Nice bit in Flight International about this topic

MG

------------------
Don't land in a field or the sheep will eat the aircraft.

Kangar. There does seem to be alternative wiring hook ups on these sidesticks depending on the exact flavour of the components, we are informed. Maybe so, and in this case Murphy got in there with nearly catastrophic results. However it does not need two versions of the same parts for error to occur. Two disturbed wires could be reversed at any time when refitted. Human error is an ever present possibility.
Hence there are procedures for checking checking checking after maintenance. Under British regulatory system any disturbance in a flight control system has always required duplicate inspections ie visual and function checks by different people at different times, all properly conducted with accompanying paperwork and according to the manuals. This is always taken very seriously. In my company we have additional technical instructions specific to the A320, with its electronic flight control system, reiterating this.
I am sure maintenance practices in Germany are not less stringent.
So I suppose there must have been several shortcomings in the maintenance actions that day. The report will make interesting reading.

avoman,


sad enough you are right. and the problem of shortcomings in maintenance effects even the "better" among all, due to budget shortenings and a generation change.


specially with lh a lot of the highly qualified technicians have retired and young fellows are doing the job. they still follow the rules but to the letter of the manuals.


it was reported to me that everybody nowadays is undere extreme time presure and the a/c's should be out of the hangar asap. the incident a/c was scheduled, no replacement available and that would have meant to cxl a revenue flight with 108 paxes.
apparently the problem didn't look severe, as the connector pin was identified as bend and therefore replaced. still no excuse, as it happend even at lh homebase but the accumulation of all these factors certainly played a role.


to what was reported to me the situation on some outsite stations is even worth, specially if the company technicians are providing service not only for their own a/c but as well for "foreign customers" (as selling of ground support has become an interesting and lucrative business generating revenue). what has been overlooked in some facilities is that they could hardly cope with all the work load, given the manpower available (which of course was never increased as well - to the opposite). priorities have to be made and some management orders apparently indicate to first serve the other customer, as this creates revenue...


if this is true, it seems to be a quite dangerous development and i believe the human factor issue might shift as well in future accidents and incidents towards the guys with the greasy hands...

TvB (independent editor aviation)
www.aviationsafetyonline.com

[This message has been edited by TvB (edited 05 June 2001).]

Reading all the posts on this topic and as a relative lay-man I am absolutely amazed there is no mechanism on an airliner as sophisticated as the A320 to stop this sort of thing from happening.

There is an old saying attributed to Murphy
"It is impossible to make anything foolproof because fools are so goddamned ingenious"
Just substitute "human" wherever you see "fool".
People make mistakes, the best you can do is minimise the opportunity.

[This message has been edited by RightsFlyer (edited 02 June 2001).]

From Air Safety Week, thought you may find this interesting:

"Cross-wired Controls Almost Bring Down Lufthansa Airliner

A Lufthansa A320 came within less than two feet and a few seconds of crashing during takeoff on a planned flight from Frankfurt to Paris.
Preliminary reports indicate that maintenance performed on one of the two A320’s elevator/aileron computer (ELAC) immediately before the incident flight had inadvertently created a situation where control inputs of the Captains sidestick controller were reversed. The case reveals that at least two “filters,” or safety defenses, were breached, leading to a near-crash shortly after rotation at Frankfurt’s Runway 18 that was saved by quick action by an alert first officer. The case is under investigation by the German Aircraft Accident Investigation Branch, the Büro für Flugunfalluntersuchung (BFU). Given the significance of the incident regarding the worldwide Airbus Industrie fly-by-wire fleet (A319, 320, 321, 330 and 340), and its possible implications for maintenance of other fly-by-wire aircraft, the German authorities have said their report will be issued in English. That report is months away.
In the meantime, this much has been reported in other media and is known from additional sources: During the March 20 takeoff with the captain as the pilot flying (PF), the airplane encountered some degree of turbulence shortly after rotation, resulting in the left wing moving down. The turbulence may have been from the wake vortex of another aircraft landing on Runway 5R prior to the incident aircraft starting its takeoff run. The captain responded to the wing dip by applying a right input to his sidestick controller, but in response the left wing banked down even more – the exact opposite of the response the captain expected. A further right input resulted in the left wing banked down some 21 degrees, and the left wingtip came within a scant 1½ feet of the ground.
The first officer, the pilot not flying (PNF), realizing the apparent control problem, switched the control priority to his sidestick and recovered the aircraft. Had the left wingtip struck the ground, the airplane likely would have crashed, endangering the lives of the 115 passengers and crew aboard. According to the BFU, computer modeling of the data from the digital flight data recorder (DFDR) indicated that the incident airplane came within a few seconds of striking the ground.
After recovering, the crew engaged the autopilot and climbed to 12,000 feet. Various handling checks were performed to confirm that the captain’s sidestick was producing “outputs” that were the opposite of “inputs” in roll. The crew elected to conduct a precautionary landing at Frankfurt rather than continue the flight. The case may stand as an outstanding example of crew resource management. The first officer observed, analyzed the situation and acted promptly to retrieve a situation that could have been disastrous.
Sources say that if the aircraft had been operated by pilots from a more authoritarian culture (e.g., Asian or Middle East) that the copilot never would have acted in this way without the captain’s express permission. This generalization perhaps should be put in context: the Germans have been noted for their penchant to recognize authority, too, so the generalization about other cultures may have limited application. The essential point is that this crew evidenced what good CRM is all about. As one impressed pilot remarked: “Highest scores for the crew – 1.6 feet at full power and 20 degree bank? Scary. Scary.”

