Go Back  PPRuNe Forums > Flight Deck Forums > Tech Log
Reload this Page >

Airbus crash/training flight

Wikiposts
Search
Tech Log The very best in practical technical discussion on the web

Airbus crash/training flight

Thread Tools
 
Search this Thread
 
Old 1st Mar 2009, 07:23
  #921 (permalink)  
 
Join Date: Jan 2000
Location: Currently, East, Middle of
Posts: 55
Likes: 0
Received 0 Likes on 0 Posts
Infallible?

Hardcore

I have to disagree with your premise that.. "every aviation regulatory body for every country in the world which allows Airbus to fly into it's airspace subscribes to the infallibility and redundancy of the Airbus Alpha floor protection system." I don't believe you will find any agency or credible body to say that ANY mechanical system, let alone a complex engineering system such as an aircraft, is infallible. It has been my experience that the setting of standards for such comes down to acceptable probablilities, acceptable failure rates, statistical analysis and so on and so on. I mean think about it... can anyone say that every component of every aircraft is perfect, right out of the factory? No.

As we all know, accidents are most often the result of the compounded failures of several components (usually small and insignificant in and of themselves) of the system be it mechanical, training, SOP's, ATC, handling etc. So, yes there may be a problem with the Alpha Floor system with respect other failures and if so it will be need to be remedied. But if you're looking for the system to be made infallible, aviation will grind to a halt.

Cheers
LanFranc is offline  
Old 1st Mar 2009, 07:47
  #922 (permalink)  
 
Join Date: Jul 2008
Location: UK
Age: 69
Posts: 475
Likes: 0
Received 0 Likes on 0 Posts
For the victorians out there.

The AOA's were not u/s as such. They were forced into a fixed position by yet to be explained actions. So what fault exactly will the comparators pick up hardcore?

For the victorians out there with minds firmly locked closed I will say it again slowly.

The aircraft found itself in a dangerous situation due to a poorly planned test/handover programme. The tests were just like any other tests for any other airplane since the wright flyer.

Additionally and unbeknown to the crew there was a problem with 2 from 3 AOA vanes in as much as they were in a fixed position.

The events that then followed the situation, approaching stall, AOA's fixed by external interference but not faulty would have also happened to any aircraft since the wright flyer.

The only comment you can make about the autotrim is that it did its job just the same as any other autotrim since the wright flyer but there are possibly question marks as to why it wasn't used manually.

The automation played absolutely no role in this and posters like smilin ed and dc8 just highlight their ignorance by asking such ridiculous questions as:

But, in a totally analog aircraft, or an FBW aircraft with a viable alternative system totally unrelated to the primary system, you could kick out the offending system with the punch of one button and fly out of danger. Obviously, they didn't have that option and my contention is they should.
So how exactly ed do you determine which from the 3 serviceable systems are u/s? Furthermore had you listened at school let alone read and understood what has been written here you can deselect any faulty AOA sensor.

This comment of yours ed proves you are no longer living in the real world

I spent 14 years evaluating the flying qualities and performance of aircraft. I also investigated several accidents in which colleagues died. With the data we have so far, I believe that there needs to be an alternative to back up FBW systems.
The secret of becoming an an excellent effective accident investigator is an emotionless but open minded approach.
You show neither quality

DC 8 and smilin ed, you need to go back to aeropru and birgenair and read and fully understand what happened on those analogue aircraft. Yes they did crash.

Once you have read and understood what took place then come back here and tell me how the excel crew should have known that 2 from 3 AOA sensors were in a fixed position?

Once you have worked that one out, then add the poor planning of a critical test manouvre and you may get nearer to the real cause. Multiple Human error. It started on the ground and tragically terminated in the air.

Same scenario with all sorts of aicraft would have ended in the same way. Its tragic, but the root cause is human error.
Safety Concerns is offline  
Old 1st Mar 2009, 07:49
  #923 (permalink)  
 
Join Date: May 1999
Location: Quite near 'An aerodrome somewhere in England'
Posts: 26,803
Received 270 Likes on 109 Posts
When I used to conduct full flight tests on 4-engined aircraft, there was a strict 'Test Schedule' which defined height, speed, weight and requirement for every stage of the test.


