Qantas emergency landing [Archive] - Page 2

Semper Amictus

14th Oct 2008, 12:37

For what it's worth (I know, I know . . .)

Latest from the Sydney Morning Herald :

Computer sent Qantas jet into dive: investigators

A computer fault caused the autopilot system to be overridden, sending a Qantas plane into a mid-air plunge over Western Australia last week, authorities said tonight.

The air data computer - or inertial reference system - for the Airbus A330-300 sent erroneous information to the flight control computer causing the autopilot to disconnect, the Australian Transport Safety Bureau (ATSB) said.

More than 70 people on Qantas flight QF72 from Singapore to Perth were injured last Tuesday when the Airbus, carrying 303 passengers and 10 crew, suddenly dropped altitude.

People were hurled around the cabin and the pilot was forced to make an emergency landing in Western Australia's north.

Australian Transport Safety Bureau investigation director Julian Walsh said the faulty unit continued to feed "erroneous and spike values'' to its primary computers.

"This led to several consequences, including false stall and overspeed warnings,'' he said.

"About two minutes after the initial fault (the air data inertial reference system) generated very high and incorrect values for the aircraft's angle of attack.''

This led to the flight control computers commanding the aircraft to pitch down, Mr Walsh said.

"The crew's timely response led to the recovery of the aircraft's trajectory within seconds, and during the recovery, the maximum altitude lost was 650 feet.''

Mr Walsh said analysis of the digital flight recorder showed the faulty air data system continued to generate false information, leading to a second, less serious "nose down aircraft movement''.

The ATSB is expected to provide a preliminary factual report within three weeks.

There had been suggestions the incident may lead to the grounding of Airbus A330-300 models.

Mr Walsh today said that would be a matter for regulatory authorities.

"However, the information we have at hand indicates that this is a fairly unique event,'' he said.

"These aircraft have been operating over many hundreds of thousands of hours over many years, and this type of event has not been seen before.''

"It's probably unlikely there will be a recurrence, but obviously we won't dismiss that, and it's important that we investigate to find out what led to the (fault) and reduce the chance of that happening in the future.''

Mr Walsh said Airbus had provided advice to airlines operating the A330-300 that would minimise risk in the very unlikely event of a similar incident occurring again.

Agent12

14th Oct 2008, 13:01

The crew were on the radio to the engineers and were told to reset the flight computers after an initial elevator warning -they were all turned OFF !

It will be routinely covered over as with many things at qantas.

infrequentflyer789

14th Oct 2008, 13:46

yes its concerning even so given command/monitor systems involved and would have thought cross checking between adirus may have voted out the dud info.
I'm as surprised as anyone such an excursion can happen to the extent it did.

over to you mr airbus........

And Mr Boeing also - since it sounds awfully similar to 9M-MRG (200503722 (http://www.atsb.gov.au/publications/investigation_reports/2005/AAIR/aair200503722.aspx))

It will be interesting to see when the detailed reports come out if the ADIRU failure mode is established and if it is similar in any way. They are probably very similarly designed and might use identical third-party components.

From these two events it would seem that both aircraft are susceptible to ADIRU failure (and I suspect that may well extend to other Airbus and Boeing models).

It would appear that we can at least put to bed the usual FBW and "computer error" speculation - the flight computers had dud inputs from their instruments, and in that case you are always potentially going to get undefined behaviour.

If you trawl through accident reports for jet upsets following instrument failure you will find the same problem occurs with flesh and blood pilots. Even when the pilots have multiple redundant instruments (some of which are reading correct) they have sometimes ended up trusting the wrong ones (fatally).

CONF iture

14th Oct 2008, 14:03

If one read between the lines of the last MEDIA RELEASE 2008/43 14 October 2008

It could be possible that after an initial NAV IR 1 FAULT ECAM MSG
the crew did not select an alternate ATTITUDE source as reference, as requested by ECAM procedure ... ?

Therefore :
The faulty Air Data Inertial Reference Unit continued to feed erroneous and spike values for various aircraft parameters to the aircrafts Flight Control Primary Computers

A330AV8R

14th Oct 2008, 14:19

1 )sorry to burst everyones bubble but 1 faulty ADIRU doesn't do jack to the bus much less command a climb and descent ,

you get a master caution , single chime amber and it tells you to check your alt , hdg and att on the PFD , as if thats not enough most of the readings can be regained via the AIR DATA switch button .

2 ) THat OZ article said 1 ADIRU was faulty and that led to AP disconnect ??? what a Load of Bull !!! and EVEN if that were the case in point EVEN after disconnecting AP ??? so what ? she aint going to climb or plunge !

CONF iture

14th Oct 2008, 14:56

you get a master caution , single chime amber and it tells you to check your alt , hdg and att on the PFD , as if thats not enough most of the readings can be regained via the AIR DATA switch button
I'm afraid you're not correct here.
The answer to an Inertial Reference System fault is through the ATT HDG SWITCHING and if you don't proceed in time and accordingly that's where it's getting messy ...

Litebulbs

14th Oct 2008, 15:19

CONF,

Yep.

lomapaseo

14th Oct 2008, 16:04

The answer to an Inertial Reference System fault is through the ATT HDG SWITCHING and if you don't proceed in time and accordingly that's where it's getting messy ...

How much time do you have to confirm the necessary action and is it covered in training?

CONF iture

14th Oct 2008, 16:53

How much time do you have to confirm the necessary action and is it covered in training?
It is actually part of the training plan.
The thing is to take the time necessary to adequately read the ECAM MSG and the requested action to be able to manipulate the appropriate switch.

Better take 45 sec and do it well than 2 sec and hit the wrong switch.

But the best way to learn is still to do the mistake a few times in the simulator ...

lomapaseo

14th Oct 2008, 18:03

It is actually part of the training plan.
The thing is to take the time necessary to adequately read the ECAM MSG and the requested action to be able to manipulate the appropriate switch.

Better take 45 sec and do it well than 2 sec and hit the wrong switch.

But the best way to learn is still to do the mistake a few times in the simulator ...

OK, than why the necessity in this event to get ground engineers involved in this?

Swedish Steve

14th Oct 2008, 19:19

In the cruise one ADIRU is connected to one AP to fly the plane. If this ADIRU gives faulty information the AP will follow it until disconnected.

A year ago I was trying to troubleshoot an ADIRU problem on an A319. The crew had seen the problem and selected the AHSI to nbr 3, but had not connected the AP to nbr 3 ADIRU. I can't remember exactly what it was, but it took a lot of detective work to confirm what actually happened. The crew thought that they had selected AP to ADIRU 3, but had actually only selected the display, not the AP, so when the fault reoccured they assumed that two ADIRU were at fault.
In the end there was no ADIRU fault at all, the fault was in an ADM (air data module)

jhurditch

14th Oct 2008, 20:40

It was actually fed erronious data from the aircraft's first IRS unit. It then indicated a high angle of attrack (erroniously) and put the aircraft into a dive.

ChristiaanJ

14th Oct 2008, 20:55

Sure, my first reaction was:
How the f*ck was an ADIRU allowed to feed coherent spurious data to the rest of the system under ANY circumstances?
But then I had to admit it does seem to be just about the first time ever that this happened.
So add one more person to the list of those who will be following the ATSB reports with a lot of interest.

CJ

bsieker

14th Oct 2008, 21:38

The following protections appear to have been ineffective in this instance,

*Load factor limitation

The load factor limitation probably worked.

In clean configuration (which we assume in cruise) the aircraft can handle up to -1G. That'll pin you to the ceiling quite thoroughly if you're not strapped in. All within the designed load limits.

Even with slats extended, the negative limit is 0G, which will render everything weightless, and can cause considerable havoc.

*Pitch attitude correction
Didn't this work? PRIM was given (wrong) High AoA values, and lowered the nose accordingly.

*High speed protection
How is this relevant? I'm not aware that MMO was reached/exceeded ...

*Maneuver load alleviation(MLA)
MLA only becomes active when stick deflection is more than 8 degrees aft, and load is higher than 2G. Its purpose is to to alleviate structural load of the outer wing surfaces, while maintaining load factor. This is probably irrelevant here. The major upsets were downwards.

*Turbulence damping function
Turns out now there was no turbulence.

*System redundancy
This is interesting. As others have pointed out, there are 3 ADIRUs. Are there really no cross-checks to detect a failure in one?

Bernd

NigelOnDraft

14th Oct 2008, 22:11

I might suggest that many of the posts above whilst "technically correct" from an FCOM point of view, really have an incomplete idea of how an Airbus works.

I've a few thousand hrs driving them, and would never pretend to really understand what goes on under the hood :{ The interactions between systems are far more complex than our FCOMs lead us to believe, as numerous incidents have shown (some in our airline)... where investigations show FCOMs as incorrect, and even Airbus taking sometime to work out what/how happened (I have one Flight Control query in with them via my airline and am told we might hear their response early next year!).

This incident seems a very rare (isolated?) one, and suggest we leave the ATSB and Airbus to figure it out. Exactly where an ADIRU 1 feeds into the the FCCs, in various laws/modes, and with which switch selections will be interesting :ooh:

NoD

ampclamp

14th Oct 2008, 22:51

you are jumping to conclusions before the investigation has concluded.They are only saying what they do know.

What they are not saying is that the adiru fault was the one and only problem.It may have been the root cause but I am sure its not the only issue.
Very early days yet.

altonacrude

14th Oct 2008, 23:05

It's an eerie coincidence that the incident involving the MAS B777 and the QF A330 both occurred on the same route (although the aircraft were travelling in opposite directions to one another) and implicated ADIRU failures on both occasions.

The ATSB analysis of the B777 incident determined that:The incident was triggered by a second accelerometer failure in the
aircraft's air data inertial reference unit (ADIRU). This unit is designed
to be highly redundant and fault-tolerant but the first failed
accelerometer's failure mode was not one that had been anticipated during
unit design and development. (It had been assumed that a failure would
always result in zero voltage output, but this failed device was producing a
high output value.) The twin failures exposed a latent software fault, which
resulted in the unit feeding incorrect aircraft acceleration data to other
flight control systems.

Boeing B777-200 aircraft first entered service in 1995 and this is the first
reported instance of the particular software fault, which was apparently
present in the unit's original design, affecting operation of an aircraft.
The incident highlights the fact that software testing can never eliminate
all risk.
What exactly happened in the case of the A330 we will find out in due course. The high degree of redundancy built into aircraft electronic hardware and software creates complexity that may be beyond the capacity of its designers to fully comprehend. It can also harbour defects that, as in the case of the B777, take years to manifest themselves.

Canguro

14th Oct 2008, 23:24

Hot off the press...

http://www.casa.gov.au/airworth/airwd/ADfiles/over/a330/a330-084.pdf

"During evaluation of specific engine failure cases at take-off on Airbus flight Simulators, it has been evidenced that with FCPC1 inoperative, in the worst case, when FCPC2 and FCPC3 resets occur during rotation at take off, a transient loss of elevator control associated with a temporary incorrect flight control law reconfiguration could occur. It leads to a movement of the elevators to the zero position, which induces a pitch down movement instead of a pitch up movement needed to lift off. In addition, it leads to a limitation of the pilot authority in pitch axis and limits the capacity to counter the pitch down movement during this flight
phase, which constitutes an unsafe condition."

NSEU

14th Oct 2008, 23:36

one auto pilot engaged at altitude, all that triple redundancy is for approach and auto land.one a/p one adiru feeding it.

Interesting.... Boeing 747-400 autopilots use a single ADC as a source of (autopilot) data, but use all 3 IRU's as a source of information at almost all times (not just for landing). If all three IRU's are giving different data, then a "mid value" is chosen (not "average", as a wildly erroneous value would affect the data too much).

On an Airbus, even if one ADIRU is plugged into the A/P, wouldn't there be data sharing via databusses to that ADIRU? (if not for "ADC" data such as AOA, then, say, IRU data, such as attitude?)

I'm also wondering how aircraft computers process "spiking". Obviously the spiking on this particular aircraft was not large or rapid enough to be considered ridiculous and the value rejected.

Just curious.

Thanks.
NSEU

ampclamp

15th Oct 2008, 02:40

as I understand it nseu the bus uses similar philosophy for position at least.
as for air data/aoa, not certain, its been a while since I delved.
I am quite sure a fault in one should flag a failure in another if not by the box itself.
Flying along fat dumb and happy, a/p engaged (one) its onside adiru is the source.alternate adiru is selectable manually.IR or air data can be turned off also.

Even so,it just seems odd such a flt profile can be allowed given its in crz phase at speed regardless of the monitoring and available redundancies.
If there are not software changes to limit the authority of systems in such an event I'd be amazed not to mention more authoritative monitoring of aoa and air data to further limit flt ctl movement at speed.

my redundancy comment was meant as fully independent systems operating in parallel ie on coupled approach.

