by Michael Blume
| University of Bielefeld - Faculty of technology | |
|---|---|
|
Networks and distributed Systems
Research group of Prof. Peter B. Ladkin, Ph.D. |
|
| Back to Abstracts of References and Incidents | Back to Root |
The Aviation Week article (1) contains a synopsis of the final report of the Japanese Aircraft Accident Investigation Committee into the tail-first crash of China Air 140 into the runway at Nagoya on 26 April 1994, along with further information on the history of the A300 flight-control design for automatic/manual interactions. Information here on these aspects comes from (1).
Some background for non-flyers: the aircraft was flying a `precision approach' on Nagoya's ILS (instrument landing system). An ILS consists of two parts: a split radio beam (the `localizer') aligned with the runway centerline which tells an aircraft if is left or right of the centerline; and an oblique radio beam (the `glideslope') of between 3 and 5 degrees downslope which leads to the `touch-down zone' of the runway. Normally, a pilot or autopilot flies the localizer and glideslope more or less exactly, and in bad weather the pilot must see the runway, a relevant part thereof, or one of the myriad runway lighting systems at or before `Decision Height' (DH) in order to land. DH is normally 200 ft. AGL (above ground level) but for an airport and airplane equipped and a crew certified for `Category III' approaches, it can be 100 ft., 50 ft., or 0 ft. AGL. If a pilot cannot see the runway environment by DH, (s)he must `go-around', that is, stop the descent, initiate a climb to a predetermined altitude AGL, and either come back for another try or go to a different airport. Going around is also the normal safe manoeuver, whatever the weather, if the approach becomes `unstable', that is, if the aircraft diverges significantly from the localizer or the glideslope for any reason.
CA140 diverged from the glideslope because the autopilot was "inadvertently" switched into go-around mode by the pilot flying (the FO). In GA mode, the autopilot tries to get the airplane to climb out instead of descending. Instead of aborting the unstable approach and going around (which as well as being normal procedure would also have "pleased" the autopilot!), the FO tried to regain the glideslope and complete the landing. He failed, disastrously. Pilots of all types have found this accident to be very strange - noone could intuitively understand why the China Air pilots didn't go around, a procedure that would have been drilled into them since their very first flying hours, and why instead they `fought' the autopilot for nearly three-quarters of a minute before taking other action. Also, after a combined total of over 2,600 hours in the A300-600, one would imagine the pilots should know how the autopilot functions. And all pilots know how to disconnect it quickly. The A300-600 is not a fly-by-wire airplane: manual control is conventional, via hydraulics, cables and mechanical links. The automatic flight control system (`autopilot', `flight director'), however, is electronic, digital and programmable. This accident involves, then, primarily human/computer interaction, as the report implicitly confirms.
Non-flyers may also need an explanation of the notion of angle of attack (AOA), the angle that the wing makes with the `relative wind'. The relative wind is the direction of air flowing over the wing, specified relative to the wing. So when the wing makes an an angle of 10 degrees (up) to the relative wind, the angle of attack is said to be 10 degrees. The lift generated by the wing is dependent upon the AOA, increasing with increasing AOA, up to a given AOA at which the wing stalls (the airflow separates and the lift forces disappear). So, when airplanes must climb in a hurry, it's optimal to increase thrust and to configure the airplane at an AOA as high as possible, but lower than the stall AOA. Note that the thrust of the engines will also be pointing `down' to the relative wind, thus giving a component of lift directly from the engines themselves. Thus standard stall-recovery techniques in straight-ahead flight for all airplanes are to lower the nose (thus decreasing the AOA) and increase engine thrust. Ways to accomplish this will depend on the airplane and the attitude it is in. Alpha-floor mode on Airbus automatic control systems is designed to increase AOA as far as possible without stalling, and increase thrust, to enter an optimal climb configuration for the airplane. The idea is that the airplane automatic control can probably do this more accurately than many human pilots can.
A final term or two: most transport-category airplanes, including the A300/A310 series, but not including the A320/330/340 series, have a control column, a vertical column rising up from the floor between the pilot's legs. The control column has forward/backward motion to activate the elevator (on the tail) which causes the airplane to pitch up (backward movement) or down (forward movement). On top of the control column is the yoke, a pair of connected `cowhorns' rather like a short mountain-bike handlebar, but with the cowhorns (`handgrips') pointing directly upwards. The yoke has additional rotational motion (left-grip-down/right-grip-down) which causes the airplane to bank left/right. The rudder (nose-left/nose-right) is controlled by foot pedals. A turn is effected by both bank and rudder, and a climb/descent by pitch (forward/backward on the column). The word `yoke' is often used for the entire column also.
Partly as a result of this accident, the FAA reviewed China Air's training and recurrent training procedures. See also the China Air B747 incident of 1985.
