Thursday, August 15, 2013

Did the Airbus flight control computers just kill two more pilots?

Airbus has a long history of "pilot error" (note that this is disputed by the Air France pilot's union) causing crashes, particularly on landings when airframes fly into hills.  And so why I heard about the fatal crash of a UPS A300-600F, I immediately thought angle of descent vs. rate of descent:
Following an uneventful flight from Lyons the crew prepared for a descent and approach to Strasbourg. At first the crew asked for an ILS approach to runway 26 followed by a visual circuit to land on runway 05. This was not possible because of departing traffic from runway 26. The Strasbourg controllers then gave flight 148 radar guidance to ANDLO at 11DME from the Strasbourg VORTAC. Altitude over ANDLO was 5000 feet. After ANDLO the VOR/DME approach profile calls for a 5.5% slope (3.3deg angle of descent) to the Strasbourg VORTAC. While trying to program the angle of descent, "-3.3", into the Flight Control Unit (FCU) the crew did not notice that it was in HDG/V/S (heading/vertical speed) mode. In vertical speed mode "-3.3" means a descent rate of 3300 feet/min. In TRK/FPA (track/flight path angle) mode this would have meant a (correct) -3.3deg descent angle. A -3.3deg descent angle corresponds with an 800 feet/min rate of descent. The Vosges mountains near Strasbourg were in clouds above 2000 feet, with tops of the layer reaching about 6400 feet when flight 148 started descending from ANDLO. At about 3nm from ANDLO the aircraft struck trees and impacted a 2710 feet high ridge at the 2620 feet level near Mt. Saint-Odile. Because the aircraft was not GPWS-equipped, the crew were not warned.
Why this is interesting is that fuel economy drives the use of many of the modes in the Airbus:
On a jet, the most fuel efficient way to descend is of course to stay in the optimal cruising altitude as long as possible, then cut the thrust and glide with a certain glide speed to the destination deceleratate for the approach, and, ideally you only advance throttles as far as the outermarker to spool up for go-around.

Simply put, the speed (i.e. steepness of your glide/dive ) calculation is based on economic fuel to flight time ratio (the cost index). So all you have to do is make a good decison about the top of descent point observing all the speed and altitude constraints ahead. Which is, obiously the tricky part.

For this regime the autopilot interface has a mode selector named Level Change (B) or Open Descent (A).

Should you find yourself short of the field, either you slow down (shallow your descent) - not good as you accumulate extra time on the flight, or add thrust - fuel penalty, the lower the worse.
While I don't know details, I wouldn't be at all surprised that this was the intersection of a complicated cockpit control design and corporate policies that made pilots think twice before taking corrective action.

Certainly Airbus has a history of their computerized control systems confusing pilots - a record not shared by Boeing.  Me, I much prefer flying in a Boeing rather than in a "Scairbus", but that's just me.

9 comments:

  1. In my college software engineering class back in the 90s, almost every class included some mention of Airbus planes dropping from the sky because of their software. I've been leery of them ever since.

    ReplyDelete
  2. Very informative. I've not flown anything other than my computer so I don't have the first hand experience with these systems that would cause me to pick one over the other. However this seems to be solid argument for boeings system.

    ReplyDelete
  3. Between their computers & the laminate tails which seem to delaminate every so often, we won't go near an Airbus plane for any reason.

    ReplyDelete
  4. 1. For those concerned about the Airbus safety record, note that this happened in 1992.

    2.The VOR/DME 05 plate for Strasbourg (see http://lessonslearned.faa.gov/ll_main.cfm?TabID=1&LLID=57&LLTypeID=2)shows check heights at 11.5 and 9.5 DME. Because they only started the descent at 11 miles, they should have been high at 9.5 miles but correcting. Did they check?

    3. Why did they attempt to set a 3.3 degree glide when the plate clearly says 5.5 degrees?

    4. A 5.5 degree glideslope is about 550 feet per mile. I don't know how fast they were going, but if we assume 180 knots for simplicity, that is about 1500 feet of descent per minute. Their actual descent rate of more than twice that would surely have been noticeable on the altimeter, let alone the VSI. Do we blame the glass cockpit for not providing these visual cues?

    5. Have a look at the FAA reference above for a discussino of the lack of co-operation between the two pilots involved. Or Google F-GGED or Air Inter Flight 148 for much more.

    ReplyDelete
  5. Glen;

    That AirBus that dissappeared over the Atlantic not long ago did so because the in-flight computer was telling the pilot incorrect information, causing him to do the wrong thing, subsequently killing everyone on board.

    I'd say airbus has some serious software issues when its software is killing people.

    Could the pilot have avoided this if he'd just ignored the computer and done what his intincts told him to? Yes. But then, what good is the computer at that point?

    ReplyDelete
  6. I may be remembering wrongly, but don't the Airbus computers also have a history of overriding basic manual flight control inputs because the computer was in the wrong mode? (I seem to remember at least one story where the pilot firewalled the throttles to abort a landing and initiate a go-around, but the computer wouldn't deliver full thrust because the mode it was in limited the throttle settings.)

    Either way, when you see a series of incidents caused by similar forms of "operator error", that's a good sign there's a serious design flaw in the system.

    My first thought is that there needs to be an "emergency" switch that either pilot can hit, which immediately causes the computer to interpret all flight control inputs literally, no matter what settings it had previously. That way, the pilot doesn't have to try and figure out if he's in the right mode for what he wants to do - he can just hit the button and fly the plane directly.

    ReplyDelete
  7. It's also worth noting that this particular plane apparently had a previous computer failure while in flight, and also that there appears to be some evidence of debris from trees in the engines.

    ReplyDelete
  8. Here's more. Apparently, the auto-pilot was engaged right up until the crash, and the pilots got a "low altitude" warning a mere 7 seconds before impact.

    ReplyDelete
  9. I made a conscious decision years ago to avoid flying Airbus-serviced legs. Last month I was never so glad to make it to the gate in Detroit to see the Jetway rolling back from an A319 and positively thrilled to wait 6+ hours to ride in a Canadair CRJ900 in Economy Comfort back to Dallas. Every time I think of Airbus, this is what sticks in my head. http://www.youtube.com/watch?v=-kHa3WNerjU

    ReplyDelete

Remember your manners when you post. Anonymous comments are not allowed because of the plague of spam comments.