CONF iture

15th Oct 2008, 03:09

This is interesting. As others have pointed out, there are 3 ADIRUs. Are there really no cross-checks to detect a failure in one?
I'm also wondering how aircraft computers process "spiking". Obviously the spiking on this particular aircraft was not large or rapid enough to be considered ridiculous and the value rejected
The way it works, the system does not automatically discard a faulty unit but it identifies that faulty unit and advises the crew to first select a reliable source of information and then turn the faulty unit off.

As you know that’s the crew responsibility to perform the requested ECAM action(s)

According to the ATSB an Inertial Reference System 1 Fault ECAM Message has been triggered which would mean the crew has been advised but it is not clear if the requested ECAM action(s) were properly completed ?

In order to "minimize risk in the unlikely event of a similar occurrence" … an Operational Engineering Bulletin is on its way … Is it simply to emphasize the already published procedure or is it something new the QF72 crew could not have known before ?

Standing-by for the OEB …

fdr

15th Oct 2008, 04:03

Airfranz

An unforseen defect can have.... unforseen consequences. The FCOM deals with the forseen.

If an ADIRU system fault develops, then an erroneously detected alpha limit will not necesarily or indeed likely have normal manoeuvre limits imposed.

Await full technical report from ATSB with interest.

In meantime, consider giving the crew some credit, they are not paid as test pilots, now were the MAS crew.

FDR
Hot Springs

cockney steve

15th Oct 2008, 09:48

Slashdot | Computer Error Caused Qantas Jet Mishap (http://tech.slashdot.org/tech/08/10/15/0225254.shtml)

Sorry, folks, I don't know why it's apparently posted twice :\
It headlines today's Slashdot page and there are some interesting comments from the people who actually work at the coalface ,where these magic boxes are concerned...........

neville_nobody

15th Oct 2008, 11:50

In regard to my ealier question to VLF, the trasmission station at Exmouth puts out VLF at 1000 KiloWatts is the highest transmittor in the Southern Hemisphere with Aerials up to 1200' high.

Ironically the station is operated by Boeing and it is still functional :}

Can someone put some technical explanation on here how high powered VLF will not interfere with computers.

It looks like Malaysian had a similar incident in a 777 down near Geraldton which also happens to be next to a fairly serious restricted area.

ampclamp

15th Oct 2008, 12:40

I think I said it'd do jack to an aircraft without any tech reason my apologies, just opinion , however my opinion is based on the extraordinary wavelengths of the actual radio signal at vlf freq's.A full wave at 19.8 kilohertz is over 15,000 metres in length if my maths is correct.
Antennae will function at any length for receiving just the efficiency suffers (tx'ing is another issue) but a resonant antenna is best.1/4 wave is widely used and still works well.Even at 1/4 wavelength an antenna is nearly 4 kilometres in length.One can shorten an antenna hugely but I think you get the point I'm making.
I understand some video /pc monitors produce a lot of vlf "noise" so I would hazard a guess that the shielding and filtering to prevent or at least minimise the opportunity for stray RF to interfere with computer ops would be very low as its a known issue.I would say that filtering and shielding would be the best arguments against vlf interference as the source of trouble.
With powerful transmissions the front end of a radio or electronic equipment can be open to brute force but given my above theorising and the fact fbw aircraft have been flying around these for years without apparent problems leads me to that conclusion.But like I said elsewhere I've never seen an oxy cyl explode in situ let alone go thru the cabin floor and exit the hole in the floor and out of the aircraft either.

I'm a mug punter with quite a few years in the industry but not for one moment would I suggest am 100% correct or even 10% , just offering an opinion to a very good question.

bvcu

15th Oct 2008, 12:41

Neville , your theory in my opinion would only be valid in the event of no faults being found with the hardware. The MAS incident found a hard fault and resulted in ADIRU mods to eliminate the potential for this. I think these incidents highlight the fact that you cant test for every potential failure, especially in the FBW area. So you can potentially have something waiting for years before the right set of circumstances that no one thought of . Not just FBW but also electrical power , i.e 747-400 water leak and various relay failures on 737/320 over the last few years. Just hope we all learn from these incidents and it improves our system knowledge , so that the guys at the pointy end in the hot seat are able to deal with whatever happens when it doesnt conform to the book .

pappabagge

15th Oct 2008, 13:04

"then a "mid value" is chosen (not "average", as a wildly erroneous value would affect the data too much"

Well, if the stats have been properly configured the sampled range should be examined, remove the highest and the lowest values to remove extremes, and the total remainder divided by the remaining number of values... sounds a bit geeky, admittedly, but potentially significantly differences can be gained from "mean" values as opposed to more representative properly configured actual "averages".

All quiet on the eastern front.:\

sevenstrokeroll

15th Oct 2008, 13:31

EVERY time our industry changes technologies, we undergo a long period of teething...figuring out new problems that didn't show up before.

For example: High powered turboprop engines and a confluence of engine mount, and wing harmonic frequency and we get WHIRL MODE and the crash of L188 electras.

New structures, new demands and environment and BAM... metal fatigue in the comet.

So, now the computer runs the flight controls by wire. BAM, plane goes nuts.

Fly by wire...weight savings, computer precision.

WELL, I say, take the most reliable, bullet proof methods and stick with them.

Flight controls, by cable, with redundant pathways. Information from computers, but used by human pilots (who are well trained, rested and paid).

IF the Airbus 330 had conventional, cable based flight controls, a simple autopilot easily disengaged by the crew, and easily understood computer information indicating angle of attack AND WE WOULDN'T have had this post/thread at all.

CAN you imagine if this happened during air to air refueling? (proposed airbus330 tanker for USAF)

Litebulbs

15th Oct 2008, 13:49

Can you imagine what would have happened if ADIRU 1 had been identified and switched off when the problem manifested itself? Not a lot really.

If that action had been carried out, then no injury's. Why it was not carried out is up for investigation.

ZEEBEE

15th Oct 2008, 15:44

ArmClamp

I think I said it'd do jack to an aircraft without any tech reason my apologies, just opinion , however my opinion is based on the extraordinary wavelengths of the actual radio signal at vlf freq's.A full wave at 19.8 kilohertz is over 15,000 metres in length if my maths is correct.

Your maths are pretty much on the mark, but there are a couple of other factors that are more relevant.

Firstly, because the VLF stations transmit intelligence they emit sidebands and the resultant harmonics at the power levels we're talking about can still be quite significant.

Secondly, though the electronics are often well shielded along with L/C filters in all the power supplies etc, it is still possible that the enormous power from the VLF transmitters *can* modulate the airframe and any poorly bonded panels *can* behave in a non-linear fashion thus injecting a detected signal into the electronics via the shields or ground returns.

As I've said elsewhere, it's a long shot, (hence the *can*) and hard to buy, but I have seen stranger pheomena with aircraft electrics/electronics.
That makes it pretty hard to rule out.

lomapaseo

15th Oct 2008, 17:44

WELL, I say, take the most reliable, bullet proof methods and stick with them

I can't say that I agree with your conclusion.

Everything that man makes has hidden faults that have to be found out and addressed sooner or later.

How well we do in this regard vs how much easier our life becomes is borne out by the data.

From a safety standpoint we are doing better than 40-50 years ago. I'll leave it to you whether your life is easier in this area.

RevMan2

15th Oct 2008, 18:30

Pearls of wisdom from the Sydney Morning Herald.

(If you're not an ex-fighter pilot, you'd be clueless..)

Bloody hell....

Ex-fighter pilot saved plunging flight
By ARJUN RAMACHANDRAN - SMH

As unfortunate as the 74 passengers injured last week in dramatically plunging Qantas jet were, perhaps they can be thankful for one thing - a former top fighter pilot was in charge.

The pilot at the controls as QF72 dived to the earth has not spoken publicly about how he handled the drastic scenario, but a colleague says he would have been "calm and methodical".

"I know the captain quite well," said Captain Michael Glynn, a fellow A330 pilot and acting president of the Australian and International Pilots Association.

"He came to Australia as an exchange pilot ... and flew the Mirage in the Australian airforce. So he's a highly trained pilot."

Despite his experience, the situation the pilot faced - in which QF72 made two plunges of 20 and 16 seconds that sent passengers slamming into the cabin's ceiling and walls - was one never seen before, Captain Glynn said.

Pilots underwent simulator training four times a year in which they faced emergency situations, such as planes plunging in altitude.

But on QF72, the plane seemingly acted of its own accord even after the pilot had taken manual control of the aircraft, he said.

"I believe the situations he was faced with have not be seen before.

"But that's one of the things we are trained to prepare for - when things crop up that you've not seen or thought up before and you have to ... get the aircraft to ground safely."

The pilot would not be available to describe how he handled the emergency as Qantas was still conducting its own investigation into the incident, a Qantas spokesman said.

But Captain Glynn said the first sign he would have realised something was wrong was when the autopilot system disconnected at about 37,000 feet, he said.

"They would have been in cruise, they would have been watching what was going on with the aircraft and having a chat ...

"They would have got a message from ECAM - that's the thing that tells us that something is maybe going wrong with the system - and given a checklist response to try to fix it."

The checklist would likely have advised the pilot to reset some of the computer systems, he said.

At that point, the pilot would have also taken manual control of the aircraft, but minutes later, the plane made two downward plunges.

"The thing to remember about Airbus is the flight control computer is always flying the plane - even when you're controlling it by hand, you're controlling it through the flight control computer.

"[After the initial problem that led to the autopilot disconnecting] they were hand-flying the plane and then the aircraft pitched down by itself.

"They would have been trying to correct that. Then it happened again ... it pitched down a second time.

"What he would have been trying to do is use the control stick to stop the pitch, using all his background knowledge to understand what's going on.

"It would have been very frightening. It would be very disconcerting."

Captain Glynn did not know what was done to eventually regain control of the plane, or whether control returned to the pilots as sporadically as it had left.

But even in the moment the plane was plunging towards the earth, the captain would have been calm, having faced "very realistic" simulations of the same scenario, he said.

"Sometimes the best thing to do as a pilot in that situation is to sit back and get a sense of what's going on, instead of leaping in and trying to fix it without understanding what's going on.

"It would have been tense, no two ways about it. But I know the captain - he would have been very calm."

lomapaseo

15th Oct 2008, 20:24

manrow

15th Oct 2008, 20:31

Good to know that the situation could only be resolved by an ex-fighter pilot ......... ?

That is a really helpful report in an obviously knowledgeable newspaper?

Why bother with long-winded accident investigators, we have the explanation already!

ChristiaanJ

15th Oct 2008, 21:13

Flight controls, by cable, with redundant pathways. Information from computers.....Two score years ago, we already had fly-by-wire. Nobody quite trusted it, so cables were added as a final mechanical back-up to a dual monitored system . Regularly reverted to in training... but never in service as far as the records show.

The aircraft? It was called Concorde.....

pattern_is_full

15th Oct 2008, 21:45

Oct. 15 — Airbus SAS issued an alert to airlines worldwide after Australian investigators said a computer fault on a Qantas Airways Ltd. flight
switched off the autopilot and generated false data, causing the jet to nosedive.....
Toulouse, France-based Airbus, the world’s largest maker of commercial aircraft, issued a telex late yesterday to airlines that fly A330s and A340s fitted with the same air-data computer. The advisory is “aimed at minimizing the risk in the unlikely event of a similar occurrence.”
.......The flight control system was supplied by Litton Industries, a subsidiary of Los Angeles-based Northrop Grumman Corp., according to the telex issued to airlines. Carriers can choose data computers made by Litton or Honeywell International Inc. forthe model. The fault hasn’t occurred with Honeywell equipment.

Bloomberg - 22:28Z

A bit more on the technical end:

A “preliminary analysis” of the Qantas plunge showed the error occurred in one of the jet’s three air data inertial reference units, which caused the autopilot to disconnect, the ATSB said in a statement on its Web site.
The unit continued to send false stall and speed warnings to the aircraft’s primary computer and about 2 minutes after the initial fault “generated very high, random and incorrect values for the aircraft’s angle of attack.”
The flight control computer then commanded a “nose-down aircraft movement, which resulted in the aircraft pitching down to a maximum of about 8.5 degrees,” it said.

cavok69

15th Oct 2008, 23:11

This just heard / read on ABC news:-

Claims naval base signal caused Qantas nosedive - ABC News (Australian Broadcasting Corporation) (http://www.abc.net.au/news/stories/2008/10/16/2392534.htm)

Claims naval base signal caused Qantas nosedive

Posted 43 minutes ago
Updated 28 minutes ago
Air safety investigators say they will look into claims signals from a naval communications base near Exmouth in Western Australia's north may have caused last week's Qantas mid-air emergency.
Early last week a Qantas Airbus travelling from Singapore to Perth was forced to land near the town after nosediving hundreds of feet in seconds, injuring about 70 people.
A preliminary investigation by the Australian Transport Safety Bureau (ATSB) found a computer fault caused the aircraft to nosedive twice.
The ATSB says it will examine whether signals from the communications base could have sparked the glitch.

