Nationaal Lucht- en Ruimtevaartlaboratorium National Aerospace Laboratory NLR
provisional issueprovisional issue
NLR-TP-2003-392
FliFliFlightFlight data reconstruction and simulation of theght the 1992 Amsterdam Bijlmermeer airplane1992 airplane accidentaccidentaccident
M.H. Smaili DOCUMENT CONTROL SHEET
ORIGINATOR’S REF. SECURITY CLASS. NLR-TP-2003-392 Unclassified ORGINATOR National Aerospace Laboratory NLR, Amsterdam, The Netherlands TITLE Flight data reconstruction and simulation of the 1992 Amsterdam Bijlmermeer airplane accident
PRESENTED AT The AIAA Modelling and Simulation Technologies Conference, 17 August 2000, Denver (USA) and at the RTO-SCI-120 Symposium on Challenges in Dynamics, System Identification, Control and Handling Qualities for Land, Air and Space Vehicles, 15 May 2002, Berlin (Germany) AUTHOR DATE PP REF M.H. Smaili June 2003 40 13
DESCRIPTORS Flight control flight simulation Aircraft accident analysis 1992 amsterdam bijlmermeer airplane accident ABSTRACT On October 4, 1992, a Boeing 747-200F freighter airplane lost its right wing engines after departing from Amsterdam Schiphol Airport. Due to severe performance and controllability problems caused by this the aircraft crashed, 13 km east of the airport, in the Bijlmermeer, a suburb of Amsterdam. In recent years, several similar incidents have occurred in which aircraft were successfully recovered after encountering a separation of one or more of the engines. This report presents an overview of an independent analysis of the accident and applied modelling and simulation techniques. The investigation, including the development of the software for the accident analysis, was performed at the Division of Flight Control and Simulation of the Faculty of Aerospace Engineering of the Delft University of Technology in 1997. Utilising simulation and visualisation techniques, a reconstruction of the flight was performed using the parameters of the Digital Flight Data Recorder (DFDR). The reconstruction method, referred to as Flight Data Reconstruction and Simulation (FDRS), allowed an accurate estimation of the flying capabilities of the accident aircraft after the separation of the engines. Apart from providing the results of the accident analysis, the aim of the report is to demonstrate the application of modelling and simulation techniques as a practical tool for reconstruction and evaluation of vehicle dynamics and system characteristics under degraded (failure mode) conditions when appropriate operational data is available. For specific applications, the presented reconstruction and simulation techniques may be modified or developed further. The analysis, as presented in this report, indicated that from a technical point of view the accident aircraft was recoverable despite the severe performance and controllability problems caused by the separated engines. For future research on advanced avionics / flight systems design, the reconstructed model resulting from the analysis can be utilised as a benchmark to evaluate flight control concepts on their performance to accommodate in-flight failures.
Nationaal Lucht- en Ruimtevaartlaboratorium National Aerospace Laboratory NLR
NLR-TP-2003-392
Flight data reconstruction and simulation of the 1992 Amsterdam Bijlmermeer airplane accident
M.H. Smaili
This report is based on a presentation held at the AIAA Modelling and Simulation Technologies Conference, 17 August 2000, Denver (USA) and at the RTO-SCI-120 Symposium on Challenges in Dynamics, System Identification, Control and Handling Qualities for Land, Air and Space Vehicles, 15 May 2002, Berlin (Germany).
The contents of this report may be cited on condition that full credit is given to NLR and the authors.
Customer: National Aerospace Laboratory NLR Working Plan number: V.1.A.1 Owner: National Aerospace Laboratory NLR Division: Flight Distribution: Unlimited Classification title: Unclassified June 2003
Approved by author: Approved by project manager: Approved by project managing department:
-2-
NLR-TP-2003-392
This page is intentionally left blank.
-3-
NLR-TP-2003-392
Summary
On October 4, 1992, a Boeing 747-200F freighter airplane lost its right wing engines after departing from Amsterdam Schiphol Airport. Due to severe performance and controllability problems caused by this the aircraft crashed, 13 km east of the airport, in the Bijlmermeer, a suburb of Amsterdam. In recent years, several similar incidents have occurred in which aircraft were successfully recovered after encountering a separation of one or more of the engines. This report presents an overview of an independent analysis of the accident and applied modelling and simulation techniques. The investigation, including the development of the software for the accident analysis, was performed at the Division of Flight Control and Simulation of the Faculty of Aerospace Engineering of the Delft University of Technology in 1997. Utilising simulation and visualisation techniques, a reconstruction of the flight was performed using the parameters of the Digital Flight Data Recorder (DFDR). The reconstruction method, referred to as Flight Data Reconstruction and Simulation (FDRS), allowed an accurate estimation of the flying capabilities of the accident aircraft after the separation of the engines. Apart from providing the results of the accident analysis, the aim of the report is to demonstrate the application of modelling and simulation techniques as a practical tool for reconstruction and evaluation of vehicle dynamics and system characteristics under degraded (failure mode) conditions when appropriate operational data is available. For specific applications, the presented reconstruction and simulation techniques may be modified or developed further. The analysis, as presented in this report, indicated that from a technical point of view the accident aircraft was recoverable despite the severe performance and controllability problems caused by the separated engines. For future research on advanced avionics/ flight systems design, the reconstructed model resulting from the analysis can be utilised as a benchmark to evaluate flight control concepts on their performance to accommodate in-flight failures.
-4-
NLR-TP-2003-392
Nomenclature
CL lift coefficient CNe yawing moment coefficient due to thrust asymmetry
CN yawing moment coefficient due to sideslip
CY side force coefficient due to sideslip
CYdelta_r side force coefficient due to rudder deflection CD drag coefficient due to wing damage CL lift coefficient due to wing damage c.g. center of gravity Ycg lateral distance of c.g. from aircraft centerline lv rudder side force moment arm Tn engine thrust V true airspeed sideslip angle delta_r rudder deflection bank angle
Abbreviations
ATC Air Traffic Control CAD Computer Assisted Design DASMAT Delft University Aircraft Simulation and Analysis Tool DFDR Digital Flight Data Recorder DUT Delft University of Technology FDRS Flight Data Reconstruction and Simulation EGT Exhaust Gas Temperature EPR Engine Pressure Ratio GA Go Around IAS Indicated Airspeed ICAO International Civil Aviation Organisation MCT Maximum Continuous Thrust NLR National Aerospace Laboratory TOGA Take Off/Go Around UTC Universal Time Co-ordinated
-5-
NLR-TP-2003-392
Contents
1 Introduction 7
2 Overview of the analysis 8
3 Sequence of events 9
4 Analysis of the flight 11 4.1 Control capabilities 11 4.2 Performance capabilities 13
5 Flight data reconstruction and simulation 14 5.1 Flight control and performance 14 5.1.1 Controllability 14 5.1.2 Performance 16 5.2 Simulation environment 16 5.2.1 Model requirements 17 5.2.2 Operating shell for DFDR analysis 18 5.3 Reconstruction setup 19 5.4 Aircraft configuration 20
6 Reconstruction and simulation results 21 6.1 Aerodynamic effects 21 6.2 Flight data reconstruction 23 6.3 Rudder control system analysis 30 6.4 Summary of simulation and analysis results 32
7 Conclusions and recommendations 35 7.1 Conclusions 35 7.2 Recommendations 35
8 References 37
Appendix A 3D visualisation of the accident flight 38
(40 pages in total)
-6-
NLR-TP-2003-392
This page is intentionally left blank.
-7-
NLR-TP-2003-392
1 Introduction
On October 4, 1992, a Boeing 747-200F freighter went down near Amsterdam Schiphol Airport after an encounter of a multiple right wing engine separation. In an attempt to return to the airport for an emergency landing, the aircraft flew several right-hand circuits in order to lose altitude and to line up with the requested runway. During the second line-up, the crew apparently lost control of the aircraft. As a result, the aircraft crashed, 13 km east of the airport, into an eleven-floor apartment building in the Bijlmermeer, a suburb of Amsterdam. Following the accident, an investigation was initiated by several departments and authorities. The Netherlands Accident Investigation Bureau, charged with the investigation, was assisted by specialists from the Aeronautical Inspection Directorate of the Department of Civil Aviation1. According to the procedures contained in International Civil Aviation Organisation (ICAO) Annex 13, accredited representatives and their advisors from several countries joined the investigation. As far as the technical aspects of the flight were concerned, NLR, the National Aerospace Laboratory of the Netherlands, was tasked with several projects. The aircraft manufacturer performed an analysis of the Digital Flight Data Recorder (DFDR) of the flight and examined its results by means of piloted simulations2. The results of the investigation, however, were hampered by the fact that the actual extent of structural damage to the right wing was unknown. Although the controllability aspects could be reproduced within reasonable tolerances in the simulator, the performance aspects showed discrepancies. Especially the last minutes of the flight, and the subsequent loss of control, raised questions that were solved relying on the data of the DFDR. The origin of several anomalies in the flight control system, contributing adversely to the control of the aircraft, remained yet unknown. The analysis concluded that given the performance and controllability of the aircraft after the separation of the engines a successful landing was highly improbable1. In 1997, the Division of Flight Control and Simulation of the Faculty of Aerospace Engineering of the Delft University of Technology (DUT) in the Netherlands performed an independent analysis of the accident3. The analysis applied modeling, simulation and visualisation techniques for a reconstruction of the flight mechanics of the aircraft using the DFDR pilot control inputs. DFDR data for the analysis was obtained from NLR and the Netherlands Aviation Safety Board4. The purpose of the analysis was to acquire an accurate estimate of the actual flying capabilities of the aircraft and to study alternative flight control strategies for a successful recovery.
