stator vane

seems a bit extreme.

experience in real airplanes, especially stalling them and rolling around in them would allow the person to FEEL some of what is actually happening and i will respect that more than any simulator experience, and i will listen to someone who has actually experience, especially a test pilot.

i will also listen to someone who seems to be focused on the 747's vortex aiming onto the rudder and not touching any other part of the airplane. but it seems a bit narrow.

may as well cancel all reference to experience when hiring as well.

Wino

Stator,

WSherif1 was referring to me.
He is retired AA and I am relatively new to AA and as such he assumed that my experience was limited to 2+ years at AA plus maybe an F-16 before hand. He didn't know that I can out of several other airlines and did post maint. work there...

Because we have also crossed swords on the APA message board called C&R we both know all about a little section of each of our lives but not the whole picture. We would still be sluggining out on C&R if that software wasn't so darn clunky that it just isn't worth my while.

Bill,
I agree that we will wait. I just want to remind you everyone jumped to exactly the same conclusion with USair 427 in Pitt. When push came to shove and they flew the 2 airacraft in VERY close proximity (much closer than the accident) Lo and behold it was found that wakes while interesting were nothing more than a trigger for a mechanical problem lurking in the aircraft.


Cheers
Wino

wsherif1

Wino,

Your reference to the USAir 427 accident in Pitt.and the 727 wake experiment indicating that the wake was of no consequence but only triggered a mechanical problem ignores the fact that wake turbulence can trigger a pilot's instinctive reaction to aircraft attitude transitions along with erroneous flight instrument readings, due to the wind shear forces in turbulence..

Excerpt from a NTSB letter dated January 21, 1998. "Pilots reaction to turbulence, MOSTLY INADVERTANT, does cause more problems than the jolt of turbulence itself."

What mechanical problem are you referring to?

The aircraft crashed in a left bank attitude. Both pilots left legs were fully extended (medical examiner statement) and both left rudder pedals were sheared off their supporting structures!

Pilot reactions to turbulence is fully documented in TWA 705, United 585, COPA 185, USAir 1016 and EgyptAir 990 accidents.

AA 587 is not included in this catagory as the pilots did not have the time or the conmtol force available to counteract the immense forces on the combined fin and rudder surface area.

Fraternally





.

stator vane

do you think it all hangs on the wake turbulence and the pilots' reaction to it? in the AA and the B737 events as well?

was there then nothing wrong with the B737 rudder PCU's after all?

personally i have never had any rudder runaway-YET-but it sounds as if there have been some definite events in the rudder from what i have read.

i am simply reading this thread and asking questions if that is okay. not attacking at all.

all this leads me to state that more unusual attitude recovery in real aircraft or the sim would be more useful than ADF approaches. regardless of how many factors entered into the event-wake turbulence, yaw dampers, rudder PCU reverse flow and jamming, composite failures and sure enough, the pilots' reactions-even if some of the control came back while the aircraft was over on it's back and headed into the ground, more familiarity with unusual attitude recovery would not hurt matters at all.

cheers;

PickyPerkins

I couldn't agree more.

wsherif1

Stator Vane,

AA 587 was not a pilot reaction to turbulence, it was strictly the
aircraft's mechanical reaction to the rotating vortices force against the large surface area of the fin & rudder. The pilots had no effective control of the aircraft.

When you ask about the B737 events (United 585 at Colorado Springs and USAir 427 at Pitt.) here we are in a completely different situation. United encountered mountain wave turbulence which affected the flight instrument indications. The pilot reaction to an attitude transition (nose up) and erroneous flight instrument readings triggered pilot flight control inputs and the aircraft pitched over into a dive. Co-pilots exclamation, "Oh God (Flip)"! Note, she did not say Roll!

The NTSB removed the final controllers sworn statements from the official report! The controller said, "The aircraft never rolled it went straight in"!

In the USAir accident the NTSB claimed the wake turbulence from the B727 just minutes ahead had no effect on 427! They do not understand that the flight instruments can be affected! The pilot reacted to erroneous flight instrument indications! Pilots have been injstructed throughout their careers to believe their instruments and have not been told about the possibility of erroneous indications from wind shear forces in turbulence.

There never was any problems with the B737 rudder! As you know, even after they modified the rudder they continued to have problems.

The numerous reports of rudder malfunctions is, in most cases, actually aircraft wake turbulence. Dr. AA Wray of NASA affirms that in smooth air aircraft wake turbulence can persist for extended periods of time. I had a severe wake turbulence encounter 45 miles behind another 707, in smooth air!

The 'Industry' has so sensitized the pilots to this supposed rudder problem that recently a crew returned to land because the aircraft 'shuddered'!

