LH A320 reportedly within 0.5m of crashing at FRA !!

[Doors to Automatic]

As reported in Flight International today a Lufthansa A320 almost crashed at FRA on 20 March because of faulty reverse wiring on the captain's sidestick!!

The aircraft hit turbulence shortly after lift-off resulting in a left wing-down. The captain responded with a slight right input but the plane banked further left. A further right input resulted in a 21 deg wing-down at which point the wing dipped to within 0.5m of the ground!

At this point the first officer, realising what was happening, switched his sidestick to priority and recovered the aircraft, preventing an almost certain crash.

I'm glad I wasn't a passenger on that flight!!!

[Mr Benn]

I wonder if LH do control checks on the ground? This should have shown up this fault. Airbus also recommend it and say that you should hold each stick position for 3 seconds as it takes that long to generate the fault message. They also recommend checking your screen to check that left stick really is left stick.
Interesting.

[Magplug]

This seems almost implausible. The control check SOP requires the non-handler to monitor the inputs of the other guy on the flying control ECAM page. He then repeats the process himself with his sidestick. This is normally done during the taxy out.

Even if both guys do this with their eyes shut then an ECAM warning is generated to the effect that the spoilers or ailerons are not responding as expected to the pilot input.

The logic for this warning was changed after the Excalibur incident where due to a maintenance error the aircraft became airborne with several pairs of spoilers hydraulicly isolated and therefore not responding.

It was believed the crew missed it on that occasion because the trigger time was too long. This was corrected to a much shorter time for detection of lack of control response to pilot input.

FI don't usually get it wrong ???

[Pelican]

The article does mention that on previous maintenance action two pairs of pins inside the connector of the captain's controls had accidentally been crossed. This resulted in a change of polarity of the sidestick. Apparently this bypasses the control unit which senses the error and triggers a warning.

This, of course, does not mean that they shouldn't have caught it on the flight control page of the ECAM during the flight control checks. The article does suggest that most pilots tend to look for a deflection indication rather than checking the direction is correct as well. In a rushed environment, or with a distraction, I don't think that is implausible.

[scanscanscan]

And of course it was also signed off and fully checked by the best DLR tested engineers in the world, or was this done just to DLR test the pilots?

------------------
We will do the drill according to the amendments to the amendments I er think?

[exeng]

Full marks to the F/O for quick thinking therby avoiding what would have been a tragic accident. That particular F/O has certainly earned a lifetimes worth of salary - well done!


Regards
Exeng

[411A]

AirBus technology at its best. And, with a first class operator. Woe-be-tide the third world airlines who are stuck with this equipment.

[Four Holer Roller]

Good grief...411a has an opinion on almost everything in aviation!! What a guy..or is that S.O.G.? See Fragrant harbour!

[exeng]

411A,

'AirBus technology at its best.' Perhaps 'Airbus technology at it's worst' might have been a more appropriate coment.

Clever though the Airbus is, the 'system' allowed both engineers and pilots to depart with an aeroplane that was cross controlled in roll. (Albeit on one side only).

That is worrying.

Again, full marks to the F/O who saved the day.


Regards
Exeng

P.S. I'm currently on an A320 course and after reading 'Flight' this morning haven't got any fingernails left!!

[OldAg84]

If the signal was capable of being reversed-why wouldn't the plug itself prevent it? The one round hole and one square hole idea.

[GotTheTshirt]

Oldag84
If the pins in the plug are crossed (and they are all identical) then it will defeat the indexed plug, which they undoubtably are. The real problem is the after defect check out by engineers ( plus of course any preflight checks.

411A - is that the type of Cessna you fly ?

[RRAAMJET]

One wonders, if this had ended in tradgedy, where would that have left Airbus and it's much-vaunted technology? What would the public think? And I'm fully aware that this can happen to conventional control systems, as well ( I remember a C-130 and an F-4 having reversed controls, from my RAF days).

Worrying.

[Huck]

Piper Aircraft lost two flight test pilots in a Navajo that way, back in the seventies....

[PaperTiger]

...and Roy Chadwick in the Tudor.

[411A]

GotTheTshirt---
Indexed plugs, wrong wiring, a bad combination. Wonder if the investigation will be swept under the rug. Sure hope not.
The F/O sure was on the ball.
'Tis a very good reason WHY the F/O should have plenty of sectors. Wonder if the CX guys are listening?
CE411A is the personal aircraft, L1011 the professional type.

[This message has been edited by 411A (edited 22 May 2001).]

[Lurk R]

Hypothetical here - despite the magnificent efforts of the F/O, should the whole thing have gone pear-shaped with the unfortunate crash of the aircraft, would there have been enough evidence to have shown that crossed pins was a cause rather than erroneous banking associated with turbulence?

[crewrest]

.......or the flight control check not allegedly being carried out properly.

Also 411A does have a valid point about a first class operator, what happens a few years down the line

[Bigpants]

I hope that the Lufty pilot's make full use of this incident in pursuing their pay rise.

It would be interesting to see how the "Management" tried to tell the travelling public that this FO was not worth a rise.

[Hung start]

Right there, the two LH pilots earned the payrise that VC is demanding. Manyfold!! Good job guys!


Oh sorry Bigpants, I just mirrored your post :)

[This message has been edited by Hung start (edited 22 May 2001).]

[Oblaaspop]

Have any of you guys that continually slate Airbus technology, stopped to consider what would have happened, if it had have been a conventionally controlled aircraft that had its controls rigged the wrong way round?

They wouldn't have stood a chance, even if the F/O was as quick as lightning, at least on an Airbus you can isolate the opposite control stick.

So I would say that on this occasion it was BECAUSE of Airbus technology that a major incident was avoided!!!!!!!!!!

[Frederic]

Oblaaspop, great minds think alike. I am very pro Airbus myself and I stongly agree with the point you're making. HOWEVER, flying being the dangeourous bussiness it is, this incident shows that aircraft safety technology as well as good pilot training still have a long way to go. Don't get me wrong, the pilots did a great job in catching a possibly leathal fault, but the fault passed two safety "filters". The first one was the fact that the fault was not detected by ECAM (technological problem) and the second one was the fact that the pilots did not spot the fault during one of the most important checks we do: the flight controls check. I say again, I am not pointing my finger at pilots (bless them), we all miss out things. But from a pilots' point of view this incident shows that you can never take anything for granted and that there is still a very good reason why there are TWO pilots(humans) in a cockpit.

[Paterbrat]

Indeed a very valid point in favour of the 'bus'.
Have been a Boeing driver haven't flown the bus but see no reason to knock it. The problem of crossed contols can and has been done on convential aircraft and in this case the plane has been saved by it's design.
Well done Airbus.

[CHAPARRAL]

Mr Benn
Regarding your post, can you please point out where exactly did you come across the 3 second delay for the fault flight control to come up?
I got that info as well but with no referance (FCOM or FCTM)
Thanks in advance

[Bus429]

Did you lot read the rest of the report or were there too many big words? F/O did a great job (I mean that!)
Connector - whether indexed or not, crossed pins would not have prevented the connector from correctly engaging. (Contacts/receptacles are the correct term). If Flight report is true, there is no excuse for not having done a continuity check on completion (a primary FCS!!!)but there again, what did ADRES tell him to do? This constitues a repair and would be covered under ATA 20 Wiring Practises.The engineer had allegedly only done a flight control function on the right stick. Do Lufthansa/LBA procedures demand a duplicate inspection? Do Airbus classify it as a "vital point"? They may have deemed this incident impossible with the system as currently designed. Another problem, FBY systems make such a repair or maintenance (on the side-stick) the reponsibility of both ATA 27 & 22 (flying controls and auto-flight) disciplines. Was there confusion or another Human Factors issue? Was the engineer being pushed to get the job done quickly? Had the crew performed a correct sense check (think about Excalibur a few years ago)?
Accidents are caused when a chain of relatively insignificant incidents link up. Think of James Reason's analogy of the spinning discs or the Swiss Cheese model.


------------------
Bus429 - the pilot's pal!



[This message has been edited by Bus429 (edited 22 May 2001).]

[TvB]

Hi everybody,
I'm the author of the FI article and unfortunately it got a bit shortend.
To get the heat a bit down (or turn it up - as you might see it) here some more facts, which are as well available on my webpage at www.aviationsafetyonline.com (http://www.aviationsafetyonline.com) :


A proper flight control check has been conducted. By the mechanics and by the crew, prior to take off. The problem, as I see it after consulting with some AI mechanics are
the wiring lists. Figure that out: even among the same type of modern airbus FBW aircraft the sidestick connector pin might be wired differently. According to the Murphys law rule this implements incidents and accidents to happen. The connector pin is a 164 pin connector (similar to those you have for you printer cable at your pc). Apparently the wrong wiring list was consulted (though it was for an A 320-200 aircraft) and the wires for the roll input and the associated control channels were reversed. This resulted in the ELAC computer indicating proper aileron deflection while the ailor was actually reversed. This failure is impossible to detect, as long as nobody outside the cockpit visually checks if the corresponding aileron deflection (up/down right and left wing)is consistent with the control input.


Airbus Industrie did not respond on several requests for comment.


Happy landings and let's all be careful out there


Tim v. Beveren
(independent) editor aviation safety
www.aviationsafetyonline.com (http://www.aviationsafetyonline.com)

[This message has been edited by TvB (edited 05 June 2001).]

[Thunderbug]

Crickey! If all this extra info is true it beggers belief. For such a condition to exist in such a modern, technically advanced, well maintained aircraft is truly scary.

Don't the French have a version of Murphy's Law?

[M14P]

Chaparral

The only reference to the 3 second 'delay' that Mr Benn mentioned was in some extra literature that was not FCOM related. I have searched in vain for more info but nothing is published in my books.

The delay itself is to prevent the FWC (flight warning computer) from faulting every single peice of equipment during electrical transients.

I am alarmed at the information from FI but I was under the impression that the ECAM gets its control position indications straight from the surface. Too technical, I know, but I find it difficult to believe that the F/CTLs and all of the Spoilers were indicating correct position just because the sidestick was in the 'correct' position.

[Frederic]

TvB. Thanks for further explanation. If I understand it correctly, it was actually a wrong placement of the wires because it is in a different order on each specific type of Airbus, yet the pin is the same on all types? In the military the ground personnel visually checks the flight controls before departure. Why not in civil? Shame on AI for messing up the design like that! But having said that never forget that things are always designed in a certain way for a certain reason.

[TvB]

Not only in this wonderful modern aircraft but throughout the entire Airbus FBW family, Thunderbug. I was told and had proof in my hands that even within one line series there might be differences in the wiring list for the respective sidesticks.


According to the sources, close to the German BFU investigation, the pins in the connector were wired 100 percent to the diagram, but unfortunately for the wrong aircraft serial no's. The correct diagram for the "incident" aircraft had these connections reversed (control channel and roll channel = total of 4 pins). Thereby the next step "safety feature", the control computer was "bypassed" and showed the correct(wrong)deflection on the ECAM screen.


Again, only somebody outside the a/c with radio communication might have catched it, when the wrong aileron turned up - instead of (desired)down.


