Subject: RISKS DIGEST 10.02 REPLY-TO: risks@csl.sri.com RISKS-LIST: RISKS-FORUM Digest Saturday 2 June 1990 Volume 10 : Issue 02 FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator Contents: Article on A320 in Aeronautique, April 1990 (Pete Mellor) [VERY LONG] The RISKS Forum is moderated. Contributions should be relevant, sound, in good taste, objective, coherent, concise, and nonrepetitious. Diversity is welcome. CONTRIBUTIONS to RISKS@CSL.SRI.COM, with relevant, substantive "Subject:" line (otherwise they may be ignored). REQUESTS to RISKS-Request@CSL.SRI.COM. TO FTP VOL i ISSUE j: ftp CRVAX.sri.comlogin anonymousAnyNonNullPW cd sys$user2:[risks]GET RISKS-i.j ; j is TWO digits. Vol summaries in risks-i.00 (j=0); "dir risks-*.*" gets you directory listing of back issues. ALL CONTRIBUTIONS ARE CONSIDERED AS PERSONAL COMMENTS; USUAL DISCLAIMERS APPLY. ---------------------------------------------------------------------- Date: Sat, 2 Jun 90 17:08:14 PDT From: Pete Mellor Subject: Article on A320 in Aeronautique, April 1990 I was given this article by some colleagues who bought the magazine while visiting France for a research project meeting. Having had a quick look at it, I decided that it was *very* interesting. It contains chapter and verse on a couple of hair-raising incidents on board the A320, and the author obviously had access to the dossier of OEB's, from which he draws some fascinating conclusions regarding the general state of readiness of the A320 on entry into service and the possible causes of the Habsheim accident. He also includes an excellent summary of the legal wrangle surrounding the investigation into Habsheim. So, because of: a) the technical quality of the article, b) the fact that it presents a French (and therefore not negatively biased?) view, and c) the fact that it is not readily accessible to the majority of UK and US readers, I decided, at *enormous* cost in time and effort :-), to make a careful translation of the whole article, and send it complete to RISKS and to Aeronautics Digest. [...] LES CRISES DE NERFS DE L'A320 Translation of article by Bertrand Bonneau: Aeronautique, April 1990, pp. 94-101 [Translator's comments and additions are in square brackets.] THE A320'S ATTACKS OF NERVES - The first aircraft in the history of the world to be totally "managed" by - computer; has the A320 been put into service before it is ready? - The excessive number of incidents during its first year of use can only make - one think so. How could the willingness to declare the pilots responsible for - major accidents, even before the judges have returned their verdict, appear - other than suspect? Even so, as everyone wished, the verdict whitewashed the - aircraft. At the start of 1988, the French authorities and Airbus Industrie congratulated themselves on the certification of the A320 only one year after the first flight of the prototype. In less than one year, the manufacturer had demonstrated the reliability of this new generation aircraft to the authorities of four of the States of the European Community. However, controversy surrounding the aircraft would not be slow to surface at the time of the inaugural flight of the Air France A320, on 28th March 1988 over Paris, with the Prime Minister of the time on board. This flight was marked by a series of technical incidents, notably by the untimely setting off of alarms. New controversies were to arise when an aircraft was destroyed in the forest of Habsheim in Alsace (26th June 1988), and when an Indian Airlines A320 crashed before reaching the runway in Bangalore last February. In both of the last two cases, the aircraft was whitewashed as far as public opinion was concerned before the slightest preliminary accident report was published... Although what have come to be called the "Chirac flight" and the "Habsheim affair" are the two facts most known to the public, the first year of operation of the A320 has been marked by numerous incidents which have directly called into question certain systems on the aeroplane. Often badly received by the first crews qualified on this aircraft, and sometimes vigorously denied by the technical directors of the launching companies, these incidents lead one to ask if the manufacturers and the certification authorities have not proceeded a little too quickly. *Twelve times more incidents than were foreseen.* In his statement on the first year of operation of the A320 in the Air France fleet, a statement addressed to the general department of civil aviation (Direction Generale de l'Aviation Civile - DGAC) on the 11th July 1989, the technical sub-director of operations management of the national company remarks that the first exercise has been marked by "a greatly increased number of technical incidents altogether" (page 12). Whereas the target set was one incident per thousand hours of flight, the year 1988 ended with an incident rate of twelve per thousand hours of flight. For comparison, this rate was 5/1 000 at the time of the first year of operation of the Airbus A300. The frequency of these incidents which have marked the A320 going into service within Air France, Air Inter and British Airways has forced the manufacturer to publish no fewer than 52 provisional flight notices (OEB, Operations Engineering Bulletin) between April 1988 and April 1989. The launch of a new aircraft requires on average four times fewer. OEB's are temporary notices sent out by the manufacturer to the users. They form a list of anomalies or simply functional features