|A Translation from the Spanish Original at:|
The Repair of the Spanair MD-82's Final Failure failed to fulfill Boeing's Norms
Friday, 03 October 2008
Marisa RECUERO / Madrid.
failed to properly diagnose a recurring fault on the plane that
crashed in Barajas on August 20 killing 154 people. The
maintenance technician isolated the problem identified by the
pilot via disconnecting a fuse, but he did not follow through to
make a detailed assessment of the effect of his action on other
interrelated systems linked
to the mechanism that failed, as recommended by Boeing.
that explains the procedures to follow to cope with failures that
would be induced by disabling the RAT
probe's heater. A day before the crash the probe had
overheated on four occasions,
causing the technicians to
reset the mechanism and re-dispatch the aircraft. The
day of the accident, the
same glitch recurred.
Commander Antonio Garcia Luna routinely decided to return to the
ramp and the technician removed the system's fuse (#Z29) -
but unfortunately did
not troubleshoot beyond that point.
Industry sources have advised that subsequently the airplane's strobe lights, that is, brilliant white flashing lights that identify the plane only when it is in the air, were operating on the ground. This should have signified to anyone in Spanair's technical employ that there was a problem with the ground-air sensing relay in the nosewheel well. It should be noted that the relays that switch the air and ground functions ON and OFF are themselves triggered by micro-switches that make and break as a function of nose oleo extension. Oleo gear legs are pneumatic air-oil struts that dampen the shock of ground contact. They extend when the weight of the aircraft is off them - and compress when the aircraft lands. Obviously the micro-switches, although encased in outer covers, are quite exposed to the elements. They are sensitive, and operate over a quite minuscule "throw". In similar fashion, oleos are prone to being over-serviced by having too much "air (i.e. nitrogen) or too little of the dampening oil injected. Pilots are
with the ground-air switching becoming sensitive to the fore-aft
weight distribution in the laden airplane. Unload a freighter's
cargo nose-first/rear holds last and you can sit the airplane on
its tail. Short of that
happening pilots can also note that systems normally unpowered
on the ground (such as strobes or radar altimeters etc) can
suddenly activate..... if the aircraft is tail-heavy/ light upon
Relay R2-5 in the nose-wheel leg's WoW (weight-on-wheels) system was the intermittently failing (and ultimately failed) part. It told the RAT heater it was in the air and so should be "ON". Nothing was wrong with the RAT sensor or heater. Facile and incomplete trouble-shooting can be lethal - just as in the Greek crash of the HELIOS 737.
The pragmatic perspective:
Essentially we know and concede that the single WOW signal did not pass through R2-5 to arm the take-off configuration warning system, which in turn would have warned the pilots of their incorrect slats/flaps setting and thus would have avoided the accident.
I wonder why the principle of redundant signals is not being followed for such a crucial warning device. Thanks to the quirks of EASA, my humble old tail-dragger has recently been equipped with a mode S transponder that by regulation must be controlled by an air/ground switch. However, as the gear is always down and welded, the signal is artfully derived from the airspeed pressure difference sensor instead of WOW. If the airspeed is considerably below the stall speed, the transponder is in ground mode. Simple (and as cheap as it comes) for any aircraft installation under the suspicious eyes of EASA and my national aviation grounding office.
It would be easy (would it not?) to include such a sensor somehow into the logic of the warning system as an additional and independent ground mode condition arbiter.
CS 25.703 Take-off warning system
(See AMC 25.703)
A take-off warning system must be installed and must meet the following requirements:
(a) The system must provide to the pilots an aural warning that is automatically activated during the initial portion of the take-off roll if the aeroplane is in a configuration, including any of the following that would not allow a safe take-off:
(1) The wing-flaps or leading edge devices are not within the approved range of take-off positions.
(2) Wing spoilers (except lateral control spoilers meeting the requirements of CS 25.671),speed brakes, or longitudinal trim devices are in a position that would not allow a safe take-off.
