Airbus A330-303, VH-QPA 7 October 2008 - ATSB Report
Join Date: Apr 2008
Location: On a long enough timeline the survival rate for everyone is zero
Posts: 731
Likes: 0
Received 0 Likes
on
0 Posts
You clearly have no understanding (by your own admission) of the Airbus FBW system architecture.
Have you not committed the same sin as the reports author? Emphasis on FACTUAL.
You pontificate about "minor" aircraft system faults and defame the crew about their performance without producing one shred of evidence. Criticism of the writing style of the report may be appropriate, but to draw the conclusion that this therefore, represents a cover-up of poor crew performance is beyond belief.
Don't. In fact, I would consider removing ALL your posts in this thread, and take legal advice from a defamation lawyer.
Originally Posted by FGD135
"normal practice for a factual report"
You pontificate about "minor" aircraft system faults and defame the crew about their performance without producing one shred of evidence. Criticism of the writing style of the report may be appropriate, but to draw the conclusion that this therefore, represents a cover-up of poor crew performance is beyond belief.
but I will go into that more on a future post
FDG
FDG,
May I suggest you separate out your two arguments as I feel they way you have presented it allows criticism that drags both down.
The first ( and bit I agree with) is that the report's writing style is not objective.
The second (and I have not the report in enough detail to form a suspicion and a cogent argument on this) is whether the crew's actions could have been better.
May I suggest you separate out your two arguments as I feel they way you have presented it allows criticism that drags both down.
The first ( and bit I agree with) is that the report's writing style is not objective.
The second (and I have not the report in enough detail to form a suspicion and a cogent argument on this) is whether the crew's actions could have been better.
Last edited by compressor stall; 30th Dec 2011 at 20:30.
Join Date: Mar 2007
Location: Roguesville, cloud cuckooland
Posts: 1,197
Likes: 0
Received 16 Likes
on
5 Posts
FGD,
the quote I posted was from the report, which stated that the ECAMS presented to the crew were minor and did not require urgent action.
The actual problem encountered by the crew was neither minor nor was the cause obvious. There was no ECAM for the ADIRU failure. Therefore the crew had no way to know what caused the pitchup.
The pitchup was caused by the activation of a FBW protection when it wasn't required. This was not obvious to the crew. There was no annunciation from the ECAM or FMGEC to that effect. In their minds they had a suspect flight control system and did not know why. That is a bad place to be in a FBW aircraft at 37,000 ft.
Forcing the aircraft into direct law means that you remove the protections of the FBW. The aircraft therefore responds as a non FBW aircraft. That may be the solution if you knew what the cause of the upset was and the culprit component. This crew did not and could not.
In Direct law however the flight control computers are still controlling the flight controls. A suspect flight control computer may be just as dangerous in that configuration as at any other time.
The crew turned off IRS1 and PRIM3, which were the only components reported by the ECAM to be faulty. I would put forward that if this crew had turned off anything else, without a good reason to or being led by a checklist then that may have potentially made their situation worse and the monday morning quarterbacks here such as you may actually have had a reason to criticise them.
I don't understand where you are coming from. Qantas had asolutely no problem with the response of this crew, and praised them accordingly.
Airbus has not sought to criticise them and holds them blameless.
The ATSB report holds them blameless and tells the story of a crew who handled a unique event in a professional way. Look up the meaning of unique.
Grumman Northrop obviously hold them blameless as well.
What makes you think, with your back-of-a-cornflakes-packet understanding of Airbus aircraft, that you know better?
the quote I posted was from the report, which stated that the ECAMS presented to the crew were minor and did not require urgent action.
The actual problem encountered by the crew was neither minor nor was the cause obvious. There was no ECAM for the ADIRU failure. Therefore the crew had no way to know what caused the pitchup.
The pitchup was caused by the activation of a FBW protection when it wasn't required. This was not obvious to the crew. There was no annunciation from the ECAM or FMGEC to that effect. In their minds they had a suspect flight control system and did not know why. That is a bad place to be in a FBW aircraft at 37,000 ft.
Forcing the aircraft into direct law means that you remove the protections of the FBW. The aircraft therefore responds as a non FBW aircraft. That may be the solution if you knew what the cause of the upset was and the culprit component. This crew did not and could not.
