The Controls DONT WORK!! Airbus Computer Nightmare

Summary

During a routine Airbus A320 type rating training in Estonia, a series of minor technical issues led to a catastrophic failure of the fly-by-wire system. With the aircraft uncontrollable, the pilots struggled to maintain control during takeoff, experiencing violent pitch oscillations. Despite multiple system failures and an engine fire, the pilots managed to land the aircraft safely after declaring an emergency. The investigation revealed inadequate training and guidance as contributing factors. Airbus and the airline implemented software improvements and more rigorous procedures to prevent similar occurrences.

Takeaways

• 😲 The video describes an incident during Airbus A320 type-rating training involving multiple computer failures leading to loss of control.
• 👨‍✈️ Four pilot trainees were completing required training to fly the A320 commercially in Europe with an experienced instructor.
• ✈️ During touch-and-go maneuvers, intermittent trim wheel issues caused computer failures dropping the aircraft into alternate control laws.
• 🛠 The captain repeatedly reset the computers but mistakes led to hidden failures reducing redundancy.
• ⛔ On the final takeoff, all computers failed due to a bounce triggering the aircraft into mechanical backup pitch mode.
• 😨 With pitch controls inoperative, the aircraft crashed during the takeoff run with gear retracting but miraculously became airborne again.
• 😰 The pilots struggled to control the crippled aircraft not designed for manual trim-only flight nearly leading to a catastrophic crash.
• 👍🏻 The safety pilot intervened enabling the captain to regain marginal control and land the aircraft safely with no fatalities.
• 📝 Airbus and the airline updated manuals and software to improve guidance for pilots and prevent similar hidden computer failures.
• 💪🏻 Despite an unprecedented emergency far beyond training, the pilots' skill and resilience saved the aircraft from disaster.

Q & A

What type of aircraft was involved in the incident?

The aircraft involved was an Airbus A320-200 operated by SmartLynx Airlines.

What was the purpose of the flight?

The flight was conducting touch-and-go landings as part of base training for new Airbus A320 pilots.

What triggered the loss of the flight control computers?

A small bounce during landing led to a discrepancy between the ground and air mode logic in the flight control computers, causing them to fail.

What is mechanical backup mode?

Mechanical backup is a degraded control law where pitch is controlled only through trim and thrust levers, with no elevator authority.

How did the pilots regain control of the aircraft?

The safety pilot identified the manual pitch trim only condition, allowing the captain to control pitch using just the trim wheel.

What allowed the aircraft to keep flying after both engines failed?

The ram air turbine deployed to provide hydraulic pressure. One engine may have continued to windmill, powering the hydraulics as well.

How much experience did the instructor pilot have?

The instructor captain had over 24,000 flight hours, including 13,500 on the A320.

What was the outcome of the incident?

The aircraft landed hard but intact, with no fatalities. All four pilots and the CAA inspector survived.

What changes resulted from the investigation?

Airbus and SmartLynx updated procedures and checklists. Resetting computers inflight is now prohibited.

Could this accident have been prevented?

Better training guidance and following standard callouts may have prevented the cascading failures.

Outlines

00:00

😐 First Pilot's Excitement and Dread

Paragraph 1 introduces the story, describing how becoming a pilot is a lifelong dream for many but sometimes training turns into a nightmare. It sets up the scenario of eager pilot trainees in Estonia ready for training on an Airbus A320, foreshadowing that something will go terribly wrong.

05:02

😟 Long Pilot Training Process

Paragraph 2 provides background on the extensive training required for commercial pilots in Europe. This includes flying small planes, getting a commercial license, training in multi-crew cockpits, and completing a specific type rating for the aircraft model they will fly.

10:02

🤔 Complex Airbus Flight Control System

Paragraph 3 gives an overview of the complex fly-by-wire system on the Airbus A320, including redundancy through multiple flight control computers. It explains the different control laws from normal to alternate to direct, which degrade protections when computers fail.

15:03

😐 More on Flight Control Laws

Paragraph 4 continues describing the flight control laws, the shifts between them, and how pilots are alerted. It notes that cautions don't activate below 1500 feet to avoid distraction at low altitudes.

20:03

😶 First Training Flights Begin

Paragraph 5 details how the first training flights begin uneventfully but issues arise when the instructor captain grabs the trim wheel override, triggering computer switches. The flights continue despite recurring faults and resets.

25:03

😱 Bounce Triggers Catastrophe

Paragraph 6 explains how a small bounce on the third trainee's landing led to both flight control computers shutting down due to timing discrepancies. This cascaded into mechanical backup pitch mode, setting the stage for the accident.

30:04

😨 Chaotic Loss of Control

Paragraph 7 describes the chaotic loss of control on the fourth trainee's flight as all computers failed. Despite the pilots' efforts, the aircraft impacted the ground, bounced back up, then entered a terrifying climb before the pilots regained some control.

35:05

😅 Miraculous Recovery and Landing

Paragraph 8 details how the pilots managed to get the severely damaged aircraft back under tenuous control. After both engines failed, they miraculously landed the plane safely with no remaining propulsion or proper flight controls.

40:07

🙂 Lessons Learned and Improvements

Paragraph 9 wraps up by noting investigation findings and improvements made by SmartLynx and Airbus after the incident. It highlights how small issues cascaded into disaster, leading to key lessons for training and operations.

