The Controls DONT WORK!! Airbus Computer Nightmare
Summary
TLDRDuring a routine Airbus A320 type rating training in Estonia, a series of minor technical issues led to a catastrophic failure of the fly-by-wire system. With the aircraft uncontrollable, the pilots struggled to maintain control during takeoff, experiencing violent pitch oscillations. Despite multiple system failures and an engine fire, the pilots managed to land the aircraft safely after declaring an emergency. The investigation revealed inadequate training and guidance as contributing factors. Airbus and the airline implemented software improvements and more rigorous procedures to prevent similar occurrences.
Takeaways
- 😲 The video describes an incident during Airbus A320 type-rating training involving multiple computer failures leading to loss of control.
- 👨✈️ Four pilot trainees were completing required training to fly the A320 commercially in Europe with an experienced instructor.
- ✈️ During touch-and-go maneuvers, intermittent trim wheel issues caused computer failures dropping the aircraft into alternate control laws.
- 🛠 The captain repeatedly reset the computers but mistakes led to hidden failures reducing redundancy.
- ⛔ On the final takeoff, all computers failed due to a bounce triggering the aircraft into mechanical backup pitch mode.
- 😨 With pitch controls inoperative, the aircraft crashed during the takeoff run with gear retracting but miraculously became airborne again.
- 😰 The pilots struggled to control the crippled aircraft not designed for manual trim-only flight nearly leading to a catastrophic crash.
- 👍🏻 The safety pilot intervened enabling the captain to regain marginal control and land the aircraft safely with no fatalities.
- 📝 Airbus and the airline updated manuals and software to improve guidance for pilots and prevent similar hidden computer failures.
- 💪🏻 Despite an unprecedented emergency far beyond training, the pilots' skill and resilience saved the aircraft from disaster.
Q & A
What type of aircraft was involved in the incident?
-The aircraft involved was an Airbus A320-200 operated by SmartLynx Airlines.
What was the purpose of the flight?
-The flight was conducting touch-and-go landings as part of base training for new Airbus A320 pilots.
What triggered the loss of the flight control computers?
-A small bounce during landing led to a discrepancy between the ground and air mode logic in the flight control computers, causing them to fail.
What is mechanical backup mode?
-Mechanical backup is a degraded control law where pitch is controlled only through trim and thrust levers, with no elevator authority.
How did the pilots regain control of the aircraft?
-The safety pilot identified the manual pitch trim only condition, allowing the captain to control pitch using just the trim wheel.
What allowed the aircraft to keep flying after both engines failed?
-The ram air turbine deployed to provide hydraulic pressure. One engine may have continued to windmill, powering the hydraulics as well.
How much experience did the instructor pilot have?
-The instructor captain had over 24,000 flight hours, including 13,500 on the A320.
What was the outcome of the incident?
-The aircraft landed hard but intact, with no fatalities. All four pilots and the CAA inspector survived.
What changes resulted from the investigation?
-Airbus and SmartLynx updated procedures and checklists. Resetting computers inflight is now prohibited.
Could this accident have been prevented?
-Better training guidance and following standard callouts may have prevented the cascading failures.
Outlines
😐 First Pilot's Excitement and Dread
Paragraph 1 introduces the story, describing how becoming a pilot is a lifelong dream for many but sometimes training turns into a nightmare. It sets up the scenario of eager pilot trainees in Estonia ready for training on an Airbus A320, foreshadowing that something will go terribly wrong.
😟 Long Pilot Training Process
Paragraph 2 provides background on the extensive training required for commercial pilots in Europe. This includes flying small planes, getting a commercial license, training in multi-crew cockpits, and completing a specific type rating for the aircraft model they will fly.
🤔 Complex Airbus Flight Control System
Paragraph 3 gives an overview of the complex fly-by-wire system on the Airbus A320, including redundancy through multiple flight control computers. It explains the different control laws from normal to alternate to direct, which degrade protections when computers fail.
😐 More on Flight Control Laws
Paragraph 4 continues describing the flight control laws, the shifts between them, and how pilots are alerted. It notes that cautions don't activate below 1500 feet to avoid distraction at low altitudes.
😶 First Training Flights Begin
Paragraph 5 details how the first training flights begin uneventfully but issues arise when the instructor captain grabs the trim wheel override, triggering computer switches. The flights continue despite recurring faults and resets.
😱 Bounce Triggers Catastrophe
Paragraph 6 explains how a small bounce on the third trainee's landing led to both flight control computers shutting down due to timing discrepancies. This cascaded into mechanical backup pitch mode, setting the stage for the accident.
😨 Chaotic Loss of Control
Paragraph 7 describes the chaotic loss of control on the fourth trainee's flight as all computers failed. Despite the pilots' efforts, the aircraft impacted the ground, bounced back up, then entered a terrifying climb before the pilots regained some control.
😅 Miraculous Recovery and Landing
Paragraph 8 details how the pilots managed to get the severely damaged aircraft back under tenuous control. After both engines failed, they miraculously landed the plane safely with no remaining propulsion or proper flight controls.
🙂 Lessons Learned and Improvements
Paragraph 9 wraps up by noting investigation findings and improvements made by SmartLynx and Airbus after the incident. It highlights how small issues cascaded into disaster, leading to key lessons for training and operations.
