Fly By Wire w/ bad IRS results in another Airbus upset

~~~^~~~

Well-known member
Joined
Dec 21, 2001
Posts
6,137
Total Time
7,500+
Somebody correct me if I'm reading this wrong, but it appears with a bad IRU telling the airplane it is in a stall, the fly by wire takes over and the crew has no control over the jet. In this case, the jet did a negative G push over injuring passengers. In August 2005 a 777 did a pitch up for similar reasons. The answer apparently is to get the IRU and any system that allows the bad IRU to communicate with the others (in this case the Air Data Inertial Reference Unit) OFF, ASAP.

Source: Australian Air Transport Safety Board
... .

The aircraft was flying at FL 370 or 37, 000 feet with Autopilot and Auto-thrust system engaged, when an Inertial Reference System fault occurred within the Number-1 Air Data Inertial Reference Unit (ADIRU 1), which resulted in the Autopilot automatically disconnecting. From this moment, the crew flew the aircraft manually to the end of the flight, except for a short duration of a few seconds, when the Autopilot was reengaged. However, it is important to note that in fly by wire aircraft such as the Airbus, even when being flown with the Autopilot off, in normal operation, the aircrafts flight control computers will still command control surfaces to protect the aircraft from unsafe conditions such as a stall.

The faulty Air Data Inertial Reference Unit continued to feed erroneous and spike values for various aircraft parameters to the aircrafts Flight Control Primary Computers which led to several consequences including:
  • false stall and overspeed warnings
  • loss of attitude information on the Captain's Primary Flight Display
  • several Electronic Centralised Aircraft Monitoring system warnings.
About 2 minutes after the initial fault, ADIRU 1 generated very high, random and incorrect values for the aircrafts angle of attack. These very high, random and incorrect values of the angle attack led to:
  • the flight control computers commanding a nose-down aircraft movement, which resulted in the aircraft pitching down to a maximum of about 8.5 degrees,
  • the triggering of a Flight Control Primary Computer pitch fault.
The crew's timely response led to the recovery of the aircraft trajectory within seconds. During the recovery the maximum altitude loss was 650 ft.
The Digital Flight Data Recorder data show that ADIRU 1 continued to generate random spikes and a second nose-down aircraft movement was encountered later on, but with less significant values in terms of aircraft's trajectory.
At this stage of the investigation, the analysis of available data indicates that the ADIRU 1 abnormal behaviour is likely as the origin of the event.
The aircraft contains very sophisticated and highly reliable systems. As far as we can understand, this appears to be a unique event and Airbus has advised that it is not aware of any similar event over the many years of operation of the Airbus.
Airbus has this evening, Australian time, issued an Operators Information Telex reflecting the above information. The telex also foreshadows the issue of Operational Engineering Bulletins and provides information relating to operational recommendations to operators of A330 and A340 aircraft fitted with the type of ADIRU fitted to the accident aircraft. Those recommended practices are aimed at minimising risk in the unlikely event of a similar occurrence. That includes guidance and checklists for crew response in the event of an Inertial Reference System failure.
Meanwhile, the ATSB's investigation is ongoing and will include:
  • Download of data from the aircraft's three ADIRUs and detailed examination and analysis of that data. Arrangements are currently being made for the units to be sent to the component manufacturer's facilities in the US as soon as possible and for ATSB investigators to attend and help with that testing, along with representatives from the US National Transportation Safety Board, The French Bureau dEnquêtes et dAnalyses (BEA) and Airbus.
  • In addition, investigators have been conducting a detailed review of the aircraft's maintenance history, including checking on compliance with relevant Airworthiness Directives, although initial indications are that the aircraft met the relevant airworthiness requirements.
  • Work is also ongoing to progress interviews, which will include with injured passengers to understand what occurred in the aircraft cabin. The ATSB plans to distribute a survey to all passengers.
-----

20 "Serious" injuries, cabin panels smashed, etc:
http://www.smh.com.au/articles/2008/10/08/1223145446448.html?feed=html
 
Last edited:

mynameisjim

Don't try this at home
Joined
Oct 27, 2004
Posts
842
Total Time
Paycut
I thought that the flight control computers would ignore one bad adirs signal, instead it would crosscheck and use the other two good adirs signals. I guess not
 

ultrarunner

Well-known member
Joined
Nov 26, 2001
Posts
4,324
Total Time
10000
Pretty much defeats the entire purpose of redundant ADIR's if one bad one is gonna try to kill you with two good ones still operating!
 

StopNTSing

Well-known member
Joined
Feb 16, 2003
Posts
715
Total Time
9500+
I'll stick with cables & pulleys, thanks.
 

Pervis

Well-known member
Joined
Oct 12, 2005
Posts
1,609
Total Time
12000+
A number of years ago I saw a video of an Airbus, I believe an A300, that departed a French airport and pitched up to +80 degrees uncommanded before recovering. It happened to at least 4 other jets as well, all recovering without serious damage or injuries. Did they not resolve the issue? Anyone have a link to the video? I prefer old school as well.
 

CA1900

Big Member
Joined
Mar 17, 2002
Posts
5,436
Total Time
11000+
A number of years ago I saw a video of an Airbus, I believe an A300, that departed a French airport and pitched up to +80 degrees uncommanded before recovering.
If it was an A300, it wasn't a computer issue. The 300 and 310 are conventionally controlled airplanes.
 

Hair-on-Fire

Well-known member
Joined
Feb 23, 2005
Posts
614
Total Time
10,000
I don't think even the protection modes will command a "negative G" pushover. Anyone know?
 

