An Automation Anomaly Software Did Not Block Erroneous Acceleration Data
Total Page:16
File Type:pdf, Size:1020Kb
ONRecorD An Automation Anomaly Software did not block erroneous acceleration data. BY MARK LACAGNINA The following information provides an aware- moving the thrust levers to the idle position,” ness of problems in the hope that they can be the report said. Nevertheless, the aircraft pitched avoided in the future. The information is based nose-up again and climbed 2,000 ft. on final reports on aircraft accidents and inci- “The flight crew notified air traffic control dents by official investigative authorities. (ATC) that they could not maintain altitude and requested a descent and radar assistance for a JETS return to Perth,” the report said. “The crew were able to verify the actual aircraft groundspeed Crew Had No Guidance for Response and altitude with ATC.” Boeing 777-200. No damage. No injuries. PFD indications appeared normal during he aircraft was climbing through Flight Level the descent. The PIC engaged the left autopilot (FL) 380, about 38,000 ft, after departing from but then disengaged it when the aircraft pitched TPerth, Western Australia, for a scheduled flight nose-down and banked right. “A similar result to Kuala Lumpur, Malaysia, the evening of Aug. occurred when the right autopilot was selected, 1, 2005, when the flight crew observed a “LOW so the PIC left the autopilot disengaged and AIRSPEED” advisory on the engine indicating manually flew the aircraft,” the report said. and crew alerting system (EICAS). At the same The PIC was unable to disengage the auto- time, the primary flight display (PFD) showed a throttle system with the disconnect switches on full-right slip/skid indication, said the Australian the thrust levers or the disconnect switch on Transport Safety Bureau (ATSB) report. the mode control panel (MCP). “The reason it The PFD initially indicated that airspeed remained active was because the flight crew did was nearing stall speed; it then indicated that not deselect the autothrottle arm switches [on airspeed was nearing the overspeed limit. “The the MCP] from the ‘ARMED’ position to the aircraft pitched up and climbed to approximate- ‘OFF’ position,” the report said. ly FL 410, and the indicated airspeed decreased The aircraft was 3,000 ft above ground level from 270 kt to 158 kt,” the report said. “The stall when the PFD again indicated an erroneous warning and stick shaker devices also activated.” low-airspeed condition and the autothrottle sys- The pilot-in-command (PIC) disengaged the tem responded with a thrust increase. The PIC autopilot and lowered the nose. “The aircraft apparently countered this again by moving the autothrottle then commanded an increase in thrust levers to the idle position. The flight crew thrust, which the PIC countered by manually landed the aircraft without further incident. WWW.FLIGHTSAFETY.ORG | AEROSAFETYWORLD | MAY 2007 | 57 ONRecorD Investigators found that the flight data he lowered the nose a little bit, and the aircraft recorder (FDR) had recorded unusual vertical, touched down firmly,” said the U.S. National lateral and longitudinal accelerations when the Transportation Safety Board (NTSB) report. The upset occurred. “The acceleration values were captain told investigators that he believed the provided by the aircraft’s ADIRU [air data iner- flare was initiated too late and was incomplete. tial reference unit] to the aircraft’s primary flight The aircraft bounced on touchdown, and computer, autopilot and other aircraft systems the first officer lowered the nose to prevent a during manual and automatic flight,” the report tail strike. “The captain remembered that, as the said. nose of the aircraft was lowering prior to the The investigation determined that the condi- second touchdown, he may have pulled back on tions leading to the incident began in June 2001, his sidestick controller slightly to prevent the when one of several accelerometers failed and nose gear from striking the runway at too great “The crew were faced began providing erroneous high-acceleration a speed,” the report said. data to the ADIRU. The ADIRU software then The tail struck the runway during the second with an unexpected excluded data from the failed accelerometer in touchdown. None of the 197 occupants was acceleration computations. However, another injured. situation that had accelerometer failed just before the upset oc- FDR data indicated that both sidestick not been foreseen.” curred, and a software anomaly allowed the controllers were being activated simultaneously ADIRU to use erroneous data from the ac- when the tail strike occurred. “According to the celerometer that had failed four years earlier. manufacturer, when both sidestick controllers The result, said the report, was that erroneous are activated simultaneously … in the same acceleration data were provided by the ADIRU or opposite directions and neither pilot takes to the flight control systems. priority via the takeover push button, the system There was no checklist in the quick refer- adds