In Direct law however the flight control computers are still controlling the flight controls. A suspect flight control computer may be just as dangerous in that configuration as at any other time.
The crew turned off IRS1 and PRIM3, which were the only components reported by the ECAM to be faulty. I would put forward that if this crew had turned off anything else, without a good reason to or being led by a checklist then that may have potentially made their situation worse and the monday morning quarterbacks here such as you may actually have had a reason to criticise them.
I don't understand where you are coming from. Qantas had asolutely no problem with the response of this crew, and praised them accordingly.
Airbus has not sought to criticise them and holds them blameless.
The ATSB report holds them blameless and tells the story of a crew who handled a unique event in a professional way. Look up the meaning of unique.
Grumman Northrop obviously hold them blameless as well.
What makes you think, with your back-of-a-cornflakes-packet understanding of Airbus aircraft, that you know better?
FGD...
Your credibility takes a major hit when, as "a plodding GA driver", you express the view that "this was a minor malfunction in broad daylight VMC conditions".
What part of the term "unprecedented compound emergency" (my words) makes you think the solution was as easy as just "forcing" Direct Law. (for which btw there is still no authorised procedure)
The A330 is not a Chieftain or a Baron, and the solution was not comparable to anything in your admitted experience base; especially since it was an unimagined/impossible event.... until it happened.
So how do you explain the lack of interest by the ATSB in the crew's performance subsequent to the pitch-downs? I say the ATSB had no further comment because the crew performed to expectations, at a very high standard, and there was little to add by way of suggested alternative courses of action.
It's not praise; they're statements of fact.
Apart from grammar, you're arguing about trivia from a position of poor A330 systems and procedural knowledge. 20/20 hindsight with the benefit of a report which took close to two years to write must be a wonderful thing for you.
If only the crew had, from the first autopilot disconnection until landing with aircraft and multiple medical emergencies, had the benefit of your wisdom. Pfft.
Then again, perhaps the ATSB is right and the crew reacted in the most timely/appropriate/prompt manner possible.
What part of the term "unprecedented compound emergency" (my words) makes you think the solution was as easy as just "forcing" Direct Law. (for which btw there is still no authorised procedure)
The A330 is not a Chieftain or a Baron, and the solution was not comparable to anything in your admitted experience base; especially since it was an unimagined/impossible event.... until it happened.
So how do you explain the lack of interest by the ATSB in the crew's performance subsequent to the pitch-downs? I say the ATSB had no further comment because the crew performed to expectations, at a very high standard, and there was little to add by way of suggested alternative courses of action.
It's not praise; they're statements of fact.Apart from grammar, you're arguing about trivia from a position of poor A330 systems and procedural knowledge. 20/20 hindsight with the benefit of a report which took close to two years to write must be a wonderful thing for you.
If only the crew had, from the first autopilot disconnection until landing with aircraft and multiple medical emergencies, had the benefit of your wisdom. Pfft.
Then again, perhaps the ATSB is right and the crew reacted in the most timely/appropriate/prompt manner possible.
Join Date: Apr 2008
Location: Australia
Posts: 669
Likes: 0
Received 0 Likes
on
0 Posts
In their minds they had a suspect flight control system and did not know why.
Capt Kremin,
Since when does a flight control system problem announce itself via:
1. False stall warnings;
2. False overspeed warnings;
3. Erroneous altitude and airspeed indications;
4. Inertial reference system (IR) fault messages?
... a highly suspect flight control system and no clue as to the real culprit.
“No clue”? At the onset of the accident, before the first pitch-down, the captain’s PFD began giving erroneous and erratic airspeed and altitude indications. But the indications on the 2nd pilot’s PFD and standby instruments were normal and without fault.
Where does the captain’s PFD get that data from? The #1 ADIRU.
There were also false stall and false overspeed warnings. These four things all came from the #1 ADIRU.
One of the initial ECAM warning messages indicated a fault with the #1 IR (inertial reference system). That IR “component” is built into the #1 ADIRU.
How can you possibly say they had “no clue”?
Remember that all of this unfolded in the two minutes before anything happened on the flight controls.
There were more clues pointing to the #1 ADIRU, but these were less obvious, and I will concede that the systems knowledge of the average pilot is such that they probably would not have made the connection. Those were:
1.ECAM message indicating a fault with the EGPWS;
2.ECAM message indicating a fault with the “autobrakes”.