of the aircraft, which do not appear in the users' manual for the equipment (FCOM, Flight Crew Operation Manual): they are only revealed in the course of operation. In the case of Air France, these provisional records are provided to the crews in the form of a volume of supplementary technical information notices (Renseignements Complementaires Techniques - RCT's). For the A320, the number of OEB's alone gives an account of the problems of putting the aircraft into service. At the technical level, around twenty of the fifty main computers of the first A320's coming off the production lines in Toulouse have had to undergo modifications. For the A320 is the first aircraft in the world to be completely computerised. Computers control the function of all the systems of the aeroplane (motors, ailerons, but also the cabin lighting, etc); it [sic] processes raw data, converts them, and transmits them to the pilot. Now, the application of numerous modifications defined by the manufacturer in order to correct defects in the systems or to enhance them, has been the origin of new breakdowns. These new problems have obliged the manufacturer to publish new OEB's before drawing up final modifications. During service, companies have had to modify once or several times certain procedures for operating their aircraft. Also, with the exception of Air Inter, which reported only good results, the increased number of incidents was the origin of poor availability and bad technical readiness of the first A320's delivered. "Of 7 334 stop-overs [landing + take-off's (?)] carried out up to April 1989," states the report of the technical sub-director of Air-France, "one lists on technical grounds [i.e. something went wrong (?)]: 4 accelerations-stops on take-off, 36 about-turns on the ground, 10 about-turns in the air, 1 emergency descent procedure, the cabin altitude being on the increase (without violent decompression), 1 engine stop in flight." [If you think this lot is confusing, you should see the original French! I think an about-turn on the ground is an aborted take-off, and an about-turn in the air is a return to the departure port. I'm not sure what the difference is between an about-turn on the ground and an acceleration-stop. Presumably the latter means the engines raced or cut-out during approach to take-off. 'Cabin *altitude* being on the increase' is a literal translation: I think it means the cabin atmosphere was below pressure, since they came *down*. Anyone with access to a dictionary of French avionic terms, or who knows the correct English avionic terms is welcome to correct me!] It is advisable to add to these outcomes the grounding of aircraft due to suspect behaviour, and 74 cancellations of flight before even starting up the engines. *Reliability in question*. For the aviation companies, the most serious problem would seem to have been that of the reliability of the information given to the crew by the various systems of the A320. The operating assessment by the technical sub-director of Air France is edifying on this subject. One discovers there, for example, that: "certain inconsistencies of piloting information have led to certain confused and very distracting situations, where the information presented to the pilots on the control screens, during flight, was in contradiction to the physical reality of the equipment, not always verifiable in flight", (report already cited, page 18). [Presumably this means: "The instruments were lying, but the pilots couldn't get out and walk around to check this at 30 000 feet!" Nice to know that French technical officialese is as obscure as British or American! ;-}] Without a doubt, Captain Claude Dalloz and First Officer Patrick Vacquand share the views of the technical sub-director of Air France. On the 25th August 1988, while taking off from Roissy on a flight to Amsterdam (flight AF 914), they had the disagreeable surprise of seeing the message "Man pitch trim only" appear in red on their control screens. In plain terms, this message informed the pilots that the controls activating the pitch control mechanism were no longer in a functional state. In this case, the only means of ensuring the longitudinal stability of the aircraft is to manually move the trimmable horizontal stabiliser by means of the pitch trim wheels. Meanwhile, the copilot who was at the controls felt not the slightest difficulty in controlling the aircraft. Then the crew witnessed a display of imaginary alarms ("fire in the toilets", for example), and noticed new signalling anomalies on the screens concerning the flight control systems, the position of the landing gear, and also the situation of the automatic pilot. It was therefore decided to return, but, during the approach, the gear at first refused to come down normally. Given the uncertainty, three passes at low altitude were made in front of the control tower to ascertain the real position of the gear after having carried out safety manoeuvres. As the information provided to the crew ("gear partially down") did not correspond to the observations of the controllers at Roissy (gear down), the passenger cabin was prepared for an eventual crash, which did not, very fortunately, occur. The same incident recurred on another plane on 29th November 1988. It finally required nine months of operation before a new, more reliable, version of the Flight Warning Computer (FWC) called into question by these two cases was made available to users. *A temperamental altimeter*. A good many problems due to the