Airbus crash/training flight

[The Ancient Geek]

There does, however, remain a worrying airworthiness issue.

The enquiry has revealed that improper washing techniques can allow water to penetrate the alpha sensors leading to a multiple sensor failure.
A multiple failure will not be correctly interpreted by the automation and in this case apparantly caused a control law change and a full-up elevator trim which was not immediately apparant to the crew.

Complex failures of this kind are difficult to diagnose and indeed are difficult to design around. I find it worrying that a simple error by relatively unskilled ground staff can lead to such a situation.

Alpha limits should never be triggered in normal airline operations but the protection is there for good reasons and there remains a possibility that the failure could be repeated with disastrous results.

Strict supervision of washing operations is the obvious answer but a redesign of the sensors and pilot awareness are also important.

Another case of the world inventing a better fool to defeat a supposedly foolproof system.

[guiones]

JC and Geek, again; the intent of this flights is to make sure everything is working.

An experienced Test/Acceptance crew(Pilots and Flight Test Engineer) is assuming anything can go wrong at anytime.

This crew allowed the speed to decay disregarding the minimum speed at which they should have discontinued the test. When this test is done, that is the absolute minimum speed at which this test is flown.

G

[HazelNuts39]

CONF iture;
I believe they are saying that, in normal law, the sidestick demands a load factor, and the commanded load factor did not require more than neutral elevator.

I agree that the presentation of the FDR data, and the explanations leave much to be desired. Which parameters go into the FAC's calculation of gross weight and CG, why are the calculated limit speeds a function of AoA? IMO the report ought to show at least the FDR data on which BEA's calculations are based. See the Australian report on QF72 for an excellent presentation of FDR data.

regards,
HN39

[Clandestino]

The enquiry has revealed that improper washing techniques can allow water to penetrate the alpha sensors leading to a multiple sensor failure. (...) I find it worrying that a simple error by relatively unskilled ground staff can lead to such a situation.

Exactly. Improper static port protection technique during washing can cause false static pressure indication, lot of false warnings, crew disorientation and hitting the ocean. You don't need Airbus for that, Boeing 757 will do. Welcome to aviation - where no task, no matter how trivial it might seem, is to be taken lightly.

A multiple failure will not be correctly interpreted by the automation and in this case apparantly caused a control law change and a full-up elevator trim which was not immediately apparant to the crew.

Almost. You don't need multiple failure to puzzle automation or "automation". Sometimes all it takes is one sensor giving false data, instead of having good manners and ceasing to function altogether. Single blocked pitot of B757 doesn't cause BLOCKED PITOT light to turn on. Rather it will throw RUDDER RATIO and MACH TRIM false alerts at pilots. Those who go troubleshooting nonexistent failures while putting the lying ASI in charge of autothrottle can easily stall the aeroplane. Single radalt of the 738 that measures zero while being in the air, can reduce thrust to idle on approach and that can be disastrous if the crew doesn't pay attention. Single malfunctioning AoA probe can trigger the stall warning and make the crew trained to always respect the stick-shaker try to re-land L1011 immediately after the lift-off and wrecking it in the process.

Subtle failures can often be recognized only by the intelligent entities. Computers, no matter how sophisticated, are still very far from being intelligent.

Control law change was effected after the aerodynamic stall. Only when the aeroplane started tumbling did the computers "recognize" something was terribly wrong and threw in the towel.

Instead of elevator trim, A320 uses trimmable horizontal stabilizer. That THS can easily overpower the elevator is the piece of basic aeronautical knowledege that is sometimes forgotten. It shouldn't be. Pages 80-82 of the report refer.

[CONF iture]

I believe they are saying that, in normal law, the sidestick demands a load factor, and the commanded load factor did not require more than neutral elevator.

HN39,
That is correct and that is what actually happened, but I can see a major BUT here :
The load factor demand law is absolutely inappropriate to a high AoA situation, it is NOT the way the system has been engineered by Airbus. Under normal law, when the AoA becomes greater than alpha prot, the system switches the elevator control from normal mode to a protection mode in which the AoA is proportional to the sidestick deflection. It simply did NOT happen here.