Keywords

💡base training

Base training refers to the final stage of flight training for aspiring airline pilots, where they get to fly the actual aircraft for the first time after simulator training. It involves supervised takeoffs and landings in the real plane to get certified. In the video, a group of students are undergoing base training at Tallinn Airport.

💡touch-and-go landing

A touch-and-go landing is a flight training exercise where the aircraft touches down on the runway and takes off again without coming to a full stop. The students in the video were practicing touch-and-go landings as part of their base training.

💡fly-by-wire

The Airbus A320 is a fly-by-wire aircraft, meaning the flight controls are electronic rather than manual/mechanical. Pilot inputs are processed through flight control computers before moving the control surfaces. This provides protections against exceeding aircraft limits.

💡control laws

The Airbus flight control system has different 'control laws' based on operational status. Normal law provides full protections. Alternate law removes some protections. Direct law removes auto-trim. Mechanical backup further degrades pitch control to just trim and thrust.

💡spoilers

Spoilers are flight control surfaces on the wing that help reduce lift during landing. The instructor had deactivated them, leading to a slight bounce that triggered computer faults.

💡ELAC

The Elevator Aileron Computers (ELAC) are flight control computers that process pilot inputs into control surface movements. Faults with ELAC 1 and 2 led aircraft to switch to lower control laws.

💡mechanical backup

Mechanical backup is the lowest control law where sidestick is useless for pitch, which is controlled by trim and thrust only. This is what the aircraft entered during the accident.

💡manual pitch trim

In mechanical backup, the ECAM message is 'manual pitch trim only'. The pilots have to use the trim wheel for pitch as sidestick doesn't work. This allowed the pilots to regain some control.

💡stabilizer trim

The horizontal stabilizer trim controls aircraft pitch. In mechanical backup, it becomes the sole means of pitch control along with thrust. Overriding trim movement had started the computer faults.

💡engine failure

Both engines failed at the end due to damage and fire caused by the impacts. With no remaining pitch control, the pilots had to land using only stabilizer trim.

Highlights

The trainees were about to fly an Airbus A320 for the first time outside of the simulator as part of their type rating training.

The captain decided to continue the training despite recurring computer failures because there was no guidance limiting resets.

A small bounce during landing caused discrepant data between the aircraft's dual flight control channels, leading to multiple computer failures.

With all flight control computers failed, the aircraft entered an extremely rare mode called mechanical backup pitch.

In mechanical backup, the sidestick becomes useless and pitch is only controllable through trim and thrust levers.

The captain took over controls and incorrectly reduced thrust and flap, causing the aircraft to impact the ground at high speed.

After bouncing back into the air, the situation became chaotic with warnings and an engine fire until the safety pilot read the critical ECAM message.

The captain regained some control using only the trim wheel and throttle levers.

The captain wisely kept both damaged engines running as long as possible since they were needed for pitch control.

With both engines failed, the aircraft landed hard but intact, an absolute miracle given the circumstances.

Airbus introduced software improvements and prohibited in-flight computer resets after the incident.

The aircraft used fly-by-wire controls and degraded through various laws as computers failed.

SmartLynx and Airbus hadn't adequately guided crews on handling recurring computer faults.

The captain should have discontinued training given the recurring failures.

The pilots were shocked when normal controls became useless in mechanical backup mode.

Transcripts

- Becoming a pilot is, for many people, a lifelong dream.

To be able to touch the clouds

and feel that awesome raw power

of the engines surging through you on a daily basis

is something that they just have to achieve.

But what happens when the pinnacle,

the crowning of your pilot training turns

into an absolute nightmare?

Stay tuned.

(calm music)

On the 28th of February, 2018,

a group of eager, type-rating students

were getting ready for one of the biggest highlights

of their career so far

as they met out outside Tallinn Airport in Estonia.

They had just completed a grueling two months of theoretical

and practical simulator training

on the Airbus A320 and it was now time

for them to finally fly the real aircraft.

You see, in order to become a commercial pilot and fly

with passengers in Europe, a pilot student

must first go through initial training.

This includes flying in smaller, single-engine aircraft

up until they complete a skill test

for the commercial pilot license

and that normally takes around 200 hours

of flight time plus loads of theoretical exams.

Now once that's gone, the student also needs

to get certified to fly multi-engine aircraft

in instrumental conditions

and once those skills have also been verified,

it's time for something known

as a multi-crew coordination or MCC course.

In the MCC course, the students

will be instructed in the skills of flying

in a multi-pilot cockpit which is radically different

than flying by yourself, but even after that course is done,

the training journey is still far from over.

The last step is to do what's known

as a type-rating, which is where

the students learn the specific technical knowledge,

handling characteristics and procedures

of the aircraft type that they will actually fly

in their new company.

It's, by the way, in this part

of the training that they would get into contact

with me as I'm a type-rating instructor and examiner.

And me and my colleagues will then prepare

the students for the job that they will be expected

to master in their coming careers.

The type-rating training is started

by a technical course, followed by procedure instruction

in a fixed space, meaning a non-moving simulator

and then the handling and emergency training is completed

in a level D, full flight simulator

which acts extremely similar to the real aircraft.

But once the type-rating skill test is completed,

there's still one more step that needs to be done

and this is known as a base check or base training.

So what is that then?

