Aviation Week & Space Technology, December 4, 1995 pp. 81-86
Michael A. Dornheim/Los Angeles
A NASA mishap investigation board found that inadequate safety analyses were at the root of many of the actions and omissions that led to the Jan. 19 X-31 accident.
The safety analyses, performed by Rockwell and repeated by NASA, underestimated the severity of the effect of large errors in the pitot-static system because they assumed the backup flight control mode would be used, the board's recent report said (AW&ST Nov. 13, p. 17). Consequently, many program personnel were not sufficiently aware of the importance of pitot heat and the consequences of pitot icing.
However, several individuals familiar with the program said that the large airspeed errors and suspected icing known to the test team violated basic flight test procedure and should have caused at least a pause in operations, even if no one thought the aircraft was in danger. The board noted this lack of concern and said it may have been due to fatigue.
X-31 made a flat, gyrating descent and the wreckage was relatively intact. Telemetry, ground video and pilot testimony provided excellent data for the investigation.
The report found that the No. 1 X-31 crashed at NASA's Dryden Flight Research Center because partial pitot icing caused the measured airspeed to read low as the aircraft descended, resulting in flight control gains that were too high for the actual airspeed. The excessive gains caused the fly-by-wire aircraft to become unstable and go out of control.
The pilot was aware of airspeed discrepancies, suspected pitot icing, had turned the pitot heat switch on, and observed the discrepancies reduce. But the airspeed probe was not equipped with pitot heat -- a fact known in the ground control room but only communicated to the pilot about nine seconds before the aircraft went out of control.
The No. 2 X-31 is now in storage at Dryden, as the program has run out of money. Original participants were Rockwell, Messerschmitt-Boelkow-Blohm, the U.S. Navy, the German Ministry of Defense and the Defense Advanced Research Projects Agency. NASA and the USAF joined the program later.
The mishap investigation board was chaired by Guy S. Gardner, a former USAF Test Pilot School Commandant, who was director of quality assurance in NASA's Office of Safety and Mission Assurance. The five other members were from the German Federal Armed Forces Flight Safety Directorate, the USAF Flight Test Center, Dryden, NASA Ames and the Naval Air Warfare Center.
The X-31 has only one pitot-static probe for the flight control computer. The original Rosemount probe was heated, but it was replaced with an unheated shielded "Kiel" probe for more accurate measurements at high angles of attack (AOA). The venturi geometry of the Kiel probe makes it more susceptible to icing. About 150 flights had been made with the probe on the No. 1 aircraft before the accident.
The cockpit pitot heat switch was not placarded inoperative, though the circuit breaker was collared "off." Three chances were missed to placard the switch inoperative. The first was a configuration change request for the new Kiel probe, which did not mention pitot heat. A subsequent engineering change order assumed the probe was heated, and the final work order only said to collar the circuit breaker.
A flight controls engineer drafted a temporary operating procedure that would have informed many program personnel that the Kiel probe was unheated, but it was lost in the several steps it took to get published. The board noted the lack of any formal tracking or follow-up procedure. The report said that four of the five active X-31 pilots thought the pitot heat was operative.
The X-31 has two air data computers (ADCs) and transducer sets that are fed by the single pneumatic source. Airspeed system errors are detected by the differences between the ADCs, but flaws with the common pneumatic source will not be detected. A feature was added after the accident wherein a warning is issued if the indicated airspeed differs grossly from estimates from other sources.
The aircraft had a backup pneumatic airspeed indicator with a separate pitot tube mounted on the canopy bow and the indicator on the lower right side of the instrument panel. It was not used by the pilot in the accident.
The flight control computer has a manually-selected "R3" backup mode with fixed gains to handle an inoperative air data system. The gains are stable over a wide speed range.
The board found that the accident would have been prevented had the R3 button been pressed anytime before the aircraft lost control. If an ADC error is detected, the R3 button illuminates "requesting" the pilot to switch to R3 mode, but no error was detected on the accident flight. The R3 mode had been used several times early in the program, after consultation with the control room.
The X-31 system safety analyses did not fully consider pitot icing because the aircraft was to be operated in visual conditions and it was originally equipped with pitot heat. Deletion of pitot heat did not cause a reanalysis. Pneumatic failures were assumed due to a low altitude bird strike or boom failure, which would be obvious to the pilot.
The consequences of airspeed failure were determined in a 1989 contractor study to be "critical" -- one degree less than the worst "catastrophic" category. A subsequent 1992 NASA study found airspeed failure to be "an accepted risk" that resulted in "degraded flight control performance," one step less severe than "critical."
The key flaw in the pitot-static studies was that they assumed the airspeed problem would be annunciated and the R3 mode activated. A 1989 study stated that not selecting R3 could be catastrophic.
A 1990 piloted simulator investigation of airspeed failures also showed that they could be catastrophic. Karl-Heinz Lang, the mishap pilot from the German Defense Ministry, flew some of these conditions and wrote "The Mach No. +/- 0.5 bias failure resulted immediately in a +/- max g departure! It is not acceptable that a single failure leads to aircraft loss!"
No action was taken because contractor engineers concluded "that such a failure could only conceivably occur as the result of a bird strike during takeoff or landing phases of flight," the report said. In these cases engineers projected that airspeed error would remain in the controllable envelope, permitting the pilot adequate time to select R3.
