University of Bielefeld -  Faculty of technology
Networks and distributed Systems
Research group of Prof. Peter B. Ladkin, Ph.D.
Back to Abstracts of References and Incidents Back to Root

UK Air Accident Investigation Board

AAIB Bulletin No: 3/95

Ref: EW/C94/9/2

Category: 1.1

INCIDENT

Aircraft Type and Registration: Airbus A340-311, G-VAEL
No & Type of Engines: 4 CFM 56-5C turbofan engines
Year of Manufacture: 1993
Date & Time (UTC): 19 September 1994 between 1435 and 1501 hrs
Location: London Heathrow Airport
Type of Flight: Scheduled Public Transport
Persons on Board: Crew - 15 Passengers - 281
Injuries: Crew - None Passengers - None
Nature of Damage: None
Commander's Licence: Airline Transport Pilot's Licence
Commander's Age: 30 years
Commander's Flying Experience: 7,500 hours (of which 500 were on type)
Last 90 days - 130 hours
Last 28 days - 30 hours
Information Source: AAIB Field Investigation

History of the flight

The aircraft departed Narita Airport in Japan at 0233 hrs on 18 September for the 12 hour 50 minute overnight scheduled service to London Heathrow. The aircraft had been loaded with 84.1 tonnes of fuel resulting in a take-off weight of 18 tonnes below the maximum structural weight. The fuel quantity required for the flight had been determined by adding to the anticipated fuel burn of 75.5 tonnes a contingency allowance of 3.8 tonnes; 2.0 tonnes for diversion to the planned alternate of Gatwick Airport; 2.3 tonnes reserve (equivalent to 30 minutes holding) and 500 kg for taxiing. No `additional' fuel in excess of the minimum requirement was carried. The planned fuel remaining on touchdown was 8.1 tonnes assuming that the contingency allowances were unused. The operating company's minimum fuel requirement for diverting to Gatwick Airport was 4.3 tonnes.

On the ground at Narita Airport, the only recorded defect of operational significance was that one of the two Fuel Control and Monitoring Computers (FCMC) indicated numerous faults during preparations for the flight. The aircraft was despatched with just one operative FCMC in accordance with the approved Master Minimum Equipment List. The departure was normal but the planned cruising level was not available from Air Traffic Control until some 69 minutes after takeoff which resulted in the aircraft using about 2 tonnes of the 3.8 tonnes contingency reserve. Thereafter, routine checks of fuel remaining were calculated in accordance with the Flight Crew Operating Manual (FCOM) instructions for a single FCMC fault by subtracting the fuel used indications from the fuel quantity loaded. During most of the flight, these checks indicated that the aircraft could land at Heathrow with between 6.1 and 6.3 tonnes of fuel remaining.

Early during the cruise, the map symbology on the commander's Electronic Flight Insturment System (EFIS) diappeared and although the flight plan was still displayed on his Multifunction Control and Display Unit (MCDU), all calculations had ceased. The first officer who was handling the aircraft, still had a fully functional EFIS and MCDU so the commander restored his own EFIS display by switching to the `BOTH ON 2' position thereby utilising the first officer's display management computer (DMC) to drive both EFIS displays. About an hour later the commander returned his EFIS display selector to the normal position to see if the navigation display had been restored, which it had. The aircraft then flew the remainder of the cruise with normal EFIS selections and normal navigation system performance.

Apart from the temporary loss of the commander's EFIS display, the cruise portion of the flight was unremarkable and the pilots each obtained some rest in the flight crew bunk. In the latter portion of the cruise, logical indications from the No 2 FCMC were restored by resetting the computer. At this stage the tank quantities indicated that fuel was out of balance laterally by 1.5 tonnes left side heavy and so the pilots balanced the fuel by selective switching of the transfer pumps. The aircraft also encountered headwinds that were slightly stronger than forecast and the last recorded fuel check about one hour before landing indicated that the aircraft would land at Heathrow, assuming no delays, with 5.7 tonnes of fuel remaining.

The incident

The A340's navigation receivers are normally tuned automatically by computer but during descent the first officer manually tuned the Lambourne VOR beacon using his MCDU so that he and the commander could satisfy themselves that their EFIS navigation displays were accurate, which they were. After a period of radar vectoring the aircraft was cleared to navigate direct to the VOR beacon but a few miles east of Lambourne, the commander's EFIS map display symbology froze and lost all computed data for no apparent reason. His MCDU displayed the message `PLEASE WAIT' together with a data entry page normally seen only when initialising the computer before flight; he was unable to obtain any other display. At about the same time or very shortly afterwards, the first officer's EFIS and MCDU exhibited identical behaviour.