Well, before the first flight

with passengers, every type-rating student needs

to have done at least six approved landings and takeoffs

in the real aircraft with the type-rating examiner.

So this is what this group of four students

were now about to do, the crowning of their type-rating

and the first real step in their professional pilot career.

They were greeted at the Tallinn Airport

by the 63-year-old type-rating instructor

and examiner who was going

to conduct the training with them.

And together with him, they walked

into the crew room to start planning for the flights.

Inside of the crew room, there were already

two more people waiting for them,

a 34-year-old first officer who was going to act

as safety pilot in case something

would happen to the captain

and a CAA representative who was going to follow along

to observe the training process.

The instructor captain in charge was a very experienced pilot

with over 24,000 hours of total time

and 13,500 flown on the Airbus A320.

The safety pilot who was going to support him

had around 3,000 hours in total

which was enough for the role

that he was being scheduled for.

Now as for the students, well, (chuckles)

they were completely new

with only around 220 hours of total experience.

Now, I know that a lot of my American colleagues out there

would be shocked when they hear this.

But in Europe it is quite common for low-hour cadets

to go straight from their flight schools

into the right seat of an airliner

since we don't have the 1,500-hour requirement over here.

Now obviously, this base check

is not the end of the training for these students,

it will just enable them to continue

their line training with qualified training captains,

but after a successful base check the type rating

will be added to their license

and they're officially allowed

to operate with passengers on board.

Anyway, the instructor started the preparation

with going through the weather for the day,

making sure that it was good enough

for the exercises he was planning.

A base check is a series of touch-and-go landings,

meaning that the aircraft will be flying circuits

around the airport and the landings tend

to be done with different flap settings

to make sure that the students understand

the different handling characteristics.

In the case of SmartLynx, the minimum requirement

for each student was five touch-and-goes

followed by one go-around and then one full-stop landing

before it was time to switch over to the next student.

The weather was okay, with some scattered clouds

at 1,100 feet, good visibility and a wind of 0.70 degrees,

nine gusting, 15 knots and a temperature

of -13 degrees Celsius, so it was a bit crispy.

The runway in Tallinn is oriented

in an almost straight east-westerly direction

so the wind was acceptable

as it would only cause a few knots of crosswind.

The aircraft that they were going to use

was one of SmartLynx's regular Airbus A320-200s,

which had been taken out of production on this day

to enable the base check to take place.

It was 18 years old and in full working condition,

at least as far as the crew

could see from its technical logbook.

Now the fact that this aircraft had to be taken

out of service to facilitate this training, obviously came

with some quite significant costs to the airline

and on top of that, the weather had to be good enough

and the schedule had to fit the instructor.

So once this check was underway, it is likely

that the instructor felt a little bit

of pressure to make sure that this was fully completed.

Anyway, once the weather briefing was completed,

the instructor proceeded with briefing

the students about the patterns that they were going to fly.

I will not go through the whole circuit profile here,

but what is going to be really important

for this story are the actions that the pilots have to do

from final approach and once the aircraft

is on the runway, since a touch-and-go landing

is very different from a normal landing.

According to the Airbus Flight Crew Training Manual,

the procedure looks like this:

Once the aircraft is turning final,

the landing flaps must be selected

and the captain would run through the landing checklist.

He would then remind the students

to not apply brakes and reversers

as doing that would lead to a full-stop landing.

The aircraft would then need to be fully stabilized

from at least 500 feet above the runway

and then flown to a, hopefully successful, nice landing.

Once the aircraft touches down, the trainee

would make sure to nicely land the nose wheel

and the captain would then disarm

the spoilers and call, "Stand them up."

The trainee would then move the thrust levers up

to about mid position to avoid the engine spooling down

whilst concentrating on also tracking the centerline.

Meanwhile, the captain would select flaps two,

reset the rudder trim if needed,

check forward movement of the stabilizer pitch trim

and then call, "Go."

When that order is given, the trainee would move

the thrust levers into the TO/GA detent

and once that's done, the captain would verify it

and call, "Thrust set," and then, "Rotate"

once the speed accelerates past the approach speed bug.

This would then be followed

by a normal rotation and once airborne,

the gear would be retracted and after this,

the aircraft would be climbed

to between 1,500 and 2,000 feet for the next touch-and-go.

Now as you can see, this is a hugely intensive exercise

but it's also close to about as much fun

as you can have in a commercial airliner

and I still get goosebumps

just thinking about my own base check.

In my case, back in the day, we actually used

to not have to do the full full-stop

so we changed over whilst the aircraft

was still airborne and on downwind.

Now I still remember that cockpit door

opening up, me being called in, strapping into the seat

and then looking out over my right shoulder

and for the first time, seeing that massive wing

instead of a black simulator wall.

Absolutely fantastic!

But absolutely fantastic is pretty far from

what these students are about to experience

and I will tell you all about it after this.

Now base training might well be fantastic

and so is making these videos

but they require an enormous amount of work to complete.

In order to get to the level of detail as I do here

in my videos I have to sit through, not only the final reports

but also newspaper articles and sometimes even blog posts.

During the production of one of my upcoming videos,

I won't tell you which one yet,

I came across a roadblock when the final report

was geo-blocked and not available for my location.

And that's when I turned

to the sponsor of this episode, NordVPN.

You see, Nord is an invaluable tool

for breaking through digital borders

and seamlessly connect

to servers worldwide at an impressive speed.