The crew had to recover from a stall situation by using the usual load factor demand law, something that Airbus itself had probably never tested before …

The technical options adopted by Airbus are unbelievably complex, and one cannot realize or foreseen the consequences of deteriorated data as sent to the system and how this all concept of flight control laws and protections will interact.

The BEA, as usual, is silent on this …

[HazelNuts39]

Originally Posted by CONF iture

Under normal law, when the AoA becomes greater than alpha prot, the system switches the elevator control from normal mode to a protection mode in which the AoA is proportional to the sidestick deflection.

Alpha prot would also have stopped autotrim. Unfortunately alphaprot was never activated because the 'polled' AoA's were frozen.

BEA suggests that the erroneous limit speeds should have alerted the crew, although actually they may have misled them into believing there still was some margin to go towards stalling. See Dutch report on Turkish crash at AMS re reading the speed tape numerically.

regards
HN39

[Dunbar]

The key point here is that they were not conducting a TEST of the system...they may have been misled by the incorrect depiction of the protection limits on the speed tape, but if they had considered a negative outcome to the 'test' they would have had ball park speeds noted- as soon as it became apparent that the FAC speeds were too low in comparison they would have had to resolve the ambiguity.

They were 'DEMOing' the kit and the kit failed - there was no plan B.

Ultimately human error again, unfortunately. Airline pilots, even TRI/TREs are not test pilots. I'm a TRE and I've spent this evening in the sim with two test pilots. Their training and their capacity to critically analyse a system is very different from mine.

[jcjeant]

Hi,

Do you see that in the BEA report ?
And what about the analysis of each reason panels ?
Why focus on the lastest (cockpit) ?
If any of the foregoing is eliminated .. the accident is unlikely to occur.
Has the BEA in its recommendations will eliminate these panels?

[Clandestino]

the system switches the elevator control from normal mode to a protection mode in which the AoA is proportional to the sidestick deflection. It simply did NOT happen here.

...for very obvious reasons which are very well documented in the report.

The crew had to recover from a stall situation by using the usual load factor demand law, something that Airbus itself had probably never tested before …

...or considered probable. It's all very nice to preach about need to install the Big Red Button that puts the beast into direct law. Issues here are a) whether it is realistic to expect the flightcrew to recognize exactly what's going on and react promptly b) whether misuse of manual override represents greater hazard than automation malfunction (e.g. some aeroplanes have no manual ground spoilers extensions to prevent their airborne deployment by mistake). Nevermind the control laws, the crew succesfuly recovered from the first stall. Second stall precipitated by full nose-up trim was fatal.

The technical options adopted by Airbus are unbelievably complex, and one cannot realize or foreseen the consequences of deteriorated data as sent to the system and how this all concept of flight control laws and protections will interact.

I don't find them unbelievably complex but that's just me. There's no need to predict the behaviour in details as long as the crew recognize it as undesirable and avoids the precursors to it - unless you're doing hard EGPWS or windshear escape there's no need to go anywhere near protections while flying the electric passenger jet. Freezing of the AoA propbes has happened before and test crew stopped the test when no autotrim cut-out was observed at calculated speed.

Why focus on the lastest (cockpit) ?

Because it's where the buck stops and buck's braking action here was severly poor.

[infrequentflyer789]

Originally Posted by jcjeant

Hi,
Do you see that in the BEA report ?
And what about the analysis of each reason panels ?
Why focus on the lastest (cockpit) ?
If any of the foregoing is eliminated .. the accident is unlikely to occur.
Has the BEA in its recommendations will eliminate these panels?

Not sure we are reading the same report, but the copy I've got has extensive discussion on the flight operations issue (regulations on these type of flights - or rather lack of) and the qualification of the sensors themselves, and the change in flight control laws.

Of the 6 safety recommendations, only 1 is for the crew, and that is regarding approach-to-stall training. I think that is justified - this isn't the only recent case of a stall recovery being messed up. Nor is failure to correct pitch-up trim an airbus-only problem in stall recovery.

