Each channel is, in reality, a sophisticated computer — Page 385, Lesson 482

Right, so we’ve already got the two EEC channels set up — channel ‘A’ and channel ‘B’. Now I want to take you deeper into how these two channels actually work together, because this is the heart of the whole supervisory system. Each channel is, in reality, a sophisticated computer. And here’s the key phrase: it operates both in tandem and in isolation with the other channel. What that means is — the two channels work together, sharing the job, but each one is also fully capable of running the engine entirely on its own. Only one channel, either ‘A’ or ‘B’, is actually necessary to monitor and control the engine. The other one is there as a fully capable standby. Now, here’s the clever part. Both channels independently analyse the raw data. And I want you to note that word — independently. Each channel takes the raw data and processes it on its own, without relying on the other. What raw data? The throttle lever position, the outside air temperature, the exhaust gas temperature, and every other parameter that is needed for, or could affect, engine performance. So they’re both looking at the same inputs, but each one is doing its own analysis. Then, after analysing independently, they compare results — with each other, and also with the inbuilt limiting parameters set by the manufacturer. So there are two comparisons happening: channel A versus channel B, and both versus the manufacturer’s limits. Now, built into each channel is something called the built-in test facility — BITE for short. BITE continuously monitors the inputs and outputs to the EECs in order to detect and isolate failures. So it’s a self-testing system that’s always watching for anything going wrong. Here’s where the command logic comes in. The healthiest channel — the one with the least faults — takes command of the engine. But this isn’t a permanent assignment. The channels will swap command whenever the health of the standby channel exceeds that of the channel currently in command. So command is dynamic — it passes back and forth based on which channel is healthier at any given moment. And there’s a critical safety behaviour here. If any of the raw data is missing, corrupt, or exceeds limits, the channel in command will automatically default to the inbuilt values. So if a sensor gives bad data, the system doesn’t just fail — it falls back to pre-programmed values stored inside. Once the raw data has been analysed, the channel in command uses the results to monitor and regulate the pressures and temperatures of the fuel and airflow through the engine — and this runs from start to shutdown. The goal is maximum performance, while at the same time ensuring that structural and performance limitations are not exceeded. Now, how does the EEC actually achieve this? It operates a whole list of engine systems: the igniters, the inlet guide vanes, the variable stator vanes, the compressor bleed valves, the active clearance control, the thrust reversers, and so on, as necessary. Each of those is a physical control the EEC is commanding. And why does all this precise control matter? Because such precise control and monitoring of the fuel and airflows maximizes engine efficiency, reduces costs, minimizes the risk to engine health, prolongs engine life, and reduces pilot tasking. So the pilot doesn’t have to manage all this manually — the EEC does it. Now, the FADEC system — and remember, FADEC is the full-authority version — has an additional safety facility. If any of the engine controls malfunction, preventing the channel in command from carrying out a specified function, then the channel in command will attempt to move the appropriate control to a fail-safe position, and it will activate the appropriate failure warning on the centralized warning panel. So there are two actions: physically move the control to a safe position, and alert the crew on the central warning panel. And the excerpt gives us an example — it says, for instance, if a fault occurs… and that’s where the passage cuts off. But you’ve got the principle: fail-safe positioning plus crew warning. That’s the FADEC’s extra layer of protection beyond what the supervisory EEC does. So to tie it all together: two independent computers, each fully capable alone, both analysing the same data, comparing results, with BITE watching for faults, the healthiest channel commanding, automatic default to inbuilt values on bad data, and — in the FADEC version — fail-safe positioning with crew warning on malfunction. That’s the complete picture of how these channels manage the engine.