-8-
NLR-TP-2003-392
2 Overview of the analysis
The analysis of the accident flight was performed using a Flight Data Reconstruction and Simulation (FDRS) method that applies the DFDR pilot control inputs to a detailed simulation model of the aircraft and flight control system. A model validation method using inverse simulation was used to obtain a best match of DFDR measurements and simulation. In this approach, the simulation model virtually ‘flies’ the accident profile, according to the pilot’s control inputs, thereby reconstructing missing flight data and any fault events that led to the loss of the aircraft. The simulation environment, developed for the analysis, enabled to assess the flight mechanics and control effects by means of visualisation. Using the reconstructed model, failure mode and effect analysis was applied to the flight control system to investigate a degradation of the aircraft’s rudder capabilities that was observed on the DFDR. The reconstruction method proved to be a practical tool for estimating the aerodynamic and overall flight mechanics effects of engine separation. Visualisation facilitated comparison with the DFDR data. The actual flying capabilities of the impaired aircraft were next investigated by applying alternative control strategies to the reconstructed model. The reconstruction method applied during the analysis resulted in a simulation model of the impaired aircraft that matched reasonably well with the performance and controllability effects as recorded on the DFDR. The introduction of control loss could be visualised in detail using additional flight mechanical parameters. In this way the applied control inputs during the last flight stage could be analysed in addition to other flight mechanical aspects. Failure mode and effect analysis gave more insight into the performance of the flight control system before and after the separation of the engines. The actual flying capabilities of the aircraft to perform an approach and landing were examined using the reconstructed model and predefined control strategies. Results of the reconstruction were also used during a Dutch Parliamentary Inquiry on the accident in 1999 to substantiate additional data on the aircraft’s flight path5.
-9-
NLR-TP-2003-392
3 Sequence of events
The accident aircraft was scheduled for a flight to Ben Gurion International Airport, Tel Aviv, with an intermediate stop at Amsterdam Schiphol Airport after a flight from John F. Kennedy International Airport, New York. The aircraft received an air traffic control slot time of 17:20 (UTC) for departure. The aircraft was refueled with 72 metric tons of Jet A1 fuel and Fig. 1: The accident aircraft landing at Amsterdam was loaded with a total of 114.7 metric tons of Schiphol Airport on October 4, 1992 (Studio LCP) cargo. The takeoff gross weight was determined to be 338.3 metric tons.
At the time of departure, the preferential runways consisted of runway 01L (Zwanenburgbaan) for takeoff and 06 (Kaagbaan) for landing. The aircraft was cleared for push back at 17:04 and taxied out at 17:14. The first officer was assigned as the pilot flying (PF). The takeoff from runway 01L was started at 17:21, and the aircraft was cleared by ATC for the Pampus departure. At 17:27.30, while climbing through an altitude of about 6,500 feet, the aircraft encountered a separation of the engines no. 3 and 4. The captain took control of the aircraft. Following engine separation, the emergency call “mayday, mayday, mayday, we have an emergency”, was transmitted by the co-pilot. The aircraft started a right turn to return to the airport for an emergency landing. According to eyewitnesses, dumping of the onboard fuel started immediately. Amsterdam Radar confirmed the emergency call and directed the flight during the emergency procedure. After the crew acknowledged their intentions, they were instructed to turn to heading 260.
At 17:28.17, the crew reported a fire on engine no. 3 and they indicated a loss of thrust on both engines 3 and 4. At 17:28.57, the aircraft was informed that the main runway for landing was runway 06. The wind at that time was 040 at 21 knots. The crew of the flight, however, requested the use of runway 27 for landing. Because the aircraft was only 7 miles Fig. 2: The accident aircraft returning to the airport after from the airport at an altitude of 5,000 feet, a separation of the no. 3 and 4 engines straight-in approach would not be possible. ATC instructed the crew to a heading of 360 degrees to fly a circuit and to descend to 2,000 feet. By then the wind was 050 at 22 knots.
-10-
NLR-TP-2003-392
At 17:31.17, the crew indicated that they needed “12 miles final for landing”. During the transmission of this reply, the crew commenced the selection of flaps 1 for landing. While instructed to turn right to heading 100 the crew reported “no. 3 and 4 are out and we have problems with the flaps”. After the aircraft was established on heading 120, the crew maintained an indicated airspeed of 260 knots and a gradual descent. ATC cleared the flight for approach and Fig.3: Flight path of the accident aircraft instructed a heading of 270 to intercept the final approach course. Indicated airspeed remained at 260 knots at an altitude of 4,000 feet. After the heading instruction from ATC, it took about thirty seconds before the heading change was actually performed. When it became clear that the aircraft was going to overshoot the runway centerline, ATC instructed the flight to turn further to heading 290 to intercept the localizer from the south. Twenty seconds later a new heading of 310 was instructed by ATC, along with the clearance to descent to 1,500 feet.
At 17:35.03, the crew acknowledged the clearance by reporting “…1500… and we have a controlling problem…”. At this point, indicated airspeed decreased to 256 knots. The crew was losing flight control and approximately 25 seconds later the captain called, “going down 1862, going down…”. During this transmission, the crew was trying to recover the aircraft by raising the flaps and by lowering the gear. The stick shaker and ground proximity warning system were audible in the Fig. 4: Impact area of the accident aircraft background of the transmission. The remaining engines no. 1 and 2 were set at maximum thrust.
At 17:35.42, the aircraft impacted at a roll angle of approximately 104, a load factor of about 2.5 g’s and approximately 70 pitch down.
-11-
NLR-TP-2003-392
4 Analysis of the flight
4.1 Control capabilities Under nominal conditions in the case of a failure of both right wing engines without separation, aircraft should have the capability to turn in either direction with adequate control authority. The accident aircraft was designed to have enough rudder authority to keep the control wheel almost neutral with two engines inoperative on one side. This flight condition can be maintained up to the remaining engines set at maximum continuous thrust (MCT/EPR 1.35) while at maneuvering speed. For the case of the accident aircraft, the DFDR indicates that control wheel deflections between 20 to 60 degrees to the left were needed for lateral control and straight flight (figure 5). The largest deflection of approximately 60 degrees was required for straight and almost level flight. This condition could only be maintained at full rudder pedal and at high thrust (EPR#1 1.56 / EPR#2 1.45). According to the DFDR, maximum available rudder was needed during the straight legs to counteract the yawing moment. The traces of the rudder control surface activity as a response to the rudder pedal inputs can be seen in figure 6. In this figure, a limited control authority of the lower rudder is visible. From the DFDR it can be determined that lagging of the lower rudder started after the first turn, approximately 100 seconds after engine separation and at full left pedal (engine separation occurring at t=378 s). Pedal relaxation during turn initiations caused the lower rudder to follow the upper rudder again. At final loss of control and increasing roll angle, the DFDR shows a sudden increase of lower rudder deflection while the upper rudder stays behind at a smaller deflection.
EL AL Flight 1862 / DFDR data EL AL Flight 1862 / DFDR data 40 10
20 8
0 6
-20 4
-40 2
-60 0 Control Wheel Deflection (deg) Deflection Wheel Control Rudder Surface Deflection (deg) Deflection Surface Rudder
-80 -2 Lower rudder Upper rudder
-100 -4 0 100 200 300 400 500 600 700 800 900 0 100 200 300 400 500 600 700 800 900 Time (s) Time (s)
Fig. 5: DFDR control wheel deflections Fig. 6: DFDR rudder surface deflections
The DFDR indicates (figure 7) that the controllability and performance condition after engine separation required engine no. 1 and 2 thrust settings between approximately MCT (EPR 1.3) and overboost thrust (EPR 1.62). High thrust (EPR#1 1.56/ EPR#2 1.45) is needed to sustain almost straight and level flight. This condition is reached approximately 120 seconds after separation of the engines and after completion of the first turn towards a heading north.
-13-
NLR-TP-2003-392
In general, the DFDR indicates that both pedal EL AL Flight 1862 / DFDR data and control wheel were used for turn initiation and roll control. The first turn after the separation 1.6 1.5 of the engines no. 3 and 4 is performed at almost 1.4 zero pedal deflection. At final control loss, 1.3 control wheel deflection is maximum while 1.2 Engine Pressure Ratio Pressure Engine rudder pedal deflection is less than maximum. 1.1 1 Engine#1 EPR An analysis of the flight in a flight simulator2 Engine#2 EPR 0.9 0 100 200 300 400 500 600 700 800 900 indicated that in the above mentioned conditions Time (s) and with maximum rudder pedal input, Fig. 7: DFDR engine no. 1 and 2 thrust settings approximately 30 degrees left control wheel deflection was needed to maintain straight flight. This condition was simulated with trailing edge flaps up. According to the hydraulic system architecture, this condition locks the outboard ailerons when outboard flaps are not selected. For the case of the accident flight, the additional wing damage and degraded effectiveness of the right wing inboard aileron required larger left wing down control wheel deflections than in the nominal case. This effect can be determined from the DFDR and was confirmed by reconstruction of the flight.