The maintenance action
German investigators, Lufthansa officials and representatives from manufacturer Airbus are focusing their inquiry on the maintenance actions that preceded the incident flight. In the process of troubleshooting and repairing the ELAC, Lufthansa Technik personnel found a damaged pin on one segment of the four connector segments (with 140 pins on each) at the “rack side,” as it were, of the ELAC mount. Repair work involving complete rewiring “upstream” of the connector pins was conducted over several work shifts by various technicians. In the process, according to preliminary reports, the polarity inadvertently was reversed on four wires in one connector segment. Two of the wires were for the roll control input and two were for the associated control channel “outputs.” It is believed from preliminary accounts that the technicians correctly followed the wiring list. Sources say the aircraft wiring can vary by aircraft serial number, and that care must be taken to match up the correct wiring list by tail number, also known as “aircraft effectivity.” An Airbus official expressed doubt that aircraft wiring would be unique for each aircraft, however BFU officials and maintenance personnel maintained that the wiring lists for individual aircraft may differ.
One pilot observed, “If it were the case that control wiring differed at the ELAC connector between models of the same type, the ELACs would not be interchangeable…and this is not the case.” However, we understand that the male/female marriage of connectors and pins (all 560 of them among the four connector segments) is not the issue, but the color-coding scheme of the wiring to the backside of the connectors on the rack to which each ELAC is mated.
Before the airplane left the hangar at Frankfurt for return to service, a flight control check was performed using the respective indications on the cockpit ECAM (Electronic Centralized Aircraft Monitoring) display (see illustration at p. __). The BFU confirmed that the mechanic’s flight control check was limited to the first officer’s sidestick, not the captain’s on the left side of the cockpit. Whether a maintenance technician would be sufficiently astute to catch aileron deflection in the wrong direction is another matter. It is not certain if anyone was standing outside the airplane to double check actual movement of flight control surfaces, or if the presence of such an individual was required by the operator’s procedures.
At Lufthansa’s code-share partner United Airlines [UAL], certified inspectors must be stationed both inside and outside the cockpit to conduct a functional check after work is performed on the flight control system. In addition, a flight test is required before the aircraft is returned to service after this kind of repair.
The details of such procedures at Lufthansa will be part of the BFU inquiry. The question of any time pressure to get the work done also seems certain to be explored. After all, this was a repair to a primary flight control system (as opposed to a flight management system). The incident seems to raise all sorts of human factors issues in maintenance.

The preflight checks
Every crew routinely exercises the flight controls as part of its preflight check. On the A320, the Flight Control page on the ECAM will appear when the sidestick is moved as part of the preflight check. The sidestick must be held about 3 seconds for full travel to be reached; it takes that long for the ECAM to generate a fault message.
There is some confusion in the pilot community about whether these checks will be displayed on the ECAM as control inputs (the position of the sidestick) or control outputs (actual position of ailerons, etc.).
The ECAM will display control outputs, as does the comparable system on the Boeing [BA] fly-by-wire B777 (see box at p. ___).
One pilot correctly explained the functioning and went on to surmise what may have happened:
“Four position sensors called LVDTs (Linear Voltage Differential Transducer – used with aircraft control surface servos) look at the ailerons. This is quite independent of the sidestick positions. This display would not have been affected or reversed because of any miswiring of the sidestick…
“On control checks during taxi out the pilots saw spoiler movement and aileron movement in response to commands from each sidestick, correctly displayed on (the) ECAM. It just happened to be in the wrong direction for one stick. Really quite easy to miss at a very busy time and so unexpected. Every pilot does control checks, thousands of times. It is always correct, isn’t it? Except for this oh-so-rare occasion.”
The check often is made during taxi out, a high workload period, rather than before pushback at the gate. Accordingly, the PF is moving his control actuators while keeping his eyes focused on activity outside the airplane, while the PNF is keeping his eyes locked on the ECAM display. In this arrangement, the PNF is not looking at and probably is not able to see the direction in which the PF is testing the sidestick. As such, the PNF may be looking at the ECAM more for confirmation of deflection, but not necessarily for direction of deflection. One means of mitigating this uncertainty might be as follows: The PF announces “Left” to indicate the direction in which he’s moving the sidestick (right, forward, back would constitute the other callouts in the four-step process). The PNF would respond to “Left” with confirmation, “Left (aileron) up, right down.” This is the common procedure on other Airbus aircraft such as the A 330 and 340. But these checks vary among different Airbus operators.
In any event, the details of these procedures and checklist will be another point of the BFU examination (see related story in box at p. ___).

The filters penetrated
The fault got by at least two safety “filters,” as it were. It was not detected during maintenance, and it was not detected during the preflight check. In this respect, the incident fits the now classic “Swiss Cheese” model of accidents postulated by human factors expert James Reason. A professor at the University of Manchester, Reason is a world-renowned expert on human error. His metaphor of Swiss cheese represents the various layers of defenses against catastrophe. The holes in each slice of cheese represent breaches in the defenses, and when the holes are in alignment, the multiple defenses in depth are breached. The combination of what can be a chain of relatively insignificant circumstances link up, leading to an incident or accident.

