Lightning reactions needed for aircraft in bad weather
Two Airbus crashes in bad weather in less than a month bring aircraft safety into question, E&T investigates.
Two Airbus crashes in less than a month bring aircraft safety into question. The cause of the Air France Airbus A330-200 crash into the Atlantic and the Airbus 310 crash into the Indian Ocean are still unknown. Theories and speculation as to what happened are rife, including speculation that the crashes could have been due to lightening strikes will continue to do the rounds until the data recorders of Flight AF 477 and Flight IY626 are found - if they ever are.
There may be a better chance of recovering the black box from the Airbus 310 that recently crashed into the sea off Yemen while trying to land in bad weather. A French submarine had detected a signal from the plane's flight recorders as this issue went to press, but it could take time to reach the wreck as it is in deep water.
Soon after the Flight AF 477 crash, on 1 June, a lightning strike was held up as a culprit. However, industry experts have pointed out that not only are such strikes common but on their own they have not brought down an airliner since 1967. In the US, for example, a commercial aircraft is struck on average about once a year, and in the UK the Civil Aviation Authority recently told the BBC it received 162 reports of strikes on UK-operated airliners between 2001 and 2006
Two of the strikes reported by the CAA involved A330s. One led to a temporary loss of cockpit read-outs such as airspeed and altitude, while the other left the onboard systems mainly unaffected but blew several holes in the fuselage.
During a strike - which is often triggered by the aircraft itself flying through a highly charged cloud - the lightning makes contact with a point such as the nose or a wing tip, then reattaches itself to the fuselage at various points as the aircraft flies on. The aircraft is effectively in an electrical circuit between regions of opposite polarity, the current travelling along the aircraft's skin and structures, and out through a point such as the tail. For passengers who have never experienced this, reports describe a flash and a bang, followed by a flickering of lights and sometimes the activation of cabin oxygen masks.
Aircraft protection standards
Most aircraft have aluminium skins, so there's a good conductive path for the current, but the Airbus makes extensive use of composite materials, which, although light and resilient, are poor conductors, so the composites have to be manufactured with a layer of conductive fibres embedded in them. In effect, modern aircraft are flying Faraday cages, and to be certified as airworthy they must, however they are built, be able to bear a current of 200,000A. By contrast, an average lightning strike measures about 30,000A.
It is equally important to protect against power surges or transients that can be induced in the wiring and equipment inside the plane by strikes on the outer skin, so every part of the control and other systems that are essential to safe flight and landing has to meet the relevant international regulations.
In practice, a key part of this internal protection is a network of shielded cables, which carry one or more conductors inside a conductive shield with one end connected to a grounding element. The normally high-impedance network changes to one of very low impedance if there's a momentary induced surge, and this creates a circuit path between the shield and ground. The surge voltage drives a shield current through the circuit, which generates an electromagnetic field in the opposite direction, cancelling and reducing the magnitude of the overall electromagnetic field that links the shielded cable.
There's a potential chink in this electrostatic armour, however - the aircraft's nose cone, or radome, which contains the onboard weather radar. The radome can't be shielded in the same way as the rest of the skin because the radar signal would be attenuated if it was surrounded by a conductive material. The radome on the Airbus is made of Kevlar, and metal strips called lightning diverters have to be bonded onto it, and sized and spaced carefully to avoid interfering too much with the radar.
So, although protection of radomes gets special attention - and like the other parts of the protection system is subject to international regulations - crash investigators are looking at the possibility that AF 447's radome was hit by lightning and that the discharge somehow entered the aircraft from there.
If this was a factor it would have knocked out the radar and torn through the aircraft's control systems. Avionics experts say modelling the exact effect of a strike on the systems' data buses and computers is difficult because of the sheer number of variables involved, but they do agree that it would have been catastrophic.
Modern aircraft like the Airbus rely almost exclusively on fly by wire (FBW) control systems to keep them in the air, and to take off and land safely. FBW uses motors and actuators to control the flaps, rudder, engine thrust and so on via wires or fibre optics, a process managed on the Airbus by multiple redundant computer systems.
Software controls the aircraft's flight according to sets of rules or 'laws', which on the Airbus are called 'Normal', 'Alternate' and 'Direct'. Airbus pilots are essentially systems managers, and if successive systems fail, then the plane will eventually reach Direct mode, leaving the crew just about able to fly the aircraft using only the rudder, elevator trim and differential engine thrust.
While redundancy normally makes the odds of getting to Direct mode remote, some pilots complain that FBW does not give them full control in an emergency, comparing Direct mode to trying to drive a car without power steering. In the kind of turbulence Flight AF 447 is believed to have experienced just before the disaster it may have been impossible to keep the aircraft upright, overstressing the airframe and causing the aircraft to break apart.
As with other types of control systems, FBW needs input from sensors to do its job, in this case to measure parameters such as airspeed, altitude and engine performance.
One of these sensors, the pitot tube, measures airspeed. A330s have three of them, and crash investigators are looking at whether one or more of these on the aircraft were not working properly. As their name suggests, they are basically a tube, which in some conditions can ice up, so they have heating elements to prevent this. Normally this keeps them ice-free but there may be a design flaw in the A330 heating elements, because some months ago Airbus recommended the pitots be replaced on the entire fleet.