Mindmap
Keywords
💡base training
💡touch-and-go landing
💡fly-by-wire
💡control laws
💡spoilers
💡ELAC
💡mechanical backup
💡manual pitch trim
💡stabilizer trim
💡engine failure
Highlights
The trainees were about to fly an Airbus A320 for the first time outside of the simulator as part of their type rating training.
The captain decided to continue the training despite recurring computer failures because there was no guidance limiting resets.
A small bounce during landing caused discrepant data between the aircraft's dual flight control channels, leading to multiple computer failures.
With all flight control computers failed, the aircraft entered an extremely rare mode called mechanical backup pitch.
In mechanical backup, the sidestick becomes useless and pitch is only controllable through trim and thrust levers.
The captain took over controls and incorrectly reduced thrust and flap, causing the aircraft to impact the ground at high speed.
After bouncing back into the air, the situation became chaotic with warnings and an engine fire until the safety pilot read the critical ECAM message.
The captain regained some control using only the trim wheel and throttle levers.
The captain wisely kept both damaged engines running as long as possible since they were needed for pitch control.
With both engines failed, the aircraft landed hard but intact, an absolute miracle given the circumstances.
Airbus introduced software improvements and prohibited in-flight computer resets after the incident.
The aircraft used fly-by-wire controls and degraded through various laws as computers failed.
SmartLynx and Airbus hadn't adequately guided crews on handling recurring computer faults.
The captain should have discontinued training given the recurring failures.
The pilots were shocked when normal controls became useless in mechanical backup mode.
Transcripts
- Becoming a pilot is, for many people, a lifelong dream.
To be able to touch the clouds
and feel that awesome raw power
of the engines surging through you on a daily basis
is something that they just have to achieve.
But what happens when the pinnacle,
the crowning of your pilot training turns
into an absolute nightmare?
Stay tuned.
(calm music)
On the 28th of February, 2018,
a group of eager, type-rating students
were getting ready for one of the biggest highlights
of their career so far
as they met out outside Tallinn Airport in Estonia.
They had just completed a grueling two months of theoretical
and practical simulator training
on the Airbus A320 and it was now time
for them to finally fly the real aircraft.
You see, in order to become a commercial pilot and fly
with passengers in Europe, a pilot student
must first go through initial training.
This includes flying in smaller, single-engine aircraft
up until they complete a skill test
for the commercial pilot license
and that normally takes around 200 hours
of flight time plus loads of theoretical exams.
Now once that's gone, the student also needs
to get certified to fly multi-engine aircraft
in instrumental conditions
and once those skills have also been verified,
it's time for something known
as a multi-crew coordination or MCC course.
In the MCC course, the students
will be instructed in the skills of flying
in a multi-pilot cockpit which is radically different
than flying by yourself, but even after that course is done,
the training journey is still far from over.
The last step is to do what's known
as a type-rating, which is where
the students learn the specific technical knowledge,
handling characteristics and procedures
of the aircraft type that they will actually fly
in their new company.
It's, by the way, in this part
of the training that they would get into contact
with me as I'm a type-rating instructor and examiner.
And me and my colleagues will then prepare
the students for the job that they will be expected
to master in their coming careers.
The type-rating training is started
by a technical course, followed by procedure instruction
in a fixed space, meaning a non-moving simulator
and then the handling and emergency training is completed
in a level D, full flight simulator
which acts extremely similar to the real aircraft.
But once the type-rating skill test is completed,
there's still one more step that needs to be done
and this is known as a base check or base training.
So what is that then?
Well, before the first flight
with passengers, every type-rating student needs
to have done at least six approved landings and takeoffs
in the real aircraft with the type-rating examiner.
So this is what this group of four students
were now about to do, the crowning of their type-rating
and the first real step in their professional pilot career.
They were greeted at the Tallinn Airport
by the 63-year-old type-rating instructor
and examiner who was going
to conduct the training with them.
And together with him, they walked
into the crew room to start planning for the flights.
Inside of the crew room, there were already
two more people waiting for them,
a 34-year-old first officer who was going to act
as safety pilot in case something
would happen to the captain
and a CAA representative who was going to follow along
to observe the training process.
The instructor captain in charge was a very experienced pilot
with over 24,000 hours of total time
and 13,500 flown on the Airbus A320.
The safety pilot who was going to support him
had around 3,000 hours in total
which was enough for the role
that he was being scheduled for.
Now as for the students, well, (chuckles)
they were completely new
with only around 220 hours of total experience.
Now, I know that a lot of my American colleagues out there
would be shocked when they hear this.
But in Europe it is quite common for low-hour cadets
to go straight from their flight schools
into the right seat of an airliner
since we don't have the 1,500-hour requirement over here.
Now obviously, this base check
is not the end of the training for these students,
it will just enable them to continue
their line training with qualified training captains,
but after a successful base check the type rating
will be added to their license
and they're officially allowed
to operate with passengers on board.
Anyway, the instructor started the preparation
with going through the weather for the day,
making sure that it was good enough
for the exercises he was planning.