Urshtnme

15th Oct 2008, 23:42

I can't believe the media is even trying this angle.

Base&squo;s signals may have caused plane&squo;s computer glitch caused Qantas plunge | PerthNow (http://www.news.com.au/perthnow/story/0,21598,24497567-948,00.html)

Lookleft

16th Oct 2008, 01:07

Why would you believe anything the media says about aviation? Even the so-called aviation writers are not ashamed to demonstrate their ignorance of the subject.

CONF iture

16th Oct 2008, 01:11

The fault hasn’t occurred with Honeywell equipmentSame thing was said for the Litton 10 days ago ...

Any more specific info on that telex ?

ve3id

16th Oct 2008, 01:52

I think I addressed this point when somebody suggested it a possibility in the BA038 incident. At that time I said it would take teraWatts, and that plane was at final approach altitude. Considering the inverse square law, there is not enough power in the grid to support that hypothesis at FL370, unless it was energy resonant to some particular sensitivity of the plane!

fleebag

16th Oct 2008, 01:55

The media seems to be getting their info from this thread :ugh:

Anyone spot the UFOs over Exmouth :eek:

Old Fella

16th Oct 2008, 04:06

To all those wishing to give the former fighter pilots now flying airliners a "backhander", I'm sure the ex-fighter jockeys would rather the newspaper comment had not been printed. Most would not agree with the implication that other than ex-fighter pilots may not have coped. Most of those feeling offended, and saying so on this forum, are likely feeling a bit inadequate. Just remember you are all qualified for the job whether civil or military trained.

Willoz269

16th Oct 2008, 04:21

This is interesting:

Litton Industries' System

The QF A330 flight control system was supplied by Litton Industries, a subsidiary of Los Angeles-based Northrop Grumman Corp., according to the telex issued to airlines. Carriers can choose data computers made by Litton or Honeywell Inc. for the model. The fault hasn't occurred with Honeywell equipment.

Northrop, the world's largest warship builder, acquired Litton in 2001 for about $5.18 billion. Northrop is ``involved in the investigation and we're helping in any way we can,'' said Gina Piellusch, a spokeswoman, adding that she didn't immediately have further information.

European Aeronautic, Defence & Space Co., Airbus's owner, fell 93 cents, or 8.4 percent to 10.17 euros in Paris trading. Northrop fell as much as $1.84, or 4.1 percent, to $43.37 and was down 3.4 percent as of 11:54 a.m. in New York Stock Exchange composite trading.

Cathay Pacific Airways Ltd., which operates 28 A330s or A340s fitted with systems covered by Airbus's alert, is taking the recommended steps, it said in an e-mailed reply to Bloomberg News queries. Actions include changes to checks by flight crews and maintenance procedures, the Hong Kong-based carrier added.

The Fault actually DID occur with Honeywell, but on the B777 of MAS...

FrequentSLF

16th Oct 2008, 04:24

Flight controls, by cable, with redundant pathways.

What about Air Moorea F-OIQI ...

Capt Kremin

16th Oct 2008, 04:27

I think the ex-fighter pilot angle was just the journalist sexing the article up a bit. If you look at what else was said about what we do, no mention was made of having to be a fighter pilot in order to be able to get the aircraft on the ground safely. We all are trained to the same standard. Anyone offended should probably check their egos at the door.

ampclamp

16th Oct 2008, 08:43

Hi zb, yes I was going to go on with harmonics beat frequencies ie heterodyning etc but didnt go any further.I was going to cover the inverse square law also but some one else has done that also.Thanks to those folks to cover my laziness.

Radio can do some weird crap so I wouldnt say absolutely impossible but I do seriously doubt it could be a factor.

Looks like pprune scooped the press on the vlf issue, wonder how long before the post re UFO gets a run in the tele or herald sun :bored:

ampclamp

16th Oct 2008, 08:57

Do we know exactly when and what the crew did?
The crew as best as we can ascertain carried out the non normal checklist.
They've not been slagged by the ATSB to my knowledge.
Its not up to them to second guess the procedures and aircraft architecture.If the NNC said turn off the offending adiru or air data section of it I'm sure they would have after identing exactly what the message was and actions to be carried out.
I dont think going thru a NNC whilst riding a bucking bronco would be terribly easy either.

Given the event appears to be unique on type the urgency to turn off an adiru is easy with Captain Harry Hindsight in command.
I'd have been far too busy slipping out of my seat covered in "adrenalin"

Swedish Steve

16th Oct 2008, 09:04

A “preliminary analysis” of the Qantas plunge showed the error occurred in one of the jet’s three air data inertial reference units, which caused the autopilot to disconnect, the ATSB said in a statement on its Web site.
The unit continued to send false stall and speed warnings to the aircraft’s primary computer and about 2 minutes after the initial fault “generated very high, random and incorrect values for the aircraft’s angle of attack.”
The flight control computer then commanded a “nose-down aircraft movement, which resulted in the aircraft pitching down to a maximum of about 8.5 degrees,” it said.

Can someone put me right. The ADIRU failed, and disconnected itself from the AP.The crew carried out the ECAM procedure, identified that ADIRU1 was at fault, set the Capts instruments to ADIRU3. A couple of minutes later the failed ADIRU, which was still powered gave out a high AOA signal and the FCS pushed the aircraft nose down to avoid what it thought was a stall.

So question is why did the FCS follow ADIRU1, when the other two were showing no high AOA? We are not talking AP here, but envelope protection. Surely this protection system uses inputs from all three ADIRU and should vote off nbr 1?

Or had the crew reengaged AP1? There is a trap on Airbus that with a failed ADIRU1 you can set Capt inst to ADIRU3, but still have ADIRU1 feeding AP1.

I follow with interest.

Litebulbs

16th Oct 2008, 18:20

I agree with you and am not blaming anyone. I am sure the investigation will examine the crew actions and as you said, if they carried out their SOP for the initial fault, then the investigation will move onto SOP's and other areas as to why the incident was allowed to happen.

tooldoc1000

16th Oct 2008, 20:07

What is the update of the Northrop Grumman (Litton) LTN-101 Inertial Reference Units (IRUs)
The current part numbers are 465020-0400-0401 but need to be updated to 465020-0400-0402 (with the 2005 Epoch software). is this correct.

bsieker

16th Oct 2008, 20:20

Swedish Steve,

I agree with most of what you say, especially that a single ADIRU outputting erroneous values should not cause a flight control upset, there should be some mechanism for excluding the faulty unit, such as median value selection, or something similar. (Navigation, flight displays and AP are another matter, they may be fed only by a single unit).

Or had the crew reengaged AP1? There is a trap on Airbus that with a failed ADIRU1 you can set Capt inst to ADIRU3, but still have ADIRU1 feeding AP1.

I understand the flight crew received an "IR 1 fault" ECAM message. Would the ECAM procedure not include turning off the faulty ADIRU?

As to the Autopilot: The ATSB media release said that the pilots hand-flew the aircraft from the time of the first incident (which was a slight pitch-up and the AP disconnect), except for a few seconds. The ATSB does not tell us when those few seconds were, in particular whether or not it was during the two following, more severe nose-down upsets.

On the other hand, the ATSB is quite clear that erroneously high AoA values sent by the ADIRU to the PRIM(s) caused the PRIM to command down-elevator deflection. No AP involved.

Bernd

ChristiaanJ

16th Oct 2008, 20:36

I'm baffled...

Wouldn't there have been a sudden large discrepancy between pitch attitude, pitch rate and AoA? Inertia and all that?

AoA presumably came from the "AD" part of the ADIRU, and pich attitude and pitch rate from the "IRU" part.

Were they still sufficiently coherent for the ADIRU not going totally offline?

bsieker

16th Oct 2008, 21:22

I'm baffled...

So am I.

Wouldn't there have been a sudden large discrepancy between pitch attitude, pitch rate and AoA? Inertia and all that?

AoA presumably came from the "AD" part of the ADIRU, and pich attitude and pitch rate from the "IRU" part.

Were they still sufficiently coherent for the ADIRU not going totally offline?

I have no idea about internal ADR vs. IR consistency checks inside the ADIRU.

But another thing is still interesting:

I only just realised that the "IR" and the "ADR" parts of the ADIRUs can be turned off separately.

As the ATSB said there was a "IR 1 fault" message. The abnormal procedure apparently says to turn off "IR 1" only if "IR totally faulty" (continuously lit fault light, instead of flashing, we don't know which it was in this case). Neither IR nor ADR fault procedures call for turning off the ADIRU completely, only for disconnecting the respective data output (IR and/or ADR, and also setting the Captain's instruments to use ADIRU 3). It is also not clear to me if this inhibits the output at the ADIRU, or just the transmission of the data to specific recipients (which ones? PRIM, Navigation/AP, Displays, ...).

Even so, if they had disconnected IR 1, the ADR part would still be operational and continue to send data.

The Captain's PFD would then have displayed the (presumably correct) data from ADIRU 3, while the PRIM will have continued to receive (erroneous) data from ADIRU 1 (and -2 and -3), even if only from the ADR portion.

AoA is obviously an "air data" value, and not IR. The upsets were triggered by incorrect AoA values.

Thus, apparently, both the ADR and the IR parts of the ADIRU were faulty. What exactly went wrong there is for the manufacturer to investigate.

Bernd

ampclamp

16th Oct 2008, 23:00

The aoa input prob has priority over the IR part in given situations.
primarys/flt comp's likely analyse the info and drive the flt ctls to protect the aircraft from a dangerous attitude.
still gets back to the basic question everyone is asking , how could it be allowed to happen given all the comparing and monitoring going on at altitude in crz?

litebulbs, no problem sometimes the written word does not always come across as we intend.:)

Brian Abraham

17th Oct 2008, 03:31

A copy of a post by Veruka Salt over on D & G.

Our fleet management has just published a memo to Airbus crew, containing an extract from the Airbus Operator Information Telex.

It's a detailed account of "what" actually happened, if not "why".

'As the incident is subject to a formal ICAO Annex 13 investigation led by the Australian Transport Safety Bureau (ATSB), the updated data about the incident included in this OIT have been approved for release by the ATSB.

The A330 aircraft was flying from Singapore to Perth. The aircraft has then been diverted to Learmonth (Australia).

The preliminary analysis of the DFDR, Post Flight Report (PFR) and BITE (Built-In Test Equipment) data allows to establish the following preliminary sequence of events:

The A/C was flying at FL 370 with Autopilot and Auto thrust system engaged without any reported or recorded anomaly, when the IRS 1 Fault has been triggered and the Autopilot automatically disconnected. From this moment, the crew flew manually the aircraft to the end of the flight except for a short duration of few seconds.

From the time the IRS 1 Fault has been triggered, the recorded parameters of the ADR part of ADIRU 1 include erroneous and temporary wrong values in a random manner. These values are spike values and not sustained values. ADIRUs 2 and 3 seemed to have operated normally.

This abnormal behaviour of the ADIRU 1 led to several consequences as follows:

* unjustified stall & overspeed warning
* loss of attitude information on Captain Primary Flight Display (PFD).
* several ECAM system warnings.

About 2 minutes after the initial IRS Fault, the ADIRU spikes generated very high, random and temporary values of the angle of attack leading to:

1/ the flight control laws commanding nose-down aircraft movements (A/C pitch attitude decreased from 2° nose-up to 8° nose-down and vertical load factor changed from 1g to -0,8g.
2/ the Flight Control Primary Computer (FCPC) "F/CTL PRIM 1 PITCH FAULT" ECAM WARNING was triggered

The crew timely response led to recover the A/C trajectory within seconds. During the recovery, the vertical load factor did not exceed 1,6g and the maximum altitude loss was 650 ft.

The DFDR data show that the ADR 1 continued to generate random spikes. A second nose-down aircraft movement was encountered later on, but with less important effects in terms of aircraft trajectory. It also led to generate the "F/CTL PRIM 2 PITCH FAULT" ECAM WARNING. This, combined with the previous "F/CTL PRIM 1 PITCH FAULT" ECAM WARNING led to switch from NORMAL to ALTERNATE law.

The BITE message of the ADIRU 1 does not include failure or maintenance message. However the PFR also includes other system failure messages which have been demonstrated as spurious but generated by the ADIRU 1.

Tests performed on the A/C following the incident did not reveal any abnormal results that would allow explaining the reason for the event.

At this stage of the investigation, the analysis of available data indicates ADIRU 1 abnormal behaviour is likely at the origin of the event.

The type of ADIRU, which is involved, is NORTHROP GRUMMAN (previously LITTON), PN 465020-0303-0316.'