Tests were only conducted by one of two appointed captains for each variant of the aircraft as the tests were infrequent, but demanding and it was vital that we had to be very experienced on type. New full flight test captains would first practise the entire test schedule in the simulator.

We flew with a crew we'd selected, including a highly experienced test co-ordinator who 'read the script', although I had my own 'cheat sheet' to remind me what the next test would be. We took the aircraft from over M0.9 down to stall warning, but only in accordance with the schedule and in clear airspace with no ATC interruption.

So to conduct the test in the way they did seems to violate all normal rules of flight testing. Time pressure (delayed take-off), commercial pressure and ATC pressure combined with an ad hoc approach to the test and you have a recipe for disaster.

Test points are defined for a reason; flight test pilots may not know the reason, but must stick to the test points. Rigidly. No great 'golden gloves' handling skills should be necessary for engineering flight tests (as opposed to prototype testing), but a disciplined approach to such flying is absolutely essential.

Although I have no experience of the A320 series, the aircraft clearly has a sophisticated flight control system. Forcing the aircraft into any specific law should obviously not be a routine event and if a test specifically requires 'alternate' or 'direct' law, there must surely be a specific procedure to follow?

I can't think of a much worse scenario for the conduct of a high alpha test then the scenario of this accident.

Incidentally 'Manual Trim' is slightly misleading when the tailplane angle is such that it is outside the elevator's authority to control pitch - if the tailplane angle is such that full sidestick cannot correct the aircraft attitude then the 'Manual Trim' becomes the primary pitch control until the tailplane angle is within the range for the associated speed where attitude can be controlled by elevator.

The lack of THS movement in 'direct' law in this accident is highly significant - perhaps more so than the allegedly unserviceable AoA probe(s).

Last edited by BEagle; 1st Mar 2009 at 08:12.
BEagle is offline  
Old 1st Mar 2009, 07:54
  #924 (permalink)  
 
Join Date: Mar 2007
Location: Right here
Age: 50
Posts: 420
Likes: 0
Received 0 Likes on 0 Posts
Why can't those who are interested and concerned enough to voice opinions on the A320 systems at least go find an FCOM and read up on how it actually works first? You don't have to be rated to do that; you don't even have to be a pilot. This is the 21st century; the relevant FCOM chapters are easily available on the internet.

The issue that intrigues me, is that every aviation regulatory body for every country in the world which allows Airbus to fly into it's airspace subscribes to the infallibility and redundancy of the Airbus Alpha floor protection system.
Otherwise the performance figures based on 1.12Vs (versus 1.3Vs of all standard flight control variants) wouldn't be accepted as the basis for the certified flight manual performance figures.
That is a misunderstanding that could have been avoided with a brief look in the FCOM. Where older aircraft used 1.3 Vs, the Airbus uses 1.23 Vs1G. Vs1G is the stall speed at 1G, whereas the traditional Vs was measured at less than 1G. The conversion factor used is Vs=0.94Vs1G, which is where the factor of 1.23 comes from.

This has nothing to do with FBW or maneuver limitations; modern non-FBW aircraft, like the ATR, also base their values on Vs1G, and thus have the 1.23 factor in their speed calculations.

The confusion arises when one assumes that "1.23Vs" refers to the old definition of Vs, not the new 1G one, which seems to imply that the new rules give lower maneuver margins. But the new rules give exactly the same maneuver margins as the old ones did.

The pilot's very probably had done hundreds of Alpha floor recoveries in the simulator and known at what stage of the deceleration the autotrim should have locked out and when alpha floor / TOGA lock kicks in. Why did they continue to decelerate below the paper VLS?
Good Q, but has nothing to do with FBW now does it?

Surely the FAC's would have a comparator logic to cross reference other flight parameters with the AoA vanes and not just rely on a single similar sensor cross check?

If it's proven that the stall protection system is deficient in it's certified abilities, does Airbus and all the operators of airbus variants have to amend the performance figures (read weights) of the aircraft?

The problem as I see it isn't that the maneuver was carried out at less than the described altitude, but that the system has proven to be fallible.
Where is the data that suggests something didn't work exactly as designed? What appears to have happened here is that the systems were fed poor data from malfunctioning AoA sensors; the systems eventually did realize that, concluded that something must be wrong somewhere, and handed the situation to the pilots.

How else should the systems have reacted with such a malfunction? If the computers start trying to guess which sensor is providing valid but erroneous data you really start getting interesting failure modes...