A base check is a series of touch-and-go landings,
meaning that the aircraft will be flying circuits
around the airport and the landings tend
to be done with different flap settings
to make sure that the students understand
the different handling characteristics.
In the case of SmartLynx, the minimum requirement
for each student was five touch-and-goes
followed by one go-around and then one full-stop landing
before it was time to switch over to the next student.
The weather was okay, with some scattered clouds
at 1,100 feet, good visibility and a wind of 0.70 degrees,
nine gusting, 15 knots and a temperature
of -13 degrees Celsius, so it was a bit crispy.
The runway in Tallinn is oriented
in an almost straight east-westerly direction
so the wind was acceptable
as it would only cause a few knots of crosswind.
The aircraft that they were going to use
was one of SmartLynx's regular Airbus A320-200s,
which had been taken out of production on this day
to enable the base check to take place.
It was 18 years old and in full working condition,
at least as far as the crew
could see from its technical logbook.
Now the fact that this aircraft had to be taken
out of service to facilitate this training, obviously came
with some quite significant costs to the airline
and on top of that, the weather had to be good enough
and the schedule had to fit the instructor.
So once this check was underway, it is likely
that the instructor felt a little bit
of pressure to make sure that this was fully completed.
Anyway, once the weather briefing was completed,
the instructor proceeded with briefing
the students about the patterns that they were going to fly.
I will not go through the whole circuit profile here,
but what is going to be really important
for this story are the actions that the pilots have to do
from final approach and once the aircraft
is on the runway, since a touch-and-go landing
is very different from a normal landing.
According to the Airbus Flight Crew Training Manual,
the procedure looks like this:
Once the aircraft is turning final,
the landing flaps must be selected
and the captain would run through the landing checklist.
He would then remind the students
to not apply brakes and reversers
as doing that would lead to a full-stop landing.
The aircraft would then need to be fully stabilized
from at least 500 feet above the runway
and then flown to a, hopefully successful, nice landing.
Once the aircraft touches down, the trainee
would make sure to nicely land the nose wheel
and the captain would then disarm
the spoilers and call, "Stand them up."
The trainee would then move the thrust levers up
to about mid position to avoid the engine spooling down
whilst concentrating on also tracking the centerline.
Meanwhile, the captain would select flaps two,
reset the rudder trim if needed,
check forward movement of the stabilizer pitch trim
and then call, "Go."
When that order is given, the trainee would move
the thrust levers into the TO/GA detent
and once that's done, the captain would verify it
and call, "Thrust set," and then, "Rotate"
once the speed accelerates past the approach speed bug.
This would then be followed
by a normal rotation and once airborne,
the gear would be retracted and after this,
the aircraft would be climbed
to between 1,500 and 2,000 feet for the next touch-and-go.
Now as you can see, this is a hugely intensive exercise
but it's also close to about as much fun
as you can have in a commercial airliner
and I still get goosebumps
just thinking about my own base check.
In my case, back in the day, we actually used
to not have to do the full full-stop
so we changed over whilst the aircraft
was still airborne and on downwind.
Now I still remember that cockpit door
opening up, me being called in, strapping into the seat
and then looking out over my right shoulder
and for the first time, seeing that massive wing
instead of a black simulator wall.
Absolutely fantastic!
But absolutely fantastic is pretty far from
what these students are about to experience
and I will tell you all about it after this.
Now base training might well be fantastic
and so is making these videos
but they require an enormous amount of work to complete.
In order to get to the level of detail as I do here
in my videos I have to sit through, not only the final reports
but also newspaper articles and sometimes even blog posts.
During the production of one of my upcoming videos,
I won't tell you which one yet,
I came across a roadblock when the final report
was geo-blocked and not available for my location.
And that's when I turned
to the sponsor of this episode, NordVPN.
You see, Nord is an invaluable tool
for breaking through digital borders
and seamlessly connect
to servers worldwide at an impressive speed.
But they're not just about gaining access,
they've also developed advanced cybersecurity tools
to help you keep safe
from hackers, malware and phishing attempts.
So whether you're like me, researching or aiming
for secure and anonymous web surfing
or just want to access your favorite content
away from home, NordVPN has your back.
So if this sounds promising,
use the link here in the description below
which is nordvpn.com/pilot to get four free months
when you sign up for the two-year plan
and if you're not happy,
you have a full 30-day money-back guarantee.
Thank you, Nord. Now, let's see what happens here.
Now, what's about to happen in this story
is among the most technically-complicated things
that I've ever attempted to explain.
So you're going to have
to bear with me through a couple of system descriptions.
But before we reach that, remember what I just told you
about what the trainee and the instructor
had to do during the circuit?
Well, that description was taken
from the Airbus Flight Training Manual
but SmartLynx had not included that exact profile
in their own flight crew training techniques manual.
Specifically, there was no mentioning about arming
or disarming the spoilers in the company-specific version
and that will soon have some wild consequences.
Once the briefing was complete,
all seven crew members walked together out to the aircraft.
Now, this was the first time
that the type-rating students had a chance to see
and touch the actual aircraft in real life
and the instructor started by doing a full walk-around
with all of the students to highlight important things
that would be hard to have time to explain
during the hectic line-training that would soon follow.