(3) The parking brake is unreleased.
(b) The aural warning required by subparagraph
(a) of this paragraph must continue until-
(1) The take-off configuration is changed to allow a safe take-off;
(2) Action is taken by the pilot to terminate the take-off roll;
(3) The aeroplane is rotated for take-off;
(4) The warning is manually silenced by the pilot. The means to silence the warning must not be readily available to the flight crew such
that it could be operated instinctively, inadvertently, or by habitual reflexive action.
Before each take-off, the warning must be rearmed automatically, or manually if the
absence of automatic rearming is clear and unmistakable.
(c) The means used to activate the system must function properly for all authorised take-off
power settings and procedures, and throughout the ranges of take-off weights, altitudes, and temperatures for which certification is requested.
AMC 25.703 (Page 368).
(3) ARINC 726, Flight Warning Computer System. This document can be obtained from the
ARINC, 2551 Riva Road, Annapolis, Maryland 21401.
4.BACKGROUND. A number of aeroplane accidents have occurred because the aeroplane was not
properly configured for takeoff and a warning was not provided to the flight crew by the takeoff
configuration warning system. Investigations of these accidents have indicated a need for guidance
material for design and approval of takeoff configuration warning systems.
a. Regulatory Basis.
(1) CS 25.703, "Takeoff warning system," requires that a takeoff configuration warning
system be installed in large aeroplanes. This requirement was introduced with JAR25
effective 1.1.79. On the FAR side, this was added to Part 25 by Amendment 2542
effective on March 1, 1978. CS 25.703 requires that a takeoff
warning system be installed and provide an aural warning to the flight crew during the initial portion of the take off roll, whenever the aeroplane is not in a
configuration which would allow a safe takeoff.
The intent of this rule is to require that the takeoff configuration warning system cover (a) only those configurations of the required systems which would
be unsafe, and (b) the effects of system failures resulting in wrong surface or system functions if there is not a separate and adequate warning already provided. According to the preamble of Amendment 2542, the takeoff warning system should serve as "backup for the checklist, particularly in unusual situations, e.g., where the checklist is interrupted or the takeoff delayed." Conditions for which warnings are required include wing flaps or leading edge devices not within the approved range of takeoff positions, and wing spoilers (except lateral control spoilers meeting the requirements of CS 25.671), speed brakes, parking brakes, or longitudinal trim devices in a position that would not allow a safe takeoff.
Consideration should also be given to adding rudder trim and aileron (roll) trim if these devices can be placed in a position that would not allow a safe takeoff.
(2) Prior to CS25
Amendment 5 and FAR 25 Amendment 2542,
there was no requirement for a takeoff configuration warning system to be installed in large aeroplanes. Since this amendment is not retroactive, some large aeroplane models in service today may not have takeoff configuration warning systems; however, all large turbojet transports currently in service, even those with a certification basis established prior to 1978, include a takeoff configuration warning system in the basic design. These include the majority of large aeroplanes.
(3) Other general rules such as CS 25.1301, 25.1309, 25.1322, 25.1357 and 25.1431 for electronic system installations also apply to takeoff configuration warning systems.
b. System Criticality.
(1) It has been Aviation Authorities policy to categorize systems designed to alert the flight crew of potentially hazardous operating conditions as being at a level of criticality associated with a probable failure condition. (For a definition of this terminology together with discussions and guidelines on the classification of failure conditions and the probability of failures, see AMC 25.1309). This is because failures of these systems, in themselves, are not considered to create an unsafe condition, reduce the capability of the aeroplane, or reduce the ability of the crew to cope with adverse operating conditions. Other systems which fall into this category include stall warning systems, overspeed warning systems, ground proximity warning systems, and windshear warning systems.