The report on the Nagoya accident said that the crash was the result of the pilots fighting the autopilot. It concluded that the pilots were inadequately trained in the "use and operational characteristics " of the autopilot. It also faulted Airbus Industrie's cockpit design, specifically the position of the autopilot's TOGA (takeoff/go-around) lever beneath the throttle; and "unclear writing" in the Flight Crew Operations Manual (FCOM) (1).
The US National Transportation Safety Board has accepted the findings of the report, as did Taiwan's Civil Aeronautics Administration (with only minor reservations). But the opinion of the French Bureau Enquètes Accidents differs in certain aspects, and the report includes a rebuttal of the BEA view (1).
Weather was not a factor: Wind was from 280 degrees @ 6 knots, sky was clear, visibility 12.5 statute miles. CA140 had been cleared to land, stalled 1,800ft above the runway approach end and hit the ground tail-first. 249 passengers and 15 crew died, 7 survived. The hull burnt.
The aircraft, serial number B-1816, was completed January 1991 and had been 8,572 hours in operation. The captain (C) was 42, had 4,826 hours of air force flight service, 2,164 hours in B747-200/400 airplanes, 1,624 hours in A300-600 airplanes. The 26-yr-old first officer (FO) had 1,624 hours total flight time, including 1,034 in the A300-600.
The report describes the accident as follows (1):
The FO was flying the approach with the flight director (FD) guidance system and autothrottle engaged. He activated the TOGA switch inadvertently (time T) at 1,070 ft altitude. This caused the FD to issue pitch commands for a go-around. C advised FO that GA mode had been engaged and told him to "retard a little and disengage". Autothrottle was disengaged and thrust manually increased. The aircraft levelled at 1,030 ft (the aircraft would be thus diverging from the glideslope).
At T+12, autopilots 1 and 2 were manually engaged (the report supposed that the crew may have thought that the autopilots would recapture the glideslope, according to (1)). The autopilot automatically went into GA mode, and this would have shown on the primary flight display. The aircraft was flying 18 degrees nose-up, normal for a go-around, but the FO was pushing heavily on the yoke to get the nose down. He was meeting heavy resistance, a design indication on almost all airplanes that that his manual commands were in conflict with the autopilot. For nearly 20 seconds, as he applied down-elevator, the autopilot moved the trimmable horizontal stabilizer (THS) in the opposite direction to keep the nose up. At T+30, THS reached maximum nose-up; at T+42, the autopilots were disengaged. C asked for autothrottles engaged and took control, increasing down elevator to full deflection as the aircraft began climbing. Alpha-floor (an Airbus automatic protection mode) triggered at T+50 from excessive AOA. Alpha-floor triggered maximum thrust for climb-out, but that in fact increased the nose-up attitude to 52.6 degrees (one may surmise that the thrust centerline is below the rotational center of the airplane, and at low speed there is not much aerodynamic force to maintain resistance to this rotation). (52.6 degrees is very steep. A high-friction granite rock face of this angle would nevertheless be considered a technical rock climb.) C disengaged alpha-floor by retarding thrust and tried to get the nose down again with trim. Airspeed had dropped to 78 kt., the aircraft stalled at 1,800 ft, and control was not regained before it hit the ground.
The cockpit voice recorder (CVR) shows the pilots were confused as to why the aircraft was not responding to the heavy manual nose-down command, despite C's recognising that GA mode had been engaged. C at first counselled calm, but frustration increased with the the out-of-trim condition, and a rapid set of instructions from C to FO appear to have increased FO's anxiety.
The autopilot on all transport-category aircraft including this one can be manually disengaged by pushing the red autopilot-disconnect button on the handgrip of the control wheel. There is also an on/off switch on the cockpit forward control panel of A300/310 series aircraft which can be used to disconnect the autopilot.
The accident aircraft had automatic yoke-force disengagement of the autopilot inhibited below 1,500 ft AGL to avoid accidental disengagement of the autopilot during automatic landings. Airbus had already issued service bulletin SB A300-22-6021 recommending modification of the flight control computer (FCC) to allow disengagement by significant control column force above 400 ft AGL. China Air had not modified the accident airplane to SB A300-22-6021. Airbus "resisted changing its autopilot software below 400 ft. [sic] out of concern that pilots would have insufficient time to recover control if they inadvertently moved the yoke during an automatic blind landing." (1). However, in March 1996 Airbus modified the system to deactivate below 400 ft. against yoke pressure of 45 lb. push and 100 lb. pull.
The Committee
Back to `Incidents and Accidents' Compendium.
| Copyright © 1999 Peter B. Ladkin, 1999-02-08 | |
|
|
by Michael Blume |