LH A320 reportedly within 0.5m of crashing at FRA !!
Guest
Posts: n/a
Kangar. There does seem to be alternative wiring hook ups on these sidesticks depending on the exact flavour of the components, we are informed. Maybe so, and in this case Murphy got in there with nearly catastrophic results. However it does not need two versions of the same parts for error to occur. Two disturbed wires could be reversed at any time when refitted. Human error is an ever present possibility.
Hence there are procedures for checking checking checking after maintenance. Under British regulatory system any disturbance in a flight control system has always required duplicate inspections ie visual and function checks by different people at different times, all properly conducted with accompanying paperwork and according to the manuals. This is always taken very seriously. In my company we have additional technical instructions specific to the A320, with its electronic flight control system, reiterating this.
I am sure maintenance practices in Germany are not less stringent.
So I suppose there must have been several shortcomings in the maintenance actions that day. The report will make interesting reading.
Hence there are procedures for checking checking checking after maintenance. Under British regulatory system any disturbance in a flight control system has always required duplicate inspections ie visual and function checks by different people at different times, all properly conducted with accompanying paperwork and according to the manuals. This is always taken very seriously. In my company we have additional technical instructions specific to the A320, with its electronic flight control system, reiterating this.
I am sure maintenance practices in Germany are not less stringent.
So I suppose there must have been several shortcomings in the maintenance actions that day. The report will make interesting reading.
Guest
Posts: n/a
avoman,
sad enough you are right. and the problem of shortcomings in maintenance effects even the "better" among all, due to budget shortenings and a generation change.
specially with lh a lot of the highly qualified technicians have retired and young fellows are doing the job. they still follow the rules but to the letter of the manuals.
it was reported to me that everybody nowadays is undere extreme time presure and the a/c's should be out of the hangar asap. the incident a/c was scheduled, no replacement available and that would have meant to cxl a revenue flight with 108 paxes.
apparently the problem didn't look severe, as the connector pin was identified as bend and therefore replaced. still no excuse, as it happend even at lh homebase but the accumulation of all these factors certainly played a role.
to what was reported to me the situation on some outsite stations is even worth, specially if the company technicians are providing service not only for their own a/c but as well for "foreign customers" (as selling of ground support has become an interesting and lucrative business generating revenue). what has been overlooked in some facilities is that they could hardly cope with all the work load, given the manpower available (which of course was never increased as well - to the opposite). priorities have to be made and some management orders apparently indicate to first serve the other customer, as this creates revenue...
if this is true, it seems to be a quite dangerous development and i believe the human factor issue might shift as well in future accidents and incidents towards the guys with the greasy hands...
TvB (independent editor aviation)
www.aviationsafetyonline.com
[This message has been edited by TvB (edited 05 June 2001).]
sad enough you are right. and the problem of shortcomings in maintenance effects even the "better" among all, due to budget shortenings and a generation change.
specially with lh a lot of the highly qualified technicians have retired and young fellows are doing the job. they still follow the rules but to the letter of the manuals.
it was reported to me that everybody nowadays is undere extreme time presure and the a/c's should be out of the hangar asap. the incident a/c was scheduled, no replacement available and that would have meant to cxl a revenue flight with 108 paxes.
apparently the problem didn't look severe, as the connector pin was identified as bend and therefore replaced. still no excuse, as it happend even at lh homebase but the accumulation of all these factors certainly played a role.
to what was reported to me the situation on some outsite stations is even worth, specially if the company technicians are providing service not only for their own a/c but as well for "foreign customers" (as selling of ground support has become an interesting and lucrative business generating revenue). what has been overlooked in some facilities is that they could hardly cope with all the work load, given the manpower available (which of course was never increased as well - to the opposite). priorities have to be made and some management orders apparently indicate to first serve the other customer, as this creates revenue...
if this is true, it seems to be a quite dangerous development and i believe the human factor issue might shift as well in future accidents and incidents towards the guys with the greasy hands...
TvB (independent editor aviation)
www.aviationsafetyonline.com
[This message has been edited by TvB (edited 05 June 2001).]
Guest
Posts: n/a
There is an old saying attributed to Murphy
"It is impossible to make anything foolproof because fools are so goddamned ingenious"
Just substitute "human" wherever you see "fool".
People make mistakes, the best you can do is minimise the opportunity.
[This message has been edited by RightsFlyer (edited 02 June 2001).]
"It is impossible to make anything foolproof because fools are so goddamned ingenious"
Just substitute "human" wherever you see "fool".
People make mistakes, the best you can do is minimise the opportunity.
[This message has been edited by RightsFlyer (edited 02 June 2001).]
Guest
Posts: n/a
From Air Safety Week, thought you may find this interesting:
"Cross-wired Controls Almost Bring Down Lufthansa Airliner
A Lufthansa A320 came within less than two feet and a few seconds of crashing during takeoff on a planned flight from Frankfurt to Paris.
Preliminary reports indicate that maintenance performed on one of the two A320’s elevator/aileron computer (ELAC) immediately before the incident flight had inadvertently created a situation where control inputs of the Captains sidestick controller were reversed. The case reveals that at least two “filters,” or safety defenses, were breached, leading to a near-crash shortly after rotation at Frankfurt’s Runway 18 that was saved by quick action by an alert first officer. The case is under investigation by the German Aircraft Accident Investigation Branch, the Büro für Flugunfalluntersuchung (BFU). Given the significance of the incident regarding the worldwide Airbus Industrie fly-by-wire fleet (A319, 320, 321, 330 and 340), and its possible implications for maintenance of other fly-by-wire aircraft, the German authorities have said their report will be issued in English. That report is months away.
