XL Flight 888T

[extricate]

Hi there,

I have a few questions w.r.t the crash. Just want to gain more knowledge so go easy please.

I know that the flight test was supposed to be done at a higher altitude. Levelling at 3000ft just wouldn't be sufficient to regain altitude in case something happened and in this case, something really did happen. But i'm curious about the flight systems in particular.

I know the AOA sensors were iced up, and the report stated that the horizontal stabilizer remained at an angle of -11degrees (Nose up) for the remaining flight? Why coudn't the PF control the aircraft? Due to flight law degredation? Can someone explain the mechanics here?

Another aspect, regarding speeds. So let's say I want to conduct a low speed test. I let the speed degrades to vPROT and when aPROT engages, i disconnect it purposely because I want to let the speed reduces to vMAX? Am I correct? This is part of the stall test too right? If the speed is reduced to vMAX, the aircraft will fly at vMAX but why in this case, the speed continued to degrade? Due to loss of flight laws?

Lastly, could the aircraft be saved even though if this flight was conducted at 3000ft? What would you do differently?

As stated, i'm still learning. Not a pilot. Please stay within topic and share your knowledge

Appreciate it. Many thanks!

[TheChitterneFlyer]

Most importantly... the Flight Test Schedule was not flown in accordance with the documentation. A qualified "Test Crew" would have abandoned the final test point as it wasn't iaw the test schedule... you NEVER delay part of a test schedule to conduct it later. That's why the incident happened!!

Test report link here

http://www.bea.aero/docspa/2008/d-la...a081127.en.pdf

[WeekendFlyer]

I know the AOA sensors were iced up, and the report stated that the horizontal stabilizer remained at an angle of -11degrees (Nose up) for the remaining flight? Why coudn't the PF control the aircraft? Due to flight law degredation? Can someone explain the mechanics here?

Lift equation: lift = 0.5 * air density * TAS^2 * wing area * CL

To maintain a lift force from an aerofoil you need to increase CL as speed decreases.Therefore the main wing AOA has to increase as speed decreases, which in level flight causes the aircraft pitch attitude to increase as speed reduces.

As the speed of an aircraft reduces in level flight the horizontal stabiliser needs to generate downforce to keep the aircraft level, even though the airspeed is reducing. Therefore the CL of the horizontal stabiliser needs to increase as speed decreases, and on a conventional aircraft this is done by the elevator moving up. In the case of an aircraft with and all moving stabiliser (e.g. A320), the angle of incidence of the stabiliser with respect to the airframe will change in order to deliver the necessary downforce.

On a light aircraft the force required to hold the elevator or all moving tailplane is a deflected position is felt through conventional reversible flight controls. In the case of an aircraft with powered flight controls, if the aircraft stick or yoke is connected to an artificial feel system then the articifical feel system will provide the necessary feedback force. This force can be removed, if desired, by using the trim system; on most airliners this is done by changing the angle of incidence of the horizontal stabiliser, thus allowing the elevator to be in the neutral position.

With the A320 it is a bit different. The sidesticks provide spring feel in proportion to displacement from the centre position but they do not give any "feel" in the conventional sense and the force will not necessarily correlate to the trim position of the stabiliser. More importantly, in normal law the FCS automatically adjusts (trims) the angle of incidence of the horizontal stabiliser on a continuous basis, so that when the sidestick is in the neutral position there is no pitch rate. The pilot thus does not have to apply any stick input to maintain the selected pitch attitude because the trim system has adjusted accordingly.

In the XL888T accident the FCS normal law worked as designed, adjusting the stabiliser so that, if the pilot were to release the sidestick, the desired attitude would be maintained. Thus as speed decreased the stabiliser moved to its maximum trim setting of -11 degrees (i.e. 11 degrees down at the stabiliser leading edge), creating the necessary downforce to keep the nose up at low speed.