design of certain systems have revealed themselves since the start of operation. The most spectacular, for the passengers, would have been the vagaries of the integrated cabin communication system (CIDS), which modified explanations or illuminating announcements in an eccentric fashion. More seriously, the crews discovered that the temperature regulation of the passenger cabin could interfere with the functioning of the engine power control computers (FADEC), generating breakdowns and alarms. To avoid these interferences, crews were asked not to "reinitialise" the cabin temperature regulation system while the engines were running. However, the most worrying phenomenon for the crews has been the untimely alterations to the setting of the altimeters during flight. Having reached a certain altitude, the pilots set their altimeters in a standard way, calculated in relation to the theoretical atmospheric pressure at sea level (1 013 hPa), in order that all aircraft using the airspace should have the same reference for altitude (QNH base). Relative to this base, the altimeter indicates a pressure altitude, which is a "QNE" altitude. While the aircraft is descending, at a predetermined height the crew must set their altimeters in relation to the altitude of the destination airport (QFE base). Apart from some very rare landing strips situated below sea-level, airports are above this [sea-] level. Since pressure diminishes with altitude, the value of QFE is generally less than 1 013 hPa. The sudden alteration of the altimeter setting by the flight programming computer (FCU, Flight Control Unit) sometimes occurs in uncomfortable conditions. So, in July 1988, during an approach to Roissy, the untimely alteration of the altimetric setting, which conveyed itself as a reversal of the altimeter reading, provoked an automatic delivery of fuel in order to compensate for the false deviation in altitude generated by the defaulting computer and detected automatically by the safety systems of the aircraft. This delivery of fuel occurred while the aircraft was being flown manually on its descent. The rapid intervention of the pilot could not avoid the aircraft going into overdrive for several seconds. Untimely alterations of altimetric settings showed up on at least the first three planes delivered to Air France, among them the aircraft which crashed at Habsheim. The commission of enquiry has revealed in its final report that such an incident had taken place on the plane several hours before its crash, concluding immediately that this anomaly due to a design error had played no part at all in the accident. Moreover, the flight report (CRM, compte-rendu materiel) of a crew, concerning a third aircraft of Air France, made mention of vagaries of the altimeter. It is therefore surprising that the report of the technical sub-director of Air France limits this type of incident to a single A320 of his fleet (the aircraft registered F-GFKB), when it has also occurred on at least two other planes (registered F-GFKA and F-GFKC). But the most amazing thing remains that this functional anomaly should cease without anyone being able to identify its origin! *Recording of parameters*. In an indirect manner, these two types of incidents have revealed another potential source of problems in the level of the recording of parameters by the "black box recorder" (DFDR, Digital Flight Data Recorder). In effect, each piece of information given to the pilot is handled by a cascade of computers. Now, this "black box" records the majority of its information on the intermediate computers and not at the start or end of the processing chain. When examining this data, therefore, there is nothing that allows one to know precisely what the pilots had for information, since there is no recording at the output of the symbol generator [DMC] for their screens. The problems posed by the flight data recording system can be illustrated by referring to the two incidents mentioned. If the Paris/Amsterdam flight recalled above had ended in a crash, the "black box recorder", which captures a large part of its information from the flight warning computer (FWC), would have revealed that the crew no longer had pitch control available. In fact, all the flight controls were functioning, but the flight warning computer, which is one of the principal sources of information of the "black box recorder", had failed (diagram, p.98). Equally, if the untimely alterations of the altimeter readings had ended in a crash, the "black box recorder" would have revealed no malfunction of the altimeter assembly, since the recording of pressure altitudes (QNE), which was correct, is effected by equipment located upstream of the failing computer. This computer (FCU) incorrectly processed the information which had been sent to it, and an erroneous indication of altitude was sent to the control screens (diagram above, p. 99). *Modification Campaigns*. Before the A320's went into service, the launch companies' instructors - who cannot be accused of bias since they were all volunteers - complained of having had no contact with the test pilots of Airbus Industrie. The report of the technical subdirector of Air France, for its part, confirms this worry by revealing that it had at last been possible to establish a "frank relationship" (page 17) after six months. The adaptation of failing systems has been progressively integrated in the course of several modification campaigns begun at the start and middle of 1989 as problems were found and listed. It