Another issue entirely is the number of incidents and accidents that have happened after an autotrimming systems puts the aircraft in a grossly out of trim situation, disconnects itself and suddenly dumps a mistrimmed aircraft into the laps of the unsuspecting pilots. But that is not an FBW issue; a 50 year old autopilot is just as capable of doing that.

Maybe what ought be remembered is this: At any time, and totally unexpectedly, a sufficient number of malfunctions could suddenly cause the Airbus FBW systems to revert to a behavior that is identical to an old-fashioned ("conventional") aircraft. It is unlikely, it is exceedingly rare, but it could happen. Thus, don't do anything in an Airbus that you wouldn't do in a B737, 'cuz it could suddenly become a B737.

Which of course everybody already lived by. Except, it would seem, the Habsheim crew and the Perpignan crew.
bjornhall is offline  
Old 1st Mar 2009, 09:23
  #925 (permalink)  
 
Join Date: May 2000
Location: NZ
Age: 55
Posts: 2
Likes: 0
Received 0 Likes on 0 Posts
Good. This fleshes out those that know from those with no idea.

The aircraft was in normal pitch and roll laws (pg34).
In normal law, when approaching the stall correct function is for the auto trim to stop when Vls is reached such that the pilot has to continue to hold the stick back to induce the protections.
The flight check called for the crew to confirm autotrims stops at Vls (pg49)
Vls at 53.7T is 123kts.
The aircraft reached 123kts at 15.44.35. (pg34)
No alerts, no warnings, (pg37) no crew action (pg34)
Autotrim doesn't stop, but continues to trim back for a further 20sec.
Alpha floor as calculated by the FAC's does not activate at Vprot, possibly because it has calculated artificially low, incorrect data based on false AoA inputs.
Where else is this incorrect data reproduced? Through the DMC's as a PFD speed tape depiction of the critical speeds (hockey stick, tiger tail), which the pilots are referencing for their queues to base the test on. Maybe this explains why there’s no crew action?
The autotrim continues to trim back.
Finally, the ELACs (having failed to back up the Alpha floor based on…. you guessed it AoA inputs pg51) but now calculating Vs from the FMGC gross weight issue the STALL STALL warning. 15.45.05
The gear is down, so the roll and pitch default to Direct law, and as P2J rightly observes autotrim is then inhibited and the message “use manual pitch trim” appears on the PFD.
Yes, practiced in the simulator, but not coincidentally with a stall.
FAC1 / FAC2 deducing that the aircraft cannot stall in Normal law, send FAC1 fail FAC2 fail signals to the DMC’s. (Pg39)
When gear is retracted, pitch Alternate law is restored. (pg34).

If an aircraft is designed without control column feedback, with the only indication of impending stall artificially created and represented on the PFD, an aircraft hardly out of the factory but with 20years of service, then the calculation and depiction of that information needs to be infallable.

Can we point the finger at the pilots as the sole cause? Maybe! Do we lose the chance to isolate and identify an inherent systemic flaw. Yes
Hardcore is offline  
Old 1st Mar 2009, 10:14
  #926 (permalink)  
 
Join Date: Oct 2003
Location: UK
Posts: 116
Likes: 0
Received 0 Likes on 0 Posts
The issue that intrigues me, is that every aviation regulatory body for every country in the world which allows Airbus to fly into it's airspace subscribes to the infallibility and redundancy of the Airbus Alpha floor protection system.
Otherwise the performance figures based on 1.12Vs (versus 1.3Vs of all standard flight control variants) wouldn't be accepted as the basis for the certified flight manual performance figures.
Alpha floor is part of the autothrust system.
Autothrust is not required for dispatch.
The flight manual performance figures are not dependant on the availability of Alpha floor, which is not available when dispatching without Autothrust.
Endeavour is offline  
Old 1st Mar 2009, 10:15
  #927 (permalink)  
 
Join Date: May 2000
Location: Glorious West Sussex
Age: 76
Posts: 1,020
Likes: 0
Received 0 Likes on 0 Posts
Thanks,hardcore an accurate summary except for..
Finally, the ELACs (having failed to back up the Alpha floor based on…. you guessed it AoA inputs pg51) but now calculating Vs from the FMGC gross weight issue the STALL STALL warning. 15.45.05
As I understand it the STALL STALL warning is produced by the ADIRS (ADR portion) - presumably the standby AOA probe angle via ADR 3 - nothing to do with FMGC GW - the word "stall" does not feature anywhere in FCOM 4 (FMGC). Do you know something we don't?
And as you state elsewhere alpha-floor is done by the FACs, not ELACs. By "back up the Alpha floor" I assume you mean αprot and αmax protections?