CONF iture

17th Oct 2008, 03:55

Apparently for that specific type of ADIRU, Airbus has substantially modified the checklist in response to an Inertial Reference fault. It is now question to turn off both parts of that unit : IR + ADR

Due to the nature of the fault in the ADIRU 1 "random spikes" it is hard to say if the crew had the proper tools to determine if the ADR part was at fault too and to turn it off before the sudden pitch down ?

How strange is it, the protection which is supposed to protect, sent the pax through the roof, and for no good reason !?

That Airbus is a VERY complex machine …

Willoz269

17th Oct 2008, 04:10

It still sounds remarkably similar to the Boeing 777 incident, and they had a Honeywell kit, only that this aeroplane pitched up 3000 Feet!!:

At approximately 1703 Western Standard Time, on 1 August 2005, a Boeing Company 777-200 aircraft, (B777) registered 9M-MRG, was being operated on a scheduled international passenger service from Perth to Kuala Lumpur, Malaysia. The crew reported that, during climb out, they observed a LOW AIRSPEED advisory on the aircraft’s Engine Indication and Crew Alerting System (EICAS), when climbing through flight level (FL) 380. At the same time, the aircraft’s slip/skid indication deflected to the full right position on the Primary Flight Display (PFD). The PFD airspeed display then indicated that the aircraft was approaching the overspeed limit and the stall speed limit simultaneously. The aircraft pitched up and climbed to approximately FL410 and the indicated airspeed decreased from 270 kts to 158 kts. The stall warning and stick shaker devices also activated. The aircraft returned to Perth where an uneventful landing was completed.
The aircraft’s flight data recorder (FDR), cockpit voice recorder and the air data inertial reference unit (ADIRU) were removed for examination. The FDR data indicated that, at the time of the occurrence, unusual acceleration values were recorded in all three planes of movement. The acceleration values were provided by the aircraft’s ADIRU to the aircraft’s primary flight computer, autopilot and other aircraft systems during manual and automatic flight.
Subsequent examination of the ADIRU revealed that one of several accelerometers had failed at the time of the occurrence, and that another accelerometer had failed in June 2001.

grizzled

17th Oct 2008, 09:26

Re Willoz269's previous post.

Using Google Earth, have a look at the geographic location of the instigating event in each of the two incidents. I agree with others about the very unlikely notion that EMI could have been a factor, so . . .

I guess that leave's Western Australia's famous UFO's.

;)

Brian Abraham

18th Oct 2008, 00:59

Copy of post by Zeke over on D & G.

TO: A318/A319/A320/A321/A330/A340/A340-500/A340-600 Operators

SUBJECT: A330 in-flight incident

OUR REF: SE 999.0083/08/LB dated 14 Oct 08

CLASSIFICATION: INFORMATION-FLIGHTS OPS

AFFECTED AIRCRAFT: All A330/A340/A340-500/A340-600 in service aircraft
--------------------------------------------------------------
Notice:

This OIT/FOT covers an operational issue.
It is the Operators' responsibility to distribute this OIT/FOT, or the information contained in this OIT/FOT, to all A330/A340/A340-500/A340- 600
flight crews without delay.
--------------------------------------------------------------
1. PURPOSE

The aim of this OIT is to:

- Update operators on the in-flight incident, which occurred on an A330
aircraft on Oct 07th.
- Advise A330/A340 operators about OEBs issuance and associated MMEL
operational procedure impact.

2. EVENT DESCRIPTION

As the incident is subject to a formal ICAO Annex 13 investigation led by the Australian Transport Safety Bureau (ATSB), the updated data about the
incident included in this OIT have been approved for release by the ATSB.

The A330 aircraft was flying from Singapore to Perth. The aircraft has then been diverted to Learmonth (Australia).

The preliminary analysis of the DFDR, Post Flight Report (PFR) and BITE
(Built-In Test Equipment) data allows to establish the following preliminary sequence of events:

The A/C was flying at FL 370 with Autopilot and Auto thrust system engaged
without any reported or recorded anomaly, when the IRS 1 Fault has been
triggered and the Autopilot automatically disconnected.

From this moment, the crew flew manually the aircraft to the end of the flight except for a short duration of few seconds.

From the time the IRS 1 Fault has been triggered, the recorded parameters of the ADR part of ADIRU 1 include erroneous and temporary wrong values in a random manner. These values are spike values and not sustained values. ADIRUs 2 and 3 seemed to have operated normally.

This abnormal behaviour of the ADIRU 1 led to several consequences as
follows:
- unjustified stall & overspeed warning
- loss of attitude information on Captain Primary Flight Display
(PFD).
- several ECAM system warnings.

About 2 minutes after the initial IRS Fault, the ADIRU spikes generated very high, random and temporary values of the angle of attack leading to:
1/ the flight control laws commanding nose-down aircraft movements (A/C
pitch attitude decreased from 2° nose-up to 8° nose-down and vertical load
factor changed from 1g to -0,8g.
2/ the Flight Control Primary Computer (FCPC) "F/CTL PRIM 1 PITCH
FAULT" ECAM WARNING was triggered

The crew timely response led to recover the A/C trajectory within seconds. During the recovery, the vertical load factor did not exceed 1,6g and the maximum altitude loss was 650 ft.

The DFDR data show that the ADR 1 continued to generate random spikes.

A second nose-down aircraft movement was encountered later on, but with
less important effects in terms of aircraft trajectory. It also led to generate the "F/CTL PRIM 2 PITCH FAULT" ECAM WARNING. This, combined with the previous "F/CTL PRIM 1 PITCH FAULT" ECAM WARNING led to switch from
NORMAL to ALTERNATE law.

The BITE message of the ADIRU 1 does not include failure or maintenance
message. However the PFR also includes other system failure messages which
have been demonstrated as spurious but generated by the ADIRU 1.

Tests performed on the A/C following the incident did not reveal any abnormal results that would allow explaining the reason for the event.

At this stage of the investigation, the analysis of available data indicates ADIRU 1 abnormal behaviour is likely at the origin of the event.

The type of ADIRU, which is involved, is NORTHROP GRUMMANN (previously
LITTON), PN 465020-0303-0316.

3. OPERATIONAL RECOMMENDATIONS for A330/A340 fitted with NORTHROP
GRUMMANN - LITTON ADIRU

Pending final resolution, Airbus will issue an OEB 74-1 that will instruct the crew to select OFF the whole ADIRU in case of IR failure, instead of switching OFF only the IR part.

The aim of the following procedure is to isolate both the IR and ADR when
an IR is detected faulty in order to prevent the ADR from providing erroneous data to the other aircraft systems.

PROCEDURE:

- If one IR is self detected faulty or if the ATT red flag is displayed on the Captain or First Officer PFD the supplying IR and ADR must be disconnected.

NAV IR 1(2)(3) FAULT or ATT flag displayed on CAPT (F/O) PFD
-IR 1(2)(3) pb ______________OFF
-ADR 1(2)(3) pb _____________OFF
IF IR 3 NOT AFFFECTED
-ATT HDG SWTG _______________CAPT (F/O) ON 3
-AIR DATA HDG SWTG __________CAPT (F/O) ON 3

- In case of dispatch under MMEL and an IR failure in flight, either detected by an IR 1+2 (1+3)(2+3) FAULT or with ATT red flag displayed on CAPT or F/O PFD, the supplying IR and ADR must be disconnected.

ATT flag displayed on CAPT (F/O) PFD or,
NAV IR 1+2(1+3)(2+3) FAULT
-IR 1(2)(3) pb ____________OFF
-ADR 1(2)(3) pb ___________OFF
SPD BRK____________________DO NOT USE
IF CG AFT 32%:
- T TANK MODE _______FWD

Note: In case of failure of IR 1 and IR 2 failure, the Inertial and Air Data from ADIRU 3 should be provided on Captain side.

Note: To isolate an ADIRU, IR mode rotary selector (OFF; NAV; ATT) remains
in the NAV position so that Inertial and Air Data be disconnected from other systems without de-energizing the ADIRU (NAV mode may be recovered if IR or ADR unduly selected OFF).

4. MMEL IMPACTS for A330/A340 fitted with NORTHROP GRUMMANN - LITTON ADIRU

In case of dispatch under MMEL 01-34-10-01-A), the associated MMEL
operational procedure is amended as follows:

IR (affected) pb sw____________________ OFF
ADR (associated) pb sw _________________OFF
IR (affected) mode rotary sel___________OFF

- If IR 1 (2) is affected:
ATT HDG sel ____________________ CAPT ON 3 (F/O ON 3)
AIR DATA sel ____________________CAPT ON 3 (F/O ON 3)

This will be reflected in MMEL Temporary Revisions:

TR N°02-34/01Z ISSUE 01 for A330
TR N°02-34/01Z ISSUE 01 for A340

5. FOLLOW-UP PLAN

Airbus is working together with the ATSB and the supplier to identify the
ADIRU failure mode.
Additionally, as the same ADIRU PN standard is fitted on single aisle family aircraft, Airbus is currently checking if temporary measures are also required on these aircraft types.

However initial investigation result seems to indicate that single aisle family aircraft flight control system is more robust against this ADIRU failure mode.

OEB 74-1 (A330 family) and 88-1 (A340 family) will be issued in the coming
days.

Specific follow-up of this OIT will be provided through OIT revision when
pertinent information related to investigation results is available

CRCinAU

18th Oct 2008, 06:09

This seems much like the Malaysian Airlines B777-200 on 3 August 2005 (Flight MH 124) from Perth to Kuala Lumpur:

Read more about that here (http://catless.ncl.ac.uk/Risks/24.03.html#subj3)

From that incident, the FAA report contains:

Since [AD 2005-10-03] was issued, we received a recent report of a
significant nose-up pitch event on a Boeing Model 777-200 series airplane
while climbing through 36,000 feet altitude. The flight crew disconnected
the autopilot and stabilized the airplane, during which time the airplane
climbed above 41,000 feet, decelerated to a minimum speed of 158 knots,
and activated the stick shaker. A review of the flight data recorder shows
there were abrupt and persistent errors in the outputs of the ADIRU. These
errors were caused by the OPS using data from faulted (failed) sensors.
This problem exists in all software versions after P/N 3470-HNC-100-03,
beginning with P/N 3477-HNC-100-04 approved in 1998 and including the
versions mandated by AD 2005-10-03. While these versions have been
installed on many airplanes before we issued AD 2005-10-03, they had not
caused an incident until recently, and the problem was therefore unknown
until then. OPS using data from faulted sensors, if not corrected, could
result in anomalies of the fly-by-wire primary flight control, autopilot,
auto-throttle, pilot display, and auto-brake systems, which could result
in high pilot workload, deviation from the intended flight path, and
possible loss of control of the airplane. ................

CONF iture

18th Oct 2008, 16:04

So that’s a major change from Airbus :

The requested actions after an IR1 FAULT used to be :
- ATT HDG SWTG …………….. CAPT ON 3
- IR1 ……………………………..... OFF

But it is now :
- IR1 ……………………………..... OFF
- ADR1 …………………………..... OFF
- ATT HDG SWTG …………….. CAPT ON 3
- AIR DATA HDG SWTG ……. CAPT ON 3

As to the Autopilot: The ATSB media release said that the pilots hand-flew the aircraft from the time of the first incident (which was a slight pitch-up and the AP disconnect), except for a few seconds. The ATSB does not tell us when those few seconds were, in particular whether or not it was during the two following, more severe nose-down upsets

There is more information in the audio file of the same ATSB media release
2008/43: Qantas Airbus A330 Accident Media Conference (http://www.atsb.gov.au/newsroom/2008/release/2008_43.aspx)

AP disconnected at the initial IR1 FAULT ECAM MSG
Aircraft climbed 200 feet due to pilot input
AP was reengaged
Aircraft went back to FL370
AP disconnected again … and was never reengaged

Only about one minute later the aircraft suddenly pitch down.

It must be a big question mark for Airbus why a single faulty ADR allowed the AOA protection to take control of the aircraft.
Aircraft was under manual control but the “protection” prevailed … !?

The more complex a system, the more automatism, the more ambitious … the more chance for the unexpected !

Zeke

18th Oct 2008, 17:14

It must be a big question mark for Airbus why a single faulty ADR allowed the AOA protection to take control of the aircraft. Aircraft was under manual control but the “protection” prevailed … !?

Please refer to the QRH 2.43 for what you should do for speed discrepancies between ADR 1,2,3 , fluctuating or unexpected speed, abnormal correlation of basic flight parameters, abnormal AP/FD/ATHR behaviour, STALL warnings or OVERSPEED warnings etc......

