From: rdd@rascal.ics.utexas.edu (Robert Dorsett)
Newsgroups: sci.aeronautics
Subject: Re: A320/automation...
Date: 25 Jul 1992 22:04:29 -0500
Organization: UTexas Mail-to-News Gateway
Distribution: world
Reply-To: rdd@rascal.ics.utexas.edu
NNTP-Posting-Host: cs.utexas.edu
Keywords: A320, 747-400, FMS

In article <36129@sdcc12.ucsd.edu> ericg@jeeves.ucsd.edu (Eric Geerdes) writes:
>
>On the accident in Germany...

The two European crashes were in France, one at Habsheim, one near Strasbourg.
I assume that in your discussion, you were referring to the 1988 crash
at Mulhouse-Habsheim aerodrome.


>Did you realize that the FD and the Fly-By-Wire on that A320 may 
>well have saved the lives of the passengers and crew?  Because the 
>pilot may have thought his new A320 gave him *complete* envelope
>protection, he did a manuver that was nearly un-recoverable.  He was
>running around after the accident claiming the FBW system caused the
>accident.  He showed a plot of the positions of the throttles and the 
>pitch controls over time.  He got the "fire-wall-thrust" he asked for,
>but his full-back-on-the-yoke_(joystick) input was over-ridden by the FBW
>system and it didn't give him the stick he wanted, = crash.  
>So he's right?...NOT!

This is debatable.  The alpha-floor protection kicked in around 9 degrees
AOA, countermanding his pitch command.  The "static" alpha-floor AOA is
around 15 degrees.  Rather than interpret the pilot's *instantaneous* 
pitch-command, it was integrating it over time, anticipating the result.
As described by Airbus, this feature is intended to accomodate any 
control problems an excess rotational momentum may cause.

Airbus' Bernard Ziegler said the airplane was in a "black hole" from which it
couldn't recover.  I question whether a system which had provided instan-
taneous access to max-AOA (without slowing down the pitch-command) *and*
with even the marginal engine-power at spool-up, couldn't have "zoomed"
the 20 feet required to avoid the trees.   Now, at this point, one would
ask, even if this were *possible*, whether it could be done with conventional
flight instrumentation (i.e., no AOA indicator); perhaps not.


I am not an aero engineer, but any ASE's out there who would like to play 
with the numbers should be aware that a fairly complete copy of the Habsheim
crash's DFDR are available on rascal.ics.utexas.edu, via anonymous ftp.
I can provide more info on the airplane, winds, and tree-line, if needed.
The question I would like answered is: what is the latest point during the
approach that the airplane could have *conceivably* been saved?  


I'm fairly critical of the actions of the Habsheim crew, and, regardless
of what the airplane did or did not do, the mere act of flying low, slow,
idle, and dirty, with 130 passengers on board, was irresponsible.  I am,
on the other hand, highly skeptical of Bernard Ziegler's "black holes"
(also described as the cause of the Bangalore crash).

The system may, indeed, have performed to spec.  But that spec. may have
limited pilot authority in a manner that caused the crash.  This is one
unique crash, not applicable to how *any* airliner *should* be flown, 
and embodies circumstances not considered in the design of the A320 EFCS--
and, perhaps, they *shouldn't* have been.  Airliners do not normally engage
in much "nap of the earth" flying.  

However, I find it rather dishonest for the manufacturer to avoid *all* 
responsibility, **if**, indeed, there was enough aerodynamic reserve to pull 
the plane above the tree-line.  But there was a lot of prestige on the line.   
Airbus was defending the airplane as an *airplane*, against the expectations 
that it should have behaved conventionally, and not the "managed" ballistic
platform that it is, and is controlled as.  If Airbus truly has confidence
in its technology, it should have defended it on *those* terms.  But again,
too much was riding on the absolutely-clean bill-of-health.  The pilot
was at fault, and that was THAT.  End of discussion, and no independent,
detailed, comparative assessment of the aerodynamics of the crash.

I distrust "perfect" airplanes, especially ones which are the embodiment of
revolutionary technologies.  The French should have played it honest, rather 
than insisting that the airplane-- and French pride--was above reproach.  
An airplane with faults, that are publicly identified and fixed, is much more 
trustworthy, IMHO, than an airplane which one vaguely suspects is the 
beneficiary of high-level political and financial games.  Compare it to the 
early 727, a number of which crashed: does anyone think the A320 will 
*ultimately* achieve quite the same reputation for safey?  Pretty doubtful, 
and it really has little to do with the airplane.  


As for your assertion (not cited) that a relatively "flat" profile saved
the airplane, (a) it was not flat (rather, it was at a high AOA by that
point), and (b) there is no "crash" mode in the system, so the argument's 
largely irrelevant.  If there had been a building or an embankment in the 
airplane's path, or denser trees, it could have just as easily have gone 
"boom!" with no survivors.  What got the airplane into the crash (pilot
or interface) is debatable; how the airplane *survived* the actual crash 
is 99% luck.  In fact, if the high AOA was a contributing factor (and
it probably was), it's arguable that a stall into the trees might have been 
even more "survivable," with less kinetic energy to deal with.


>This and the other stuff above seem to point up the need for: 
>
>-pilots to try harder to adapt (well) to the growing 
>automation--understand the systems you have, while we try to make 
>them better.

So, in other words, accomodate training to conform to the interface,
rather than the interface to the pilot.  This is a "technology for 
technology's sake" argument.  If an optional technology cannot be
effectively designed to be used by the pilots, then it should find an
honored place on the R&D scrap-heap, and kept in "reserve" until such
time it is more appropriate.

I also don't see this as an automation issue.  I see it as an interface 
issue.  Flight control interfaces should be conventional as possible, without 
hard protections, even if done under the guide of a FBW system.  That much, 
at least, should be clear from the A320 experience, and clearly the other
manufacturers have learned from that lesson.  "Existential" system design, 
such as the A320's, is almost certain to miss failure modes, due to the
plethora of multiple hard protections and control modes (which affect both 
control laws *and* system reconfiguration and flight-surface authority). 
Since *all* of that software is safety-critical (and not just advisory), we
have a potentially very unpleasant unpleasant situation, both in terms of
the effectiveness of the *interface* and in terms of the theoretical 
reliability requirement of the software.

In other words: conventional control systems work; don't fix what isn't
broken.  By introducing a non-standard control mechanism, Airbus might
well have substituted a mess of "interface" crashes for the sort of trivial
"out-of-envelope" crashes the system claims to protect the airplane from.

IMHO. :-)




---
Robert Dorsett
rdd@cactus.org
...cs.utexas.edu!cactus.org!rdd