(2) Even though AMC 25.1309 does not define an upper probability limit for probable failure conditions, generally, it can be shown by analysis that such systems have a probability of failure (of the ability to adequately give a warning) which is approximately 1.0 x 10 3 or less per flight hour. This probability does not take into account the likelihood that a warning will be needed. Systems which are designed to meet this requirement are usually single channel systems with limited built-in monitoring.
Maintenance or preflight checks are relied on to limit the exposure time to undetected failures which would prevent the system from operating adequately.
(3) Applying the practice given in subparagraphs b(1) and b(2) above to takeoff configuration warning systems is not considered to result in an adequate level of safety when the consequence of the combination of failure of the system and a potentially unsafe takeoff configuration could result in a major/catastrophic failure condition. Therefore, these systems should be shown to meet the criteria of AMC 25.1309 pertaining to a major failure condition, including design criteria and in-service maintenance at specified intervals. This will ensure that the risk of the takeoff configuration warning system being unavailable when required to give a warning, if a particular unsafe configuration occurs, will be minimized.
(4) If such systems use digital electronic technology, a software level should be used, in accordance with the applicable version of EUROCAE ED12()/ RTCA document DO178(), as recognized by AMC 20115(), which is compatible with the system integrity determined by the AMC 25.1309 analysis.
(5) Since a false warning during the takeoff run at speeds near V1 may result in an unnecessary rejected takeoff (RTO), which could lead to a mishap, the occurrence of a false warning during the takeoff should be remote in accordance with AMC 25.1309.
(6) If the takeoff configuration warning system is integrated with other systems that provide crew alerting functions, the level of criticality of common elements should be commensurate with that of the takeoff configuration warning system unless a higher level is dictated by one or more of the other systems.
c. Design Considerations.
(1) A review of existing takeoff configuration warning systems has shown a trend towards increased sophistication of design, partly due to the transition towards digital electronic technology which is amenable to self-monitoring and simple testing. The net result has been an improvement in reliability, fewer unwanted warnings and enhanced safety.
(2) With the objective of continuing this trend, new systems should be designed using the objectives and criteria of AMC 25.1309. Analysis should include all the remote sensors, transducers and the elements they depend on, as well as any takeoff configuration warning system line replaceable unit (LRU) and the actual visual and aural warning output devices.
(3) Unwanted warnings may be reduced by inhibiting the takeoff configuration warning system where it is safer to do so, e.g., between V1 and VR, so that a hazardous rejected takeoff is not attempted. Hmm? Inhibition of the takeoff configuration warning system at high speeds will also avoid any confusion from the occurrence of a warning during a touch and go landing. This is because the basic message of an alert is to stop because it is unsafe to take off. It may or may not tell the flight crew which surface or system is wrong. A warning may be more hazardous than reliance on the flight crew's skill and training to cope with the situation. (unless it's aerodynamically impossible of course)
(4) Even though CS 25.703 specifies those inputs common to most large aeroplanes that must be included in the design, each aeroplane model should be carefully reviewed to ascertain that any configuration or trim setting that could jeopardize a safe takeoff has an input to the takeoff warning system unless a separate and adequate warning is already provided by another system. There may be aeroplane configurations or electronically positioned lateral or longitudinal trim unique to a particular model that constitute this hazard. In the event that it is necessary to inhibit the warning from
a particular system during the entire takeoff roll, an equivalent level of safety finding would be required.
(5) Automatic volume adjustment should be provided to maintain the aural warning volume at an appropriate level relative to cockpit ambient sound. According to Report No. DOT/FAA/RD81/
38, II entitled "Aircraft Alerting Systems Standardization Study, Volume II Aircraft Alerting System Design Guidelines," aural signals should exceed masked threshold by 8 ± 3 dB.
