Airbus A330-303, VH-QPA 7 October 2008 - ATSB Report

[mmciau]

ATSB Report released 19 December 2011.

Airbus A330-303, VH-QPA 7 October 2008

Investigation: AO-2008-070 - In-flight upset - Airbus A330-303, VH-QPA, 154 km west of Learmonth, WA, 7 October 2008 (http://www.atsb.gov.au/publications/investigation_reports/2008/aair/ao-2008-070.aspx)

[mmciau]

150 QF A330 Passengers on flight QF72 have won millions of dollars in compensation settlement from Airbus & Northrop Grumman:

http://www.watoday.com.au/travel/tra...ut-from-airbus-20111220-1p3o7.html (http://www.watoday.com.au/travel/travel-incidents/plane-dive-passengers-win-payout-from-airbus-20111220-1p3o7.html)

[FGD135]

This report is poorly written, contains too much opinion, and features the inappropriate use of flow charts.

Inappropriate use of flow charts is not unusual these days, but I would have expected better from the ATSB. The author appears unaware as to the purpose of flow charts. A hint for him is in the name: FLOW.

The author also appears intent on praising the crew. A factual report on something is not the place for opinion-based praise. PPRUNE is a more appropriate place for opinion-based praise!

But the biggest failing of the ATSB in this investigation would have to be the complete non-recognition of the fact that the flight computers are capable of making control surface deflections that will result in vertical accelerations of this magnitude.

If the ATSB gave any consideration to this issue they haven't made any mention of it.

This upset would have to be very embarrasing to Airbus. This has made their software look very amateurish indeed.

Question for the Airbus drivers: would these pitch-downs have still occurred with the autopilots disengaged? If yes, then what about in alternate law? Can the computers be manually switched to alternate law?

[training wheels]

[FONT=Arial][COLOR=black]150 QF A330 Passengers on flight QF72 have won millions of dollars in compensation settlement from Airbus & Northrop Grumman:


Shouldn't any crew injured in this incident also be entitled to compensation in this case?

[lilflyboy262...2]

This is why there needs to be a big red button that says "Off"
When you press it, when you move the stick back, plane goes up, stick forward, plane goes down.
No if's, buts or maybe's.

Accidents have happened already when the computer takes a mind of its own.

[404 Titan]

FGD135

Question for the Airbus drivers: would these pitch-downs have still occurred with the autopilots disengaged?
Yes
If yes, then what about in alternate law?
Unders some conditions, yes.
Can the computers be manually switched to alternate law?Yes they can. What would be better is switching all the primary computers off and using the secondaries in "direct law". There are no protections in direct law therefore no chance of dud input data sending the flight controls into heart failure.

[FGD135]

I have read through the report again. It is as bad as I first thought. The author/investigator goes well beyond the normal practice for a factual report in order to praise the crew.

I believe that the pilot's performance was less than ideal (see below) but the intent of the author/investigator seems to be to protect the pilots by building a wall of praise around them.

This praise goes a bit too far as it involves too much opinion.

Snippets from the report are as follows. I have bolded certain words:

The flight crew’s responses to the emergency were timely and appropriate.

... the flight crew worked together to provide the captain with all the information he needed to fly the aircraft.


The aircraft only descended a total of 690 ft during the first pitch-down. Although this was due in part to prompt action by the flight crew ...

The captain’s sidestick responses to both pitch-downs were prompt.

However, in addition to being timely, the captain’s sidestick responses were also of the appropriate magnitude.

... the crew’s decision to divert to Learmonth was appropriate.

These tasks were performed with a high degree of coordination and effectiveness by the flight crew.

The flight crew’s responses to the warnings and cautions, the pitch-down events, and the consequences of the pitch-down events, demonstrated sound judgement and a professional approach.

"Professional"? That would be a word appropriate to a PPRUNE post, but not an ATSB Final Report.

There were other passages that contained the words "prompt" and "immediate" in relation to pilot actions. There was nothing in the report that was even slightly critical of the pilot's performance.

The report is suggesting that the pilot's performance was flawless. Was it?

The pilot's were confused as to which law the flight computers were in. The law switched to "alternate" after the second pitch down and remained that way until landing. The pilots believed the computers were in "direct" law.

Being in "alternate" law, however, meant that there was thus a greater chance of further, misguided control inputs by the flight computers.

I believe there should have been more effort spent on getting the computers into "direct" law. The pilot's belief they were already in "direct" law seems to have been based on a (flawed) observation by the captain regarding the auto-trim.

It appears to me that the pilots were overwhelmed to some degree, which should be a concern given that:

1. The fault was minor;
2. The aircraft was in clear VMC conditions in broad daylight;
3. There was a 3,000 metre runway less than 100 NM away;

The author/investigator seems to have excused the pilots, on the grounds that they were confused.

After the first pitch-down, the flight crew were presented with a situation that was even more confusing ...