AP/FD ___________________OFF
A/THR____________________OFF
……
Faulty ADR(s) __________ OFF
Remaining Air Data______ CONFIRM

Until we have the final report I am unable to confirm if the crew did/did not follow the UNRELIABLE SPEED INDIC/ADR CHECK PROC and turn off the erroneous ADR output. They received spikes in airspeed giving STALL/OVERSPEED warnings and all the other symptoms of a faulty ADR, and you WILL get a nose down/up bias until that ADR is turned off.

I am still not convinced the GNADIRU was faulty, problems with the output of the GNADIRU unit in the past have been traced back to things like the racking of the box (e.g. hitting the shelf above causing excessive vertical g), or a probe/sensor/air data module failure.

Please do not jump to conclusions.

CONF iture

19th Oct 2008, 03:49

Zeke,

Airbus had never thought before QF72 that switching OFF a faulty ADR was a top priority, they have changed their mind since, at least for that type of ADIRU.

Switching OFF a faulty ADR, in the UNRELIABLE SPEED INDICATION / ADR CHECK PROC has never been a top priority. It had to come up at the right time, but not before a thorough analysis by the crew was performed.

As you mention the first two lines of the UNRELIABLE SPEED INDICATION memory items, note that switching OFF a faulty ADR is NOT one of these items.
Actually it is mentioned only on the second page of one of the longest procedure figuring in the Quick Reference Handbook.

Applying the UNRELIABLE SPEED INDICATION memory items was considered enough to maintain a safe conduct of the flight, just enough to grab the QRH and read through that long abnormal procedure where, eventually, the faulty ADR would be switched OFF.

I would guess the QRH was not open on the table for a minute when the AOA protection decided to take control ...

ulaula123

19th Oct 2008, 04:28

OK,it is clear now:pilot manualy flew and climb initialy than received wrong stall signal and pushed too fast...

Now the question is:
who will pay the compensation for injured?
Qantas because of pilot's action or Airbus because of computer glich?

kremlin,thanks:)

Zeke

19th Oct 2008, 04:38

CONF iture,

The start of the UNRELIABLE SPEED INDIC/ADR CHECK PROC assumes worst case, problem at rotation, this was far from being the worst case. They had a lot of altitude on their side. This was far more manageable than when it happens at rotation. The procedure covers all phases of flight, including the cruise in clean configuration.

Switching off the ADR still is not a top priority, flying the aircraft is. This event went over something like 5-10 minutes, not seconds. I am sure you have been thrown false overspeed or stall warnings in the simulator at altitude, and trained not to blindly follow them, cross check them first.

I am well aware of what the checklist says, and in what order. I put the .... in to indicate a break. All I was demonstrating was the existing procedure for dealing with "unjustified stall & overspend warning" would lead you to turning off the ADR. The tools are in the QRH, so are the symptoms to look out for.

I note you did not realise this until I raised it, which makes me think Airbus is right putting it in the OEB for people who not make this connection with the UNRELIABLE SPEED INDIC/ADR CHECK PROC QRH procedure.

Capt Kremin

19th Oct 2008, 04:48

Ulaula, the pilot didn't pitch down; the FBW did when it tried to avoid a stall as sensed by the faulty ADIRU.

Who is this Quantas anyway?

CONF iture

19th Oct 2008, 19:59

I put the .... in to indicate a break
How long is your break then ?

May I remind you the crew got at most one minute, and not five to ten (?) … but only a minute after they came back at 370 and before the protection took control for NO good reason whatsoever.
The total duration of the event between the initial NAV IR FAULT ECAM MSG and the first upset which is the one that matters, was at most two minutes.
Dealing with the AP disconnection + requested ECAM actions after an IR fault can easily take one out of these two minutes.

Switching off the ADR still is not a top priority, flying the aircraft is.
Flying the aircraft is exactly what that crew did. Do you have any information to the contrary ?
Of course switching OFF the faulty ADR is NOW a top priority, why do you think Airbus, in that very short period of only one week, decided to modify the checklist in that direction ?
Is it just for fun ?

Anyway, I read your posts and I have the feeling it could not have happened to you ... Good for you !
I won’t argue that you may well be above average.
But it is also possible you don’t realize the nature of the fault described as random spikes which has nothing to see with the typical steady fault encountered during a simulator ride. Even the system itself did not diagnostic the faulty ADR …
Still, you look surprised they did not switch OFF that faulty ADR before the upset.
I am not surprised and I would not have done any better.

To put it in simple words :
A faulty ADR was not supposed to trigger a protection and take away the control from the pilot … but it did !?
Did you know that ?
Airbus didn’t.

I note you did not realise this until I raised it, which makes me think Airbus is right putting it in the OEB for people who not make this connection with the UNRELIABLE SPEED INDIC/ADR CHECK PROC QRH procedure.
I’m not really sure where you got that … Do you think training is exclusive to CX ?
Beside that, Airbus don’t publish a Telex or the coming OEB to simply emphasize a known procedure, but to MODIFY it !

Zeke

20th Oct 2008, 06:13

CONF iture,

It would appear the protections came on for good reason, because of the ADIRU generated high angle of attack. It would also appear the protections responded the way they should have in response to the angle of attack generated by the ADIRU.

The output from one ADR was not correct, "the recorded parameters of the ADR part of ADIRU 1 include erroneous and temporary wrong values in a random manner" from the time the AP was disconnected.

The procedures for dealing with "unreliable speed" and "unjustified stall & overspeed warnings" is listed in the QRH, they may not come up on ECAM as the ADIRU cannot detect unreliable speed. The procedure calls for the faulty ADR to be turned off after the speeds have been cross checked.

FCOM 3 also says in case of simultaneous failure of ADR and IR (same ADIRU), the ADR FAULT procedure should be applied BEFORE the IR FAULT procedure (where you would turn off the failed ADR as part of the procedure). That is listed at the start of the NAV IR FAULT, and NAV ADR FAULT FCOM 3 procedures.

Did you know the QRH and FCOM 3 references to turning off the failed ADR before making your posts ?

I will be keen to see the ATSB report when it is issued.

CONF iture

20th Oct 2008, 20:45

Zeke,
Whatever I can say beside, thanks for giving me the reply.

But let’s go back in the Arena …

It would appear the protections came on for good reason, because of the ADIRU generated high angle of attack. It would also appear the protections responded the way they should have in response to the angle of attack generated by the ADIRU.
Except from a REAL case of potential stall I don’t see anything else as a good reason to send crew and pax head butting the ceiling.
What kind of "protection" is it ?

To me you’re drifting away from reality :

1- There was no real case of approaching stall
2- Your commentaries remind me the guy seating in the simulator but on the instructor’s seat, the clever seat, the guy who has the power to freeze the situation at any time.
You now pretend the key was in the FCOM 3
But is it the way you teach or are teach, to open FCOM 3 before dealing with the ECAM actions and before referring to the Quick Reference Handbook Abnormal Procedure ?
I’m getting seriously confused here …

Referring to Flight Crew Operation Manual is actually a good idea, but only when time permits … was it the case before the first upset ?

By the way, what was the initial ECAM message again … ?

Before going any further, Please, face the following questions :
1- Did Airbus modify the checklist in the last Telex Info Ops ?
2- Why ?

grumpyoldgeek

21st Oct 2008, 04:23

Airbus is working together with the ATSB and the supplier to identify the ADIRU failure mode. Additionally, as the same ADIRU PN standard is fitted on single aisle family aircraft, Airbus is currently checking if temporary measures are also required on these aircraft types.

However initial investigation result seems to indicate that single aisle family aircraft flight control system is more robust against this ADIRU failure mode.

It seems they might know a bit more than they are disclosing at this time...

Scissorlink

23rd Oct 2008, 03:06

catastrophic outcomes that are totally blameless

Maybe thats the whole point??

grumpyoldgeek

23rd Oct 2008, 03:37

Leave closed-loop artificial intelligence for solving engineering problems like smart bombs, railway yard traffic, nuclear power stations and kitchen refrigerators with 17" plasma screens bleating interactive instructions on how to use a broom, all of which have produced catastrophic outcomes that are totally blameless.

Your golden tongued rhetoric does little to advance the discussion. First of all, servo loops do not in any way fall into the commonly accepted category of artificial intelligence. They are fundamentally furnace thermostats with various forms of dampening and anticipation. In the Quantas incident, the servo loop was not responsible for the injuries, a defective sensor was. Granted, flaws in the system prevented the crew from identifying and isolating the defective subsystem, but that will be fixed. Secondly, any pronouncement of unsuitability should also include a risk analysis of other ways. My risk analysis tells me that in the USA, the major airlines have flown for nearly 7 years (knock on wood) without killing a single passenger. That tells me that something is working right and I'd rather not go back to whatever way it was before.

lomapaseo

23rd Oct 2008, 03:55

grumpyoldgeek

Secondly, any pronouncement of unsuitability should also include a risk analysis of other ways

Of course you're right, :ok:

This fancy stuff has indeed advanced not only passenger comfort but safety as well. We haven't quite reached perfection yet but we're still trying. That's what science is all about. Fortunately in aviation we have safety engineers watching over this quite closely and advancing their art and concepts as well.

From my vantage the most important lesson learned is the lesson learned and applied.

The day we don't learn from our mistakes signifies a loss of confidence in the profession

Litebulbs

23rd Oct 2008, 07:06

The automatics in this event appear to have acted correctly and very quickly. They diagnosed a fault and disconnected automatic control. That is exactly what the system is designed to do. The human element then entered the loop, to diagnose what the problem was and take corrective action.

fdr

23rd Oct 2008, 08:34

Litebulbs
The automatics in this event appear to have acted correctly and very quickly. They diagnosed a fault and disconnected automatic control. That is exactly what the system is designed to do. The human element then entered the loop, to diagnose what the problem was and take corrective action.

Well, if you are referring to the initial degradation of the DGFCS that dropped out the APLT, then true, but the pitch up, and of more concern the pitch down were grossly abnormal behavior of the FBW control system, and appear to have exceeded the normal gains in the flight control system. By a wide margin.

An A330 manually flown to a condition that invokes alpha protection does not react with that high a pitch rate, [caveat: at least in the simulator and from the flight test data of the aircaft used to derive the MQTG]

The crew input to the controls will not normally derive the rates that have occurred in this event, including dual inputs. I personally know the PIC of this aircraft, have done so for many years, and I would be surprised if the crew input was an issue.

Excessive gain has occurred in the FCS before... as while the controls are primarily a PID negative feedback system (including anti windup), they do have lookup tables for gains in relation to the proportional response signal. There is, as mentioned, no AI in the control system. gain issues have previously been involved with lateral control, which couple to yaw, and pitch.

Awaiting the final report....

Capn Bloggs

23rd Oct 2008, 10:11

Lightbulbs,

From the ATSB media conference (off their website):
About 2 minutes after the initial fault, ADIRU 1 generated very high, random and incorrect values for the aircrafts angle of attack.

These very high, random and incorrect values of the angle attack led to the flight control computers commanding a nose-down aircraft movement, which resulted in the aircraft pitching down to a maximum of about 8.5 degrees, the triggering of a Flight Control Primary Computer pitch fault.

The crew's timely response led to the recovery of the aircraft trajectory within seconds. During the recovery the maximum altitude loss was 650 ft.

The Digital Flight Data Recorder data show that ADIRU 1 continued to generate random spikes and a second nose-down aircraft movement was encountered later on, but with less significant values in terms of aircraft's trajectory.

All I'll say to your comment that:
The automatics in this event appear to have acted correctly and very quickly.
is... absolute nonsense! The automatics made a concerted attempt to maim/kill everybody on board that A330 by bunting the aircraft not once but twice, so violently that people ended up with their heads breaking the overhead lockers!:=

lomapaseo

23rd Oct 2008, 12:56

Capn Bloggs

All I'll say to your comment that:

Quote:
The automatics in this event appear to have acted correctly and very quickly.

is... absolute nonsense! The automatics made a concerted attempt to maim/kill everybody on board that A330 by bunting the aircraft not once but twice, so violently that people ended up with their heads breaking the overhead lockers!

Not so fast.

The first priority in aircraft performance is to protect the aircraft (else everybody is lost)

Litebulbs

23rd Oct 2008, 13:15

The automatic i.e. no pilot intervention (simplistically) worked. The fault ended its authority. If the autopilot still had authority do deal with the problem that it had detected, it would have voted the incorrect source of data out and disconnected that input into the EFCS, then carried on flying normally. It is not designed to do this, that is what pilots are for. You open the loop and let them decide what is the next course of action using the relevant documentation to understand what fault is being displayed and isolate it.

It appears Airbus are making changes to how you would deal with the information presented if this fault reoccurred. Don't blame the pilots OR the aircraft.

sevenstrokeroll

23rd Oct 2008, 14:24

iompasseo

you wrote something about the first priority being to protect the aircraft...I submit that the first priority should be to protect the people aboard the aircraft.

because the plane's structure is perhaps not as robust as I would like the plane saved itself at the expense of the passengers (granted they were not wearing seatbelts).

