Report details how Airbus pilots saved the day when all three flight computers failed on landing
- Reference: 1630940298
- News link: https://www.theregister.co.uk/2021/09/06/a330_computer_failure/
- Source link:
The result was a loss of thrust reversers and autobrake systems and the pilots having to use manual braking to bring the aircraft, a China Airlines A330-302, to a halt just 30 feet before the end of the runway. The incident happened at Taipei Songshan Airport on 14 June 2020.
The flight, CI202 from Shanghai with 87 passengers and nine cabin crew members, had been uneventful. The landing, however, was anything but.
[1]
[2]The final report [PDF] published by the Taiwan Transport Safety Board (TTSB) and reported in [3]The Aviation Herald details the incident as it unfolded.
[4]
[5]
It was raining at the airport as the aircraft approached so the runway was wet (although still well within margins). The captain disengaged the autopilot at approximately 773 feet and continued the approach. The A330 touched down between 1,500 and 2,000 feet from the runway threshold and then, judging by the report, everything went to Hell.
Three seconds after touchdown, an autobrake system fault was recorded. A second after that, faults were recorded on the primary flight control computers and the spoilers were retracted. Reverse thrust could not be applied and, a few seconds later, the captain called to the first officer to assist with manual braking. Both pilots then applied full brakes and the aircraft was eventually brought to a halt.
[6]
"Seems the pilots did a good job," a tame Airbus pilot told The Register . "You know it's bad when the captain tells the FO to help him on the brakes to stop the aircraft!"
As for the cause, the report pointed to the three Flight Control Primary Computers (FCPCs) becoming inoperative almost at the same time. Ground spoiler functionality needs one FCPC, autobrake arming needs two, and thrust reversers require an unlock signal from either FCPC1 or FCPC3.
According to the report: "The root cause was determined to be an undue triggering of the rudder order COM/MON monitoring concomitantly in the 3 FCPC. At the time of the aircraft lateral control flight law switching to lateral ground law at touch down, the combination of a high COM/MON channels asynchronism and the pilot pedal inputs resulted in the rudder order difference between the two channels to exceed the monitoring threshold."
[7]
The result was FCPC1 failing. Control of the flight system was then handed over to FCPC2 and 3 in sequence, both of which also experienced COM/MON channel asynchronism and became inoperative.
[8]NASA tests flying taxis made by biz dreaming of being the Uber of the sky
[9]Smoking smartphone sparks emergency evacuation of Alaska Airlines jet, two taken to hospital
[10]Japan's aerospace agency hooks up with Boeing to make planes quieter when they land
[11]Alan Turing Institute to spend UK.gov grants on AI for air traffic control and banking
COM (Command) and MON (Monitor) is a standard protocol for Airbus Fly By Wire aircraft, with the monitor watchdog switching to another computer (command) in the event inputs diverge outside of acceptability. As our Airbus pilot put it: "Stick monkey (or autopilot) puts in command and clever Franco-German computer monitors input for correctness."
In this instance, the aircraft was shifting from flight to ground law as the pilot was applying the rudder (not particularly unusual, especially if there is crosswind on landing). Since the rudder deflects differently between ground and flight law a conflict occurred and the system was flagged as faulty. Then the same thing cascaded through the second and third FCPCs.
Airbus noted that it was the first triple fault at touchdown since the A330/A340 aircraft had entered service (and the electrical rudder-fitted family had put in 44.3m flight hours up to April 2020).
The immediate action taken was to remind operators of what to do in the event of such a triple failure. Longer term, however, is a software enhancement "to address the root cause."
According to the report, Airbus's modification, which is targeted to arrive by Q3 2022 for the A330-200 and A330-800, Q3 2023 for the A330-300, and mid 2024 for the A330-900, will include:
Decrease of the COM/MON asynchronism level for the flight/ground information treatment
Improvement of the COM/MON rudder order monitoring robustness in case of ground to flight and flight to ground transitions
Higher unitary monitoring robustness during such transitions
Avoid cascading/"domino's" effect that leads to several PRIM fault
The Register asked Airbus for its response to the report, but the aviation giant has yet to comment.
In a world of increasing automation, the incident serves as a reminder of the importance of keeping a human backup in the loop. ®
Get our [12]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YTY7O-r5uDxoUdGZJPapSgAAAFE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://www.ttsb.gov.tw/media/4913/ci202_executive-summary_release.pdf
[3] https://avherald.com/h?article=4d97ca46&opt=0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YTY7O-r5uDxoUdGZJPapSgAAAFE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YTY7O-r5uDxoUdGZJPapSgAAAFE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YTY7O-r5uDxoUdGZJPapSgAAAFE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YTY7O-r5uDxoUdGZJPapSgAAAFE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2021/09/02/nasa_joby_faa/
[9] https://www.theregister.com/2021/08/24/alaska_smartphone_fire/
[10] https://www.theregister.com/2021/08/20/jaxa_boeing_acoustic_research/
[11] https://www.theregister.com/2021/07/23/turing_ai_grant/
[12] https://whitepapers.theregister.com/
Hit the brakes hard?
Something that Tesla drivers should also keep in mind.
"Seems the pilots did a good job,"
The pilots did a fucking Grade-A job. Kudos to them.
Now we really need to know how it is that a triple system went haywire like that, because the last thing the aviation industry needs now is for yet another entire airliner model to be grounded.
Re: "Seems the pilots did a good job,"
THE " other entire airliner model"
WTH?
I read that as "we failed to allow for required monitoring initialisation on state change"?
Re: WTH?
Perversely this is where the process that Tesla followed to check for obstructions would have been a good thing. You restart your checks on handover by which time things like the transition of sensors from air mode to ground mode is likely to have completed.
Automation Issue
Even with 'AI' or humans sometimes, the unexpected, unanticipated require an almost instinctive reaction that is not in the book or program. Humans often can correctly make these reactions while 'AI' often fails. For 'AI' the issue is what scenarios has it not been 'trained' or programmed to handle. The proper questions to ask are:
What scenarios is not 'AI' not 'trained' or programmed to handle? (I had an engineering professor note often the best question to ask is the inversion of the sales spiel)
What is the fail safe mode for the device?
Can a human take full control of the device?
In aviation, there have been many cases were the skill of the pilots to handle an unexpected and dangerous situation almost instinctively have saved many lives. Sometimes these events are well known ('Miracle on the Hudson'), others like this are only found digging through incident/accident reports. I am not sure an 'AI' system would have been able to successfully resolve these situations in most cases.
how long is each FCPC allowed to be failed for?
do they need a tech to plug into the aircraft and clear the fault or is it a turn off/on affair?
seriously though, there should be some system that can have a FCPC do a check and see if its safe to go back into the pool once, perhaps, a transitory issue has passed. if critical functions such as auto brake and spoilers are dependant on FCPC's being available then there should be something the pilots could do to have the systems try again.
maybe a big flashing green button could be hit to at least try?
Might be more trustworthy on an Airbus than a Boeing?
Only on landing?
Airbus's modification, which is targeted to arrive by Q3 2022 for the A330-200 and A330-800, Q3 2023 for the A330-300, and mid 2024 for the A330-900
That's a few hundred planes flying until Q3 2022 with a known bug that can shut down all flight computers during landing, a few hundred more until Q3 2023, and hundreds on order that won't be fixed until mid-2024. Cool, cool.
The immediate action taken was to remind operators of what to do in the event of such a triple failure
Hit the brakes hard ?