The above analysis taken into account, it is clear that the crew of the aircraft was confronted with a flight condition that was different from a nominal two engine out situation. For the heavy aircraft configuration at a relative low speed of 260 knots IAS, the DFDR indicates that flight control was almost lost at full pedal, 60 to 70% of maximum lateral control and at high thrust.
4.2 Performance capabilities An energy analysis of the flight using the DFDR data6 indicated that after the separation of the engines the aircraft had level flight capability at go-around thrust (GA) and at an airspeed (IAS) of approximately 270 knots. Maneuvering capabilities were marginal and resulted into a loss of altitude. A normal load of approximately 1.1 g, equivalent to 25 degrees of bank, reduced the maximum climb capability to approximately minus 400 feet/min. At MCT thrust and at approximately 270 knots IAS, maximum climb performance was about minus 350 feet/min. Below 260 knots IAS, a normal load of 1.15 g and an angle of attack above approximately 8 degrees, resulted in a significant performance degradation. At 256 knots IAS, a normal load of 1.2 g and MCT thrust, maximum climb performance was reduced to minus 2000 feet/min. This effect, and the associated loss of altitude, was not predicted correctly by simulation models in foregoing analyses2, 6.
-14-
NLR-TP-2003-392
5 Flight data reconstruction and simulation
In contrast to the foregoing analysis of the accident flight relying on the data of the DFDR, an analysis was performed utilising flight data reconstruction and simulation techniques. In this approach, the DFDR parameters were reconstructed by applying the DFDR pilot control inputs to an extensive simulation model of the accident aircraft. In particular, the following issues were covered in detail by the analysis:
Reconstruction of the flight data to review the flight from initial climb to the final flight stage Flight path reconstruction Available control margins during the flight Applied control inputs Flight control and aerodynamic contributions to the loss of control Initial climb performance Rudder control system performance and effect on controllability Flight control capabilities Control loss recovery capabilities Maneuvering capabilities Approach and landing capabilities
5.1 Flight control and performance
5.1.1 Controllability The first notice on an engine failure will be a sudden yaw of the aircraft. If directional control is not applied, or with a fixed rudder deflection, thrust asymmetry will cause the aircraft to slip and to roll. The negative sideslip angle will create a positive rolling moment (right wing down). Instant control compensation in an engine out condition may consist of:
A rudder pedal input to counteract the yawing moment A control wheel deflection to counteract the rolling moment Applying a thrust reduction on the remaining engines to stop the yaw
Aircraft maneuvering in this flight condition has a direct result on the remaining control and performance capabilities of the aircraft. Turning into the direction of the remaining engines
-15-
NLR-TP-2003-392
(dead engine high) creates a flight condition with more lateral margin. Bank steepening in both turn directions will cause the available performance margins to decrease. Structural damage to the wing due a separation of the engine causes an additional lift loss and drag increase on the wing. Because these effects are a function of angle of attack, increase of angle of attack will create an additional rolling moment and yawing moment into the direction of the separated engine. This will require more opposite control wheel deflection, especially to counteract bank steepening during maneuvering.
For steady flight in the above mentioned conditions, the aircraft can be flown by:
Reducing roll angle to zero, or Reducing sideslip angle to zero
Figure 8 illustrates the aircraft condition for stationary and straight flight at zero roll angle under the conditions of the accident aircraft. In wings level flight a positive sideslip angle is required for straight flight to compensate the lateral force in the vertical tailplane. This condition decreases the available performance of the aircraft due to the additional drag of the sideslip. However, more lateral control margin is created due to the contribution of the increasing negative rolling moment due to sideslip.
Fig. 8: Straight and stationary flight with Fig. 9: Straight and stationary flight with right wing engine separation at zero roll angle right wing engine separation at zero sideslip angle
-16-
NLR-TP-2003-392
Straight and stationary flight at zero sideslip angle with a separation of the right wing engines is illustrated in figure 9. This condition actually improves the available performance of the aircraft as the zero sideslip reduces drag. In addition, the required directional control is less demanding to sustain the flight condition. Lateral control margin is, however, reduced as no positive sideslip is available.
5.1.2 Performance The simulation environment used for the analysis enabled a reconstruction of the maximum performance capabilities of the aircraft. The maximum performance capability indicates the aircraft climb capability, for the current condition, that is available with constant airspeed. The actual climb rate of the aircraft may not be equal to the maximum climb capability. In this condition the aircraft acceleration is not equal to zero. The maximum performance capability is calculated by differentiation of the aircraft’s specific energy6. Or:
dh dH V dV e * dt dt g dt
Where:
dh e = rate of change of specific energy (feet/min) dt dH = altitude or climb rate (feet/min) dt dV = acceleration along the flight path (feet/min2) dt g = gravitational acceleration (feet/min2)
5.2 Simulation environment The simulation environment for the analysis is based on the Delft University Aircraft Simulation Model and Analysis Tool DASMAT7. This MATLAB®/Simulink® package was developed at the Division of Flight Control and Simulation of the Faculty of Aerospace Engineering of the Delft University of Technology in order to meet the requirements for computer assisted design (CAD) and evaluation of flight control systems. The software is equipped with several simulation and analysis tools, all centered around a generic nonlinear aircraft model for state-of-the-art six-degree-of-freedom aircraft simulations. For high performance computation and visualisation capabilities, the package has been integrated as a toolbox in the computing environment MATLAB®/Simulink®. Some of the features of the package include trimming and linearisation tools for linear flight control design, flight test data
-17-
NLR-TP-2003-392
analysis, nonlinear on-line or off-line simulations and 3D aircraft visualisation. Applying user-generated models to the generic package customizes the software for the simulation of any specific aircraft. The Simulink® architecture of the software (figure 10) comprises three generic models of the aircraft, engine and aerodynamics. The simulation environment for the accident analysis was developed as an extension module to the DASMAT package.
The simulation environment incorporates a Fig. 10: Model architecture of the simulation environment nonlinear aerodynamic model and a flight control system model, reflecting the hydraulic system architecture, of the accident aircraft. The modeled control surfaces were subjected to aerodynamic effects throughout the flight envelope. The environment is operated from its own operating shell. On-line simulations of the reconstructed model can be performed interactively or system failures can be selected that affect the aircraft’s flight mechanics. For the accident analysis, the simulation environment was extended to simulate separation of the right wing engines, incorporating all its associated system failures, and provided the capability to import DFDR pilot control inputs. In this setup, the reconstructed flight data was visualised in addition to any desired flight parameter that was not recorded by the DFDR. To account for the effect of the right wing damage, the aerodynamic model was extended with an estimate of the aerodynamic effects following the separation of the engines.
5.2.1 Model requirements In general, analysis of impaired aircraft encountering one or more failure modes necessitates the definition of additional requirements to a simulation model of the aircraft. As impaired aircraft may introduce high nonlinear motions due to failures, the simulation model must comprise at least a nonlinear mathematical model in six-degrees-of-freedom. The requirements for the accident analysis resulted into the following model conditions and features for reconstruction and simulation:
Nonlinear aerodynamic model Flight control system model Simulation of engine separation and hydraulic failures Provisions for failure mode and effect analysis
-18-
NLR-TP-2003-392
Simulation of all control surfaces subjected to mechanical and rate limits Aerodynamic effects on the control surfaces to account for actuator force limitations in the case of hydraulic power loss, including floating control devices Lateral control system including spoiler program Directional control system that simulates the upper and lower rudder independently, including actuator forces and hinge moments Dual yaw damper and dual ratio changer systems for failure mode conditions Simulation of the hydraulic system architecture JT9D-3 engine model modified to simulate the JT9D-7J high thrust version Massmodel that accounts for fuel jettison Process capability of DFDR data Visualisation of flight parameters and control surface activity User interface to select a desired failure mode or perform on-line simulations
Modeling data was obtained from ref. [8-11].