''they don't build 'em like they used to''.

fdr

23rd Oct 2008, 22:11

Lightbulb: The automatic i.e. no pilot intervention (simplistically) worked. The fault ended its authority. If the autopilot still had authority do deal with the problem that it had detected, it would have voted the incorrect source of data out and disconnected that input into the EFCS, then carried on flying normally. It is not designed to do this, that is what pilots are for. You open the loop and let them decide what is the next course of action using the relevant documentation to understand what fault is being displayed and isolate it.

It appears Airbus are making changes to how you would deal with the information presented if this fault reoccurred. Don't blame the pilots OR the aircraft.

No, the underlying fault was in a sensor providing data to the FCC's. The autopilot detects a defect and disconnects, great, but the defect remains, with spurious signals being sent to the FCC's affecting a flight path change when autoprotection boundaries are exceeded.

Lightbulb: It appears Airbus are making changes to how you would deal with the information presented if this fault reoccurred. Don't blame the pilots OR the aircraft.

1st comment is reasonable, and hardly surprising. The last part "or the aircraft" is possibly valid if you then wish to lay causation at inadequate fault tolerant design by humans rather than the product "aircraft". either way, the crew need a timely action to mitigate eroneous sensor data affecting flight paths, as it has done in this case, and in the earlier MAS B777 case.

Litebulbs

23rd Oct 2008, 22:54

The fault remained because the aircraft could not turn the faulty unit off. That is a human function. The AoA sensor could safely remain faulty if ADIRU 1 was switched off.

CONF iture

24th Oct 2008, 03:56

This event is a first time experience for that specific ADIRU type, Airbus is confident a similar fault cannot duplicate on the other ADIRU type, or at least would not lead to such an adventure.
But for the Litton ADIRU, even if the probability of re-occurrence is very low, they want to make sure the crew will have the proper tool, not to totally eliminate the risk, but at least to significantly reduce the exposure time to that risk : That’s the reason for the Operations Engineering Bulletin publication.

Some Airbus automatisms, in my view, are one step too far.
Surely wonderful on paper as well as in real time when everything is by the book, but can also badly bite and so by complete surprise as lately demonstrated.

Put back QF72 in a simplified FBW A330 version, one with NO protection and the crew had ample time to deal with the defective equipment.

Still, I am confident Airbus and Litton will find a technical solution to the issue, but for now …
Follow the OEB if you want to be protected from the protection !

People will shoot me for doing so, but this event brings me back 20 years earlier :
Habsheim was the first case when flight controls responded in an unexpected way.

captplaystation

24th Oct 2008, 10:30

Perhaps unfair of me to comment, as unlike you I have no professional experience of Scarebusses, but this surely won't be the last time that man is surprised by this increasingly complicated system. It is all very well electronically engineering more and more levels of protection/ intervention, but it doesn't half put the onus on swift thinking and systems knowledge (perhaps in excess of the Type Rating course? ) when things do go wrong.
I don't wish to imagine the joys to come when these beasties get older and fall into the hands of "less well known carriers in exotic climes".
Wiggly Amps & Wobbly Aircraft OOer. . . :ooh:

ACMS

24th Oct 2008, 15:00

Already in those times my friend, Garuda already operate the A330, have done for a long time.

And a lot of Airlines in mainland China and Taiwan and Korea blah blah blah

They seem to cope ok so far.

captplaystation

24th Oct 2008, 20:08

Wait till they get older and end up with less well known operators, although in all fairness the oldest 320's aren't exactly yung. (sorry actually meant young, freudian slip)

dazdaz

25th Oct 2008, 16:14

Some more info.......US military link to Qantas jet plunge | Herald Sun (http://www.news.com.au/heraldsun/story/0,21985,24505353-661,00.html)

ChristiaanJ

25th Oct 2008, 22:17

I REALLY have a lot of problems with how anybody, having even the remotest notions of physics, and aeronautical engineering, can believe a high-power VLF communication station can inject enough energy into an aircraft system (ADIRU... and the AoA sensor if you want to be picky), to cause such a fault.
We're talking about an aircraft at 37000 ft, i.e., about 7 miles away, even if right overhead.

KISS, please.
Electromechanical and electronic faults DO happen......
We don't need little green man to explain them all.

CJ

Capn Bloggs

26th Oct 2008, 00:49

The base uses powerful low frequency radio transmissions to US Navy and Australian Navy ships and submarines.

It is understood to be the most powerful transmission station this side of the globe and includes 13 radio towers, the tallest of which is 387m tall.

The base is named the Harold E. Holt communications station after the former Australian Prime Minister.

ATSB spokesman David Hope confirmed the new line of inquiry today, after "several" groups had raised it as a possibility.

Neville Nobody, you and your "groups" have a lot to answer for! :E:p:D:ok:

CONF iture

26th Oct 2008, 01:15

I believe Harold would have disturbed ADIRU 2 and ADIRU 3 as well ...

Whatever the reason which caused ADIRU 1 to fault, the airplane took control on the base of that single piece of equipment dysfunction, and so in an ugly way.

What a chock for the crew ... curious to hear the CVR.

Also curious to know if ADR1 has been switched OFF after the second upset or did the spikes just quit ?

What happen if a spike value is generated in final …

captplaystation

26th Oct 2008, 12:13

I guess it becomes "the" final approach, rather than "a" final approach. :ooh:

Chris Scott

26th Oct 2008, 15:33

Quote from ChristiaanJ:
I REALLY have a lot of problems with how anybody, having even the remotest notions of physics, and aeronautical engineering, can believe a high-power VLF communication station can inject enough energy into an aircraft system (ADIRU... and the AoA sensor if you want to be picky), to cause such a fault.
We're talking about an aircraft at 37000 ft, i.e., about 7 miles away, even if right overhead.
[Unquote]

Hi Christian,

The trouble with you electronics engineers is that you are too impatient with us mere mortals! I note only that the A330's altitude was probably less than one wavelength of the LF transmission, so a close flyby could place the aircraft exactly one wavelength away on two occasions over a period of less than two minutes. That may or may not be relevant to RFI (probably the latter), but it makes one think.

Most of us have little understanding of the mechanism whereby an electromagnetic wave can induce EMF in a wire, and the latter's possible effects. We are also reluctant to pursue a crash course in elementary electronics. Assuming you have some idea of the order of power of a transmission that is capable of propagating a receivable ground wave across (and under?) thousands of miles of oceans, could you hazard back-of-the-envelope figures of what effect this radiation might have on a (say) 10-metre cable about 15km slant-range from the transmitter array? [I'm suggesting, for sake of argument, that the AoA probe might be about 10m from the ADIRU.]

Could you also tell us if the Faraday cage of the fuselage structure would be even more effective against VLF than shorter wavelengths?

Chris

Luap

27th Oct 2008, 01:16

Could you also tell us if the Faraday cage of the fuselage structure would be even more effective against VLF than shorter wavelengths?

Vlf frequencies are used for communications with undersea boats, because those frequencies can penetrate some metres of water. Higher frequencies cannot penetrate some metres of water. It is the same for the aluminium hull of the aeroplane: lower frequencies can penetrate deeper in the aluminium. So i think vlf will not totally be shielded by the aeroplane hull, while higher frequencies will be shielded by the aluminium. However, uhf frequencies will enter the plane via the windows.

Volume

27th Oct 2008, 09:56

The base uses powerful low frequency radio transmissions to US Navy and Australian Navy ships and submarines.
Does anybody know by heart the frequency range tested during L/HIRF certzification tests? (there must be some FAA-AC around specifying the frequencies to be tested), and does anybody know the "low frequency" used to communicate with subs? Are we talking kHz range, or lower?
Maybe nobody thought of such low frequency high energy radio transmissions when dsesigning the electromagnetic shielding of the computers ?

ampclamp

27th Oct 2008, 11:45

the tx in question is I believe 19.8 khz.ABC radio in Melbourne for example is 774khz so that will give you some idea how low it is.
this theory has been discussed at some length on this or another thread dealing with the same incident.what hirf freqs are used for testing no idea.
the wavelengths at these low freq's are enormous (15 kms)and for a number of reasons most of us have discarded the theory.
Does not mean we are correct,just means some of us agree.
for "it" to get in and selectively target one system would indicate big shielding and filtering issues.
vlf is not new and I could not believe filtering and shielding against any rf that could interfere would be dealt with.Shielding and LC ccts are very effective against rfi.
electronics maufacturers also need to deal with the harmonics of signals also the beat freq's as well as the fundamentals freq's.
Whilst other info would be superimposed , for example, on the carrier or sidebands of the fundamental the strength of those is normally less and refer to the above shielding and filtering of unwanted freq's.

philipat

27th Oct 2008, 11:51

Maybe nobody thought of such low frequency high energy radio transmissions when dsesigning the electromagnetic shielding of the computers ?

I think we are off chasing a red herring similar to the Gordon Broen radio interference herrings in the BA038 incident.This base is NOT new and it lies directly beneath the flightpath from DPS-PER. As far as I am aware, none of these flights have fallen from the sky over the years?

neville_nobody

27th Oct 2008, 12:39

This base is NOT new and it lies directly beneath the flightpath from DPS-PER. As far as I am aware, none of these flights have fallen from the sky over the years?

True but since it is all secret squirrel we don't really know everything that goes on there. Similarly there would be no point in pontificating because noone really knows and those who do won't be posting it on here. And in reality even if the ATSB rang up the Navy they won't be telling them to much either.

Theres a bit of official information on the net and some research papers published but how this stuff could affect an aircraft is really unknown.

ChristiaanJ

27th Oct 2008, 17:24

Chris Scott asked for some back-of-the-envelope figures.

I'll start with some very simple assumptions, then we'll see if there are any major errors in those assumptions.

Published frequency 19.8 kHz, say 20 kHz = wavelength 15 km.
Published power 1 MW (1,000,000 Watt = 10^6 Watt). Let's assume this is radiated power rather than the transmitter power.
Transmitter is a "point source", radiating evenly into a hemi-sphere above the station.
Aircraft at 11 km high (36000 ft) and a slant range of 16 km (45° above the horizon).
Aircraft is a 777, which we can consider as a 60 m long and 6 m thick cylinder, presenting at most a surface of 360 m² to the transmitter.

Surface of the hemi-sphere = 2 * pi * r^2 = 6.3*(16000)^2 = 1600 * 10^6 m². With 10^6 Watts radiated, the power at location of the aircraft is 1/1600 W/m², so the entire aircraft structure intercepts about 0.225W, about 1/6th of the power of the bulb in a typical flashlight/torch.

I'll have to leave it to an antenna expert to tell us exactly what voltages and currents are induced in a cylinder that is a minute fraction of the wavelength, how much will be simply dissipated in the skin (skin effect, Faraday cage effect) and how much of it would be detectable inside.

One of my assumptions is that the transmitter radiates evenly into a hemisphere. In practice, we see huge antenna farms on the photos, with dimensions in the order of half a wavelength, so we can expect the radiation to be at least somewhat directional in both the horizontal and vertical plane. But it seems unlikely to me, that gains of more than 3 to 4 are obtained in any one direction.

My other assumptions of course are the actual distances: 16 km slant range and 11 km height and 45° above the horizon. Since there is an r_squared involved, reducing the slant range to 11 km will roughly double the power. I haven't done that because usually the "overhead" power of a transmitter installation is less than that at lower radiation angles.

So OK, even if I'm out by a factor 10 or so, the total power arriving on the skin of the entire aircraft is still about that of the bulb in a flashlight. Only a fraction of that will get "inside". To actually affect the electronics (not the radio, but the electronics such as the ADIRU), something already has to be very seriously wrong with those electronics.

CJ

ChristiaanJ

27th Oct 2008, 23:02

Let me add some anecdotical "evidence".

http://www.concordesst.com/pictures/gbsst1.jpg

Have a careful look at the forward part of the fin. See the two green-brown vertical "slashes"? They are indeed two "slashes" into the metal structure, covered by "radio-transparent" fibreglass, and for some reason never painted over until nearly the end of the flight test programme. They are there on all Concordes, but painted over on the others.

They are the HF (high-frequency) slot antennas.
In the olden days, a wire strung from the cockpit back to the fin would do the job, but that wasn't really acceptable in the supersonic era....
But a slot cut into a metal structure, closed on the inside, and connected to a radio transmitter, will radiate HF energy.
So that was the solution on Concorde, and you will find similar solutions on most present-day airliners.

However.... a radio engineer will tell you that such a slot aerial at HF frequencies is not exactly the most efficient, and will set up very high high-frequency currents in the surrounding structure.
As happened on Concorde.

So.... here we had an 100W HF transmitter, directly connected to the airframe, and trying to radiate at least some of its energy.... but some it just got dissipated in the structure (SWR not quite one, for the experts).