Can we point the finger at the pilots as the sole cause? Maybe!
Not the sole cause - if the AOA probes had worked as advertised the crew would have done the alpha-floor test and accelerated back to normal speed.
TP
TyroPicard is offline  
Old 1st Mar 2009, 10:52
  #928 (permalink)  
 
Join Date: Oct 2008
Location: Melbourne, ɐıןɐɹʇsn∀
Age: 74
Posts: 81
Likes: 0
Received 0 Likes on 0 Posts
the systems were fed poor data from malfunctioning AoA sensors; the systems eventually did realize that, concluded that something must be wrong somewhere, and handed the situation to the pilots.
Understood / accepted the systems were not capable of handling the situation that was experienced. However, why would Airbus programme the systems to abandon functions and leave the stabiliser control surfaces in such an extreme setting. OR were they stuck in that position which was what caused the systems to abandon processing.

My concern is that whether through painting, ice or some other things, some sensors may malfunction. Certainly in operational circumstances, rather than test as this is, one would hopefully not be near critical energy situations like this. However a different combination of circumstances could see the situation occur in line ops. I can't believe an amber message is enough feedback for the crew to notice and overcome and anyway isn't the remedial action better conducted without that extreme stabiliser setting?

I hope to see some recommendations for Airbus to improve their automation, in particular the abandonment of function.
LandIT is offline  
Old 1st Mar 2009, 11:01
  #929 (permalink)  
 
Join Date: Jan 2008
Location: Kent
Age: 65
Posts: 216
Likes: 0
Received 0 Likes on 0 Posts
Non-pilot here, asking a layman's question.

This was a flight being carried out following maintenance work, where the expectation had to be that there might be covered sensors and other glitches. Wasn't that the point of the flight - to test all the functions of the a/c that might be affected by such oversights?

The fact that there was a problem with the AoA sensors was presumably exactly the kind of thing they were trying to flush out?

So my question is; had they been performing this test at the 'correct' altitude, would they have been able to recover the situation, in your opinion?

I'm getting confused as to whether this was a 'normal' test flight situation, from which the plane would have been expected to recover given enough height, or whether it's a basic problem with Airbus design.
overthewing is offline  
Old 1st Mar 2009, 11:52
  #930 (permalink)  
 
Join Date: May 1999
Location: Quite near 'An aerodrome somewhere in England'
Posts: 26,803
Received 270 Likes on 109 Posts
Reading that Airbus Test Manual, written in the customarily weird fractured franglais, I do not understand what (p48)

Disconnect this α floor function at once
is supposed to mean. "Disconnect"? How??

Also, the instruction to record the 3 AoA values and to ensure that 'The AoA must not differ by more than 0.5º when compared to the (pitch-fpa) data' is ambiguous. Does this refer to the mean AoA value, or any single AoA value?

It is not a precise flight test document, to my mind.
BEagle is offline  
Old 1st Mar 2009, 11:57
  #931 (permalink)  
 
Join Date: Mar 2007
Location: Right here
Age: 50
Posts: 420
Likes: 0
Received 0 Likes on 0 Posts
hardcore,

You've read the report; now go read the FCOM! You're wasting your time trying to understand what happened until you do.

For instance,

In normal law, when approaching the stall correct function is for the auto trim to stop when Vls is reached such that the pilot has to continue to hold the stick back to induce the protections.
is totally wrong. THS freezes while in normal law in some situations, but going below Vls is not one of them. That the pilot needs to hold the stick back to reach an AoA higher than alpha prot has nothing to do with what the THS is doing.
bjornhall is offline  
Old 1st Mar 2009, 12:06
  #932 (permalink)  
 