The design vindicated
The fact that the incident did not end with investigators piecing through charred wreckage is fortuitous. In the unfortunate event of a crash, there might not have been sufficient evidence pointing to a connector/wiring fault. Absent such evidence, investigators may have come to a finding of incorrect banking associated with turbulence, leading to a conclusion of “pilot error.”
To be sure, crossed or reversed flight control cables on conventional aircraft have caused more than one crash. There is a grim history of such events on military and general aviation aircraft. If one control stick is connected backwards, then both yokes are misrigged, and both pilots are faced with what might be characterized as “the same rather extreme problem.”
However, reversed controls are deemed impossible on transport-category aircraft, with their combination of cables and pushrods. Consider the “conventional” B737. A Boeing official said, “The ailerons are moved by hydraulic actuators. Following proper maintenance and inspection procedures, it is impossible to connect the steel cables leading to these actuators reversed. You would have to do it deliberately. This problem would be detected by maintenance (personnel) performing the operational checks, but latest by the pilot during his preflight check, as he would not be able to move the controls.”
In the case of the A320, one aspect of the aircraft’s fly-by-wire design may have enabled the first officer to quickly gain control of the aircraft – the ability to isolate a malfunctioning sidestick and shift command to the other sidestick at the push of a button. As one pilot observed: “I would say that on this occasion it was BECAUSE of Airbus technology that a major incident was avoided!”

The larger implications
Even though technology may have saved the day in this case, Peter Ladkin, a computer systems expert at the University of Bielefeld in Germany, points to a number of accidents involving fly-by-wire primary flight control systems. In the military, the X-31 research aircraft, the Saab JAS 39 Gripen tactical jet (twice), the V-22 Osprey tilt-rotor, to name a few. And there have been incidents involving computer-controlled primary flight control systems in commercial aircraft. “There are people such as myself…who believe a re-think of this safety-criticality of on-board systems is in order,” Ladkin asserted.
Some commentators suggest the installation of closed-circuit television (CCTV) to provide added real-time feedback to the pilots. In most large jets, pilots cannot actually see the movement of ailerons, flaps, thrust reversers, and so forth (although spoiler deployment can be viewed from the cockpit). A CCTV system, they suggest, would provide added feedback. And, with the CCTV integrated into the digital flight data recorder (DFDR), a visual record of system functioning would be available for post-crash analysis.
The debate over CCTV on transport-category aircraft may be for another day. In this case, human factors issues in maintenance and flight operations appear to dominate, with latent factors such as “aircraft effectivity” for wiring lists.
The BFU may have “just” an incident on its hands to investigate, but the safety issues are profound. (ASW note: aviation editor Tim van Beveren contributed to this story) Q

BOX
Functional Checks of the fly-by-wire B777

“In the B777 the EICAS (Engine Indicating and Crew Alerting System, the equivalent of the ECAM on Airbus aircraft) will detect a single fault, as it was the case with the LH A320. It (the computers) would have a problem to detect multiple faults (which is a common known problem with artificial intelligence systems).
“The EICAS would generate an error message as it compares the pilots’ inputs versus the actual outputs. Each pilot input is translated into three independent signals. The computer also compares these three signals for plausibility and that they all agree.
“Further, it compares the ACTUAL surface deflection (left aileron up if control wheel input to the left, right aileron down and vice versa) to the desired control input…
“Further, there is a specific mandatory maintenance task after performing ANY rewiring of any components. Special computerized test equipment is used and will detect any wiring faults…
“Last, with many of our operators there is a required visual check outside while somebody inside the cockpit performs the flight control check after repair to ensure appropriate deflection.”
Source: Boeing"

Well, "Air Safety Week" reads PPRuNe then!

Checkboard - I think you can put that input down to TvB. Tim has sought thoughts and opinions from aviation professionals via the electronic bulletin boards even before PPRuNe was around. Danny and I both used to see posts from him over on CServe and, if I remember correctly, he was then doing research on aviation safety for Dutch television.

------------------
Regards from the Towers
[email protected]

Certainly a full visual check is impossible but as an FO I can quite easily see whether the RH Aileron is deflected upwards during the stick right movement during the control check. Can't see anything else though but since this Lufty incident I must admit to a few glances over my shoulder.

Don;t know whether you can do this on an A321.

Well done also to the pilots.

Wonder if the F/O actually had time to analyse the situation?
As I understand it the other pilot's side stick is not visible from either side thus the input is not immediately apparent.
Maybe the F/O reacted instinctively as most of us would and fortunately his side stick was correctly wired. I am not trying to denigrate anyone - just trying to imagine the scene.