As it so happened, the yaw rate gyros, part of the autostab system, were mounted precisely in this area.

Guess... when we started to test the HF radios on longer-range flights, we found the tail wagged and twitched a bit whenever somebody talked on the HF radio....

Even so, it took us some time to correlate the twitches with the autostab. A small filter solved the problem.

Moral of the story?
Nearly forty years ago it took us 100W injected directly into the structure of an aircraft (still being flight tested, mind you) to provoke a mere 'twitch' in an analog control system.

Less than a milliWatt/m² of VLF impacting on an aircraft, from a facility overflown regularly, and suddenly causing a malfunction in an electronics unit (ADIRU or AoA sensor)? Try another one, this one has bells on.

CJ

Litebulbs

27th Oct 2008, 23:09

CJ,

Two absolutely excellent posts.

Bulbs

ChristiaanJ

27th Oct 2008, 23:51

CJ,
Two absolutely excellent posts.
Bulbs
Thanks.... !
I'm just trying to plug in some figures, so at least we know what we're talking about.

In this case, a remote-probability ADIRU or AoA sensor failure looks more likely than an equally remote-probability ADIRU or AoA sensor failure PLUS electromagnetic interference from a nearby VLF facility at a negligeable power level.

If you get my drift?

CJ

Yamagata ken

28th Oct 2008, 00:58

Thank you very much for the numbers. The "facility" has been there for many many years, and I have PAXed over it many many times on my way between Perth and the Pilbara. Nary a twitch in the BAE 146.

Elsewhere I've given up on conspiracy theorists. The 9/11 conspiracy inverted triangle relies entirely on the twin towers being "aircraft-proof". So far, no-one has been able to provide specific information about the particular "aircraft-proof" engineering details. That doesn't stop the chatter. The stupid being lead by the wilfully ignorant... :ugh:

Chris Scott

28th Oct 2008, 14:41

Thanks Christian,

Just the laymen's explanation I was hoping for.

It's been commented that aircraft have been passing the facility for years; but we don't know how often the transmissions take place, nor their duration, nor if there might be protocols to avoid them when aircraft are expected. If your figures are of the right order of magnitude, however, further discussion of VLF signal dissipation by Faraday cage and skin effects would seem to be academic.

As for any concentration of transmitter energy by a directional effect, I agree (in the apparent absence of any antenna experts on PPRuNe) that the array would appear to be incapable of anything in the vertical plane. Also, any intentional concentration would presumably be directed horizontally, to increase the power of the ground wave towards a nautical target receiver. Hardly like Fylingdales...

[Re your Concorde HF Tx problem, the autopilot of one of our DC10s suffered something similar for weeks before anything was done about it. Rather annoying, having to remember to disconnect it before transmitting.]

Don't suppose Qantas was working HF?

Chris

ChristiaanJ

28th Oct 2008, 15:59

Chris,
I also just noticed that apart from the frequency/wavelength, the whole installation is pretty much like a longwave broadcasting station. Those use much the same transmitter power, between 0.5 MW and 2 MW, mostly. The wavelength is about 10 times less, e.g., BBC longwave operates on 1500 metres.

Now I have no recollection of airliners bouncing all over the sky all over Europe when passing over a longwave transmitter (and there are a fair number).

I think we can lay this one to rest......

MrCyberdude

28th Oct 2008, 17:06

Anyone hear about another Qantas emergency?
Something along the lines of....

Rumor STARTS

On Sunday 26th October 2008 around 6pm Singapore time a Qantas flight had an emergency landing at Changi(SIN) airport.
Fire trucks were deployed and one of its runways was closed to facilitate this.
Aircraft was towed to gate and SLF departed.

Rumor ENDS

sevenforeseven

28th Oct 2008, 21:10

Come on man, give it a break!!!:ugh: I do not fly for QF, but its NO big deal. Leave QF alone.:mad:

WindSheer

28th Oct 2008, 21:19

I agree.

Could have been a burst tyre on takeoff...:ugh:

Give it a break!:mad:

Ron & Edna Johns

29th Oct 2008, 01:22

FFS....

Facts: Aircraft blew a tyre during departure FRA. No indications of any other damage. Upon arrival it turned out that a gear sensor had been taken out by the tyre, so crew got GEAR UNSAFE message when selecting Dunlops down. They went around, ran the C/L from the QRH, came back and landed safely. No drama. End of facts.

Like it's never, ever, happened before to any other airline or aircraft....

Nothing to see here.

4PW's

29th Oct 2008, 07:12

The LA to SYD flight is a new low.

Getting embarrassing.

Arnold123

29th Oct 2008, 07:35

I also just noticed that apart from the frequency/wavelength, the whole installation is pretty much like a longwave broadcasting station. I love this forum and thanks for this.

========================================
Arnold

HotDog

29th Oct 2008, 10:14

The LA to SYD flight is a new low.

4PW's, I think your comment is embarrassing. You call yourself a B744 pilot? So what would you do if you had a weather radar failure in mid Pacific? Carry on and fly into the next cb? In my opinion, QF did a very resourcefull thing by following NZ.:rolleyes:

Chris Scott

29th Oct 2008, 12:49

Quote from Arnold123:
I also just noticed that apart from the frequency/wavelength, the whole installation is pretty much like a longwave broadcasting station.
[Unquote]

Welcome! Yes, they're an endangered species over here, unfortunately. The old BBC transmitter at Droitwich that Christian refers to, currently broadcasting Radio4LW on 198 kHz (used to be on 200kHz, until rationalised to a multiple of 3 by some convention), is a valuable nav-aid for all sorts of purposes. Powerful and reliable for off-airways flying in Britain, and – if you have a suitable receiver – a good way of finding north (as well as monitoring the Test-Match) when you are travelling in the south of France... No doubt fishermen 500 miles off shore still use it for navigation if their GPS goes on the blink, as well as for receiving the shipping weather-forecasts.

All analogue broadcasting is being phased out in the UK in the next few years, and shutting down Droitwich will save the BBC, admittedly, a great deal of money. But it'll be a sad day, particularly for those of us who are still fascinated by long-distance radio transmissions.

The Droitwich antenna array masts go up to about 700ft agl, but – as far as I know – there are still no special flying restrictions. As Christian says, aircraft are not generally known to suffer RFI effects in their vicinity, even at low level.

ampclamp

30th Oct 2008, 07:13

Thanks for that CJ, I think you (and I ) have done it to death.
The point is, even in the remotest chance that the tx had anything to do with this incident (I'll do a nude run down any main street you can name if it is proven) it would still be a fault with the aircraft/component by way of shielding, bonding or filtering.Aircraft are bombarded by a multitude of RF signals from within and out and are built with that in mind.
Over and out.

NSEU

30th Oct 2008, 08:12

The LA to SYD flight is a new low.

A new low for... newspaper reporting.

The reliability of new generation weather radar antennae is outstanding. I used to have to replace faulty ones every second month. Now I hardly ever hear of a failure... but it's still not what one would call "newsworthy".

Today's Australian Daily Telegraph article on this referred back to the Airbus incident, claiming that it suddenly dropped 2000 meters (even after the DFDR data had been released to the public). According to this particular newspaper, Qantas is now responsible for manufacturer faults. Huh?

Also reported was the fact that the aircraft arrived four hours late... which is probably about six hours sooner than it would if it had turned back to LAX.

The crew showed some initiative, but it's not like it's never been done before.

The expression "flying blind" has been bandied about.... as if the pilots could lose their way, flying in cloud :rolleyes: Maybe they haven't heard of IRS, GPS, Satcom weather reports, TCAS....

Another slow news day....

awqward

1st Nov 2008, 06:22

Although manual control was resumed after "a few seconds", it seems that upon encountering the sudden uncommanded pitch down the PIC's instant first (and natural) response was to pull back on the stick - all the way back... which the aircraft ignored! This may be the "airbus way" but it would be a very unnerving experience for any pilot.

radeng

1st Nov 2008, 11:13

Further to ChristianJ's calculations, actually radiating 1MW at 19.8kHz is pretty difficult. Antenna efficiencies are going to be low, especially as the highest tower is of the order of 0.025 wavelengths. This means a very low feed impedance and doubtless a high reactance, so the losses in the matching will be pretty enormous. To actually radiate 1MW will probably need something of the order of 50MW of RF out of the transmitter. Not impossible, but you need your own power station!

CONF iture

3rd Nov 2008, 01:44

This may be the "airbus way" but it would be a very unnerving experience for any pilot
When you have absolutely no clue what's happening, that's the time you start doubting heavily your usually so reliable piece of equipment.
Helpless feeling ... What's coming next ???
For sure that crew was only relieved once on the ground, and maybe not so keen to go back in their once beloved 330 ... ?

The 9/11 conspiracy inverted triangle relies entirely on the twin towers being "aircraft-proof"
I can accept my link didn't make it in this thread, but it was just a reply to your so poorly informed comment, which is still surprisingly allowed to stand in this same thread ... !?

grizzled

3rd Nov 2008, 08:54

I think the possibility of EMI being involved in this (and/or other incidents) is being too easily dismissed by some. (And NO, I am not saying that I'm sure this is the case here!)
Though the math is no doubt correct (I'm definitely not qualified to question it) on the posts relating to propagation, I think there is some confusion between carrier frequencies and RF energy itself. For instance ELF (extra low frequency) is tricky stuff and as I'm sure some ppruners are aware it can be used it as a weapon. The principal is the same as an EMP burst, as ELF can generate high intensity EM field and unfortunately any "electronics" can be susceptible -- especially gyro-based computer components. Previous comments about higher frequency RF are in principal correct, but there is also reason to discount the notion that whatever transmitter(s) may be involved, they would be directed at the surface, as opposed to the ionosphere.
Lots of sources of interesting info out there, but for many, this might be an interesting start: High Frequency Active Auroral Research Program - Wikipedia, the free encyclopedia (http://en.wikipedia.org/wiki/High_Frequency_Active_Auroral_Research_Program)

Grizz

Teal

13th Nov 2008, 23:03

From the Melbourne 'Age' newspaper - Naval base signals may have led to Qantas jet plunge | theage.com.au (http://www.theage.com.au/national/naval-base-signals-may-have-led-to-qantas-jet-plunge-20081114-66lg.html)

Naval base transmissions may have led to Qantas jet plunge
Brendan Nicholson
November 14, 2008 - 10:46AMCivil Aviation Safety investigators are considering the possibility that transmissions from the top-secret joint US-Australia naval base near Exmouth may have caused a Qantas aircraft to dive suddenly last month, seriously injuring a flight attendant and at least 13 passengers. The base in Western Australia is used by the US Navy to communicate with its nuclear submarine fleet in the Pacific and by the Australian Navy to maintain contact with its fleet of six Collins-class submarines.

Kerryn Macaulay, of the Air Transport Safety Bureau, said yesterday it was considered unlikely that a low frequency transmission from the Harold E. Holt transmitter near Exmouth could have caused the problem but that possibility was still being investigated.

She said it was also possible that an electronic device being used by a passenger might have interfered with the aircraft's computer system.

Ms Macaulay said examination of information from the aircraft's flight data recorder indicated that at the time the aircraft's autopilot was disconnected.

DocSullivan

13th Nov 2008, 23:11

The ATSB just released their preliminary report on this accident. Here's the link (43 pages - 'pdf'):

http://www.atsb.gov.au/publications/investigation_reports/2008/AAIR/pdf/AO2008070_prelim.pdf

Here's the media release that accompanied the report (includes brief synopsis):

MEDIA RELEASE : 14 November 2008 - ATSB Preliminary Factual Report, In-flight upset, Qantas Airbus A330, 154km west of Learmonth, WA, 7 October 2008 (http://www.atsb.gov.au/newsroom/2008/release/2008_45.aspx)

Barkly1992

14th Nov 2008, 00:24

Its the mice I tell ya!

:ok:

Fragman88

14th Nov 2008, 02:57

Sorry, late to this thread, but many years ago in a B737/200 over N Wales around FL370, inbound to MAN, the A/P pitch channel dropped out for no apparent reason (1 A/P, separate Pitch & Roll channels --High Tech stuff). It was duly re-engaged and a few seconds later dropped out again, again with no warnings. Last try attempted, and stayed in for a few seconds, under close supervision, then once more out she goes, but his time with the Skipper's hands on the stick and a lot of attention we saw/heard there was a momentary stick shake (Stick Shaker activation automatically takes out the A/P Pitch channel).

Continued to MAN uneventfully, and were sitting on the ramp with the Tech Log out, wondering how to write this up so it made some sense, when the Ground Engineer arrives. Seeing our puzzlement he says "Autopilot Pitch Channel?" we both nod. "OK" he says, "Write `FL3X0 over N Wales. Repeated A/P Pitch Channel disconnects with momentary Stick Shaker activation'. "How do you know that?" we ask.