was necessary to wait until the end of last year to obtain the definitive version of certain pieces of equipment, that is to say, eighteen months after the certification and entry into commercial service of the A320. At the end of last year, the dossier of supplementary technical notices (RCT's) distributed to A320 crews already comprised eleven pages, whereas the RCT's of other aircraft in the Air France fleet rarely got beyond three pages. Contrary to the fears expressed many times in the course of these last years, not only by certain pilots' unions, but also by the American certification authorities (FAA, Federal Aviation Authority), the electrical flight controls and the electronic engine control system, which constitute the two great technological innovations of the A320, would never be the direct cause of any significant incident, notably in stormy conditions. During test just as in service, the A320 was struck by lightning several times without the least influence on the flight controls. The majority of the teething troubles and design faults of the A320 therefore concern more classical systems. The report of the technical sub-director of Air France is once again definitive: "Pressurisation, management of cabin communications (CIDS), pneumatic generation, auxiliary power units (APU)... have been for a long time of an unacceptable reliability. Everything is still not under control to this day (NDLR: 11th July 1989)." (Report already cited, page 17). *Industrial secret*. It could therefore be thought that the certificator has turned his attention above all to the innovative elements (flight controls, FADEC, etc.) of the A320. However, this explanation, although not completely without foundation, does not take into account the fact that the systems called classical are also subject to major innovations, since they practically all require computer automation. Without invoking the young demons of computing, the embedding of numerous pieces of software on board aircraft of the new generation (A320, but also McDonnell-Douglas MD 11, Boeing 747-400, among others) can pose problems for the official agencies. Up until then, the certificators were confronted by much more simple systems (cabling, for example) and by perfectly mastered technologies (electricity, for example). With the A320, the certificator found himself before a gigantic interactive data processing system, made up of "boxes" which consisted of inputs and outputs. No-one having foreseen such a rapid installation of computers on board service aircraft, it was not possible to find, in the international regulations, standards directly applicable to this domain. Furthermore, the certificator came up against protection of embedded software by industrial secret. The official agencies were finally forced sometimes to give their agreement to a piece of equipment, on a simple demonstration of the required result, without being able to know precisely the organisation of the system which allowed it to be reached. In such a context, only a more thorough programme of tests would have permitted the major design faults of certain systems to be revealed with certainty and would have avoided certain launch companies having to proceed with the modification of nearly half of the main computers of their first A320's. The protection of software by industrial secret constitutes a source of problems also for the users' maintenance services, who must leave it to the manufacturer to understand the reasons for its failure. For the time being, the best equipped companies are provided with certain software test sets, but eventually the users will have to be able to test their systems directly on the battery of test sets of the manufacturer through data transmission networks. *The dead-ends of certification*. It is interesting to note that use has revealed several loopholes in certification. A provisional information bulletin dating from the month of May 1988 (OEB no. 06/2) reveals for example that the single information source for the pilot's and copilot's altimeters on the A320, is not compatible with certification standards [i.e. it makes a single point failure possible?]. Another provisional information bulletin sent out in August 1988 (OEB no. 33/1) indicates that the safety lighting system of the floor of the passenger cabin does not conform to certification standards. This system would not automatically illuminate when one of the emergency evacuation devices of the aircraft was activated, in the case of the loss of the normal electricity supply. Now, this lighting system provides an illuminated pathway in the central aisle of the cabin, which must allow passengers to find the safety exits or doors during an evacuation in the dark or in smoke. This design defect was underlined by the final report of the commission of enquiry into the Habsheim accident. "To be the launch client of a new aircraft is sometimes a painful task," one of the directors of Air France confided last year, before adding that "the A320 would attain the level of reliability of the fleet (of Air France) by the start of 1990." This would be practically two years after the certification of the aircraft. A last example: it has been necessary to wait until the month of July 1989 for it to be noticed, in the course of a test flight, that the landing gear could, in certain cases, not retract fully in case of a shut-down of engine no. 1 during take-off (OEB no. 62/1). (1) The totality of these elements, then, could allow one to believe that speed and haste had been confused. Bertrand Bonneau --------------- [Footnote:] (1) The OEB's are intended to be temporary. As a consequence, the anomalies with which they are concerned when they are sent out, have normally been corrected. ------------------- [End of main article. Text in boxes accompanying illustrations follows:] ------------------- [Box on p. 95, below photograph of cockpit:] *Up to the customer to complete the tests.