(6) Of particular importance in the design of takeoff configuration warning systems is the elimination of nuisance warnings. These are warnings generated by a system which is functioning as
designed but which are inappropriate or unnecessary for the particular phase of operation. Attempting to eliminate nuisance warnings cannot be over-emphasized because any indication which could cause
the flight crew to perform a high speed rejected takeoff, or which distracts or adversely affects the flight crew's performance of the takeoff manoeuvre, creates a hazard which could lead to an
accident. In addition, any time there are nuisance warnings generated, there is a possibility that the flight crew will be tempted to eliminate them through system deactivation, and by continually doing this,
the flight crew may be conditioned to ignore a valid warning.
(7) There are a number of operations that could produce nuisance warnings. Specifically, single engine taxi for twin engine aeroplanes, or in the case of 3 and 4 engine aeroplanes, taxi with
fewer than all engines operating is a procedure used by some operators for the purpose of saving fuel. Nuisance warnings have also been caused by trim changes and speed brake handle adjustments.
(8) The means for silencing the aural warning should not be located such that it can be operated instinctively, inadvertently, or by habitual reflexive action. Silencing is defined as the
interruption of the aural warning. When silenced, it is preferred that the system will be capable of rearming itself automatically prior to takeoff
. However, if there is a clear and unmistakable annunciation that the system is silenced, manual rearming is acceptable.
(9) Each aeroplane model has a different means of arming the takeoff configuration warning system, therefore the potential for nuisance warnings varies accordingly. Some existing systems use only a single throttle position, some use position from multiple throttles, some use EPR or N1, and some use a combination of these. When logic from a single operating engine was used, nuisance warnings were common during less than all engine taxi operations because of the higher power settings required to move the aeroplane. These systems were not designed for that type of operation.
Because this procedure is used, inputs that arm the system should be judiciously selected taking into account any likely combination of operating and shutdown engines so that nuisance warnings will not occur if the aeroplane is not in takeoff configuration.
(10) CS 25.703 requires only an aural alert for the takeoff warning system. CS 25.1322 currently specify requirements for visual alerts while related reading material reference 3a(2), 3a(4) and 3b(1) provide guidance for integrated visual and aural annunciations for warnings, cautions and advisory alerting conditions. It has been common industry practice to incorporate the above mentioned references in their aeroplane designs. FAR/CS 25.1322 are planned for revision to incorporate the guidance of these references to reflect current industry practices. Manufacturers may wish to incorporate these alerting concepts to the takeoff warning system. If such is the case , the following guidance is offered:
a) A master warning (red) attention getting alert may be provided in the pilot's primary field of view simultaneously with the aural attention getting alert.
b) In addition to (or instead of) the aural attention getting alert (tone), voice may be used to specify the general problem (Configuration), or the exact problem (slats, flaps, trim, parking brake, etc…).
c) The visual alert may also specify the general problem (Configuration), or the exact problem (slats, flaps, trim, parking brake, etc…).
d) A visual cautionary alert associated with the failure of the Takeoff warning system may be provided
e.g. "T/O WARN FAIL".
(11) The EASA Agency approved Master Minimum Equipment List (MMEL) includes those items of equipment related to airworthiness and operating regulations and other items of equipment
which the Agency finds may be inoperative and yet maintain an acceptable level of safety by appropriate conditions and limitations. No MMEL relief is provided for an inoperative takeoff configuration warning. Therefore, design of these systems should include proper system monitoring including immediate annunciation to the flight crew should a failure be identified or if power to the system is interrupted.
d. System Tests and Test Intervals.
(1) When manual tests or checks are required to show compliance with CS 25.1309, by detecting the presence of and limiting the exposure time to a latent failure that would render the warning inoperative, they should be adequate, simple and straight forward in function and interval to allow a quick and proper check by the flight crew and maintenance personnel. Flight crew checks may be specified in the approved Aeroplane Flight Manual (AFM) and, depending on the complexity of the takeoff configuration warning system and the aeroplane, maintenance tasks may be conventional
Maintenance Review Board (MRB) designed tasks or listed as Certification Check Requirements (CCR) where appropriate, as defined in AMC 25.1309, and determined as part of the approval process between the manufacturer and the certification office.