The report identifies a couple of safety issues but fails to identify what, to me, are the more significant safety issues. Those are:

1. That the flight computers (in "normal" law, no less) will quite happily command elevator deflections that are capable of producing vertical accelerations of the magnitude experienced in this incident;

2. That the warning/messaging systems, in the case of a minor malfunction, can so easily confuse the crew to the point where they no longer feel they can "trust" the messages/systems;

3. The pilot's management of the flight computers. They knew there was something fishy with the computers but their efforts at isolating, to the greatest degree possible, the computer-generated control inputs, were insufficient.

The author/investigator could have sought advice from Airbus and Qantas regarding the performance of the pilots but does not appear to have done this. Instead, he/she is content to describe it with words like "timely", "appropriate" and "professional".

Poor job, ATSB. Can do better.

[Capt Fathom]

Next........ :ugh:

[astroboy55]

I believe there should have been more effort spent on getting the computers into "direct" law. The pilot's belief they were already in "direct" law seems to have been based on a (flawed) observation by the captain regarding the auto-trim.

It appears to me that the pilots were overwhelmed to some degree, which should be a concern given that:

1. The fault was minor;
2. The aircraft was in clear VMC conditions in broad daylight;
3. There was a 3,000 metre runway less than 100 NM away;

The author/investigator seems to have excused the pilots, on the grounds that they were confused.


Id be confused as well if my head had been used to punch a hole in the ceiling of the galley........

aircraft landed. No-one dead. Success.

[1a sound asleep]

Hardly looks like the death dive some made it out to sound


ATSB animation of Airbus A330 in-flight upset - YouTube

[Jetsbest]

It wasn't the dive that did the damage; it was the pitch rate which put people into the ceilings and back onto seats/carts/armrests, which in turn caused the injuries. Such was the nose-down attitude that the pilots could not see the horizon until pitch control was restored. Fortunately, the pilots in the flight deck had their seat belts "securely fastened".

and FGD...

what other words would you have the ATSB use if indeed they have assessed that crew actions were "timely/appropriate/prompt"? I don't see your selective quotes as praising the crew but, rather, stating the facts as the ATSB found them. The "complete non-recognition of the fact that the flight computers are capable of making control surface deflections that will result in vertical accelerations of this magnitude" is surprising though, and I'll read the report to form a view on that.

[Wally Mk2]

Actually looking at the Vid the actual pitch change in deg's was a total of near 11 deg's From +2.5 up normal flight Att to around -8.4 deg's downward. That's a large change in a short space of time.Also as we all know an aircraft pivots for want of a better word about it's wing so the further away from that balance point the more dramatic the pitching effect on anyone not strapped in.
We've all had fun pushing & pulling the control column of a light A/C to create pos & neg G's for our poor unsuspecting friends but the moment arm for the change was tiny compared to a large airliner.
Still I hear some of the pax are going to reject the $400K that QF are offering (in the news 2day) as they are doing a class action suit for millions !...ouch!!!

Wmk2

[PPRuNeUser0198]

as they are doing a class action suit for millions !...ouch!!!

Against Airbus and Northrop Grumman.

They could be waiting a very long time. Should have taken the offer from Qantas...

[FGD135]

Against Airbus and Northrop Grumman

The action against Northrop Grumman is a waste of time.

It should be aimed at Airbus exclusively - it was their dopey software that decided the bunt was a good idea.

[FGD135]

I don't see your selective quotes as praising the crew but, rather, stating the facts as the ATSB found them.
But, Jetsbest, you should notice that none of those quotes were statements of fact. They were all expressions of opinion. Quotes 2 and 3 do contain a small amount of fact, I will concede, but overall, they are statements of opinion.

To those like me that read these reports all the time, these statements stick out like the proverbial.

To me, the author/investigator is intent on building a wall of protection around the flight crew. He does not miss an opportunity to lavish praise on the captain.

It appears the author/investigator has studiously avoided any kind of examination of the flight crew's performance. The report makes clear that, after the pitch-downs, they were experiencing "mode confusion" and were overwhelmed to some degree, but the author/investigator just doesn't want to go there.

Why not?

Maybe the investigator is a former Qantas pilot himself. Maybe he is an old friend of the Captain. Maybe he has a son or daughter that is trying to get into Qantas.

Or could it be related to some nationalistic sentiment about the much-vaunted aussie pilots? Aussie pilots wouldn't get "mode confusion" would they?

[FGD135]

In an earlier post, I listed three major safety issues raised by this accident that have all been missed by the ATSB.

Here is the fourth:

4. That there are no procedures/training for when the computers begin making dangerously misguided control surface deflections.

From the report:
There were also no other procedures available for the situation they were experiencing.

For an airliner that is almost 100% computer controlled, I find it utterly astonishing that Airbus and/or Qantas haven't established procedures or conducted training for when the computers get confused.

I am only a plodding GA driver, but to me, the immediate action would be to isolate, to the greatest degree possible, the computers.

This means, firstly, manually switching to "direct law". Then, switching the computers so that a different "prim" (primary flight control computer) is manipulating the surfaces.