Hi All
I cannot answer for the Civvy (normal) Techies, but as an ex RAF Techie our independent check system for flying control systems states that the checker should check for 'Correct sense ands range of movement'. Now forgetting every indication device ever invented, how do you know on the ground that when you stick left the left Aileron moves up etc, well the only way is to get someone to stick left, while you watch them, and then while they hold it there, you go and look at the control surfaces. I don't know whether it's the Military in me or not, but unless i have seen everything working correctly, with my own eyes, then I couldn't sign up an Independent check for controls. Seeing is believing. Incidentally, I have to agree with the people who have been saying that if the Airbus system wasn't the way it is, the A/C would have crashed. At least there was some override available. If anyone wants to flame me about this, don't bother, this is my opinion and I'm not about to change it. Also at 44 I've been called just about every name going (and they all apply ;-))

Regards

------------------
'If at first you don't succeed, skydiving probably isn't the hobby for you'

PFD

In a previous post someone made the comment about mismatched wires and indexed connector plugs and how could this lead to the problem discussed in this thread. Here is how it could happen. A major German supplier of power drive systems for the secondary flight control systems on Airbus Aircraft did not incorporate indexed electrical connectors on any of the components they supplied on the A-310. It was their contention that they would impact the delivery schedule of their systems to the wing integrator and besides, it would have a severe impact on the cost of their equipment.

With this in mind consider the following. The only means incorporated in the wiring system to combat misconnection of connectors onto an appliance were tiebacks on the wire looms. The first time the appliances required maintenance or were removed for cause the tiebacks were cut. After the maintenance the tiebacks were either not replaced or, they were not in the same condition as before the maintenance. This would allow for cross connecting. If the wires were cross-connected on the PPUs the first time power was applied the flap or slat system would shut down and the computer could not diagnose the problem. If the wires on the command sensor unit were cross connected there would be no indication as to the problem but it would seriously impact the problem of trouble shooting if a defect were to occur.

If a connector were mis connected on the power control unit the system would not operate correctly and the effected system would most likely lock up and to top it off the computer may not be able to diagnose the problem.

I can’t say if this problem was rectified on later models but it still exists on the A-310.

If you want to hear more about this and other problems go to my posting entitled “How safe is your aircraft”?, on these threads.


------------------
The Cat

[This message has been edited by Lu Zuckerman (edited 04 June 2001).]

[This message has been edited by Lu Zuckerman (edited 04 June 2001).]

I read that many believe that if this had been a Boeing airplane there would have been an accident, only the fact that it was an airbus saved it. However, there would be less chance of incorrect aileron setup in the Boeing, since it would involve cable rigging, which is not often touched, and would be harder to mis-rig. So the initial error would probably not have happened thus no incident. And think what would have happened if BOTH the aileron connections were wrong; the FO would have rolled them in to the ground. In fact, how did he know his controls were not similarly affected? Seems he took a chance (which worked out for them all, luckily).
And for TvB, you said that Luft does the control check on taxy instead of before pushback. I was working for a small airline that Luft had a contract to manage and they did the same to us, making us change the control check from the Boeing standard to during taxy. I objected till I was red in the face but could not make them see the stupidity of their actions. I would imagine that they will still not see it. I have no respect for airline managements that think they know more than the manufacturer does about the airplanes.

askcv - A valid flight control check can only be performed with both engines running (ie pressurizing the green and yellow HYD systems) hence this check is done after pushback, and "at a convenient stage during taxi" according to Airbus SOPs.

Pardon my iggorance but all the airplanes I have flown have several methods of powering a hyd system; electric (pnuematic/manual/RAT) and engine driven. The Bus does not? Woo, more than I wanted to know!

[This message has been edited by askcv (edited 04 June 2001).]

It is the F/O action I find most incredible in this saga. To take over control from a senior officer is psychologically very very hard. This guy must have had really excellent CRM training to do this so quickly and decisively. How many FO's in UK airlines would have responded like this?

askcv

Manufactures do make mistakes, practise has proven that over the years. I personally as every other pilot on this forum have updated my manuals with many amendments.

The problem is not that the Airline manager might have another opinion then the manufacturer. The problem is that the customer support afters sales with the manufacturer’s standard pilots is not up to scratch.

To believe that the manufacturer has all these things fully under control is dreaming with your eyes open. They need the feedback from the operators, and if they are serious about the credibility of the design of their product they should have no problem with that.

Boeing claims they had the customer involved at a very early stage when designing the B 777, I believe that to be true although a bit overstated.

One of the worst customer supports I have ever seen is that from British Aerospace for their Avro 146/RJ 85, I am puzzled how this thing ever got certified ?


------------------
Smooth Trimmer

PFD:


As I was told, Airbus didn?t feel it necessary to make such a visual check mandatory for their f-b-w a/c. So we are back to famous Mr. Murphy and his law?


I tend to see it your way (in this regard): »seeing is believing« or »only sign off what you've seen with your own eyes«. However, if the fight-control check would have been performed on the F/O side only (as with the LH incident a/c), the deflection would have been consistent with the expectation?


Yes, you maybe right that here the »option« of the priority switch made the day, despite that I was told by numerous (civil) technicians that it would be quite impossible to screw up the flight control cables on a conventional airliner and reverse them without detecting it before being airborne.


Apparently the mechanic (1. safety guard), the inspector inspecting and signing the work off (2. safety guard) and finally the pilot during his preflight checks (3. safety guard) would not be able to move the stick. - I?m aware that it had happened on some kind of military aircraft though and there are many cases in the general aviation field.


