Train-the-Trainer by DataHomeLab

9.5 Safety Features

The three safety features the chapter catalogues protect occupants of the simulator from injury caused by motion-platform faults, hydraulic faults, or boarding-and-egress hazards. They are the load-bearing protection layer between the simulator's high-energy actuators and the people in the cockpit.

Failsafe detectors and automatic shutdown

To prevent injury to students and instructors, failsafe detectors continuously monitor system parameters and automatically shut down all systems if one is sensed to be out of limits. The failsafe-detector layer is the silent first line of defence: trainees and instructors do not interact with it directly, and it operates without instructor command when an out-of-limits parameter is detected. Hydraulic pressure, motion-platform position, electrical power, and selected airframe parameters fall within the monitored set.

The EMER OFF switch

The EMER OFF switch on the instructor's console can be used to shut down all systems. This switch is only activated in emergencies, since:

  • It immediately removes power from all systems.
  • It can damage the simulator.
  • Resetting the simulator after this switch has been depressed is time-consuming.

The gate and sky-bridge interlock

The gate must be closed when entering the simulator, or else the sky-bridge will not rise. This prevents the motion from actuating.

The interlock is a two-part safeguard against motion-platform actuation while the boarding bridge is still in contact with the simulator shell:

  • The gate at the entry to the bridge must be closed.
  • Only with the gate closed will the sky-bridge rise (the bridge raise-clear is the prerequisite for motion enable).

If either link is broken, motion does not actuate. The interlock means that an open boarding gate or a sky-bridge that has not raised is sufficient on its own to prevent motion: an instructor cannot accidentally enable motion with the bridge still down.

The three layers as a defence-in-depth

The three safety features compose a defence-in-depth chain:

  • The gate/sky-bridge interlock is the prerequisite for motion enable: if it is broken, motion cannot actuate at all.
  • The failsafe detectors are the runtime safety net: if a parameter goes out of limits during operation, all systems shut down on the device's own authority.
  • The EMER OFF switch is the instructor's manual override: if the runtime safety net does not catch a hazard the instructor sees, the instructor can shut everything down by hand.

The three layers are designed to be independent: a failure of one does not compromise the others. The instructor's discipline (gate-walked, EMER OFF reserved for emergencies, failsafe trips investigated rather than reset-without-thought) is what keeps the layers operational.

Connections