[Capt Kremin]

FGD, From the report,

Although the crew received numerous ECAM caution messages, none of them required urgent action, and none of them indicated any potential problems with the aircraft’s flight control system.

Do you have any idea of the number of computers on an A330 that have a direct input into the FMGEC?

The actual fault was with ADIRU 1, which never came up on the ECAM. So, which computer or computers do you isolate? All of them?; leaving yourself on the Rudder backup and the manual trim to control the aircraft with?

The loss of the autotrim is a symptom of direct law, but the report states that the "Use Manual trim" message never appeared on the PFD's.... so what Law is the aircraft operating in? Is it any wonder that there was confusion?

Utimately is doesn't matter what Law the aircraft is operating in if you apply the "Golden Rules" of flying an Airbus... that is, if it isn't doing what you expect, take over and fly it manually. Which is what the captain did.

....Manual thrust, manual trim and using the standby instruments... go through all the checklists, look after the passengers and accomplish a safe landing with a highly suspect flight control system and no clue as to the real culprit.

This crew was faced with a Black Swan event. It had never happened before.

I hope to half as well if something like this ever happens to me.

As to your amateur intimations that the ATSB somehow erred in their estimation of the performance of this crew; you are out of your depth and it shows.

[Jetsbest]

The ATSB don't just interview the crew, decide they're nice blokes, and then shield them from criticism by contriving the evidence. The report is the product of many thousands of hours work by many highly qualified people using input from more of the same.
The unprecedented happened, redundancy wasn't, automatic diagnosis didn't, and it fell to the crew to make a successful outcome from the most confusing, trying and stressful of circumstances. Where the ATSB has 'praised' it is deserved and recognizes that, in the circumstances, this crew acted in the most timely/appropriate/prompt manner possible.
It sounds like you wanted the ATSB to say something like "The crew took action in 1.2seconds, which is considered timely in the circumstances". :rolleyes:
I'm afraid I'm with Kremin on this one. :hmm:

[compressor stall]

I must side with FDG on this, that is being critical of part of the report's writing style (not the crew or their actions). The ATSB should state fact not opinion.

From the ATSB website, their goals are to:
• conduct impartial, systemic and timely safety investigations
• report safety issues clearly and objectively, without attributing blame or liability.

The definition of Objective from the OED, "Not influenced by personal feelings or opinions in considering and representing facts"


The reader should infer that an action was a "Good Decision, Son" by reading that the crew were faced with no better options available.

And as an aside, when did the ATSB start naming the companies involved? I always recalled that the company name was omitted (although it was pretty obvious who it was to those in the industry)?

[FGD135]

Good points, Stallie. This report falls short of the "objective" standard stated by the ATSB's own website. As we have seen, in places throughout the report where just plain facts should be the order of the day, we have in many instances, opinions - opinions that are slapping the crew on the back.

Every single one of those opinions that I quoted earlier could have been left out of the report entirely.

This deviation from the ATSB's own "objective" standard could be put down to the author's lack of report writing experience. (It is my assumption that he lacks experience in this regard. Other aspects of the report would suggest this).

Or, the deviation could be for the reasons I have given earlier. I'm no conspiracy theorist, but it does just sound so much like he is trying to shield the pilots.

I have only come this far on this because of those opinionated statements. When the final report became available, I looked at it with the intention of skimming through the executive summary and findings. In the executive summary was this statement:

The flight crew’s responses to the emergency were timely and appropriate.I was immediately struck by this statement as it stood out like the proverbial. I have never seen such a bald statement in such a key place of an air safety report before. Come to think of it, I have never seen a statement like it anywhere, in any air safety report, ever!

Where the ATSB has 'praised' it is deserved and recognizes that, in the circumstances, this crew acted in the most timely/appropriate/prompt manner possible.But, Jetsbest, it is not their place to praise. If praise is in order (and I believe it is), then this should be done by those that normally do it (e.g., the airline, the unions, the passengers, professional pilot groups, etc).

... when did the ATSB start naming the companies involved?Another break from convention is the usage of rank to identify the pilots. The norm when reporting actions and observations from the pilots is to refer to them as "PF" and "PNF".

Capt Kremin,

Although the crew received numerous ECAM caution messages, none of them required urgent action,
Not sure what you're getting at here, but the upset certainly required urgent action.

... which computer or computers do you isolate?By "isolate" I mean reduce, tothe greatest extent possible, the influence of the computers on the flight controls. From what I understand, this is achieved by manually forcing the computers into "direct law".

... so what Law is the aircraft operating in? Is it any wonder that there was confusion?There was an ECAM message stating that "alternate law" had been entered. I am suggesting that the best course of action would have been to force "direct law".

Like the ATSB investigator, you seem to be accepting the confusion as normal - and not something that may be a serious safety issue.

Utimately is doesn't matter what Law the aircraft is operating in if you apply the "Golden Rules" of flying an Airbus... that is, if it isn't doing what you expect, take over and fly it manually.
Not a very golden rule in this case. Flying it "manually" did not prevent the upsets. Being in "direct law" would have.