You are correct more instruction in unusual attitude recovery is imperative. The present, Aircraft Upset Recovery Training Aid, is not only misnamed but in one reccomended procedure can almost guarranty an aircraft upset accident. It should be named Aircraft Unusual Attitude Recovery Training Aid. Once an aircraft is upset into a steep dive attitude the acceleration of G is so rapid that the possible recovery velocity is exceeded and the aircraft breaks apart in the air. e.g. NWA705, COPA 185, EgyptAir 990, etc.

The 'Industry' still insists that an aircraft will pitch down in an updraft! In my 'pitchup' in a B707, (in the clear above strong thunderstorm activity), from a weather induced updraft, the aircraft pitched up, instantaneously, to an attitude of 20-25 degrees! There was no zoom in climb just some mechanical lifting with the updraft. The aircraft's momentum carried it along, in this attitude, on its projected flight path.

Due to the vertical component of the relative wind there was no zoom in climb as you would expect in this nose attitude transition. No zoom, no increase in aircraft load factor, 'G'! No increase in G, no loss of aircraft's kinetic energy! No loss of kinetic energy no iminent stall threat! No stall threat no need for a radical pitch control input! Ease the nose down to the actual horizon, as in my case, or artificial horizon if on instruments! NOW THE BIG PROBLEM! Your flight instruments will show a rapid climb and slowing airspeed! The pilot's natural reaction will be to shove the nose down. With this radical control input and the vertical component of the relative wind, the aircraft will pitch over into a vertical dive. In the NWA 705 pitchup accident the pilot trimmed the horizontal stabilizer nose down but the aircraft did not respond as expected so he further trimmed to the nose down stop. Now he exited the updraft and normal relative wind conditions took affect and the full nose down trim pitched the aircraft over into a steep dive attitude. The aircraft came apart in the air during the attempted recovery! In the investigation both gyros exhibited severe impact damage on the nose down stops!

In turbulence the aircraft must be controlled with reference to the artificial horizon only! The erroneous flight instrument indications that trigger pilots' instinctive reactions must be shielded from the pilots' field of view! A 'heads up' presentation of the artificial horizon on the windshield?

Regards,

wsherif1

Wino

Bill you are working with outdated info on 427 and colorado springs.

I suggest that you get last month's (maybe 2 months ago now) Air and Space magazine. It has a long detailed description of the investigation and how they thought what you thought was true untill they found the mechanical defect in the 737s rudder that causes it to reverse (You step with right foot and it goes left) and then JAM at the stop. The problem is real and now known and turned out to be common to the redesigned rudder. The aircraft have been speeded up to faster than crossover speed as a near term bandaide till the fleet can be fixed.

Your hypothesis was given a VERY serious look at by the NTSB and the FAA and everyone else untill the real mechanical defect was found. We have found enough defects in the A300 as well.

Cheers
Wino

PS. If you can't get a hold of Air and Space shoot me your address and I will copy it and forward it to you if I still have it

wsherif1

Wino,

The NTSB really had to work hard to find some mechanical fault to cause a supposed rudder problem.

As you will recall they then determined that the United 585 accident at Colorado Springs, CO must have experienced the same problem, so they finally solved this previous accident by blaming it on the rudder also.

I don't know if you have read the ATC Chairman's Factual Report on this accident. It is very enlightening! The NTSB never acknowledged or mentioned it in the final report!!!

This 'Factual' report contains the sworn statements of the final controller handling the aircraft at the time of the accident. Qiuote from Mr. Rayfield (final controller), "The aircraft never rolled it went straight in"! etc., etc.

You quote the supposed problem in the 427 accident, "You step with right foot and it goes left and then jams at the stop." Please explain the fact that both pilots' left legs were fully extended at impact (medical examiner) and both left rudder pedals were sheared off their support structures!!

The NTSB will do whatever is needed to cover-up accidents that might alarm the flying public , meanwhile they are obscuring the real causes! They have removed essential data from the official report on the TWA 800 accident, they are reading the FDR readout from the Zero G line!, They have ignored evidence in the EgyptAir 990 accident and implied evidence that is absolutely not true.!! etc. Save us from the NTSB!!

Cheers!!

Belgique

Obviously AA587's tail fell off after it was sorely abused. There's but one candidate for said abuse (IMHO). It's just the process that they now need to hunt down.
This 13 Nov 01 incident below may be relevant (happened quite remarkably the day after the AA587 crash).