Should the pilots have had more of “a clue” as to where the problem was coming from? Is it reasonable to have expected their systems knowledge and diagnosis abilities to be better?
Why didn’t the ATSB ask these questions? Would the answers have been too uncomfortable? I believe the ATSB/BASI of old would have asked those questions.
As a youngster I would read, from cover to cover, every copy of Aviation Safety Digest I could get my hands on. There were several messages it would hammer the reader with, every chance it got. One of those messages was “know your aircraft and know its systems”.
If the pilots had recognised that #1 ADIRU was suspect and switched it off then nobody would have been injured and the flight would have continued uneventfully to Perth.
The two pilots on the flight deck had two calm, stress-free minutes to figure out what was going on. It appears they were unable to, as, at the moment they were summoning the third pilot for assistance, the first pitch-down occurred.
Was this a difficult fault to diagnose? It is always easy in hindsight to pass judgement about a crew’s actions but I believe this WAS an easy fault, and that many of the world’s Airbus pilots would have picked it.
In fact, of all the un-annunciated faults that these aircraft could present, this one would have to rank amongst the easiest to diagnose and action.
Are the pilots of these highly automated aircraft becoming dependent on the aircraft’s own warning and messaging systems for diagnosis of faults? Are they already fully dependent? And is this mindset encouraged by Qantas? What about other airlines?
It would appear that the industry expects nothing more from a pilot than the ability to read an ECAM message and respond with the appropriate checklist. This ATSB investigator appears to be of this view, as does Capt Kremin.
It also appears the industry is happy to accept that pilots of these aircraft can easily become confused. The following quote is from the report. The investigator is NOT quoting one of the pilots. These are his own words:
After the first pitch-down, the flight crew were presented with a situation that was even more confusing ...
The pilots of Air France 447 were confused too. A minor fault affecting the airspeed readings caused their autopilot to disconnect. That aircraft was in stormy weather, over the middle of the Atlantic, in the middle of the night. The aircraft was flown into a stall, where it remained for the 3 minutes it took to fall to the ocean.
There was over 20,000 hours of combined flight experience on the flight deck of the Air France aircraft but the result was no different to what could have been expected had 10 year-olds been at the controls.
There are some hard questions to be asked about the man/machine interface in these highly automated aircraft.
The ATSB had a golden opportunity to ask those questions but ducked it in favour of a report that would upset as few people as possible. This investigation and report is a blight on the once proud history of the BASI/ATSB.
Airbus has not sought to criticise them and holds them blameless.
This accident was highly embarrassing to Airbus. It was their software that thought the pitch-downs were a good idea. The much vaunted protections offered by their FBW aircraft are about protecting the aircraft from pilots, but this accident has shown that an Airbus aircraft needs protection from itself (!)
Airbus would want this accident swept under the carpet.
Qantas had absolutely no problem with the response of this crew ...
Last edited by FGD135; 4th Jan 2012 at 04:15. Reason: Changed 10 minutes to 3 minutes
Join Date: Mar 2007
Location: Roguesville, cloud cuckooland
Posts: 1,197
Likes: 0
Received 16 Likes
on
5 Posts
Your reasoning is flawed FGD.
You say this crew should have responded as if an ADIRU failure was a memory item to be actioned immediately lest a false FBW protection be activated with the results that occurred.
An ADIRU failure at the time, was a non-event ECAM checklist. A faulty ADIRU was supposed to be compared to the other two, and if it had suspect data it would be ignored by the flight control system and flight data to the crew would be restored by switching.
In this case, not only was the relevant ECAM not displayed, but the system reacted to the false data in a way never envisioned by the designers.
You seem to think that the crew should have had some sort of immediate cognizance of an unannunciated fault, and should have gone against their training and immediately switched off the ADIRU to avoid an outcome that somehow, they presciently realised may happen? .... something that had never previously occurred in 28 million flight hours?
The QPG fault a few months later was ameliorated by use of the OEB that did not exist for the QPA incident. That crew reacted with full knowledge of what had gone before them and a checklist to cope with it.... something the crew of QPA did not.
Congratulations of the excellent 20/20 hindsight...
You say this crew should have responded as if an ADIRU failure was a memory item to be actioned immediately lest a false FBW protection be activated with the results that occurred.
