ATM Modernization, Business & GA, Commercial, Military

Safety in Avionics: Cross-Wired Controls

By David Evans | August 1, 2001

A Lufthansa A320 came within less than two feet and a few seconds of crashing during takeoff on a planned flight from Frankfurt to Paris.

Preliminary reports indicate that maintenance performed on the captain’s sidestick controller immediately before the incident flight had inadvertently created a situation in which control inputs were reversed. The case reveals that at least two "filters," or safety defenses, were breached, leading to a near-crash shortly after rotation at Frankfurt’s Runway 18. Quick action by the first officer prevented a catastrophe.

The German aircraft accident investigation branch, the Büro für Flugunfalluntersuchung (BFU), is investigating the case. Given the significance of the incident regarding the worldwide Airbus Industrie fly-by-wire fleet (A319, 320, 321, 330 and 340) and its implications for maintenance of other fly-by-wire aircraft, the German authorities have said their report will be issued in English. The release of that report is months away.

Meantime, this much has been reported in other media and is known from additional sources: During the March 20 takeoff with the captain as the pilot flying (PF), the airplane encountered some degree of turbulence shortly after rotation, resulting in the left wing dipping down. The turbulence may have come from the wake vortex of another aircraft landing on Frankfurt’s runway 5R prior to the incident aircraft starting its takeoff run.

The captain responded to the wing dip by applying a right input to his sidestick controller. In response, the left wing banked down even more–the exact opposite of the response the captain expected. A further right input resulted in the left wing banked down some 21�,and the wingtip came within a scant 1.6 feet (0.48 meters) of the ground.

The first officer, the pilot not flying (PNF), realizing the apparent control problem, switched the control priority to his sidestick and recovered the aircraft. Had the left wingtip struck the ground, the airplane likely would have cartwheeled into a fireball, killing the 115 passengers and crew aboard. According to the BFU, computer modeling of the data from the digital flight data recorder (DFDR) indicated that the incident airplane came within seconds of striking the ground.

After recovering the airplane, the crew engaged the autopilot and climbed to 12,000 feet. Various handling checks were performed to confirm that the captain’s sidestick was producing "outputs" that were the opposite of "inputs" in roll. The crew prudently elected to conduct a precautionary landing at Frankfurt rather than continue the flight.

German investigators, Lufthansa officials and representatives from manufacturer Airbus are focusing their inquiry on the maintenance actions that preceded the incident flight. In the process of troubleshooting and repairing an elevator/aileron computer (ELAC–one of two on the A320), Lufthansa Technik personnel found a damaged pin on one segment of the four connector segments (with 140 pins on each) at the "rack side," as it were, of the ELAC mount.

Repair work involving complete rewiring "upstream" of the connector pins was conducted over several work shifts by various technicians. In the process, according to preliminary reports, the polarity inadvertently was reversed on four wires in one connector segment. Two of the wires were for the roll control input and two were for the associated control channel "outputs." It is believed from preliminary accounts that the technicians correctly followed the wiring list. However, BFU officials and maintenance personnel maintained that the wiring lists for individual aircraft may differ. There’s a latent hazard for you, just begging for some technician to perform perfect repairs based on the wrong wiring list.

One pilot observed, "If it were the case that control wiring differed at the ELAC connector between models of the same type, the ELACs would not be interchangeable...and this is not the case." True, but the male/female marriage of connectors and pins (all 560 of them among the four connector segments) is not the issue. Rather, it is the color-coding scheme of the wiring to the backside of the connectors on the rack to which each ELAC is mated.

Before the airplane left the hangar at Frankfurt for return to service, a flight control check was performed using the respective indications on the cockpit ECAM (Electronic Centralized Aircraft Monitoring) display. The BFU confirmed that the mechanic’s flight control check was limited to the first officer’s sidestick, not the captain’s on the left side of the cockpit. Whether a maintenance technician would be sufficiently astute to catch aileron deflection in the wrong direction is another matter. It is not certain if anyone was standing outside the airplane to double check actual movement of flight control surfaces.

The details of such procedures will be part of the BFU inquiry. The question of any time pressure to get the work done also seems certain to be explored, as well as whether a test flight before the aircraft was returned to service would have uncovered the reversal problem. After all, this was a repair to a primary flight control system (as opposed to a flight management system).

Every crew routinely exercises the flight controls as part of its preflight check. On the A320, the Flight Control page on the ECAM will appear when the sidestick is moved as part of the preflight check. The sidestick must be held about three seconds for full travel to be reached; it takes that long for the ECAM to generate a fault message.

Some confusion exists in the pilot community about whether these checks will be displayed on the ECAM as contro linputs (the position of the sidestick) or control outputs (actual position of ailerons, etc.). The ECAM will display control outputs, as does the comparable system on the Boeing fly-by-wire B777.

One pilot correctly explained the functioning and went on to surmise what may have happened:

"Four position sensors called linear voltage differential transducers (LVDTs–used with aircraft control surface servos) look at the ailerons. This is quite independent of the sidestick positions. This display would not have been affected or reversed because of any miswiring of the sidestick...

"On control checks during taxi out, the pilots saw spoiler movement and aileronmovementin response to commands from each sidestick, correctly displayed on [the] ECAM. It just happened to be in the wrongdirectionfor one stick. Really quite easy to miss at a very busy time, and so unexpected. Every pilot does control checks, thousands of times. It is always correct, isn’t it? Except for this oh-so-rare occasion."

The check often is made during taxi out, a high workload period, rather than before pushback at the gate. Accordingly, the PF is moving his control actuators while keeping his eyes focused on activity outside the airplane, while the PNF is keeping his eyes locked on the ECAM display. In this arrangement, the PNF is not looking at and probably is not able to see the direction in which the PF is testing the sidestick. As such, the PNF may be looking at the ECAM more for confirmation of deflection, but not necessarily for direction of deflection.

In any event, the wiring fault got by at least two safety "filters," as it were. It was not detected during maintenance, and it was not detected during the preflight check.

The fact that this incident did not end with investigators piecing through charred wreckage is fortuitous. In the unfortunate event of a crash, there might not have been sufficient evidence pointing to a connector/wiring fault. Absent such evidence, investigators may have invoked "pilot error" based on a finding of incorrect banking associated with wake turbulence.

To be sure, crossed or reversed flight control cables on conventional aircraft have caused more than one crash. There is a grim history of such events on military and general aviation aircraft. If one control stick is connected backwards, then both yokes are misrigged, and both pilots are faced with the same parlous problem.

However, reversed controls are deemed impossible on transport-category aircraft, with their combination of cables and pushrods. Consider the "conventional" B737. A Boeing official declared it is impossible to reverse the connection of steel cables to hydraulic flight control actuators. Even if done deliberately, the pilots would instantly discover that they could not physically move their flight controls.

In the case of the A320, one aspect of the aircraft’s fly-by-wire design may have enabled the first officer to quickly gain control of the aircraft: the ability to isolate a malfunctioning sidestick and shift command to the other sidestick at the push of a button. As one pilot noted: "I would say that on this occasion, it was because of Airbus technology that a major incident was avoided!"

That may be so. But the case may well illustrate how avionics protections against human error in the cockpit can be reversed into outright hazards by human error on the maintenance floor. The BFU may have "just" an incident on its hands to investigate, but the safety issues are profound.

Receive the latest avionics news right to your inbox

Curated By Logo