I believe something VITAL as the flight controls, specially in an FBW aircraft, should be failsafe on this end.
I recall talking to a former top manager at AI some years ago, where we discussed such an issue and AI was trying to convince me that a screw up as it was the case in the famous B 727 accident(flight control cabels connected reversed) is more than unlikely to happen with an Airbus. Well Murphys Law...


BTW: there were 108 pax and a crew of 7 on board during this event. A/c registration was D-AIPW. Take-Off RWY was 18 and this is a pretty long one, as I recall. Big, big luck for all, as the aircraft was still above the runway and not close to the ajecent forrest...

[This message has been edited by TvB (edited 23 May 2001).]

[Streamline]

Back to basics,

After maintanance affecting the flight controls, a visual check needs to be performed, and this in all possible modes the FBW is supposed to function, Airbus or Boeing.

I am sure the manuals will be updated respecting this logic.

------------------
Smooth Trimmer

[This message has been edited by Streamline (edited 22 May 2001).]

[screwjack]

There we go again, the magnificent-state-of- the-art-fly-by-wire-"puesch-beton" (french for "push button")-fully-computerized-and-controlled-best-aircraft-ever-built!

Ooops!!!

What scares me is something like this happening to a major player like Lufthansa and their "above" standart skilled and trained mechanics.

Highest scores for this crew. 1.6 feet at full power and 20 deg bank? Scary, scary.

On top I find it pretty disturbing that there is not one unique wiring layout for the sidestick connectors. Hopefully it will be adressed soon but so far I'm only aware of a short bulletin for the Airbus jockeys
with instructions on "how to perform a flight control check". As I understand the issue here the ELAC won't sense this condition and the ECAM will indicate proper aileron movement (despite it will be exactly to the opposite direction). I believe this will go undetected as long as no one with sufficient understanding of this system, carefully observing desired aileron deflection according to (announced???) sidestick input is outside the bird.

Yeah, but I have to agree, this crew are good canidates for a salary increase.
Cheers...

[Ficky]

I wonder what the cost would be to LH to settle with the pilots?

What would the cost be, including liability, litigation and hull loss, had the F/O not done his job?

No, I don't speak German.

[screwjack]

Ficky,
depending on how many US citizens have been on board somewhere between US $ 500,000,000.00 and 800,000,000.00! This is what the insurance usually calculates with.
Germans don't count for that much (seriously), they don't have the same amounts and specially not such high punitive damages in Europe as we have it in the US.
But sure it will be a hell of negative pr for
Lusthansa.

[AfricanSkies]

411a

Lufthansa a '1st class operator' ??

mmmmmmmmmmmmmmmmmmmmmfm !! haHA!

[GotTheTshirt]

"Wonder if the investigation will be swept under the rug. Sure hope not"


I realise that the Europeans have a lot to learn from our US cousins but the following pprune topic is an interesting read !

Topic: TWA 800 - the acceptable cost of accidents.
The moral Have a good,long,expensive,open investigation and dialogue - then sweep it under the rug!

[Midnight Blue]

At least Lufthansa looks a lot more safer than most of the African Airlines, according to the statistics...

[This message has been edited by Midnight Blue (edited 23 May 2001).]

[Pengineer]

I'm not convinced about the wiring list differences as stated here. I know you do get wiring variations but If it were the case that control wiring differed at the ELAC connector between models of the same type, the ELACS would not be interchangable between these various models and this is not the case.
If the two pairs of left and right signal wires were crossed there would be no ECAM warning, you'd only get the warning if it couldn't deliver what you asked, in this case they got what they asked, an aileron input, so no warning was generated.
Wiring checks as per the WDM rather than the wire lsit would have detected this.

[TvB]

We are talking the sidestick (output) connector pins, not the ELAC.
Do these go straight into the ELACS? Not to my knowledge, but I'm not an Airbus mechanic.

Rgds
TvB

[DoctorA300]

Just to settle all discutions on 1 topic at least. The reason the ECAM diplay indicated the "correct" deflection is because the Ail., and all othe flt control, surface position sensor is a syncro, not a resolver, ei. it only measures amount of deflection and not direction. The syncro signal is fed to the FCDC (Flight control Data Consentrator), an Analog to Digital converter, and from there to the DMU´s for ECAM display. But to get back on track, the syncro signal is a AC voltage and the FCDC simply converts it to a Digital signal, the up or down deflection is based on sidestick direction.
Brgds
Doc

[Cyclic Hotline]

A couple of questions spring to mind here.

1. Following maintenance activity to a primary control system, was a duplicate (independent) inspection completed on the affected systems.

2. Was the maintenance carried out by an Avionics or Airframe technician?

3. Was the certifying engineer an Avionics technician, or an Airframe engineer?

I think that many answers to this incident may lie in the responses to these questions.

Even the very best people and systems screw up. The importance in an incident like this, is to ensure that the entire chain leading to the occurence is identified and the information be provided industry wide to ensure that the lesson is learned as painlessly as possible.

Mechanical control systems and autopilots get connected incorrectly and also cause crashes. The final inspection of any control system is to ensure complete and free range of movement, and also correct control response. The danger in an electrical system such as this, is the possibility that the engineer performing (or certifying) the activity does not understand the complete implications of the system concerned.

[SOPS]

Scare Bus, Die by wire.

[Flap 5]

One thing I do not quite understand from the posts here: With this wired up incorrectly would the ECAM show the correct direction of movement on the control check or not? When you do the control check you should certainly should check for both movement and the direction of movement of the ailerons.

There certainly have been cases of cross controls in older aircraft. I remember the China North West TU-154 which had the autopilot incorrectly connected. Unfortunately the flight crew elected not to disconnect the A/P and the aircraft crashed. However this possibility should be designed out of modern fly by wire aircraft. The fact that the wiring connections change for aircraft with different serial numbers with aircraft of the same type is a serious design flaw.

[TvB]

Flap 5:
that's my point. And yes, the ECAM indicates the correct deflection associated with the stick input during the check, despite the surfaces actually move opposite.

You would need somebody outside the aircraft to check visually if the aileron deflection is appropriate and consistent with the sidestick input.

Any A 320 rated techi out here?


Rgds
TvB

[This message has been edited by TvB (edited 23 May 2001).]

[E cam]

I can see how aileron could indicate correctly when moving in the oposite sense but what about the spoilers?

[Mowgli]

I like to know that when I make a control input, the input is transferred through a clever combination of wires, pulleys, cranks, control rods, hydraulic pistons and actuators, toa control surface. I can't knock what I haven't tried, and maybe I belong in the ark, but I prefer computers and software to help and assist, not decide how to interpret what I've demanded.

I may well end up on the "electric jet", but at the moment, I'm glad I'm partnered with my trusty old Boeing.

Full marks to the Airbus crew for the way they handled this one. I only hope that given the same circumstances I would have reacted in the same way as that excellent FO.

I guess I'm just afraid of what I don't understand, and maybe that's why they put me on a Boeing (simple, like me).

[overstress]

Mowgli

Better drive a carburetted automobile then. It would be scary to have a computer 'interpret' your throttle demands. Or would you prefer it if your conventional throttle cable snapped just in the middle of that tricky overtaking manoeuvre with the 40-tonne truck bearing down?

Had it occurred to you that conventional flying controls can be jammed?

The F/O on this occasion reacted as he was trained and isolated the offending sidestick. (Yes all you sceptics - what if the Capt had, say, a seizure at the controls at the same moment on takeoff, his arm locking on his sidestick? I'm sure all A320 operators at least introduce this idea during training)

[3 putt]

Mowgli & Sops

You lot are missing the point.
So maintenance screwed up,not unknown to happen,but the very fact it was fly by wire saved them.Not possible with pulleys.

[screwjack]

3 putt:
I believe, with all due respect: you miss the point.

To the opposite: FBW almost killed them!

1. We are talking something short as 5 seconds before the wing would have hit the ground! Apparently there was light turbulence, so what if another would have hit the aircraft while flying with takeoff pwr, wingtip 1.6 feet above the ground? Do you know how damm close this is? Do you know how many fractions of an inch of additional false/right sidestick input by the Cpt. would have slammed the a/c right into the ground?

2. Yes, somebody at LHTechnics had screwed up. But: how can somebody design an electrical flight control input connector and use different wire diagrams, even within the same series of airplane? This was an incident (luckily no accident) waiting to happen. Such a device has to be designed dummy-proof and failsafe.

If you look at the famous "chain of events" leading to an accident, how many parameters here did almost make it happen? The well known 5, 4, 3, 2...?


3. And the ECAM indications showed proper aileron deflection while they were deflected to the opposite direction? So far I've not seen any A320,330,340 jockey looking out the window to the rear and checking if the ailerons move according to his input. Besides: it would be against the AI procedure. - So how should somebody catch this fault?

Now, and I know we are becoming hypothetical here, what if both sticks have been rewired according to the wrong wiring list. The f.....g ECAM would still show : OKAY!!!

This glitch has to be fixed ASAP and the good thing about this article might be that the story is out now. Might trigger some special attention in the respective workshops and maintenance facilities worldwide. Apparently the incident happend in March. So I believe AI was well aware of it by mid-April. Checked
company bulletins today: there is NIL! A simple bulletin would do the job in terms of "prevention".

This is what bothers me and it is symptomatic with Airbus Industrie and their birds.

So thanx God there was a very good trained crew, a F/O very, very quick and awake and only this one problem, no further wake, and it all happend with an airline and in a country where they didn't hide the event under some rug or somewhere else...

[Bus429]

Suggest you doom merchants and Luddites have a look at TvB's reply on page 2. It is possible that FI's editorial team may not have let all pertinent facts through.

------------------
Bus429 - the pilot's pal!

[PaperTiger]

sj

>If you look at the famous "chain of events" leading to an accident, how many parameters here did almost make it happen? The well known 5, 4, 3, 2...?<

Break the chain by visually checking control surface movements following the mtx. Surely applies to any a/c, fbw or pulleys particularly if it's the control system you've been d1cking with.

I think this illustrates not that computers are infallible - we all know they are not, rather we have come to expect them to be. Many millions of trouble-free hours can induce complacency. Yeah, the design could be better, but simply checking the work would have prevented this particular chain.

Bad practices, good crew.

[Frederic]

SOPS and Screwjack,
Any of you want to start a string on B737 rudder-hardovers, exploding centre tanks, or the Egyptair 767 "suicide"? Boeing design at its best? Or what about Concorde's flimsy fuel tanks?
Don't get me wrong, I think all of the above are great aircraft and I hope they'll keep going for as long as they can, really.
In this Incident AI obviously messed up the design, yes. But try to get a slightly more open mind about aircraft design please. We all think the fact that the ECAM didn't show the fault is outrageous. But WHY didn't it? If the system only measures deflection, how does it know if the direction is correct, or doesn't it? Believe me, the designers really were not thinking "oh, it'll never happen..." It's a bit more complex than that. Sometimes the reasons why things are designed a certain way aren't immediately obvious... Any AI people out there with an answer?