Meanwhile, the safety pilot went
into the cockpit and started setting it up
to a limited extent so that when the captain arrived
with the first trainee, they would have saved some time.
Once the exterior inspection was finally completed,
everyone boarded the aircraft and the first trainee sat down
in the right seat with the instructor captain to the left.
The safety pilot was seated in the left jump seat
behind the captain and the CAA representative in the right.
The pre-flight procedures were completed
according to standard operating procedures
and at time 10:02, the trainee first officer asked Tallinn Ground
for start-up clearance and a few minutes later,
they started taxing out for take-off.
Once the before-take-off checklist was completed,
the captain lined the aircraft up
on Runway 08 and gave some final instructions
to the first officer for the first take-off.
Once that was completed, the first officer took over
the controls, moved the thrust levers forward
into the TO/GA detent and that caused
the almost empty aircraft to quickly
start accelerating down the runway.
They took off normally, retracted the gear
and climbed up to about 1,500 feet
before turning right for the first circuit.
Everything was working normally
at this point and the captain concentrated
on following the procedures whilst also instructing
the first officer on what to think about
during the first landing.
Like I mentioned before, this was the first time
that the trainee would have ever been
in control of such a large aircraft
outside of the simulator and in those situations,
it's easy to get slightly emotional
which can obviously affect the outcome.
Anyway, before we continue any further,
there are a few things that you need
to understand about the Airbus A320
for this story to make any kind of sense.
Let's first start with the fact
that this is a fully fly-by-wire aircraft,
meaning that all flight control inputs
the pilots are making will be routed
through several computers before the commands
are translated into actual movements
of the flight control surfaces.
Now, this is generally an excellent system
which both saves a lot of weight
and it also adds significant safety features to the aircraft
and that is because the computers
will not allow the pilots to exceed certain limit values
or over-stress the airframe under normal circumstances.
But as anyone who has ever owned a computer knows,
they sometimes fail and in order
for a simple or even double computer failure
to not affect the safety of the aircraft,
robust redundancies have also been built into the system.
I'll give you one example.
When the pilots want to move the aircraft nose up or down
around the pitch axis, the aircraft uses
the trimmable horizontal stabilizer
and the elevators in the aircraft tail to achieve this.
If the pilot moves the pitch trim
or the side-stick to tell the aircraft to pitch
these signals are then, in-flight, sent to a computer known
as the elevator aileron control or ELAC 2
which will then send the signals onwards to one
of the three electrical trim motors
and two of the hydraulic motors
controlling the stabilizer jack screw and elevators.
All of the flight control computers
have both a command channel,
which is executing the pilot's command
and a monitoring channel which is monitoring the outputs
to make sure that everything is working correctly.
Now if a failure of any sort
would affect the ELAC 2 computer
the system will automatically shift controls
over to ELAC 1 which will do the same job
like the previous computer
but using different electrical motors to do it,
making sure that everything still works.
But the redundancy doesn't stop there.
If ELAC 1 would also become faulty,
the commands are then shifted over
to another computer known as the spoiler elevator computer
or SEC 2 and if that one would also get bust,
it finally shifts over to SEC 1.
For the pilots in the cockpit,
the only thing that they would notice
if flight control computers would shift over
is a small jerk in the controls
but if multiple computers would start failing
at the same time, something known
as a degradation-in-control-laws might also happen.
If, for example, both ELAC
would fail simultaneously, the system would go
from normal law over to something known as alternate law
and if further failures would then continue,
the system would finally degrade into direct law.
So what does that mean then?
Well, in normal law, the Airbus avails
of all of its pre-programmed protections
that I mentioned before.
The pilots can control the aircraft with their side sticks
and the flight control surfaces
will position the aircraft proportionately
to the stick inputs irrespectively of speed.
If the system would then regress
back to alternate law, certain protections will be lost
like the max-roll protections, for example,
but the aircraft would still behave largely
in the same way as in normal law.
But if the aircraft would go into direct law,
the auto-trim function will be lost meaning
that the pilots would need to trim
the aircraft just like we do in the Boeing
and on top of that, the flight controls
would start to move exactly
like the pilots indicate, without any protections.
Now if the aircraft would degrade
into a lower law, it will always let the pilots know about it
through a single chime in the cockpit,
together with the master caution light
and ECAM messages on their screens,
explaining the problem and what the pilot needs to do.
But these cautions were programmed to only activate
above 1,500 feet to avoid distracting
the pilots at lower altitudes
and that's worth keeping in mind.
I know I've mentioned these laws
in many of my previous videos
but in this case we will soon get to see a part
of this system which very few of you have ever heard about
and it's quite terrifying but I'll get to that later.
What's also worth knowing about the system
is that it will transition between something known
as in-flight mode, flare mode
and ground mode during a normal landing.
And it will start transitioning
to ground mode about five seconds
after the aircraft senses touch-down.
Once the ground mode is activated,
the auto-trim system will start moving
the trimmable horizontal stabilizer to zero degrees in order
to prepare for the next flight
and this is something that we don't want to do
when we're practicing touch-and-go landings.
It's super important
that the trim is set at more or less the correct value
when we rotate for the next takeoff.