Had the aircraft remained in normal law, as the pilot increased speed and demanded the nose to pitch down, the horizontal stabiliser would have adjusted automatically by trimming up, thus reducing the CL of the horizontal stabiliser as speed increased. However, unfortunately for the crew the AOA sensor failure caused the FCS to degrade from normal law to alternate, thus stopping the auto-trim function. When the crew recovered from the first stall by lowering the nose and speeding up, the aircraft soon reached a speed where the stabiliser being at -11 degrees caused far too much downforce on the stabiliser, meaning that even with full down elevator commanded using the sidestick the elevator could not reduce the downforce sufficiently to stop the nose pitching up. Therefore the aircraft reached an unusually nose-high attitude, lost speed rapidly, and entered a manoeuvre often referred to as a hammerhead stall, when the nose drops rapidly.

It is not clear whether the crew failed to notice the "USE MAN PITCH TRIM" message on the ECAM screen (Electronic centralised aircraft monitor - Wikipedia, the free encyclopedia), or failed to act on it, but in simple terms had they reduced the nose-up trim as the aircraft increased speed following the first stall, they would almost certainly have survived. Adjusting the trim would have allowed the pilot to counter the pitch up motion that occured as the speed increased during stall recovery.

This is an interesting case because it is another example of the Airbus low speed protection and FCS law mode changes occuring as designed, but the crew awareness and response being insufficient or counterproductive. AF477 was another example of this. To my mind it does beg the question as to whether the Airbus design strategy has some implicit human factors weaknesses when it comes to pitch control in low speed flight in conjunction with subtle failure modes leading to FCS law degradation. Removing conventional feel from the primary flight controls was a design decision that Airbus and the certifying authorities were and still are content with; also there are other manufacturers, particularly in military aviation, who have designed and implemented primary flying control inceptors without conventional feel systems.

However, from the accident reports it does appear that removing the influence of conventional feel from flying controls is not necessarily a helpful thing in some circumstances, because on a conventional aircraft an out of trim condition can be felt through the force one is having to apply to flight the controls, particularly in the pitch axis. Put simply, if the sidesticks had been capable of providing a level of force feedback that prompted the pilot to realise he had a large amount of nose-up trim selected, one does have to ask whether he might have adjusted the trim instinctively. But having said that, the crew should not have been doing what they did, and it is highly unfortunate that the AOA probes failed in the way they did, leading to loss of stall protection.

[Clandestino]

Originally Posted by extricate

I know the AOA sensors were iced up

You shouldn't be knowing this as they were not simply iced up. Bearings on 2 out of 3 AoA probes froze due to water ingress, consequently to pressure washing the a/c without protective covers fitted.

Why coudn't the PF control the aircraft? Due to flight law degredation? Can someone explain the mechanics here?

Flight control laws passed into direct and then abnormal alternate, both without autotrim. THS overpowered elevators per design. MAnual trim was not used.

I let the speed degrades to vPROT and when aPROT engages, i disconnect it purposely because I want to let the speed reduces to vMAX? Am I correct?

No. Idea was to test AlphaProt, disconnecting it would be pointless. Pulling the stick to stop will give you alpha max, it won't disconnect protection.

This is part of the stall test too right?

Wrong. It is not and no full stall was planned - for that FCS laws have to be deliberately degraded and this is not line pilots' stuff.

If the speed is reduced to vMAX, the aircraft will fly at vMAX

1. ValphaMax 2. stick has to be held against the back stop 3. in normal law only.

why in this case, the speed continued to degrade? Due to loss of flight laws?

No. Protections are based on measured alpha, which bore no resemblance to actual one so prots weren't triggered. FCS law degradation occurred after the first stall.

Lastly, could the aircraft be saved even though if this flight was conducted at 3000ft?

If aeroplane had been washed properly, the crew would get away with improvised flight test.

What would you do differently?

I'd stop wondering about people so blissfully unaware of environmental and organizational factors affecting the pilot's decisions and actions that they come up here with simple question of "What would you do differently?".

go easy please

This is what it looks like when I'm going easy.