But they're not just about gaining access,

they've also developed advanced cybersecurity tools

to help you keep safe

from hackers, malware and phishing attempts.

So whether you're like me, researching or aiming

for secure and anonymous web surfing

or just want to access your favorite content

away from home, NordVPN has your back.

So if this sounds promising,

use the link here in the description below

which is nordvpn.com/pilot to get four free months

when you sign up for the two-year plan

and if you're not happy,

you have a full 30-day money-back guarantee.

Thank you, Nord. Now, let's see what happens here.

Now, what's about to happen in this story

is among the most technically-complicated things

that I've ever attempted to explain.

So you're going to have

to bear with me through a couple of system descriptions.

But before we reach that, remember what I just told you

about what the trainee and the instructor

had to do during the circuit?

Well, that description was taken

from the Airbus Flight Training Manual

but SmartLynx had not included that exact profile

in their own flight crew training techniques manual.

Specifically, there was no mentioning about arming

or disarming the spoilers in the company-specific version

and that will soon have some wild consequences.

Once the briefing was complete,

all seven crew members walked together out to the aircraft.

Now, this was the first time

that the type-rating students had a chance to see

and touch the actual aircraft in real life

and the instructor started by doing a full walk-around

with all of the students to highlight important things

that would be hard to have time to explain

during the hectic line-training that would soon follow.

Meanwhile, the safety pilot went

into the cockpit and started setting it up

to a limited extent so that when the captain arrived

with the first trainee, they would have saved some time.

Once the exterior inspection was finally completed,

everyone boarded the aircraft and the first trainee sat down

in the right seat with the instructor captain to the left.

The safety pilot was seated in the left jump seat

behind the captain and the CAA representative in the right.

The pre-flight procedures were completed

according to standard operating procedures

and at time 10:02, the trainee first officer asked Tallinn Ground

for start-up clearance and a few minutes later,

they started taxing out for take-off.

Once the before-take-off checklist was completed,

the captain lined the aircraft up

on Runway 08 and gave some final instructions

to the first officer for the first take-off.

Once that was completed, the first officer took over

the controls, moved the thrust levers forward

into the TO/GA detent and that caused

the almost empty aircraft to quickly

start accelerating down the runway.

They took off normally, retracted the gear

and climbed up to about 1,500 feet

before turning right for the first circuit.

Everything was working normally

at this point and the captain concentrated

on following the procedures whilst also instructing

the first officer on what to think about

during the first landing.

Like I mentioned before, this was the first time

that the trainee would have ever been

in control of such a large aircraft

outside of the simulator and in those situations,

it's easy to get slightly emotional

which can obviously affect the outcome.

Anyway, before we continue any further,

there are a few things that you need

to understand about the Airbus A320

for this story to make any kind of sense.

Let's first start with the fact

that this is a fully fly-by-wire aircraft,

meaning that all flight control inputs

the pilots are making will be routed

through several computers before the commands

are translated into actual movements

of the flight control surfaces.

Now, this is generally an excellent system

which both saves a lot of weight

and it also adds significant safety features to the aircraft

and that is because the computers

will not allow the pilots to exceed certain limit values

or over-stress the airframe under normal circumstances.

But as anyone who has ever owned a computer knows,

they sometimes fail and in order

for a simple or even double computer failure

to not affect the safety of the aircraft,

robust redundancies have also been built into the system.

I'll give you one example.

When the pilots want to move the aircraft nose up or down

around the pitch axis, the aircraft uses

the trimmable horizontal stabilizer

and the elevators in the aircraft tail to achieve this.

If the pilot moves the pitch trim

or the side-stick to tell the aircraft to pitch

these signals are then, in-flight, sent to a computer known

as the elevator aileron control or ELAC 2

which will then send the signals onwards to one

of the three electrical trim motors

and two of the hydraulic motors

controlling the stabilizer jack screw and elevators.

All of the flight control computers

have both a command channel,

which is executing the pilot's command

and a monitoring channel which is monitoring the outputs

to make sure that everything is working correctly.

Now if a failure of any sort

would affect the ELAC 2 computer

the system will automatically shift controls

over to ELAC 1 which will do the same job

like the previous computer

but using different electrical motors to do it,

making sure that everything still works.

But the redundancy doesn't stop there.

If ELAC 1 would also become faulty,

the commands are then shifted over

to another computer known as the spoiler elevator computer

or SEC 2 and if that one would also get bust,

it finally shifts over to SEC 1.

For the pilots in the cockpit,

the only thing that they would notice

if flight control computers would shift over

is a small jerk in the controls

but if multiple computers would start failing

at the same time, something known

as a degradation-in-control-laws might also happen.

If, for example, both ELAC

would fail simultaneously, the system would go

from normal law over to something known as alternate law

and if further failures would then continue,

the system would finally degrade into direct law.

So what does that mean then?

Well, in normal law, the Airbus avails

of all of its pre-programmed protections

that I mentioned before.

The pilots can control the aircraft with their side sticks

and the flight control surfaces

will position the aircraft proportionately

to the stick inputs irrespectively of speed.

If the system would then regress

back to alternate law, certain protections will be lost

like the max-roll protections, for example,

but the aircraft would still behave largely

in the same way as in normal law.