So given this in respect to our scenario here at hand I believe the comparison and conclusion is not appropriate (- my personal opinion) and I feel that askcv is right with his remark.


askcv:


I?m very well aware that Lufti has many company procedures quite unique to their operation. I very well recall some aspects we found in the aftermath of their landing accident at WAW. For example it was company procedure to use a higher speed addition (for the family) when crosswind was to be expected. The LH SOP asked for 15kts more, despite the AI procedures recommended only 10 kts. This resulted in a higher speed on final approach at WAW where there was no x-wind during the landing but in fact a nice tailwind adding up the final approach speed.
Looking further in the procedures we found another interesting issue in regards to the V1 calculation. It was at that time that LH had introduced the »go-decision« instead of V1 and they did it for all fleets. What got lost in this change was the fact that the A320 had been certified according to the new certification requirements in those days. These required to include the »reaction time for the pilot« in case of an abort decision after V1 and before Vr. Now AI went ahead and calculated their V1 accordingly, but without giving it a lot of publicity. I interviewed their former Senior Vice President of Engineering, Bernard Ziegler and he confirmed that, adding: »?we considered V1 to be critical and we did not give any ?publicitee? to that as we are safety minded and we would like the pilots to ignore that they have a higher safety margin.« (well?hmmm...). Anyway this resulted in LH reducing their V1 a second time by their go-decision calculation. Not a very big deal as long as we don?t come into the regime of Vmcg and we still have enough runway to clear the threshold by the required altitude. I believe LH changed that as well after they became aware.


I think you?re right that sometimes the management believes they know everything better. The root of multiple problems in this area is as well associated with a lack and/or defective communication between manufacturers, operators and pilots, as Streamline rightly commented. I?m sure no one acts deliberately or out of pure arrogance, but the potential danger for safety relevant implications is given under such conditions.

Back to the incident at EDDF:


So far we have identified three different company procedures for the flight control checks on A320 a/c. - Strangely, LH does it during taxi. For other operators this is a clear ?NONO? out of obvious reasons associated with the safety during taxi (let stand alone the SQ 006 scenario?).


I would be interested to learn from the Airbus pilots among you (A320 family, A330 and A340) how your flight control check is performed and when (after eng start up, pushback, taxi) and if there is any x-check between CM1 and CM2, according to your company procedures.


Are there companies still performing a solid flt/ctr check with somebody outside, for example at the first flight of the day?


I feel that there might be more than three alternatives out for the same aircraft and among the entire Airbus product variety.
Comments highly appreciated.


Regards
TvB
(independent) aviation editor
www.aviationsafetyonline.com



[This message has been edited by TvB (edited 05 June 2001).]

The Airbus SOP calls for the PF, at a convenient time during taxi, to apply full lateral and longitudinal sidestick deflection (and rudder deflection) in sequence. Each deflection is announced by the PF and checked for FULL TRAVEL AND CORRECT SENSE by the PNF from the F/CTL page.

The PNF then silently checks his sidestick.

The procedure is probably adopted by most or all A320 operators (guess????)

Yes the check could be done before pushback by powering all three hydraulic systems (electrically and via a PTU) with outside observers etc etc but I think this is completely unnecessary, time wasting, and done during a period of much higher workload than during taxy!

This incident has elements of "Murphy's law" however for me it stresses the need to check correct sense of movement, not just "full and free".

[This message has been edited by mcdude (edited 05 June 2001).]

mcdude:

is this the Airbus procedure or a specific from your company?

If the later, is this a European operator?

Apparently there is quite a set of different procedures in this regard, specially in Europe, with variations, but no unique standart procedure.
And we have not entered into the field of variations for other AI fbw a/c...

regards
TvB
(independent) aviation editor
www.aviationsafetyonline.com

Slightly off topic but...
I seem to remember a documentary about Airbus A320 and FBW incidents etc which had on it the ex Lufhthansa chief safety pilot being interviewed and if my memory serves me correct he actually resigned from LH in protest at their decision to buy these A/C.
Can anyone else confirm this? I'm fairly sure I'm right.
http://www.stopstart.fsnet.co.uk/mica/pc-crash.gif

[This message has been edited by Pengineer (edited 05 June 2001).]

411A & Ironbutt57 --- SOG's

Out of all of this I noticed that having had the wires changed on the CAPTAINS sidestick the engineer carries out the control check ( without external check) using the CO-PILOTS sidestick. Well excuse me but which one had the work carried out on it!!!!!!!!!!!!!!

------------------
Keep smiling!!!!

There is something i wanted to ask about this incident, too:

If the wing was only still 0.5 feet (or meters) from the surface, how should it have lasted 5 more seconds (anyone wrote this) until impact ? Did the captain try to correct the course during rotation or after take off ? I can't believe that within 5 seconds a A320 shouldn't have made enough height to avoid touching the ground with a wing ? Who can say somnething about this point ?

Interestingly this incident isn't discussed on the german pilots site at the moment.
Makes me wonder .... so it's all right ?

cheers
ef

PFD – sadly the independent checking system has all but disappeared in civil aviation.

Abulafia – CRM training had little to do with the F/O's input, more like lightning recognition of the situation and the application of common sense.