Originally Posted by WeekendFlyer

unfortunately for the crew the AOA sensor failure caused the FCS to degrade from normal law to alternate

No. There was no unequivocal failure of any AoA probe right down to impact. Probes 1 and 2 send values that were false but stable and within normal range. Law degradation occurred as the aeroplane was tumbling following full aerodynamic stall.

This is an interesting case because it is another example of the Airbus low speed protection and FCS law mode changes occuring as designed, but the crew awareness and response being insufficient or counterproductive.

I find attempt to test stall protection at 3000 ft without knowing the speed at which it should go off more interesting.

To my mind it does beg the question as to whether the Airbus design strategy has some implicit human factors weaknesses when it comes to pitch control in low speed flight in conjunction with subtle failure modes leading to FCS law degradation.

To my mind this is just another half-informed, fully-opinionated, loaded question. Of course, I might be mistaken and there was never, ever case of loss of control at low speed with "conventional" controls.

Removing conventional feel from the primary flight controls was a design decision that Airbus and the certifying authorities were and still are content with

There is no plausible reason to change their minds. Besides, artificial feel is pretty complex beast with not much in common with conventional feel.

However, from the accident reports it does appear that removing the influence of conventional feel from flying controls is not necessarily a helpful thing in some circumstances, because on a conventional aircraft an out of trim condition can be felt through the force one is having to apply to flight the controls, particularly in the pitch axis.

If we don't read the accident reports where AFCS trimmed "conventional" aeroplane excessively and clueless crew failed to trim when she was suddenly handed back to them or where panicked pilots kept pulling and trimming into stall, well then, you are right.

it is highly unfortunate that the AOA probes failed in the way they did, leading to loss of stall protection.

Yeah, I'm superstitious too: I believe that not following procedures brings bad luck.

[extricate]

That made so much sense now. Thanks WeekendFlyer!

[DozyWannabe]

Clandestino is as pugnacious as ever, but the points he makes are correct. There are no western airliners flying today with conventional feel - with the exception of the B737 and DC-9 derivatives in the event of manual reversion (and both of those have been described as a handful to fly in that instance). As soon as you involve hydraulics, the feel is *artificial* - driven by electro-mechanical devices, or - in the case of the B777 and B787 - by software connected to servos. Both setups rely on the output from the same sensors that drive the instruments.

As such, there's no guarantee that such artificial feel systems will behave transparently if an aircraft is taken outside the normal operating envelope, and consequently the argument over active and passive control feedback is a moot point in the case of this accident.

Ultimately, if one or more of the sensors driving an aircraft's systems is fouled, the result is always a serious impediment to crew understanding and rarely ends well. This is as true of incidents involving types with "conventional" control layouts (e.g. Aeroperu 603 and Birgenair 301) as it is with FBW Airbus types (e.g. this incident and AF447).

[rudderrudderrat]

Hi DW,

As such, there's no guarantee that such artificial feel systems will behave transparently if an aircraft is taken outside the normal operating envelope,

It's not so much the magnitude of the force feed back which matters - it's the displacement away from neutral on the controls which gives you the clues as to how far away from your trimmed position you are.
B777 and B787 have a large red switch to turn the FBW computers off and enable the pilot to simply fly like like a 707, 737, 757 etc. Airbus don't fit a similar switch.

[DozyWannabe]

Originally Posted by rudderrudderrat

It's not so much the magnitude of the force feed back which matters - it's the displacement away from neutral on the controls which gives you the clues as to how far away from your trimmed position you are.

Understood, but if that displacement is calculated then you could be misled if the input to those calculations (whether electro-mechanical or digital) is outside of the specified range.

B777 and B787 have a large red switch to turn the FBW computers off and enable the pilot to simply fly like like a 707, 737, 757 etc. Airbus don't fit a similar switch.

No, as you know they have Direct Law, in which the computers simply translate the control inputs to flight surface deflections. While this arrangement doesn't have tactile feedback, it does take the computations out of the equation.

[WeekendFlyer]

Quote: Lastly, could the aircraft be saved even though if this flight was conducted at 3000ft?