5.2.2 Operating shell for DFDR analysis For the accident analysis, the simulation software was given the capability to reconstruct the DFDR data and to perform failure mode and effect analysis. The operating shell of the software (figure 11) offers several interactive capabilities for on-line simulations of the reconstructed model and analysis of the flight control system. The user may select a desired flight condition or specific failure mode scenario. Simulation results may then be recorded and used in conjunction with the analysis tools from DASMAT. This may, for instance, include the generation of a linearised model for flight control design applications. The operating shell offers the following capabilities for DFDR reconstruction and analysis of the reconstructed model:
Import of DFDR data On-line simulation of aircraft, flight control and hydraulic systems Selection of aircraft failure modes, including: - Engine separation - Hydraulic system failures Visualisation of reconstructed flight data Visualisation of reconstructed flight control surface deflections 3D visualisation of reconstructed flight profile
-19-
NLR-TP-2003-392
ut u0(1) Set Aircraft Model EL AL 1862 Leg 3 / Flaps 1 delta_c u0(2) Tn delta_w u0(3) Button Set initial FDRS conditions delta_p u
u0(4) OBSERVATIONS delta_stab u0(5) x u0(6) delta_sbh xdot NaN Mux yair u0(7) yacc delta_fh u0(8) gear Mux1 SIMULATIONyfp ys Tn0(1) Tn0(2) yFMaero OUTPUT EPR1/T n1 Mux BOEING 747-100/200 EPR2/T n2 FLIGHT MODEL yFMgust Tn0(1) Mux2 yFMt Tn0(2) EPR3/T n3 yCaero EPR4/T n4 CONTROL PANEL uc [lapse,ccp] delta_c [lapse,cwp] FLIG HT CO NT RO LS [lapse,rpp] delta_w delta_air delta_p delta_ail [lapse,stab] delta_stab [0,0] delta_aor [0,0] delta_sbh FLIGHT DECK CONTROLS delta_aol NaN Mux [lapse,flaph] delta_sp1 DFDR [0,0] delta_fh delta_sp2 gear Mux4 delta_sp3 INPUT [lapse,epr1] FIRE 1 FIRE 2 FIRE 3 FIRE 4 delta_sp4 [lapse,epr2] EPR1 Mux delta_sp5 EPR2 SYSTEM FAILURE MODE SELECT [0,0] Mux3 delta_sp6 EPR3 [0,0] engine 1 engine 2 engine 3 engine 4 delta-sp7 EPR4 FLIGHT DATA ENGINE SEPARATION 3 + 4 GEAR UP HYD SYS HYD SYS HYD SYS HYD SYS delta_sp8 (ELAL flight 1862 scenario) PRESS 1 PRESS 2 PRESS 3 PRESS 4 FAILURE MODE delta_sp9
GEAR DOWN WING DAMAGE LEADING EDGE FLAPS FAILURE delta_sp10 (ELAL flight 1862 scenario) WHEEL/COLUMN THRUST LEVERS SEGMENTS 19/20/21 FLAPS 1 SELECTION delta_sp11 delta_sp12 STAB SPEED FLAPS RIGHT INBOARD FLAP FAILURE TRIM BRAKES FLAPS LIMIT FLAPS 1 delta_eir 0 Clock 1-265 KTS 20-214 KTS delta_eil 1 5-240 KTS 25-205 KTS FUEL JETTISON PRESS yout 10-225 KTS 30-180 KTS delta_eor 5 RESET To Workspace delta_eol 10 Vd/Md 1 Demux ih 20 S.L-434 KTS/0.65 FLIGHTLAB 747 0 Demux 10K-432 KTS/0.76 delta_ru 25 20K-414 KTS/0.92 OPEN-LOOP OPERATING SHELL 30K-350 KTS/0.97 delta_rl 1 1 30 40K-276 KTS/0.97 1997 by M.H.Smaili flight model by BOEING/NASA delta_fo 1 1 1 1 1 1 1 Floating delta_fi Scope 0 CONTROL 0 RUDDER 0 0 1 1 1 1 EPR 0 COLUMN PEDAL
ON-LINE AIRCRAFT SIMULATION
Fig. 11: Simulation environment for flight data reconstruction and analysis
For the accident analysis, selection of engine separation will cause the simulation model to be configured according to the system architecture of the aircraft.
5.3 Reconstruction setup The reconstruction is based on a model validation method using inverse simulation12 (figure 12). The DFDR pilot control inputs up are directly applied to the simulation model of the aircraft and Fig. 12: Inverse simulation principle for flight data reconstruction the flight control system. The response error of the simulation output xc and measured DFDR data xm are input to a feedback controller. The output of the feedback controller is a measure for the fidelity of the reconstructed model. The reconstruction method has the advantage that the combined effect of structural and flight control system failures may be visualised using the simulation inputs and outputs. The estimation of the aerodynamic effects due to engine separation can be Fig. 13: Principle of Flight Data Reconstruction and Simulation (FDRS) for aircraft accident analysis
-20-
NLR-TP-2003-392
performed by adjusting the parameters of a model structure of the damaged wing until the controller output is minimised. An additional advantage of the method is that the DFDR data, with a low sample rate, can be used directly to excite the simulation model. The reconstruction setup for the analysis is illustrated in figure 13. A proportional feedback controller using pitch and roll data proved to be sufficient to obtain a reasonable match with measurements and simulation data.
The reconstructed flight profile of the accident aircraft, starting from lift-off to final loss of control, was divided into three separate stages or flight legs (figure 14):
LEG#1 (t=47-371 sec): Gross takeoff flight path to engine separation.
LEG#2 (t=378-647 sec): Engine separation flight path with flaps up.
LEG#3 (t=648-874 sec): Engine separation flight path with flaps 1 selected. Fig. 14: Flight legs for DFDR reconstruction
This subdivision was based on the following considerations:
Validation of the simulation model and reconstruction method without failure modes Estimation of aerodynamic effects for different aircraft configurations Reduction of computational load
Meteorological data at the time of the crash was used during the reconstruction. The effect of fuel jettison and fuel flow was included in the simulation based on DFDR data. To facilitate comparison, the time reference during the analysis was chosen the same as in ref. [2].
5.4 Aircraft configuration The aircraft failure mode configuration after the separation of the right wing engines (figure 15) was included in the simulation and consisted of:
-21-
NLR-TP-2003-392
Aircraft systems: Hydraulic systems 3 and 4 off Engine 1 and 2 thrust asymmetry Lower rudder lag
Mass properties: Engine no. 3 and 4 weight loss, 4,014 kg each Pylon no. 3 and 4 weight loss, 1,000 kg each Lateral center of gravity displacement Total weight loss: 10,0028 kg
Aerodynamics: Lift loss due to wing damage, CLsep Rolling moment due to wing damage, Clsep Drag due to wing damage, CDsep Yawing moment due to wing damage, Cnsep Pitching moment due to wing damage, Cmsep Right inboard aileron and spoiler 10 and 11 Control surface lost aerodynamic efficiency loss 50% Hinge moment loss /
half trim rate
Fig. 15: Failure modes and damage configuration of the accident aircraft
6 Reconstruction and simulation results
6.1 Aerodynamic effects On March 31, 1993, a Boeing 747 freighter encountered a separation of the no. 2 engine under turbulence conditions13. Despite the severe performance and controllability problems caused by the separated engine, the flight crew managed to recover the aircraft by means of an emergency landing. The flight conditions after engine separation required up to full right rudder pedal, approximately 60 degrees of right wing down control wheel deflection and overboost thrust on the no. 1 engine. The structural damage to the left wing of the aircraft (figure 16) may have been representative for the amount of structural damage incurred by the aircraft of the Bijlmermeer accident. The aerodynamic effects due to engine separation result in a lift loss and an increase of drag on the damaged wing. Consequently, an additional rolling moment due to lift loss and a yawing moment due to the drag increase on the wing will result. At higher angle of attack these effects
-22-
NLR-TP-2003-392
will further increase resulting into a reduction of controllability and performance. Figure 17 depicts an estimate of the right wing damage of the Amsterdam Bijlmermeer accident aircraft after the separation of the engines. The figure indicates that most damage of the right wing was located near the no. 3 engine. This may have caused a degradation of the aerodynamic efficiency of the inboard aileron located behind the damage. Additionally, the reconstruction method enabled to identify a significant pitch down moment effect after the separation of the engines. It is difficult to determine the individual contributions to this effect, as the exact damage to the right wing is not known. The effect was most probably caused by a combination of a change of induced downwash near the stabilizer, wing leading edge damage, effect of the engines and effect of selected flaps. An estimate of the additional pitch down moment was required to obtain a reasonable match with the DFDR data.
Fig. 16: Wing damage due to separation of Fig. 17: Estimated right wing damage engine no.2, Boeing 747, March 31, 1993 of the Amsterdam Bijlmermeer accident (source: ref. [13]) aircraft
Based on the estimates of damage to the right wing, a model structure of the aerodynamic effects due to engine separation was included in the simulation model for the reconstruction3. The aerodynamic estimates in the model, obtained during an extensive tuning process, resulted into a reasonable match with the performance and control capabilities of the accident aircraft. However, it should be emphasised that the aerodynamic effects due to structural failure, as characteristic for the accident flight, are very complex and difficult to determine precisely. This is especially true due to the fact that the actual amount of structural damage to the right wing was unknown. Therefore, the objective for the analysis was to obtain a physically representative model of the effect of engine separation on the aircraft flight mechanics by closely matching the characteristic trends in aircraft performance and controllability as provided by the flight data recorder. Figures 18-21 illustrate the effect of the aerodynamic estimates for the right wing damage contribution on the model input and output for t=378-647 s. It can be seen that, under the
-23-
NLR-TP-2003-392
prevailing flight condition, a reasonable match between DFDR and simulation for control wheel deflection (figures 18 and 19) and roll angle (figures 20 and 21) can be achieved.
