Re: [sc] A320 crash at Habsheim.



Date view Thread view Subject view Author view Attachment view

From: Pete Mellor (pm(at)csr.city.ac.uk)
Date: Wed 28 Aug 2002 - 14:39:51 BST


On Wed, 28 Aug 2002, Smith Mark wrote:

> There has been some debate at work on this subject, I have tried to
> look up on the Internet what the conclusions were but am now even less
> sure of the results. Some blame the pilot for poor attitude to the
> flight others reiterate problems with the altimeter and may be the
> engines and others are claiming that the Lausanne Institute of Police
> Forensic Evidence and Criminology have proved, in May 1998, that the
> black boxes were switched.
> 
> Does any one know what actually happened.

The short answer is "No!", Mark.  The stuff below might explain why.  
----------------------------------------------------------------
Peter Mellor, Centre for Software Reliability, City University, 
Northampton Square, London EC1V 0HB
Tel.: +44 (0)20 7040 8422   Fax.: +44 (0)20 7040 8585  
e-mail: Pete Mellor <p.mellor(at)csr.city.ac.uk> 
---------------------------------------------------------------- 
Excerpt from:- 

[MELL94A] Mellor P.: (at)(at)CAD: Computer-Aided Disaster'', 
High Integrity Systems Journal, Vol. 1, Iss. 2, 1994. 


Habsheim 
---------

(at)(at)The breath-taking demonstrations of Airbus test pilots at air-shows, the
publicity campaigns systematically presenting the aeroplane at high angles
of attack with its nose in the air, the A320 flight manual, our training
on that machine, all led us to believe that there was no danger in flying
at low speed with high angle of attack on that aircraft. The A320's
computers act on the control surfaces to maintain the angle of attack at a
maximal value, sufficiently far from the dangerous value at which stall
occurs. We had, wrongly, delegated to them the respect for safety margins,
and had developed an excessive confidence in this system of flight
envelope protection.''

-- Michel Asseline: (at)(at)Le pilote est-il coupable?'', p152 
(Author's translation) 


The accident 
------------

(at)(at)Merde!'' -- Michel Asseline, Habsheim CVR transcript 


On 26th June 1988, Airbus A320-100 F-GFKC was giving a display flight at
the tiny aerodrome of Habsheim, near Mulhouse in the Alsace region.  It
made its first slow pass at an altitude of 30 feet, flaps extended and
gear down. The second pass, in (at)(at)clean'' configuration, at speed, was
never made. The aircraft failed to regain altitude, ploughed into a forest
beyond the end of the runway, and caught fire, killing 3 of the 130
passengers on board.

The conclusions of the official final report (known as the (at)(at)Bechet
Report'', after the president of the commission) [BECC89A] are that the
causes of the crash (quoted from the report) were:-

* very low flyover height, lower than surrounding obstacles, 
* very low speed, reducing to reach maximum possible angle of attack, 
  with engines at flight idle, and 
* late application of go-around thrust. 

Together with the conclusions that the aircraft was flightworthy, and that
no malfunction of the aircraft or its systems could have contributed to
the crash, these add up to a verdict of (at)(at)pilot error''. The conclusions
of the Bechet Report can be summarised as (at)(at)Too low, too slow, too late''.

The captain on that flight was Michel Asseline, who has since written a
book [ASSM92A] setting out his own view of the causes of the crash.


Human error 
----------- 

Asseline ([ASSM92A] Ch. 4) cites the following (at)(at)links in the chain'' of
human error which contributed to the crash, and to the severity of its
consequences:--