In the meantime, this much has been reported in other media and is known from additional sources: During the March 20 takeoff with the captain as the pilot flying (PF), the airplane encountered some degree of turbulence shortly after rotation, resulting in the left wing moving down. The turbulence may have been from the wake vortex of another aircraft landing on Runway 5R prior to the incident aircraft starting its takeoff run. The captain responded to the wing dip by applying a right input to his sidestick controller, but in response the left wing banked down even more – the exact opposite of the response the captain expected. A further right input resulted in the left wing banked down some 21 degrees, and the left wingtip came within a scant 1½ feet of the ground.
The first officer, the pilot not flying (PNF), realizing the apparent control problem, switched the control priority to his sidestick and recovered the aircraft. Had the left wingtip struck the ground, the airplane likely would have crashed, endangering the lives of the 115 passengers and crew aboard. According to the BFU, computer modeling of the data from the digital flight data recorder (DFDR) indicated that the incident airplane came within a few seconds of striking the ground.
After recovering, the crew engaged the autopilot and climbed to 12,000 feet. Various handling checks were performed to confirm that the captain’s sidestick was producing “outputs” that were the opposite of “inputs” in roll. The crew elected to conduct a precautionary landing at Frankfurt rather than continue the flight. The case may stand as an outstanding example of crew resource management. The first officer observed, analyzed the situation and acted promptly to retrieve a situation that could have been disastrous.
Sources say that if the aircraft had been operated by pilots from a more authoritarian culture (e.g., Asian or Middle East) that the copilot never would have acted in this way without the captain’s express permission. This generalization perhaps should be put in context: the Germans have been noted for their penchant to recognize authority, too, so the generalization about other cultures may have limited application. The essential point is that this crew evidenced what good CRM is all about. As one impressed pilot remarked: “Highest scores for the crew – 1.6 feet at full power and 20 degree bank? Scary. Scary.”
The maintenance action
German investigators, Lufthansa officials and representatives from manufacturer Airbus are focusing their inquiry on the maintenance actions that preceded the incident flight. In the process of troubleshooting and repairing the ELAC, Lufthansa Technik personnel found a damaged pin on one segment of the four connector segments (with 140 pins on each) at the “rack side,” as it were, of the ELAC mount. Repair work involving complete rewiring “upstream” of the connector pins was conducted over several work shifts by various technicians. In the process, according to preliminary reports, the polarity inadvertently was reversed on four wires in one connector segment. Two of the wires were for the roll control input and two were for the associated control channel “outputs.” It is believed from preliminary accounts that the technicians correctly followed the wiring list. Sources say the aircraft wiring can vary by aircraft serial number, and that care must be taken to match up the correct wiring list by tail number, also known as “aircraft effectivity.” An Airbus official expressed doubt that aircraft wiring would be unique for each aircraft, however BFU officials and maintenance personnel maintained that the wiring lists for individual aircraft may differ.
One pilot observed, “If it were the case that control wiring differed at the ELAC connector between models of the same type, the ELACs would not be interchangeable…and this is not the case.” However, we understand that the male/female marriage of connectors and pins (all 560 of them among the four connector segments) is not the issue, but the color-coding scheme of the wiring to the backside of the connectors on the rack to which each ELAC is mated.
Before the airplane left the hangar at Frankfurt for return to service, a flight control check was performed using the respective indications on the cockpit ECAM (Electronic Centralized Aircraft Monitoring) display (see illustration at p. __). The BFU confirmed that the mechanic’s flight control check was limited to the first officer’s sidestick, not the captain’s on the left side of the cockpit. Whether a maintenance technician would be sufficiently astute to catch aileron deflection in the wrong direction is another matter. It is not certain if anyone was standing outside the airplane to double check actual movement of flight control surfaces, or if the presence of such an individual was required by the operator’s procedures.
At Lufthansa’s code-share partner United Airlines [UAL], certified inspectors must be stationed both inside and outside the cockpit to conduct a functional check after work is performed on the flight control system. In addition, a flight test is required before the aircraft is returned to service after this kind of repair.
The details of such procedures at Lufthansa will be part of the BFU inquiry. The question of any time pressure to get the work done also seems certain to be explored. After all, this was a repair to a primary flight control system (as opposed to a flight management system). The incident seems to raise all sorts of human factors issues in maintenance.
The preflight checks
Every crew routinely exercises the flight controls as part of its preflight check. On the A320, the Flight Control page on the ECAM will appear when the sidestick is moved as part of the preflight check. The sidestick must be held about 3 seconds for full travel to be reached; it takes that long for the ECAM to generate a fault message.
There is some confusion in the pilot community about whether these checks will be displayed on the ECAM as control inputs (the position of the sidestick) or control outputs (actual position of ailerons, etc.).
The ECAM will display control outputs, as does the comparable system on the Boeing [BA] fly-by-wire B777 (see box at p. ___).
One pilot correctly explained the functioning and went on to surmise what may have happened:
“Four position sensors called LVDTs (Linear Voltage Differential Transducer – used with aircraft control surface servos) look at the ailerons. This is quite independent of the sidestick positions. This display would not have been affected or reversed because of any miswiring of the sidestick…
“On control checks during taxi out the pilots saw spoiler movement and aileron movement in response to commands from each sidestick, correctly displayed on (the) ECAM. It just happened to be in the wrong direction for one stick. Really quite easy to miss at a very busy time and so unexpected. Every pilot does control checks, thousands of times. It is always correct, isn’t it? Except for this oh-so-rare occasion.”