EL AL Flight 1862 Leg 2 / Flaps up EL AL Flight 1862 Leg 2 / Flaps up
FDRS 20 20 DFDR 10 10
0 0
-10 -10
-20 -20
-30 -30
-40 -40
-50 -50 Control Wheel Position (deg) Position Wheel Control Control Wheel Position (deg) Position Wheel Control -60 -60
-70 -70 FDRS -80 DFDR -80
400 450 500 550 600 650 400 450 500 550 600 650 Time (s) Time (s) Fig. 18: Reconstructed control wheel deflection without Fig. 19: Reconstructed control wheel deflection aerodynamic estimates (t=378-647 s) including aerodynamic estimates (t=378-647 s)
EL AL Flight 1862 Leg 2 / Flaps up EL AL Flight 1862 Leg 2 / Flaps up
40 FDRS 40 FDRS DFDR DFDR 30 30
20 20
10 10
0 0
Roll Angle (deg) Angle Roll -10
Roll Angle (deg) Angle Roll -10
-20 -20
-30 -30
-40 -40
400 450 500 550 600 650 400 450 500 550 600 650 Time (s) Time (s) Fig. 20: Reconstructed roll angle without aerodynamic Fig. 21: Reconstructed roll angle including estimates (t=378-647 s) aerodynamic estimates (t=378-647 s)
6.2 Flight data reconstruction The flight stages or legs of the accident profile, as defined for the analysis, were reconstructed starting from an initial trimmed flight condition in an aircraft configuration without failure modes. The trimmed condition was obtained by the aircraft trim routines in the simulation environment. At the start of the reconstruction, engines 3 and 4 were separated from the aircraft initiating all relevant failure modes in the simulation. Subsequently, the DFDR pilot control inputs were applied to the simulation model to reconstruct the relevant stage of the accident profile. The DFDR was recovered in a highly damaged state while the tape was broken on four places. To improve the quality of the DFDR data for simulation and analysis, the data was further analysed and smoothed before application. Reconstruction results of the accident flight are further discussed in ref. [3].
-24-
NLR-TP-2003-392
Leg#1 (t=47-371 sec) Figures 22-35 illustrate the reconstruction results of the departure and climbout of the accident aircraft up to separation of the engines. The reconstructed data matches well with the DFDR data under the prevailing meteorological conditions. Performance capabilities and controllability of the simulation model are representative of the aircraft without failure modes and for the applied thrust settings. Ground track data (figure 22) was obtained from radar sources as this information was not available from the DFDR. The angle of attack bias in figure 31 is caused by the difference between measured and reconstructed angle of attack (DFDR vane angle of attack vs. calculated body angle of attack).
5 x 10 EL AL Flight 1862 Leg 1 / Pampus Departure EL AL Flight 1862 Leg 1 / Pampus Departure 4.9 8000 FDRS ATC RADAR 4.89 7000
4.88 6000
4.87 5000 4.86 4000 Y (m) Y 4.85 Altitude (feet) Altitude 3000 4.84
2000 4.83
1000 FDRS 4.82 DFDR
4.81 0 1.1 1.15 1.2 1.25 1.3 1.35 1.4 50 100 150 200 250 300 350 5 X (m) x 10 Time (s) Fig. 22: Reconstructed ground track (t=47-371 s) Fig. 23: Reconstructed altitude (t=47-371 s)
EL AL Flight 1862 Leg 1 / Pampus Departure EL AL Flight 1862 Leg 1 / Pampus Departure 140 3
120 2
100 1
80 0 60 Heading (deg) Heading -1
40 (deg) SideslipFDRSAngle
-2 20 FDRS DFDR
0 -3 50 100 150 200 250 300 350 50 100 150 200 250 300 350 Time (s) Time (s) Fig. 24: Reconstructed heading (t=47-371 s) Fig. 25: Reconstructed sideslip angle (t=47- 371 s)
EL AL Flight 1862 Leg 1 / Pampus Departure EL AL Flight 1862 Leg 1 / Pampus Departure 18 FDRS FDRS 16 DFDR 30 DFDR 25 14 20 12 15
10 10
8 5 Roll Angle (deg) Angle Roll Pitch Angle (deg) Angle Pitch 0 6 -5 4 -10 2 -15
0 -20 50 100 150 200 250 300 350 50 100 150 200 250 300 350 Time (s) Time (s) Fig. 26: Reconstructed pitch angle (t=47-371 s) Fig. 27: Reconstructed roll angle (t=47-371 s)
-25-
NLR-TP-2003-392
EL AL Flight 1862 Leg 1 / Pampus Departure EL AL Flight 1862 Leg 1 / Pampus Departure 5 FDRS 30 DFDR 4
20 3
2 10
1 0
0 -10 Control Wheel Position (deg) Position Wheel Control Control Column Position (deg) Position Column Control -1 -20
-2 FDRS -30 DFDR -3 50 100 150 200 250 300 350 50 100 150 200 250 300 350 Time (s) Time (s) Fig. 28: Reconstructed control column position Fig. 29: Reconstructed control wheel deflection (t=47-371 s) (t=47-371 s)
EL AL Flight 1862 Leg 1 / Pampus Departure EL AL Flight 1862 Leg 1 / Pampus Departure 300 18 FDRS 280 16 DFDR
260 14
240 12 220 10 200 8 180
Angle-of-Attack (deg) Angle-of-Attack 6
Indicated Airspeed(KTS) Indicated 160
4 140 FDRS 120 DFDR 2
100 0 50 100 150 200 250 300 350 50 100 150 200 250 300 350 Time (s) Time (s) Fig. 30: Reconstructed indicated airspeed Fig. 31: Reconstructed angle of attack (t=47- (t=47-371 s) 371 s)
EL AL Flight 1862 Leg 1 / Pampus Departure EL AL Flight 1862 Leg 1 / Pampus Departure
FDRS FDRS DFDR DFDR 1.15 0.28
1.1 0.26
1.05 0.24
1 0.22
Load Factor (g) Factor Load 0.95 0.2 Longitudinal Acceleration (g) Acceleration Longitudinal 0.9 0.18 0.85 0.16 0.8 50 100 150 200 250 300 350 50 100 150 200 250 300 350 Time (s) Time (s) Fig. 32: Reconstructed load factor (t=47-371 s) Fig. 33: Reconstructed longitudinal acceleration (t=47-371 s)
EL AL Flight 1862 Leg 1 / Pampus Departure EL AL Flight 1862 Leg 1 / Pampus Departure 1.5 3000
1.48 Engine#1 EPR Engine#2 EPR Engine#3 EPR 2500 1.46 Engine#4 EPR
1.44 2000 1.42
1.4 1500
1.38
Engine Pressure Ratio Pressure Engine 1000 1.36
1.34 500 Maximum Performance Capability (feet/min) Capability Performance Maximum FDRS 1.32 DFDR
1.3 0 50 100 150 200 250 300 350 50 100 150 200 250 300 350 Time (s) Time (s) Fig. 34: DFDR applied power settings (t=47- Fig. 35: Reconstructed maximum climb capability 371 s) (t=47-371 s)
-26-
NLR-TP-2003-392
Leg#2 (t=378-647 sec) Figures 36-49 present the reconstruction results of the accident flight after separation of the engines 3 and 4 up to the selection of flaps 1. The reconstructed data matches well with the DFDR data under the prevailing meteorological conditions. Among other parameters not available from the DFDR, the reconstruction method enabled to calculate the sideslip capabilities of the accident aircraft after the separation of the engines throughout the flight stage (figure 39). The figures indicate that performance capabilities and controllability of the simulation model for this flight condition are representative of the accident aircraft with flaps up and at high thrust.