On a Chieftain or a Baron, disengaging the autopilot and "flying it manually" is a sound course of action when the autopilot starts doing funny things on the controls.

But on the Airbus, "flying it manually" means the computers are still just as involved as they are when "on autopilot", so although this would be a sound move for a range of other situations, it is not a smart move when the computers are doing dangerous things with the control surfaces.

... no clue as to the real culprit.I would dispute this. The captain was getting clues on his PFD as to who the culprit was, but I will go into that more on a future post.

The ATSB don't just interview the crew, decide they're nice blokes, and then shield them from criticism by contriving the evidence.
So how do you explain the lack of interest by the ATSB in the crew's performance subsequent to the pitch-downs? This was a minor malfunction in broad daylight VMC conditions, yet the crew were experiencing "mode confusion" and were somewhat overwhelmed. We also know they had reached a point of "distrust" of the warnings and messages.

Surely you can see that these are serious safety issues. Why can't the ATSB see this?

The ATSB needs to be seen to be objective but it has failed in many keys areas of this report. But this is only my most minor gripe. My big gripe is that there are four major safety issues that the ATSB don't seem to have recognised.

The author/investigator has zeroed in on a minor malfunction in a single component. He has missed all the systemwide safety issues.

[breakfastburrito]

You clearly have no understanding (by your own admission) of the Airbus FBW system architecture.
"normal practice for a factual report"
Have you not committed the same sin as the reports author? Emphasis on FACTUAL.

You pontificate about "minor" aircraft system faults and defame the crew about their performance without producing one shred of evidence. Criticism of the writing style of the report may be appropriate, but to draw the conclusion that this therefore, represents a cover-up of poor crew performance is beyond belief.

but I will go into that more on a future post
Don't. In fact, I would consider removing ALL your posts in this thread, and take legal advice from a defamation lawyer.

[compressor stall]

FDG,

May I suggest you separate out your two arguments as I feel they way you have presented it allows criticism that drags both down.

The first ( and bit I agree with) is that the report's writing style is not objective.

The second (and I have not the report in enough detail to form a suspicion and a cogent argument on this) is whether the crew's actions could have been better.

[Capt Kremin]

FGD,

the quote I posted was from the report, which stated that the ECAMS presented to the crew were minor and did not require urgent action.

The actual problem encountered by the crew was neither minor nor was the cause obvious. There was no ECAM for the ADIRU failure. Therefore the crew had no way to know what caused the pitchup.

The pitchup was caused by the activation of a FBW protection when it wasn't required. This was not obvious to the crew. There was no annunciation from the ECAM or FMGEC to that effect. In their minds they had a suspect flight control system and did not know why. That is a bad place to be in a FBW aircraft at 37,000 ft.

Forcing the aircraft into direct law means that you remove the protections of the FBW. The aircraft therefore responds as a non FBW aircraft. That may be the solution if you knew what the cause of the upset was and the culprit component. This crew did not and could not.

In Direct law however the flight control computers are still controlling the flight controls. A suspect flight control computer may be just as dangerous in that configuration as at any other time.

The crew turned off IRS1 and PRIM3, which were the only components reported by the ECAM to be faulty. I would put forward that if this crew had turned off anything else, without a good reason to or being led by a checklist then that may have potentially made their situation worse and the monday morning quarterbacks here such as you may actually have had a reason to criticise them.

I don't understand where you are coming from. Qantas had asolutely no problem with the response of this crew, and praised them accordingly.

Airbus has not sought to criticise them and holds them blameless.

The ATSB report holds them blameless and tells the story of a crew who handled a unique event in a professional way. Look up the meaning of unique.

Grumman Northrop obviously hold them blameless as well.

What makes you think, with your back-of-a-cornflakes-packet understanding of Airbus aircraft, that you know better?

[Jetsbest]

Your credibility takes a major hit when, as "a plodding GA driver", you express the view that "this was a minor malfunction in broad daylight VMC conditions".

What part of the term "unprecedented compound emergency" (my words) makes you think the solution was as easy as just "forcing" Direct Law. (for which btw there is still no authorised procedure);)

The A330 is not a Chieftain or a Baron, and the solution was not comparable to anything in your admitted experience base; especially since it was an unimagined/impossible event.... until it happened.

So how do you explain the lack of interest by the ATSB in the crew's performance subsequent to the pitch-downs? I say the ATSB had no further comment because the crew performed to expectations, at a very high standard, and there was little to add by way of suggested alternative courses of action. := It's not praise; they're statements of fact.

Apart from grammar, you're arguing about trivia from a position of poor A330 systems and procedural knowledge. 20/20 hindsight with the benefit of a report which took close to two years to write must be a wonderful thing for you. :rolleyes:

If only the crew had, from the first autopilot disconnection until landing with aircraft and multiple medical emergencies, had the benefit of your wisdom. Pfft.