An ADIRU failure at the time, was a non-event ECAM checklist. A faulty ADIRU was supposed to be compared to the other two, and if it had suspect data it would be ignored by the flight control system and flight data to the crew would be restored by switching.
In this case, not only was the relevant ECAM not displayed, but the system reacted to the false data in a way never envisioned by the designers.
You seem to think that the crew should have had some sort of immediate cognizance of an unannunciated fault, and should have gone against their training and immediately switched off the ADIRU to avoid an outcome that somehow, they presciently realised may happen? .... something that had never previously occurred in 28 million flight hours?
The QPG fault a few months later was ameliorated by use of the OEB that did not exist for the QPA incident. That crew reacted with full knowledge of what had gone before them and a checklist to cope with it.... something the crew of QPA did not.
Congratulations of the excellent 20/20 hindsight...
Join Date: Nov 2006
Location: Sydney
Posts: 159
Likes: 0
Received 0 Likes
on
0 Posts
Captain Kremin
Congratulations on the patience and restraint you have shown in your responses to FGD.
I consider his/her very thinly veiled attack on the operating crew and ATSB investigators whilst admiting to have no operational experience on type disgraceful, and that is where he lost me. You sir have provided excellent education and counter argument.
FGD the last three statements in your post 15 are disgraceful and you should withdraw them. Additionally take the conspiracy hat off and you may learn from Captain K.
Congratulations on the patience and restraint you have shown in your responses to FGD.
I consider his/her very thinly veiled attack on the operating crew and ATSB investigators whilst admiting to have no operational experience on type disgraceful, and that is where he lost me. You sir have provided excellent education and counter argument.
FGD the last three statements in your post 15 are disgraceful and you should withdraw them. Additionally take the conspiracy hat off and you may learn from Captain K.
Trying to take one step back from this matter, it would appear that the common issue in both this incident and the Air France accident is that the failure occurred in a manner that was not simply discoverable by the crew, all the crew sees is the outcome, thus leaving them guessing as to what the fault isolation and corrective action might be.
I know this is basically a safety philosophy matter which has probably been covered by many metres thick of learned papers, but we do not seem to have redundant, independent systems for fault monitoring.
To put that another way; the stuff that is flying the aircraft is supposed to tell you when its failed, and if it doesn't, then there is bugger all you can do about the failure.
For example, take the case of the A380 engine failure. Would the crew have been able to correctly diagnose what had happened if the failure had occurred at night, without loud noises and in turbulence? Would the fuel leak and structural damage have been visible? There would have been no "Skipper we've lost an engine, we have a fuel leak and dirty great hole in the wing". Instead the crew would have to wade through the 50+ ECAM messages and try and deduce what had happened, starting with the question "Is the ECAM telling me the truth, or is it broken as well?"
At least with control cables there is some redundant haptic feedback as to what might be going on at the other end.
To put that another way, how many Airbus accidents have been caused by the sophistication and elegance of its control systems?
We have at least AF447, VH-QPA, F-WWKH and Aeroflot 593.
I know this is basically a safety philosophy matter which has probably been covered by many metres thick of learned papers, but we do not seem to have redundant, independent systems for fault monitoring.
To put that another way; the stuff that is flying the aircraft is supposed to tell you when its failed, and if it doesn't, then there is bugger all you can do about the failure.
For example, take the case of the A380 engine failure. Would the crew have been able to correctly diagnose what had happened if the failure had occurred at night, without loud noises and in turbulence? Would the fuel leak and structural damage have been visible? There would have been no "Skipper we've lost an engine, we have a fuel leak and dirty great hole in the wing". Instead the crew would have to wade through the 50+ ECAM messages and try and deduce what had happened, starting with the question "Is the ECAM telling me the truth, or is it broken as well?"
At least with control cables there is some redundant haptic feedback as to what might be going on at the other end.
To put that another way, how many Airbus accidents have been caused by the sophistication and elegance of its control systems?
We have at least AF447, VH-QPA, F-WWKH and Aeroflot 593.
Join Date: Mar 2005
Location: shivering in the cold dark shadow of my own magnificence.
Posts: 522
Likes: 0
Received 0 Likes
on
0 Posts
At least with control cables there is some redundant haptic feedback as to what might be going on at the other end.
To put that another way, how many Airbus accidents have been caused by the sophistication and elegance of its control systems?