And in order to make sure that that was the case,
the captain was planning to grab the trim wheel
with his hand as it was being moved forward.
By doing so, he would activate
an override mechanism in connection
with the trim wheel which would stop the resetting
and leave the trim set correctly for the incoming rotation.
And this will also become important.
So the aircraft was now entering
downwind for the first touch and go.
The captain completed the after-takeoff checklist,
activated the coming approach in the FMC
and completed the approach checklist,
all whilst the trainee was handling the aircraft manually.
The captain then turned off the flight directors
and activated an indicator known as the flight path vector
to help give the students some guidance
and then briefed him about the landing that was coming up.
Once the aircraft passed
the touchdown point, they started timing
for three seconds for every 100 feet
they were above the ground, meaning about 54 seconds
from 1,800 feet minus one second for each knot of tailwind.
Since this was a touch-and-go manuever,
the aircraft had been left in flaps one configuration
so once the timing was out, flaps two was then selected,
together with gear down and eventually flaps three,
as the aircraft started descending.
Now here, the Airbus manual also stipulated that the spoilers
should be armed for landing but like I mentioned earlier,
this was not in the SmartLynx manual
so the captain decided to keep the spoilers down
since they would only need to be lowered
immediately after landing anyway.
Now this might seem like a logical thing to do
but the spoilers actually play an important role
in all landings and that is to spoil
the lift from the wings on touchdown to keep the aircraft
from bouncing and in normal conditions,
also to bring more weight onto the brakes.
Anyway, the aircraft continued
towards the final and as the trainee was making
the final turn, the captain selected full flaps,
completed the landing checklist
and reminded the trainee
to not select brakes or reversers after landing.
The first officer replied that he had understood this
and then they just continued descending.
The first landing was nicely executed
and once the nose wheel was safely down,
the captain continued according to plan
by calling, "Stand them up," moving the flaps to two
and then grabbing onto the trim wheel
as it was approaching one unit nose up.
And completely unbeknownst to the pilots,
now something really strange happened.
As the captain grabbed the trim wheel,
the override mechanism started moving
to stop the trimming but the piston
that was supposed to activate
the associated micro-switches
was not moving as quickly as it should.
This sent unreliable signals to the flight control computer,
ELAC 2, that was currently in charge,
triggering a switch over to the backup computer.
But since the backup, ELAC 1, also received
the same signals, this computer now also failed
and that sent the system down another notch,
activating SEC 2 and alternate law.
Now the pilots had no idea that this was happening
at this point since the caution
would only appear later as they passed 1,500 feet climbing.
Anyway the trainee pushed the thrust levers
into the TO/GA detent again and soon
the aircraft had accelerated past the approach bug
and the captain called, "Rotate."
The rest of the maneuver continued
just like the first takeoff and when the trainee leveled
at about 1,500 feet, the master caution warning went off,
together with a single chime and the information
about the failure popped up on the ECAM displays.
Now, the information shown said ELAC 1 and 2 pitch fault
and informed the pilots that they were operating in alternate law.
The captain took up the quick reference handbook
and read through the procedures
which simply instructed a computer reset
of each of the ELAC computers,
something that was relatively easy and quick to do.
So once this was done, the aircraft functioned
just like normal again so the captain decided
just to continue with the exercises.
The second touch-and-go landing went out
without any issues and warnings
but after the third landing once the aircraft was back up
at circuit altitude, the same warnings appeared again.
Now after the captain had again reset the computers,
he tried looking for any guidance
of limitations to the number of resets that were allowed
but couldn't find any in the Airbus manuals.
If this would have been a normal line flight,
he would have likely asked engineering for guidance
but since there was no specific guidance
in the minimum equipment list,
the aircraft was working perfectly fine
and this was not a revenue flight,
he instead again decided to continue.
The rest of the training session with the first trainee
was completely uneventful and after the last landing,
they did a full stop and taxied off the runway
to change over to the next student.
The second trainee then climbed
into the right seat and the exercises started all over again.
For the second student, there were less issues.
Only once did the ELAC 1 failure occur
and since this was only a singular failure,
there was no lower version
and no caution, just an ECAM message,
letting the crew know that it had happened.
The captain reset the system
a third time and then just continued.
So what was actually going on here?
Well, it was later noticed that the reason
that the override piston inside of the trim mechanism
wasn't moving correctly was because of the presence
of a non-approved oil inside of the cylinder.
This oil had a viscosity almost twice as high
as the correct oil would have had which impeded the piston
from correctly activating the microswitches.
But remember, the only time that this piston
should have had to be used in normal circumstances
would be during a runaway stabilizer event
where the pilots would need
to stop the incorrect movement of the stab trim manually.
And since that was such a rare event,
and it really, really is, this system was hardly ever used
nor was it tested during routine maintenance checks
so we will actually really never know
when this faulty oil was introduced
to the system or by whom.
Now had it only been for this small system issue,
this would not have become such a serious incident
but soon, some additional things were going to happen
in such a bizarre way that I couldn't really believe it
when I first read it.
When the second student had finished all of his landings,
the third student took place in the cockpit.
And it is in his session that the first
really important mistake will occur
that will ultimately lead to this accident.