   1) Air France permitted display flights to carry passengers (a practice 
      terminated after the accident). 
   2) Air France (at)(at)company minima'' for display flights were 100 feet 
      above ground level (AGL) in landing configuration and 300 feet in
      clean configuration. In fact, these were 
      outside the limits imposed by national regulations. 
   3) The flight dossier was sent late to the crew, without 
      any verbal briefing, due to an administrative cock-up. It was
      assumed (incorrectly) that the crew were experienced in display 
      flights. 
   4) The map in the dossier was a black-and-white photocopy of a coloured 
      original, and included no key of symbols. As a result, the first
      they knew about 30 to 40ft high trees just beyond the end of the 
      runway was when they saw them in front of their noses 15 seconds 
      of flying time away! 
   5) The crew placed too much confidence in the automated protection
      systems as a result of their training, and of the manufacturer's 
      assurances, both informal and in the manuals, without which they 
      would never have attempted such a manoeuvre. 
   6) The captain did not visit the airport before the flight, nor 
      attend the briefing by the organisers at 10 a.m. on the 
      morning of the show. This would have meant flying the 
      aircraft from Paris to Basle-Mulhouse on the preceding evening, 
      and having it out of regular service for longer than was otherwise 
      necessary. 
   7) The crew thought that they were at 100 feet above the runway at 
      Habsheim. In fact, they were at 30 feet. Several factors, human and 
      technical, contributed to this mistake: 
    
      a) Since they were unused to visiting small airports, they were 
         misled by the visual cues of scale and perspective. 
         Asseline decided to use the barometric altimeter plus the 
         vertical speed indicator to control the low pass, since 
         their readings are displayed in an analogue fashion and so are 
         easier to read than the radio altimeter, which is displayed 
         digitally, and so is impossible to read during very low altitude 
         flight over uneven terrain when the figures are changing rapidly.  
         Unfortunately, the barometric altimeter readings were out by 
         70 feet. (See below.) 
      b) The crew did not hear the lower announcements of the    
         radiosonde synthesised voice, partly since they had other 
         things to think about, partly because the announcements were 
         not relayed through their headsets. 


If any of one of these human errors had been absent, the accident would
not have occurred.  Underlying many of them were the political and
commercial pressures for the A320 to succeed, and therefore for the public
to be impressed by its capabilities.


Technical factors 
----------------- 

Asseline ([ASSM92A] Ch. 5) deals with the technical reasons for the crash 
under the aforementioned headings (at)(at)too low, too slow, too late''. 

1. Too low? 
He was flying too low. The official report [BECC88A] accepts that the
barometric altimeter was giving an incorrect reading.  The height chosen
for the first fly-over was 100ft, within written (at)(at)company minima''
[DOND504]. The technical factors which contributed to the actual height
being 30ft were:--

a) Altimeter failure: 
After the accident, while inspecting the part of the DFDR printout
corresponding to the take-off from Basle-Mulhouse, Asseline [ASSM92A]
discovered that the recorded altitude had risen to 67ft before the wheels
had even left the ground!  The crew had checked their altimeters while on
the runway but would not have checked again until airborne, by which time
the discrepancy had crept in, and was not noticeable at altitude.  On
approach to Habsheim, when they calibrated the altimeter to the altitude
of the airfield, they were 67ft in error.  Asseline suspects that this
might have been due to a fault in the ADIRU software.

b) Non-communicating FMGCs:  
On handing over the aircraft, the captain of the previous flight reported
that the two Flight Management and Guidance Computers (FMGCs) were not
communicating. The data for the Habsheim airport had to be entered by hand
on the MCDU keyboard. Unless identical data were entered on both the
pilot's and co-pilot's keyboards, then if one FMGC went down and the other
cut in, the discrepancy would result in the navigation displays (NDs)
going blank.  They therefore decided to keep it simple and input only the
geographical coordinates of Habsheim.  The amount of information stored in
the FMGS about Habsheim was therefore minimal.


2.  Too slow? 

The aircraft was in fact going slightly faster than the planned speed for
the fly-past.


3.  Too late? 

(In what follows, the timings are those given in [ASSM92A] Ch. 1, and do
not always agree with those in the final report [BECC88A], for reasons
described later. They are given in seconds before the moment of final
impact, H.)

The sequence of events given in [ASSM92A] over the last few seconds of 
the flight was as follows:-- 

The aircraft arrived at a height of (what the crew thought was) 100ft over
the grass runway at H-30 seconds. The synthesised voice announced a radio
altitude of (at)(at)ONE HUNDRED'' just prior to this, but they ascribed this to
unevenness in the terrain.