"Third today, the military must be up to something around the LLanbedr ranges!" (Lots of live ranges, radars etc in that area).

Different A/C. Different place and time, but similar results.

Fragman :E

arcniz

14th Nov 2008, 05:34

Volume thoughtfully queried:

Does anybody know by heart the frequency range tested during L/HIRF certzification tests? (there must be some FAA-AC around specifying the frequencies to be tested), and does anybody know the "low frequency" used to communicate with subs? Are we talking kHz range, or lower?
Maybe nobody thought of such low frequency high energy radio transmissions when designing the electromagnetic shielding of the computers ?

Although physics still works about the same as in the past, the character of possible radio waves and transmission schemes, at nearly all wavelengths and energies, has become much more complex over the last twenty years. The is the result of significant innovative developments in electronic components, in novel signal generating and processing means, and other bits of technology that depart ever further from the serenely pure model of a basic Marconi wireless - the model that often prevails in specifications and testing for EMI toughness in systems and products.

This is not a proper place for discussion or detail about exotic advances in electromagnetrickery, mumble, mumble, but your suggestion, Volume, that industry standard testing specs and methods re EMI are out of date and insufficient may be valid, in light of quite recent developments, and possibly is worth pursuing further in a more formal context.

Kiwiguy

14th Nov 2008, 06:45

I think we are off chasing a red herring similar to the Gordon Broen radio interference herrings in the BA038 incident.This base is NOT new and it lies directly beneath the flightpath from DPS-PER. As far as I am aware, none of these flights have fallen from the sky over the years?

How about Egyptair flight 990 ?
Autopilot disconnected just like the Skippy bird did.

USA was full of 9/11 hysteria so the co-pilot had to be blamed.

USA also has OTHR radar over the Atlantic like the Jindalee system. UK also has an OTHR system pointed towards the Atlantic.

There are a lot of vested interests from Governments to aircraft manufacturers out there who don't want to admit that electronic interference can flip out systems on commercial airliners.

fdr

14th Nov 2008, 07:10

B]kiwiguy:
How about Egyptair flight 990 ?
Autopilot disconnected just like the Skippy bird did.

er, did you ever look at the DFDR of that plane? or hear the CVR? if not, please refrain from sprouting nonsense. :ok:

[The QAR records the methods of disconnect.... which kinda blows a "whole" in your supposition of commonality or conspiracy or I know not what...]

The parameters of the DFDR were adequate to identify exactly what was being done on the flight controls of MSR 990, and the system behavior was completely consistent with the inputs, as were the flight dynamics. Additionally, please don't bring in any reference to Silkair 185, the data and the dissenting opinion on the report are convincing, as were the mcab flyouts of the reconstruction. :ugh:

There are adequate real issues to contend with....

overthewing

14th Nov 2008, 10:53

How about Egyptair flight 990 ?
Autopilot disconnected just like the Skippy bird did.

USA was full of 9/11 hysteria so the co-pilot had to be blamed.

Egyptair 990 crashed in 1999, 2 years before 9/11, so '9/11' hysteria did not exist. Suspicions about the co-pilot's actions were mooted well before 9/11, if I remember correctly.

CONF iture

15th Nov 2008, 05:08

The crew reported that the messages were constantly scrolling, and they could not effectively interact with the ECAM to action and/or clear the messages.... very confusing indeed.

Where is the switch "SVP NO PROTECTION" ?

That FO could almost look suspicious ... left the flight deck only one minute before the initial ECAM FAULT and returned only a full 5 minutes after the first upset ... ;)

uffington sb

15th Nov 2008, 05:27

Kiwiguy
AFAIK we only had one OTHR and that was at Orford Ness pointing east, as shown in the excellent 'Coast' tv programme.
It didn't work and was dismantled years ago. I believe that there was one planned for the Brawdy area in Wales, but that was never built.

Wod

15th Nov 2008, 07:08

In Australian media the VLF people at the facility near Learmonth have been sort of quoted as saying "we've been there a bloody long time and no aircraft operator has complained, and anyway we are not the only VLF facility located near commercial airways, and none of them have been cited either."

Methinks the ATSB put that reference, plus the one to passenger operated devices, into the report in order to placate who knows who.

They will look at both because they are thorough professionals, but clearly the onboard gear is the prime suspect, and greatest worry.

SLF3b

15th Nov 2008, 09:55

In the light of the report, perhaps someone should open a new thread so that all those who posted that it was CAT and that they should have continued to Perth can post retractions without distracting the VHF brigade?

flynerd

15th Nov 2008, 11:30

I think that it is a real stretch to say that the QF incident might be related to the US NAVCOMSTA at Exmouth Cape.

The recently released initial ATSB report says the incident occurred 154km west of Learmonth. That would make it about 170km W-S-W of the NAVCOMSTA at Exmouth Cape.
This is much further from the transmitter than inferred in reports on this forum.

Here is a ground track of the flight showing where the problem occured.

http://i37.tinypic.com/287n2o0.png

Had the flight track been directly overhead the transmitter then perhaps there may be some correlation.

Flynerd

tubby linton

15th Nov 2008, 11:40

Those of you who like a good conspiracy theory may be interested in this link and the article it links to!
AN AMERICAN VLF TRANSMITTER SITE...OR WAS IT? (http://www.godfreydykes.info/AN%20AMERICAN%20VLF%20TRANSMITTER%20SITE...OR%20WAS%20IT.htm )

Christodoulidesd

15th Nov 2008, 17:49

It was the evil green men who did it :}

ChristiaanJ

15th Nov 2008, 20:10

The recently released initial ATSB report says the incident occurred 154km west of Learmonth. That would make it about 170km W-S-W of the NAVCOMSTA at Exmouth Cape.
This is much further from the transmitter than inferred in reports on this forum.Thanks for the info, flynerd!
I'll redo my calculations next week... we have friends for lunch this Sunday.
But applying the usual square law, at first sight you can divide my figures by a hundred.
My figures were based on a near overflight in the main lobe, at aout 15 km range...
Those of you who like a good conspiracy theory may be interested in this link and the article it links to!
AN AMERICAN VLF TRANSMITTER SITE...OR WAS IT?Thanks to you, too
I absolutely love those conspiracy theories :)

Have you noticed how often you can just deduct from the mere style of the article, or post, or whatever, that the author is telling porkies?
Much like the intonation of the opening sentence of a telemarketer....

CJ

fdr

16th Nov 2008, 00:06

didn't work...?

Of historical note only:

Well, the original UK radar trials were conducted at Orfordness with the Radio Research Station setting up from 13 May 1935 on site, under the direction of Sir R. Watson Watt (& Wilkins, Bainbridge-Bell, and Bowen). Initial transmissions were by a transmitter using huge NT46 valves ex navy, at 5,000V input, giving approximately 20-25kW output @ 50mtr freq, which was boosted to 12,000V giving 200kW. The early tests showed echoes from [parts of] Europe over 2,000 miles away. The first aircraft tracked was a Scapa flying boat at a range of 17 miles, on 17 June 1935.

The initial freq selected, 50mtr was expected to give a good return on the dipole resonator of the expected target aircraft wingspan, but due to excessive interference the freq was increased to 26mtr, then 10-13mtr which remained primary radar freq through Round II.

The tactical requirement of the Air Ministry (Dowding) under Tizzard's Scientific Committee's position was to address defense requirements below 100nm. The OTHR effects were identified but discounted as a nuisance at that time.

well before Jindalee was initiated, "woodpecker" interference was received from what was DF'd as USSR on HF freqs, (back in 60's and early 70's), which was consistent with OTHR trials.

ref: Radar Days, E.G. Bowen, Published by Adam Hilger, Bristol UK. 1987 ISBN 0-85274-590-7
Metres to Microwaves, E. B. Callick, Published by Institution of Engineering and Technology, 1990 ISBN 0863412122

Sir Robert Watson-Watt (http://www.radarpages.co.uk/people/watson-watt/watson-watt4.htm)
AAS-Biographical memoirs-Bowen (http://www.science.org.au/academy/memoirs/bowen.htm)
CSIRO PUBLISHING - Historical Records of Australian Science (http://www.publish.csiro.au/paper/HR9920920151.htm)

limelight

17th Nov 2008, 03:11

from today's Crikey e-zine

Secret data may give Qantas a QF72 clue
Ben Sandilands writes:

A secret partition (internal computer wall) on the US-made air data inertial reference unit (ADIRU) that Qantas blames for the in flight crisis that forced QF 72 to make an emergency landing at Learmonth on 7 October is about to be unlocked.

Its existence, only hinted at in the preliminary ATSB report into the accident, is causing consternation among airlines for whom there is now a question mark over the serviceability of equipment critical to the control of modern airliners. They simply don't know the full information held by the ADIRU.

Crikey has been shown part of a private Qantas presentation on the accident, which injured 60 of its passengers and 14 of its crew aboard the Airbus A330-300 involved.

It draws attention to frequent unusual movements in the tail of the jet and disclosed that all three ADIRU units had be sent back to the maker, Northrop-Grumman because of third level data that was partitioned from examination by operators or accident investigators and could only be read in the Northrop-Grumman workshops.

This deeper level of data is apparently prohibited to users to protect proprietary aspects of the design from being copied or interfered with.

However the issue that has now emerged for the carriers including Qantas is that this secrecy might prevent them becoming aware of any deeper layer faults that should be fixed before an airliner is allowed to continue in service.

The Australian, French and US incident investigation authorities, and Airbus and Qantas will all be present this week when Northrop-Grumman starts unlocking all of the data contained in the three units on the A330, the two that appeared to work properly, and the one that ran amok.

pattern_is_full

17th Nov 2008, 03:12

"The original UK radar trials were conducted at Orfordness ....The early tests showed echoes from Europe over 2,000 miles away."

Suffolk having been transplanted for the tests to the east coast of Canada? :hmm:

I heard this RFI story from an editor friend who ran the newspaper outside the Bremerton Navy Base in the NW US. When the Associated Press began sending photographs via digital satellite instead of land-line fax around 1990, pictures that arrived around 6 a.m. each day were scambled. As an afternoon paper that printed at 10 a.m., this meant some of the best newsy news pictures from the Gulf War I were getting toasted right on deadline.

After a little investigating he discovered that all the big aircraft carriers in port tested their search radars at 6 ack-emma, and that all of them pointed directly at the newspaper's satellite reception dishes (ships lined up in parallel berths facing the town.) The beams were turning the incoming AP signals into guacamole.

That was at a range of about 1 mile or less, though.

That Crikey story at first listen sounds a bit like finding a false bottom in your wastebasket and blaming it for all your mistyped pages - but maybe it will go somewhere.

Rob W

10th Mar 2009, 01:59

See new interim report here: aair200806143.aspx (http://www.atsb.gov.au/publications/investigation_reports/2008/AAIR/aair200806143.aspx)

Key new points:
1. Testing discounts Leamonth VLF interference.
2. No fault found with ADIRUs so far; testing continues.
3. PRIMS usually filter spikes from ADIRUs, but fail to filter rare combinations of spikes. Only applies to A330/340.
4. ADIRU 1 generated many spikes. Two sets appear not to have been rejected by PRIMS and resulted in nose-down events. Subsequent events explained by as-designed fall back response.
4. Three other similar incidents (all having no ill effects) uncovered (4 total, all QANTAS or Jetstar)
5. Reproducible situation identified where loosely fastened seatbelts can disconnect if passenger propelled upward.

Curiouser and curiouser...

bsieker

10th Mar 2009, 10:20

I think everyone is missing the point.

The problem is not that the ADIRU 1 sent "erroneous and spike" values. ADIRUs are known to fail occasionally, that's one of the reasons why there are several of them.

This is evidence of a serious flaw in the Airbus FBW control software in the A330/A340 PRIMs (Flight Control Primary Computers).

Spike filtering is essential, and "the manufacturer advised" that there was "an issue" with the software, in which AoA spike values could be passed on to the control algorithms in certain conditions.

It is not unexpected to people involved with high-reliability software for safety-critical systems that it appears to be a requirements/specification problem.

There is a temporal sequence of AoA spike values (I will call it "Critical Spike Value Sequence", CSVS) from the ADIRUs that will get past the spike filtering and be interpreted by the flight control/envelope protection algorithms as real values.

It appears that the software develeopment process at Airbus is not quite what it should be.

Either the algorithms were specified incorrectly and the emergence of CSVS is inherent in the algorithm, or the algorithm was implemented incorrectly, and the emergence of CSVS is an artifact of implementation issues (coding/compiler/linker/hardware). According to the report, Airbus identified a problem with the algorithm, so that points to the first alternative.

Either way it is a strong case for the need to use formal methods for both requirements elicitation, ensuring their completeness
and adequacy, and for implementation, using state-of-the-technology "Correct-by-Construction"-methods.

Bernd