The session started normally with a takeoff climb to 2,000 feet
and then a right turn to start the exercises.
After the first landing, the same problem reoccurred
as the captain was setting the stabilizer trim,
meaning that once again, the ELAC 1 failure appeared downwind.
The captain reset the computers
as he was getting quite used to doing at this point
but since these failures continued
to pop up at altitude, he never really connected them
with his use of the stabilizer trim override mechanism
which only happened on the ground.
Anyway, the second landing went very well without any failures
but on the third landing, again it appeared
but this time it was also associated
with a single chime for some reason.
The investigators were never able
to find out why this chime activated
since it was still only a single ELAC failure
but in any case the computer was again reset
and the exercises continued.
After the fourth landing, the same ELAC 1 failure appeared,
this time without that single chime
that had happened before but curiously,
this time the computer was never reset.
It is highly likely that whoever started working
on the ECAM message this time, accidentally pressed
the clear key instead of doing the reset.
And since this was not a critical fault,
the message would then be hidden
until someone pressed the recall button
for at least three seconds, something that would normally
only happen, according to standard operating procedures,
as part of a full pre-flight for the next full flight.
This meant that the aircraft now continued
to fly in normal law but with one ELAC already inoperative
and without that being shown to the pilots.
During the fourth landing, ELAC 2 again became inoperative
and since ELAC 1 was already down,
this meant that the control dropped down to the SEC computers
and the aircraft went into alternate law.
Again, that triggered the master caution,
the chime and the ECAM but this time,
the failure of ELAC 1 stayed hidden
so that when the captain reset ELAC 2,
the aircraft reverted to normal law
but with ELAC 1 still inoperative.
The third student finished his session successfully
and it was now time for the fourth and last student.
And as everyone has probably already figured out by now,
this is where the accident will finally happen.
The fourth trainee took over the controls and got ready
for his first take off completely unaware
that one of the flight control computers
was now already inoperative.
The students had all been sitting in the passenger seats
in the cabin during the sessions
of the others so none of them had seen these warnings before.
At 14:25 UTC, the thrust levers were,
again, moved into the TO/GA detent
and the aircraft started rolling down the runway.
The first circuit went fine
but during the second touch-and-go,
the ELAC 2 failure were again triggered
for the same reason as before.
When they reached circuit altitude,
the warning went off and the captain reset
the computer but again without resetting ELAC 1.
Now remember how I said before
that I would reveal a new function connected
with the Airbus control laws?
Well, it turns out that direct law
is not actually the lowest law available.
In case of some truly catastrophic conditions
like the loss of five flight control computers
after a complete power failure, for example,
the aircraft could revert into something
known as mechanical backup.
In mechanical backup,
the aircraft can still be controlled in pitch
but only through the use of stabiliser trim
and thrust lever movements
and if it would also be activated in roll
by the use of rudder pedals.
In this condition, the elevators
will be moved into a neutral position
and the pilot's side stick becomes completely useless.
If this would happen, there would be a more serious
cricket warning going off together with a master warning
and ECAM messages but nothing
would actually state mechanical backup.
Instead, a man pitch trim only message
will appear on the primary flight displays
in front of the pilots as well
as a man pitch trim on the ECAM screens.
This would obviously be a very bad situation to be in
and the possibility of this happening
had been deemed so remote
that pilots only had to practice it
whilst in the cruise in the simulator
after a complete loss of generators
and never with any maneuvering needed
and definitely not any takeoff and landings.
So with that in mind, let's now go into the fourth
touch-and-go for the last trainee.
As the aircraft entered the final approach,
everything looked completely normal
but during the last few tens of feet before landing,
the descent rate went up just
a little bit higher than on the previous approaches.
This meant that as the aircraft touched down,
it did so a little bit harder than before
and since the captain had deactivated the spoilers,
this led to a slight bounce
that lasted just over one second, starting at 15:04:55.
Now remember how I said that the flight control computers
were divided into a commanding and monitoring channel?
Well it turns out that the internal clocks
in those two channels weren't completely in sync with each other,
and that was by design, by Airbus.
But the insane problem that now occurred
was that since the bounce lasted
for just about one second and the input signals
that the weight-on-wheel switches
on the main landing gear sends to the SEC computers
updated every 1.02 seconds.
This meant that the command channel
now still felt that the aircraft was airborne
and the monitoring channel sensed that it was on the ground.
This would have been completely impossible
if the bounce was any longer or any shorter
but now it meant that one computer channel
was measuring side-stick inputs
as if the aircraft was in the air
and the other expected them to be on the ground mode
where the inputs were much smaller.
And since both SEC computers
were fed the same information,
both of them noticed the discrepancy and simply shut down.
This meant that the scene was now set for the accident
but it was still not set in stone.
For that to happen, it required the captain
to, again, stop the stabilizer trim manually,
for the intermittent piston fault to again appear
and deactivate ELAC 2
which was now the only remaining flight control computer.
And, of course, this is exactly what happened
at time 15:05:10.
At that time, the captain had already given the order
to the first officer to go which meant
that the TO/GA thrust had now been set
and they were therefore completely committed to the takeoff.