They finished lining up with the runway, and levelling off for the
fly-past.  At H-20 seconds, when everything still seemed to be going to
plan, the captain advanced the thrust levers and pressed the autothrust
disconnect buttons. The intention was to demand full power on passing the
control tower. At H-14, when nothing seemed to be happening, the captain
moved the thrust levers back to (at)(at)idle'', then forward to the
(at)(at)take-off/go-around'' (TOGA) position. (at)(at)TOGA/SRS'' did not appear on the
screen until H-8, as reported by the co-pilot.  The first sign of
increased thrust appeared at H-6.  First contact with the trees occurred
at H-3.

The official report clearly states that the engines performed to
specification.  Asseline states that he did not get power as quickly as he
expected it, following the selection of TOGA thrust. According to
Asseline's timings, 9 seconds elapsed between the TOGA command and the
spool-up of the engines, instead of the 5 seconds that the engines are
physically capable of (and that the official report claimed). In addition,
the pitch control did not follow the pilot's commands.

Asseline [ASSM92A] suggests that the following possible technical factors
could have contributed:--

A) Engine control delay 

Asseline states that the autothrust mechanism failed shortly after
take-off, and that when he deliberately disconnected A/THR during the
fly-over, this action had no effect. According to the CVR transcript in
the final report, Asseline himself disengaged the autothrust during climb,
and commented that he was so doing.

It should be noted that there was an important reason for disconnecting
autothrust on this flight. The intended fly-over height was 100ft AGL at
maximum AOA. If A/THR was enabled, alpha-floor would be activated and
spoil the demonstration. When or how A/THR was disconnected would have
made little difference to what happened in the final seconds, however. The
point is that the engines might have responded more slowly in the first
part of the fly-over if A/THR was disconnected.

B) Engine stagnation 

Engine performance depends on Variable Stator Vanes (VSVs), which regulate
the flow of air over the compressor. They are moved by hydraulic actuators
pressurised by fuel, in response to the speed of rotation of the engine.  
If they do not move out of their (at)(at)idle'' position, the engine cannot
accelerate, and stagnates. This condition was understood, but only after
the accident was an Operations Engineering Bulletin (OEB) distributed to
describe it. In August 1988, the engines were modified by the fitting of a
new hydraulic pump to activate the VSVs, also described in an OEB.  
Asseline believes that, at the time of the crash, the necessary conditions
for stagnation were present: low altitude, engines at flight idle, high
angle of incidence.

C) Compressor stall} 

A compressor stall occurs when the air flow over the turbine blades
becomes turbulent, i.e., the blades (which are (at)(at)flying'' through this air
flow)  experience an aerodynamic stall. This is a serious failure, which
causes the engine to lose power immediately, and may actually damage it.
It is characterised by a loud deep double (at)(at)boom''.

The tendency to compressor stall depends on the adjustment of the VSV
actuators. Following a compressor stall on take off at Geneva in August
1988, these were adjusted on F-GFKA and F-GFKB. (F-GFKC had already
crashed, of course!)

According to Asseline [ASSM92A], although the right engine began to spool
up at about the time of first impact with the trees, the left engine was
held back by a compressor stall, as indicated by the two loud bangs
included in the CVR transcript in the preceding preliminary report
[BECC88A] as (at)(at)Boum! Boum!''. (The CVR transcript in the Bechet report
omits this, and states (at)(at)Noise of impact with trees''.)  Two witnesses
reported hearing this noise. One was a passenger seated towards the rear
of the aircraft. The other was a ground engineer (who was familiar with
the noise of a compressor stall) and was manning a fuel station at the
edge of the airfield very close to the point at which the aircraft entered
the forest.