FACTUAL INFORMATION
A Boeing 747-SP38 aircraft was maintaining Flight Level (FL) 430 with autopilot `A' engaged, when the aircraft yawed abruptly to the right and rolled to a bank angle of approximately 20 degrees. The autopilot was disengaged and the aircraft stabilised in a straight and level attitude. The uncommanded yaw occurred again. The flight crew broadcast a PAN (radio code indicating uncertainty or alert, not yet the level of a Mayday) and received a descent authorisation to FL380.
The upper rudder position indicator showed a rudder displacement of 5-degrees right and the lower rudder indicator showed zero degrees deflection. The flight crew began activating and de-activating the upper and lower yaw damper switches attempting to isolate the problem. During those actions, the aircraft commenced to `Dutch roll' (lateral oscillations with both rolling and yawing components). The crew then successfully isolated the problem to the upper damper and turned the upper damper switch off. With the aircraft at FL380, normal operations ensued. Autopilot `B' was then engaged and the flight proceeded without further incident.
Investigation by company maintenance personnel confirmed an anomaly of the upper yaw damper computer. The unit was replaced and the system tested. Normal operations ensued.
Analysis of Flight Data Recorder information revealed that during the event the upper rudder displaced 4.7 degrees. The data also indicated that the maximum roll encountered was 13 degrees to the right.
System redundancy had operated as required to limit the effect of the upper yaw damper anomaly.

http://www.atsb.gov.au/aviation/occu...ail.cfm?ID=381

I believe the A300-600 has two yaw damper actuators and two yaw damper computers. My gut feeling is that if there was to be a software "bug" latently in the software of one system it would be very likely repeated in the other. For there then to be a conflict between the two, a significant trigger threshold (such as the wake turbulence upset) may be required to trigger any vehement algorithmic disagreement. The interesting comparison is that in the 747SP case above, the computer anomaly was able to act upon its own (upper) rudder (only) - whereas in the AA587 accident it may have been the case that a resonance (or electronic echo) was set up between the two computers (each acting through separate actuators - but upon the same rudder). In that scenario, both may have been accepting feedback from the other's reaction to the yaw induced by the wake turbulence encounter. That sort of thing in acoustics (and digital and analogue electronics) soon sets up a very annoying superheterodyne squeal. In a computer-controlled flight-control system the equivalent outcome may be capable of chaotically driving the rudder to its limits. It might explain A300 tail-wagging in toto.

We know that the A300-600's FCS is capable of very rapid sampling and reaction times (such that the cockpit display info is necessarily filtered, as are the DFDR data-feeds also -unfortunately). One notable aspect of a yaw damper system is that it is by design a very reactive system i.e. it pauses (before acting) for a finite period to sense what is happening (from yaw-rate gyros) so as to calculate its appropriate response. It may even reset and resample if it doesn't believe its first answer. Because Dutch Roll is normally an escalating phenomenon, the yaw damper software may be "trained" to reject and resample any sharp disturbance of a large initial amplitude and rate (such as wake). So let us suppose, in a very dynamic scenario, that this "sensing and resetting" of each computer is able to become ever so slightly out of synch - perhaps sufficiently that the two systems are actually reacting to each other's inputs. Therein would lie the seeds of mayhem and destruction. Computers in this type of arrangement are normally "tied" (and constrained to agree), but perhaps not to the same extent as autopilots in an autoland configuration.

It would also be interesting to learn whether each yaw damper computer gets individual feeds (if any) from the CADC. My theory all along has been that, once things get dynamic, you cannot trust pressure sensors within a highly responsive and reactive system.

Once again it's just a theory. But you will recall that a yaw-damper failed its BITE test on start-up for Flt AA587 and had to be reset. Whilst not uncommon, it might at least be indicative. The 747SP anomaly at least proves that two identical systems, even though tied together and fed the same info, can still slug it out like a couple of boxers (once provoked sufficiently).

arcniz

Regarding Appropriate technology:


Let's put this in perspective:


Sad but true, ALL systems have their inadequacies. Each and every one is cobbled together by fallible people, based on the biases and perceptions of the time, using the materials at hand at that moment, to solve a problem which is inevitably, to some degree, imperfectly understood and improperly specified.


When machines cross beyond a certain threshold of complexity, they are actually safer to build with electronics and 'software' in control than with long cables, vulnerable hydraulics or carefully hewn clockworks of steel or spruce. Manual controls are more appropriate for gliders and sailboats than for turbine passenger transport aircraft and nuclear submarines. Of course, there's likely always something mechanical at the ends of the process.

I, too, have worked in software development and testing since the 1960's as well as in electronics, computer architecture & design, and systems analysis - not a small amount of it for things like chemical refineries, vehicle and machine controls, avionics, weapons systems, very large-scale transactions systems such as used by the banking industry, telecommunications, health care, and other environments that place a high value on near-perfect operation, orderly degradation in the event of failures, and redundancy / maintainability such that they may never fail and never need to be switched off for scheduled maintenance.

By 1970, already, the state of the art of reliability and verifiability for critical process software-driven control systems was well along. The hundred-millionfold improvement since then in raw price/performance of computing and control system pieces has helped move machine reliability along much further.