But if the aircraft would go into direct law,

the auto-trim function will be lost meaning

that the pilots would need to trim

the aircraft just like we do in the Boeing

and on top of that, the flight controls

would start to move exactly

like the pilots indicate, without any protections.

Now if the aircraft would degrade

into a lower law, it will always let the pilots know about it

through a single chime in the cockpit,

together with the master caution light

and ECAM messages on their screens,

explaining the problem and what the pilot needs to do.

But these cautions were programmed to only activate

above 1,500 feet to avoid distracting

the pilots at lower altitudes

and that's worth keeping in mind.

I know I've mentioned these laws

in many of my previous videos

but in this case we will soon get to see a part

of this system which very few of you have ever heard about

and it's quite terrifying but I'll get to that later.

What's also worth knowing about the system

is that it will transition between something known

as in-flight mode, flare mode

and ground mode during a normal landing.

And it will start transitioning

to ground mode about five seconds

after the aircraft senses touch-down.

Once the ground mode is activated,

the auto-trim system will start moving

the trimmable horizontal stabilizer to zero degrees in order

to prepare for the next flight

and this is something that we don't want to do

when we're practicing touch-and-go landings.

It's super important

that the trim is set at more or less the correct value

when we rotate for the next takeoff.

And in order to make sure that that was the case,

the captain was planning to grab the trim wheel

with his hand as it was being moved forward.

By doing so, he would activate

an override mechanism in connection

with the trim wheel which would stop the resetting

and leave the trim set correctly for the incoming rotation.

And this will also become important.

So the aircraft was now entering

downwind for the first touch and go.

The captain completed the after-takeoff checklist,

activated the coming approach in the FMC

and completed the approach checklist,

all whilst the trainee was handling the aircraft manually.

The captain then turned off the flight directors

and activated an indicator known as the flight path vector

to help give the students some guidance

and then briefed him about the landing that was coming up.

Once the aircraft passed

the touchdown point, they started timing

for three seconds for every 100 feet

they were above the ground, meaning about 54 seconds

from 1,800 feet minus one second for each knot of tailwind.

Since this was a touch-and-go manuever,

the aircraft had been left in flaps one configuration

so once the timing was out, flaps two was then selected,

together with gear down and eventually flaps three,

as the aircraft started descending.

Now here, the Airbus manual also stipulated that the spoilers

should be armed for landing but like I mentioned earlier,

this was not in the SmartLynx manual

so the captain decided to keep the spoilers down

since they would only need to be lowered

immediately after landing anyway.

Now this might seem like a logical thing to do

but the spoilers actually play an important role

in all landings and that is to spoil

the lift from the wings on touchdown to keep the aircraft

from bouncing and in normal conditions,

also to bring more weight onto the brakes.

Anyway, the aircraft continued

towards the final and as the trainee was making

the final turn, the captain selected full flaps,

completed the landing checklist

and reminded the trainee

to not select brakes or reversers after landing.

The first officer replied that he had understood this

and then they just continued descending.

The first landing was nicely executed

and once the nose wheel was safely down,

the captain continued according to plan

by calling, "Stand them up," moving the flaps to two

and then grabbing onto the trim wheel

as it was approaching one unit nose up.

And completely unbeknownst to the pilots,

now something really strange happened.

As the captain grabbed the trim wheel,

the override mechanism started moving

to stop the trimming but the piston

that was supposed to activate

the associated micro-switches

was not moving as quickly as it should.

This sent unreliable signals to the flight control computer,

ELAC 2, that was currently in charge,

triggering a switch over to the backup computer.

But since the backup, ELAC 1, also received

the same signals, this computer now also failed

and that sent the system down another notch,

activating SEC 2 and alternate law.

Now the pilots had no idea that this was happening

at this point since the caution

would only appear later as they passed 1,500 feet climbing.

Anyway the trainee pushed the thrust levers

into the TO/GA detent again and soon

the aircraft had accelerated past the approach bug

and the captain called, "Rotate."

The rest of the maneuver continued

just like the first takeoff and when the trainee leveled

at about 1,500 feet, the master caution warning went off,

together with a single chime and the information

about the failure popped up on the ECAM displays.

Now, the information shown said ELAC 1 and 2 pitch fault

and informed the pilots that they were operating in alternate law.

The captain took up the quick reference handbook

and read through the procedures

which simply instructed a computer reset

of each of the ELAC computers,

something that was relatively easy and quick to do.

So once this was done, the aircraft functioned

just like normal again so the captain decided

just to continue with the exercises.

The second touch-and-go landing went out

without any issues and warnings

but after the third landing once the aircraft was back up

at circuit altitude, the same warnings appeared again.

Now after the captain had again reset the computers,

he tried looking for any guidance

of limitations to the number of resets that were allowed

but couldn't find any in the Airbus manuals.

If this would have been a normal line flight,

he would have likely asked engineering for guidance

but since there was no specific guidance

in the minimum equipment list,

the aircraft was working perfectly fine

and this was not a revenue flight,

he instead again decided to continue.

The rest of the training session with the first trainee

was completely uneventful and after the last landing,

they did a full stop and taxied off the runway

to change over to the next student.

The second trainee then climbed

into the right seat and the exercises started all over again.

For the second student, there were less issues.

Only once did the ELAC 1 failure occur

and since this was only a singular failure,

there was no lower version

and no caution, just an ECAM message,

letting the crew know that it had happened.