Pengineer – The man you refer to is a personal friend and former colleague of mine - Captain Heino H. Ceasar, indeed the former Chief Flight Safety Pilot at LH, and who left on attaining retirement age (from the B747-200) and not 'in protest' at LH's acquisition of Airbus equipment. He had lots of, shall we say, strong opinions, about all the products he flew, all the way back to long-range piston types.

pengineer:

I think I know the film you mentioned as I produced and directed it*. But you're wrong! To my knowledge the former Lufthansa CF, Cpt. Heino Caesar did not resign in protest. He simply retired reaching his retirement age.

Cpt. Caesar was involved in the early stage of the Lufthansa decision to go for the A320 as he was the company safety pilot. He published some quite remarkable articles with the FSF and other special publications in regards to automation in the cockpit and the man-machine interface.

Regards
TvB

* The film is titled "fatal logic" and is dealing with the Lufthansa landing accident in WAW and in general with the design philosophy of AI. This film was realized in cooperation with the German Pilots Union (VC) and tried to shed some light onto the line of notorious "pilot errors" - whenever it came to an Airbus accident.

Those who are interested in the further development of this story might check the article "Thinking of Airbus" under the "Special Features" section on my webpage at www.aviationsafetyonline.com

there is no issue here .....

the control scenario is checked on the ground ( spoiler deflection & all aileron inputs ) ..... there is no error margin .....crew input ...& ecam confirmation .. think lufty is thingkin bout the xtra 30 % .....2 much......??

enginefailure:

check out the threat before you write. It starts at page 1. Everything was quoted here and as for the German Pilots Forum pls. check:


http://www.pilots.de/ubb/NonCGI/Forum1/HTML/000797.html
- if you understand German.

After all this cross- and double checking your engine should be running..., ehh...your questions should be answered.

Regards


------------------

Streamline;
I flew a few British airplanes when I was a youngun and I was not impressed with their manuals either. I am only talking here about Boeing really, since I am not aware of the Airbus manuals. But from what I have read here I can see that the tendency of airline managers to write procedures themselves exists in Airbus fleets too.
I know that for the latest generation of airplanes Boeing spent a lot of time and money to get the best procedures for their product, and the design of the systems and switches were optimised for those procedures so that everything works as well as it can. They had specialists in time and motion, engineering, flight crew (including trained and qualified test pilots), education, medicine and so on to conference, suggest, test and apply it all. The end result is what we, the greasy end, have to work with.
Yet many airlines don't even bother to try it before they substitute their own procedures. They have no idea what affect this will have on the safe or efficient operation of the airplane, and often are not aware of the damage they do. They justify it by saying it is "standardization", or it is intended to reduce training cost, or simply (usually) it is done because the old codger writing the new procedures does so to make it comfortable to himself.
It goes without saying that the airline managers and their helpers do not have the qualifications of those who designed the original procedures. The pilots accept the way the airline tells them to do it, and most of the time they are not aware of the deficiencies, nor even that what they are doing is not 'standard' (what the manufacturer intended).
If the changes were beneficial, then you can be assured that the manufacturer would pick them up and make them part of their own procedures. This practically does not happen, which should tell you something.
Many of the changes made do result, by themselves and as part of the whole procedure, in a less safe and less efficient way of doing it.
Changing the B744 procedures to agree in part with the 747 Classic, for example, is a terribly short sighted way to do it. But Lufthansa (among others) does exactly this.
The new airplanes are downgraded (dumbed down) for a short term benefit and once the procedures are written, it is extemely hard to change them.
Ansett bought new F27-400s with F27-100 flight instruments, for example, intending to save money on training, and I have heard some airlines have tried to do the same with the newer glass cockpit types (CX for one). This is an extreme example of what I am talking about of course, but even if the change is simply to move the control check to the taxi phase instead of doing it before start, as the manufacturer intended, has adverse affects on safety and cost.
In fact I know of no changes that result in an improvement. Maybe you do?

If only similar coordinations and reactions were input into the GF072 scenario,would have saved theday,probably???

There is an interesting analogy to non-standard wiring of flight control sticks in the field of anaesthesiology. It makes interesting reading and I quote from it below. Maybe someone in the aviation world can calculate the incremental reduction in risk that common design aspects across a family of aircraft could generate.