(2) The specified tests/checks established in accordance with subparagraph 5d(1) above should be demonstrated as part of the approval process and should show that each input sensor as well as the control and logic system and its emitters, including the indication system, are individually verified as required to meet subparagraph 5b(3). It should also be demonstrated that the warning self cancels when required to do so, for example by retarding the throttles or correcting the wrong configuration.
e. Test Considerations.
(1) During flight testing it should be shown that the takeoff configuration warning system does not issue nuisance alerts or interfere with other systems. Specific testing should be conducted to ensure that the takeoff configuration warning system works satisfactorily for all sensor inputs to the system. Flight testing should include reconfiguration of the aeroplane during touch and go manoeuvres.
(2) It should be shown by test or analysis that for all requested power settings, feasible weights, taxiway slopes, temperatures and altitudes, there will be no nuisance warnings, nor failure to give a warning when necessary (e.g., cold conditions, derated takeoff), for any reasonable configuration of engines operating or shut down. This is to test or simulate all expected operational configurations. Reasonable pilot technique for applying power should be presumed.
(3) The means for silencing the aural warning by the flight crew will be evaluated to assure that the device is not accessible instinctively and it is properly protected from inadvertent activation.
Automatic or manual rearming of the warning system will be evaluated.
Flight crews make a positive contribution to the safety of the air transportation system because of their ability to assess continuously changing conditions and situations, analyse potential actions, and make reasoned decisions. However, even well trained, qualified, healthy, alert flight-crew members make errors. Some of these errors may be influenced by the design of the systems and their flight crew interfaces, even with those that are carefully designed. Most of these errors have no significant safety effects, or are detected and/or mitigated in the normal course of events,. Still, accident analyses have identified flight crew performance and error as significant factors in a majority of accidents involving transport category aeroplanes. Accidents most often result from a sequence or combination of errors and safety related events (e.g., equipment failure and weather conditions). Analyses show that the design of the flight deck and other systems can influence flight crew task performance and the occurrence and effects of some flight crew errors.
Some current regulatory requirements mean to improve aviation safety by requiring that the flight deck and its equipment be designed with certain capabilities and characteristics. Approval of flight deck systems with respect to design-related flight crew error has typically been addressed by referring to system specific or general applicability requirements, such as CS 25.1301(a), CS 25.771(a), and CS 25.1523. However, little or no guidance exists to show how the applicant may address potential crew limitations and errors. That is why CS 25.1302 and this guidance material have been developed.
Often, showing compliance with design requirements that relate to human abilities and limitations is subject to a great deal of interpretation. Findings may vary depending on the novelty, complexity, or degree of integration related to system design. The EASA considers that guidance describing a structured approach to selecting and developing acceptable means of compliance is useful in aiding standardised certification practices.
3. SCOPE AND ASSUMPTIONS
This AMC provides guidance for showing compliance with CS 25.1302 and guidance related to several other requirements associated with installed equipment the flight crew uses in operating the aeroplane. Table 1 below contains a list of requirements related to flight deck design and flight crew interfaces for which this AMC provides guidance. Note that this AMC does not provide a comprehensive means of compliance for any of the requirements beyond CS 25.1302.
This material applies to flight crew interfaces and system behavior for installed systems and equipment used by the flight crew on the flight deck while operating the aeroplane in normal and non-normal conditions.
It applies to those aeroplane and equipment design considerations within the scope of CS-25 for type certificate and supplemental type certificate (STC) projects. It does not apply to flight crew training, qualification, or licensing requirements. Similarly, it does not apply to flight crew procedures, except as required within CS-25.
In showing compliance to the requirements referenced by this AMC, the applicant may assume a qualified flight crew trained in the use of the installed equipment. This means a flight crew that is allowed to fly the aeroplane by meeting the requirements in the operating rules for the relevant Authority.