The captain reset the system

a third time and then just continued.

So what was actually going on here?

Well, it was later noticed that the reason

that the override piston inside of the trim mechanism

wasn't moving correctly was because of the presence

of a non-approved oil inside of the cylinder.

This oil had a viscosity almost twice as high

as the correct oil would have had which impeded the piston

from correctly activating the microswitches.

But remember, the only time that this piston

should have had to be used in normal circumstances

would be during a runaway stabilizer event

where the pilots would need

to stop the incorrect movement of the stab trim manually.

And since that was such a rare event,

and it really, really is, this system was hardly ever used

nor was it tested during routine maintenance checks

so we will actually really never know

when this faulty oil was introduced

to the system or by whom.

Now had it only been for this small system issue,

this would not have become such a serious incident

but soon, some additional things were going to happen

in such a bizarre way that I couldn't really believe it

when I first read it.

When the second student had finished all of his landings,

the third student took place in the cockpit.

And it is in his session that the first

really important mistake will occur

that will ultimately lead to this accident.

The session started normally with a takeoff climb to 2,000 feet

and then a right turn to start the exercises.

After the first landing, the same problem reoccurred

as the captain was setting the stabilizer trim,

meaning that once again, the ELAC 1 failure appeared downwind.

The captain reset the computers

as he was getting quite used to doing at this point

but since these failures continued

to pop up at altitude, he never really connected them

with his use of the stabilizer trim override mechanism

which only happened on the ground.

Anyway, the second landing went very well without any failures

but on the third landing, again it appeared

but this time it was also associated

with a single chime for some reason.

The investigators were never able

to find out why this chime activated

since it was still only a single ELAC failure

but in any case the computer was again reset

and the exercises continued.

After the fourth landing, the same ELAC 1 failure appeared,

this time without that single chime

that had happened before but curiously,

this time the computer was never reset.

It is highly likely that whoever started working

on the ECAM message this time, accidentally pressed

the clear key instead of doing the reset.

And since this was not a critical fault,

the message would then be hidden

until someone pressed the recall button

for at least three seconds, something that would normally

only happen, according to standard operating procedures,

as part of a full pre-flight for the next full flight.

This meant that the aircraft now continued

to fly in normal law but with one ELAC already inoperative

and without that being shown to the pilots.

During the fourth landing, ELAC 2 again became inoperative

and since ELAC 1 was already down,

this meant that the control dropped down to the SEC computers

and the aircraft went into alternate law.

Again, that triggered the master caution,

the chime and the ECAM but this time,

the failure of ELAC 1 stayed hidden

so that when the captain reset ELAC 2,

the aircraft reverted to normal law

but with ELAC 1 still inoperative.

The third student finished his session successfully

and it was now time for the fourth and last student.

And as everyone has probably already figured out by now,

this is where the accident will finally happen.

The fourth trainee took over the controls and got ready

for his first take off completely unaware

that one of the flight control computers

was now already inoperative.

The students had all been sitting in the passenger seats

in the cabin during the sessions

of the others so none of them had seen these warnings before.

At 14:25 UTC, the thrust levers were,

again, moved into the TO/GA detent

and the aircraft started rolling down the runway.

The first circuit went fine

but during the second touch-and-go,

the ELAC 2 failure were again triggered

for the same reason as before.

When they reached circuit altitude,

the warning went off and the captain reset

the computer but again without resetting ELAC 1.

Now remember how I said before

that I would reveal a new function connected

with the Airbus control laws?

Well, it turns out that direct law

is not actually the lowest law available.

In case of some truly catastrophic conditions

like the loss of five flight control computers

after a complete power failure, for example,

the aircraft could revert into something

known as mechanical backup.

In mechanical backup,

the aircraft can still be controlled in pitch

but only through the use of stabiliser trim

and thrust lever movements

and if it would also be activated in roll

by the use of rudder pedals.

In this condition, the elevators

will be moved into a neutral position

and the pilot's side stick becomes completely useless.

If this would happen, there would be a more serious

cricket warning going off together with a master warning

and ECAM messages but nothing

would actually state mechanical backup.

Instead, a man pitch trim only message

will appear on the primary flight displays

in front of the pilots as well

as a man pitch trim on the ECAM screens.

This would obviously be a very bad situation to be in

and the possibility of this happening

had been deemed so remote

that pilots only had to practice it

whilst in the cruise in the simulator

after a complete loss of generators

and never with any maneuvering needed

and definitely not any takeoff and landings.

So with that in mind, let's now go into the fourth

touch-and-go for the last trainee.

As the aircraft entered the final approach,

everything looked completely normal

but during the last few tens of feet before landing,

the descent rate went up just

a little bit higher than on the previous approaches.

This meant that as the aircraft touched down,

it did so a little bit harder than before

and since the captain had deactivated the spoilers,

this led to a slight bounce

that lasted just over one second, starting at 15:04:55.

Now remember how I said that the flight control computers

were divided into a commanding and monitoring channel?

Well it turns out that the internal clocks

in those two channels weren't completely in sync with each other,

and that was by design, by Airbus.

But the insane problem that now occurred

was that since the bounce lasted

for just about one second and the input signals

that the weight-on-wheel switches

on the main landing gear sends to the SEC computers

updated every 1.02 seconds.