Join Date: Mar 2007
Location: Right here
Age: 50
Posts: 420
Likes: 0
Received 0 Likes on 0 Posts
However, why would Airbus programme the systems to abandon functions and leave the stabiliser control surfaces in such an extreme setting.
Don't have an opinion on that, but one needs to consider the failure modes that "fixing" such a problem could induce. For the aircraft to end up in such a significant out of trim situation to begin with, something must have gone badly wrong that the computers have not picked up on. We wouldn't want a sick computer, when it finally realizes it has lost situational awareness, start guessing as to what might wrong and take actions based on those guesses.
bjornhall is offline  
Old 1st Mar 2009, 12:52
  #933 (permalink)  
 
Join Date: Dec 2000
Location: Canada
Posts: 141
Likes: 0
Received 0 Likes on 0 Posts
Another consideration in the mix is the ability of the crew to view FMA annunciations on the PFD at high/low pitch angles.

A contributing factor cited in the 1994 A330 test flight accident was that the PFD "declutters" the a portion of the FMA annunciations at high pitch angles to increase the viewable attitude sphere. In the A330 accident this led to the crew not determining that the aircraft was in ALT*.

I am still prowling through the FCOM to find the references to this and whether this was corrected as a result of the 1994 accident, but haven't found it yet.

If the FMA was "decluttered" then important information about pitch trim etc. may not have been available.
Canuckbirdstrike is offline  
Old 1st Mar 2009, 13:03
  #934 (permalink)  
 
Join Date: Oct 2003
Location: UK
Posts: 116
Likes: 0
Received 0 Likes on 0 Posts
Reading that Airbus Test Manual, written in the customarily weird fractured franglais, I do not understand what (p48)

Quote:
Disconnect this α floor function at once

is supposed to mean. "Disconnect"? How??
By pressing one/both instinctive disconnect p/bs on the thrust levers
Endeavour is offline  
Old 1st Mar 2009, 13:23
  #935 (permalink)  

Sun worshipper
 
Join Date: Dec 2001
Location: Paris
Posts: 494
Likes: 0
Received 0 Likes on 0 Posts
BEagle

Reading that Airbus Test Manual, written in the customarily weird fractured franglais, I do not understand what (p48)

Quote:
Disconnect this α floor function at once
is supposed to mean. "Disconnect"? How??
The α Floor function can be disengaged by disconnecting the auto-thrust system, and so is the associated TOGA-lock function.
The idea of that test would be to check that the αFloor function works as required, and after its disengagement, check the α Prot function at Vmin, requiring a descent at that speed.

Also, the instruction to record the 3 AoA values and to ensure that 'The AoA must not differ by more than 0.5º when compared to the (pitch-fpa) data' is ambiguous. Does this refer to the mean AoA value, or any single AoA value?
That comparison can only be done in stable conditions, i.e "green dot" or Vls, depending on the aircraft configuration. The test engineer will have on one of the MCDUs the AIDS page containing all three AoA values. That part hasn't been done in the"Full" configuration, as they were, according to the report in HDG/VS mode.
Lemurian is offline  
Old 1st Mar 2009, 13:42
  #936 (permalink)  
 
Join Date: Feb 2008
Location: Valencia
Age: 49
Posts: 37
Likes: 0
Received 0 Likes on 0 Posts
The accident was pure and simple but tragically...human error
I think that you mean, human error triying to understand what a very complicated machine that resembled a plane was doing.

I will try to explain some things from my own experience:

1.- The aircraft protections, FWB philosophy working well or not, denied the crew vital inputs to know how the airframe was performing.

2.- The lack of feedback and the 2,5 G limitation denied the crew the hability to recover the plane, they were condemned from the begining of the dive. In that situation you can tell me that the structure is going to crush at 2,5G, you can tell me that this is the maximum performance of the plane for a pull out. But if I´m going in, and I need to pull more Gs to save the plane, I will always prefer to have the option to use more Gs, even if that means destroying the plane.
By "desing" the A320 probably is going to crush at "2,55G", but I think that if you are going to die anyway is better risking a pull out at 2,6G or 2,7G than a 2,5G. Al least you have a chance.

3.- Testing a B727, the STALL warning failed. It indeed Stalled, but because we knew how a stall feeled we recovered the plane without problem.