There was insufficient time for the crew to attempt to restore the EFIS displays so the commander notified ATC of their navigation problem and the aircraft was given radar vectors to Lambourne and instructed to descend to Flight Level (FL) 80 at 210 kt IAS. The controller then asked the crew to confirm that the aircraft could still make an ILS approach because the runway visual range had reduced to 1,100 metres in heavy rain. The controller was assured that it could. At about this stage the commander began tuning the ILS, ADF and DME receivers for the approach to Runway 09 Right using the Radio Management Panels. This is a `back-up method' and each aid for each pilot has to be individually tuned using concentric frequency selector knobs in conjunction with a separate selector key for each receiver. Whilst tuning the navaids for both pilots, the crew received an ECAM warning of low fuel state and instructions to open the crossfeeds for Nos 3 and 4 engines. Shortly afterwards the low fuel state warning recurred and the ECAM instructed the crew to open the crossfeeds for Nos 1 and 2 engines. At this stage the ECAM gave a fuel on board figure of 4.5 tonnes, some 2 tonnes less than expected. Because the indicated fuel on board was less than the required diversion fuel, the commander asked for the aircraft's position in the sequence of landing aircraft. When told his aircraft was number seven in the sequence the commander replied "WE'RE GONNA HAVE TO CUT THAT SHORT, WE'RE DECLARING A FUEL PROBLEM". The controller then asked the crew "JUST CONFIRM ITS A FULL EMERGENCY" to which the commander replied "NEGATIVE, ITS NOT A FULL EMERGENCY AT THE MOMENT BUT WE WILL HAVE TO CUT THAT SEQUENCE SHORT IF POSSIBLE". Before beginning further discussion with the commander the controller then cleared the aircraft to descend to 4.000 feet on the QNH. After a short discussion, the commander agreed to declare a `full emergency' whereupon ATC agreed to give the aircraft priority. When asked if the aircraft could accept a 16 mile final approach track, the commander stated that it could; at this stage the aircraft was above 7,000 feet altitude.

After a frequency change the aircraft was asked "ARE YOU HAPPY WITH 14 MILES?". The reply from the handling pilot was "YES THAT'S FINE"; at this stage the aircraft was at about 7,000 feet altitude at 210 kt. The controller informed the crew that there were no speed restrictions and asked "IF I TURN YOU ON TO BASE LEG THERE YOU GOT ABOUT ELEVEN MILES, IS THAT OK" to which the crew replied "AFFIRMATIVE"; at this stage the aircraft was descending through 6,000 feet. On the final approach intercept heading of 120° the aircraft was cleared to descend to 2,000 feet; it was then about nine miles from the runway at 5,300 feet at 175 KIAS and flaps at position 2. The crew informed ATC that they had established on the localiser and received clearance for further descent on the ILS before being sent to the Tower frequency.

The handling pilot was using the autopilot to acquire the ILS and he had armed the approach mode. The aircraft intercepted a glideslope at 5 miles at an altitude of about 4,900 feet. The capture was very dynamic and the glidepath bar moved rapidly down the ILS display before moving rapidly up once again; the autopilot's attempt to follow the glidepath resulted in unusually high pitch rates and so the autopilot was disconnected. The commander informed the Tower "WE'VE GOT TO DO AN SRA.... WE'RE NOT PICKING UP THIS GLIDESLOPE". Radar vectors were then given for the surveillance radar approach terminating at two nautical miles and the crew were informed that the cloud coverage was now 2 oktas at 400 feet, 5 oktas at 500 feet and 8 oktas at 900 feet.

Initially the SRA proceeded normally and the co-pilot re-engaged the autopilot in heading and height modes. On the base leg heading of 180°, when a left turn onto 130° was demanded using the heading selctor knob, both heading bugs went left to 130° and the commander's flight director bar went to the left. However, the co-pilot's flight director bar went to the right and the aircraft turned right. At this stage the co-pilot disconnected the autopilot and flight directors and flew the aircraft manually in accordance with the headings and advisory altitudes. However, because of the unwanted turn, the aircraft overshot the centreline and large heading corrections were required to regain it. When the aircraft was established on the centreline and descent profile, both sets of ILS indications appeared to give correct information. After informing the crew that the RVR was now 1,300 metres, the controller cleared the aircraft to land and continued with the `talkdown' commentary. The crew saw the runway at about 500 feet altitude and the aircraft landed at 1503 hrs. After taxiing in and shutting down, the fuel indications recovered to 4.5 tonnes.

Problem Areas

The AAIB identified and investigated the following problem areas: RTF phraseology; ATC vectors and ILS performance; Autopilot and Flight Director heading performance; fuel quantity indications; double Flight Management Guidance System (FMGS) failure and aircraft type certification. These aspects are addressed in subsequent paragraphs.