D) Pitch control anomalies} 

The EFCS responded to (at)(at)stick-back'' with (at)(at)nose-down''. This is clear
from the DFDR listings appended to the final report. Asseline suggests
three hypotheses to explain this:--

  i) On descending through 50ft, the EFCS had (unknown to the crew, who 
thought they were at 100ft), entered (at)(at)landing mode''. At 30ft, the 
EFCS would then have begun its (at)(at)derotation'' as for a normal landing. 
This hypothesis is rejected by the final report, on the grounds that, 
by the time the radio altitude was below 30ft, alpha was 14.5 degrees, 
and high AOA protection would be in force and would take priority. 
This statement in turn is disputed by Sandall [SANC91A], since, 
assuming that the official timings are 4s in error, descent below 
30ft first occurred at least 8 seconds before impact, when alpha was 
well below 14.5 degrees. 

 ii) There was a supplementary limitation on angle of attack in landing
mode, not published in the FCOM, intended to prevent a tail-strike during 
landing (which would require a 14 degree limit). 

iii) EFCS software failure. 


Habsheim: Other Investigations 
------------------------------ 

Asseline has consistently alleged that the Bechet report contains
inaccuracies. This would not be surprising in the circumstances, however
independent investigations have cast serious doubt on some conclusions in
the report, and even on the reliability of some of the evidence presented.

In November 1989, the UK Channel 4 television series (at)(at)Equinox'' devoted
one of its programmes to (at)(at)Fly--by--Wire'' [EQUI89A].  This covered the
design and development of the A320, and particularly the EFCS.  It
included the then known facts about the Habsheim crash.  (The final report
was still awaiting publication.) One of the shots showed the flight
recorders lying in the boot of the car of Daniel Tenenbaum, then head of
the DGAC. Michel Asseline and his co-pilot, Pierre Mazieres, subsequently
watched a recording of this programme and stated that these were not the
same recorders which they had seen under judicial seal in the possession
of the investigating magistrate. This sparked off further investigations,
and eventually a follow-up to the first programme was broadcast in
September 1990 [EQUI90A].

For this second programme, the researchers obtained the services of Ray
Davis, OBE, an independent air accident investigator. Davis produced a
report [DAVR90A] commenting on the content and conclusions of the official
final report [BECC89A] (which had by then appeared), and made several
statements in interview on the programme.

Davis' main assertions are that (in contradiction to what is stated in 
the final report):-- 

1. There is no evidence on the published DFDR listings of the aircraft
colliding with the trees. One would expect radio altitude to drop abruptly
to zero as the aircraft passed over the forest. Then as it began to crash,
deceleration would be expected. In the last valid frame of data recorded
on the DFDR, RA is still around 30ft, and deceleration is beginning to
decrease. It appears that the DFDR recording simply stops abruptly just at
the point of contact with the forest, although the official report states
that it ran for a second or so afterwards until damage to the aircraft
stopped it.

2. The correlation between the CVR events and the DFDR is not
(at)(at)excellent'' as stated in the official report, but shows a discrepancy in
the final part of the recording which makes the DFDR events appear to
occur 4 seconds later than they actually do.

3. The controls were not following the commands of the pilot throughout
the flight, but during the last few seconds, the elevators moved towards a
position corresponding to nose down, although the captain was holding the
stick back.

Davis cites several other anomalies which cast doubt on the official
analysis.

Around this time a student of the author's undertook an independent
analysis of the published evidence [SANC91A] and confirmed many of Davis'
findings. In particular, the times of the synthesised voice radiosonde
call-outs fit much better into the pattern of events recorded by the DFDR
if the call out times are shifted 3 to 4 seconds before the times reported
in the official final report [BECC89A].

Bernard Ziegler dismissed Davis' report as (at)(at)pitiful'' in interview on the
programme [EQUI90A], but on several points at issue (e.g., the sign
convention for the recording of longitudinal acceleration on the DFDR), it
was demonstrated that Davis was right, and Ziegler wrong.  On other
points, Ziegler was unable to give a satisfactory explanation of the
anomalies in the evidence.

Hardly surprisingly, Airbus Industrie have reacted strongly, and have
published detailed refutations [AIRB91A] of the allegations by Asseline,
Davis, the Equinox researchers, and others. In particular, they have
rejected Asseline's allegations that the DFDR recordings, and maybe other
evidence, were tampered with in some way.