5 x 10 EL AL Flight 1862 Leg 2 / Flaps up EL AL Flight 1862 Leg 2 / Flaps up 4.9 8000 FDRS FDRS 4.88 ATC RADAR DFDR 7000 4.86 6000 4.84 5000 4.82
4.8 4000 Y (m) Y
4.78 (feet) Altitude 3000 4.76 2000 4.74 1000 4.72
4.7 0 1.15 1.2 1.25 1.3 1.35 1.4 1.45 400 450 500 550 600 650 5 X (m) x 10 Time (s) Fig. 36: Reconstructed ground track (t=378- Fig. 37: Reconstructed altitude (t=378-647 s) 647 s)
EL AL Flight 1862 Leg 2 / Flaps up EL AL Flight 1862 Leg 2 / Flaps up 400 3
350 FDRS 2 DFDR
300 1
250 0
200 -1
Heading (deg) Heading 150 -2 FDRS Sideslip Angle (deg) SideslipFDRSAngle 100 -3
50 -4
0 -5 400 450 500 550 600 650 400 450 500 550 600 650 Time (s) Time (s) Fig. 38: Reconstructed heading (t=378-647 s) Fig. 39: Reconstructed sideslip angle (t=378- 647 s)
EL AL Flight 1862 Leg 2 / Flaps up EL AL Flight 1862 Leg 2 / Flaps up 12 FDRS 40 FDRS DFDR DFDR 10 30 8 20 6 10
4 0
2
Roll Angle (deg) Angle Roll -10 Pitch Angle (deg) Angle Pitch
0 -20
-2 -30
-4 -40
400 450 500 550 600 650 400 450 500 550 600 650 Time (s) Time (s) Fig. 40: Reconstructed pitch angle (t=378-647 s) Fig. 41: Reconstructed roll angle (t=378-647 s)
-27-
NLR-TP-2003-392
EL AL Flight 1862 Leg 2 / Flaps up EL AL Flight 1862 Leg 2 / Flaps up
FDRS 4 20 DFDR
3 10 0 2 -10 1 -20 0 -30 -1 -40 -2 -50 Control Wheel Position (deg) Position Wheel Control
Control Column Position (deg) Position Column Control -3 -60 -4 -70 -5 FDRS DFDR -80 -6 400 450 500 550 600 650 400 450 500 550 600 650 Time (s) Time (s) Fig. 42: Reconstructed control column position Fig. 43: Reconstructed control wheel deflection (t=378-647 s) (t=378-647 s)
EL AL Flight 1862 Leg 2 / Flaps up EL AL Flight 1862 Leg 2 / Flaps up
340 FDRS DFDR 10
9 320 8
300 7
6 280 5
260 4 Angle-of-Attack (deg) Angle-of-Attack Indicated Airspeed(KTS) Indicated 3 240 2 FDRS 1 220 DFDR 0 400 450 500 550 600 650 400 450 500 550 600 650 Time (s) Time (s) Fig. 44: Reconstructed indicated airspeed (t=378- Fig. 45: Reconstructed angle of attack (t=378- 647 s) 647 s)
EL AL Flight 1862 Leg 2 / Flaps up EL AL Flight 1862 Leg 2 / Flaps up 0.16 FDRS 2.2 DFDR FDRS 0.14 DFDR 2 0.12 1.8 0.1 1.6
0.08 1.4
Load Factor (g) Factor Load 1.2 0.06 Longitudinal Acceleration (g) Acceleration Longitudinal 1 0.04
0.8 0.02 0.6 0 400 450 500 550 600 650 400 450 500 550 600 650 Time (s) Time (s) Fig. 46: Reconstructed load factor (t=378-647 s) Fig. 47: Reconstructed longitudinal acceleration (t=378-647 s)
EL AL Flight 1862 Leg 2 / Flaps up EL AL Flight 1862 Leg 2 / Flaps up 1000
1.6 500
1.5 0
1.4 -500
1.3 -1000
1.2 -1500 Engine Pressure Ratio Pressure Engine
1.1 -2000 Maximum Performance Capability (feet/min) Capability Performance Maximum 1 Engine#1 EPR -2500 FDRS Engine#2 EPR DFDR
0.9 -3000 400 450 500 550 600 650 400 450 500 550 600 650 Time (s) Time (s) Fig. 48: DFDR applied power settings (t=378- Fig. 49: Reconstructed maximum climb capability 647 s) (t=378-647 s)
-28-
NLR-TP-2003-392
Leg#3 (t=648-874 sec) The reconstruction results of the accident flight after the selection of flaps 1 up to the final loss of control are shown in the figures 50-63. The reconstructed data shows a reasonable match with the DFDR data under the prevailing meteorological conditions. The difference between the impact area of the radar data and the simulation model (figure 50) is caused by the higher bank angle of the model from t=780 s to t=840 s and possible nonlinear effects at high angle of attack. In general, performance and control capabilities of the simulation model, up to the final stage of the flight, remain representative of the accident aircraft with inboard trailing edge flaps selected to 1 and for the applied thrust settings on the remaining engines.
5 x 10 EL AL Flight 1862 Leg 3 / Flaps 1 EL AL Flight 1862 Leg 3 / Flaps 1 4.92 5000 FDRS FDRS 4500 DFDR ATC RADAR 4.9 4000
4.88 3500
3000 4.86 2500 Y (m) Y 4.84 Altitude (feet) Altitude 2000
1500 4.82
1000 4.8 500
4.78 0 1.2 1.25 1.3 1.35 660 680 700 720 740 760 780 800 820 840 860 5 Time (s) X (m) x 10 Fig. 50: Reconstructed ground track (t=648- Fig. 51: Reconstructed altitude (t=648-874 s) 874 s)
EL AL Flight 1862 Leg 3 / Flaps 1 EL AL Flight 1862 Leg 3 / Flaps 1 450 1
FDRS 400 DFDR 0.5
350 0
300 -0.5
250 -1 200
Heading (deg) Heading -1.5 150 FDRS Sideslip Angle (deg) SideslipFDRSAngle -2 100
-2.5 50
0 -3 660 680 700 720 740 760 780 800 820 840 860 660 680 700 720 740 760 780 800 820 840 860 Time (s) Time (s) Fig. 52: Reconstructed heading (t=648-874 s) Fig. 53: Reconstructed sideslip angle (t=648- 874 s) EL AL Flight 1862 Leg 3 / Flaps 1 EL AL Flight 1862 Leg 3 / Flaps 1 10 120
FDRS 100 DFDR 0
80 -10
60
-20 40 Roll Angle (deg) Angle Roll Pitch Angle (deg) Angle Pitch -30 20
-40 0 FDRS DFDR
-50 -20 660 680 700 720 740 760 780 800 820 840 860 660 680 700 720 740 760 780 800 820 840 860 Time (s) Time (s) Fig. 54: Reconstructed pitch angle (t=648-874 s) Fig. 55: Reconstructed roll angle (t=648-874 s)
-29-
NLR-TP-2003-392
EL AL Flight 1862 Leg 3 / Flaps 1 EL AL Flight 1862 Leg 3 / Flaps 1 12 20
FDRS FDRS DFDR 10 DFDR 0
8 -20
6 -40
4 -60
2 -80
0 -100 Control Wheel Position (deg) Position Wheel Control Control Column Position (deg) Position Column Control
-2 -120
-4 -140
660 680 700 720 740 760 780 800 820 840 860 660 680 700 720 740 760 780 800 820 840 860 Time (s) Time (s) Fig. 56: Reconstructed control column position Fig. 57: Reconstructed control wheel deflection (t=648-874 s) (t=648-874 s)
EL AL Flight 1862 Leg 3 / Flaps 1 EL AL Flight 1862 Leg 3 / Flaps 1 340 20 FDRS DFDR 18 FDRS 320 DFDR 16
300 14
280 12
10 260 8 Angle-of-Attack (deg) Angle-of-Attack Indicated Airspeed(KTS) Indicated 240 6
4 220 2
200 0 660 680 700 720 740 760 780 800 820 840 860 660 680 700 720 740 760 780 800 820 840 860 Time (s) Time (s) Fig. 58: Reconstructed indicated airspeed (t=648- Fig. 59: Reconstructed angle of attack (t=648- 874 s) 874 s)
EL AL Flight 1862 Leg 3 / Flaps 1 EL AL Flight 1862 Leg 3 / Flaps 1
0.24 FDRS 2.2 DFDR FDRS 0.22 DFDR 2 0.2 1.8 0.18
1.6 0.16
1.4 0.14
Load Factor (g) Factor Load 1.2 0.12
1 (g) Acceleration Longitudinal 0.1
0.08 0.8 0.06 0.6 0.04 660 680 700 720 740 760 780 800 820 840 860 660 680 700 720 740 760 780 800 820 840 860 Time (s) Time (s) Fig. 60: Reconstructed load factor (t=648-874 s) Fig. 61: Reconstructed longitudinal acceleration (t=648-874 s)
EL AL Flight 1862 Leg 3 / Flaps 1 EL AL Flight 1862 Leg 3 / Flaps 1 1000 Engine#1 EPR 1.65 Engine#2 EPR 500 1.6 0 1.55
1.5 -500
1.45 -1000
1.4 -1500 Engine Pressure Ratio Pressure Engine 1.35 -2000 1.3 Maximum Performance Capability (feet/min) Capability Performance Maximum 1.25 -2500 FDRS DFDR
1.2 -3000 660 680 700 720 740 760 780 800 820 840 860 660 680 700 720 740 760 780 800 820 840 860 Time (s) Time (s) Fig. 62: DFDR applied power settings (t=648- Fig. 63: Reconstructed maximum climb capability 874 s) (t=648-874 s)
-30-
NLR-TP-2003-392
6.3 Rudder control system analysis The simulation model of the flight control system enabled a reconstruction and analysis of the rudder deflections of the accident aircraft using the DFDR data. This analysis was performed to investigate the operation of the rudder control system during the accident flight in order to clarify certain anomalies that contributed adversely to the control of the aircraft. Reconstruction of the upper and lower rudder surface deflections, before the separation of the engines (t=47-371 s), indicated that reconstructed upper rudder deflection did not agree with the DFDR data (figure 64). Lower rudder activity was consistent with the DFDR lower rudder deflections (figure 65). At t=270 seconds, the aircraft acquires a 15 degrees roll angle to the left as a result of a control wheel input. Reconstructed upper rudder deflection is then opposite to the DFDR data. The lower rudder (figure 65) shows a reconstructed deflection consistent with the DFDR data and is opposite to the DFDR upper rudder deflection. For the upper rudder, several failure mode scenarios were applied to the simulation model. The model indicated that DFDR upper rudder activity can be reconstructed in case the upper rudder turn co-ordinator is not available (figure 66). In this condition, figures 66 and 67 indicate that at t=270 seconds both reconstructed upper and lower rudder deflections are consistent with the DFDR data.
