Turbine Pilot: Introduction

A fabled fuel stop

The view on final as a King Air 350 approaches Runway 7 at a historic transatlantic stop en route to Iceland.

Where: Narsarsuaq, Greenland

Photographer: Peter Herr, Textron Aviation

I’ve been watching the fly-by-wire (FBW) scene, and sometimes I get concerned. Can we really understand what goes on in an FBW system? The December 28, 2014, AirAsia Flight 8501 fatal accident that took place in the Java Sea involved an Airbus A320 that apparently suffered failures of its FBW flight augmentation computers, which control rudder travel limits. Normally, the computer logic automatically limits rudder travel at high airspeeds.

But on the day in question, while flying at 38,000 feet and circumnavigating thunderstorms, cockpit annunciators warned of no fewer than four repetitive failures of the rudder limiters. This airplane had a history of these warnings. Three days earlier the computers had annunciated a failure of the limiter units on the ground. Mechanics “fixed” the problem by pulling the computer circuit breakers, then resetting them. It worked.

Would this method work if there were warnings while airborne? The Indonesian National Transportation Safety Committee learned that engineers had told the crew that the reset could be done any time the annunciators came on. That’s what the crew did in flight.

Instead of extinguishing the warning lights, the airplane’s autopilot and autothrottles disconnected, control laws reverted from Normal to Alternate (which cancels the usual flight envelope protection features), and the A320 began a sudden, uncommanded roll 57 degrees to the left. The first officer reacted by banking right and entered an 11,000-fpm climb. Then the airplane stalled.

The captain tried to lower the nose, but forgot to push a switch that would take control away from the first officer. So, according to protocol, the Airbus’ FBW system averaged the two pilots’ inputs. The wings were leveled, but it was too late. The A320 was in a deep stall and descended at 12,000 fpm to the water. No probable cause was issued, but the NTSC recommended upset training.

So, unbeknownst to the crew, there was one set of control laws when the breakers were pulled on the ground, and another when in the air. Cracks relating to overheating were then blamed for the limiter failures. Airbus responded by saying that with few exceptions, breakers should not be reset in flight.

It makes you wonder. Now Google is testing its 53-car fleet of driverless cars. So far, so good, the company says. But some cars have been acting up. In 272 cases human drivers had to take over when the software failed. And cars would stop if they “saw” a trash bag on the road, whereas a driver would steer around it.

Engineers who create automated controls—like good pilots—are always learning. But perfection may never be achieved. The moral: Pilots of FBW airplanes should get training in upset recovery techniques. —Thomas A. Horne, Turbine Pilot Editor