Then again, perhaps the ATSB is right and the crew reacted in the most timely/appropriate/prompt manner possible.

[FGD135]

In their minds they had a suspect flight control system and did not know why.
Capt Kremin,

Since when does a flight control system problem announce itself via:

1. False stall warnings;
2. False overspeed warnings;
3. Erroneous altitude and airspeed indications;
4. Inertial reference system (IR) fault messages?

... a highly suspect flight control system and no clue as to the real culprit.
“No clue”? At the onset of the accident, before the first pitch-down, the captain’s PFD began giving erroneous and erratic airspeed and altitude indications. But the indications on the 2nd pilot’s PFD and standby instruments were normal and without fault.

Where does the captain’s PFD get that data from? The #1 ADIRU.

There were also false stall and false overspeed warnings. These four things all came from the #1 ADIRU.

One of the initial ECAM warning messages indicated a fault with the #1 IR (inertial reference system). That IR “component” is built into the #1 ADIRU.

How can you possibly say they had “no clue”?

Remember that all of this unfolded in the two minutes before anything happened on the flight controls.

There were more clues pointing to the #1 ADIRU, but these were less obvious, and I will concede that the systems knowledge of the average pilot is such that they probably would not have made the connection. Those were:

1.ECAM message indicating a fault with the EGPWS;
2.ECAM message indicating a fault with the “autobrakes”.


Should the pilots have had more of “a clue” as to where the problem was coming from? Is it reasonable to have expected their systems knowledge and diagnosis abilities to be better?

Why didn’t the ATSB ask these questions? Would the answers have been too uncomfortable? I believe the ATSB/BASI of old would have asked those questions.

As a youngster I would read, from cover to cover, every copy of Aviation Safety Digest I could get my hands on. There were several messages it would hammer the reader with, every chance it got. One of those messages was “know your aircraft and know its systems”.

If the pilots had recognised that #1 ADIRU was suspect and switched it off then nobody would have been injured and the flight would have continued uneventfully to Perth.

The two pilots on the flight deck had two calm, stress-free minutes to figure out what was going on. It appears they were unable to, as, at the moment they were summoning the third pilot for assistance, the first pitch-down occurred.

Was this a difficult fault to diagnose? It is always easy in hindsight to pass judgement about a crew’s actions but I believe this WAS an easy fault, and that many of the world’s Airbus pilots would have picked it.

In fact, of all the un-annunciated faults that these aircraft could present, this one would have to rank amongst the easiest to diagnose and action.

Are the pilots of these highly automated aircraft becoming dependent on the aircraft’s own warning and messaging systems for diagnosis of faults? Are they already fully dependent? And is this mindset encouraged by Qantas? What about other airlines?

It would appear that the industry expects nothing more from a pilot than the ability to read an ECAM message and respond with the appropriate checklist. This ATSB investigator appears to be of this view, as does Capt Kremin.

It also appears the industry is happy to accept that pilots of these aircraft can easily become confused. The following quote is from the report. The investigator is NOT quoting one of the pilots. These are his own words:
After the first pitch-down, the flight crew were presented with a situation that was even more confusing ...
The pilots of Air France 447 were confused too. A minor fault affecting the airspeed readings caused their autopilot to disconnect. That aircraft was in stormy weather, over the middle of the Atlantic, in the middle of the night. The aircraft was flown into a stall, where it remained for the 3 minutes it took to fall to the ocean.

There was over 20,000 hours of combined flight experience on the flight deck of the Air France aircraft but the result was no different to what could have been expected had 10 year-olds been at the controls.

There are some hard questions to be asked about the man/machine interface in these highly automated aircraft.

The ATSB had a golden opportunity to ask those questions but ducked it in favour of a report that would upset as few people as possible. This investigation and report is a blight on the once proud history of the BASI/ATSB.

Airbus has not sought to criticise them and holds them blameless.

This accident was highly embarrassing to Airbus. It was their software that thought the pitch-downs were a good idea. The much vaunted protections offered by their FBW aircraft are about protecting the aircraft from pilots, but this accident has shown that an Airbus aircraft needs protection from itself (!)

Airbus would want this accident swept under the carpet.

Qantas had absolutely no problem with the response of this crew ...Qantas were not at fault but would nevertheless, like Airbus, want the attention to die down as quickly as possible.

[Capt Kremin]

Your reasoning is flawed FGD.

You say this crew should have responded as if an ADIRU failure was a memory item to be actioned immediately lest a false FBW protection be activated with the results that occurred.

An ADIRU failure at the time, was a non-event ECAM checklist. A faulty ADIRU was supposed to be compared to the other two, and if it had suspect data it would be ignored by the flight control system and flight data to the crew would be restored by switching.

In this case, not only was the relevant ECAM not displayed, but the system reacted to the false data in a way never envisioned by the designers.

You seem to think that the crew should have had some sort of immediate cognizance of an unannunciated fault, and should have gone against their training and immediately switched off the ADIRU to avoid an outcome that somehow, they presciently realised may happen? .... something that had never previously occurred in 28 million flight hours?

