherent safety benefits.  Ensuring data fidelity and imposing realistic alarm limitations will significantly reduce this risk and aid in the successfully implementing of on-wing parameter monitoring and alarming; conversely, failure to mitigate risks such as these will ultimately result in diminished user confidence and program trust. And finally, to maximize the capability of on-wing parameter monitoring and alarming, aircrew notification must be carefully considered and implemented, empowering the user with critical system information needed to assess impending component failures in-flight.