RTF phraseology

The term `Fuel Emergency' is not recognised by ATC in the United Kingdom. Emergency calls related to fuel shortage should be prefixed by `PAN' or `MAYDAY' as appropriate. This instruction is made clear to holders of Air Operators Certificates in CAP 360 and to pilots in Aeronautical Information Circular (AIC) 43/1994 (Pink 103). According to the CAA, the term `Full Emergency' is an alert state used by ATC. Although the meaning of this phrase may be understood by many pilots, it is not a term with officially recognised status in the CAA's Radiotelephony Manual CAP 413, AIC 43/1994, or in AIC 5/1994 (Pink 98) which cover use of the VHF International Aeronautical Emergency Service.

ATC vectors and ILS performance

Recorded radar data were synchronised with tape recordings of the radar vector information provided by ATC. The analysis showed that the vectors given to the crew of G-VAEL, particularly the track miles to touchdown, were reasonably accurate. There were no reports of doubtful ILS performance from other aircraft landing at Heathrow around the time of the incident. Moreover, on their second approach the crew received ILS indications that were consistent with the SRA guidance given by ATC. Three dimensional reconstruction of the aircraft's flightpath showed that during its first approach it had established on the localiser beam at about 8 miles finals at a height of about 5,000 feet. The aircraft then acquired a false 9° glideslope at about 5 miles from touchdown and 4,800 feet altitude. The steepness of this false glideslope and the shallow sidelobe responsible for it would have resulted in a dynamic capture and the pitch oscillations experienced by G-VAEL. The UK requirements for transmission of a 3° glideslope is elevation coverage between 1.35° and 5.25° above the horizontal; false glideslopes caused by sidelobes are a well known facet of the ILS system when operating above the 5.25° elevation angle. Procedural instrument approaches are generally designed to avoid false glideslopes by ensuring that the correct glideslope is captured from beneath and not from above. CAA guidance on the use of ILS facilities in the UK is contained in AIC 33/1993 (Pink 78) dated 4 March.

Autopilot and Flight Director heading performance

The reason for the wrong response of the autopilot and one flight director to the left turn demand was a software error. The error only occurs when the current selected heading is 180° and within 150 millisecs of a change of heading being initiated, the aircraft's heading varies around 180° in the opposite direction to the heading change. The aircraft was being flown on autopilot No 2 which followed the incorrect guidance produced by flight director No 2. Flight director No 1, which has a different heading reference, was not affected. This software error was known to Airbus Industrie and corrective measures for this and several other software deficiencies were contained in Flight Management Guidance Envelope Computer (FMGEC) standard L-5 which has been issued and incorporated in most A340s on the UK register.

Fuel quantity indications

In July 1994 Airbus Industrie issued an Operations Engineering Bulletin on the subject of fuel quantity indication. This bulletin stated (as written):

----------------------------------------------------------------------

REASON FOR ISSUE
----------------

Several cases of abnormal fuel quantity indications have been reported by operators.

EXPLANATIONS
------------

The following phenomenons have been observed

1. On ground when FOB quantity is above 75t there is an underread quantity (actual
FOB above ECAM indication). The cockpit indication may be out of tolerance by
45 kg for each ton above 75 t fuel on board.

2. The inner tank quantity indication is affected by the significant pitch variations.
This induces: - an overread in climb (up to 4t at the end of the climb)
- an underread in descent (up to 1t at the end of the descent).

3. When the fuel quantity in each inner tank is between 3 and 7 t, an underread of up to
1,3t on the FOB may occur.

This can be noticed especially on ground at pump ON selection.
After pump OFF selection a stabilization time of about 10 minutes is necessary to get
an assessment of fuel remaining at the end of flight.

In flight this phenomenon can induce some fluctuations of the indicated quantity linked
to fuel shifting due to aircraft movements.

ACTIONS
-------

1. A solution to cancel this anomaly is under investigation.
2. & 3. A solution to these anomalies will be provided with FCMC standard 6*.

RECOMMENDATION
--------------

In flight consider that a stabilization time of 15 minutes in cruise is necessary to get an accurate fuel indication.

In addition, as recommended in SOP 3.03.16 P.2:
- during descent preparation: check FUEL USED indication,
- in Go Around phase: Use FUEL USED indication to determine remaining fuel quantity.

On ground with each inner tank quantity between 3 and 7t, if the fuel quantity decreases at pumps ON selection, consider that the right value is the value with pumps off.