The check often is made during taxi out, a high workload period, rather than before pushback at the gate. Accordingly, the PF is moving his control actuators while keeping his eyes focused on activity outside the airplane, while the PNF is keeping his eyes locked on the ECAM display. In this arrangement, the PNF is not looking at and probably is not able to see the direction in which the PF is testing the sidestick. As such, the PNF may be looking at the ECAM more for confirmation of deflection, but not necessarily for direction of deflection. One means of mitigating this uncertainty might be as follows: The PF announces “Left” to indicate the direction in which he’s moving the sidestick (right, forward, back would constitute the other callouts in the four-step process). The PNF would respond to “Left” with confirmation, “Left (aileron) up, right down.” This is the common procedure on other Airbus aircraft such as the A 330 and 340. But these checks vary among different Airbus operators.
In any event, the details of these procedures and checklist will be another point of the BFU examination (see related story in box at p. ___).
The filters penetrated
The fault got by at least two safety “filters,” as it were. It was not detected during maintenance, and it was not detected during the preflight check. In this respect, the incident fits the now classic “Swiss Cheese” model of accidents postulated by human factors expert James Reason. A professor at the University of Manchester, Reason is a world-renowned expert on human error. His metaphor of Swiss cheese represents the various layers of defenses against catastrophe. The holes in each slice of cheese represent breaches in the defenses, and when the holes are in alignment, the multiple defenses in depth are breached. The combination of what can be a chain of relatively insignificant circumstances link up, leading to an incident or accident.
The design vindicated
The fact that the incident did not end with investigators piecing through charred wreckage is fortuitous. In the unfortunate event of a crash, there might not have been sufficient evidence pointing to a connector/wiring fault. Absent such evidence, investigators may have come to a finding of incorrect banking associated with turbulence, leading to a conclusion of “pilot error.”
To be sure, crossed or reversed flight control cables on conventional aircraft have caused more than one crash. There is a grim history of such events on military and general aviation aircraft. If one control stick is connected backwards, then both yokes are misrigged, and both pilots are faced with what might be characterized as “the same rather extreme problem.”
However, reversed controls are deemed impossible on transport-category aircraft, with their combination of cables and pushrods. Consider the “conventional” B737. A Boeing official said, “The ailerons are moved by hydraulic actuators. Following proper maintenance and inspection procedures, it is impossible to connect the steel cables leading to these actuators reversed. You would have to do it deliberately. This problem would be detected by maintenance (personnel) performing the operational checks, but latest by the pilot during his preflight check, as he would not be able to move the controls.”
In the case of the A320, one aspect of the aircraft’s fly-by-wire design may have enabled the first officer to quickly gain control of the aircraft – the ability to isolate a malfunctioning sidestick and shift command to the other sidestick at the push of a button. As one pilot observed: “I would say that on this occasion it was BECAUSE of Airbus technology that a major incident was avoided!”
The larger implications
Even though technology may have saved the day in this case, Peter Ladkin, a computer systems expert at the University of Bielefeld in Germany, points to a number of accidents involving fly-by-wire primary flight control systems. In the military, the X-31 research aircraft, the Saab JAS 39 Gripen tactical jet (twice), the V-22 Osprey tilt-rotor, to name a few. And there have been incidents involving computer-controlled primary flight control systems in commercial aircraft. “There are people such as myself…who believe a re-think of this safety-criticality of on-board systems is in order,” Ladkin asserted.
Some commentators suggest the installation of closed-circuit television (CCTV) to provide added real-time feedback to the pilots. In most large jets, pilots cannot actually see the movement of ailerons, flaps, thrust reversers, and so forth (although spoiler deployment can be viewed from the cockpit). A CCTV system, they suggest, would provide added feedback. And, with the CCTV integrated into the digital flight data recorder (DFDR), a visual record of system functioning would be available for post-crash analysis.
The debate over CCTV on transport-category aircraft may be for another day. In this case, human factors issues in maintenance and flight operations appear to dominate, with latent factors such as “aircraft effectivity” for wiring lists.
The BFU may have “just” an incident on its hands to investigate, but the safety issues are profound. (ASW note: aviation editor Tim van Beveren contributed to this story) Q
BOX
Functional Checks of the fly-by-wire B777
“In the B777 the EICAS (Engine Indicating and Crew Alerting System, the equivalent of the ECAM on Airbus aircraft) will detect a single fault, as it was the case with the LH A320. It (the computers) would have a problem to detect multiple faults (which is a common known problem with artificial intelligence systems).
“The EICAS would generate an error message as it compares the pilots’ inputs versus the actual outputs. Each pilot input is translated into three independent signals. The computer also compares these three signals for plausibility and that they all agree.
“Further, it compares the ACTUAL surface deflection (left aileron up if control wheel input to the left, right aileron down and vice versa) to the desired control input…
“Further, there is a specific mandatory maintenance task after performing ANY rewiring of any components. Special computerized test equipment is used and will detect any wiring faults…
“Last, with many of our operators there is a required visual check outside while somebody inside the cockpit performs the flight control check after repair to ensure appropriate deflection.”
Source: Boeing"
"Cross-wired Controls Almost Bring Down Lufthansa Airliner
A Lufthansa A320 came within less than two feet and a few seconds of crashing during takeoff on a planned flight from Frankfurt to Paris.
Preliminary reports indicate that maintenance performed on one of the two A320’s elevator/aileron computer (ELAC) immediately before the incident flight had inadvertently created a situation where control inputs of the Captains sidestick controller were reversed. The case reveals that at least two “filters,” or safety defenses, were breached, leading to a near-crash shortly after rotation at Frankfurt’s Runway 18 that was saved by quick action by an alert first officer. The case is under investigation by the German Aircraft Accident Investigation Branch, the Büro für Flugunfalluntersuchung (BFU). Given the significance of the incident regarding the worldwide Airbus Industrie fly-by-wire fleet (A319, 320, 321, 330 and 340), and its possible implications for maintenance of other fly-by-wire aircraft, the German authorities have said their report will be issued in English. That report is months away.