This meant that the command channel

now still felt that the aircraft was airborne

and the monitoring channel sensed that it was on the ground.

This would have been completely impossible

if the bounce was any longer or any shorter

but now it meant that one computer channel

was measuring side-stick inputs

as if the aircraft was in the air

and the other expected them to be on the ground mode

where the inputs were much smaller.

And since both SEC computers

were fed the same information,

both of them noticed the discrepancy and simply shut down.

This meant that the scene was now set for the accident

but it was still not set in stone.

For that to happen, it required the captain

to, again, stop the stabilizer trim manually,

for the intermittent piston fault to again appear

and deactivate ELAC 2

which was now the only remaining flight control computer.

And, of course, this is exactly what happened

at time 15:05:10.

At that time, the captain had already given the order

to the first officer to go which meant

that the TO/GA thrust had now been set

and they were therefore completely committed to the takeoff.

As ELAC 2 shut down, the warning crickets

and lights came on just as the captain called, "Rotate."

And because all flight control computers

had now stopped working,

the aircraft had gone into mechanical backup in pitch.

What this meant was that the poor trainee,

now tried to pull back on his side-stick

to rotate the aircraft but this made no difference at all

since the elevators was moving to neutral,

making the side-stick completely useless in pitch.

The stabilizer which had been moving

towards zero, had, at this point, a slight positive angle

of 3.5 degrees but with the speed of 130 knots,

this was still not enough to get the aircraft airborne.

The captain saw that the speed was increasing

and nothing was happening but he had obviously

not yet understood what was happening to his aircraft.

He called out, "Rotate, Rotate!"

to which the trainee desperately responded that he was.

The aircraft continued to accelerate to 152 knots

and when the horizontal stabilizer finally stopped moving,

it had a nose-up angle of 1.5 degrees

which was just enough to get the aircraft airborne.

They now slowly started climbing

with the first officer's side-stick

in the almost full aft position

but making no difference whatsoever.

Two seconds into the flight,

the captain started moving his own side-stick

which triggered a dual input warning

and he then pushed the priority button

and called out, "I have controls."

Remember this was still only a few seconds

into this event and by taking over

the controls the captain was responding correctly.

But now he was faced with a situation

that he had never seen before nor had he been trained for.

His aircraft which had, up until this point,

worked almost perfectly was now completely impossible

to control using normal means

and he just couldn't figure out why.

Like I said, the decision to reject or continue the take-off

had already been taken

when the fault appeared and they were now airborne.

It is likely that this sudden increase

in workload and stress was what caused the captain

to now take a few rapid bad decisions

which would make this situation truly catastrophic.

Because about four seconds after he had taken controls,

the trust levers were momentarily moved back

to the idle position before being pushed back up again

and as that was happening, the flaps were also moved

from position two to one, possibly in a futile attempt

to try to affect the pitch.

But when that happened, the aircraft was at 19 feet,

slightly climbing with a pitch of 2.8 degrees nose up.

But this sudden decrease in thrust and flaps

meant that the aircraft now started reducing the pitch

and after it had reached a maximum altitude of 48 feet,

it now started descending

at the same time as the captain asked for gear up.

The trainee first officer responded,

obviously completely overwhelmed by the situation,

so he simply did what he was told

and selected the gear lever up,

causing the gear to start transitioning.

About four seconds, later the aircraft impacted

the ground about 200 meters away

from the runway end with the gear still partially extended.

It touched down with 2.85 g which is a pretty hard impact

and this, combined with the partially retracted gear

caused both of the engine nacelles to slam into the asphalt.

But since the nose gear was still out at this point,

the impact caused a bounce movement

of the nose that pushed it back up into the air.

The engines were both now back in TO/GA,

producing full thrust and since the speed

had been around 190 knots when the impact occurred,

this forced the airliner back into the air

with a terrifying climb rate of around 6,000 feet per minute.

Now things started to look really, really bad.

Neither the captain nor the first officer

had, at this point, managed to figure out

what was going on and none of them

had seen the manual pitch trim only message

on their primary flight displays.

The aircraft was now pitching up

with 19 degrees with a speed of 207 knots

when suddenly, the flaps also locked up.

On top of that, the impact of the number 2 engine

had ruptured internal components

and the sparks created from the impact

had started an engine fire which triggered all

of the associated warnings inside of the cockpit.

This was clearly heading towards a disaster,

but thankfully, now the safety pilot was sitting

behind the captain started speaking up.

He called out, "Manual pitch trim only, manual pitch trim only!"

And that got the captain back into the loop and he now

started moving the trim wheel forward.

He also brought the thrust levers back

and the combined effect of both of those actions

meant that the pitch now finally started decreasing

and getting back under some type of relative control.

But obviously, this was far from over.

At time 15:05:53, less than a minute

into this emergency, the aircraft

reached its highest altitude of 1,590 feet.

From then on, it started pitching down again

and it was soon in a 7,200 feet per minute descent.

The captain moved the thrust to TO/GA again

whilst moving the trim wheel in the opposite direction

and remember, flying an aircraft with the trim only

is not easy as there's always a delay

to the effect and this was not something

that they had been trained for doing.

The aircraft's ground proximity warning system

was now calling out, "Sink rate, pull up!

Terrain! Terrain! Too low! Terrain!"

And on top of that, all of the cricket warnings

and lights associated with a blazing engine fire

were still sounding.