In the book ‘The best American Science writing 2000’, Atul Gawande writes about the incidence of fatalities resulting from general anaesthesia. In the US, between 1960 and 1980, this averaged at 1 in 10,000 operations. Acceptable risk? Maybe not if you weigh the ratio against total operations annually. In 1982, this equated to 6000 patient killed or brain damaged. Fortunately, the incidence is greatly reduced today, thanks to an engineer named Jeffrey Cooper. To quote from the book,
“An unassuming, fastidious man, Cooper had been hired in 1972, when he was twenty-six years old, by the Massachusetts General Hospital bioengineering unit, to work on developing machines for anesthesiology researchers. He gravitated toward the operating room, however, and spent hours there observing the anesthesiologists, and one of the first things he noticed was how poorly the anesthesia machines were designed. For example, a clockwise turn of a dial decreased the concentration of potent anesthetics in about half the machines but increased the concentration in the other half. He decided to borrow a technique called "critical incident analysis"--which had been used since the nineteen-fifties to analyze mishaps in aviation--in an effort to learn how equipment might be contributing to errors in anesthesia. The technique is built around carefully conducted interviews, designed to capture as much detail as possible about dangerous incidents: how specific accidents evolved and what factors contributed to them. This information is then used to look for patterns among different cases.
Getting open, honest reporting is crucial. The Federal Aviation Administration has a formalized system for analyzing and reporting dangerous aviation incidents, and its enormous success in improving airline safety rests on two cornerstones. Pilots who report an incident within ten days have automatic immunity from punishment, and the reports go to a neutral, outside agency, NASA, which has no interest in using the information against individual pilots. For Jeffrey Cooper, it was probably an advantage that he was an engineer, and not a physician, so that anesthesiologists regarded him as a discreet, unthreatening interviewer.
The result was the first in-depth, scientific look at errors in medicine. His detailed analysis of three hundred and fifty-nine errors provided a view of the profession unlike anything that had been seen before. Contrary to the prevailing assumption that the start of anesthesia ("takeoff") was the most dangerous part, anesthesiologists learned that incidents tended to occur in the middle of anesthesia, when vigilance waned. The most common kind of incident involved errors in maintaining the patient's breathing, and these were usually the result of an undetected disconnection or misconnection of the breathing tubing, mistakes in managing the airway, or mistakes in using the anesthesia machine. Just as important, Cooper enumerated a list of contributory factors, including inadequate experience, inadequate familiarity with equipment, poor communication among team members, haste, inattention, and fatigue.
The study provoked widespread debate among anesthesiologists, but there was no concerted effort to solve the problems until Jeep Pierce came along. Through the anesthesiology society at first, and then through a foundation that he started, Pierce directed funding into research on how to reduce the problems Cooper had identified, sponsored an international conference to gather ideas from around the world, and brought anesthesia-machine designers into safety discussions.
It all worked. Hours for anesthesiology residents were shortened. Manufacturers began redesigning their machines with fallible human beings in mind. Dials were standardized to turn in a uniform direction; locks were put in to prevent accidental administration of more than one anesthetic gas; controis were changed so that oxygen delivery could not be turned down to zero.”
……”Today, anesthesia deaths from misconnecting the breathing system or intubating the esophagus rather than the trachea are virtually unknown. In a decade, the over-all death rate dropped to just one in more than two hundred thousand cases--less than a twentieth of what it had been.

Reference
Gawande, A., “When doctors make mistakes”, In “The best American science writing 2000”, Ed. James Gleick, ECCO Harper-Collins, New York 2000.

Has Airbus decided to modify the parts within the control stick unit which are apparently interchangeable, or is that the main risk for maintenance?

Date: Mon, 18 Jun 2001 12:54:17 +0200
From: "Peter B. Ladkin" <[email protected]>
Subject: A320 Incident

Tim van Beveren reported in *Flight International*, 22-28 May 2001, on a 20
Mar 2001 incident to a Lufthansa Airbus A320 on takeoff from Frankfurt.
This incident was reported at greater length and detail in *Air Safety
Week*, 4 Jun 2001, by David Evans and Tim van Beveren.

The captain was Pilot Flying (PF). there was some degree of turbulence
during takeoff, shortly after rotation, which resulted in the left wing
moving down. The captain applied correction (right lateral roll control) but
the wing dipped further left, reaching 21 degrees bank, and the wingtip is
reported to have come within half a meter of the ground, and according to
computer modelling of the digital flight data recorder the airplane "came
within a few seconds of striking the ground".

The First Officer, the pilot not flying (PNF), realising there could be a
control problem, switched "priority" to his sidestick controller and
recovered the aircraft. The aircraft was flown up to 12,000ft on autopilot,
the crew confirmed the problem, that the CAP's sidestick was controlling for
roll in the reverse sense (normally, putting the sidestick to the left
commands left roll; to the right commands right roll. Control-reversal here
means that CAP's sidestick gave right roll on a left movement and left roll
on a right movement).

The aircraft had just come out of maintenance. Maintenance is a known
risk -- James Reason, an authority on human factors in aviation safety and
Professor of Psychology at the University of Manchester, amongst others, has
detailed how significant problems may arise through maintenance of complex
systems.

It has happened many times that aircraft have come out of maintenance with
control systems reversed in one or more of the three axes (roll, pitch,
yaw). This has been the cause of a number of accidents with general aviation
aircraft, but my informal requests for information turned up no recent
accidents to commercial aircraft due to this cause. Evans and van Beveren
report that "reversed controls are deemed impossible on transport-category
aircraft" and that Boeing claims that the B737 aircraft cannot be
reverse-connected without it being discovered before flight, normally
through mandatory post-maintenance checks, but at the latest by the pilot's
preflight check, as the controls could not be moved.

At Lufthansa's code-sharing partner, United Air Lines, certified inspectors
must be stationed both inside and outside the cockpit to conduct a
functional check after the flight control system has been worked on; a
flight test is also required before the aircraft is returned to service
after this kind of repair. It is believed that either of these measures
would have caught the control-reversal problem, and so general
maintenance
procedures at Lufthansa Technik will be subject to detailed inquiry.

There have been a number of reports as to what fault caused the lateral
control reversal, including the two sources above. However, I have found
none of the explanations so far satisfactory, as they raise further puzzles
that they do not solve.