In the meantime, this much has been reported in other media and is known from additional sources: During the March 20 takeoff with the captain as the pilot flying (PF), the airplane encountered some degree of turbulence shortly after rotation, resulting in the left wing moving down. The turbulence may have been from the wake vortex of another aircraft landing on Runway 5R prior to the incident aircraft starting its takeoff run. The captain responded to the wing dip by applying a right input to his sidestick controller, but in response the left wing banked down even more – the exact opposite of the response the captain expected. A further right input resulted in the left wing banked down some 21 degrees, and the left wingtip came within a scant 1½ feet of the ground.
The first officer, the pilot not flying (PNF), realizing the apparent control problem, switched the control priority to his sidestick and recovered the aircraft. Had the left wingtip struck the ground, the airplane likely would have crashed, endangering the lives of the 115 passengers and crew aboard. According to the BFU, computer modeling of the data from the digital flight data recorder (DFDR) indicated that the incident airplane came within a few seconds of striking the ground.
After recovering, the crew engaged the autopilot and climbed to 12,000 feet. Various handling checks were performed to confirm that the captain’s sidestick was producing “outputs” that were the opposite of “inputs” in roll. The crew elected to conduct a precautionary landing at Frankfurt rather than continue the flight. The case may stand as an outstanding example of crew resource management. The first officer observed, analyzed the situation and acted promptly to retrieve a situation that could have been disastrous.
Sources say that if the aircraft had been operated by pilots from a more authoritarian culture (e.g., Asian or Middle East) that the copilot never would have acted in this way without the captain’s express permission. This generalization perhaps should be put in context: the Germans have been noted for their penchant to recognize authority, too, so the generalization about other cultures may have limited application. The essential point is that this crew evidenced what good CRM is all about. As one impressed pilot remarked: “Highest scores for the crew – 1.6 feet at full power and 20 degree bank? Scary. Scary.”
The maintenance action
German investigators, Lufthansa officials and representatives from manufacturer Airbus are focusing their inquiry on the maintenance actions that preceded the incident flight. In the process of troubleshooting and repairing the ELAC, Lufthansa Technik personnel found a damaged pin on one segment of the four connector segments (with 140 pins on each) at the “rack side,” as it were, of the ELAC mount. Repair work involving complete rewiring “upstream” of the connector pins was conducted over several work shifts by various technicians. In the process, according to preliminary reports, the polarity inadvertently was reversed on four wires in one connector segment. Two of the wires were for the roll control input and two were for the associated control channel “outputs.” It is believed from preliminary accounts that the technicians correctly followed the wiring list. Sources say the aircraft wiring can vary by aircraft serial number, and that care must be taken to match up the correct wiring list by tail number, also known as “aircraft effectivity.” An Airbus official expressed doubt that aircraft wiring would be unique for each aircraft, however BFU officials and maintenance personnel maintained that the wiring lists for individual aircraft may differ.
One pilot observed, “If it were the case that control wiring differed at the ELAC connector between models of the same type, the ELACs would not be interchangeable…and this is not the case.” However, we understand that the male/female marriage of connectors and pins (all 560 of them among the four connector segments) is not the issue, but the color-coding scheme of the wiring to the backside of the connectors on the rack to which each ELAC is mated.
Before the airplane left the hangar at Frankfurt for return to service, a flight control check was performed using the respective indications on the cockpit ECAM (Electronic Centralized Aircraft Monitoring) display (see illustration at p. __). The BFU confirmed that the mechanic’s flight control check was limited to the first officer’s sidestick, not the captain’s on the left side of the cockpit. Whether a maintenance technician would be sufficiently astute to catch aileron deflection in the wrong direction is another matter. It is not certain if anyone was standing outside the airplane to double check actual movement of flight control surfaces, or if the presence of such an individual was required by the operator’s procedures.
At Lufthansa’s code-share partner United Airlines [UAL], certified inspectors must be stationed both inside and outside the cockpit to conduct a functional check after work is performed on the flight control system. In addition, a flight test is required before the aircraft is returned to service after this kind of repair.
The details of such procedures at Lufthansa will be part of the BFU inquiry. The question of any time pressure to get the work done also seems certain to be explored. After all, this was a repair to a primary flight control system (as opposed to a flight management system). The incident seems to raise all sorts of human factors issues in maintenance.
The preflight checks
Every crew routinely exercises the flight controls as part of its preflight check. On the A320, the Flight Control page on the ECAM will appear when the sidestick is moved as part of the preflight check. The sidestick must be held about 3 seconds for full travel to be reached; it takes that long for the ECAM to generate a fault message.
There is some confusion in the pilot community about whether these checks will be displayed on the ECAM as control inputs (the position of the sidestick) or control outputs (actual position of ailerons, etc.).
The ECAM will display control outputs, as does the comparable system on the Boeing [BA] fly-by-wire B777 (see box at p. ___).
One pilot correctly explained the functioning and went on to surmise what may have happened:
“Four position sensors called LVDTs (Linear Voltage Differential Transducer – used with aircraft control surface servos) look at the ailerons. This is quite independent of the sidestick positions. This display would not have been affected or reversed because of any miswiring of the sidestick…
“On control checks during taxi out the pilots saw spoiler movement and aileron movement in response to commands from each sidestick, correctly displayed on (the) ECAM. It just happened to be in the wrong direction for one stick. Really quite easy to miss at a very busy time and so unexpected. Every pilot does control checks, thousands of times. It is always correct, isn’t it? Except for this oh-so-rare occasion.”
