Airbus is developing a retrofit to reduce the risk of system logic weaknesses that played a role in the SmartLynx A320 touch-and-go accident at Tallinn last year.
While performing touch-and-go circuits for student pilots, the aircraft lost elevator control just after landing, a situation which the crew only discovered as the jet accelerated towards rotation again.
It became airborne as a result of the horizontal stabiliser setting before bouncing heavily on the runway and entering a sharp climb with its engines damaged and elevators inoperable.
Estonian investigation authority OJK found that, during each landing, the instructor pilot had been grasping the trim wheel to prevent the stabiliser from returning to neutral, in order to maintain a take-off setting.
This action would have been observed as a discrepancy between the stabiliser’s actual and commanded positions. In order for this situation not to be interpreted as a runaway, an override mechanism is designed to detect manual takeover, disengage the pitch-trim actuator and trigger three microswitches.
But the inquiry found that the wrong sort of oil – with twice the viscosity of the oil required – was used in the override mechanism, resulting in a “non-standard” friction curve of the mechanism’s clutch, and incorrect microswitch activation.
Maintenance documentation does not require any test of the override during regular checks, it adds, and “could have contributed” to the wrong oil being left unnoticed.
OJK says the instructor’s manual grasping of the stabiliser trim wheel was not registered correctly by the override, generating erratic microswitch triggering and the loss of elevator aileron computer control.
At the moment of the touch-and-go incident on 28 February last year, this sequence had rendered both elevator aileron computers unavailable.
Airbus is developing a software modification for this computer, intended to “mitigate the consequences” of a failure to detect manual takeover of the horizontal stabiliser through the trim wheel, it adds. Certification of this upgrade and global retrofit is planned for mid-2020.
When neither elevator aileron computer is available the system logic shifts pitch control to the spoiler elevator computer.
But OJK also found that a “design flaw” allowed a single event – a shallow rebound during the landing – to trigger a consolidation logic discrepancy between the spoiler elevator computer’s two channels, with one computing elevator orders in ‘flight’ law and the other computing orders in ‘ground’ law.
It resulted in the loss of control of both elevators by both spoiler elevator computers, and subsequently to the elevators’ moving and locking in the neutral position – setting up the failure to rotate when the A320 accelerated for take-off.
Airbus has initiated developed of a modification which, the inquiry says, will improve the weakness in the consolidation logic and increase robustness of the spoiler elevator computer against landing-gear bounce.
All seven occupants of the A320, including four student pilots, survived after the instructor and a safety pilot managed to use thrust from the damaged engines and horizontal stabiliser trim to return to Tallinn for an emergency landing. Both engines failed before the aircraft touched down and the jet was subsequently written off.
Airbus is developing a retrofit to reduce the risk of system logic weaknesses that played a role in the SmartLynx A320 touch-and-go accident at Tallinn last year.
While performing touch-and-go circuits for student pilots, the aircraft lost elevator control just after landing, a situation which the crew only discovered as the jet accelerated towards rotation again.
It became airborne as a result of the horizontal stabiliser setting before bouncing heavily on the runway and entering a sharp climb with its engines damaged and elevators inoperable.
Estonian investigation authority OJK found that, during each landing, the instructor pilot had been grasping the trim wheel to prevent the stabiliser from returning to neutral, in order to maintain a take-off setting.
This action would have been observed as a discrepancy between the stabiliser’s actual and commanded positions. In order for this situation not to be interpreted as a runaway, an override mechanism is designed to detect manual takeover, disengage the pitch-trim actuator and trigger three microswitches.
But the inquiry found that the wrong sort of oil – with twice the viscosity of the oil required – was used in the override mechanism, resulting in a “non-standard” friction curve of the mechanism’s clutch, and incorrect microswitch activation.
Maintenance documentation does not require any test of the override during regular checks, it adds, and “could have contributed” to the wrong oil being left unnoticed.
OJK says the instructor’s manual grasping of the stabiliser trim wheel was not registered correctly by the override, generating erratic microswitch triggering and the loss of elevator aileron computer control.
At the moment of the touch-and-go incident on 28 February last year, this sequence had rendered both elevator aileron computers unavailable.
Airbus is developing a software modification for this computer, intended to “mitigate the consequences” of a failure to detect manual takeover of the horizontal stabiliser through the trim wheel, it adds. Certification of this upgrade and global retrofit is planned for mid-2020.
When neither elevator aileron computer is available the system logic shifts pitch control to the spoiler elevator computer.
But OJK also found that a “design flaw” allowed a single event – a shallow rebound during the landing – to trigger a consolidation logic discrepancy between the spoiler elevator computer’s two channels, with one computing elevator orders in ‘flight’ law and the other computing orders in ‘ground’ law.
It resulted in the loss of control of both elevators by both spoiler elevator computers, and subsequently to the elevators’ moving and locking in the neutral position – setting up the failure to rotate when the A320 accelerated for take-off.
Airbus has initiated developed of a modification which, the inquiry says, will improve the weakness in the consolidation logic and increase robustness of the spoiler elevator computer against landing-gear bounce.
All seven occupants of the A320, including four student pilots, survived after the instructor and a safety pilot managed to use thrust from the damaged engines and horizontal stabiliser trim to return to Tallinn for an emergency landing. Both engines failed before the aircraft touched down and the jet was subsequently written off.
