I recently saw a documentation about XL Airways Germany Flight 888T. This made some questions rising in my mind:

Two AOA-Sensors failed (freezed) simultaneously. From Wikipedia:

Two out of three angle of attack sensors have been frozen and rendered inoperative. System logic has been designed to reject sensor values which deviate significantly from the others. In this specific case, this principle led to the rejection of the single operative angle of attack sensor, and to the acceptance of the two faulty ones, which provided similar values, but have been stuck since cruise flight.

The Airbus "shut down" the computers because of unlogic values and displayed USE MAN PITCH TRIM. But as stated above, the Airbus rejected the third sensor and accepted the two working sensors.

  • What made the computers to deactivate and switch to manual mode?

Is it comparing the outside AOA-Sensors with the gyro data (Thanks to the user "mins" for clarifying the diffeence between AOA-Sensor and Artificial Horizon Data, but maybe the Airbus uses the Gyro-Data as a less ranked AOA reference, which flows into the detection of a faulty AOA-Sensor)

  • Why aren't Airbus-Computers switching to something like alternate law automatically, instead of deactivating the FBW and displaying a small warning?

It was really hard to form my questions and I'm sure I forgot something. But I would appreciate it if you could answer the questions.

  • 3
    $\begingroup$ We need to read the BEA report to understand why. It is not clear to me that flight computers were not available. The crew was actually performing various tests part of a scenario to demonstrate the protections in place, on a voluntary basis. More information is required. $\endgroup$
    – mins
    Mar 11, 2017 at 10:47
  • $\begingroup$ Quite simply, if two of the three say 10 degrees and one says 5, the computers have no way of knowing which is the correct one. The logic says if 2 agree and 1 doesn't, the 2 in agreement win. $\endgroup$
    – Simon
    Mar 11, 2017 at 11:40
  • 2
    $\begingroup$ “USE MAN PITCH TRIM” would indicate direct law (even less than alternate mode) and they would know it is pointless to test Alpha-floor in direct mode, so I don't think it was indicating that. $\endgroup$
    – Jan Hudec
    Mar 11, 2017 at 11:44
  • 2
    $\begingroup$ @NoahKrasser, no, the computers never shut down. They did switch to direct law after the plane left the flight envelope. And no, I don't know what the analyst smoked when they decided it should switch to direct (where trim remains full up) rather than alternate (where the trim would move back on nose-down control input) law. $\endgroup$
    – Jan Hudec
    Mar 11, 2017 at 12:08
  • 1
    $\begingroup$ Of course they didn't stopped working, but they switched to, as USE MAN PITCH TRIM refers to, Direct Law. The flight computer should have been remained in Normal Law because there was no logical failure. What I want to know: What made the flight computer switch to Direct law? This occurs when there is a logical failure. What was this logical failure? $\endgroup$ Mar 11, 2017 at 12:09

2 Answers 2


Tl;dr it was in direct law because air data was inconsistent and the landing gear was down.

For a full answer to why the aircraft did what it did I'll answer a few questions one at a time.

Why did the flight computers reject the good sensor and use the frozen ones?

The values of the sensors are fed to the control computers by the ADIRU (air data and inertial reference unit). There are three ADIRU's, each corresponding to three redundant systems of sensors. Part of the ADIRU is the ADR (air data reference). The ADR is responsible for determining the validity of the values coming from the air data sensors (pitot tube, static port and AoA vanes), correcting those values from local AoA to airplane AoA and feeding the values to the control computers. (local AoA at the sensor location is not necessarily the same as the overall airplane AoA due to their positioning on the plane.) Each ADR uses two resolvers for each sensor and compares these values for consistency. Along with the value it also sends to the control computers an indication as to whether the values are valid or not.

The ELAC (elevator/aileron computer), which controls movement of the flight surfaces takes the values from each ADIRU and compares them against the median value. If a sensor deviates from the median value past a certain threshold it assumes sensor failure and rejects the input. It then uses the average value of the other two.

Unfortunately for the crew of XL888t this method anticipates a single sensor failure. When two sensors fail at the same or similar value the system will reject the working sensor. There is really no way to overcome this, but having two sensors fail at the same value is exceedingly unlikely.

Why did the control laws degrade?

This is really the crux of the question. The ELAC is what determines the control laws. It uses information from the aircraft configuration (flaps, slats, air brakes, undercarriage)and the output of the ADIRU to determine how to interpret the pilot's control inputs. It uses this information to determine the α protection speeds (α-prot, α-floor and VLS) and when to engage the automatic envelope protections.

Normally when the aircraft slows the AoA increases unless a nose down input is given. In the case of XL888t the pilots were intentionally trying to put the plane into a stall in order to demonstrate the α protections. The elevator and stabilizer were in full up position and the engines were slowed. The ELAC will allow this position until it reaches the calculated values for α protection. In this case the AoA was not changing. When the parameters the ELAC is using get so far out of their thresholds the ELAC can no longer make the necessary calculations, so the α protections are disabled and control law is degraded to alternate.

So why did it go into direct law?

The test the crew was performing at the time was low speed check in landing configuration." Landing configuration obviously indicates that the landing gear be down. In alternate law roll control is in direct law, but pitch control is still as it is in normal law, with automatic trim, etc.,except without α protections. But when the landing gear is down the pitch control shifts to direct law and autotrim is disengaged. The "USE MAN PITCH TRIM" warning is displayed on the PFD. It's the pilots' failure to notice this warning that resulted in the crash.

As to why the control laws are designed this way I can't say. Maybe someone else can explain why Airbus made that choice.

Note: All of this information was taken from the BAE final report.

  • $\begingroup$ Thank you! Answered my question perfectly and I could learn a lot new things about the Airbus Systems. $\endgroup$ Mar 11, 2017 at 18:44
  • $\begingroup$ “There is really no way to overcome this”—no, but I would expect it to at least tell the pilots that it happened. For airspeed it does and there is an unreliable airspeed procedure to be followed when it happens. However for the AoA vanes it does not. $\endgroup$
    – Jan Hudec
    Mar 11, 2017 at 18:52
  • $\begingroup$ @JanHudec I guess Airbus thinks the way the BEA does. From the BEA report: "Angle of attack, though significant for the study of the aerodynamic situation of the aeroplane, is not a piloting parameter." $\endgroup$
    – TomMcW
    Mar 11, 2017 at 19:29

What exactly happened to the flight computers is summed up adequately on Wikipedia:

Some of the aircraft's computers received conflicting information and operated in degraded mode where some protections were not available.

More precisely: two out of three angle of attack sensors have been frozen and rendered inoperative. System logic has been designed to reject sensor values which deviate significantly from the others. In this specific case, this principle led to the rejection of the single operative angle of attack sensor, and to the acceptance of the two faulty ones, which provided similar values, but have been stuck since cruise flight. This in turn led to erratic limit speeds computations, moreover stall warning in normal law was not possible.

All the above resulted in degraded functionality of automated systems, some stall protection functions were not available. However, stall warning was still available, and has been triggered during the last phase of the flight.

The findings of the official report don't lay any blame on how the systems are designed. All the findings under "factors contributed to the accident" are actions/decisions taken by the flight crew and the "absence of consistency in the rinsing task in the aeroplane cleaning procedure".

However, there is one recommendation regarding the flight computers:

That EASA [to] undertake a safety study with a view to improving the certification standards of warning systems for crews during reconfigurations of flight control systems or the training of crews in identifying these reconfigurations and determining the immediate operational consequences.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.