|University of Bielefeld - Faculty of technology|
Networks and distributed Systems
Research group of Prof. Peter B. Ladkin, Ph.D.
|Back to Abstracts of References and Incidents||Back to Root|
UK Air Accident Investigation Board
AAIB Bulletin No: 3/95
|Aircraft Type and Registration:||Airbus A340-311, G-VAEL|
|No & Type of Engines:||4 CFM 56-5C turbofan engines|
|Year of Manufacture:||1993|
|Date & Time (UTC):||19 September 1994 between 1435 and 1501 hrs|
|Location:||London Heathrow Airport|
|Type of Flight:||Scheduled Public Transport|
|Persons on Board:||Crew - 15 Passengers - 281|
|Injuries:||Crew - None Passengers - None|
|Nature of Damage:||None|
|Commander's Licence:||Airline Transport Pilot's Licence|
|Commander's Age:||30 years|
|Commander's Flying Experience:||7,500 hours (of which 500 were on type)|
|Last 90 days - 130 hours|
|Last 28 days - 30 hours|
|Information Source:||AAIB Field Investigation|
On the ground at Narita Airport, the only recorded defect of operational significance was that one of the two Fuel Control and Monitoring Computers (FCMC) indicated numerous faults during preparations for the flight. The aircraft was despatched with just one operative FCMC in accordance with the approved Master Minimum Equipment List. The departure was normal but the planned cruising level was not available from Air Traffic Control until some 69 minutes after takeoff which resulted in the aircraft using about 2 tonnes of the 3.8 tonnes contingency reserve. Thereafter, routine checks of fuel remaining were calculated in accordance with the Flight Crew Operating Manual (FCOM) instructions for a single FCMC fault by subtracting the fuel used indications from the fuel quantity loaded. During most of the flight, these checks indicated that the aircraft could land at Heathrow with between 6.1 and 6.3 tonnes of fuel remaining.
Early during the cruise, the map symbology on the commander's Electronic Flight Insturment System (EFIS) diappeared and although the flight plan was still displayed on his Multifunction Control and Display Unit (MCDU), all calculations had ceased. The first officer who was handling the aircraft, still had a fully functional EFIS and MCDU so the commander restored his own EFIS display by switching to the `BOTH ON 2' position thereby utilising the first officer's display management computer (DMC) to drive both EFIS displays. About an hour later the commander returned his EFIS display selector to the normal position to see if the navigation display had been restored, which it had. The aircraft then flew the remainder of the cruise with normal EFIS selections and normal navigation system performance.
Apart from the temporary loss of the commander's EFIS display, the cruise portion of the flight was unremarkable and the pilots each obtained some rest in the flight crew bunk. In the latter portion of the cruise, logical indications from the No 2 FCMC were restored by resetting the computer. At this stage the tank quantities indicated that fuel was out of balance laterally by 1.5 tonnes left side heavy and so the pilots balanced the fuel by selective switching of the transfer pumps. The aircraft also encountered headwinds that were slightly stronger than forecast and the last recorded fuel check about one hour before landing indicated that the aircraft would land at Heathrow, assuming no delays, with 5.7 tonnes of fuel remaining.