Even that recommendation is not really critical of the crew, given that the recommendation is regarding training, and that the report specifically states that the approach-to-stall procedure was followed.

[guiones]

Dunbar, let me correct you; they were conducting a TEST of the system, it is called Low Speed CONF FULL.

The TEST is to reduce the speed(1 KT/sec), wait for ALFA FLOOR to activate, cancel it; note when AUTO TRIM stops and then stabilize the aircraft at V ALFA MAX for a speed reading, prior to this TEST they must calculate(normally done by the Flight Test Engineer) the minimum speed at which to STOP THE TEST and never go below it.

The crew was not trained to do this TEST and very important, they did not have a Flight Test Engineer on board, a key part of any Flight TEST.

G

[Dunbar]

They may have intended to do a test (should that be TEST) but their mindset was that that of a demonstration ie they did not expect the test to fail and they did not have gross error figures of the alpha protections which would have given them a heads up of the failure.

So, whilst they were supposed to be conducting a test, what they were effectively doing was demonstrating alpha floor at low level.

I hope that clears it up

Cheers Jon

[guiones]

I get your point, understood.

By the way, the intended test as per Airbus PATM is to verify not only Alfa Floor, which is canceled immediately but also Auto Trim stop, Alfa Prot and Alfa Max. That is why is so important to have the calculated absolute minimum speed before the start of the test.

G

[jcjeant]

Hi,

Infrequentflyer 789

Not sure we are reading the same report, but the copy I've got has extensive discussion on the flight operations issue (regulations on these type of flights - or rather lack of) and the qualification of the sensors themselves, and the change in flight control laws.

Of the 6 safety recommendations, only 1 is for the crew, and that is regarding approach-to-stall training. I think that is justified - this isn't the only recent case of a stall recovery being messed up. Nor is failure to correct pitch-up trim an airbus-only problem in stall recovery.

Even that recommendation is not really critical of the crew, given that the recommendation is regarding training, and that the report specifically states that the approach-to-stall procedure was followed.

Indeed .. and the report I wanted to read was ....




HOW? :

Loss Control A320

WHY? (Depending on model REASON chronological order):


Bore hole in the plate "builder" technology choices

Bore hole in the plate "feedback": 2 events prior untapped

Bore hole in the plate "maintenance": non-compliance procedures

Bore hole in the plate "cockpit": low-speed tests carried out in an improvised manner

[Smilin_Ed]

What Do Pilots Do?

a) whether it is realistic to expect the flightcrew to recognize exactly what's going on and react promptly

Isn't that what the pilots were supposed to do during the test?

[Machinbird]

Recoverable?

The uncontrolled pitch up scenario is familiar to me from an emergency procedure on another aircraft and this procedure may well have utility (with suitable modifications) on a wide range of transport aircraft (The pitch trim systems are similar). I am providing this procedure strictly as a discussion tool to stimulate thought and not recommending it for any aircraft type.
From the A-4 Natops Manual (Please ignore the partial disconnect details)

Nose Pitchup on Takeoff
Nose pitchup on takeoff may be due to either runaway noseup trim or partial disconnect of the elevator power system. Specific procedures to counter either of these malfunctions are published in this emergency procedures section, but the pilot must react successfully to the immediate problem of nose pitchup to maintain control of the aircraft and provide time for determination of the exact nature of the malfunction. Limited forward stick travel, in the case of partial disconnect, and limited elevator effectiveness, in the case of runaway noseup trim, cause excessive nose pitchup as the aircraft accelerates through 170 KIAS and the flaps are raised.
To regain control of the aircraft the pilot must immediately lower the flaps while reducing airspeed to the minimum required for safe flight by maintaining a controllable climbing attitude and adjusting the power setting as necessary. The judicious use of bank angle may be advantageous and necessary in assisting the pilot to control nose high attitude. (NA. reference to jettison of external stores) Once controlled flight is ensured, the pilot shall comply with the applicable emergency procedures………(END OF APPLICABLE PORTION OF PARAGRAPH)

[SKS777FLYER]

Amen Machinbird...
Sad for me as I read thru the pages of this thread and some of the official reports. Not being familiar with the airbus, I can only guess that the immenently qualified instructor pilot, TRE occupying the left seat was just used to his airbus taking care of his handflying duty of trimming the aircraft during attempted recovery from their low speed condition. Don't recall if the various bank angles were pilot induced in an effort to get the nose dow, or if they occured as a result of low speed aerodynamic forces...tho I suspect the latter.