As ELAC 2 shut down, the warning crickets
and lights came on just as the captain called, "Rotate."
And because all flight control computers
had now stopped working,
the aircraft had gone into mechanical backup in pitch.
What this meant was that the poor trainee,
now tried to pull back on his side-stick
to rotate the aircraft but this made no difference at all
since the elevators was moving to neutral,
making the side-stick completely useless in pitch.
The stabilizer which had been moving
towards zero, had, at this point, a slight positive angle
of 3.5 degrees but with the speed of 130 knots,
this was still not enough to get the aircraft airborne.
The captain saw that the speed was increasing
and nothing was happening but he had obviously
not yet understood what was happening to his aircraft.
He called out, "Rotate, Rotate!"
to which the trainee desperately responded that he was.
The aircraft continued to accelerate to 152 knots
and when the horizontal stabilizer finally stopped moving,
it had a nose-up angle of 1.5 degrees
which was just enough to get the aircraft airborne.
They now slowly started climbing
with the first officer's side-stick
in the almost full aft position
but making no difference whatsoever.
Two seconds into the flight,
the captain started moving his own side-stick
which triggered a dual input warning
and he then pushed the priority button
and called out, "I have controls."
Remember this was still only a few seconds
into this event and by taking over
the controls the captain was responding correctly.
But now he was faced with a situation
that he had never seen before nor had he been trained for.
His aircraft which had, up until this point,
worked almost perfectly was now completely impossible
to control using normal means
and he just couldn't figure out why.
Like I said, the decision to reject or continue the take-off
had already been taken
when the fault appeared and they were now airborne.
It is likely that this sudden increase
in workload and stress was what caused the captain
to now take a few rapid bad decisions
which would make this situation truly catastrophic.
Because about four seconds after he had taken controls,
the trust levers were momentarily moved back
to the idle position before being pushed back up again
and as that was happening, the flaps were also moved
from position two to one, possibly in a futile attempt
to try to affect the pitch.
But when that happened, the aircraft was at 19 feet,
slightly climbing with a pitch of 2.8 degrees nose up.
But this sudden decrease in thrust and flaps
meant that the aircraft now started reducing the pitch
and after it had reached a maximum altitude of 48 feet,
it now started descending
at the same time as the captain asked for gear up.
The trainee first officer responded,
obviously completely overwhelmed by the situation,
so he simply did what he was told
and selected the gear lever up,
causing the gear to start transitioning.
About four seconds, later the aircraft impacted
the ground about 200 meters away
from the runway end with the gear still partially extended.
It touched down with 2.85 g which is a pretty hard impact
and this, combined with the partially retracted gear
caused both of the engine nacelles to slam into the asphalt.
But since the nose gear was still out at this point,
the impact caused a bounce movement
of the nose that pushed it back up into the air.
The engines were both now back in TO/GA,
producing full thrust and since the speed
had been around 190 knots when the impact occurred,
this forced the airliner back into the air
with a terrifying climb rate of around 6,000 feet per minute.
Now things started to look really, really bad.
Neither the captain nor the first officer
had, at this point, managed to figure out
what was going on and none of them
had seen the manual pitch trim only message
on their primary flight displays.
The aircraft was now pitching up
with 19 degrees with a speed of 207 knots
when suddenly, the flaps also locked up.
On top of that, the impact of the number 2 engine
had ruptured internal components
and the sparks created from the impact
had started an engine fire which triggered all
of the associated warnings inside of the cockpit.
This was clearly heading towards a disaster,
but thankfully, now the safety pilot was sitting
behind the captain started speaking up.
He called out, "Manual pitch trim only, manual pitch trim only!"
And that got the captain back into the loop and he now
started moving the trim wheel forward.
He also brought the thrust levers back
and the combined effect of both of those actions
meant that the pitch now finally started decreasing
and getting back under some type of relative control.
But obviously, this was far from over.
At time 15:05:53, less than a minute
into this emergency, the aircraft
reached its highest altitude of 1,590 feet.
From then on, it started pitching down again
and it was soon in a 7,200 feet per minute descent.
The captain moved the thrust to TO/GA again
whilst moving the trim wheel in the opposite direction
and remember, flying an aircraft with the trim only
is not easy as there's always a delay
to the effect and this was not something
that they had been trained for doing.
The aircraft's ground proximity warning system
was now calling out, "Sink rate, pull up!
Terrain! Terrain! Too low! Terrain!"
And on top of that, all of the cricket warnings
and lights associated with a blazing engine fire
were still sounding.
This was an absolutely crazy situation
and to think that the captain was
now sharing the cockpit
with a poor brand new cadet
doing his first ever flight in the aircraft,
makes this absolutely heartbreaking.
The lowest point that the aircraft reached
during this massive dive was around 600 feet
before the captain again regained control
and got the aircraft's climbing back up to about 1,200 feet.
The status of his aircraft at this point
was that both engines were severely damaged
with engine two still on fire, pitch control was in mechanical backup
and roll in direct law and on top of that,
the flaps were locked in position.
Not a great day.
The captain tried to send out a mayday call but failed
to get it to transmit during the commotion.
But the safety pilot now started reading out
the ECAM warnings and this seemed
to have a calming effect on the crew.