The proof that these systems exist and operate is all around you - in a rather undramatic form. It is most manifest in the industrial accidents that don't happen, the odd little deviations that don't appear in your bank account, and the unintended mushroom clouds you don't see depicted on the evening news.

There is a BIG difference beteen software (and hardware) carefully developed for critical applications and those provided on a fairly casual basis by companies, such as Microsoft, which depend on inherent product bugs to motivate frequent purchases of hastily developed 'new and improved' products with new and improved bugs.


So: Please do not frighten people unduly with global condemnation of these very useful technologies, but instead try to cite more specific relevant examples (many can be found) that are specifically worthy of criticism and improvement.

-----------


BELGIQUE - your focus on rudder specifics is very illuminating. A good job of reporting!

This information deserves much consideration. We can hope someone who knows the design specifics will share some details. I will react to a couple of points immediately:

I agree with your inference that the two yaw-damper computers SHOULD have been identical in design. Whether that actually is the case - at the circuit level - would require some heavy duty testing. One hopes the parties involved will take a forensic approach toward a determination.

The yaw-damper computers could have been physically identical but with different STORED states determining behavior - such as calibration, configuration updates, or just recent history that would be weighted in. Like ice, these states might not be preserved for later analysis. Any difference in history - which is inevitable if each is using a different collection of sensors - would cause them to operate somewhat out of phase - most of the time.

Even a single yaw-damper control could oscillate - by itself- if the s1- sensor reported aerodynamic response of the aircraft differed significantly from expected value for the s2-sensor reported angle of rudder deflection, based on the computed command signal applied to the actuator. This would produce the case where yd1 system was oscillating and the yd2 system, mechanically coupled to yd1 via the yd2s2 deflection angle sensor -whose response is delayed by the slew rate of the yd1 actuator and rudder mass - would be counter-oscillating in the effort to correct it.

Depending how implemented, I doubt that the yaw damper system 'pauses' before acting. More likely it determines a rate of control actuation which will - based on current input - lead to the desired result at some point in time future, and repeats this analysis continuously. By doing so, it never causes the full action based on a single moment in time, but accomplishes this
by the cumulative effect. This plan tends to reduce oscillation. Two controls with similar future-oriented agendas could certainly oscillate against each other if one was slow or misinformed or if both were receiving rapidly varying information which they processed in slightly differing phase.

Surely the original designers thought a lot about the possibilites for oscillation here, so it would be interesting to see what could have slipped through the cracks. My guess would be a 'minor' redesign of some critical component - actuator - angle sensor - rudder - yaw sensor - computers - calibration procedure - data path, etc. after the the original design was completed and released.

Pehr Hallberg

Exactly Belgique.

About computer redundancy and the security of having two computers "agree" on something.

A computer doing some useful job is obviously some hardware with some specialized software together performing the job. I have seen in the Telecom industry for instance several examples where the redundancy is on the hardware side but where you run the same software in both sets of hardware. This protects against hardware faliure but if the software fails both computers fail in the same way.

Now then where is your redundancy?

PickyPerkins

--------- Start of quotes ----------
Wsherif1, posted 28th July 2002 :... The 200+ mph force of the rotating vortices striking the FIN, (vertical stabilizer and the rudder), BROADSIDE resulted in an INSTANTANEOUS left YAW! …….

Wsherif1, posted 2nd August 2002 NTSB and Rudders: The F Meter When the vertical stabilizer and the rudder were struck broadside by the forces of the 747's clockwise rotating vortices the resulting instantaneous yaw maneuver was initiated before the pilot had a chance to react to what would have been erroneous flight instrument indications anyway. The pilots were just along for the ride!

Wsherif1, posted 4th August 2002 …. Dr. AA Wray of NASA affirms that in smooth air aircraft wake turbulence can persist for extended periods of time. I had a severe wake turbulence encounter 45 miles behind another 707, in smooth air! …
--------- End quotes ----------
I have been thinking on and off over the past month about the above posts and the various responses from Wino, Stator Vane, and Belgique, and finally got around to wondering what would happen with a much LOWER vortex X-wind than 200 mph, like maybe 100 kts.

I should start by saying that I am NOT a commercial pilot, and have NO training or qualifications in aerodynamics or aircraft structures, and that this post is really an attempt to encourage people who really know their stuff into following a train of thought and providing guidance to the rest of us.

The train of thought goes as follows: AW&ST published a diagram (on p. 25, AW&ST for Jan 21, 2002) showing the results of their calculations of how the side forces on the fin/rudder of an A300-600 varies with sideslip angle at 250 kts. One of the three curves in that diagram was for a centered rudder. It showed that the fin/rudder design strength limit is reached at a sideslip angle of 10 degrees, and that the design ultimate limit is reached with a sideslip angle of 15 degrees. I have plotted these results in a different form in Fig. 1 below.