The check often is made during taxi out, a high workload period, rather than before pushback at the gate. Accordingly, the PF is moving his control actuators while keeping his eyes focused on activity outside the airplane, while the PNF is keeping his eyes locked on the ECAM display. In this arrangement, the PNF is not looking at and probably is not able to see the direction in which the PF is testing the sidestick. As such, the PNF may be looking at the ECAM more for confirmation of deflection, but not necessarily for direction of deflection. One means of mitigating this uncertainty might be as follows: The PF announces “Left” to indicate the direction in which he’s moving the sidestick (right, forward, back would constitute the other callouts in the four-step process). The PNF would respond to “Left” with confirmation, “Left (aileron) up, right down.” This is the common procedure on other Airbus aircraft such as the A 330 and 340. But these checks vary among different Airbus operators.
In any event, the details of these procedures and checklist will be another point of the BFU examination (see related story in box at p. ___).
The filters penetrated
The fault got by at least two safety “filters,” as it were. It was not detected during maintenance, and it was not detected during the preflight check. In this respect, the incident fits the now classic “Swiss Cheese” model of accidents postulated by human factors expert James Reason. A professor at the University of Manchester, Reason is a world-renowned expert on human error. His metaphor of Swiss cheese represents the various layers of defenses against catastrophe. The holes in each slice of cheese represent breaches in the defenses, and when the holes are in alignment, the multiple defenses in depth are breached. The combination of what can be a chain of relatively insignificant circumstances link up, leading to an incident or accident.
The design vindicated
The fact that the incident did not end with investigators piecing through charred wreckage is fortuitous. In the unfortunate event of a crash, there might not have been sufficient evidence pointing to a connector/wiring fault. Absent such evidence, investigators may have come to a finding of incorrect banking associated with turbulence, leading to a conclusion of “pilot error.”
To be sure, crossed or reversed flight control cables on conventional aircraft have caused more than one crash. There is a grim history of such events on military and general aviation aircraft. If one control stick is connected backwards, then both yokes are misrigged, and both pilots are faced with what might be characterized as “the same rather extreme problem.”
However, reversed controls are deemed impossible on transport-category aircraft, with their combination of cables and pushrods. Consider the “conventional” B737. A Boeing official said, “The ailerons are moved by hydraulic actuators. Following proper maintenance and inspection procedures, it is impossible to connect the steel cables leading to these actuators reversed. You would have to do it deliberately. This problem would be detected by maintenance (personnel) performing the operational checks, but latest by the pilot during his preflight check, as he would not be able to move the controls.”
In the case of the A320, one aspect of the aircraft’s fly-by-wire design may have enabled the first officer to quickly gain control of the aircraft – the ability to isolate a malfunctioning sidestick and shift command to the other sidestick at the push of a button. As one pilot observed: “I would say that on this occasion it was BECAUSE of Airbus technology that a major incident was avoided!”
The larger implications
Even though technology may have saved the day in this case, Peter Ladkin, a computer systems expert at the University of Bielefeld in Germany, points to a number of accidents involving fly-by-wire primary flight control systems. In the military, the X-31 research aircraft, the Saab JAS 39 Gripen tactical jet (twice), the V-22 Osprey tilt-rotor, to name a few. And there have been incidents involving computer-controlled primary flight control systems in commercial aircraft. “There are people such as myself…who believe a re-think of this safety-criticality of on-board systems is in order,” Ladkin asserted.
Some commentators suggest the installation of closed-circuit television (CCTV) to provide added real-time feedback to the pilots. In most large jets, pilots cannot actually see the movement of ailerons, flaps, thrust reversers, and so forth (although spoiler deployment can be viewed from the cockpit). A CCTV system, they suggest, would provide added feedback. And, with the CCTV integrated into the digital flight data recorder (DFDR), a visual record of system functioning would be available for post-crash analysis.
The debate over CCTV on transport-category aircraft may be for another day. In this case, human factors issues in maintenance and flight operations appear to dominate, with latent factors such as “aircraft effectivity” for wiring lists.
The BFU may have “just” an incident on its hands to investigate, but the safety issues are profound. (ASW note: aviation editor Tim van Beveren contributed to this story) Q
BOX
Functional Checks of the fly-by-wire B777
“In the B777 the EICAS (Engine Indicating and Crew Alerting System, the equivalent of the ECAM on Airbus aircraft) will detect a single fault, as it was the case with the LH A320. It (the computers) would have a problem to detect multiple faults (which is a common known problem with artificial intelligence systems).
“The EICAS would generate an error message as it compares the pilots’ inputs versus the actual outputs. Each pilot input is translated into three independent signals. The computer also compares these three signals for plausibility and that they all agree.
“Further, it compares the ACTUAL surface deflection (left aileron up if control wheel input to the left, right aileron down and vice versa) to the desired control input…
“Further, there is a specific mandatory maintenance task after performing ANY rewiring of any components. Special computerized test equipment is used and will detect any wiring faults…
“Last, with many of our operators there is a required visual check outside while somebody inside the cockpit performs the flight control check after repair to ensure appropriate deflection.”
Source: Boeing"
Join Date: Jan 1997
Location: UK
Posts: 7,737
Likes: 0
Received 0 Likes
on
0 Posts
Checkboard - I think you can put that input down to TvB. Tim has sought thoughts and opinions from aviation professionals via the electronic bulletin boards even before PPRuNe was around. Danny and I both used to see posts from him over on CServe and, if I remember correctly, he was then doing research on aviation safety for Dutch television.
------------------
Regards from the Towers
[email protected]
------------------
Regards from the Towers
[email protected]
Guest
Posts: n/a
Certainly a full visual check is impossible but as an FO I can quite easily see whether the RH Aileron is deflected upwards during the stick right movement during the control check. Can't see anything else though but since this Lufty incident I must admit to a few glances over my shoulder.
Don;t know whether you can do this on an A321.
Well done also to the pilots.
Don;t know whether you can do this on an A321.
Well done also to the pilots.
Guest
Posts: n/a
Wonder if the F/O actually had time to analyse the situation?
