Report details how Airbus pilots saved the day when all three flight computers failed on landing

Software 'enhancement' on the way after triple touchdown TITSUP

Airbus is to implement a software update for its A330 aircraft following an incident in 2020 where all three primary flight computers failed during landing.

The result was a loss of thrust reversers and autobrake systems and the pilots having to use manual braking to bring the aircraft, a China Airlines A330-302, to a halt just 30 feet before the end of the runway. The incident happened at Taipei Songshan Airport on 14 June 2020.

The flight, CI202 from Shanghai with 87 passengers and nine cabin crew members, had been uneventful. The landing, however, was anything but.

The final report [PDF] published by the Taiwan Transport Safety Board (TTSB) and reported in The Aviation Herald details the incident as it unfolded.

It was raining at the airport as the aircraft approached so the runway was wet (although still well within margins). The captain disengaged the autopilot at approximately 773 feet and continued the approach. The A330 touched down between 1,500 and 2,000 feet from the runway threshold and then, judging by the report, everything went to Hell.

Three seconds after touchdown, an autobrake system fault was recorded. A second after that, faults were recorded on the primary flight control computers and the spoilers were retracted. Reverse thrust could not be applied and, a few seconds later, the captain called to the first officer to assist with manual braking. Both pilots then applied full brakes and the aircraft was eventually brought to a halt.

"Seems the pilots did a good job," a tame Airbus pilot told The Register. "You know it's bad when the captain tells the FO to help him on the brakes to stop the aircraft!"

As for the cause, the report pointed to the three Flight Control Primary Computers (FCPCs) becoming inoperative almost at the same time. Ground spoiler functionality needs one FCPC, autobrake arming needs two, and thrust reversers require an unlock signal from either FCPC1 or FCPC3.

According to the report: "The root cause was determined to be an undue triggering of the rudder order COM/MON monitoring concomitantly in the 3 FCPC. At the time of the aircraft lateral control flight law switching to lateral ground law at touch down, the combination of a high COM/MON channels asynchronism and the pilot pedal inputs resulted in the rudder order difference between the two channels to exceed the monitoring threshold."

The result was FCPC1 failing. Control of the flight system was then handed over to FCPC2 and 3 in sequence, both of which also experienced COM/MON channel asynchronism and became inoperative.

COM (Command) and MON (Monitor) is a standard protocol for Airbus Fly By Wire aircraft, with the monitor watchdog switching to another computer (command) in the event inputs diverge outside of acceptability. As our Airbus pilot put it: "Stick monkey (or autopilot) puts in command and clever Franco-German computer monitors input for correctness."

In this instance, the aircraft was shifting from flight to ground law as the pilot was applying the rudder (not particularly unusual, especially if there is crosswind on landing). Since the rudder deflects differently between ground and flight law a conflict occurred and the system was flagged as faulty. Then the same thing cascaded through the second and third FCPCs.

Airbus noted that it was the first triple fault at touchdown since the A330/A340 aircraft had entered service (and the electrical rudder-fitted family had put in 44.3m flight hours up to April 2020).

The immediate action taken was to remind operators of what to do in the event of such a triple failure. Longer term, however, is a software enhancement "to address the root cause."

According to the report, Airbus's modification, which is targeted to arrive by Q3 2022 for the A330-200 and A330-800, Q3 2023 for the A330-300, and mid 2024 for the A330-900, will include:

• Decrease of the COM/MON asynchronism level for the flight/ground information treatment
• Improvement of the COM/MON rudder order monitoring robustness in case of ground to flight and flight to ground transitions
• Higher unitary monitoring robustness during such transitions
• Avoid cascading/"domino's" effect that leads to several PRIM fault

The Register asked Airbus for its response to the report, but the aviation giant has yet to comment.

In a world of increasing automation, the incident serves as a reminder of the importance of keeping a human backup in the loop. ®

Source