>From RISKS Digest 21.48. We use independent checks after rigging to
avoid precisely this situation; It's sobering to see that even major
commercial airliners can be subjected to it from time to time.
- mark
Date: Mon, 18 Jun 2001 12:54:17 +0200
From: "Peter B. Ladkin" <[EMAIL PROTECTED]>
Subject: A320 Incident
Tim van Beveren reported in *Flight International*, 22-28 May 2001, on a 20
Mar 2001 incident to a Lufthansa Airbus A320 on takeoff from Frankfurt.
This incident was reported at greater length and detail in *Air Safety Week*,
4 Jun 2001, by David Evans and Tim van Beveren.
The captain was Pilot Flying (PF). there was some degree of turbulence
during takeoff, shortly after rotation, which resulted in the left wing
moving down. The captain applied correction (right lateral roll control) but
the wing dipped further left, reaching 21 degrees bank, and the wingtip is
reported to have come within half a meter of the ground, and according to
computer modelling of the digital flight data recorder the airplane "came
within a few seconds of striking the ground".
The First Officer, the pilot not flying (PNF), realising there could be a
control problem, switched "priority" to his sidestick controller and
recovered the aircraft. The aircraft was flown up to 12,000ft on autopilot,
the crew confirmed the problem, that the CAP's sidestick was controlling for
roll in the reverse sense (normally, putting the sidestick to the left
commands left roll; to the right commands right roll. Control-reversal here
means that CAP's sidestick gave right roll on a left movement and left roll
on a right movement).
The aircraft had just come out of maintenance. Maintenance is a known risk --
James Reason, an authority on human factors in aviation safety and Professor
of Psychology at the University of Manchester, amongst others, has detailed
how significant problems may arise through maintenance of complex systems.
It has happened many times that aircraft have come out of maintenance with
control systems reversed in one or more of the three axes (roll, pitch,
yaw). This has been the cause of a number of accidents with general aviation
aircraft, but my informal requests for information turned up no recent
accidents to commercial aircraft due to this cause. Evans and van Beveren
report that "reversed controls are deemed impossible on transport-category
aircraft" and that Boeing claims that the B737 aircraft cannot be
reverse-connected without it being discovered before flight, normally
through mandatory post-maintenance checks, but at the latest by the pilot's
preflight check, as the controls could not be moved.
ntenance checks, but at the latest by the pilot's
preflight check, as the controls could not be moved.
At Lufthansa's code-sharing partner, United Air Lines, certified inspectors
must be stationed both inside and outside the cockpit to conduct a
functional check after the flight control system has been worked on; a
flight test is also required before the aircraft is returned to service
after this kind of repair. It is believed that either of these measures
would have caught the control-reversal problem, and so general maintenance
procedures at Lufthansa Technik will be subject to detailed inquiry.
There have been a number of reports as to what fault caused the lateral
control reversal, including the two sources above. However, I have found
none of the explanations so far satisfactory, as they raise further puzzles
that they do not solve.
The following architectural description of the A320 primary flight control
system (PFCS) is drawn from Cary R. Spitzer, Digital Avionics Systems,
Second Edition, McGraw-Hill 1993. The A320 sidestick controller generates
input to five of the seven flight control computers which form part of the
primary flight control system (PFCS). These five are the two Elevator
Aileron Computers (ELACs) and the three Spoiler Elevator Computers (SECs).
Each wing has two outboard ailerons, and five inboard spoilers (overwing
surfaces which can be raised). Lateral (roll) control proceeds via four of
the five spoilers and the two ailerons. Each of the two ELACS and three SECs
control some combination of these 12 control surfaces. There is a
significant amount of control redundancy.
Initial reports said that Lufthansa Technik personnel had been repairing
one of the two ELACs, and had found a damaged pin on a connector. They
had replaced the connector and this had apparently caused the control
reversal. This explanation made no sense to me as it stood, because
(a) the connectors are standardised. Replacing one with another should
give exactly the same connections as were there before;
(b) if one ELAC was receiving reversed signals, and the other was not,
and the three SECs were not, then
(i) the PFCS architecture would detect a discrepancy on the channels, and
(ii) on each side, one aileron would operate counter to the other, but
all spoilers would operate correctly-sensed, and it is hard to see
how this could lead to the extreme control discrepancy reportedly
experienced by the PF.
The Aviation Safety Week report on June 4 suggested that "Repair work
involving complete rewiring "upstream" of the connector pins was conducted
over several work shifts". The ELAC connector with the damaged pin has 140
pins and is one of four such for the ELAC, for a total of 560 pins.
It seems to me that to get control reversal without the phenomena in (b)
above, there must have been a reversed signal downstream of the sidestick
but upstream of where the sidestick movement is multiplexed into the five
input signals to the five PFCS computers which receive them. I do not yet
have, nor have I heard, a coherent suggestion as to how that could occur.
There has been considerable discussion of and speculation concerning:
maintenance procedures at Lufthansa Technik, which has one of the very
highest reputations for maintenance quality; wiring, wiring conventions and
connectors in the A320 series; why the pilots did not discover the
discrepancy during the usual preflight control checks (the A320 displays
control surface displacement on the cockpit display, the ECAM, when the
sidestick is intentionally moved and the airplane is on the ground, as
during a preflight control system check). I think it is fair to say that few
hard facts have emerged yet concerning any of these, and I find it hard to
make any useful inferences about what actually went on from the publicly
available information.
What emerges most clearly so far from this incident is that the simple
physical complexity of the control system has confused some. Amongst other
things, explanations have been proposed by presumably technically competent
people that do not fit the control system architecture. It is hard to see
how that phenomenon could have occurred with the simpler architectures of
mechanical control systems. On the other hand, the PNF was able to take over
normal control of the aircraft with one button push (the "control priority"
takeover on the sidestick), which could also not happen with the simpler
mechanical architectures.
We have very little information so far on the incident. It is certain that
the puzzles will be solved further along the investigative line, and very
likely that the results of the investigation will be highly significant for
the care and feeding of fly-by-wire architectures.
Peter Ladkin, University of Bielefeld, http://www.rvs.uni-bielefeld.de
--
* You are subscribed to the aus-soaring mailing list.
* To Unsubscribe: send email to [EMAIL PROTECTED]
* with "unsubscribe aus-soaring" in the body of the message
* or with "help" in the body of the message for more information.