The QPG fault a few months later was ameliorated by use of the OEB that did not exist for the QPA incident. That crew reacted with full knowledge of what had gone before them and a checklist to cope with it.... something the crew of QPA did not.

Congratulations of the excellent 20/20 hindsight...

[Jack Ranga]

mmmmmm, just think, in about 5 years time an ex Jetstar cadet could be in charge of one of these things with a fresh cadet sitting beside him/her. How cool!

[adsyj]

Captain Kremin

Congratulations on the patience and restraint you have shown in your responses to FGD.

I consider his/her very thinly veiled attack on the operating crew and ATSB investigators whilst admiting to have no operational experience on type disgraceful, and that is where he lost me. You sir have provided excellent education and counter argument.

FGD the last three statements in your post 15 are disgraceful and you should withdraw them. Additionally take the conspiracy hat off and you may learn from Captain K.

[Sunfish]

Trying to take one step back from this matter, it would appear that the common issue in both this incident and the Air France accident is that the failure occurred in a manner that was not simply discoverable by the crew, all the crew sees is the outcome, thus leaving them guessing as to what the fault isolation and corrective action might be.

I know this is basically a safety philosophy matter which has probably been covered by many metres thick of learned papers, but we do not seem to have redundant, independent systems for fault monitoring.

To put that another way; the stuff that is flying the aircraft is supposed to tell you when its failed, and if it doesn't, then there is bugger all you can do about the failure.

For example, take the case of the A380 engine failure. Would the crew have been able to correctly diagnose what had happened if the failure had occurred at night, without loud noises and in turbulence? Would the fuel leak and structural damage have been visible? There would have been no "Skipper we've lost an engine, we have a fuel leak and dirty great hole in the wing". Instead the crew would have to wade through the 50+ ECAM messages and try and deduce what had happened, starting with the question "Is the ECAM telling me the truth, or is it broken as well?"

At least with control cables there is some redundant haptic feedback as to what might be going on at the other end.

To put that another way, how many Airbus accidents have been caused by the sophistication and elegance of its control systems?

We have at least AF447, VH-QPA, F-WWKH and Aeroflot 593.

[psycho joe]

At least with control cables there is some redundant haptic feedback as to what might be going on at the other end.

No there isn't. On a modern airliner, that haptic or tactile feedback is entirely artificial. It's designed to stop gross inputs by fooling the Pilot's brain into thinking that they are getting a tactile response from control inputs.

To put that another way, how many Airbus accidents have been caused by the sophistication and elegance of its control systems?

We have at least AF447, VH-QPA, F-WWKH and Aeroflot 593

AF 447 did exactly what the manual says it should do under those circumstances.

VH-QPA (according to the report) can't happen again and was a component fault.

F-WWKH was an edge of envelope test flight, not something that line pilots would be likely to ever see and could have occurred on a non FBW aircraft under the circumstances.

Aeroflot 593 was flown into the ground by a 15 year old boy.


FBW is here to stay. If you drive a modern car then there's every chance that your control inputs are actioned Or moderated via "throttle by wire", " steering by wire" " electronic stability control computers" and ABS computers.

[limelight]

To quote Sunfish 'Trying to take one step back from this matter, it would appear that the common issue in both this incident and the Air France accident is that the failure occurred in a manner that was not simply discoverable by the crew, all the crew sees is the outcome, thus leaving them guessing as to what the fault isolation and corrective action might be.'

He is correct, maybe AB should add a few 'Inconsistency between A and B' components. That at least would allow quicker diagnosis, instead of trying to fix it internally without reference to the crew?

[Up-into-the-air]

SUGGESTION 2 for a positive change to go forward in 2012:

Fix ATSB’s funding.

In the recent Senate Committee into ATSB put a submission as submission 25 [http://www.aph.gov.au/senate/committee/rat_ctte/pilots_2010/submissions.htm] for the Senate Inquiry into Pilot Training and Airline Safety Including the Transport Safety Investigation Amendment (Incident Reporting) Bill 2010

It reads in part:

In 2009 – 10 the ATSB received approximately 15 100 notifications through its mandatory accident and incident reporting system (8 393 were classified as safety occurrences). During that period the ATSB had the resources to commence 70 new investigations. Ten safety research and analysis reports were released in this period.

I don't think they are going to get on top of this easily.

The funding issues is great also, which covers all the ATSB marine, aviation and road responsibilities, as shown below [casa has over $170m]:

http://img163.imageshack.us/img163/5139/basidata20102011.png

[aveng]

This is why there needs to be a big red button that says "Off"
When you press it, when you move the stick back, plane goes up, stick forward, plane goes down.
No if's, buts or maybe's.

Accidents have happened already when the computer takes a mind of its own.
There was an off button, along with a FAULT light, that was on steady above the Capts head!