We have at least AF447, VH-QPA, F-WWKH and Aeroflot 593
We have at least AF447, VH-QPA, F-WWKH and Aeroflot 593
VH-QPA (according to the report) can't happen again and was a component fault.
F-WWKH was an edge of envelope test flight, not something that line pilots would be likely to ever see and could have occurred on a non FBW aircraft under the circumstances.
Aeroflot 593 was flown into the ground by a 15 year old boy.
FBW is here to stay. If you drive a modern car then there's every chance that your control inputs are actioned Or moderated via "throttle by wire", " steering by wire" " electronic stability control computers" and ABS computers.
Last edited by psycho joe; 4th Jan 2012 at 03:29.
Join Date: Aug 2007
Location: australia
Posts: 88
Likes: 0
Received 0 Likes
on
0 Posts
To quote Sunfish 'Trying to take one step back from this matter, it would appear that the common issue in both this incident and the Air France accident is that the failure occurred in a manner that was not simply discoverable by the crew, all the crew sees is the outcome, thus leaving them guessing as to what the fault isolation and corrective action might be.'
He is correct, maybe AB should add a few 'Inconsistency between A and B' components. That at least would allow quicker diagnosis, instead of trying to fix it internally without reference to the crew?
He is correct, maybe AB should add a few 'Inconsistency between A and B' components. That at least would allow quicker diagnosis, instead of trying to fix it internally without reference to the crew?
Join Date: May 2010
Location: More than 300km from SY, Australia
Posts: 817
Likes: 0
Received 0 Likes
on
0 Posts
ATSB not correctly funded - casa overfunded
SUGGESTION 2 for a positive change to go forward in 2012:
Fix ATSB’s funding.
In the recent Senate Committee into ATSB put a submission as submission 25 [http://www.aph.gov.au/senate/committ...bmissions.htm] for the Senate Inquiry into Pilot Training and Airline Safety Including the Transport Safety Investigation Amendment (Incident Reporting) Bill 2010
It reads in part:
In 2009 – 10 the ATSB received approximately 15 100 notifications through its mandatory accident and incident reporting system (8 393 were classified as safety occurrences). During that period the ATSB had the resources to commence 70 new investigations. Ten safety research and analysis reports were released in this period.
I don't think they are going to get on top of this easily.
The funding issues is great also, which covers all the ATSB marine, aviation and road responsibilities, as shown below [casa has over $170m]:
Join Date: Feb 2005
Location: Past the rabbit proof fence
Posts: 242
Likes: 0
Received 0 Likes
on
0 Posts
This is why there needs to be a big red button that says "Off"
When you press it, when you move the stick back, plane goes up, stick forward, plane goes down.
No if's, buts or maybe's.
Accidents have happened already when the computer takes a mind of its own.
When you press it, when you move the stick back, plane goes up, stick forward, plane goes down.
No if's, buts or maybe's.
Accidents have happened already when the computer takes a mind of its own.
What I totally fail to comprehend, is why the crew failed to do a cockpit scan and if they did, why didn't they select the part of ADIRU1 that was showing "FAULT". The nice thing about the A330 as compaired to the 777 is being able to select half or all of the three ADIRU's off.
Maybe because you don't go turning switches on/off unless called for in a checklist procedure.
Unless of course you know more about how the system works than the manufacturer.
Good luck with that!
Unless of course you know more about how the system works than the manufacturer.
Good luck with that!
Psycho Joe:
Psych, the problem with flying which makes it different from driving a car is that I don't have an issue with determining what reality is.
In a car, if the engine she make noises, I have problem.
In the car, if the engine she no go, I stop.
In a car, if I turn the wheel and the car she no turn, I know I have a problem (especially if she no stop).
What I was trying to say, perhaps badly, is that the systems by which you are flying the aircraft are also creating the artificial reality by which you are monitoring the performance of the system. If the system screws up, you not only have a badly performing flight control system, you have a badly performing reality.
As a trivial example of automation, I departed Queenscliife on my yacht at 4.00 am for Melbourne Two days ago, relying on the autopilot, charting computer and software to take me down the West Channel. However I had the mark I eyeball to monitor what was happening, even in the dark.
Would I have trusted that system to do the same thing in Fog? I don't think so. - No redundancy - that is all I am saying. The Airbus software is both Poacher and Gamekeeper - not a good thing.