EL AL Flight 1862 Leg 1 / Upper rudder turn coordinator available EL AL Flight 1862 Leg 1 / Upper rudder turn coordinator available 3 5 FDRS FDRS DFDR 4 DFDR 2 3
1 2
1 0 0
-1 -1 Upper Rudder Deflection (deg) Deflection Rudder Upper (deg) Deflection Rudder Lower -2 -2 -3
-3 -4 50 100 150 200 250 300 350 50 100 150 200 250 300 350 Time (s) Time (s) Fig. 64: Reconstructed upper rudder deflection Fig. 65: Reconstructed lower rudder deflection (t=47-371 s) (t=47-371 s)
EL AL Flight 1862 Leg 1 / Upper rudder turn coordinator not available EL AL Flight 1862 Leg 1 / Upper rudder turn coordinator not available 3 5 FDRS FDRS DFDR 4 DFDR 2 3
1 2
1 0 0
-1 -1 Upper Rudder Deflection (deg) Deflection Rudder Upper (deg) Deflection Rudder Lower -2 -2 -3
-3 -4 50 100 150 200 250 300 350 50 100 150 200 250 300 350 Time (s) Time (s) Fig. 66: Reconstructed upper rudder deflection Fig. 67: Reconstructed lower rudder deflection (t=47-371 s); upper rudder turn coordinator not (t=47-371 s); upper rudder turn coordinator not available available
-31-
NLR-TP-2003-392
Upper and lower rudder activity was subsequently evaluated after the separation of the engines (figures 68-73). The DFDR indicates that lower rudder authority was limited after the engines were separated from the aircraft (figure 68). To investigate the probable cause of this anomaly, rudder deflections were reconstructed for the second and third flight leg (t=378-874 s). It was found that deflections of the lower rudder, as indicated on the DFDR, were related to the flight condition at some stages. A typical effect starts at t=858 s when the aircraft loses flight control at full rudder pedal while bank angle increases. In this condition, at t=865 s, lower rudder deflection increases while upper rudder is limited and decreasing (figure 70). Both upper and lower rudders are equipped with a dual-tandem actuator. Loss of one actuator, due to loss of hydraulic supply, will reduce the actuator hinge moment. Under some flight conditions, the available rudder will thus be limited by actuator force capability (aerodynamic blowdown). To study this effect, additional failure mode scenarios were evaluated with the reconstructed model. An actuator hinge moment less than the nominal value, applied as a failure mode to the model of the lower rudder, appeared to most closely match the rudder deflection trends as observed on the DFDR. In this failure mode condition, when full pedal is applied at t=480 s, the reconstructed lower rudder deflections appear to be consistent with the DFDR data (figure 69). It can be seen that the lower rudder is limited to about 3.2 degrees, while upper rudder is limited to 7 degrees. Analysis of the reconstructed flight data indicated that the lower rudder deflections appear to be primarily subjected to the effect of sideslip due to thrust application (figure 72). In particular, this can be seen at t=590 s when engine no. 1 and 2 thrust is reduced which causes the sideslip to decrease resulting into an increase of lower rudder authority. For the condition after the loss of flight control, analysis of the simulation model indicated that the increase of lower rudder deflection at t=860 s (figure 70) was primarily caused by a reduction of the aerodynamic blowdown effect on the lower rudder as the aircraft banks to the right. As a consequence, lower rudder authority is increased enabling the rudder to follow a combination of the commanded pedal and yaw damper commands due to yaw rate (figure 73). Reconstructed rudder surface deflections for this condition are indicated in figure 71 (lower rudder simulated with blowdown limit of 5.1 degrees).
EL AL Flight 1862 Leg 2 / Flaps up EL AL Flight 1862 Leg 2 / Flaps up 8 8
7 7
6 6
5 5
4 4
3 3
2 2
1 1
DFDR Rudder Surface Deflection (deg) Deflection Surface Rudder DFDR 0 (deg) Deflection Surface Rudder FDRS 0
Lower rudder Lower rudder -1 Upper rudder -1 Upper rudder
-2 -2 400 450 500 550 600 650 400 450 500 550 600 650 Time (s) Time (s)
Fig. 68: DFDR upper and lower rudder deflections Fig. 69: Reconstructed upper and lower rudder (t=378-647 s) deflections (t=378-647 s)
-32-
NLR-TP-2003-392
EL AL Flight 1862 Leg 3 / Flaps 1 EL AL Flight 1862 Leg 3 / Flaps 1 9 9 Lower rudder Lower rudder Upper rudder Upper rudder 8 8
7 7
6 6
5 5
4 4 DFDR Rudder Surface Deflection (deg) Deflection Surface Rudder DFDR (deg) Deflection Surface Rudder FDRS 3 3
2 2 660 680 700 720 740 760 780 800 820 840 860 660 680 700 720 740 760 780 800 820 840 860 Time (s) Time (s) Fig. 70: DFDR upper and lower rudder deflection Fig. 71: Reconstructed upper and lower rudder (t=648-874 s) deflections (t=648-874 s)
EL AL Flight 1862 Leg 2 / Flaps up EL AL Flight 1862 Leg 3 / Flaps 1 3 3
2 2.5
1 2
0 1.5
-1 1
-2 0.5 FDRS Sideslip Angle (deg) SideslipFDRSAngle -3 0 FDRS Yaw Damper Command (deg) Command Damper Yaw FDRS
-4 -0.5
-5 -1 400 450 500 550 600 650 660 680 700 720 740 760 780 800 820 840 860 Time (s) Time (s) Fig. 72: Reconstructed sideslip angle (t=378- Fig. 73: Reconstructed lower rudder yaw damper 647 s) command (t=648-874 s)
6.4 Summary of simulation and analysis results The analysis results of the flight data reconstruction and simulation of the 1992 Amsterdam Bijlmermeer airplane accident case, as presented in ref. [3], can be summarised as follows:
The reconstructed model indicated that after separation of the engines from the aircraft, performance (figure 74) and controllability (figure 75) were degraded due to the heavy weight of the aircraft and additional drag of the damaged right wing. The relative large performance degradation at angles of attack greater than 8 degrees, at a load factor of 1.2 g, and at approximately 260 KIAS, could only be reconstructed by a significant increase of drag caused by the damaged wing. Application of thrust, combined with a delayed pedal input, resulted into a loss of flight control. Analysis of the reconstructed model indicated that at the loss of flight control sufficient directional control margins existed to regain control of the aircraft. The simulation model predicted that the control loss during the last flight stage was recoverable within operational limits (see appendix A). The control strategy for the recovery is, however, contradictory to the natural reaction of the pilot. The DFDR indicates that at final control loss, the engines are set at full thrust while the control column is pulled
-33-
NLR-TP-2003-392
backwards. In addition, less than maximum rudder pedal is applied at the initiation of control loss. The simulation model indicated that for a successful recovery, engine thrust must be reduced to idle, at the expense of performance, while applying full control wheel and rudder and a forward column deflection. Applying a control loss recovery strategy to the reconstructed model for the conditions during the final stage of flight, obtained the following results:
- Altitude loss (t=858-880 s): 800 feet - Control recovery roll rate (48 degrees right to 20 degrees left bank): 7.6 deg/sec - Maximum performance loss: -3500 feet/min - Application of maximum thrust (EPR 1.62 / EGT limit): 20 seconds
The reconstructed model was able to identify that upper rudder turn coordinator was not available before the separation of the engines. It is not likely that this condition contributed to the separation of the no. 3 engine. With regard to the lower rudder lag after the separation of the engines, the simulation model indicated that a reasonable match with DFDR lower rudder deflections could be obtained by applying a reduction of lower rudder actuator hinge moment as a failure mode. Although the analysis indicated that the lower rudder lag had a significant adverse contribution to the control of the aircraft (figure 76), no statement could be made with regard to the origin of this failure mode. Analysis of the reconstructed model indicated that straight and level flight capability existed down to approximately 250 KIAS at heavy weight and go-around thrust (figure 77). A weight reduction of about 56,000 kg reduced the straight and level flight capabilities down to approximately 220 KIAS at MCT. Weight reduction was achieved by simulation of fuel jettison up to a remaining quantity for about 20 minutes of flight. A deceleration to 240 KIAS could be simulated for straight flight only at heavy weight and MCT thrust. The reconstructed model indicated that after the separation of the engines controllability was sufficient to turn in both directions. The simulation model predicts sufficient performance and controllability after the separation of the engines to fly a low-drag approach profile at a 3.5 degrees glide slope angle for a high-speed landing or ditch at 200/210 KIAS (figure 78). The lower thrust requirement for this approach profile resulted into a significant improvement of controllability (figure 79). Performance and controllability for this condition were calculated for a weight reduction of 56,000 kg due to fuel jettison. Further speed reduction below approximately 220 KIAS at flaps 1 resulted in a loss of go-around capabilities.