Not wishing to go back and read the info available, I don't believe the pilots briefed what to look for on their flight displays or what messages to look for on ECAM (or whatever AB calls it) or what to expect or procedures anticipated in the impending recovery drill. Indeed sad that the chain of events leading to the catastrophe included the freezing of two of the AOA probes, and no direct warning to the pilot/s. Apparently there WERE subtle clues displayed, I think, "use manual trim" but it seems no briefing was conducted to actually watch the instruments.
I pointed earlier the pilots complete disregard for ATC speed constraints/assignments in any timely fashion, outright false statement of speed to the controller; which points ME to a nagging doubt that they had any clue about their speed as the Captain slowed the aircraft in preparation for the final event.
I wished from day one in airliners on the 727 for an actual cockpit AOA guage. What would be the harm, say one clock style guage with diamond pointers superimposed one over the other for each AOA sensor. I know, AOA information is only useful for the accident investigators reading the flight recorder data. Needs to be kept secret from the pilots. I don't think the pilots of the accident aircraft would have seen an AOA indicator on their final mission however. Perhaps an AOA indexer on the glareshield?
Yes, the AOA is displayed I believe with the various color bands on the speed displays, but I think they are calculated on 1 g flight. Actual AOA is dynamic and changing for various g loadings, ahh the good ol' stick shaker.

[Machinbird]

SKS777FLYER,

What would be the harm, say one clock style guage with diamond pointers superimposed one over the other for each AOA sensor.

I see you have flown with AOA before. If the crew had such a gage in their panel, the accident wouldn't have happened despite the Flight Control System locking out the one good sensor. A normal scan of the panel would have showed the problem with the AOA sensors before they had slowed significantly.

The procedure from the A-4 is basically a stick and throttle procedure. It is there to keep things from going out of control until you can figure out what is happening and execute corrective measures. It is somewhat relevant because the A-4, just like virtually every subsonic jet airliner, has a trimable horizontal stabilizer which can overpower the conventional boosted elevator.

Only one problem. The procedure is counter-intuitive.

Natural inclination for a surprise pitchup during acceleration is max power and raise the gear to maintain energy. What is needed is to slow the aircraft back down quickly below the speed where it begins to pitch up. In an aircraft with Airbus style protections, it is probably difficult to get enough wing down to help prevent the nose from climbing.

Could the accident pilot have used this information to successfully save the day? Probably so, if he had trained for it. If he had not trained for it-probably not. It is really very counter-intuitive. Particularly if you have just scared yourself by stalling your aircraft.

[Smilin_Ed]

Don't Trim Into A Stall!!!!

I see you have flown with AOA before. If the crew had such a gage in their panel, the accident wouldn't have happened despite the Flight Control System locking out the one good sensor. A normal scan of the panel would have showed the problem with the AOA sensors before they had slowed significantly.

One of the first things taught in U.S. Navy flight training is to not trim into a deliberate stall. Yet, the crew let airplane do exactly that. They had sensor failures but, again, they weren't alert to that. They apparently didn't even know what the stall speed was at their weight and when they approached it, they just kept on going. The AB flight control system can "protect" against some things but clearly not against faulty AOA sensors. The mission of this flight required real thinking pilots but there were none, at least not in the two front seats.

[bearfoil]

Smilin Ed

Just a quick question. You say the USN trains not to trim into a deliberate Stall. Did you mean inadvertently, or deliberately? I might sound pedantic here, but as a training issue, once all the other parameters are in place, including sufficient altitude to recover, why would an assist from the trim wheel be out of place? Especially across all types in the Inventory?

bear