As I understand it the other pilot's side stick is not visible from either side thus the input is not immediately apparent.
Maybe the F/O reacted instinctively as most of us would and fortunately his side stick was correctly wired. I am not trying to denigrate anyone - just trying to imagine the scene.
As I understand it the other pilot's side stick is not visible from either side thus the input is not immediately apparent.
Maybe the F/O reacted instinctively as most of us would and fortunately his side stick was correctly wired. I am not trying to denigrate anyone - just trying to imagine the scene.
Guest
Posts: n/a
Hi All
I cannot answer for the Civvy (normal) Techies, but as an ex RAF Techie our independent check system for flying control systems states that the checker should check for 'Correct sense ands range of movement'. Now forgetting every indication device ever invented, how do you know on the ground that when you stick left the left Aileron moves up etc, well the only way is to get someone to stick left, while you watch them, and then while they hold it there, you go and look at the control surfaces. I don't know whether it's the Military in me or not, but unless i have seen everything working correctly, with my own eyes, then I couldn't sign up an Independent check for controls. Seeing is believing. Incidentally, I have to agree with the people who have been saying that if the Airbus system wasn't the way it is, the A/C would have crashed. At least there was some override available. If anyone wants to flame me about this, don't bother, this is my opinion and I'm not about to change it. Also at 44 I've been called just about every name going (and they all apply ;-))
Regards
------------------
'If at first you don't succeed, skydiving probably isn't the hobby for you'
PFD
I cannot answer for the Civvy (normal) Techies, but as an ex RAF Techie our independent check system for flying control systems states that the checker should check for 'Correct sense ands range of movement'. Now forgetting every indication device ever invented, how do you know on the ground that when you stick left the left Aileron moves up etc, well the only way is to get someone to stick left, while you watch them, and then while they hold it there, you go and look at the control surfaces. I don't know whether it's the Military in me or not, but unless i have seen everything working correctly, with my own eyes, then I couldn't sign up an Independent check for controls. Seeing is believing. Incidentally, I have to agree with the people who have been saying that if the Airbus system wasn't the way it is, the A/C would have crashed. At least there was some override available. If anyone wants to flame me about this, don't bother, this is my opinion and I'm not about to change it. Also at 44 I've been called just about every name going (and they all apply ;-))
Regards
------------------
'If at first you don't succeed, skydiving probably isn't the hobby for you'
PFD
Guest
Posts: n/a
In a previous post someone made the comment about mismatched wires and indexed connector plugs and how could this lead to the problem discussed in this thread. Here is how it could happen. A major German supplier of power drive systems for the secondary flight control systems on Airbus Aircraft did not incorporate indexed electrical connectors on any of the components they supplied on the A-310. It was their contention that they would impact the delivery schedule of their systems to the wing integrator and besides, it would have a severe impact on the cost of their equipment.
With this in mind consider the following. The only means incorporated in the wiring system to combat misconnection of connectors onto an appliance were tiebacks on the wire looms. The first time the appliances required maintenance or were removed for cause the tiebacks were cut. After the maintenance the tiebacks were either not replaced or, they were not in the same condition as before the maintenance. This would allow for cross connecting. If the wires were cross-connected on the PPUs the first time power was applied the flap or slat system would shut down and the computer could not diagnose the problem. If the wires on the command sensor unit were cross connected there would be no indication as to the problem but it would seriously impact the problem of trouble shooting if a defect were to occur.
If a connector were mis connected on the power control unit the system would not operate correctly and the effected system would most likely lock up and to top it off the computer may not be able to diagnose the problem.
I can’t say if this problem was rectified on later models but it still exists on the A-310.
If you want to hear more about this and other problems go to my posting entitled “How safe is your aircraft”?, on these threads.
------------------
The Cat
[This message has been edited by Lu Zuckerman (edited 04 June 2001).]
[This message has been edited by Lu Zuckerman (edited 04 June 2001).]
With this in mind consider the following. The only means incorporated in the wiring system to combat misconnection of connectors onto an appliance were tiebacks on the wire looms. The first time the appliances required maintenance or were removed for cause the tiebacks were cut. After the maintenance the tiebacks were either not replaced or, they were not in the same condition as before the maintenance. This would allow for cross connecting. If the wires were cross-connected on the PPUs the first time power was applied the flap or slat system would shut down and the computer could not diagnose the problem. If the wires on the command sensor unit were cross connected there would be no indication as to the problem but it would seriously impact the problem of trouble shooting if a defect were to occur.
If a connector were mis connected on the power control unit the system would not operate correctly and the effected system would most likely lock up and to top it off the computer may not be able to diagnose the problem.
I can’t say if this problem was rectified on later models but it still exists on the A-310.
If you want to hear more about this and other problems go to my posting entitled “How safe is your aircraft”?, on these threads.
------------------
The Cat
[This message has been edited by Lu Zuckerman (edited 04 June 2001).]
[This message has been edited by Lu Zuckerman (edited 04 June 2001).]
Guest
Posts: n/a
I read that many believe that if this had been a Boeing airplane there would have been an accident, only the fact that it was an airbus saved it. However, there would be less chance of incorrect aileron setup in the Boeing, since it would involve cable rigging, which is not often touched, and would be harder to mis-rig. So the initial error would probably not have happened thus no incident. And think what would have happened if BOTH the aileron connections were wrong; the FO would have rolled them in to the ground. In fact, how did he know his controls were not similarly affected? Seems he took a chance (which worked out for them all, luckily).
And for TvB, you said that Luft does the control check on taxy instead of before pushback. I was working for a small airline that Luft had a contract to manage and they did the same to us, making us change the control check from the Boeing standard to during taxy. I objected till I was red in the face but could not make them see the stupidity of their actions. I would imagine that they will still not see it. I have no respect for airline managements that think they know more than the manufacturer does about the airplanes.