Since the a/c cannot be held in a sideslip on a fixed heading with the rudder centered, AW&ST assumed that the sideslip was established using the rudder and other controls, and then the rudder was suddenly centered. At a maximum of 39 degrees/sec, this might be done on an A300 rudder in less than half a second.

Now suppose instead of sideslipping, you fly along normally on a fixed heading and with the rudder centered, and then you suddenly meet a wake vortex which effectively provides a X-wind. To the a/c this feels like it was initially flying along normally and then suddenly it is flying at a yaw angle due to the vortex X-wind, as shown on the right in Fig. 2. The relative wind comes at an angle to the nose and is the vector sum of the speed of the plane, S, and the speed of the vortex X-wind, X. In both Figs. 1 and 2, S=250 kts. The calculated stresses on the a/c for a given sideslip angle are as shown in Fig.1. While a sideslip is not the same as a yaw, and neither can be held at a constant heading with the rudder centered, I am going to assume for the purposes of this discussion that that the forces on the fin are roughly equivalent for similar sideslip/yaw angles. If this is accepted, then Fig. 1 can be re-drawn in terms of “Angle of Relative Wind Off the Nose” and “X-wind” as shown in Fig. 2.

Fig.2 indicates that the fin/rudder design strength limit is reached at a sudden X-wind speed of about 44 kts, and the design ultimate limit is reached at a sudden X-wind speed of about 66 kts. A lot less than 200 mph.

A possibly interesting aspect of all this is that a vortex X-wind speed of 200 mph MIGHT be LESS stressful because relative wind would then be at an angle of 35 degrees, at which angle-of-attack the coefficient of lift might be much lower than at 10-15 degrees, and consequently the force might be LOWER than at a LOWER X-wind speed.

Now what happens if the a/c is flying along normally (fixed heading, rudder centered, and no yaw) and then it suddenly meets a wake vortex X-wind speed of, say, 60 kts (i.e. where the stresses on the a/c are more than design but less than ultimate), and the pilot has NO TIME TO REACT? The a/c is aerodynamically in a yaw, but the autopilot and yaw dampers, being gyro-based, think the a/c is flying straight and level, so they initially do nothing, and the rudder initially remains centered. One of the quotes above says that the X-wind will start a yaw and roll by direct action on the fin/rudder, which I assume the autopilot and yaw-damper will then try to counter. The numbers in the AW&ST diagram referred to above for cases where the rudder is not centered (not shown in Figs. 1 or 2) suggest that if the angle the rudder then turns through is equal to or less than the angle that the plane turns through (as might be expected of a gyro-based correction system), then the net result will be a DECREASE in the stress on the fin/rudder. So the autopilot/yaw damper response should NOT be an additional hazard.

To summarize this (possibly erroneous) train of thought:

(a) It looks from the AW&ST calculations that a wake vortex X-wind of about 66 kts would stress the fin/rudder to its design ultimate stress (at which level the fin/rudder might deform permanently, but it should NOT immediately detach). The AW&ST article says that the FAA requires that the aircraft must be able to withstand the ultimate limit stress for three seconds, permanent distortion being allowed. However, I assume that a X-wind of 100 kts. might result in a different outcome.

(b) The responses of the auto-pilot yaw-damper combination at X-wind speeds of 66 kts. or less are likely to immediately lower the stresses on the fin/rudder.

(c) I cannot even guess what a 200 mph X-wind would do, because that corresponds to a 35 degree yaw, at which angle of attack the fin/rudder coefficient of lift might be lower than at 10-15 degrees, and the forces might therefore be LOWER than at a LOWER X-wind velocity. And, of course, the vortex wind might not be a direct X-wind, but come at an angle other than 90 degrees.

To repeat my initial note, I am NOT a commercial pilot, and have NO training or qualifications in aerodynamics or aircraft structures. This post is an invitation to people who really know their stuff to follow a train of thought and respond with correction, amplification, confirmation, or whatever they may feel is appropriate.

Meanwhile, I think I will temporarily retire into my underground bunker ………..

Belgique

Picky

Sort of "responded to" here - rather than answered.

Bit lengthy as a Pprune thread (and don't want to upset the moderators) - so it's elsewhere.

Belgique

cwatters

What diameter are these rotating vorticies? Is it possible that the top of the fin can be pushed one way and the bottom of the fin the other? Does this double the forces or have I missed something?

Belgique

cwatters
Not dissimilar to the way in which a thermal will boost one wing and give you the "net" effect of an unwanted roll. If you've ever watched a dust-devil accelerate away from the ground and broaden out as it gains height and entrains surrounding air, well just imagine the wake vortex to be a horizontal thermal that is similarly expanding as it drops astern. The essential difference is that the thermal is accelerating and the wake vortex decelerating. When you hit a wake there will be a net effect upon your airplane ... BUT it is also true that part of your airplane might take a fairly direct hit from that rotating helix. That didn't seem to matter in an all-metal airplane. When it's a large vertical surface that's not really designed to take large thwartships airloads (because it's made of composite material) - well that's apparently not immaterial.

My theory (at that url above) is that if you take that hit and it causes an FCS overreaction (per the reasons and sample incidents given), then the combined effect of rudder response and an ill-timed second wake encounter (from the other wingtip's trailing vortice) may be a sufficient overload for failure.

arcniz

Pehr Hallberg says:I disagree. A couple of points here:

a) To achieve any tough degree of reliability and fail-soft capability with computer controls, one needs to work them in groups of three. With only two, any discrepancy leads to an argument and possible deadlock; with three, they can take a vote, cut out the oddfellow, and ring some bells to escalate alarm about the new condition of degraded redundancy. If three is good, 'many' sometimes can be better.

b) Much can be done - in design - to prevent the problem you point to - where 'everybody is wrong'. Sometimes the best answer is to 'fail' the system momentarily and recycle it to a new self-aware configuration. Also helpful is judicious allocation of 'gold bars' allocating authority.

c) As we all know, a lot of things can go wrong in hardware and software. Reliability in both is most commonly accomplished by detection of abnormal performance and subsequent reconfiguration to a (usually) more conservative operating strategy. This works just as well with 'software' as 'hardware', yet it tends more often to be omitted or done lightly in software because the threshold cost for s/w changes is putatively lower.

You seem to feel that hardware fault detection is much more reliable than software fault detection, but I disagree. If similar design methods are used for software fault detection and reconfiguration, the results can be comparable to those of the best hardware, i.e., nearly perfect.

We have all seen computers fail to perform correctly, but anecdotal evidence is not the same as truth.

If the intent is to have ultrareliable systems and then they are observed to fail, one must say that they have not been designed / tested with sufficient care. This is the binary equivalent of 'pilot error'.

Your telcom anecdote highlights a common failure in 'duty of care'.
Just as it would be irresponsible for an airline to put an unqualified and untested pilot in charge of a passenger transport, it is a management mistake to deploy inadequately designed and / or inappropriate technology in any critical application.

The only way to achieve true reliability is .....Very Carefully.

PickyPerkins

Wake turbulence rotators seem to be big - like a wing-span.

FDXmech

As I work on the A300-600 on a daily basis, I'm very interested in this topic.

I was always aware of the design philosophy between the Boeing ratio changer method of rudder travel limiting versus Airbus's rudder pedal limiting philosophy. Yet, until Wino brought to my attention the potential (and with AA587, possibly all too real) ramifications of limiting pedal movement, I assumed the difference to be "six on one hand, half dozen the other".

Yet the more I learned of this pedal limiting design, with its inherant progressive decrease in pedal force coupled with a very short pedal travel as IAS rises, I can only ask why was such a system devised and more importantly, approved? What benefit does this design bring?

I wanted to see for myself the overall effect of this system. This being possible by putting a single air data computer in the self test mode, (via the maintenance test panel behind the F/O's seat) thereby increasing various air data driven parameters.

I gently cycled the rudder pedals and to my surprise, the resistance to movement felt almost nonexistant, especially noticeable with the short throw. IMO, any assertion that a pilot would need to be heavy footed to swing the rudder is a bit overstated.

Belgique: Do you have any opinion on this system?

Lu Zuckerman

To: arcniz

I am enclosing the following in order to shed some light on how Airbus and their vendors do business. I will state that the information following deals with theA-310 and the A-320 but since the major players are basically the same the A-300 can be tarred with the same brush.

I worked as the senior Reliability and Maintainability engineer on the A-310. I worked on a consulting contract at Liebherr Aerotechnik in Lindenberg, Germany. Liebherr was the senior contractor in the design of the secondary flight control system power drives and actuators. They were also senior contractor in the design of the flap / slat computer which was designed and built by Marconi in the UK. The integrating contractor was MBB-Erno based in Bremen, Germany. The lead in the wing design was BAe in Hatfield in the UK. Our associate contractor in the design of the power drives and the actuators was Lucas Aerospace in Wolverhampton in the UK.

The story is about to unfold and it is broken into several sub stories.

1) During the tear down of a slat actuator that had been used in test and development I discovered a strange erosion pattern. I referred it to our stress engineer and he said it was stress corrosion. I placed the unit under high power magnification and the strange pattern turned out to be spark erosion. I could not get the stress engineer to agree. I talked to a senior design engineer and asked him to verify the continuity of the installed system on the iron bird. The check showed that the slat system was not grounded to the iron bird, which meant that when installed in the aircraft it would not be bonded to the airframe. I contacted my counterpart at Lucas and he found the same to be true for the flaps. I brought this problem to the attention of my department manager and he took it to the Vice President and the senior project engineer. To support my argument I had referenced an Airbus technical directive (TDD 20 A 001) which addressed Electrical Bonding, Lightning Strike Protection and Electrostatic Discharge. Their argument against my criticism of the design was two fold. They stated that the TDD was not fully approved and therefore did not apply to the A-310 design. Although Airbus directed in the design specification that any problems related to Reliability, Maintainability and Safety had to be brought to their attention it was Liebherrs’ position that if they brought it to the attention of Airbus they would have to absorb the cost of the design modification. They suggested that I talk to MBB-Erno, which I did. Much to my surprise they took the Liebherr position of not telling Airbus as a means of avoiding the redesign costs. I then took the problem to Bae and they told me that they were in sympathy with my problem but they could do nothing about it. This is the company that designed the wing and was responsible for flight safety and ultimate certification.

According to the Airbus TDD the two most frequent points of lightning attachment are the nose which has strike diverters and a partially extended slat. Should lightning hit the extended slat it would arc to the outboard slat actuator and into the wing structure. The way the A-310 wing is constructed the slat actuator jack screw is retracted into the wing and it is separated by a thin Titanium wall. On the other side of the Titanium wall is the outboard fuel tank, which will most likely explode when the arc occurs.

The clincher to this problem is that the TDD was eventually approved and the problem of non- electrical bonding would or, should have been detected during final inspection of the aircraft prior to flight-testing. The non-bonding of the flaps is another story. According to Lucas calculations the flaps would build up a static charge of 800-1400 volts and as the flaps retracted the voltage would arc to the wing skin or the rear of the rear spar.

2) Airbus and JAR / FAA requirements dictate that an uncommanded operation of the flaps or slats should occur no more frequently than 1 10 9 or one time in a billion hours for the fleet. In performing the Failure modes Effects Analysis (FMEA) for the Flap and Slat Power Control Units (PCU) it was determined that if an internal leak that bypassed the control solenoids on the PCUs it could cause an uncommanded operation of the flaps or the slats depending on which PCU developed the crack. The problem was that a similar crack could also occur that would cause faulty operation of the PCU or it could result in a loss of a single hydraulic system. The predicted occurrence of this type of crack is .1 10 6 or, one time in 10 million hours of fleet operation. We were forced to show that the crack occurrence was 1 10 9 and not .1 10 6 which is the difference between 10,000,000 hours and 1,000,000,000 hours which was not realistic. We ended up doing it over my objections in order to show we met the safety requirements dictated by the certification authorities.

During the life cycle testing of the slat system Liebherr encountered a runaway slat system and the flap slat computer was not only unable to detect it was unable to stop it. This would be a minor problem on the slat system regarding uncommanded extension, as the air loads at cruise would keep them retracted. However if it occurred on the slat system causing an uncommanded retraction during takeoff it could cause major or catastrophic problems. The same is true if it happened on the flap system. Again Liebherr was required to notify Airbus about the runaway as well as the computer being oblivious to the problem. They didn’t notify Airbus. Instead, they contacted Lufthansa and Swiss Air, which had 17 Airbus A-310s in service. Liebherr made a quick fix and told the operators to notify them when they had an aircraft on ground over night and Liebherr would install a “more reliable” designed PCU at no cost. When Liebherr encountered the problem the accelerated test had about 1800 hours of operation and the operating aircraft were fast approaching that number.

3) The flap slat computer was designed and built by Marconi. I had several encounters with Marconi on other programs and I found them extremely difficult to deal with. The same was true for the A-310 program. Per Airbus program requirements I directed Marconi to analyze the failure of every piece part in the computer and indicate how the failure manifested itself when the part failed. Marconi replied that it would be too expensive to do that so instead they just indicated the failure rate of each part and combined it in order to show the total failure rate for the computer. This proved to be totally insufficient to meet the Airbus requirements, as it did not reflect a true FMEA.

Marconi had a running battle with Lucas Aerospace accusing them of robbing trade secrets and stealing their top designers. Lucas like Liebherr constructed an iron bird to test and develop the flap drive system. Marconi provided Liebherr a complete brass board of the computer that had the total capability to control the slat system and diagnose any system problems. Despite this requirement the computer was unable to respond to the runaway slat system on the Liebherr iron bird. Instead of providing Lucas with a similar brassboard computer they provide one lane of the computer or 1/4th of the computer. This allowed the extension and retraction of the flap system without having any diagnostic capability. Without this diagnostic capability Lucas could not adequately test the system and therefore, they could not certify the system. The system ultimately received certification although it was not properly tested.