This was an absolutely crazy situation

and to think that the captain was

now sharing the cockpit

with a poor brand new cadet

doing his first ever flight in the aircraft,

makes this absolutely heartbreaking.

The lowest point that the aircraft reached

during this massive dive was around 600 feet

before the captain again regained control

and got the aircraft's climbing back up to about 1,200 feet.

The status of his aircraft at this point

was that both engines were severely damaged

with engine two still on fire, pitch control was in mechanical backup

and roll in direct law and on top of that,

the flaps were locked in position.

Not a great day.

The captain tried to send out a mayday call but failed

to get it to transmit during the commotion.

But the safety pilot now started reading out

the ECAM warnings and this seemed

to have a calming effect on the crew.

Often when faced with complete chaos,

it's a great idea to return back to basics

and continue to follow familiar procedures

and that's because the human mind is just not equipped

to process this much information at once

but it can allow to follow familiar tasks.

At time 15:06:58, two minutes into this emergency,

the captain again tried to send out an emergency call

but now the safety pilot instead asked

to take over the communication,

letting the captain concentrate on just flying.

And after he had taken over,

he finally managed to transmit

that first mayday call into air traffic control.

He advised them that they had flight control fail

and the captain told him to ask

if they could make a right turn straight back

to land on the opposite runway instead.

This was immediately approved by the tower

and the captain now started visually turning right

to align with the final.

At the same time, he also asked

the student to change seats with the safety pilot

and the student quickly debuckled his seatbelt,

stood up and together with the CAA inspector,

moved back into the cabin and strapped in.

Now it was up to the two remaining pilots

to try and get this stricken bird

down on the ground in one piece.

The safety pilot started by pushing

the master fire warning button

which got rid of the visual warnings as well as the crickets.

This would have made the cockpit environment

much more bearable and with that, greatly reduced the stress.

The captain asked what the runway heading was

for Runway 26 and the safety pilot responded 262 degrees

whilst he also set that up into the flight management computer.

He then continued by informing air traffic control

about the engine fire so that they could alert the fire brigade

and he also told the controllers

that they were definitely going to try and land on Runway 26.

Now came the time to try and deal with the problem

so the safety pilot suggested

to the captain that they should reduce power

on the still burning engine number two.

But here the high experience

of the captain really started to shine through

because he now told the safety pilot that he would prefer

to use the two engines he had for as long as possible

and hopefully, have them available for landing

rather than shutting one of them down now.

Not dealing with an engine fire would feel

very counterintuitive for any pilot but the golden motto,

aviate, navigate, communicate always takes precedence.

And in this case the engines were not only needed

in order to provide propulsion but also for pitch control

so this decision makes complete sense.

At time 15:09, the captain asked

for gear down as he started

his descent down towards the runway.

But only 19 seconds later, engine number two finally gave up

and failed as the fire had now completely destroyed

several of its vital components.

The safety pilot informed the captain that engine number two

has failed, which the captain acknowledged

whilst just continuing to aim for the runway as best as he could.

The loss of one of the engines

would have made the pitch control even more difficult.

A few seconds later, the captain confirmed,

"Gear is down," and asked for flaps three.

The safety pilot moved the flaps to three

but it's unclear from the report

if the flaps actually started moving or not.

But what we do know is that seven seconds

after this, engine number one, the only remaining engine

also failed due to the auxiliary gearbox seizing up.

And this cut off all power to several of the aircraft systems

including the cockpit voice recorder

and the flight data recorder.

In theory, this loss of both engines

should have also removed all power

from the hydraulic motors, moving the horizontal stabilizer

which was now the only remaining means of pitch control

but somehow this didn't happen.

It is possible that engine number two

continued to windmill and that this was enough

to maintain minimum hydraulic power.

The ram air turbine or RAT deployed after a few seconds

which meant that some systems came back and when they did,

the first officer stated, "Gear is down, we don't have engines,"

and then he started reading out the airspeed.

150.

130.

120.

And at time 15:10:12, the aircraft

finally touched down hard

just about 150 meters short of Runway 26.

The touchdown was so hard

that all main tires immediately burst

but the aircraft still reached

the runway in one piece where it started decelerating

and then finally veered off to the left where it came to a stop

just a few meters to the side of the runway.

Everyone was alive and a true miracle had just happened.

The investigation quickly honed in

on the fact that there were little guidance available

in the SmartLynx training manual

regarding the continuation of training with reoccurring faults

and since there was no limitation from Airbus

on the number of times that

the computers could be reset there was no real reason

for the captain to discontinue the training.

The fact that the captain decided

to disarm the spoilers for each approach was what led

to that small bounce that triggered

the last couple of faults but again,

this was not specifically forbidden in the manual.

Airbus has, after this incident,

introduced numerous software improvements

and they have forbidden the reset

of any ELAC computer in flight.

The SmartLynx manuals have also been updated

to reflect much clearer guidance

for base training and also for general dispatch

and if you want to see all of the recommendations

and safety improvements that came out of this accident

then please visit mentourpilot.com

using the link that we have here below

where you can always get the best aviation news

as well as downloading my app.

Consider supporting our work

by sending a Super Thanks using the dollar button here below,

maybe buy some merch or join my fantastic Patreon crew

to help me create these videos.

Have an absolutely fantastic day wherever you are

and I'll see you next time, bye bye.