FBW is here to stay. If you drive a modern car then there's every chance that your control inputs are actioned Or moderated via "throttle by wire", " steering by wire" " electronic stability control computers" and ABS computers.
In a car, if the engine she make noises, I have problem.
In the car, if the engine she no go, I stop.
In a car, if I turn the wheel and the car she no turn, I know I have a problem (especially if she no stop).
What I was trying to say, perhaps badly, is that the systems by which you are flying the aircraft are also creating the artificial reality by which you are monitoring the performance of the system. If the system screws up, you not only have a badly performing flight control system, you have a badly performing reality.
As a trivial example of automation, I departed Queenscliife on my yacht at 4.00 am for Melbourne Two days ago, relying on the autopilot, charting computer and software to take me down the West Channel. However I had the mark I eyeball to monitor what was happening, even in the dark.
Would I have trusted that system to do the same thing in Fog? I don't think so. - No redundancy - that is all I am saying. The Airbus software is both Poacher and Gamekeeper - not a good thing.
Take away the protection with the OFF switch and I am more scared by the possibility of destroying the plastic plane with its limited G tolerances.
China Airlines Flight 006, the Boeing 747SP where the crew was forced to overstress and structurally damage the horizontal tail surfaces in order to recover from a roll and near-vertical dive. This had been caused automatic disconnect of autopilot and incorrect handling of a yaw brought about by an engine failure. The pilot recovered control with about 10,000 ft of altitude remaining but with an estimated 5.5 G, or more than double design limits.
Now lets imagine it was an Airbus A330 what would have happened?.
ASN Aircraft accident Boeing 747SP-09 N4522V San Fransisco, CA, USA
China Airlines Flight 006, the Boeing 747SP where the crew was forced to overstress and structurally damage the horizontal tail surfaces in order to recover from a roll and near-vertical dive. This had been caused automatic disconnect of autopilot and incorrect handling of a yaw brought about by an engine failure. The pilot recovered control with about 10,000 ft of altitude remaining but with an estimated 5.5 G, or more than double design limits.
Now lets imagine it was an Airbus A330 what would have happened?.
ASN Aircraft accident Boeing 747SP-09 N4522V San Fransisco, CA, USA
Join Date: Feb 2005
Location: Past the rabbit proof fence
Posts: 242
Likes: 0
Received 0 Likes
on
0 Posts
Maybe because you don't go turning switches on/off unless called for in a checklist procedure.
Unless of course you know more about how the system works than the manufacturer.
Good luck with that!
Unless of course you know more about how the system works than the manufacturer.
Good luck with that!
Join Date: Mar 2005
Location: shivering in the cold dark shadow of my own magnificence.
Posts: 522
Likes: 0
Received 0 Likes
on
0 Posts
What I was trying to say, perhaps badly, is that the systems by which you are flying the aircraft are also creating the artificial reality by which you are monitoring the performance of the system. If the system screws up, you not only have a badly performing flight control system, you have a badly performing reality.
Dont they teach free thinking anymore?
Ex A380
I was referring to the suggestion in a prior post that there should be an OFF button where a pilot could switch off computers.
I don't think many understand that the FBW systems allow a lighter construction of the airframe. In the Air China accident a FBW plane would have likely fallen apart if protection systems had been not working
This is why there needs to be a big red button that says "Off"
When you press it, when you move the stick back, plane goes up, stick forward, plane goes down.
No if's, buts or maybe's.
Accidents have happened already when the computer takes a mind of its own.
I was referring to the suggestion in a prior post that there should be an OFF button where a pilot could switch off computers.
I don't think many understand that the FBW systems allow a lighter construction of the airframe. In the Air China accident a FBW plane would have likely fallen apart if protection systems had been not working
This is why there needs to be a big red button that says "Off"
When you press it, when you move the stick back, plane goes up, stick forward, plane goes down.
No if's, buts or maybe's.
Accidents have happened already when the computer takes a mind of its own.
"Now lets imagine it was an Airbus A330 what would have happened?."
Dont know about a FBW bus pulling 5.5g but the A310 was built pretty strong - lah.
Bay Of Bengal anybody?
Dont know about a FBW bus pulling 5.5g but the A310 was built pretty strong - lah.
Bay Of Bengal anybody?