~~~^~~~

Well-known member
Joined
Dec 21, 2001
Posts
6,137
Total Time
7,500+
It isn't supposed to, but look at the holes in the ceiling panels and draw your own conclusions. I put a link to the video feed at the bottom.

If the airplane does not know what attitude it is in, it could command about anything.

Again, someone here probably knows more than I do, but I've seen failures where one bad data stream throws off the other data as the information is averaged in the software. In one aircraft's EICAS, bad ITT data from one of 17 sensors threw of the mean of the data, throwing the calibration of the entire data out of whack over time. It seems I recall an RJ that had a bad static input that ended up taking down the entire AHRS platform in a similar fashion.

Guess the moral of the story - don't screw with a faulting IRU/INS/AHRS - get out the QRH, expeditiously.
 
Last edited:

Ralph Cramden

Took the Red Pill
Joined
May 7, 2005
Posts
351
Total Time
2much
One bad ADIRU should be over ruled, but in this case apparently not.

You could turn off the FAC computers (2 out of the 7 the A320 has) to disable the alpha limit protections. Not an approved ECAM procedure, but in their case they had become test pilots anyway...
 

luckytohaveajob

Well-known member
Joined
Nov 17, 2005
Posts
1,114
Total Time
1+
Aug 2005, Malaysian Air B777 incident.

It is written about in an October 2008 issue of Aviation Week and Space Tech.

Basically, hardware is certified. Software is not.
 

Dizel8

Douglas metal
Joined
Feb 27, 2003
Posts
2,817
Total Time
Huh?
I'll stick with cables & pulleys, thanks.
How does that make a difference?

The next gen 737 gets information from the ADIRU's or whatever they call them on that thing. You thinking the autopilot couldn't command "bad" control movements?

Besides, cable and pulleys caused a few bad 73 crashes.
 

CA1900

Big Member
Joined
Mar 17, 2002
Posts
5,436
Total Time
11000+
The next gen 737 gets information from the ADIRU's or whatever they call them on that thing. You thinking the autopilot couldn't command "bad" control movements?
Sure it could, but it's not the same thing. When you see it malfunction and hit the AP disconnect on a Boeing, you're actually disconnecting the computer. That's not the case on a fly-by-wire airplane like the Airbus.
 

Dizel8

Douglas metal
Joined
Feb 27, 2003
Posts
2,817
Total Time
Huh?
Sure it could, but it's not the same thing. When you see it malfunction and hit the AP disconnect on a Boeing, you're actually disconnecting the computer. That's not the case on a fly-by-wire airplane like the Airbus.
Well, not sure how you read that into the report? How did they gain control of the a/c? Not having anymore data to go by, they may well have disconnected the autopilot and flown manually.

Yes, on the Boeing you disconnect the auto pilot computer, however, if you were in cruise, autopilot engaged and the autopilot decided to command an abrupt pitch down, as it did in this case, the result might well have been the same.

Certainly, having spent a fair amount of time with Fifi, there is nothing in the system that should command such an abrupt pitch over, certainly not the envelope protection, secondly, the max pitchover you can generate through the stick, shoving it full forward is minus 1G. Appears this was a bit more than that.

Fifi is, perhaps unfairly, considered a very "strange" bird because of the FBW, but she is just an airplane and one with a proven safety record.

(Donning flamesuit, standing by for torching by the cable and pulley crowd)
 
Last edited:

ultrarunner

Well-known member
Joined
Nov 26, 2001
Posts
4,324
Total Time
10000
Well, not sure how you read that into the report? How did they gain control of the a/c? Not having anymore data to go by, they may well have disconnected the autopilot and flown manually.
They did disconnect and fly manually. The report is a bit vague, but it can be read that two minutes after the first fault, and with the AP off, the flight control computers commanded another significant hard over. Yikes!
 

ImbracableCrunk

Unregistered Un-User
Joined
Feb 5, 2003
Posts
1,481
Total Time
6AM
I don't think even the protection modes will command a "negative G" pushover. Anyone know?
Maybe the computer doesn't "think" it's doing a negative-g pushover if it's that messed up to begin with.
 

Dizel8

Douglas metal
Joined
Feb 27, 2003
Posts
2,817
Total Time
Huh?
They did disconnect and fly manually. The report is a bit vague, but it can be read that two minutes after the first fault, and with the AP off, the flight control computers commanded another significant hard over. Yikes!
You are correct, my bad :(

However, I will stand by my comment wrt. Airbus safety and FBW.
 

Ralph Cramden

Took the Red Pill
Joined
May 7, 2005
Posts
351
Total Time
2much
Thanks for pointing out my editing shortcomings :)

7 total computers, 2 of which are FACs, short for Flight Augmentation Computers. Turning those two off will disable a lot of the protections but still allow you to fly in Alternate Law.

I just saw a bit on a crash of the X 31 in a flight test program. Seems someone forgot to connect the pitot heat, leading to airspeed readout loss at altitude. Not a good thing in a FBW experimental bird. Test pilot punched out, plane went in flat spin free fall. Ouch!
 
Top