* The standards and certification procedures of civil aircraft are not adapted to the A320, an aircraft which, for the first time in the history of civil aviation, is massively equipped with data processing systems. For example, the software in the flight warning computer [FWC] included a fault which a good computer scientist could have repaired without a doubt. But this software is protected by industrial secret, and as luck would have it the fault did not show itself at the time of the certification campaign. Result: an aircraft has been sold with a certain number of latent defects, which the first customers have discovered bit by bit. ------------------- [Box on p. 97, accompanying photographs of instrument panels in cockpits of (1) A320, (2) A310, (3) A300:] THE TECHNOLOGICAL LEAPS OF THE AIRBUS The A320 (1) is the first aircraft whose cockpit panel is entirely equipped with cathode tube screens [CRT's]. Only three traditional instruments are still found there, in case of failure of the former [i.e. CRT's]. The new screens display more synthetic and more complete information to the crew. So, the whole navigation of the flight is directly visible to one of them, and the image evolves in real time along with the movement of the aircraft, whereas on traditional aircraft, this tracking is effected by the pilot on a piece of paper on which he reports the successive positions given by the on-board equipment (radiobeacon receiver, radiocompass, inertial platform [IRS?], etc.). But these screens can also, unfortunately, deliver erroneous information if one of the systems that supplies them is failing; and the irony is that often this information cannot be verified by the pilots in flight (see diagrams, p.98). An aircraft of the preceding generation, the A310 (2), was already equipped with some screens, whereas the A300 (3), which was developed at the start of the 70's, is only equipped with classical electromechanical instruments. ------------------- [Box on pp. 98-99, illustrating two incidents described in the main text, labelled case A and case B in the boxed text to allow cross-reference between that and the two accompanying diagrams, which show by numbered labels the placing, and communication between, the following:] 1. PFD. Piloting screen. It is this which displayed "manual pitch trim only" in case A in the text, and the erroneous QFE altitude in case B. 2. ECAM. Screen which gives information about the aircraft systems (motors, lighting, etc.). 3. PA. Automatic Pilot. 4. Side-stick. 5. FCU. Flight Control Unit. 6. DMC. Symbol generator for screen displays [Display Management Computer]. 7. SEC-ELAC-FAC. Computer [sic] for flight controls (ailerons, pitch control surface, flaps, spoilers, etc.). 8. ADIRU. Air Data Inertial Reference Unit 9. SDAC. System Data Acquisition Concentrator, which translates into data processing language the data received from systems upstream of it (sensors, controls, etc.). 10. FDIU. [Flight Data Interface Unit] Computer for the flight data recording system, which manages the "black box recorder" [DFDR]. 11. Hydraulic servo-mechanism for pitch control surface. 12. Trimmable Horizontal Stabiliser [THS] and pitch control surface. 13. DFDR. "Black box recorder" [Digital Flight Data Recorder]. 14. Switch for display of QFE pressure [on FCU] BREAKDOWNS AND DANGERS INVENTED BY THE COMPUTER *A. Alarmist computers.* This simplified diagram [p. 98] of the A320 systems (which takes no account of the actual location of the computers) shows how the crew of flight AF 914 of 25th August 1988 found themselves confronted by nonsensical information generated by the flight warning computer (FWC). This sent the erroneous message "manual pitch trim only" to the piloting screen (PFD) and to the "black box recorder" (DFDR), a message informing of a loss of control of the pitch control surfaces (red arrows). [Sorry. Colour diagrams are difficult over e-mail ;-)] Put simply, the pilot can no longer control the climb or descent of his aircraft with the stick (but only by means of a manual back-up control). In fact (green arrows), this control [i.e. the electronic one] was functioning perfectly. *B. Imaginary altitude.* The second diagram [p. 99] shows how the pilots had on their screens an untimely alteration to their altimetric setting, generated by the flight control unit (FCU), whereas the altitude data in the air data inertial reference unit (ADIRU) was correct. The FCU prompted an inversion between the pressure altitude (QNE) and the altitude of the destination landing strip (QFE). As the QFE was giving an altitude below the QNE altitude (which would allow one to believe that the aircraft was flying dangerously lower than it was in reality), the safety systems of the aircraft demanded an automatic delivery of fuel to regain height. ------------------- [Box on pp. 100-101:] HABSHEIM ACCIDENT: CFMI ASSESSES CFMI On the 26th June 1988, the air show organised by the little flying club of Habsheim, in the Haut-Rhin, turned to drama when an Air France A320 crashed with 130 passengers in the forest which bordered the landing field, in