[M14P]

Quite right - why is it that a genuine thread is so often hijacked by a bunch of folks who know nothing about the subject they are harping on about?

Screwjack - you have simply demonstrated in a particularly extravagant way how very little you understand about this technology. 'Slammed into the ground' - go back to reading the Daily Mail

Sidestick failures and inadvertant inputs are covered in the AI course very early on.

Do we really have all the facts about this incident? As I said before and E cam reiterated - what about the spoilers?

[Case One]

Having recently come to the Airbus from Naval Aviation where our control deflections were always visually confirmed, I have always been concerned by this aspect of the flight control system. Since I cannot see ANY of the the controls move from the the flight deck, I have developed my own personal check. When I do my walk round I look at the actual control surface positions and compare them to what the ECAM flight control page displays. If the display agrees with what I have seen, then I trust it. For what its worth.

[Oilhead]

The Airbus 320 flight control surfaces are unpowered until engine start - are you sure this is a valid check? Curious as to what Airbus would have to say about this. Also, the control deflections are easily checked on the ECAM screen. At my company, it is SOP for the captain to call out his sidestick movement, and the f/o must verify the actual movement is what is expected.

[screwjack]

M14P, Frederick and Oilhead,

1. I don't read the Daily Mail!
2. I believe you get me wrong here.

Of course no a/c will be ever a 100 % failsafe and there are numerous things the engineers and with AI specially software designers could not think about at the time of designing their blueprints. That's okay and nobody blames anybody for that.

BUT:
once a glitch or serious item has been identified, I expect from a key player like Boeing or Airbus to inform the rest of the community in an appropriate and timely manner. A simple bulletin, describing the facts of the incident will do it and subsequently everybody out there will try to avoid it. So here we have a case of a serious design deficency which was never adressed since the first FBW Airbus had been built a decade ago.
And it applies to the entire family (320,330, 340).

The AI design tends to give pilots and even some mechanics a wrong impression of precission and safety. Sitting in the cockpit you can't see all surface deflection, while you perform your flight control check. The SOP says PF performs the stick inputs, PNF checks the ECAM and then vice versa. So everybody tends to believe what is indicated on the screen is correct and corresponds with the actual deflection.

I recall a daily proceedure with my former European airline where the flight controls were checked every morning before the first flight with a mechanic outside the a/c, hooked into the intercom. Some egghead found out that this delays the operation by 6 minutes and since it is not performed any more...

- I wonder how the folks in Seattle have resolved the issue with their B777, but I tend to believe such a glitch can't happen here, at least it would be sensed and a warning triggered.

But this is really not that important.Let's face it: It is the "ATTITUDE" of Airbus Industrie, gentlemen!

When it comes down the line I don't see a "responsible reaction" in dealing with their product. In the past they were pretty fast in blaming the pilots for each and every mishap (latest was the Northwest A 320 take-off accident at Detroit some weeks back) instead of turning their attention inside and ask themselves: "what could we do to avoid this situation in the future?".

When it comes to information in terms of product support you get a bunch of pages, revisions and so forth on lavatory lights and other stuff I don't consider as important for flying the a/c, but you won't get a bulletin stating the incident, the findings, what really happened inside their computer brains and what you should try to avoid.

We all know that safety in our job is the no 1 priority and everybody tries to perform at his best. This includes prevention and the tool for prevention is information. I believe the industry has a massive problem, when it comes to this.

Have a good one

[bonajet]

If the flight controls have been disturbed, then isn’t it normal to have a requirement for a flight control check entered in the log book? This has to be cleared before flight and requires an outside observer on headset to confirm the surface movements versus pilot inputs. If this isn’t standard practice, then maybe it should be.

[stagger]

Regarding the ECAM display...DoctorA300 wrote that the amount of aileron deflection is measured directly but the direction of deflection is determined from the position of the sidestick?

Well how is direction determined when the aileron deflection is commanded by the AP and not by the sidestick?



[This message has been edited by stagger (edited 24 May 2001).]

[3 putt]

SJ
(I've read your post very carefully)

You should really watch your blood pressure! and yes I do know how close "1.6 ft" is.

Let's not get into the AI versus Boeing nonsense(it's been covered and what are they going to do?take all A320 a/c out of service)
I simply made the point that the design of the fbw is such that the f/o was able to split the stick and thus recover the a/c.Now I would imagine that this is a simple statement to understand.The fbw saved them,it would appear mtx let them down.
Are you suggesting that it is better to find yourself at the controls of a Boeing or Cessna after such an alleged mtx release?
A flight control is a flight control and it does'nt care if it is bolted to an AI or a boeing.It does exactly what it says on the tin.

Case One, When exactly do you do your walkround?

[TvB]

bonajet,
nothing was wrong with the flight controls in that incident. the a/c came back to FRA with one ELAC inop (according to MEL you can conduct a flight with this handicap...). At FRA a troubleshooting was conducted and in the process they found one pin on the sidestick connector bend. therefore the connector was replaced, rewiring a new connector according to the respective (in this case 'wrong') wiring list.

The controls were then checked inside the cockpit with the ECAM indications and found okay. nobody had reason to believe that actually there was a problem with the ailerons. No work was performed there.

does this clarify it a bit?

rgds

tvb

[ironbutt57]

You people make us sick...this is a public forum where all Ppruners are welcome to post their RATIONAL comments/observations/ideas on ALL topics..so why jump on 411A..I happen to know that person was an aviation professional, when most of you unionizing crybabies were choking pablum down your mothers' back...we all learn from each other, even from the most unlikely sources...so if you're too good and knowledgeable to acknowledge/ignore 411A's posts, get out of the cockpit before you kill somebody....

[Case One]

Just to make it clear where I stand, I enjoy flying the 320, but I have no intention of letting the same thing happen to me if I can help it.

Oilhead: AI SOPs call for the PF to move the controls and PNF to check deflections on the ECAM F/CTL page. My point is how do you know that what ECAM tells you is correct?

screwjack: Yes, AI's attitude is a problem. Mechanics doing visual checks at dispatch would be great, but I don't expect that to be implemented (cynic).

3 putt: Banter aside, before I get in. Our 320s are fairly old and the ailerons, elevator and rudder are almost always deflected from neutral when the jet is shut down. I have noticed that on the new jets being delivered the ailerons are almost always neutral at shut down (drat).

Its not perfect, but until AI or my company comes up with a better system, its all that I can do personally to make sure that I stay alive. Any better ideas wellcome.

[Flap 5]

TvB

From what you say It would appear that the ECAM only shows the sidestick position and not the actual aileron position. If that is the case there is little point in doing a control check.

When I place the sidestick to the left I know that it is to the left! What I need to know is where the control surfaces are! I was always told not to look at the flap lever but to look at the ECAM because it used feedback from the flaps to show the actual position of the flaps. If what you say is true then the feedback to the ECAM is not from the control surfaces but just from the sidestick, which is of little use.

Edited for typos

[This message has been edited by Flap 5 (edited 24 May 2001).]

[bonajet]

TvB – my point is that if the flight controls are disturbed then a check is done with an outside observer watching the results. This is done if the sidestick was worked on as well as it is part of the flight controls. If the FCDC is swopped then the new unit is checked via the MCDU.
I am just surprised that there was no visual check requirement as there would have been in our airline. Was it not a requirement in LH?

[Oilhead]

Are we not talking about two different displays here? We look at two displays on taxi out on the bus. One for stick deflection, and one for surface deflection. You can see excactly what the ailerons are doing!

I can certainly see what the flight controls AND side stick are doing on the ground. In the air I can (electronically) see what the flight controls are doing too.

There is an ECAM Flight Controls Page which shows the position of the surfaces, not the sidestick. That page is either manually selected, or automatically appears on taxi out as you commence the full and free check. That page also shows ELAC and SEC status (FWIW).

Then there is the Primary Flight Display (artificial horizon in the old days, except this does a bit more) (PFD) Ground Display mode. After the first engine is started, a white box appears on the PFD. It shows the deflection of either sidestick, but not the resultant control deflection. It disappears after rotation. Then within the box there appears a little Maltese cross thingy. We call it the "side stick orders indication". It shows the combined displacement of Captain's and First Officer's side sticks. This way one can see the commanded side stick deflection during take off and landing roll.

Oilhead

[This message has been edited by Oilhead (edited 25 May 2001).]

[Al Titude]

Please excuse my lack of knowledge of civilian operating procedures, but I can't understand why a check of control surfaces was not done prior to take off. Are there reliable indications of stick movement in the cockpit? Or could a control check from the first officer have suggested the control surfaces worked correctly on the ground?

This check wasn't carried out in a hawk a few years ago (aileron cables not connected post maintenace) with tragic consequences.

This said, excellent effort by the FO and quick thinking no doubt saved countless lives.

[Pengineer]

TvB, are you sure the connector was at the sidestick and not the rack connector at the rear of the ELAC?
The sidestick wiring is relativeley simple with good access to work. Why would anybody rewire the capt's sidestick connector then move accross to the F/O's seat to check it out???
The pins on the rack connector are more susceptable to damage and more likely to be damaged troubleshootinfg an ELAC fault, the access is not as good, neither is the visibilty to seee what your doing so more likely venue for a f*** up.

[screwjack]

Thank you Case One!!!

Finally someone who understands my concern.
Happy Landings and a long life.

Screwjack

[TvB]

bonajet, flap 5 and pengineer!


From what I got through the research of this incident:


It was the CM1 (cpt) sidestick connector, a 560 pin connector (4 segments with 140 pins each).


A flight control check on F/O's side was performed by the mechanic, but only inside the cockpit, using the ECAM indications.


A total of four wires (2 for the roll and 2 for the associated control channel for roll) were reversed in polarity. This apparently made the ELAC believe everything is okay and consistent. Indication on the screen would show proper movement of aileron according to desired actual input but actual movement would be opposite!?!


To my knowledge the AI logic and computers do not compare flight control input/output vs. actual aileron deflection (sensed at the aileron).


Lufthansa did not answer the FI request for comment. No addition information was therefore obtained in ref. to their specific procedures how to perform this flight control check after changing the connector.
But I believe they do it quite to the book, what ever the book says (they are Germans for Christ's sake!!!).


One source at LH told me that there is no requirement for a specific flight control check simultaneously inside/outside after this kind of repair. Could not get this confirmed as AI did not comment either. Possibly different company procedures might apply for different operators, but I really don't know.


Maybe those of you with access to "basis" are able to retrieve more information on this incident.


What some of you guys might find interesting though is what I got officially from Boeing in this regard (- of course I was curious how they have secured this important feature at their FBW B 777 -). Here is the answer from Seattle, WA:


"In the B 777 the EICAS will detect a single fault, as it was the case with the LH A 320. It (the computer-system) would have a problem to detect multiple faults (which is a common known problem with artificial intelligence systems).


The EICAS would generate an error message as it compares the pilots inputs verses the actual outputs. Each pilot input is translated into 3 independent signals. The computer also compares these 3 signals for plausibility and that they all agree.


Further it compares the ACTUAL surface deflection (left aileron up if control wheel input to the left, right aileron down and vice versa) to the desired control input.