There was insufficient time for the crew to attempt to restore the EFIS displays so the commander notified ATC of their navigation problem and the aircraft was given radar vectors to Lambourne and instructed to descend to Flight Level (FL) 80 at 210 kt IAS. The controller then asked the crew to confirm that the aircraft could still make an ILS approach because the runway visual range had reduced to 1,100 metres in heavy rain. The controller was assured that it could. At about this stage the commander began tuning the ILS, ADF and DME receivers for the approach to Runway 09 Right using the Radio Management Panels. This is a `back-up method' and each aid for each pilot has to be individually tuned using concentric frequency selector knobs in conjunction with a separate selector key for each receiver. Whilst tuning the navaids for both pilots, the crew received an ECAM warning of low fuel state and instructions to open the crossfeeds for Nos 3 and 4 engines. Shortly afterwards the low fuel state warning recurred and the ECAM instructed the crew to open the crossfeeds for Nos 1 and 2 engines. At this stage the ECAM gave a fuel on board figure of 4.5 tonnes, some 2 tonnes less than expected. Because the indicated fuel on board was less than the required diversion fuel, the commander asked for the aircraft's position in the sequence of landing aircraft. When told his aircraft was number seven in the sequence the commander replied "WE'RE GONNA HAVE TO CUT THAT SHORT, WE'RE DECLARING A FUEL PROBLEM". The controller then asked the crew "JUST CONFIRM ITS A FULL EMERGENCY" to which the commander replied "NEGATIVE, ITS NOT A FULL EMERGENCY AT THE MOMENT BUT WE WILL HAVE TO CUT THAT SEQUENCE SHORT IF POSSIBLE". Before beginning further discussion with the commander the controller then cleared the aircraft to descend to 4.000 feet on the QNH. After a short discussion, the commander agreed to declare a `full emergency' whereupon ATC agreed to give the aircraft priority. When asked if the aircraft could accept a 16 mile final approach track, the commander stated that it could; at this stage the aircraft was above 7,000 feet altitude.
After a frequency change the aircraft was asked "ARE YOU HAPPY WITH 14 MILES?". The reply from the handling pilot was "YES THAT'S FINE"; at this stage the aircraft was at about 7,000 feet altitude at 210 kt. The controller informed the crew that there were no speed restrictions and asked "IF I TURN YOU ON TO BASE LEG THERE YOU GOT ABOUT ELEVEN MILES, IS THAT OK" to which the crew replied "AFFIRMATIVE"; at this stage the aircraft was descending through 6,000 feet. On the final approach intercept heading of 120° the aircraft was cleared to descend to 2,000 feet; it was then about nine miles from the runway at 5,300 feet at 175 KIAS and flaps at position 2. The crew informed ATC that they had established on the localiser and received clearance for further descent on the ILS before being sent to the Tower frequency.
The handling pilot was using the autopilot to acquire the ILS and he had armed the approach mode. The aircraft intercepted a glideslope at 5 miles at an altitude of about 4,900 feet. The capture was very dynamic and the glidepath bar moved rapidly down the ILS display before moving rapidly up once again; the autopilot's attempt to follow the glidepath resulted in unusually high pitch rates and so the autopilot was disconnected. The commander informed the Tower "WE'VE GOT TO DO AN SRA.... WE'RE NOT PICKING UP THIS GLIDESLOPE". Radar vectors were then given for the surveillance radar approach terminating at two nautical miles and the crew were informed that the cloud coverage was now 2 oktas at 400 feet, 5 oktas at 500 feet and 8 oktas at 900 feet.
Initially the SRA proceeded normally and the co-pilot re-engaged the autopilot in heading and height modes. On the base leg heading of 180°, when a left turn onto 130° was demanded using the heading selctor knob, both heading bugs went left to 130° and the commander's flight director bar went to the left. However, the co-pilot's flight director bar went to the right and the aircraft turned right. At this stage the co-pilot disconnected the autopilot and flight directors and flew the aircraft manually in accordance with the headings and advisory altitudes. However, because of the unwanted turn, the aircraft overshot the centreline and large heading corrections were required to regain it. When the aircraft was established on the centreline and descent profile, both sets of ILS indications appeared to give correct information. After informing the crew that the RVR was now 1,300 metres, the controller cleared the aircraft to land and continued with the `talkdown' commentary. The crew saw the runway at about 500 feet altitude and the aircraft landed at 1503 hrs. After taxiing in and shutting down, the fuel indications recovered to 4.5 tonnes.
Several cases of abnormal fuel quantity indications have been reported by operators.
The following phenomenons have been observed
|1.||On ground when FOB quantity is above 75t there is an underread
FOB above ECAM indication). The cockpit indication may be out of tolerance by
45 kg for each ton above 75 t fuel on board.