the signals of both pilots algebraically,” ence handbook (QRH) addressing the unreliable the report said. “Airbus had issued flight crew airspeed indications that the flight crew had operating bulletins concerning bounced land- received before the upset occurred. “When the ings and tail strikes, but the pilots stated that no hardware [i.e., accelerometer] failure occurred, classroom or simulator training was received combined with the software anomaly, the crew to reinforce the meaning and contents of the were faced with an unexpected situation that bulletins.” had not been foreseen,” the report said. Among actions taken in response to the inci- ‘Heavy’ Controls Traced to Misrouted Cable dent investigation were an emergency airworthi- Boeing 737-700. Minor damage. No injuries. ness directive issued by the U.S. Federal Aviation fter completing a scheduled flight from Administration (FAA) requiring installation of Melbourne, Victoria, to Sydney, New new ADIRU software and a revision of the 777 ASouth Wales, Australia, the night of Aug. 9, QRH by Boeing to include an “Airspeed Unreli- 2005, the pilot reported “heavy” flight controls. able” checklist. “An inspection by maintenance engineers re- vealed that the left lower rear elevator cable was Sidestick Activations Lead to Tail Strike incorrectly routed around a stiffener and that Airbus A321. Substantial damage. No injuries. the stiffener and cable section had been dam- he first officer, the pilot flying, said that the aged as a result of contact between them,” said aircraft seemed to lose inertia as it crossed the ATSB report. Tthe runway threshold at 50 ft while land- About two weeks before the incident, a ing at Fort Lauderdale/Hollywood (Florida, contract maintenance organization had replaced U.S.) International Airport on Sept. 18, 2005. eight elevator control cable sections while per- “The first officer stated that before touchdown, forming a scheduled maintenance check of the 58 | FLIGHT SAFETY FOUNDATION | AEROSAFETYWORLD | MAY 2007 ONRecorD aircraft. The cable replacements were required a record been made of the event, then more by Boeing Service Bulletin 737-27-1254 rigorous inspections may have detected the Revision 1. misrouted cable.” The contract maintenance organization’s — Bart Crotty forward planning department was not assigned to provide full work details from the service Learjet Overruns Snow-Covered Runway bulletin, and work task cards from a previous Learjet 35A. Substantial damage. No injuries. job were copied and used instead. “The task he airplane was on a positioning flight from cards contained insufficient instructions for the Salt Lake City, Utah, U.S., to Kansas City, required work to be satisfactorily completed,” TMissouri, to pick up passengers for a charter the report said. flight the night of Jan. 28, 2005. Nearing the des- While preparing a rear cable for replace- tination, Kansas City International Airport, the ment, a trainee failed to secure it before remov- flight crew learned that the airport was closed ing the cable keeper. When the keeper was because an airliner had slid off a contaminated removed, the unsecured cable slipped out of taxiway and a one-hour hold could be expected sight. “While recovering the cable, the trainee before approach clearance. and an aircraft maintenance engineer inadver- The crew had specified Lincoln (Nebraska) tently misrouted the cable around the stiffener,” Airport, which has a 12,901- by 200-ft (3,932- the report said. “When the replacement cable by 61-m) runway, as the alternate airport on was pulled into place, it followed the same their flight plan; however, they requested and incorrect route around the stiffener.” The two received clearance to divert to the nearby workers did not inform their team leader or Charles B. Wheeler Downtown Airport, which make a record of the temporary loss of the old has a 7,000- by 150-ft (2,134- by 46-m) runway. cable; they also did not verify that the new cable Reported visibility at the airport was 1.25 mi was routed correctly. (2,000 m) in light snow and mist. The runway While performing duplicate inspections had just been plowed full length and 50 ft (15 of the cable replacements, two maintenance m) on both sides of the centerline, but 1/4 in (6 engineers heard a rubbing noise but thought mm) of snow remained on the plowed area. that it came from a cable pressure seal. They also The tower controller told the Learjet crew noticed a heaviness in elevator control move- that braking action had been reported as fair; ment. However, they failed to conduct thorough the controller did not say that the report had investigations of the two anomalies. been made by the pilot of a Cessna 210, a light The report indicated that time pressures single-engine airplane. “The Cessna 210 pilot might have contributed to the workers’ failure to did not use brakes during landing and did not inform their team leader of the temporary cable indicate this to [the tower controller] during his loss and their less stringent duplicate inspections braking-action report,” the NTSB report said.