What I totally fail to comprehend, is why the crew failed to do a cockpit scan and if they did, why didn't they select the part of ADIRU1 that was showing "FAULT". The nice thing about the A330 as compaired to the 777 is being able to select half or all of the three ADIRU's off.

[Capt Fathom]

Maybe because you don't go turning switches on/off unless called for in a checklist procedure.

Unless of course you know more about how the system works than the manufacturer.

Good luck with that!

[Sunfish]

Psycho Joe:

FBW is here to stay. If you drive a modern car then there's every chance that your control inputs are actioned Or moderated via "throttle by wire", " steering by wire" " electronic stability control computers" and ABS computers.

Psych, the problem with flying which makes it different from driving a car is that I don't have an issue with determining what reality is.

In a car, if the engine she make noises, I have problem.

In the car, if the engine she no go, I stop.

In a car, if I turn the wheel and the car she no turn, I know I have a problem (especially if she no stop).

What I was trying to say, perhaps badly, is that the systems by which you are flying the aircraft are also creating the artificial reality by which you are monitoring the performance of the system. If the system screws up, you not only have a badly performing flight control system, you have a badly performing reality.

As a trivial example of automation, I departed Queenscliife on my yacht at 4.00 am for Melbourne Two days ago, relying on the autopilot, charting computer and software to take me down the West Channel. However I had the mark I eyeball to monitor what was happening, even in the dark.

Would I have trusted that system to do the same thing in Fog? I don't think so. - No redundancy - that is all I am saying. The Airbus software is both Poacher and Gamekeeper - not a good thing.

[1a sound asleep]

Take away the protection with the OFF switch and I am more scared by the possibility of destroying the plastic plane with its limited G tolerances.

China Airlines Flight 006, the Boeing 747SP where the crew was forced to overstress and structurally damage the horizontal tail surfaces in order to recover from a roll and near-vertical dive. This had been caused automatic disconnect of autopilot and incorrect handling of a yaw brought about by an engine failure. The pilot recovered control with about 10,000 ft of altitude remaining but with an estimated 5.5 G, or more than double design limits.

Now lets imagine it was an Airbus A330 what would have happened?.

ASN Aircraft accident Boeing 747SP-09 N4522V San Fransisco, CA, USA (http://aviation-safety.net/database/record.php?id=19850219-0)

http://wiki-images.enotes.com/thumb/f/f6/Chinaair006.png/300px-Chinaair006.png

[aveng]

Maybe because you don't go turning switches on/off unless called for in a checklist procedure.

Unless of course you know more about how the system works than the manufacturer.

Good luck with that!

Dont they teach free thinking anymore? If the ecam is going nuts and the actions reqd can't be read and the aircraft is nose diving this requires some thinking outside the box. When is a good time to do something?:rolleyes:

[psycho joe]

What I was trying to say, perhaps badly, is that the systems by which you are flying the aircraft are also creating the artificial reality by which you are monitoring the performance of the system. If the system screws up, you not only have a badly performing flight control system, you have a badly performing reality.



Sunfish, I've flown Boeings and A330's and what you're saying is ridiculous.

Dont they teach free thinking anymore?

In essence, no. It's called troubleshooting and according to Boeing and Airbus, it generally does more harm than good.

[1a sound asleep]

Ex A380

I was referring to the suggestion in a prior post that there should be an OFF button where a pilot could switch off computers.

I don't think many understand that the FBW systems allow a lighter construction of the airframe. In the Air China accident a FBW plane would have likely fallen apart if protection systems had been not working


This is why there needs to be a big red button that says "Off"
When you press it, when you move the stick back, plane goes up, stick forward, plane goes down.
No if's, buts or maybe's.

Accidents have happened already when the computer takes a mind of its own.

[oicur12.again]

"Now lets imagine it was an Airbus A330 what would have happened?."

Dont know about a FBW bus pulling 5.5g but the A310 was built pretty strong - lah.

Bay Of Bengal anybody?

[boocs]

Now now Oicur..... :=

b.

[1a sound asleep]

Dont know about a FBW bus pulling 5.5g but the A310 was built pretty strong - lah.

Bay Of Bengal anybody?Photos: Airbus A310-324 Aircraft Pictures | Airliners.net (http://www.airliners.net/photo/Singapore-Airlines/Airbus-A310-324/0244687/L/)

9V-STO (cn 433) Nicknamed "Suddenly Turn Over" by SIA staff after the registration. This aircraft unintentionally performed some aerobatics over the Bay of Bengal quite a few years ago.

[Sunfish]

Psycho Joe:

Quote:
What I was trying to say, perhaps badly, is that the systems by which you are flying the aircraft are also creating the artificial reality by which you are monitoring the performance of the system. If the system screws up, you not only have a badly performing flight control system, you have a badly performing reality.

Sunfish, I've flown Boeings and A330's and what you're saying is ridiculous.

Quote:
Dont they teach free thinking anymore?

In essence, no. It's called troubleshooting and according to Boeing and Airbus, it generally does more harm than good.