Further: there is a specific mandatory maintenance task after performing ANY rewiring of ANY components. A special computerized test equipment is used to detect wiring faults along the line and they will be detected with this equipment.


Last there is a required visual check outside while somebody inside the cockpit performs the flight control check after repair to insure appropriate deflection an free travel of any control surface."


BTW: it took them (Boeing) 16 hours and 42 minutes to answer the questions, with a night in between!!!


Have a great weekend


TvB
(independent) editor aviation
www.aviationsafetyonline.com (http://www.aviationsafetyonline.com)



[This message has been edited by TvB (edited 05 June 2001).]

[Oilhead]

Ouch!

[exeng]

I worked for QF for a while some years ago and their SOP was, before service, for the Flight Crew to visually check all the flight controls whenever any flight control system had been disturbed by maintenance.

This involved the F/E to take a headset (with a very long lead) and chat over the service interphone whilst the Pilots operated all the control surfaces.

We all thought this was a bit of a yawn in theory. I had to do it on a 747 S.P. on only one occasion. We discovered that the spoilers were not operating as advertised! (The most inboard spoiler was not doing it's thing, I've forgotten the detail, but it is different to a standard 100/200/300) By the way we only were doing this check because some other flight control had been disturbed. We relayed this info to maintenance who stated that it had probably left Boeing rigged in this manner! Nevertheless the A/C was dragged back into the hanger for investigation.

I hope QF still have this check as part of their SOP's, and it would certainly have done the trick in preventing LH's incident. Unfortunately my airline do not have this check requirement.

Well done to the Lufty crew.


Regards
Exeng

[chrisN]

Kegworth - one engine on fire, other one thought to be and shut down. Subsequent proposals included CCTV to enable pilots to see what's happeneing behind them. Universally rubbished. How many dead was that?

A320 - pilots can't see control surfaces move for viusal check, airlines can't afford 6 minutes for an outside person to watch and confirm movement in desired sense. CCTV would do the trick, without time penalty, wouldn't it? How many have to have near misses like this one, and some die if the FO isn't as quick, before CCTV is though maybe to have some cost- and safety-benefits?

Just a thought from an amateur. (I was a motor industry beancounter - and no, I did not stop safety-related costs being incurred, I encouraged them because bad safety costs too much in the long run. And I fly gliders - visually check movement of control surfaces before every flight, with external helper if I can't see, and check very carefully after every maintenance episode - but then, what do I know?)

Chris N.

[Jurassic Jet Man]

How does it go...

If you think safety is expensive, try having an accident!

[screwjack]

JJM: - Well that was true in the past but today this "partial remaining risk" is extensivly covered by insurance deals. The only looser might be the airline if it happens to be a small operator and not one of the big players. Did anybody go down or out of business recently because of a crash? Singapore? Egyptair? Air France? Swissair? American? I don't think so. Therefore I tend to believe that some egg heads really do take a fatality into account (only from time to time) when they do their budget cuttings. Let's hope that the "professionals" will stay smart, qualified and fast enough to jump into this gap when required and the manufacturers find ways to eliminate the rest.


Change? Well only if the "consumer" would demand it, and he really likes to be shuttled for as low as 250 bucks half around the world (and back)... so what?




[This message has been edited by screwjack (edited 27 May 2001).]

[avoman]

Oilhead is correct, and Doctor A300 and a few others are mistaken. The aileron position info (direction and amount of deflection) displayed on the flight controls ECAM page of course is that of the ailerons! Four position sensors called LVDTs look at the ailerons. This is quite independent of the sidestick positions. This display would not have been affected or reversed because of any miswiring of a sidestick. The additive positions of the sidesticks is displayed until rotation on the PFD.
I think Pelican put his finger on it. On control checks during taxi out the pilots saw spoiler movement and aileron movement in response to commands from each sidestick,correctly displayed on ECAM. It just happened to be in the wrong direction for one stick. Really quite easy to miss at a very busy time and so unexpected. Every pilot does control checks, thousands of times. It is always correct isn't it? Except for this oh so rare occasion.

[screwjack]

Bummer, avoman.

Where do I find the info about the LVDT's in the AOM? Chapter 1.27 doesn't give me a clue about this matter...

[DoctorA300]

AVOMAN, STAGGER
I have to appologize, I wrote about the AIL. Indication, but mixed in the SIDE stick indication on the PFD.
AVOMAN, The Signal from the LVDT´s for the AIL. pass through first the SDAC´s and then the DMU´s. And as far as I can interpret the AMM the LVDT´s signal is converted to an 8 bit ARINC429 signal in the SDAC, the polarity (UP or DOWN) is derived from something else, which I have not been able to figure out yet.
But thanks for pointing out my mistake.
Brgds
Doc

[M14P]

So just to reiterate then:

The sidestick order symbol would have been correct but the ailerons would have indicated reverse sense on the F/CTL page (exactly as most sensible people would believe)

If this is the case are we looking at a chain of human error insofar as an engineering procedures error was then followed by a crew error?

So now we can all stop wailing and moaning about the hidden agenda/conspiracy theory run from Toulouse and admit that the Airbus FBW series are darned good aircraft after all.

[Frederic]

DoctorA300, Don't the LVDT bits go through the FCDCs instead of the SDACs? I thought the FCDC sent their info straight through to the DMCs and then onto ECAM Flt Cntrls? Would seem more logical to me. I might be totaly wrong! Thanks for shedding some light on the mixup between the ECAM Flt Cntrls page and the sidestick position indicator on the PFD. You got me totaly confused there. M14P, Airbus great aircraft indeed, but different wiring orders for same connector on different aircraft of exactly the same type? Accident waiting to happen. AI has some explaining to do.

[DoctorA300]

Frederick,
You are so right, LVDT´s go to the FCDC.
Brgds
Doc

[Kangar]

Guys,
Not in the aviation industry, but the gist of what I saw here is that the sidestick was wired to a 320-200 specification, no A320-200 in particular, which turned out to be wrong. Had it ben wired to the specification of that particular aircraft, it would've been fine? Now, as for people saying this is a serious gaffe on AI's part, I have this to say. Do you honestly think every 737-400, A330-300, etc are identical in every technical detail? No, didn't think so. If airline maintenance has a proper document control system in place, these issues would be picked up. At the end of the day, the schematics used did not correlate to the serial number of the aircraft, this can happen anyone unless there are proper procedures in place. Any upgrades/changes by a manufacturer presumably go through numerous forums for an approval, and are then added to equipment configuration details. These equipment configuration details are captured in subsequent documentation, which is why it is so important to use the correct reference material for the exact aircraft being worked on. Is this even remotely the case, or am I miles off? Just curious, not trying to pi** off the professionals, but I'd like an insight into the workings of these issues...........

[Mister Geezer]

Nice bit in Flight International about this topic

MG

------------------
Don't land in a field or the sheep will eat the aircraft.

[avoman]

Kangar. There does seem to be alternative wiring hook ups on these sidesticks depending on the exact flavour of the components, we are informed. Maybe so, and in this case Murphy got in there with nearly catastrophic results. However it does not need two versions of the same parts for error to occur. Two disturbed wires could be reversed at any time when refitted. Human error is an ever present possibility.
Hence there are procedures for checking checking checking after maintenance. Under British regulatory system any disturbance in a flight control system has always required duplicate inspections ie visual and function checks by different people at different times, all properly conducted with accompanying paperwork and according to the manuals. This is always taken very seriously. In my company we have additional technical instructions specific to the A320, with its electronic flight control system, reiterating this.
I am sure maintenance practices in Germany are not less stringent.
So I suppose there must have been several shortcomings in the maintenance actions that day. The report will make interesting reading.

[TvB]

avoman,


sad enough you are right. and the problem of shortcomings in maintenance effects even the "better" among all, due to budget shortenings and a generation change.


specially with lh a lot of the highly qualified technicians have retired and young fellows are doing the job. they still follow the rules but to the letter of the manuals.


it was reported to me that everybody nowadays is undere extreme time presure and the a/c's should be out of the hangar asap. the incident a/c was scheduled, no replacement available and that would have meant to cxl a revenue flight with 108 paxes.
apparently the problem didn't look severe, as the connector pin was identified as bend and therefore replaced. still no excuse, as it happend even at lh homebase but the accumulation of all these factors certainly played a role.


to what was reported to me the situation on some outsite stations is even worth, specially if the company technicians are providing service not only for their own a/c but as well for "foreign customers" (as selling of ground support has become an interesting and lucrative business generating revenue). what has been overlooked in some facilities is that they could hardly cope with all the work load, given the manpower available (which of course was never increased as well - to the opposite). priorities have to be made and some management orders apparently indicate to first serve the other customer, as this creates revenue...


if this is true, it seems to be a quite dangerous development and i believe the human factor issue might shift as well in future accidents and incidents towards the guys with the greasy hands...

TvB (independent editor aviation)
www.aviationsafetyonline.com (http://www.aviationsafetyonline.com)

[This message has been edited by TvB (edited 05 June 2001).]

[Doors to Automatic]

Reading all the posts on this topic and as a relative lay-man I am absolutely amazed there is no mechanism on an airliner as sophisticated as the A320 to stop this sort of thing from happening.

[RightsFlyer]

There is an old saying attributed to Murphy
"It is impossible to make anything foolproof because fools are so goddamned ingenious"
Just substitute "human" wherever you see "fool".
People make mistakes, the best you can do is minimise the opportunity.

[This message has been edited by RightsFlyer (edited 02 June 2001).]

[TvB]

From Air Safety Week, thought you may find this interesting:

"Cross-wired Controls Almost Bring Down Lufthansa Airliner

A Lufthansa A320 came within less than two feet and a few seconds of crashing during takeoff on a planned flight from Frankfurt to Paris.
Preliminary reports indicate that maintenance performed on one of the two A320’s elevator/aileron computer (ELAC) immediately before the incident flight had inadvertently created a situation where control inputs of the Captains sidestick controller were reversed. The case reveals that at least two “filters,” or safety defenses, were breached, leading to a near-crash shortly after rotation at Frankfurt’s Runway 18 that was saved by quick action by an alert first officer. The case is under investigation by the German Aircraft Accident Investigation Branch, the Büro für Flugunfalluntersuchung (BFU). Given the significance of the incident regarding the worldwide Airbus Industrie fly-by-wire fleet (A319, 320, 321, 330 and 340), and its possible implications for maintenance of other fly-by-wire aircraft, the German authorities have said their report will be issued in English. That report is months away.
In the meantime, this much has been reported in other media and is known from additional sources: During the March 20 takeoff with the captain as the pilot flying (PF), the airplane encountered some degree of turbulence shortly after rotation, resulting in the left wing moving down. The turbulence may have been from the wake vortex of another aircraft landing on Runway 5R prior to the incident aircraft starting its takeoff run. The captain responded to the wing dip by applying a right input to his sidestick controller, but in response the left wing banked down even more – the exact opposite of the response the captain expected. A further right input resulted in the left wing banked down some 21 degrees, and the left wingtip came within a scant 1½ feet of the ground.
The first officer, the pilot not flying (PNF), realizing the apparent control problem, switched the control priority to his sidestick and recovered the aircraft. Had the left wingtip struck the ground, the airplane likely would have crashed, endangering the lives of the 115 passengers and crew aboard. According to the BFU, computer modeling of the data from the digital flight data recorder (DFDR) indicated that the incident airplane came within a few seconds of striking the ground.
After recovering, the crew engaged the autopilot and climbed to 12,000 feet. Various handling checks were performed to confirm that the captain’s sidestick was producing “outputs” that were the opposite of “inputs” in roll. The crew elected to conduct a precautionary landing at Frankfurt rather than continue the flight. The case may stand as an outstanding example of crew resource management. The first officer observed, analyzed the situation and acted promptly to retrieve a situation that could have been disastrous.
Sources say that if the aircraft had been operated by pilots from a more authoritarian culture (e.g., Asian or Middle East) that the copilot never would have acted in this way without the captain’s express permission. This generalization perhaps should be put in context: the Germans have been noted for their penchant to recognize authority, too, so the generalization about other cultures may have limited application. The essential point is that this crew evidenced what good CRM is all about. As one impressed pilot remarked: “Highest scores for the crew – 1.6 feet at full power and 20 degree bank? Scary. Scary.”