Conclusions 
----------- 

(at)(at)If the causes of an accident are not fully established, then that
accident will happen again.''

                         -- Ray Davis in interview [EQUI90A]
 

(at)(at)L'Affaire Habsheim'' is not yet over. Opinions about it are completely
polarised. Despite the rebuttals by the manufacturer, several statements
in the official final report are seriously open to question.

The crucial point is the timing. Leave out the 4 seconds, and Asseline
appears to be trying to cover up his own mistake. Add 4 seconds to the
timings, and there is a strong prima facie case that, whatever human error
led to the aircraft being in that situation, the way that the aircraft's
on-board systems functioned led to the captain not being able to recover
from it.

It is not possible to resolve this long-standing dispute in this paper,
nor is it the author's intention even to attempt to do so. The reader
should be aware of the controversy, however. Note that some pilots have
disagreed with Asseline's view of events, in particular the possibility of
being misled by visual cues into believing that a height of 30 feet AGL is
100 feet [DORS94B].

On a final note, the very complexity of the A320's on-board systems is
part of the cause of the controversy. There is no agreement even on what
mode the EFCS was in when the aircraft crashed!


References 
---------- 

[AIRB91A] (at)(at)The A320 Habsheim Accident: an Airbus Industrie response 
to allegations made in television programmes and other media'', 
Airbus Industrie, 316.0104/91, March 1991. 

[ASSM92A] Asseline M.: (at)(at)Le Pilote est-il coupable?'', 
Pub.: Edition No. 1, Paris, 1992, ISBN 2-86-39-1517-7. 

[DOND504] Air France internal service note, ref. DOND 50420, signed by 
M. Henri Petit, Director of Air Operations, and approved by M. Jacques
Gauthier, Flight Safety Officer. Dated 29 October 1987.  (Quoted in ibid.)

[BECC88A] (at)(at)Commission d'Enquete sur l'accident survenu le 26 Juin 1988 
a Mulhouse-Habsheim (68) a l'Airbus A320 de la Compagnie Nationale Air
France, immatricule F-GFKC'', Rapport Preliminaire, 26.07.88

[BECC88B] (at)(at)Transcription CVR'', Transcription of Cockpit Voice 
Recorder accompanying Preliminary Report, 26.07.88

[BECC89A] (at)(at)Investigation Commission concerning the accident which 
occurred on June 26th 1988 at Mulhouse-Habsheim (68) to the Airbus A320, 
registered F-GFKC: FINAL REPORT'', Ministry of Planning, Housing, 
Transport and Maritime Affairs, 29 November 1989. (Official translation 
from the French by the Bureau d'Enquetes Accidents (BEA).) 

[DAVR90A] Davis R.A.: (at)(at)Comments on the evidence relating to the accident
to Air France A320 Airbus F--GFKC at Habsheim 26 Jun 88'', report dated
15th July 1990. (Produced on behalf of Box Productions Ltd., in connection
with Channel 4 Television broadcast 25th September 1990.)

[DORS94B] Dorsett R.: Personal communication with the author, July 1994. 

[EQUI89A] (at)(at)Fly--by--Wire'', Channel 4 Television Equinox series, Produced
by Box Productions Ltd. (research by Ben Hamilton), first broadcast 5th
November 1989.

[EQUI90A} (at)(at)Fly--by--Wire: Technology on Trial'', Channel 4 Television,
Equinox series, Produced by Box Productions Ltd.  (research by Ben
Hamilton), first broadcast 25th September 1990.

[SANC91A] Sandall C.B.: (at)(at)Computerised Flight Control Systems for Civil
Aviation'', BSc degree in Computer Science, final year project report,
12th May 1991.

[VSD838A] (at)(at)Enquete sur encore un crash'', VSD, 838, 23-29 September 1993,
pp 56--57
--------------------------------------------------------------------

Date view Thread view Subject view Author view Attachment view