The following architectural description of the A320 primary flight control
system (PFCS) is drawn from Cary R. Spitzer, Digital Avionics Systems,
Second Edition, McGraw-Hill 1993. The A320 sidestick controller generates
input to five of the seven flight control computers which form part of the
primary flight control system (PFCS). These five are the two Elevator
Aileron Computers (ELACs) and the three Spoiler Elevator Computers (SECs).
Each wing has two outboard ailerons, and five inboard spoilers (overwing
surfaces which can be raised). Lateral (roll) control proceeds via four of
the five spoilers and the two ailerons. Each of the two ELACS and three SECs
control some combination of these 12 control surfaces. There is a
significant amount of control redundancy.

Initial reports said that Lufthansa Technik personnel had been repairing
one of the two ELACs, and had found a damaged pin on a connector. They
had replaced the connector and this had apparently caused the control
reversal. This explanation made no sense to me as it stood, because
(a) the connectors are standardised. Replacing one with another should
give exactly the same connections as were there before;
(b) if one ELAC was receiving reversed signals, and the other was not,
and the three SECs were not, then
(i) the PFCS architecture would detect a discrepancy on the channels, and
(ii) on each side, one aileron would operate counter to the other, but
all spoilers would operate correctly-sensed, and it is hard to see
how this could lead to the extreme control discrepancy reportedly
experienced by the PF.

The Aviation Safety Week report on June 4 suggested that "Repair work
involving complete rewiring "upstream" of the connector pins was conducted
over several work shifts". The ELAC connector with the damaged pin has 140
pins and is one of four such for the ELAC, for a total of 560 pins.

It seems to me that to get control reversal without the phenomena in (b)
above, there must have been a reversed signal downstream of the sidestick
but upstream of where the sidestick movement is multiplexed into the five
input signals to the five PFCS computers which receive them. I do not yet
have, nor have I heard, a coherent suggestion as to how that could occur.

There has been considerable discussion of and speculation concerning:
maintenance procedures at Lufthansa Technik, which has one of the very
highest reputations for maintenance quality; wiring, wiring conventions and
connectors in the A320 series; why the pilots did not discover the
discrepancy during the usual preflight control checks (the A320 displays
control surface displacement on the cockpit display, the ECAM, when the
sidestick is intentionally moved and the airplane is on the ground, as
during a preflight control system check). I think it is fair to say that few
hard facts have emerged yet concerning any of these, and I find it hard to
make any useful inferences about what actually went on from the publicly
available information.

What emerges most clearly so far from this incident is that the simple
physical complexity of the control system has confused some. Amongst other
things, explanations have been proposed by presumably technically
competent
people that do not fit the control system architecture. It is hard to see
how that phenomenon could have occurred with the simpler architectures of
mechanical control systems. On the other hand, the PNF was able to take over
normal control of the aircraft with one button push (the "control priority"
takeover on the sidestick), which could also not happen with the simpler
mechanical architectures.

We have very little information so far on the incident. It is certain that
the puzzles will be solved further along the investigative line, and very
likely that the results of the investigation will be highly significant for
the care and feeding of fly-by-wire architectures.

Peter Ladkin, University of Bielefeld, http://www.rvs.uni-bielefeld.de

[end quote]

Is anybody seriously considering the routine of the PF control check? Many PNF checks of flight control operation on the flight control system page would not pick up incorrect sense. Many PNF say "checked" before surface indications return to neutral. This immediately invalidates the pilot flight control checks. Captains therefore have increased responsibility to ensure that controls are actually correctly checked.
I guess many FBW pilots are now meeting the new challenge. The question is of course, why not previously to this near fatal incident?

Peter

Small correction to your A320 explanation.
I'm sure you just forgot.
On each wing side there is just one aileron surface. This surface is controlled by 2 servo controls, one of which is active while the other is in damping mode. The 2 servos are never active at the same time.

FF

We do all our flightcontrols checks PRIOR taxi (A319/A320/A321/A330). It has been mentioned several times, that the feedback of the travel direction is taken from the sidestick and not from the aileron itself. I don't agree, because if all the hydraulics are depressurized (engines not running), the aileron droop is visible on the FCTL ECAM page. With a centered stick, there would be no directional feedback.

Just goes to show that all the technology in the world cannot save us from ourselves

UPDATE
 

Hello everybody.

Has been some time that we have discussed this issue here and I just want to point your attention to the final report of the German Accident Investigation Board (BFU). An English language version is available at the BFU web page at

http://www.bfu-web.de/berichte/e_index.htm ,

file no 5X004-0/01 for download as a pdf file.

Everybody flying A3we should have a look into the "synopsis" and specially to the "contributing factors"



Happy landings

Tim van Beveren
(still independent) aviaton safety editor

I'm sorry to intrude here but...

Do pilots really bother to look out the window and check visually the control input results? How many of you DO look outside? Don't get me wrong here, but procedures made day after day after day, one day, will result on skipping some detail, out of simple trust on the system, because you know the system is too damn good.

Just my two cents...

GDL

Nice idea but in practice you can't see the surfaces from the flight deck. If you crank your neck around you can just about see the wingtip!

Amazing
 

I just realised that since I posted my update remark, the topic (which was dormant for almost two years) got more then 1.700 hits in less then 6 hrs. That's what I call traffic; - must be the headline though... ;)

Nevertheless, honestly: how many have been aware of this incident, its cause and implications?

:ok: :cool: