Originally Posted by Capn Bloggs
So Wiki was right.
On the 777 in the normal Primary Flight Computers (PFC) mode (AUTO) the control column inputs are process by the Actuator Control Electronics (ACE), sends them to the PFC via the ARINC 629 data busses, the PFC gets inputs from other inputs like the ARIDU via the ARINC 629 data busses as well. When the PFC are in the AUTO position, the PFC supply the actuator position commands to the ACE, which in turn converts them into an analog servo command moving the control surfaces.
The PFC in pitch mode is a manoeuvre demand control law, at low speed pitch rate is the controlling factor, when the aircraft was in the low speed regime as the pilots push or pull of the control column, the PFC then converts that into a desired change of pitch rate of the aircraft, and then generates the desired flight control commands to acheive that pitch rate. As the PFC thought it went into the high speed regime, as the pilot moved the control column was interoperated by the PFC to change the given load factor, the PFC then converts that into a desired change of load factor of the aircraft, and then generates the desired flight control commands to acheive that load factor. This is why the pilot somewhat over controlled the recovery.
The manoeuvre demand control law on the 777 places significant reliance of the accelerometer values supplied by the ADIRU, as it is so significant, a secondary source the Secondary Attitude Air Data Reference Unit (SAARU) is also used by the PFC to try and eliminate any possible input errors. The commanded flight control outputs on 9M-MRG would have been a lot worse if the PFC did not compare mean values of the ADIRUs and the SAARU.
During manual flight the aircraft continued to pitch up and enter the low speed protection (while the pilot was commanding nose down via the control column), stick shaker activated, overspeed protection was also activated. This was due to due to accelerometer #5 providing false information to the PFC.
Basically all of the "misbehaviour" happened AFTER the A/P was disconnected at the 46 sec point in the animation. The accelerometer that failed at the time of the event (#6) actually got voted out at the time of the event, but a long time faulty accelerometer (#5) was voted in.
The ATSB included on the last page of their report a copy of the screen capture, in that you can clearly see the A/P disconnected, throttle commanded via the T/L to zero, commanded nose down pitch on the control column, and the aircraft continuing to pitch up. This is due to the PFC combining the various inputs to what it sees as being the desired output.
The pilot pressed the throttle lever A/T disconnect switches continuously for a period of approximately 90 seconds, during that time the A/T was not engaged in any mode, with the release of the A/T disconnect switches the low speed protection placed the A/T engaged the A/T speed mode.
On the 777 the ADIRU accelerometer values are processed by the Fault Containment Area (FCA)/Fault Containment Module (FCM) and sent to the to the PFC over the ARINC 629 data busses which produces navigation and flight control output in both manual and automatic flight to the FCS. Disconnecting the A/P does not remove the accelerometer inputs to the FCA/FCM, nor from the PFC. Acceleration values are needed by the PFC in all flight regimes, autopilot engaged or not.
The ATSB coved this on page 9 of their report “Even though the second fault resulted in proper annunciation of a status message, the ADIRU flight control FDI algorithm which excluded accelerometer number -6 from the flight control outputs at the moment it failed, erroneously allowed accelerometer number -5 back into the computation of the flight control outputs.”
To remove all influence of faulty acceleration values on the FCS would require the pilots to move the PFC switch on the overhead panel to the DISC position, that is the only way to remove the PFC from the FCS and put the FCS into direct mode. In direct mode, the ACEs do not process commands from the PFCs. Instead, each ACE decodes pilot commands directly from the transducers on the cockpit controls and uses them for the closed loop servo control of the actuators (direct law). This mode will automatically be entered due to total failure of all three PFCs, failures internal to the ACEs, loss of the flight controls ARINC 629 data busses, or some combination of these failures. It may also be selected manually via the PFC DISC switch on the overhead panel.
That was not done by the crew, nor did the ATSB consider it.
The main reason for the different outcomes from the two events was that 9M-MRG only occurred 18 minutes after departure. It actually experienced much higher accelerations, rates of climb/descent, and pitch range over the A330 event. If this happened several hours into the flight after a meal service with many people waiting to use the toilet, I think the outcome would have been very different.
Originally Posted by CONF iture
The 777 upset was AP and AT induced.
No, it was caused by erroneous acceleration values, it was not induced by the A/T or A/P.
The ADIRUs were pulled from the aircraft, and tested by the manufacturer, it was determined that the ADIRU’s accelerometer #6 failed at the time of the occurrence, and that accelerometer #5 failed in June 2001 (4 years earlier).
Originally Posted by CONF iture
The 330 was nicely manually flown when the protections did the mess.
The AoA sees the relative airflow direction at the position of the vane, it changes with attitude, airspeed, configuration, sideslip etc.
It is apparent from the FDR data plots that a pilot did contribute pitch commands to the FCS at the time of the two events. The ATSB has not stated that pilot inputs did or did not influence the outcome.
The ATSB have not published their investigation findings which one would hope would make this consideration. Nor has the ATSB considered the other crew actions that were and were not completed.
It is also apparent that over 30 AoA spikes were recorded in the FDR (which was limited by the sampling rate), however 3 nose down pitch events were seen. If it was as simple as you were suggesting that it was the protections kicked in, one would assume that a correlation would then exist between all the AoA spikes and the pitch events.
The ADIRUs were pulled from the aircraft, and tested by the manufacturer under ATSB supervision, no fault was found with them, this is very different to 9M-MRG where component faults (accelerometer) were found.
That is why the ATSB has stated it is looking into the possibility of cosmic radiation as being the possible cause, it might conceivably cause a problem inside the volatile memory in the ADIRU, or even in the analogue to digital converter for the AoA probe.
A fault message in modern avionics equipment does not necessarily mean an internal problem within that unit, it can also point to a problem with an input used by that equipment failing to pass the continuous fault tolerant testing they perform. The ADIRUs not only monitor faults within the ADR and IR, they also monitor the performance of the probes/vanes and the probe heat computers.