----------------------------------------------------------------------

* Centre of gravity (CG) control in the A340 is effected by transferring fuel to or from a trim tank in the horizontal stabiliser. The fuel gauging errors have resulted in at least one departure with the CG too far forward because there was 2 tonnes less fuel than expected in the trim tank. Action pending by Airbus Industrie to correct fuel quantity errors involves the installation of five additional fuel probes in each inner tank and software standard 6.0. Action to correct CG control errors is contained in a software only upgrade to standard 6.1.

The AAIB consulted A340 operators outside the UK regarding their experiences with incorrect fuel quantity indications. All the airlines which replied had experienced the problem at some stage although some had overcome the problems with the help of Airbus Industrie. Those who still suffered the problem anticipated an improvement following the embodiment of the extra probes and FCMC standard 6.0 in late 1994 or early 1995. In the meantime, one operator carried an extra 2 tonnes of fuel to prevent nuisance low fuel state warnings.

FMGS double failures

After landing the aircraft's Central Maintenance System had logged a fault in No 2 FMGEC. This was removed and sent to France for data extraction and fault analysis. No fault was found within the hardware and a comparable software fault could not be reproduced on the test bench. Nevertheless, the BITE data dump showed that at 1435 hrs the No 2 FMGEC had detected a CLASS 1 HARD failure within itself and a simultaneous fault within FMGEC No 1. The investigation was complicated by the involvement of several sub-contractors in the manufacture of the FMGEC and its database.

The AAIB canvassed other A340 operators. Two airlines had not suffered any double FMGS failures but two had. Of the latter, one airline had suffered just one double failure but the other had suffered three double failures. The cause of these three failures had been identified as anomalies in the airlines's policy file of the navigation database which produced incorrect values for negative or zero entries. A fix for this problem was identified by the FMGS vendor.

Airbus Industrie were aware of the double FMGS failure mode which had first emerged on the A320 series aircraft. On A320/330/340 aircraft, each FMGEC is linked to its own set of peripherals and inertial reference system. Both FMGECs achieve their own computations and exchange data through a cross talk bus. One FMGEC is declared as master and the other as slave; the master FMGEC is related to the engaged autopilot. Some data in the slave FMGEC is synchronised to the master but all data inserted on any MCDU is transferred to both FMGECs and to all peripherals.

According to Airbus Industrie, there are several ways in which the exchange of data and/or a problem in one computer can affect the other computer. Often the computers reset themselves after a few seconds but occasionally a fault results in repetitive resets or attempts to resynchronise. The fifth reset latches the computer which will not recover without a power interrupt. Reset breakers for manual power interrupts are on the flight deck overhead panel. Dual resets occur when both FMGECs encounter failures at the same time. They generally occur after a pilot entry which involves use of the navigation database or to an event synchronised between both flight management systems. Latched double failures usually occur if pilots successively perform three inputs which cause a reset or for an `impossible' computation of predictions.

Airbus Industrie have succeeded in radically reducing the frequency of double FMGS failures on the A320 series aircraft; they are also addressing the problem on the A330 and A340 series. The AAIB has asked Airbus Industrie assist in identifying the cause of the double FMGS failure which occurred in G-VAEL. If the fault is identified, the facts will be reported in a subsequent AAIB bulletin.

Type Certification

The A340 was granted a type certificate by the countries of the Joint Aviation Authorities (JAA), as a co-ordinated JAA member activity. When a new aircraft type first enters airline service, there are bound to be a number of minor teething troubles which will take time and effort to identify and correct. Some of these problems will be discovered before the aircraft enters service and a certification authority may judge that, because they do not affect the safe operation of the aircraft, they have no impact on the issue of a type certificate. On the other hand, some problems will inevitably require corrective action before the aircraft is fit for sevice and the certification authority will have to make that judgement. The AAIB has written to the JAA to ascertain whether the certification committee were aware of some of the more significant shortcomings of the A340's fuel and flight management systems before the type certificate was granted.

Safety Recommendation

Although the JAA is the forum for the co-ordination and certification of the Airbus A340 by individual European Authorities, there are no systems in place at present to allow the JAA to respond, as a body, to safety recommendation raised by national investigating authorities. This Safety Recommendation is therefore submitted to the JAA and should be transmitted to the `responsible authority' for the Airbus A340 and to all other JAA states. The JAA and the UK CAA should monitor the safety action arising from this recommendation.

It is recommended that the reliability of the Airbus A340 FMGS and the fuel management system should be reviewed to ensure that modified software and hardware required to achieve a significant improvement in reliability is introduced as quickly as possible and the subsequent system performance closely monitored.
[Safety Recommendation 95-1]

Every effort has been made to ensure this text is syntactically identical to the original source.
Peter Ladkin gratefully acknowledges the AAIB for permission for this use of their material.

Peter B. Ladkin, 1999-02-08
Last modification on 1999-06-15
by Michael Blume