The maintenance action
German investigators, Lufthansa officials and representatives from manufacturer Airbus are focusing their inquiry on the maintenance actions that preceded the incident flight. In the process of troubleshooting and repairing the ELAC, Lufthansa Technik personnel found a damaged pin on one segment of the four connector segments (with 140 pins on each) at the “rack side,” as it were, of the ELAC mount. Repair work involving complete rewiring “upstream” of the connector pins was conducted over several work shifts by various technicians. In the process, according to preliminary reports, the polarity inadvertently was reversed on four wires in one connector segment. Two of the wires were for the roll control input and two were for the associated control channel “outputs.” It is believed from preliminary accounts that the technicians correctly followed the wiring list. Sources say the aircraft wiring can vary by aircraft serial number, and that care must be taken to match up the correct wiring list by tail number, also known as “aircraft effectivity.” An Airbus official expressed doubt that aircraft wiring would be unique for each aircraft, however BFU officials and maintenance personnel maintained that the wiring lists for individual aircraft may differ.
One pilot observed, “If it were the case that control wiring differed at the ELAC connector between models of the same type, the ELACs would not be interchangeable…and this is not the case.” However, we understand that the male/female marriage of connectors and pins (all 560 of them among the four connector segments) is not the issue, but the color-coding scheme of the wiring to the backside of the connectors on the rack to which each ELAC is mated.
Before the airplane left the hangar at Frankfurt for return to service, a flight control check was performed using the respective indications on the cockpit ECAM (Electronic Centralized Aircraft Monitoring) display (see illustration at p. __). The BFU confirmed that the mechanic’s flight control check was limited to the first officer’s sidestick, not the captain’s on the left side of the cockpit. Whether a maintenance technician would be sufficiently astute to catch aileron deflection in the wrong direction is another matter. It is not certain if anyone was standing outside the airplane to double check actual movement of flight control surfaces, or if the presence of such an individual was required by the operator’s procedures.
At Lufthansa’s code-share partner United Airlines [UAL], certified inspectors must be stationed both inside and outside the cockpit to conduct a functional check after work is performed on the flight control system. In addition, a flight test is required before the aircraft is returned to service after this kind of repair.
The details of such procedures at Lufthansa will be part of the BFU inquiry. The question of any time pressure to get the work done also seems certain to be explored. After all, this was a repair to a primary flight control system (as opposed to a flight management system). The incident seems to raise all sorts of human factors issues in maintenance.

The preflight checks
Every crew routinely exercises the flight controls as part of its preflight check. On the A320, the Flight Control page on the ECAM will appear when the sidestick is moved as part of the preflight check. The sidestick must be held about 3 seconds for full travel to be reached; it takes that long for the ECAM to generate a fault message.
There is some confusion in the pilot community about whether these checks will be displayed on the ECAM as control inputs (the position of the sidestick) or control outputs (actual position of ailerons, etc.).
The ECAM will display control outputs, as does the comparable system on the Boeing [BA] fly-by-wire B777 (see box at p. ___).
One pilot correctly explained the functioning and went on to surmise what may have happened:
“Four position sensors called LVDTs (Linear Voltage Differential Transducer – used with aircraft control surface servos) look at the ailerons. This is quite independent of the sidestick positions. This display would not have been affected or reversed because of any miswiring of the sidestick…
“On control checks during taxi out the pilots saw spoiler movement and aileron movement in response to commands from each sidestick, correctly displayed on (the) ECAM. It just happened to be in the wrong direction for one stick. Really quite easy to miss at a very busy time and so unexpected. Every pilot does control checks, thousands of times. It is always correct, isn’t it? Except for this oh-so-rare occasion.”
The check often is made during taxi out, a high workload period, rather than before pushback at the gate. Accordingly, the PF is moving his control actuators while keeping his eyes focused on activity outside the airplane, while the PNF is keeping his eyes locked on the ECAM display. In this arrangement, the PNF is not looking at and probably is not able to see the direction in which the PF is testing the sidestick. As such, the PNF may be looking at the ECAM more for confirmation of deflection, but not necessarily for direction of deflection. One means of mitigating this uncertainty might be as follows: The PF announces “Left” to indicate the direction in which he’s moving the sidestick (right, forward, back would constitute the other callouts in the four-step process). The PNF would respond to “Left” with confirmation, “Left (aileron) up, right down.” This is the common procedure on other Airbus aircraft such as the A 330 and 340. But these checks vary among different Airbus operators.
In any event, the details of these procedures and checklist will be another point of the BFU examination (see related story in box at p. ___).

The filters penetrated
The fault got by at least two safety “filters,” as it were. It was not detected during maintenance, and it was not detected during the preflight check. In this respect, the incident fits the now classic “Swiss Cheese” model of accidents postulated by human factors expert James Reason. A professor at the University of Manchester, Reason is a world-renowned expert on human error. His metaphor of Swiss cheese represents the various layers of defenses against catastrophe. The holes in each slice of cheese represent breaches in the defenses, and when the holes are in alignment, the multiple defenses in depth are breached. The combination of what can be a chain of relatively insignificant circumstances link up, leading to an incident or accident.

The design vindicated
The fact that the incident did not end with investigators piecing through charred wreckage is fortuitous. In the unfortunate event of a crash, there might not have been sufficient evidence pointing to a connector/wiring fault. Absent such evidence, investigators may have come to a finding of incorrect banking associated with turbulence, leading to a conclusion of “pilot error.”
To be sure, crossed or reversed flight control cables on conventional aircraft have caused more than one crash. There is a grim history of such events on military and general aviation aircraft. If one control stick is connected backwards, then both yokes are misrigged, and both pilots are faced with what might be characterized as “the same rather extreme problem.”
However, reversed controls are deemed impossible on transport-category aircraft, with their combination of cables and pushrods. Consider the “conventional” B737. A Boeing official said, “The ailerons are moved by hydraulic actuators. Following proper maintenance and inspection procedures, it is impossible to connect the steel cables leading to these actuators reversed. You would have to do it deliberately. This problem would be detected by maintenance (personnel) performing the operational checks, but latest by the pilot during his preflight check, as he would not be able to move the controls.”
In the case of the A320, one aspect of the aircraft’s fly-by-wire design may have enabled the first officer to quickly gain control of the aircraft – the ability to isolate a malfunctioning sidestick and shift command to the other sidestick at the push of a button. As one pilot observed: “I would say that on this occasion it was BECAUSE of Airbus technology that a major incident was avoided!”

The larger implications
Even though technology may have saved the day in this case, Peter Ladkin, a computer systems expert at the University of Bielefeld in Germany, points to a number of accidents involving fly-by-wire primary flight control systems. In the military, the X-31 research aircraft, the Saab JAS 39 Gripen tactical jet (twice), the V-22 Osprey tilt-rotor, to name a few. And there have been incidents involving computer-controlled primary flight control systems in commercial aircraft. “There are people such as myself…who believe a re-think of this safety-criticality of on-board systems is in order,” Ladkin asserted.
Some commentators suggest the installation of closed-circuit television (CCTV) to provide added real-time feedback to the pilots. In most large jets, pilots cannot actually see the movement of ailerons, flaps, thrust reversers, and so forth (although spoiler deployment can be viewed from the cockpit). A CCTV system, they suggest, would provide added feedback. And, with the CCTV integrated into the digital flight data recorder (DFDR), a visual record of system functioning would be available for post-crash analysis.
The debate over CCTV on transport-category aircraft may be for another day. In this case, human factors issues in maintenance and flight operations appear to dominate, with latent factors such as “aircraft effectivity” for wiring lists.
The BFU may have “just” an incident on its hands to investigate, but the safety issues are profound. (ASW note: aviation editor Tim van Beveren contributed to this story) Q

BOX
Functional Checks of the fly-by-wire B777

“In the B777 the EICAS (Engine Indicating and Crew Alerting System, the equivalent of the ECAM on Airbus aircraft) will detect a single fault, as it was the case with the LH A320. It (the computers) would have a problem to detect multiple faults (which is a common known problem with artificial intelligence systems).
“The EICAS would generate an error message as it compares the pilots’ inputs versus the actual outputs. Each pilot input is translated into three independent signals. The computer also compares these three signals for plausibility and that they all agree.
“Further, it compares the ACTUAL surface deflection (left aileron up if control wheel input to the left, right aileron down and vice versa) to the desired control input…
“Further, there is a specific mandatory maintenance task after performing ANY rewiring of any components. Special computerized test equipment is used and will detect any wiring faults…
“Last, with many of our operators there is a required visual check outside while somebody inside the cockpit performs the flight control check after repair to ensure appropriate deflection.”
Source: Boeing"

[Checkboard]

Well, "Air Safety Week" reads PPRuNe then!

[PPRuNe Towers]

Checkboard - I think you can put that input down to TvB. Tim has sought thoughts and opinions from aviation professionals via the electronic bulletin boards even before PPRuNe was around. Danny and I both used to see posts from him over on CServe and, if I remember correctly, he was then doing research on aviation safety for Dutch television.

------------------
Regards from the Towers
[email protected]

[flaps]

Certainly a full visual check is impossible but as an FO I can quite easily see whether the RH Aileron is deflected upwards during the stick right movement during the control check. Can't see anything else though but since this Lufty incident I must admit to a few glances over my shoulder.

Don;t know whether you can do this on an A321.

Well done also to the pilots.

[shades]

Wonder if the F/O actually had time to analyse the situation?
As I understand it the other pilot's side stick is not visible from either side thus the input is not immediately apparent.
Maybe the F/O reacted instinctively as most of us would and fortunately his side stick was correctly wired. I am not trying to denigrate anyone - just trying to imagine the scene.