Psych, What happened to AF447 wasn't ridiculous - the tightly integrated Airbus control system was no longer able to represent reality to the crew in a meaningful way that would have allowed them to take corrective action in time.

As for "troubleshooting" - this is exactly what the crew of the QF A380 successfully did after they lost an engine and cut a data-bus in the process. There was nothing in the manual for that one either.

[AussieAviator]

I have about 4000 hours command time on A320 aircraft, and while the A330 is very similar, there are many subtle differences, so I can't specifically comment on the A330. Some posters here seem to say that Airbus aircraft should have a master multi position switch that can be activated to switch to a new flight control law. It is not as simple as that because the computers all have redundancy built in, and by simply switching it off, this could cause even further unforeseen problems, than the the original fault, which may be a minor sub-system providing input to it's associated computer. Flying a Airbus in Direct Law is quite a demanding task, but interestingly enough, the Bus can be flown without ANY computers by rudder pedals and stab trim only. I think that this crew did exceedingly well considering that they had a problem that had NEVER presented before. If you would like to know more about how this aircraft ticks, follow this link.

SmartCockpit - Airline training guides, Aviation, Operations, Safety (http://www.smartcockpit.com/pdf/plane/airbus/A330/systems/0010/)

SmartCockpit - Airline training guides, Aviation, Operations, Safety (http://www.smartcockpit.com/pdf/plane/airbus/A330/instructor/0041/)

[aveng]

As for "troubleshooting" - this is exactly what the crew of the QF A380 successfully did after they lost an engine and cut a data-bus in the process. There was nothing in the manual for that one either.

Sorry, thats what I was alluding to. Do something - dont just ride the roller coaster.:ok:

[Capt Kremin]

Aveng,

Your comments appear to indicate you haven't actually read the report in any great detail...

This one in particular...

There was an off button, along with a FAULT light, that was on steady above the Capts head! is dead wrong.

[teresa green]

Totally off topic I know Mod, but would QF mind sending that A380 over the SCG, it worked a treat before in MEL and its continuing, 300 not out. Just once more should do it!:D

[psycho joe]

Psych, What happened to AF447 wasn't ridiculous - the tightly integrated Airbus control system was no longer able to represent reality to the crew in a meaningful way that would have allowed them to take corrective action in time.



Are you kidding? The aircraft performed exactly as it was supposed to under the circumstances. The accident had nothing to with "integrated control systems".

It had everything to do with two pilot's who flew into a line of thunderstorms because of a lack of Wx radar mode awareness.

The crew failed to recognise a transient unreliable speed indication and induced the aircraft into a stall and made no effort to recover from the stall until approx 2000 agl, despite the fact that the aircraft was barking:

STALL STALL...STALL STALL... STALL STALL

How could they be presented with more "reality"?

Every system on AF447 was functioning normally when it hit the water.

I'm sorry, but I do find this Airbus/FBW witch hunt by non pilot's to be ridiculous. You simply dislike something that you don't understand.

If I could borrow a Clarksonism:

Conventional flight controls are like trying to manoeuvre a cow up the back steps of your house, whereas FBW is like smearing honey into Miranda Kerr.

[psycho joe]

You are wrong. Unreliable airspeed - and aircraft was in alternate law. They failed to fly the correct stall recovery. have you flown airbus or been in one?



Unreliable airspeed was transient.

Yes, you are right the aircraft was in alt law. And what are the characteristics of alt law?

-In pitch: Same as normal law
-In roll: Same as normal law
-In yaw: same as normal law
that was my point.

They didn't fail to fly the correct recovery, they failed to recognise that the aircraft was stalling so they didn't attempt to recover.

yes and yes.

I totally agree, I didn't bring it up.

[psycho joe]

Mate back to recurrent ground school for you.
Alternate law-
No pitch or bank protection.
High alpha prot and max alpha replaced by low speed stability (stall warning speed)
No alpha floor protection



:ugh: I would have said it was exceedingly obvious that the protections inherent in normal law were not available in alt law, given that we are talking about an aircraft that stalled into the sea. :D

However those protections, or the lack of, do not alter the pilot's ability to control the aircraft. ie this was not a control issue.

[aveng]

Aveng,

Your comments appear to indicate you haven't actually read the report in any great detail...

This one in particular...


Quote:
There was an off button, along with a FAULT light, that was on steady above the Capts head!

is dead wrong.

So your saying the adiru1 fault light was not on? (and if you select it, it says 'OFF'). The eng's that were sent to Learmonth said it was still on when they got there.

Your right I didn't read the ATSB report, I saw more of the raw data and made my own conclusions based on what I know about the A330 and a little study of the maintenance/training manuals. The adiru fault light was on almost immediately, along with the aprox 1sec failure scan rate that was stuffing up the Ecam action list. The supposed lack of response by the elevator came from prim1 handing over to 2 to 3 then to alt law so there was a slight delay - but quite quick when you realise how much the a/c's fly by wire was trying to sort things and comply with pilot input.

[Capt Fathom]

Give it up..... Please!