And for TvB, you said that Luft does the control check on taxy instead of before pushback. I was working for a small airline that Luft had a contract to manage and they did the same to us, making us change the control check from the Boeing standard to during taxy. I objected till I was red in the face but could not make them see the stupidity of their actions. I would imagine that they will still not see it. I have no respect for airline managements that think they know more than the manufacturer does about the airplanes.
Guest
Posts: n/a
Pardon my iggorance but all the airplanes I have flown have several methods of powering a hyd system; electric (pnuematic/manual/RAT) and engine driven. The Bus does not? Woo, more than I wanted to know!
[This message has been edited by askcv (edited 04 June 2001).]
[This message has been edited by askcv (edited 04 June 2001).]
Guest
Posts: n/a
It is the F/O action I find most incredible in this saga. To take over control from a senior officer is psychologically very very hard. This guy must have had really excellent CRM training to do this so quickly and decisively. How many FO's in UK airlines would have responded like this?
Guest
Posts: n/a
askcv
Manufactures do make mistakes, practise has proven that over the years. I personally as every other pilot on this forum have updated my manuals with many amendments.
The problem is not that the Airline manager might have another opinion then the manufacturer. The problem is that the customer support afters sales with the manufacturer’s standard pilots is not up to scratch.
To believe that the manufacturer has all these things fully under control is dreaming with your eyes open. They need the feedback from the operators, and if they are serious about the credibility of the design of their product they should have no problem with that.
Boeing claims they had the customer involved at a very early stage when designing the B 777, I believe that to be true although a bit overstated.
One of the worst customer supports I have ever seen is that from British Aerospace for their Avro 146/RJ 85, I am puzzled how this thing ever got certified ?
------------------
Smooth Trimmer
Manufactures do make mistakes, practise has proven that over the years. I personally as every other pilot on this forum have updated my manuals with many amendments.
The problem is not that the Airline manager might have another opinion then the manufacturer. The problem is that the customer support afters sales with the manufacturer’s standard pilots is not up to scratch.
To believe that the manufacturer has all these things fully under control is dreaming with your eyes open. They need the feedback from the operators, and if they are serious about the credibility of the design of their product they should have no problem with that.
Boeing claims they had the customer involved at a very early stage when designing the B 777, I believe that to be true although a bit overstated.
One of the worst customer supports I have ever seen is that from British Aerospace for their Avro 146/RJ 85, I am puzzled how this thing ever got certified ?
------------------
Smooth Trimmer
Guest
Posts: n/a
PFD:
As I was told, Airbus didn?t feel it necessary to make such a visual check mandatory for their f-b-w a/c. So we are back to famous Mr. Murphy and his law?
I tend to see it your way (in this regard): »seeing is believing« or »only sign off what you've seen with your own eyes«. However, if the fight-control check would have been performed on the F/O side only (as with the LH incident a/c), the deflection would have been consistent with the expectation?
Yes, you maybe right that here the »option« of the priority switch made the day, despite that I was told by numerous (civil) technicians that it would be quite impossible to screw up the flight control cables on a conventional airliner and reverse them without detecting it before being airborne.
Apparently the mechanic (1. safety guard), the inspector inspecting and signing the work off (2. safety guard) and finally the pilot during his preflight checks (3. safety guard) would not be able to move the stick. - I?m aware that it had happened on some kind of military aircraft though and there are many cases in the general aviation field.
So given this in respect to our scenario here at hand I believe the comparison and conclusion is not appropriate (- my personal opinion) and I feel that askcv is right with his remark.
askcv:
I?m very well aware that Lufti has many company procedures quite unique to their operation. I very well recall some aspects we found in the aftermath of their landing accident at WAW. For example it was company procedure to use a higher speed addition (for the family) when crosswind was to be expected. The LH SOP asked for 15kts more, despite the AI procedures recommended only 10 kts. This resulted in a higher speed on final approach at WAW where there was no x-wind during the landing but in fact a nice tailwind adding up the final approach speed.
Looking further in the procedures we found another interesting issue in regards to the V1 calculation. It was at that time that LH had introduced the »go-decision« instead of V1 and they did it for all fleets. What got lost in this change was the fact that the A320 had been certified according to the new certification requirements in those days. These required to include the »reaction time for the pilot« in case of an abort decision after V1 and before Vr. Now AI went ahead and calculated their V1 accordingly, but without giving it a lot of publicity. I interviewed their former Senior Vice President of Engineering, Bernard Ziegler and he confirmed that, adding: »?we considered V1 to be critical and we did not give any ?publicitee? to that as we are safety minded and we would like the pilots to ignore that they have a higher safety margin.« (well?hmmm...). Anyway this resulted in LH reducing their V1 a second time by their go-decision calculation. Not a very big deal as long as we don?t come into the regime of Vmcg and we still have enough runway to clear the threshold by the required altitude. I believe LH changed that as well after they became aware.
I think you?re right that sometimes the management believes they know everything better. The root of multiple problems in this area is as well associated with a lack and/or defective communication between manufacturers, operators and pilots, as Streamline rightly commented. I?m sure no one acts deliberately or out of pure arrogance, but the potential danger for safety relevant implications is given under such conditions.
Back to the incident at EDDF:
So far we have identified three different company procedures for the flight control checks on A320 a/c. - Strangely, LH does it during taxi. For other operators this is a clear ?NONO? out of obvious reasons associated with the safety during taxi (let stand alone the SQ 006 scenario?).
I would be interested to learn from the Airbus pilots among you (A320 family, A330 and A340) how your flight control check is performed and when (after eng start up, pushback, taxi) and if there is any x-check between CM1 and CM2, according to your company procedures.
