From: dominop@en.ecn.purdue.edu (Philippos A. Peleties)
Newsgroups: sci.aeronautics
Subject: Re: A320/automation...
Keywords: A320, 747-400, FMS
Date: 26 Jul 92 18:03:12 GMT
Article-I.D.: en.1992Jul26.180312.14995
Organization: Purdue University Engineering Computer Network

In article <CMM.0.90.2.712119823.rdd@rascal.ics.utexas.edu> rdd@rascal.ics.utexas.edu writes:
>In article <36129@sdcc12.ucsd.edu> ericg@jeeves.ucsd.edu (Eric Geerdes) writes:
>>
>>On the accident in Germany...
>
>The two European crashes were in France, one at Habsheim, one near Strasbourg.
>I assume that in your discussion, you were referring to the 1988 crash
>at Mulhouse-Habsheim aerodrome.
>
>
>>Did you realize that the FD and the Fly-By-Wire on that A320 may 
>>well have saved the lives of the passengers and crew?  Because the 
>>pilot may have thought his new A320 gave him *complete* envelope
>>protection, he did a manuver that was nearly un-recoverable.  He was
>>running around after the accident claiming the FBW system caused the
>>accident.  He showed a plot of the positions of the throttles and the 
>>pitch controls over time.  He got the "fire-wall-thrust" he asked for,
>>but his full-back-on-the-yoke_(joystick) input was over-ridden by the FBW
>>system and it didn't give him the stick he wanted, = crash.  
>>So he's right?...NOT!
>
>This is debatable.  The alpha-floor protection kicked in around 9 degrees
>AOA, countermanding his pitch command.  The "static" alpha-floor AOA is
>around 15 degrees.  Rather than interpret the pilot's *instantaneous* 
>pitch-command, it was integrating it over time, anticipating the result.
>As described by Airbus, this feature is intended to accomodate any 
>control problems an excess rotational momentum may cause.
>

It sounds like an anti anti-lock brake argument :-)

I think Erik has a point here. If I recall correctly the plane crashed
at a relatively high AOA but almost flat trajectory. In essence it almost 
"landed" into the forest. Had it not done so (aside from clearing the tree
tops ofcourse!) its my guess that it would have nosed down, a worse situation
than the former.


>Airbus' Bernard Ziegler said the airplane was in a "black hole" from which it
>couldn't recover.  I question whether a system which had provided instan-
>taneous access to max-AOA (without slowing down the pitch-command) *and*
>with even the marginal engine-power at spool-up, couldn't have "zoomed"
>the 20 feet required to avoid the trees.   Now, at this point, one would
>ask, even if this were *possible*, whether it could be done with conventional
>flight instrumentation (i.e., no AOA indicator); perhaps not.
>

So what are you saying? That the aircraft had sufficient energy to avoid the
tree tops and go on from there with eventual recovery? If this were possible 
but could not be done with conventional flight instrumentation, then ... what
is your point?

>
>I am not an aero engineer, but any ASE's out there who would like to play 
>with the numbers should be aware that a fairly complete copy of the Habsheim
>crash's DFDR are available on rascal.ics.utexas.edu, via anonymous ftp.
>I can provide more info on the airplane, winds, and tree-line, if needed.
>The question I would like answered is: what is the latest point during the
>approach that the airplane could have *conceivably* been saved?  
>
>
>I'm fairly critical of the actions of the Habsheim crew, and, regardless
>of what the airplane did or did not do, the mere act of flying low, slow,
>idle, and dirty, with 130 passengers on board, was irresponsible.  I am,
>on the other hand, highly skeptical of Bernard Ziegler's "black holes"
>(also described as the cause of the Bangalore crash).
>
>The system may, indeed, have performed to spec.  But that spec. may have
>limited pilot authority in a manner that caused the crash.  This is one
>unique crash, not applicable to how *any* airliner *should* be flown, 
>and embodies circumstances not considered in the design of the A320 EFCS--
>and, perhaps, they *shouldn't* have been.  Airliners do not normally engage
>in much "nap of the earth" flying.  

Which more points to the irresponsibility of the whole exercise of flying low,
dirty with 130 passengers. It is not unreasonable to think that the pilots did
indeed put the plane in a situation where it was not physically possible to
recover, A320 or otherwise. I think from the three crushes *this* one is the
least suspicious one from the aircraft's perspective (IMHO).