Often when faced with complete chaos,
it's a great idea to return back to basics
and continue to follow familiar procedures
and that's because the human mind is just not equipped
to process this much information at once
but it can allow to follow familiar tasks.
At time 15:06:58, two minutes into this emergency,
the captain again tried to send out an emergency call
but now the safety pilot instead asked
to take over the communication,
letting the captain concentrate on just flying.
And after he had taken over,
he finally managed to transmit
that first mayday call into air traffic control.
He advised them that they had flight control fail
and the captain told him to ask
if they could make a right turn straight back
to land on the opposite runway instead.
This was immediately approved by the tower
and the captain now started visually turning right
to align with the final.
At the same time, he also asked
the student to change seats with the safety pilot
and the student quickly debuckled his seatbelt,
stood up and together with the CAA inspector,
moved back into the cabin and strapped in.
Now it was up to the two remaining pilots
to try and get this stricken bird
down on the ground in one piece.
The safety pilot started by pushing
the master fire warning button
which got rid of the visual warnings as well as the crickets.
This would have made the cockpit environment
much more bearable and with that, greatly reduced the stress.
The captain asked what the runway heading was
for Runway 26 and the safety pilot responded 262 degrees
whilst he also set that up into the flight management computer.
He then continued by informing air traffic control
about the engine fire so that they could alert the fire brigade
and he also told the controllers
that they were definitely going to try and land on Runway 26.
Now came the time to try and deal with the problem
so the safety pilot suggested
to the captain that they should reduce power
on the still burning engine number two.
But here the high experience
of the captain really started to shine through
because he now told the safety pilot that he would prefer
to use the two engines he had for as long as possible
and hopefully, have them available for landing
rather than shutting one of them down now.
Not dealing with an engine fire would feel
very counterintuitive for any pilot but the golden motto,
aviate, navigate, communicate always takes precedence.
And in this case the engines were not only needed
in order to provide propulsion but also for pitch control
so this decision makes complete sense.
At time 15:09, the captain asked
for gear down as he started
his descent down towards the runway.
But only 19 seconds later, engine number two finally gave up
and failed as the fire had now completely destroyed
several of its vital components.
The safety pilot informed the captain that engine number two
has failed, which the captain acknowledged
whilst just continuing to aim for the runway as best as he could.
The loss of one of the engines
would have made the pitch control even more difficult.
A few seconds later, the captain confirmed,
"Gear is down," and asked for flaps three.
The safety pilot moved the flaps to three
but it's unclear from the report
if the flaps actually started moving or not.
But what we do know is that seven seconds
after this, engine number one, the only remaining engine
also failed due to the auxiliary gearbox seizing up.
And this cut off all power to several of the aircraft systems
including the cockpit voice recorder
and the flight data recorder.
In theory, this loss of both engines
should have also removed all power
from the hydraulic motors, moving the horizontal stabilizer
which was now the only remaining means of pitch control
but somehow this didn't happen.
It is possible that engine number two
continued to windmill and that this was enough
to maintain minimum hydraulic power.
The ram air turbine or RAT deployed after a few seconds
which meant that some systems came back and when they did,
the first officer stated, "Gear is down, we don't have engines,"
and then he started reading out the airspeed.
150.
130.
120.
And at time 15:10:12, the aircraft
finally touched down hard
just about 150 meters short of Runway 26.
The touchdown was so hard
that all main tires immediately burst
but the aircraft still reached
the runway in one piece where it started decelerating
and then finally veered off to the left where it came to a stop
just a few meters to the side of the runway.
Everyone was alive and a true miracle had just happened.
The investigation quickly honed in
on the fact that there were little guidance available
in the SmartLynx training manual
regarding the continuation of training with reoccurring faults
and since there was no limitation from Airbus
on the number of times that
the computers could be reset there was no real reason
for the captain to discontinue the training.
The fact that the captain decided
to disarm the spoilers for each approach was what led
to that small bounce that triggered
the last couple of faults but again,
this was not specifically forbidden in the manual.
Airbus has, after this incident,
introduced numerous software improvements
and they have forbidden the reset
of any ELAC computer in flight.
The SmartLynx manuals have also been updated
to reflect much clearer guidance
for base training and also for general dispatch
and if you want to see all of the recommendations
and safety improvements that came out of this accident
then please visit mentourpilot.com
using the link that we have here below
where you can always get the best aviation news
as well as downloading my app.
Consider supporting our work
by sending a Super Thanks using the dollar button here below,
maybe buy some merch or join my fantastic Patreon crew
to help me create these videos.
Have an absolutely fantastic day wherever you are
and I'll see you next time, bye bye.
تصفح المزيد من مقاطع الفيديو ذات الصلة
Unforgivable!! The Tragic tale of Air Algérie Flight 6289
Surviving a Crash Landing in London | British Airways Flight 38
Pilatus PC-12 Autopilot Disconnect Pilot Issues
Japan plane crash: What happened?
Why The Airbus A350 Has Quickly Become A Favorite For Airlines, Pilots & Passengers
ATPL Performance - Class 12: Class B Regulations.
Are Planes With Parachutes Really Safer?
5.0 / 5 (0 votes)