What exactly happened with the Flight Computers on XL Airways Germany Flight 888T?

Question

I recently saw a documentation about XL Airways Germany Flight 888T. This made some questions rising in my mind:

Two AOA-Sensors failed (freezed) simultaneously. From Wikipedia:

Two out of three angle of attack sensors have been frozen and rendered inoperative. System logic has been designed to reject sensor values which deviate significantly from the others. In this specific case, this principle led to the rejection of the single operative angle of attack sensor, and to the acceptance of the two faulty ones, which provided similar values, but have been stuck since cruise flight.

The Airbus "shut down" the computers because of unlogic values and displayed USE MAN PITCH TRIM. But as stated above, the Airbus rejected the third sensor and accepted the two working sensors.

• What made the computers to deactivate and switch to manual mode?

Is it comparing the outside AOA-Sensors with the gyro data (Thanks to the user "mins" for clarifying the diffeence between AOA-Sensor and Artificial Horizon Data, but maybe the Airbus uses the Gyro-Data as a less ranked AOA reference, which flows into the detection of a faulty AOA-Sensor)

• Why aren't Airbus-Computers switching to something like alternate law automatically, instead of deactivating the FBW and displaying a small warning?

It was really hard to form my questions and I'm sure I forgot something. But I would appreciate it if you could answer the questions.

Answer 1

Tl;dr it was in direct law because air data was inconsistent and the landing gear was down.

For a full answer to why the aircraft did what it did I'll answer a few questions one at a time.

Why did the flight computers reject the good sensor and use the frozen ones?

The values of the sensors are fed to the control computers by the ADIRU (air data and inertial reference unit). There are three ADIRU's, each corresponding to three redundant systems of sensors. Part of the ADIRU is the ADR (air data reference). The ADR is responsible for determining the validity of the values coming from the air data sensors (pitot tube, static port and AoA vanes), correcting those values from local AoA to airplane AoA and feeding the values to the control computers. (local AoA at the sensor location is not necessarily the same as the overall airplane AoA due to their positioning on the plane.) Each ADR uses two resolvers for each sensor and compares these values for consistency. Along with the value it also sends to the control computers an indication as to whether the values are valid or not.

The ELAC (elevator/aileron computer), which controls movement of the flight surfaces takes the values from each ADIRU and compares them against the median value. If a sensor deviates from the median value past a certain threshold it assumes sensor failure and rejects the input. It then uses the average value of the other two.

Unfortunately for the crew of XL888t this method anticipates a single sensor failure. When two sensors fail at the same or similar value the system will reject the working sensor. There is really no way to overcome this, but having two sensors fail at the same value is exceedingly unlikely.

Why did the control laws degrade?

This is really the crux of the question. The ELAC is what determines the control laws. It uses information from the aircraft configuration (flaps, slats, air brakes, undercarriage)and the output of the ADIRU to determine how to interpret the pilot's control inputs. It uses this information to determine the α protection speeds (α-prot, α-floor and VLS) and when to engage the automatic envelope protections.

Normally when the aircraft slows the AoA increases unless a nose down input is given. In the case of XL888t the pilots were intentionally trying to put the plane into a stall in order to demonstrate the α protections. The elevator and stabilizer were in full up position and the engines were slowed. The ELAC will allow this position until it reaches the calculated values for α protection. In this case the AoA was not changing. When the parameters the ELAC is using get so far out of their thresholds the ELAC can no longer make the necessary calculations, so the α protections are disabled and control law is degraded to alternate.

So why did it go into direct law?

The test the crew was performing at the time was low speed check in landing configuration." Landing configuration obviously indicates that the landing gear be down. In alternate law roll control is in direct law, but pitch control is still as it is in normal law, with automatic trim, etc.,except without α protections. But when the landing gear is down the pitch control shifts to direct law and autotrim is disengaged. The "USE MAN PITCH TRIM" warning is displayed on the PFD. It's the pilots' failure to notice this warning that resulted in the crash.

As to why the control laws are designed this way I can't say. Maybe someone else can explain why Airbus made that choice.

Note: All of this information was taken from the BAE final report.

Answer 2

What exactly happened to the flight computers is summed up adequately on Wikipedia:

Some of the aircraft's computers received conflicting information and operated in degraded mode where some protections were not available.

More precisely: two out of three angle of attack sensors have been frozen and rendered inoperative. System logic has been designed to reject sensor values which deviate significantly from the others. In this specific case, this principle led to the rejection of the single operative angle of attack sensor, and to the acceptance of the two faulty ones, which provided similar values, but have been stuck since cruise flight. This in turn led to erratic limit speeds computations, moreover stall warning in normal law was not possible.

All the above resulted in degraded functionality of automated systems, some stall protection functions were not available. However, stall warning was still available, and has been triggered during the last phase of the flight.

The findings of the official report don't lay any blame on how the systems are designed. All the findings under "factors contributed to the accident" are actions/decisions taken by the flight crew and the "absence of consistency in the rinsing task in the aeroplane cleaning procedure".

However, there is one recommendation regarding the flight computers:

That EASA [to] undertake a safety study with a view to improving the certification standards of warning systems for crews during reconfigurations of flight control systems or the training of crews in identifying these reconfigurations and determining the immediate operational consequences.