>
>However, I find it rather dishonest for the manufacturer to avoid *all* 
>responsibility, **if**, indeed, there was enough aerodynamic reserve to pull 
>the plane above the tree-line.  But there was a lot of prestige on the line.   
>Airbus was defending the airplane as an *airplane*, against the expectations 
>that it should have behaved conventionally, and not the "managed" ballistic
>platform that it is, and is controlled as.  If Airbus truly has confidence
>in its technology, it should have defended it on *those* terms.  But again,
>too much was riding on the absolutely-clean bill-of-health.  The pilot
>was at fault, and that was THAT.  End of discussion, and no independent,
>detailed, comparative assessment of the aerodynamics of the crash.
>
>I distrust "perfect" airplanes, especially ones which are the embodiment of
>revolutionary technologies.  The French should have played it honest, rather 
>than insisting that the airplane-- and French pride--was above reproach.  
>An airplane with faults, that are publicly identified and fixed, is much more 
>trustworthy, IMHO, than an airplane which one vaguely suspects is the 
>beneficiary of high-level political and financial games.  Compare it to the 
>early 727, a number of which crashed: does anyone think the A320 will 
>*ultimately* achieve quite the same reputation for safey?  Pretty doubtful, 
>and it really has little to do with the airplane.  
>

Why so? "..it does has little to do with the airplane"?? I trust by
"reputation" you do not mean "how it is viewed by the average Joe".

>
>As for your assertion (not cited) that a relatively "flat" profile saved
>the airplane, (a) it was not flat (rather, it was at a high AOA by that
>point), and (b) there is no "crash" mode in the system, so the argument's 
>largely irrelevant.  If there had been a building or an embankment in the 
>airplane's path, or denser trees, it could have just as easily have gone 
>"boom!" with no survivors.  What got the airplane into the crash (pilot
>or interface) is debatable; how the airplane *survived* the actual crash 
>is 99% luck.  In fact, if the high AOA was a contributing factor (and
>it probably was), it's arguable that a stall into the trees might have been 
>even more "survivable," with less kinetic energy to deal with.
>
>
>>This and the other stuff above seem to point up the need for: 
>>
>>-pilots to try harder to adapt (well) to the growing 
>>automation--understand the systems you have, while we try to make 
>>them better.
>
>So, in other words, accomodate training to conform to the interface,
>rather than the interface to the pilot.  This is a "technology for 
>technology's sake" argument.  If an optional technology cannot be


Not an excuse but a reality. Training is almost *always* used to mask out
*perceived* system inefficiencies. It is a matter of degree at this point not
whether it is/should happen.


>effectively designed to be used by the pilots, then it should find an
>honored place on the R&D scrap-heap, and kept in "reserve" until such
>time it is more appropriate.
>


>I also don't see this as an automation issue.  I see it as an interface 
>issue.  Flight control interfaces should be conventional as possible, without 
>hard protections, even if done under the guide of a FBW system.  That much, 
>at least, should be clear from the A320 experience, and clearly the other
>manufacturers have learned from that lesson.  "Existential" system design, 
>such as the A320's, is almost certain to miss failure modes, due to the
>plethora of multiple hard protections and control modes (which affect both 
>control laws *and* system reconfiguration and flight-surface authority). 
>Since *all* of that software is safety-critical (and not just advisory), we
>have a potentially very unpleasant unpleasant situation, both in terms of
>the effectiveness of the *interface* and in terms of the theoretical 
>reliability requirement of the software.
>

>In other words: conventional control systems work; don't fix what isn't
>broken.  By introducing a non-standard control mechanism, Airbus might
>well have substituted a mess of "interface" crashes for the sort of trivial
>"out-of-envelope" crashes the system claims to protect the airplane from.
>


What is in your opinion a *justifiable* reason from introducing a new design
(more, next level of technology) whether in aircraft design, automobile design,
etc (aside from fixing a previous problem)? Do you support the ex-Soviet
approach (the approach might still not be ex- mind you :-) ) of pushing a
given (current) technology to its limit before we jump to the next generation
one?


>IMHO. :-)
>
>
>
>
>---
>Robert Dorsett
>rdd@cactus.org
>...cs.utexas.edu!cactus.org!rdd
>

Philip Peleties

-- 


I speak for myself, I think for myself, I work for myself ... but I don't want
to play by myself ... so bring your toys and let's share ...
Newsgroups: sci.aeronautics