Originally Posted by
silverstrata
Extracted from:- Mellor P.: "CAD: Computer-Aided Disaster'', High Integrity Systems Journal, Vol. 1, Iss. 2, 1994.
I'm very pleased that you quoted that particular paper. I'll leave the reasons for being glad for last, but first, let's address a few common-sense items.
Firstly, any half-decent lawyer will be selective about the information they present, particularly with regard to that showing their client in the best possible light. This is why the Continental legal system in the case of air accidents, and it's uneasy relationship between investigators and the judiciary, has always been problematic to deal with.
What Asseline and his lawyers present there is a falsely limited spread of possible explanations, so let's have a look at them. The first two are intriguing, in that they present a possible design fault - however they both hinge on the assumption that the aircraft entered landing mode. The third is more nebulous and assumes a major software failure.
The BEA went back to the FDR traces and found that in the aspect of a back-stick being applied and the elevators commanded down, Asseline was in fact telling the truth - but the FDR was not capable of tracking the mode the computer was in at the time, so Capt. Bechet (the investigator in charge) came up with a novel test. On the longest runway available at the Toulouse testing centre he set up a flight path with obstacles as near to the conditions encountered at Habsheim as possible and flew the A320 over it at 30ft (naturally with plenty of remaining runway should the "landing mode" theory be correct!), and what he found was that by duplicating Asseline's inputs, nose down *was* commanded with backstick applied, but it did not enter landing mode.
What was triggered, however, was Alpha (Stall) Protection, and a fourth explanation that Asseline and his legal team either did not consider, or deliberately left out of contention as it would do his legal position no favours. So we have:
iv: By disconnecting/disabling autothrust (depending on who you believe), the manual thrust settings allowed the engines to spool down completely. The EFCS did not have control of the thrust at the time, so it was unable to command TOGA thrust as it would have done when engaged, but it was monitoring the thrust and airspeed - it knew it didn't have enough to climb. The only thing it could do to prevent the aircraft stalling was keep the AoA such that the aircraft continued flying, and as such all it could do was stop the nose from going up any further (hence commanding elevator down).
[EDIT - CONF iture, is this the mode that you say was "kept silent" until the NTSB Hudson report? And if so, are you saying that Capt. Bechet is lying about performing the test that proved it, that he left this information out of the report - but went on to mention it on a television series two decades later? I'm confused... ]
Had the aircraft done as Asseline commanded it would have stalled just before the trees, fallen from the sky out of control and the death toll would likely have been much higher. Had Asseline and his crew realised their predicament earlier and crammed on full power as they crossed the threshold, the EFCS would have detected enough thrust and airspeed to follow Asseline's nose-up command and allow the aircraft to climb out. Had the trees been just a few metres further from the end of the grass strip, the thrust would have been enough to climb out.
That's the technical aspect of the accident and I don't want to go further than that here, but expect a PM to come your way.
Now - the reason I'm glad you picked that article. It was published in 1994, but as I recall it was written a few years earlier (and had to go through a lengthy peer review process), along with a pretty pointed critique of the use of software in such safety-critical situations.
So, if Airbus were as dismissive and arrogant as their detractors suggest, you'd think they would have rebutted Prof. Mellor's paper and the software reliability critique and called his abilities and reputation into question.
What they actually did was invite him to Toulouse to look at their processes and to assist in identifying any problems based on his track record in the field of Software Reliability. Here's a brief summary of his visit (which happened in 1993):
Prof. Mellor's visit to Toulouse
While due to his nature as a human being and an academic, he never bought into it 100%, he was mollified to some degree and the tone of that report indicates that he was pleasantly surprised by what he found.
How do I know this? Because the late Professor Peter Mellor was my lecturer and professor in the Software Engineering and Software Reliability modules of my degree at City University, and I spent hours in the lecture halls with him (many of his lectures used the case of the Airbus FBW and the frankly incredible attempts to reduce errors and provide redundancy as examples) and doing his coursework. Over and above that though, I collared him a few times during his cigarette breaks (most frequently in the lee of the student union building), identified myself as a fellow aviation nerd and discussed this case to with him on more than a few occasions, and *that's* why I'm glad you chose that paper. Like I said, he remained to be convinced for the entire time I knew him, but his final position on the matter seemed to be that he was completely neutral on the matter of Asseline vs. BEA and Airbus.
As an aside, the relevant Mayday/Air Crash Investigation episode is kicking around on YouTube if you search for it, obviously it's not an exhaustive account and the dramatisation is a bit over-the-top, but both (the real) Capt. Asseline and Capt. Bechet have equal screen time and it also includes the last televised appearance of my old Prof., who sadly passed away sometime between his segments being filmed and the episode being aired. His phrase "The pilot flies the computer and the computer flies the 'plane" was the standard opening of every lecture where the subject was touched upon.