The Last Effort
Gentlemen,
after this one, I will take an extended leave from pprune. The hairy troll gets hungry and will go out to pick mushrooms. I have worked way too hard on this, and my life (yes I do have one) is calling me.
For those who are ready to read and try to understand with an open mind, please bear with me.
I have come to study very carefully the flight control system mounted on this type of aircraft. Whatever modest findings I came up with do not exclude any other factor added to the accident sequence. Yes, I may even be wrong ! At this stage, however, findings provide material for crucial questions.
What prompts me to question the Flight Controls System in this instance has two aspects :
- a philosophical aspect, as I explained in earlier posts : since the system is built in such a way as to claim final authority (under certain circumstances) over the aircraft control surfaces, it should be questioned first, regardless of pilot actions, and regardless of which law it is supposed to have been working in, or what the aircraft FBW system advertised capabilities are. Its central position in the design and its criticality in a Loss Of Control accident should make it the subject of extremely careful scrutiny as a matter of principle.
- a technical aspect, the core substance of which I will now address.
As an introduction, it must be stressed that "protections" are provided in many forms for this aircraft, and the really assertive forms of protection do not come from the autopilot but directly from the main Flight Control Computers, the PRIMs, even in manual flight, and even in alternate 2 law, albeit in a less severe version. Only Direct law and worse remove all protection.
Three out of five components of the Flight Controls System have suffered anomalies :
- PRIM2 suffered a connectivity problem with ADR1, such problem is deemed HARD, which means permanent, not transient.
- PRIM1 stopped operating.
- SEC1 stopped operating.
These anomalies have consequences which can be verified using the Flight Controls Reconfiguration Schematics from FCOM chapter 27 :
- PRIM2 is tasked with THS motor because PRIM1 quit.
- PRIM2 is tasked with both elevator halves because both PRIM1 & SEC1 quit.
Additionally, PRIM2 operation is polluted because it lost connectivity with ADR1, thus reducing its discriminating capability while simultaneously getting fed multiple erroneous ADR data.
This simultaneous double failure condition : connectivity + erroneous data, is an extremely serious issue. I very much doubt that such apparently unrelated, simultaneous, totally different failures (external cause -> icing + internal cause -> wiring) were ever considered together during the design phase of the Flight Control System.
This extraordinary combination precisely affected the one computer which ended up being tasked with :
- interpreting sidestick commands on the pitch axis.
- sending orders to the hydraulic servo jacks located on the elevator moving parts.
- sending orders to the electric THS motor.
- providing whatever "protection" it deemed necessary to provide while in its undefined state (unreliable ADR data + lost connectivity with one ADR)
The lethal question exists in either of these modes :
- the researcher will ask : what is the exact state of PRIM2 throughout the whole event and what is its exact role in its unfolding ?
- the pilot will ask : what the heck is happening ?
It took me two years to simply get an adequate understanding of the core issues. They had two minutes before it was doomed.
Rest In Peace.
Svarin
PS : Post Scriptum / Pure Speculation
PURE SPECULATION BEGINS
"Je ne comprends rien."
Total confusion. Unimaginable betrayal. Such as Flight Controls twisting on you.
I have been asked to describe the protections I thought interfered with the pilot's actions. Contrary to all that I have posted before, what follows is pure speculation. The relationship with any real accident would be coincidental. This does not mention any aircraft-specific data. We, I do not know what happened yet. This is provided only as a thought-provoking element, which, although speculative, is not contrary to such kind of system's description under the condition of erroneous data being fed to a computer which did not correctly assess its degraded state. In other words, an example of a Byzantine fault made manifest :
-imagine two concurrent protections triggering alternatively upon erroneous indications. Imagine the Flight Controls System erroneously believing itself deep into coffin corner, overspeed and low stall at the same time.
-Stall protection has first priority and pushes the nose down without the pilot knowing why, and when the pilot pushes the control down, stall protection deactivates (the pilot did the right thing).
-Then overspeed protection undesiredly kicks in (second on protection priority list) which pulls the nose up, again without the pilot knowing why.
-The time lag between the two is such that, as the pilot pushes and waits for a result, the protections switch to overspeed and the aircraft noses up, and as the pilot pulls up, the protections again switch to anti-stall and the aircraft noses down until stall protection deactivates.
-And the cycle continues. One way to try and break it is to deliberately apply one clear, full deflection control command for a significant amount of time, and see what happens.
-Both protections acting undesiredly in this kind of deadly ballet would maintain AoA more or less near its maximum until real stall occurs from total energy depletion. Deep stall follows.
Too complex, eh ? No way this can be true, of course. But it sure makes one think twice about "protections", especially multiple, contradictory ones.
PURE SPECULATION ENDS
PPS :
Can any protection backfire on you ?
Mother said you would be safe from harm
A child can dream of becoming a pilot
But a pilot is not a child anymore