-34-
NLR-TP-2003-392
260 KIAS / Flaps 1 / Lower rudder authority 5.1 degrees / Full pedal 260 KIAS / Flaps 1 / Lower rudder authority 5.1 degrees / Full pedal 1400 0 700,000 lbs / 317,460 kg 700,000 lbs / 317,460 kg 1200 577,648 lbs / 261,972 kg -10 577,648 lbs / 261,972 kg
1000 -20
800 -30
600 -40
400 -50
200 -60
0 (deg) Deflection Wheel Control -70
Maximum Performance Capability (feet/min) Capability Performance Maximum -200 MCT TOGA MCT TOGA -80 -400 1 1.1 1.2 1.3 1.4 1.5 1.6 1 1.1 1.2 1.3 1.4 1.5 1.6 Engines 1 & 2 EPR Engines 1 & 2 EPR Fig. 74: Effect of engine thrust and weight on Fig. 75: Effect of engine thrust and weight on maximum climb performance for straight flight at lateral control for straight flight at 260 KTS 260 KTS
250 KIAS / 700,000 lbs / Flaps 1 250 KIAS / Flaps 1 / Lower rudder authority 5.1 degrees 0 0 Lower rudder lag 5.1 degrees 700,000 lbs / 317,460 kg -10 Full lower rudder authority -10 577,648 lbs / 261,972 kg
-20 -20
-30 -30
-40 -40
-50 -50
-60 -60 Control Wheel Position (deg) Position Wheel Control (deg) Position Wheel Control
-70 -70
-80 -80
0 2 4 6 8 10 12 14 -2 0 2 4 6 8 10 12 14 Rudder Pedal Position (deg) Rudder Pedal Position (deg) Fig. 76: Effect of lower rudder lag on lateral Fig. 77: Effect of weight on lateral control for control for straight and level flight at 250 KTS straight and level flight at 250 KTS
Wings level / Flaps 1 / Lower rudder authority 5.1 degrees / Full pedal Wings level / Flaps 1 / Lower rudder authority 5.1 degrees / Full pedal 220 80
210 60
40 200 20
190 0
-20 180 Indicated Airspeed(KTS) Indicated
Control Wheel Position (deg) Position Wheel Control -40
170 -60 700,000 lbs / 317,460 kg 700,000 lbs / 317,460 kg 577,648 lbs / 261,972 kg 577,648 lbs / 261,972 kg -80 160 -7 -6.5 -6 -5.5 -5 -4.5 -4 -3.5 -3 -2.5 -2 -7 -6.5 -6 -5.5 -5 -4.5 -4 -3.5 -3 -2.5 -2 Glide Slope Angle (deg) Glide Slope Angle (deg) Fig. 78: Effect of weight on indicated airspeeds Fig. 79: Effect of weight on lateral control and and attainable flight path angles for simulated attainable flight path angles for simulated low- low-drag approach profile drag approach profile
-35-
NLR-TP-2003-392
7 Conclusions and recommendations
7.1 Conclusions Based on the results of the analysis in this report the following conclusions can be made.
An independent analysis of the 1992 Amsterdam Bijlmermeer airplane accident, performed at the Division of Flight Control and Simulation of the Faculty of Aerospace Engineering of the Delft University of Technology in 1997, was presented. Utilising modeling and simulation techniques, referred to as Flight Data Reconstruction and Simulation (FDRS), a reconstruction of the accident flight was performed using the parameters of the Digital Flight Data Recorder (DFDR). The reconstructed model was used to estimate the actual flying capabilities of the aircraft using several flight control strategies. The reconstruction method, developed for the accident analysis, proved to be a practical tool to obtain a reasonable match with the DFDR data of the accident flight given the limited estimations of the aircraft’s structural damage. The application of this technique resulted into a simulation model of the impaired aircraft that could reasonably predict the performance, controllability effects and control surface deflections as observed on the DFDR.
The analysis software provided the tools for a detailed estimate of the flying capabilities of the aircraft. This included an analysis of several flight control system related problems that contributed adversely to the control of the aircraft. Analysis of the rudder control system indicated a possible degradation of hinge moment capabilities of the lower rudder after separation of the engines. Although it was shown that this had a significant adverse effect on controllability, no conclusions could be made with regard to the cause of this failure mode. Analysis of the reconstructed model using several control strategies indicated that from a technical point of view the accident aircraft was recoverable. However, the required procedures evaluated for the recovery are not part of current industry training practices for complex in-flight emergencies or handling qualities in degraded modes. It is therefore understandable that a successful recovery of the aircraft under the prevailing conditions was highly improbable.
7.2 Recommendations The following general recommendations can be made as far as the aircraft accident case and described investigation techniques are concerned.
-36-
NLR-TP-2003-392
For aircraft control in case of a degradation of performance and controllability, the analysis indicates that: - Control of the aircraft should have a first priority. - If control of the aircraft can still be maintained, time should be used for an assessment of the remaining performance and control capabilities and, where necessary, try to improve it (e.g. jettison of fuel). - Unusual attitude recovery techniques may be required to regain control of the aircraft. - Configuration changes (e.g. flaps and landing gear) should be kept to a minimum. - Special care should be given to airspeed and angle of attack in degraded flight conditions. Further degradation of performance and controllability may be expected at the reduction of airspeed and increase of angle of attack. For an emergency landing in these conditions, higher than nominal approach speeds should be considered. The selection of flaps should not be considered. - Awareness of the pilot regarding performance and controllability limits in a (severely) degraded flight condition may increase the survivability of the aircraft. Methods for in- flight failure accommodation may assist the pilot in flying the aircraft or function as an advisory by providing information concerning the (degraded) flight envelope. - Apart from training of multiple system failures, flight crews should be more familiarised with conditions in which the performance and controllability of the aircraft are compromised. This includes demonstration of aircraft control and the application of thrust in degraded (asymmetric) modes as part of standard training practices. The presented modeling and simulation techniques may be used as a practical tool for reconstruction and simulation of vehicle and system dynamics under specific failure mode conditions in case operational recorded data is available. Depending on the application, the applied methods and simulation techniques may be modified or developed further.
For the application of flight data for accident investigation purposes, the quality of DFDR data should be further improved. Specifically, to make recorded vehicle data more suitable for computer processing, simulation and analysis, the sample rate of the data should be as high as possible.
The reconstructed model of the accident aircraft may be further used as a research tool to evaluate advanced flight control techniques on their performance to accommodate in-flight failures.
-37-
NLR-TP-2003-392
8 References
1. EL AL Flight 1862, Aircraft Accident Report 92-11, Netherlands Aviation Safety Board, Hoofddorp, 1994. 2. EL AL Flight 1862. Results of Flight Data Recorder Analysis and Piloted Simulations, Boeing, May 17, 1993. 3. Smaili, M.H., Flight Data Reconstruction and Simulation of EL AL Flight 1862, Graduation Report, Delft University of Technology, Delft, 1997. 4. Flight Data Recorder Factual Report, Office of Research and Engineering, National Transportation Safety Board, Washington D.C., 1992. 5. Een Beladen Vlucht, Report Dutch Parliamentary Inquiry, SDU 1999. 6. Broos, P.M., EL AL Flight 1862 Performance Capability Evaluation, June 1993. 7. Van der Linden, C.A.A.M., DASMAT- Delft University Aircraft Simulation Model and Analysis tool, LR-781, Delft University of Technology, Delft, 1996. 8. The Simulation of a Large Jet Transport Aircraft, Vol. I: Mathematical Model, NASA CR- 1756, March 1971. 9. The Simulation of a Large Jet Transport Aircraft, Vol. II: Modeling Data, NASA CR- 114494, September 1970. 10. Boeing 747 Aircraft Operations Manual, Royal Dutch Airlines, 1976. 11. Boeing 747 Maintenance Manual, Royal Dutch Airlines. 12. Fischenberg, D., Ground Effect Modeling Using a Hybrid Approach of Inverse Simulation and System Identification, AIAA Modeling and Simulation Technologies Conference, Conference Proceedings, Portland, Oregon, 1999. 13. In-Flight Engine Separation Japan Airlines, Inc, Flight 46E, Boeing 747-121, N473EV Anchorage, Alaska, USA, NTSB/AAR-93/06.
-38-
NLR-TP-2003-392
Appendix A 3D visualisation of the accident flight
The figures on the following pages demonstrate the 3D-visualisation capabilities of the analysis software as used for reconstruction of the accident flight. A 3D profile of the reconstructed flight from takeoff up to the final stage of flight is illustrated in the figures a-k. Figures l-o show a 3D visualisation of a control loss recovery strategy applied to the reconstructed model. Simulation was performed using the on-line analysis capabilities of the simulation environment.
a) t=137 s: Initial climb after takeoff b) t=367 s: Separation engines no. 3 and 4
c) t=443 s: Right turn / high performance d) t=618 s: High thrust / low climb capability degradation
-39-
NLR-TP-2003-392
e) t=648 s: Flaps 1 selected / MCT thrust f) t=708 s: Heading 120
g) t=768 s: Final turn / start of performance h) t=788 s: Loss of lateral control margins degradation
i) t=808 s: High performance degradation j) t=848 s: Application of thrust / loss of flight control
-40-
NLR-TP-2003-392
k) t=863 s: Engines no. 1 and 2 at full thrust / flight control lost
l) Control loss recovery strategy m) Control loss recovery strategy t=859 s: Power levers idle / column forward t=869 s: Left bank / maximum thrust
n) Control loss recovery strategy o) Control loss recovery strategy t=890 s: Altitude recovery / TOGA thrust t=1004 s: Steady climb / MCT thrust