[PFD]

Hi All
I cannot answer for the Civvy (normal) Techies, but as an ex RAF Techie our independent check system for flying control systems states that the checker should check for 'Correct sense ands range of movement'. Now forgetting every indication device ever invented, how do you know on the ground that when you stick left the left Aileron moves up etc, well the only way is to get someone to stick left, while you watch them, and then while they hold it there, you go and look at the control surfaces. I don't know whether it's the Military in me or not, but unless i have seen everything working correctly, with my own eyes, then I couldn't sign up an Independent check for controls. Seeing is believing. Incidentally, I have to agree with the people who have been saying that if the Airbus system wasn't the way it is, the A/C would have crashed. At least there was some override available. If anyone wants to flame me about this, don't bother, this is my opinion and I'm not about to change it. Also at 44 I've been called just about every name going (and they all apply ;-))

Regards

------------------
'If at first you don't succeed, skydiving probably isn't the hobby for you'

PFD

[Lu Zuckerman]

In a previous post someone made the comment about mismatched wires and indexed connector plugs and how could this lead to the problem discussed in this thread. Here is how it could happen. A major German supplier of power drive systems for the secondary flight control systems on Airbus Aircraft did not incorporate indexed electrical connectors on any of the components they supplied on the A-310. It was their contention that they would impact the delivery schedule of their systems to the wing integrator and besides, it would have a severe impact on the cost of their equipment.

With this in mind consider the following. The only means incorporated in the wiring system to combat misconnection of connectors onto an appliance were tiebacks on the wire looms. The first time the appliances required maintenance or were removed for cause the tiebacks were cut. After the maintenance the tiebacks were either not replaced or, they were not in the same condition as before the maintenance. This would allow for cross connecting. If the wires were cross-connected on the PPUs the first time power was applied the flap or slat system would shut down and the computer could not diagnose the problem. If the wires on the command sensor unit were cross connected there would be no indication as to the problem but it would seriously impact the problem of trouble shooting if a defect were to occur.

If a connector were mis connected on the power control unit the system would not operate correctly and the effected system would most likely lock up and to top it off the computer may not be able to diagnose the problem.

I can’t say if this problem was rectified on later models but it still exists on the A-310.

If you want to hear more about this and other problems go to my posting entitled “How safe is your aircraft”?, on these threads.


------------------
The Cat

[This message has been edited by Lu Zuckerman (edited 04 June 2001).]

[This message has been edited by Lu Zuckerman (edited 04 June 2001).]

[askcv]

I read that many believe that if this had been a Boeing airplane there would have been an accident, only the fact that it was an airbus saved it. However, there would be less chance of incorrect aileron setup in the Boeing, since it would involve cable rigging, which is not often touched, and would be harder to mis-rig. So the initial error would probably not have happened thus no incident. And think what would have happened if BOTH the aileron connections were wrong; the FO would have rolled them in to the ground. In fact, how did he know his controls were not similarly affected? Seems he took a chance (which worked out for them all, luckily).
And for TvB, you said that Luft does the control check on taxy instead of before pushback. I was working for a small airline that Luft had a contract to manage and they did the same to us, making us change the control check from the Boeing standard to during taxy. I objected till I was red in the face but could not make them see the stupidity of their actions. I would imagine that they will still not see it. I have no respect for airline managements that think they know more than the manufacturer does about the airplanes.

[mcdude]

askcv - A valid flight control check can only be performed with both engines running (ie pressurizing the green and yellow HYD systems) hence this check is done after pushback, and "at a convenient stage during taxi" according to Airbus SOPs.

[askcv]

Pardon my iggorance but all the airplanes I have flown have several methods of powering a hyd system; electric (pnuematic/manual/RAT) and engine driven. The Bus does not? Woo, more than I wanted to know!

[This message has been edited by askcv (edited 04 June 2001).]

[Abulafia]

It is the F/O action I find most incredible in this saga. To take over control from a senior officer is psychologically very very hard. This guy must have had really excellent CRM training to do this so quickly and decisively. How many FO's in UK airlines would have responded like this?

[Streamline]

askcv

Manufactures do make mistakes, practise has proven that over the years. I personally as every other pilot on this forum have updated my manuals with many amendments.

The problem is not that the Airline manager might have another opinion then the manufacturer. The problem is that the customer support afters sales with the manufacturer’s standard pilots is not up to scratch.

To believe that the manufacturer has all these things fully under control is dreaming with your eyes open. They need the feedback from the operators, and if they are serious about the credibility of the design of their product they should have no problem with that.

Boeing claims they had the customer involved at a very early stage when designing the B 777, I believe that to be true although a bit overstated.

One of the worst customer supports I have ever seen is that from British Aerospace for their Avro 146/RJ 85, I am puzzled how this thing ever got certified ?


------------------
Smooth Trimmer

[TvB]

PFD:


As I was told, Airbus didn?t feel it necessary to make such a visual check mandatory for their f-b-w a/c. So we are back to famous Mr. Murphy and his law?


I tend to see it your way (in this regard): »seeing is believing« or »only sign off what you've seen with your own eyes«. However, if the fight-control check would have been performed on the F/O side only (as with the LH incident a/c), the deflection would have been consistent with the expectation?


Yes, you maybe right that here the »option« of the priority switch made the day, despite that I was told by numerous (civil) technicians that it would be quite impossible to screw up the flight control cables on a conventional airliner and reverse them without detecting it before being airborne.


Apparently the mechanic (1. safety guard), the inspector inspecting and signing the work off (2. safety guard) and finally the pilot during his preflight checks (3. safety guard) would not be able to move the stick. - I?m aware that it had happened on some kind of military aircraft though and there are many cases in the general aviation field.


So given this in respect to our scenario here at hand I believe the comparison and conclusion is not appropriate (- my personal opinion) and I feel that askcv is right with his remark.


askcv:


I?m very well aware that Lufti has many company procedures quite unique to their operation. I very well recall some aspects we found in the aftermath of their landing accident at WAW. For example it was company procedure to use a higher speed addition (for the family) when crosswind was to be expected. The LH SOP asked for 15kts more, despite the AI procedures recommended only 10 kts. This resulted in a higher speed on final approach at WAW where there was no x-wind during the landing but in fact a nice tailwind adding up the final approach speed.
Looking further in the procedures we found another interesting issue in regards to the V1 calculation. It was at that time that LH had introduced the »go-decision« instead of V1 and they did it for all fleets. What got lost in this change was the fact that the A320 had been certified according to the new certification requirements in those days. These required to include the »reaction time for the pilot« in case of an abort decision after V1 and before Vr. Now AI went ahead and calculated their V1 accordingly, but without giving it a lot of publicity. I interviewed their former Senior Vice President of Engineering, Bernard Ziegler and he confirmed that, adding: »?we considered V1 to be critical and we did not give any ?publicitee? to that as we are safety minded and we would like the pilots to ignore that they have a higher safety margin.« (well?hmmm...). Anyway this resulted in LH reducing their V1 a second time by their go-decision calculation. Not a very big deal as long as we don?t come into the regime of Vmcg and we still have enough runway to clear the threshold by the required altitude. I believe LH changed that as well after they became aware.


I think you?re right that sometimes the management believes they know everything better. The root of multiple problems in this area is as well associated with a lack and/or defective communication between manufacturers, operators and pilots, as Streamline rightly commented. I?m sure no one acts deliberately or out of pure arrogance, but the potential danger for safety relevant implications is given under such conditions.

Back to the incident at EDDF:


So far we have identified three different company procedures for the flight control checks on A320 a/c. - Strangely, LH does it during taxi. For other operators this is a clear ?NONO? out of obvious reasons associated with the safety during taxi (let stand alone the SQ 006 scenario?).


I would be interested to learn from the Airbus pilots among you (A320 family, A330 and A340) how your flight control check is performed and when (after eng start up, pushback, taxi) and if there is any x-check between CM1 and CM2, according to your company procedures.


Are there companies still performing a solid flt/ctr check with somebody outside, for example at the first flight of the day?


I feel that there might be more than three alternatives out for the same aircraft and among the entire Airbus product variety.
Comments highly appreciated.


Regards
TvB
(independent) aviation editor
www.aviationsafetyonline.com (http://www.aviationsafetyonline.com)



[This message has been edited by TvB (edited 05 June 2001).]

[mcdude]

The Airbus SOP calls for the PF, at a convenient time during taxi, to apply full lateral and longitudinal sidestick deflection (and rudder deflection) in sequence. Each deflection is announced by the PF and checked for FULL TRAVEL AND CORRECT SENSE by the PNF from the F/CTL page.

The PNF then silently checks his sidestick.

The procedure is probably adopted by most or all A320 operators (guess????)

Yes the check could be done before pushback by powering all three hydraulic systems (electrically and via a PTU) with outside observers etc etc but I think this is completely unnecessary, time wasting, and done during a period of much higher workload than during taxy!

This incident has elements of "Murphy's law" however for me it stresses the need to check correct sense of movement, not just "full and free".

[This message has been edited by mcdude (edited 05 June 2001).]

[TvB]

mcdude:

is this the Airbus procedure or a specific from your company?

If the later, is this a European operator?

Apparently there is quite a set of different procedures in this regard, specially in Europe, with variations, but no unique standart procedure.
And we have not entered into the field of variations for other AI fbw a/c...

regards
TvB
(independent) aviation editor
www.aviationsafetyonline.com (http://www.aviationsafetyonline.com)

[Pengineer]

Slightly off topic but...
I seem to remember a documentary about Airbus A320 and FBW incidents etc which had on it the ex Lufhthansa chief safety pilot being interviewed and if my memory serves me correct he actually resigned from LH in protest at their decision to buy these A/C.
Can anyone else confirm this? I'm fairly sure I'm right.
http://www.stopstart.fsnet.co.uk/mica/pc-crash.gif

[This message has been edited by Pengineer (edited 05 June 2001).]

[electricjetjock]

411A & Ironbutt57 --- SOG's

Out of all of this I noticed that having had the wires changed on the CAPTAINS sidestick the engineer carries out the control check ( without external check) using the CO-PILOTS sidestick. Well excuse me but which one had the work carried out on it!!!!!!!!!!!!!!

------------------
Keep smiling!!!!

[enginefailure]

There is something i wanted to ask about this incident, too:

If the wing was only still 0.5 feet (or meters) from the surface, how should it have lasted 5 more seconds (anyone wrote this) until impact ? Did the captain try to correct the course during rotation or after take off ? I can't believe that within 5 seconds a A320 shouldn't have made enough height to avoid touching the ground with a wing ? Who can say somnething about this point ?

Interestingly this incident isn't discussed on the german pilots site at the moment.
Makes me wonder .... so it's all right ?

cheers
ef

[BUMPFF]

PFD – sadly the independent checking system has all but disappeared in civil aviation.

Abulafia – CRM training had little to do with the F/O's input, more like lightning recognition of the situation and the application of common sense.

Pengineer – The man you refer to is a personal friend and former colleague of mine - Captain Heino H. Ceasar, indeed the former Chief Flight Safety Pilot at LH, and who left on attaining retirement age (from the B747-200) and not 'in protest' at LH's acquisition of Airbus equipment. He had lots of, shall we say, strong opinions, about all the products he flew, all the way back to long-range piston types.