On the first revenue flight for Lufthansa they flew from Frankfurt to Cairo. Upon landing the pilots could not retract the flaps. No one including the computer was able to diagnose the problem and the computer did not recognize that a problem had occurred. The aircraft was returned to Frankfurt in non-revenue service with the flaps fully extended. Upon its’ return the same situation existed. Nobody could figure out what was wrong. The flaps were mechanically disconnected and hand cranked in. The system was reconnected and everything worked OK.

Marconi also stated that on the A-320 when Lucas was going to be the lead design contractor Marconi would not work with them and most likely not bid on the contract. I do not know if they followed through with their threat.

4) I concluded that I had done everything possible to bring the problems to the attention of everyone in the chain of command with the exception of Airbus and to do so would place my position in jeopardy. After leaving that consulting position I went to another in Italy on helicopters. While on that assignment I discovered that the A-310 had been certificated in the USA. I sent a letter to the FAA explaining everything. Two months later I received a letter thanking me and telling me that they would bring the problem to the attention of the DGCA. Four months later I received a letter from the FAA stating that the DGCA had indicated that the problems were corrected. I contacted a friend still at Liebherr and he said that nothing had changed. I sent a more forceful letter to the FAA stating that I had absolved myself of any responsibility and if something happened they could be brought into any litigation resulting from a crash. They eventually took action and the Vice President and the senior program manager were fired but nothing was done to correct the design. All of the problems I described above are waiting in the wings (pun intended) and will manifest themselves sometime in the future. It should be noted that an A-320 from Air Canada suffered an uncommanded retraction of the flaps during takeoff and the computer could not stop it.

4) On December 17, 1997 Airbus Industrie issued Airworthiness Directive 90-092-109(B)R3 which dealt with the inspection of the Vespel Bushes in the Flap / Slat Transmission-Universal Joint Assemblies. One of the checks was to determine if there was electrical continuity in the bushes they were to be replaced if continuity was discovered. When the system was designed the bushes which were called Rose Bushes were impregnated with carbon to make them electrically conductive. I do not believe the design was changed to remove the Rose Bushes. What I do believe is that the English translation got it wrong. I contacted the DGCA, the FAA and the Canadian MOT and never got any feedback on the possibility of a mis-translation. I contacted both the FAA and the Canadian MOT telling them that their respective versions of the Airbus AD were not in agreement and that their respective translations from the French original might be wrong. I also contacted the DGCA telling them that there was a possibility that the two translations were not correct. I never heard from any of them regarding this potential conflict.



To: arcniz

I had to delete this part of my post above in order to comply with the maximum character requirements for posts.

I have been banned from Rotorheads for speaking the truth, which was interpreted as libel by the moderators. The following is 100% true and I can back everything up as being true. You speak of reliability as if it were some means of assuring that airplanes are safe. The following will show you how reliability really works in the aircraft industry. I was going to disguise the names of the participants but since my statements are already entered into the files of the FAA, the DGCA and the LBA and the RAI I’ll let it stand. I'll wait to see if the moderators agree.

Wino

FDXmech

While some other older aircraft use the blocker system (notably the md80 and the 727) they are used in conjuction with reducing the hydraulic pressure from 3000 psi to 800 psi. Thereby limiting your ability to do damage, and making the sensitivity somewhat constant.

The A300-605R A320 A330 and A340 all use a blocker system and maintain 3000 psi at all times. Indeed the A300 tail is not mass balanced and is prevented from fluttering by constant hydraulic pressure of 3000 psi.

If the pilot flying stepped lightly on one rudder to assist in roll he would have gone to the floor at 250 knots and not known how he got there. If he tried to correct he would have almost instantly hit the other stop. I doubt he would have reversed again, but then the other pilot might have tried to put in a rudder input. very quickly you get 4 throws of the rudder right there.

The A300-605R rudder system is DANGEROUS at 250 knots. The tail is incapable of withstanding the stress, and the controlls are trap for a POI. The A300 B4 with its ratio rudder load limiter was a much better design.

The blocker system is much simpler to implement than a complicated ratio changer system. However without the additional safety of depowering the rudder it is a menace. The composite design of the rudder and verticle stab do not allow the rudder to be depowered as the hydraulics are used to balance the rudder. So Airbus cut a corner and 265 people are dead. I expect that out of this accident there will be a short term fix of limiting the throw of the rudder further (probably forcing an engine derate as a result) and a long term fix of requiring rudder load limiters to be of the ratio type or if a blocker is used it is used in conjunction with depowering the rudder.

Cheers
Wino