If one or more of the pitots on Flight AF 447 had iced up then their airspeed measurements would have disagreed - as appears to have been the case, judging by some of the telemetry data sent by the aircraft minutes before all contact was lost (see box on facing page). But it can't be known for certain whether icing caused the disagreement, only that the measurements varied. And blocked pitots on their own would not have caused the crash.
Far more likely is that, like the vast majority of air disasters, it was a sequence of events, each one serious it its own right. Exactly what that sequence was though can only be determined when, or if, the flight data recorders are found.
The A330 has two solid-state 'black boxes', from Honeywell Aerospace, that the search operation is trying to find - the flight data recorder itself and a cockpit voice recorder.
The FDR will have recorded data on about 400 different parameters of the Airbus systems from take-off, ranging from acceleration, outside temperature and pressure to cabin pressure, magnetic heading and airspeed from the pitots - even settings such as the positions of control columns and rudder pedals. When so much as a switch is flicked on or off, it's recorded by the FDU.
Meanwhile the CVR will have recorded the last two hours of the flight crew's conversations using a set of microphones built into the cockpit, which are designed to pick up any other cockpit noises such as bangs or thuds as well.
Black box specifications
As is common in airliners, both boxes are installed towards the rear of the A330 to increase their chances of surviving a crash, which is partly why finding part of the tail section recently was so important, but they are of course designed anyway to survive a crash - and then some. To be certified for use the recorders have to withstand the following:
- A crash impact of 3,400g - equal to or greater than an actual crash;
- Dropping a 227kg weight with a 0.63cm protruding steel pin onto the unit's most vulnerable part from a height of 3m (10ft);
- Applying a 5,000psi crush force onto the unit's axis points for five minutes;
- Cooking the unit at 1,100ºC for an hour;
- Submersion in a pressurised tank (equivalent to 20,000ft) of salt water for 24 hours, and submersion in a tank of salt water for 30 days.
Various components in the recorders also have to survive being placed in a range of aviation fluids, such as jet fuel, lubricants and fire-extinguisher chemicals.
The recorders also have an underwater locator beacon (ULB), an ultrasonic 'pinger' that is activated by a sensor as soon as it touches water. The beacon then starts sending out pulses at 37.5kHz once a second for 30 days. It will work down to about 6km and its signal can be detected up to 2km away.
But that may not be enough for the investigation team to find them. The crash site covers a huge area in the mid-Atlantic, where the ocean depth can exceed 6km. It's also rugged terrain, full of mountains and valleys, so if the recorders are sitting in a crevice or at the bottom of a valley then the loss of line-of-sight means the search vessels and their detectors would have to be practically overhead.
Even if the beacons' lithium batteries were at their full 30-day power at the time of the crash, at the time of writing they had only a few days of life left.
These difficulties have prompted calls in some quarters to start fitting the recorders with 90-day batteries and flotation devices. But Chris Bechin, Honeywell's director of aerospace regulatory affairs, says, "The 30-day life of beacon batteries is the industry standard, so that's what airlines conform to. And a flotation device would only be any good if the unit could be ejected from the plane, because the boxes have to be bolted into the airframe.
"Once you start thinking about that, you then have to think in terms of mounting the unit where it could be ejected - a wing tip, for example - then you have to consider the use of some explosive device to eject the unit, which creates safety issues for aircraft maintenance staff, as well as some system for triggering its ejection.
"It would all make for something very complicated and potentially unsafe. And remember that although most of the Earth's surface is covered in water, most flights are over land, making such a system also largely unnecessary," he says.
But he says Honeywell Aerospace, like the rest of the industry, is continuing to enhance FDR technology, for example by incorporating email-like data link capabilities emerging under the EU's Single European Sky and NextGen in the US. And he says there are also plans to add some form of uninterruptible power supply to recorders so that they will keep working "to the very end" - recorders currently draw their power via the aircraft's engines, either 28V dc or 115V 400Hz ac, which of course is lost when the engines fail.
Senior aviation consultant at Frost & Sullivan Diogenis Papiomytis echoes Bechin's points, adding, "For commercial airlines it's all about costs and regulations. Worldwide, most airlines' percentage margins are in single figures, even in the good times, so they do the minimum required by the regulations.
"Meanwhile the regulator, the Federal Aviation Authority, is aware of the commercial realities the airline industry faces, so it tries to avoid mandates on advanced technology, pushing instead for gradual adoption to enable airlines to spread costs.
"But perhaps this accident will accelerate the adoption of some new measures, as 9/11 did with the requirement to protect cockpit doors from forced entry. In the case of beacon batteries, for example, I wouldn't be surprised if the FAA says that after this latest accident all airliners must switch to the 90-day option, as it wouldn't add much extra cost. Bear in mind though that few black boxes remain missing after 30 days and this measure wouldn't make aircraft safer, just easier to find."
Fair point, but hindsight is a wonderful thing, and perhaps Flight AF 447 proves to be the exception - where the recorders were so difficult to find - that makes the rule.