If aeroplane had been washed properly, the crew would get away with improvised flight test.

True, but having a dual AOA sensor common failure mode because of water ingress is arguably a system safety weakness; one of the recomendations in the BEA report was aimed at addressing this. I very much doubt an aircraft safety case would be signed off if the known likely outcome of "improper washing" was total loss of aircraft and crew. This suggests that the failure mode had not been identified previously, perhaps because nobody thought it could happen. This just goes to show that hindsight is a wonderful thing and that safety cases are not always perfect, even with the best efforts of the people concerned.

artificial feel is pretty complex beast with not much in common with conventional feel

In terms of what the pilot feels through the controls, for an artificial feel system the relationship between control force, speed, height and control deflection can actually be very similar to what a conventional aerodynamic feel would give, but with reduced control forces. It depends on the exact type of feel system used but a Q-feel system, for example, can replicate the force vs speed vs altitude relationships extremely well and relies only on connections to the pitot and static systems to do its calculations. If the trim actuators also bias the neutral position of the control column, then out of trim forces are also accurately reproduced for the pilot. It has been demonstrated that the presence of such force feedback is very important in accurate control of the aircraft, particularly when manoeuvring. The Avro Canada CF-105 Arrow development program is a case in point (Avro Canada CF-105 Arrow - Wikipedia, the free encyclopedia).

There was no unequivocal failure of any AoA probe right down to impact. Probes 1 and 2 send values that were false but stable and within normal range. Law degradation occurred as the aeroplane was tumbling following full aerodynamic stall.

I have to disagree with this. Both probes were sending data that was identical but false, which is by definition a common mode failure. The probe electronics were operating correctly but the mechanical elements were not free to move as designed due to icing, thus the AOA probes failed to do their job, albeit in a rare and unforseen set of circumstances.

The FCS detection of AOA probe failure depends on one probe giving a different signal to the other, i.e. a non-common mode failure. In the event, the FCS did detect that the AOA and IAS did not correlate given the gross weight of the aircraft, with the ECAM displaying a message suggesting a mismatch of gross weight with the combination of AOA and IAS being measured at the time. However, it would not necessarily be obvious to the crew that the AOA probe icing was the cause of this mismatch unless they checked the actual AOA values on the relevant MCDU page.

Moreover, according to the BEA report the "USE MAN PITCH TRIM" message was removed from the ECAM as soon as the FCS entered abnormal attitude law, which means the crew probably had only a small amount of time to read it when there was a lot going on.

I studied human factors in engineering design as an element of my professional training and, put simply, it was deemed poor practice for a safe outcome to depend on a stressed and possibly confused human operator doing the right thing under pressure, particularly if the information needed to make correct decisions and take correct actions was not immdieately and clearly available. Clearly in this accident the crew expected things to work in a certain way (i.e. the FCS does not permit speed to fall below V alpha max in normal law), thus they were completely thrown by the unexpected stall, FCS reversion and subsequent loss of autotrim.

When operators of equipment have a different mental map of what a system should be doing, compared to what it is actually doing, that is when accidents can happen. Surely XL888T is a case of this? If so, then perhaps engineers should be asking if the system design can be improved to reduce the chance of operator confusion? BOAC posted a thread on exactly this issue (http://www.pprune.org/tech-log/526796-time-check.html) but unfortunately it only garnered 8 responses then petered out, which is sad, because it appears to be a growing problem and perhaps it is time it was addressed more thoroughly by regulators and industry.

[Lantirn]

As a new airbus driver I am wondering...

How the heck the stall warning sounded?

In the findings in the report:

"The triggering of the first stall warning in normal law, at an angle of attack
close to the theoretical angle of attack triggering the warning in landing
configuration, indicates that angle of attack sensor 3 was working at that
moment."

When you have 2 identical but false AOA values, the 3rd ADR is rejected by the voting principle even if correct, and now we have a stall warning from this probe?

My concern is that it sounded in normal law