2. The inner tank quantity indication is affected by the significant pitch variations.
|This induces:||- an overread in climb (up to 4t at the end of the climb)|
|- an underread in descent (up to 1t at the end of the descent).|
|3.||When the fuel quantity in each inner tank is between 3 and
7 t, an underread of up to |
1,3t on the FOB may occur.
|This can be noticed especially on ground at pump ON selection.|
After pump OFF selection a stabilization time of about 10 minutes is necessary to get
an assessment of fuel remaining at the end of flight.
|In flight this phenomenon can induce some fluctuations of
the indicated quantity linked |
to fuel shifting due to aircraft movements.
|1.||A solution to cancel this anomaly is under investigation.|
|2. & 3.||A solution to these anomalies will be provided with FCMC standard 6*.|
In flight consider that a stabilization time of 15 minutes in cruise is necessary to get an accurate fuel indication.
In addition, as recommended in SOP 3.03.16 P.2:
- during descent preparation: check FUEL USED indication,
- in Go Around phase: Use FUEL USED indication to determine remaining fuel quantity.
On ground with each inner tank quantity between 3 and 7t, if the fuel quantity decreases at pumps ON selection, consider that the right value is the value with pumps off.
|*||Centre of gravity (CG) control in the A340 is effected by transferring fuel to or from a trim tank in the horizontal stabiliser. The fuel gauging errors have resulted in at least one departure with the CG too far forward because there was 2 tonnes less fuel than expected in the trim tank. Action pending by Airbus Industrie to correct fuel quantity errors involves the installation of five additional fuel probes in each inner tank and software standard 6.0. Action to correct CG control errors is contained in a software only upgrade to standard 6.1.|
The AAIB consulted A340 operators outside the UK regarding their experiences with incorrect fuel quantity indications. All the airlines which replied had experienced the problem at some stage although some had overcome the problems with the help of Airbus Industrie. Those who still suffered the problem anticipated an improvement following the embodiment of the extra probes and FCMC standard 6.0 in late 1994 or early 1995. In the meantime, one operator carried an extra 2 tonnes of fuel to prevent nuisance low fuel state warnings.
The AAIB canvassed other A340 operators. Two airlines had not suffered any double FMGS failures but two had. Of the latter, one airline had suffered just one double failure but the other had suffered three double failures. The cause of these three failures had been identified as anomalies in the airlines's policy file of the navigation database which produced incorrect values for negative or zero entries. A fix for this problem was identified by the FMGS vendor.
Airbus Industrie were aware of the double FMGS failure mode which had first emerged on the A320 series aircraft. On A320/330/340 aircraft, each FMGEC is linked to its own set of peripherals and inertial reference system. Both FMGECs achieve their own computations and exchange data through a cross talk bus. One FMGEC is declared as master and the other as slave; the master FMGEC is related to the engaged autopilot. Some data in the slave FMGEC is synchronised to the master but all data inserted on any MCDU is transferred to both FMGECs and to all peripherals.
According to Airbus Industrie, there are several ways in which the exchange of data and/or a problem in one computer can affect the other computer. Often the computers reset themselves after a few seconds but occasionally a fault results in repetitive resets or attempts to resynchronise. The fifth reset latches the computer which will not recover without a power interrupt. Reset breakers for manual power interrupts are on the flight deck overhead panel. Dual resets occur when both FMGECs encounter failures at the same time. They generally occur after a pilot entry which involves use of the navigation database or to an event synchronised between both flight management systems. Latched double failures usually occur if pilots successively perform three inputs which cause a reset or for an `impossible' computation of predictions.
Airbus Industrie have succeeded in radically reducing the frequency of double FMGS failures on the A320 series aircraft; they are also addressing the problem on the A330 and A340 series. The AAIB has asked Airbus Industrie assist in identifying the cause of the double FMGS failure which occurred in G-VAEL. If the fault is identified, the facts will be reported in a subsequent AAIB bulletin.
It is recommended that the reliability of the Airbus A340 FMGS
and the fuel management system should be reviewed to ensure
that modified software and hardware required to achieve a
significant improvement in reliability is introduced as
quickly as possible and the subsequent system performance
[Safety Recommendation 95-1]
Every effort has been made to ensure this text is syntactically identical
to the original source.
Peter Ladkin gratefully acknowledges the AAIB for permission for this use of their material.
|Peter B. Ladkin, 1999-02-08|
by Michael Blume