Are there companies still performing a solid flt/ctr check with somebody outside, for example at the first flight of the day?
I feel that there might be more than three alternatives out for the same aircraft and among the entire Airbus product variety.
Comments highly appreciated.
Regards
TvB
(independent) aviation editor
www.aviationsafetyonline.com
[This message has been edited by TvB (edited 05 June 2001).]
As I was told, Airbus didn?t feel it necessary to make such a visual check mandatory for their f-b-w a/c. So we are back to famous Mr. Murphy and his law?
I tend to see it your way (in this regard): »seeing is believing« or »only sign off what you've seen with your own eyes«. However, if the fight-control check would have been performed on the F/O side only (as with the LH incident a/c), the deflection would have been consistent with the expectation?
Yes, you maybe right that here the »option« of the priority switch made the day, despite that I was told by numerous (civil) technicians that it would be quite impossible to screw up the flight control cables on a conventional airliner and reverse them without detecting it before being airborne.
Apparently the mechanic (1. safety guard), the inspector inspecting and signing the work off (2. safety guard) and finally the pilot during his preflight checks (3. safety guard) would not be able to move the stick. - I?m aware that it had happened on some kind of military aircraft though and there are many cases in the general aviation field.
So given this in respect to our scenario here at hand I believe the comparison and conclusion is not appropriate (- my personal opinion) and I feel that askcv is right with his remark.
askcv:
I?m very well aware that Lufti has many company procedures quite unique to their operation. I very well recall some aspects we found in the aftermath of their landing accident at WAW. For example it was company procedure to use a higher speed addition (for the family) when crosswind was to be expected. The LH SOP asked for 15kts more, despite the AI procedures recommended only 10 kts. This resulted in a higher speed on final approach at WAW where there was no x-wind during the landing but in fact a nice tailwind adding up the final approach speed.
Looking further in the procedures we found another interesting issue in regards to the V1 calculation. It was at that time that LH had introduced the »go-decision« instead of V1 and they did it for all fleets. What got lost in this change was the fact that the A320 had been certified according to the new certification requirements in those days. These required to include the »reaction time for the pilot« in case of an abort decision after V1 and before Vr. Now AI went ahead and calculated their V1 accordingly, but without giving it a lot of publicity. I interviewed their former Senior Vice President of Engineering, Bernard Ziegler and he confirmed that, adding: »?we considered V1 to be critical and we did not give any ?publicitee? to that as we are safety minded and we would like the pilots to ignore that they have a higher safety margin.« (well?hmmm...). Anyway this resulted in LH reducing their V1 a second time by their go-decision calculation. Not a very big deal as long as we don?t come into the regime of Vmcg and we still have enough runway to clear the threshold by the required altitude. I believe LH changed that as well after they became aware.
I think you?re right that sometimes the management believes they know everything better. The root of multiple problems in this area is as well associated with a lack and/or defective communication between manufacturers, operators and pilots, as Streamline rightly commented. I?m sure no one acts deliberately or out of pure arrogance, but the potential danger for safety relevant implications is given under such conditions.
Back to the incident at EDDF:
So far we have identified three different company procedures for the flight control checks on A320 a/c. - Strangely, LH does it during taxi. For other operators this is a clear ?NONO? out of obvious reasons associated with the safety during taxi (let stand alone the SQ 006 scenario?).
I would be interested to learn from the Airbus pilots among you (A320 family, A330 and A340) how your flight control check is performed and when (after eng start up, pushback, taxi) and if there is any x-check between CM1 and CM2, according to your company procedures.
Are there companies still performing a solid flt/ctr check with somebody outside, for example at the first flight of the day?
I feel that there might be more than three alternatives out for the same aircraft and among the entire Airbus product variety.
Comments highly appreciated.
Regards
TvB
(independent) aviation editor
www.aviationsafetyonline.com
[This message has been edited by TvB (edited 05 June 2001).]
Guest
Posts: n/a
The Airbus SOP calls for the PF, at a convenient time during taxi, to apply full lateral and longitudinal sidestick deflection (and rudder deflection) in sequence. Each deflection is announced by the PF and checked for FULL TRAVEL AND CORRECT SENSE by the PNF from the F/CTL page.
The PNF then silently checks his sidestick.
The procedure is probably adopted by most or all A320 operators (guess????)
Yes the check could be done before pushback by powering all three hydraulic systems (electrically and via a PTU) with outside observers etc etc but I think this is completely unnecessary, time wasting, and done during a period of much higher workload than during taxy!
This incident has elements of "Murphy's law" however for me it stresses the need to check correct sense of movement, not just "full and free".
[This message has been edited by mcdude (edited 05 June 2001).]
The PNF then silently checks his sidestick.
The procedure is probably adopted by most or all A320 operators (guess????)
Yes the check could be done before pushback by powering all three hydraulic systems (electrically and via a PTU) with outside observers etc etc but I think this is completely unnecessary, time wasting, and done during a period of much higher workload than during taxy!
This incident has elements of "Murphy's law" however for me it stresses the need to check correct sense of movement, not just "full and free".
[This message has been edited by mcdude (edited 05 June 2001).]
Guest
Posts: n/a
mcdude:
is this the Airbus procedure or a specific from your company?
If the later, is this a European operator?
Apparently there is quite a set of different procedures in this regard, specially in Europe, with variations, but no unique standart procedure.
And we have not entered into the field of variations for other AI fbw a/c...
regards
TvB
(independent) aviation editor
www.aviationsafetyonline.com
is this the Airbus procedure or a specific from your company?
If the later, is this a European operator?
Apparently there is quite a set of different procedures in this regard, specially in Europe, with variations, but no unique standart procedure.
And we have not entered into the field of variations for other AI fbw a/c...
regards
TvB
(independent) aviation editor
www.aviationsafetyonline.com