[TvB]

pengineer:

I think I know the film you mentioned as I produced and directed it*. But you're wrong! To my knowledge the former Lufthansa CF, Cpt. Heino Caesar did not resign in protest. He simply retired reaching his retirement age.

Cpt. Caesar was involved in the early stage of the Lufthansa decision to go for the A320 as he was the company safety pilot. He published some quite remarkable articles with the FSF and other special publications in regards to automation in the cockpit and the man-machine interface.

Regards
TvB

* The film is titled "fatal logic" and is dealing with the Lufthansa landing accident in WAW and in general with the design philosophy of AI. This film was realized in cooperation with the German Pilots Union (VC) and tried to shed some light onto the line of notorious "pilot errors" - whenever it came to an Airbus accident.

Those who are interested in the further development of this story might check the article "Thinking of Airbus" under the "Special Features" section on my webpage at www.aviationsafetyonline.com (http://www.aviationsafetyonline.com)

[oriental bloke]

there is no issue here .....

the control scenario is checked on the ground ( spoiler deflection & all aileron inputs ) ..... there is no error margin .....crew input ...& ecam confirmation .. think lufty is thingkin bout the xtra 30 % .....2 much......??

[TvB]

enginefailure:

check out the threat before you write. It starts at page 1. Everything was quoted here and as for the German Pilots Forum pls. check:


http://www.pilots.de/ubb/NonCGI/Forum1/HTML/000797.html
- if you understand German.

After all this cross- and double checking your engine should be running..., ehh...your questions should be answered.

Regards


------------------

[askcv]

Streamline;
I flew a few British airplanes when I was a youngun and I was not impressed with their manuals either. I am only talking here about Boeing really, since I am not aware of the Airbus manuals. But from what I have read here I can see that the tendency of airline managers to write procedures themselves exists in Airbus fleets too.
I know that for the latest generation of airplanes Boeing spent a lot of time and money to get the best procedures for their product, and the design of the systems and switches were optimised for those procedures so that everything works as well as it can. They had specialists in time and motion, engineering, flight crew (including trained and qualified test pilots), education, medicine and so on to conference, suggest, test and apply it all. The end result is what we, the greasy end, have to work with.
Yet many airlines don't even bother to try it before they substitute their own procedures. They have no idea what affect this will have on the safe or efficient operation of the airplane, and often are not aware of the damage they do. They justify it by saying it is "standardization", or it is intended to reduce training cost, or simply (usually) it is done because the old codger writing the new procedures does so to make it comfortable to himself.
It goes without saying that the airline managers and their helpers do not have the qualifications of those who designed the original procedures. The pilots accept the way the airline tells them to do it, and most of the time they are not aware of the deficiencies, nor even that what they are doing is not 'standard' (what the manufacturer intended).
If the changes were beneficial, then you can be assured that the manufacturer would pick them up and make them part of their own procedures. This practically does not happen, which should tell you something.
Many of the changes made do result, by themselves and as part of the whole procedure, in a less safe and less efficient way of doing it.
Changing the B744 procedures to agree in part with the 747 Classic, for example, is a terribly short sighted way to do it. But Lufthansa (among others) does exactly this.
The new airplanes are downgraded (dumbed down) for a short term benefit and once the procedures are written, it is extemely hard to change them.
Ansett bought new F27-400s with F27-100 flight instruments, for example, intending to save money on training, and I have heard some airlines have tried to do the same with the newer glass cockpit types (CX for one). This is an extreme example of what I am talking about of course, but even if the change is simply to move the control check to the taxi phase instead of doing it before start, as the manufacturer intended, has adverse affects on safety and cost.
In fact I know of no changes that result in an improvement. Maybe you do?

[shogunsina]

If only similar coordinations and reactions were input into the GF072 scenario,would have saved theday,probably???

[vikingwill]

There is an interesting analogy to non-standard wiring of flight control sticks in the field of anaesthesiology. It makes interesting reading and I quote from it below. Maybe someone in the aviation world can calculate the incremental reduction in risk that common design aspects across a family of aircraft could generate.

In the book ‘The best American Science writing 2000’, Atul Gawande writes about the incidence of fatalities resulting from general anaesthesia. In the US, between 1960 and 1980, this averaged at 1 in 10,000 operations. Acceptable risk? Maybe not if you weigh the ratio against total operations annually. In 1982, this equated to 6000 patient killed or brain damaged. Fortunately, the incidence is greatly reduced today, thanks to an engineer named Jeffrey Cooper. To quote from the book,
“An unassuming, fastidious man, Cooper had been hired in 1972, when he was twenty-six years old, by the Massachusetts General Hospital bioengineering unit, to work on developing machines for anesthesiology researchers. He gravitated toward the operating room, however, and spent hours there observing the anesthesiologists, and one of the first things he noticed was how poorly the anesthesia machines were designed. For example, a clockwise turn of a dial decreased the concentration of potent anesthetics in about half the machines but increased the concentration in the other half. He decided to borrow a technique called "critical incident analysis"--which had been used since the nineteen-fifties to analyze mishaps in aviation--in an effort to learn how equipment might be contributing to errors in anesthesia. The technique is built around carefully conducted interviews, designed to capture as much detail as possible about dangerous incidents: how specific accidents evolved and what factors contributed to them. This information is then used to look for patterns among different cases.
Getting open, honest reporting is crucial. The Federal Aviation Administration has a formalized system for analyzing and reporting dangerous aviation incidents, and its enormous success in improving airline safety rests on two cornerstones. Pilots who report an incident within ten days have automatic immunity from punishment, and the reports go to a neutral, outside agency, NASA, which has no interest in using the information against individual pilots. For Jeffrey Cooper, it was probably an advantage that he was an engineer, and not a physician, so that anesthesiologists regarded him as a discreet, unthreatening interviewer.
The result was the first in-depth, scientific look at errors in medicine. His detailed analysis of three hundred and fifty-nine errors provided a view of the profession unlike anything that had been seen before. Contrary to the prevailing assumption that the start of anesthesia ("takeoff") was the most dangerous part, anesthesiologists learned that incidents tended to occur in the middle of anesthesia, when vigilance waned. The most common kind of incident involved errors in maintaining the patient's breathing, and these were usually the result of an undetected disconnection or misconnection of the breathing tubing, mistakes in managing the airway, or mistakes in using the anesthesia machine. Just as important, Cooper enumerated a list of contributory factors, including inadequate experience, inadequate familiarity with equipment, poor communication among team members, haste, inattention, and fatigue.
The study provoked widespread debate among anesthesiologists, but there was no concerted effort to solve the problems until Jeep Pierce came along. Through the anesthesiology society at first, and then through a foundation that he started, Pierce directed funding into research on how to reduce the problems Cooper had identified, sponsored an international conference to gather ideas from around the world, and brought anesthesia-machine designers into safety discussions.
It all worked. Hours for anesthesiology residents were shortened. Manufacturers began redesigning their machines with fallible human beings in mind. Dials were standardized to turn in a uniform direction; locks were put in to prevent accidental administration of more than one anesthetic gas; controis were changed so that oxygen delivery could not be turned down to zero.”
……”Today, anesthesia deaths from misconnecting the breathing system or intubating the esophagus rather than the trachea are virtually unknown. In a decade, the over-all death rate dropped to just one in more than two hundred thousand cases--less than a twentieth of what it had been.

Reference
Gawande, A., “When doctors make mistakes”, In “The best American science writing 2000”, Ed. James Gleick, ECCO Harper-Collins, New York 2000.

[Ignition Override]

Has Airbus decided to modify the parts within the control stick unit which are apparently interchangeable, or is that the main risk for maintenance?

[TheShadow]

Date: Mon, 18 Jun 2001 12:54:17 +0200
From: "Peter B. Ladkin" <[email protected]>
Subject: A320 Incident

Tim van Beveren reported in *Flight International*, 22-28 May 2001, on a 20
Mar 2001 incident to a Lufthansa Airbus A320 on takeoff from Frankfurt.
This incident was reported at greater length and detail in *Air Safety
Week*, 4 Jun 2001, by David Evans and Tim van Beveren.

The captain was Pilot Flying (PF). there was some degree of turbulence
during takeoff, shortly after rotation, which resulted in the left wing
moving down. The captain applied correction (right lateral roll control) but
the wing dipped further left, reaching 21 degrees bank, and the wingtip is
reported to have come within half a meter of the ground, and according to
computer modelling of the digital flight data recorder the airplane "came
within a few seconds of striking the ground".

The First Officer, the pilot not flying (PNF), realising there could be a
control problem, switched "priority" to his sidestick controller and
recovered the aircraft. The aircraft was flown up to 12,000ft on autopilot,
the crew confirmed the problem, that the CAP's sidestick was controlling for
roll in the reverse sense (normally, putting the sidestick to the left
commands left roll; to the right commands right roll. Control-reversal here
means that CAP's sidestick gave right roll on a left movement and left roll
on a right movement).

The aircraft had just come out of maintenance. Maintenance is a known
risk -- James Reason, an authority on human factors in aviation safety and
Professor of Psychology at the University of Manchester, amongst others, has
detailed how significant problems may arise through maintenance of complex
systems.

It has happened many times that aircraft have come out of maintenance with
control systems reversed in one or more of the three axes (roll, pitch,
yaw). This has been the cause of a number of accidents with general aviation
aircraft, but my informal requests for information turned up no recent
accidents to commercial aircraft due to this cause. Evans and van Beveren
report that "reversed controls are deemed impossible on transport-category
aircraft" and that Boeing claims that the B737 aircraft cannot be
reverse-connected without it being discovered before flight, normally
through mandatory post-maintenance checks, but at the latest by the pilot's
preflight check, as the controls could not be moved.

At Lufthansa's code-sharing partner, United Air Lines, certified inspectors
must be stationed both inside and outside the cockpit to conduct a
functional check after the flight control system has been worked on; a
flight test is also required before the aircraft is returned to service
after this kind of repair. It is believed that either of these measures
would have caught the control-reversal problem, and so general
maintenance
procedures at Lufthansa Technik will be subject to detailed inquiry.

There have been a number of reports as to what fault caused the lateral
control reversal, including the two sources above. However, I have found
none of the explanations so far satisfactory, as they raise further puzzles
that they do not solve.

The following architectural description of the A320 primary flight control
system (PFCS) is drawn from Cary R. Spitzer, Digital Avionics Systems,
Second Edition, McGraw-Hill 1993. The A320 sidestick controller generates
input to five of the seven flight control computers which form part of the
primary flight control system (PFCS). These five are the two Elevator
Aileron Computers (ELACs) and the three Spoiler Elevator Computers (SECs).
Each wing has two outboard ailerons, and five inboard spoilers (overwing
surfaces which can be raised). Lateral (roll) control proceeds via four of
the five spoilers and the two ailerons. Each of the two ELACS and three SECs
control some combination of these 12 control surfaces. There is a
significant amount of control redundancy.