4.- From my point of viww, a plane that changes 3 times in 40 seconds it´s flight laws in a critical condition like low speed or stall is a very complicated machine. Human error is inherent to complexity. Someone had to mind about that while desining this bird.
Strongresolve is offline  
Old 1st Mar 2009, 13:57
  #937 (permalink)  
 
Join Date: Jan 2005
Location: W of 30W
Posts: 1,916
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by pax2908
The conclusion that two of the AoA sensors failed, comes from the fact that the values "do not make sense" at some point in time; and also from the fact that the values are not changing. Of course I don't know, but I presume neither of these clues is taken into account by the system to (in)validate the data? The two wrong AoA values do seem to agree with each other, though. Would the third (supposedly good) data be discarded in such a situation, without any sort of warning?
Very good question !

There is a possibility here that earlier into the flight, due the AOA discrepancy, one of the ADR was rejected by the ELAC, and so without caution.

Even without automatic ADR rejection, there was numerous opportunities for the system to advise the crew that all AOA readings didn’t agree.
No need to say that a simple hypothetic AOA DISCREPANCY ECAM MSG at this time would have put an early end to the flight test.


Crucial data are missing from the BEA interim report :
  • Where is the graph for the third AOA ?
  • Where is the graph for the vertical acceleration ?
  • Where are the graphs for the FO side stick position ?
  • Just too little from the CVR ...

PJ2, I believe SFLY is correct :

25 seconds before the end, the pitch was back in alternate law, but the stabilizer position did not move (?)
There is a possibility that the stabilizer was jammed (?)
There is a possibility that the pilot tried earlier to move it … with no more success than the automatic system (?)
CONF iture is offline  
Old 1st Mar 2009, 14:02
  #938 (permalink)  
 
Join Date: Jan 2008
Location: above it all
Posts: 367
Received 0 Likes on 0 Posts
Some elementary accident statistics here:

There have been some 4700 fly-by-wire Airbus aircraft built & operating.

Out of those, there have been 30 crashes which have resulted in a hull loss. That´s 0.6 per cent, which is not a bad percentage at all for FBW.

Probably not an entirely fair comparison, but out of some 5900 B737 aircraft (all models) bulit there have been 131 hull losses (2.2 per cent).

To claim that FBW is somehow "unsafe" and "at fault" due to this accident, which happened during a test flight which was not conducted exactly according to instructions is, in my opinion, streching it rather too far.
Finn47 is offline  
Old 1st Mar 2009, 14:04
  #939 (permalink)  
 
Join Date: May 2000
Location: Glorious West Sussex
Age: 76
Posts: 1,020
Likes: 0
Received 0 Likes on 0 Posts
From LandIT
However, why would Airbus programme the systems to abandon functions and leave the stabiliser control surfaces in such an extreme setting.
The THS setting is not "programmed" to be left at an extreme setting - the autotrim was doing it's job perfectly and the THS setting was the natural result of the low speed, the a/c was in trim.

bjornhall
You've read the report; now go read the FCOM! You're wasting your time trying to understand what happened until you do.
Spoken like a PPL holder! Your comment
THS freezes while in normal law in some situations, but going below Vls is not one of them.
while arguably perfectly accurate denies the fact that the THS autotrim stops when AOA-protection is active, which will also be below VLS.

For those interested the THS setting in this situation cannot be increased (nose-up) by autotrim or trim wheel movement.
TyroPicard is offline  
Old 1st Mar 2009, 14:41
  #940 (permalink)  
 
Join Date: May 2000
Location: Glorious West Sussex
Age: 76
Posts: 1,020
Likes: 0
Received 0 Likes on 0 Posts
CONF
25 seconds before the end, the pitch was back in alternate law, but the stabilizer position did not move (?)
Most of that 25 seconds were spent in Abnormal Attitude law, with no Autotrim.

But the trim wheel should still work,so here's some THS questions for engineers/designers with specific knowledge of A320.
1. How often is the full range of movement checked? (Not required to be done by line crew).
2. What checks are done on the THS in a C check?

Incidentally my FCOM 1 says the nose-up limit of the THS is 13.5° whereas the report says it remained at 11.2° - we (or at least I) have all been banging on about full nose-up trim when it wasn't - quite.
TyroPicard is offline  


Contact Us - Archive - Advertising - Cookie Policy - Privacy Statement - Terms of Service

Copyright © 2024 MH Sub I, LLC dba Internet Brands. All rights reserved. Use of this site indicates your consent to the Terms of Use.