the course of its display flight. In a few minutes, the aircraft was almost completely burned. Toll: 3 dead, 34 injured, the other 93 occupants unhurt. Nearly 18 months after the accident, the Commission of enquiry delivered its report. Contrary to what it had been possible to affirm, this document (called the "Bechet report" after the name of the president of that commission) does not establish any responsibility, but limits itself to stating the facts and suggesting some measures. After all, only judges are entitled to decide blame and responsibility. Now, this decision has not taken place. The investigating magistrate has even requested recently the reopening of the inquiry for supplementary information. No-one knows, then, what the Mulhouse magistrate thinks, but the context in which the enquiry into this accident was begun could be marked by certain irregularities. Indeed, on the evening of the drama, the director general of Civil Aviation was filmed by a television crew as he took charge of the transport of the two "black boxes" (CVR and DFDR). Now these two recorders are the essential elements for the enquiry. The presence of the director general of civil Aviation at the scene of the accident and the particularly active role that he played that evening seem hardly compatible with the ministerial directive of the 3rd January 1953 relating to the coordination of the judicial inquiry and the technical investigation and with directive no. 300 IGAC/SA of the 3rd June 1957 concerning the steps to be taken in case of irregularity, incident or accident in aviation. The General Directorate of Civil Aviation having had the responsibility of certifying the aircraft and having authorised the holding of the meeting, it is legitimate to ask oneself if its director is not simultaneously judge and party to the case. Moreover, the authority designated by the regulations as being competent in the matter of enquiries is not the DGAC but the General Inspectorate of Civil Aviation (IGAC), placed under the direct authority of the Minister of Transport. A second factor, which follows from the first, could leave one to suspect that the concern of the only technical enquiry had overridden that of the judicial enquiry. First, it was necessary to wait two days for an investigating judge to be appointed, whereas that is generally done in half a day for major accidents; and this is one of them [i.e. major], with, moreover, a considerable amount at stake. Furthermore, the two black boxes were left for nine days without any judicial control, since the placing under seal was only done on the 5th July (let us recall that the accident took place on 26th June). In the meantime, parts of the recording of the conversations held in the cockpit during the flight were published in the press, in defiance of the secrecy required by the directive [i.e. no. 300 IGAC/SA of 3rd June 1957(?)]. Reading of the Bechet report (page 41) reveals that the assessment of the damaged aircraft engines was entrusted to their own manufacturer (CFMI), on the SNECMA premises at Melun-Villaroche. Without casting doubt on the quality of the assessment achieved by the manufacturer on the premises of one of his partners with the participation of the Commission of Enquiry, it seems astonishing that the manufacturer should have had control over a procedure which concerned him so directly. As one knows, in the case of an enquiry relating to an accident, an assessment is always likely to have judicial consequences. That is all the more surprising since the engines had been directly implicated by the statements of the crew immediately after the accident. One can therefore ask oneself why the assessment of the two CFM56-5A1's was not entrusted to the experts of the Propeller Test Centre of Saclay, which comes under the Flight Test Centre. Indeed, this centre does not have any judicial, industrial or commercial links with the equipment in question. Even if the conclusions of the commission of enquiry, based on that assessment and on the recording of the "black box recorder" [DFDR], categorically rule out the two engines, that will not cut short some of the objections which some of the lawyers would have been able to try to set out before the judges of Mulhouse. Such would not have been the case if that investigation had been entrusted to an organisation which was not also an interested party. If the defects of acceleration of the CFM56-5A1 engines of the Air France A320, noticed sometimes in certain cases of low altitude flight, did not exhibit themselves at the time of the accident, why, then, was a provisional information bulletin (OEB 19/1) sent out in May 1988, modified in the following August (OEB 19/2)? Moreover, the adjustment of the stator blades (counterbalancing [?] of the jacks which modify their pitch [?]) of these engines, which has a direct link with their efficiency at low speed and at low altitude, was also modified a short time after the accident. There again, why? ------------- DISCLAIMER: 1. The opinions expressed in this article are not necessarily the opinions of City University, of the Centre for Software Reliability, or of the translator. 2. Misprints in the original are the responsibility of the publisher. 3. Factual errors in the original are the responsibility of the author. 4. Errors in translation are the responsibility of my O-level French mistress. 5. I am not responsible for ANYTHING! ;-} Peter Mellor ------------------------------ End of RISKS-FORUM Digest 10.02 ************************