Initial reports said that Lufthansa Technik personnel had been repairing
one of the two ELACs, and had found a damaged pin on a connector. They
had replaced the connector and this had apparently caused the control
reversal. This explanation made no sense to me as it stood, because
(a) the connectors are standardised. Replacing one with another should
give exactly the same connections as were there before;
(b) if one ELAC was receiving reversed signals, and the other was not,
and the three SECs were not, then
(i) the PFCS architecture would detect a discrepancy on the channels, and
(ii) on each side, one aileron would operate counter to the other, but
all spoilers would operate correctly-sensed, and it is hard to see
how this could lead to the extreme control discrepancy reportedly
experienced by the PF.

The Aviation Safety Week report on June 4 suggested that "Repair work
involving complete rewiring "upstream" of the connector pins was conducted
over several work shifts". The ELAC connector with the damaged pin has 140
pins and is one of four such for the ELAC, for a total of 560 pins.

It seems to me that to get control reversal without the phenomena in (b)
above, there must have been a reversed signal downstream of the sidestick
but upstream of where the sidestick movement is multiplexed into the five
input signals to the five PFCS computers which receive them. I do not yet
have, nor have I heard, a coherent suggestion as to how that could occur.

There has been considerable discussion of and speculation concerning:
maintenance procedures at Lufthansa Technik, which has one of the very
highest reputations for maintenance quality; wiring, wiring conventions and
connectors in the A320 series; why the pilots did not discover the
discrepancy during the usual preflight control checks (the A320 displays
control surface displacement on the cockpit display, the ECAM, when the
sidestick is intentionally moved and the airplane is on the ground, as
during a preflight control system check). I think it is fair to say that few
hard facts have emerged yet concerning any of these, and I find it hard to
make any useful inferences about what actually went on from the publicly
available information.

What emerges most clearly so far from this incident is that the simple
physical complexity of the control system has confused some. Amongst other
things, explanations have been proposed by presumably technically
competent
people that do not fit the control system architecture. It is hard to see
how that phenomenon could have occurred with the simpler architectures of
mechanical control systems. On the other hand, the PNF was able to take over
normal control of the aircraft with one button push (the "control priority"
takeover on the sidestick), which could also not happen with the simpler
mechanical architectures.

We have very little information so far on the incident. It is certain that
the puzzles will be solved further along the investigative line, and very
likely that the results of the investigation will be highly significant for
the care and feeding of fly-by-wire architectures.

Peter Ladkin, University of Bielefeld, http://www.rvs.uni-bielefeld.de

[end quote]

[autoflight]

Is anybody seriously considering the routine of the PF control check? Many PNF checks of flight control operation on the flight control system page would not pick up incorrect sense. Many PNF say "checked" before surface indications return to neutral. This immediately invalidates the pilot flight control checks. Captains therefore have increased responsibility to ensure that controls are actually correctly checked.
I guess many FBW pilots are now meeting the new challenge. The question is of course, why not previously to this near fatal incident?

[flying flynn]

Peter

Small correction to your A320 explanation.
I'm sure you just forgot.
On each wing side there is just one aileron surface. This surface is controlled by 2 servo controls, one of which is active while the other is in damping mode. The 2 servos are never active at the same time.

FF

[F/O Junior]

We do all our flightcontrols checks PRIOR taxi (A319/A320/A321/A330). It has been mentioned several times, that the feedback of the travel direction is taken from the sidestick and not from the aileron itself. I don't agree, because if all the hydraulics are depressurized (engines not running), the aileron droop is visible on the FCTL ECAM page. With a centered stick, there would be no directional feedback.

[ironbutt57]

Just goes to show that all the technology in the world cannot save us from ourselves

[TvB]

Hello everybody.

Has been some time that we have discussed this issue here and I just want to point your attention to the final report of the German Accident Investigation Board (BFU). An English language version is available at the BFU web page at

http://www.bfu-web.de/berichte/e_index.htm ,

file no 5X004-0/01 for download as a pdf file.

Everybody flying A3we should have a look into the "synopsis" and specially to the "contributing factors"



Happy landings

Tim van Beveren
(still independent) aviaton safety editor

[GearDown&Locked]

I'm sorry to intrude here but...

Do pilots really bother to look out the window and check visually the control input results? How many of you DO look outside? Don't get me wrong here, but procedures made day after day after day, one day, will result on skipping some detail, out of simple trust on the system, because you know the system is too damn good.

Just my two cents...

GDL

[Man Flex]

Nice idea but in practice you can't see the surfaces from the flight deck. If you crank your neck around you can just about see the wingtip!

[TvB]

I just realised that since I posted my update remark, the topic (which was dormant for almost two years) got more then 1.700 hits in less then 6 hrs. That's what I call traffic; - must be the headline though... ;)

Nevertheless, honestly: how many have been aware of this incident, its cause and implications?

:ok: :cool:

[Ignition Override]

As people stated above, for flight control checks, it would be quick and simple for all planes to have someone look at all primary flight control surfaces as we twist/push-pull the yoke and push both rudder pedals, before taxi-out.

It would take only about one or two minutes (provided that numerous ramp personnel were trained to scan: whether mechanics/engineers or not), and other than doing this again after de-icing procedures, it could have prevented such a near-tragedy.

Unfortunately, most airlines would probably not spend extra dollars to train ramp personnel for such a totally new concept. Some might not even like the extra printing cost for the paperwork, nor the extra one or two minute$ of fuel burn, as we create a two-minute delay for the pushback or powerback at the gate/stand next to us.:)

[Anthony Carn]

..........significant problems may arise through maintenance of complex systems.
So keep the sytems simple !

You listening, Monsieur Airbus ?

Too "clever" for their own, or anyone else's, good. :*

[Few Cloudy]

Monsieur Airbus....

No Brits or Germans involved in the consortium then?

[Charly]

Note: The controlinputs showed correctly on the ECAM at first...


I had a tour with that CPT a couple of weeks later, and he told me, that they did the Flight Control Check acc SOP on the ground. The tricky part was this: At first, the control inputs showed correctly on the ground!!

Then they had their flight with the little adrenalin-kick upon TO..
After they landed, they checked the flight controls of the left Stick again..

The first 1 or 2 sec correct display, and then the amazing thing happened: They flickered a little and then swung over to the wrong side!

At a certain point checking, double checking and so on reach a level, where it isn´t practicable anymore. This was just too hidden and tricky.
This was the point, where pilots did the job, they are so well paid for..

[atakacs]

The first 1 or 2 sec correct display, and then the amazing thing happened: They flickered a little and then swung over to the wrong side! Anyone could explain how this could be ?!

Alex

[Charly]

No idea..

Sorry for poor system knowledge, but I´m not that firm with A320 Systems anymore, as I changed to another fleet.

rgds

[cwatters]

As people stated above, for flight control checks, it would be quick and simple for all planes to have someone look at all primary flight control surfaces as we twist/push-pull the yoke and push both rudder pedals, before taxi-out.

Actually that doesn't work too well. Three times I've seen people waggle the stick while watching the surfaces move, then take off and crash because the controls were reversed....fortunately they were only flying a model plane at the time.

[Anthony Carn]

It happens in full scale life, too, cwatters.

After de-icing, one does a controls check amongst other things. I give controls name and direction of movement on the intercom.....the guy on the ground confirms full movement and direction.

You give the ground guys a bum steer on movement direction (intentionally or not) and I'll guarantee that a lot of them will fail to pick up the error. We are'nt even talking an Engineer in my outfit -- it's often one of the cleaners who multi-tasks as a push-back guy.

Good game !

:rolleyes:

[farqueue]

> After de-icing, one does a controls check amongst other things. I give
> controls name and direction of movement on the intercom.....the guy on
> the ground confirms full movement and direction.

No, have HIM tell you the direction/sense of the controls after you have moved them. If you tell him LEFT RUDDER and give full RIGHT, I'll bet many will still OK it. And you should also check each side stick as well.

[TvB]

Oh I have to say I love my good old wheel and the possibility to x-check my stick movements with actual aileron deflection. Though I have to admit, flying with some newcomers you can always get them by performing flight contro check (without them looking out) and then ask which aileron would be up and which one down...;)

- No way in any A3we, specially not in the new 600 version. But I recall past days with many carriers, where a mechanic was x-checking the flt-controls outside upon the first flight of the day...
:ok:

Probably not inovative enough for the "puesch buetton engineers" at TOU...never mind...
:E

[airmen]

AIRBUS not really to blame : if you bring your car to the mechanic and he make a mistake, do you criticise the car maker?

As a previous engineer on A320, I have never seen a side stick (which is flight control and I guess vital component!!) be replaced with a check consisting only at a glance on a screen.....we always had a look inside at the screen and outside at the controls to check for proper deflection and that was mandatory!
And as a private and line pilot, I always check visually the controls through the window BEFORE departure, I guess to what I see for real, aviation related matters speaking.
Haven't you ever experienced a problem with your home personal computer that you nor the specialist could explain?
And beside this, when you look at a screen to check an indication, there is a lag effect, in that case, the aileron where moving in the correct direction then after the lag they came reversely...If the pilots or engineer would have checked wih their eyes directly the flight controls, they would have seen the misbehaviour!
The F/O had the flight back to control seconds after TO which is sure very well done BUT there have been a chain of error that could have been broken before TO with an visual eye flight control check.
Human make errors.

[TopBunk]

airmen

I may have mis-interpreted your post, but pilots can not see the control surfaces when doing the control checks on most transport jets. On the 744 one can just about see the outboard engines, on the A320 the wingtips, so we have to rely on the displayed control positions. What are you suggesting?

[GearDown&Locked]

I think the main problem here is the positioning of the flight controls check in the checklist. The check is done when taxiing, so no external visual confirmation can be performed. But if done right after pushback by field personell, it would take a minute or two to perform the check , at no extra fuel-cost , as one is required to let the engines warm up... Then again I might be wrong.

GDL

[airmen]

TopBunk,
Firstly the guys who replaced the side-stick could have done this with a handheld radio and one guy outside to check visually.
Secondly if you see on the log book when you take over the plane that engineers have done something on the flight controls, ( replaced the side-stick in our case) it is not forbidden for the crew to double check the function on ground with your flight buddy?
Think easy!

[TopBunk]

Airmen

I don't have any issue with engineers checking with a colleague after any flight control repair, in fact I am surprised that it is not SOP. It obviously is not, or is only paid lip service to, however - remember the A320(?) about 10 years ago out of maintenance on which the spoilers were still disabled.

I read your post to suggest that as a matter of routine, pilots verify flight control movement themselves, or with the ground crew, before each flight, and was pointing out the problems.

[Charly]

Maintanance performed the check. One in the cockpit, one outside.

Problem was, they were in a hurry, and only did the check from the right Stick. Contributing factor was lack of personell and the night shift.

I remember that, when turning your head, and smashing your nose to the maximum towards the window, rolling your eyeballs beyond normal operational range, you actually could see the ailorons and the outboard spoilers on an A320 (a lot more on an A319, and at least the ailorons on A321).

I have to admit, that my nose is rather short, but not very flexible. Depending on the shape and consistence of your nose and the mobility of your eyes the above mentioned observations may vary a little :}