The lack of documentation about the severe effects, as demonstrated by the simulator session, "resulted in a situation in which it was unlikely that future project participants would be apprised of the identified hazard." The board made the point that the pitot heat deletion may not have fallen through the cracks if the severe effects of airspeed failure were more broadly known.
The accident was the 523rd flight in the X-31 program, and the 292nd and final one on the No. 1 aircraft before it went down for maintenance and possible mothballing, as program funds were low. It was the third flight of the day, and four flights had been made the day before. The rapid pace combined with the benign nature of the mission may have caused an attention deficit, the board said. The accident occurred while the aircraft was returning to base, when there is a tendency to relax after testing has been completed.
The purpose of the flight was to measure aircraft response to individual control surfaces. The first part of the flight flew at 30-40 deg. angles of attack (AOA) and the final part of the tests were trim points at lower AOA, up to 20 deg. The thrust vectoring was on for the tests, but was turned off for the return to base. The tests took place at about 22,000-24,000 ft., below a 23,000-25,000 ft. cirrus cloud layer. It was a cold and humid day.
The NASA F/A-18 chase pilot said the X-31 transitioned once or twice through the lower cirrus clouds, and it produced visible condensation in the wingtip vortices for much of the mission.
During the latter test points, Lang noticed that the airspeed seemed high for the AOA being flown, and suspected pitot icing. The aircraft was indicating about 207 kias. at 20 deg. AOA, whereas the speed would normally be about 140 kias. Long was concentrating on AOA, not airspeed, for the tests.
Lang turned on the pitot heat and believed it was working because he observed the airspeed decrease. "Being from Germany, where pitot heat is a must, I assumed it worked," he said. "I told the test director the pitot heat was on, and asked him to remind me to turn it off after landing."
His observation of the airspeed decreasing was actually due to the aircraft descending into higher static pressure, reducing its difference from the obstructed total pressure. This difference is used to calculate indicated airspeed.
The aircraft was transmitting telemetry that was being monitored in Dryden's control room, and Lang's comment prompted the project engineer to tell the test conductor "pitot heat is not hooked up on the Kiel probe." He repeated this because the test conductor was distracted, but the conductor did not pass the information to Lang.
The final test point was not accomplished because the software that activated individual surfaces had been tripped off by the indicated airspeed being too high, due to the plugged pitot.
Fuel ran low and Lang started the return-to-base checklist, then reduced power to idle to start his descent. "I was in a turn looking for the field and not concerned about speed," Lang said. The descent caused the indicated airspeed to read increasingly low because of the plugged pitot and increasing static pressure. For reference, with the pitot blocked to read 200 keas. at 20,000 feet, the airspeed will read zero at 16,900 ft. regardless of the actual airspeed. "Fortunately I didn't notice the airspeed, because if I did I would have pushed over to accelerate and the accident may have been more violent.
"The control room then called and said 'the pitot heat might be disconnected.' Several seconds later the aircraft became unstable in all axes. I had seen in the simulator what happens when the X-31 goes out of control -- it departs at maximum g -- so I decided to eject." The ejection occurred 5-10 sec. after loss of control.
"As I grabbed the ejection handle I stared at the R3 button, and thought it would have helped if I had pushed it several seconds earlier," Lang said. "But it took several seconds to realize what had happened, and by then it was already out of control. Pushing R3 then would not have done any good."
After Lang ejected, the aircraft regained stability due to deceleration from the high AOA, but as it fell it gained speed, become unstable again, and had a -8 g bunt among other gyrations.
Lang suffered two fractured vertebrae and a broken ankle and rib, though the initial diagnosis at Edwards was "bruises." His flight suit and some parachute risers were scorched by the ejection pyrotechnics, possibly due to the airflow from the 90 deg. AOA.
The ejection seat is a standard Martin-Baker unit from an F/A-18. The 17 ft.-dia. parachute gave a high 28.3-fps. sink rate, which the board found resulted in the pilot's injuries. The aircraft made a relatively flat impact in the desert. The accident board used recorded telemetry, interviews, and radar and long-range video data in its investigation.
The flight control gains vary with airspeed in the X-31 to maintain optimum aircraft response, resulting in the control surfaces having greater deflections at low speeds. This variable gain feature, along with thrust vectoring, helped the X-31 achieve its fighter maneuverability goal of being responsive and controllable at high AOA, yet stable at high speed. The X-31 is aerodynamically unstable.
As the aircraft descended, the control system margin to instability grew narrower because of the increasing airspeed error. At 20,000 ft., the indicated airspeed had dropped to below 50 kias. but the actual airspeed was about 240 kcas. At this point, the airplane became unstable. It began lateral-directional oscillations which caused the flaperons to move at the actuator rate limit. The rate-limiting introduced lags into the control system that made it further unstable, and several seconds later the aircraft pitched up out of control at about four g's.
Aircraft handling gave no indication of trouble until it exploded out of control, Lang said. "The problem with digital flight control is you feel safe to the very edge. There's no warning whatsoever."
Lang's "hot mike" transmissions to the control room were carried on the telemetry channel and could not be heard by the F/A-1 8 chase pilot. It is possible the chase pilot may have noticed the continuing airspeed discrepancy had he heard the transmissions.
In the past, the hot mike transmissions were rebroadcast to the chase pilot on a UHF frequency, but this practice was stopped because the system was noisy. Technical problems will be fixed and the pilot's comments more widely broadcast, Rogers Smith, Dryden chief test pilot, said.
The board noted that the project engineer's comment that Kiel probe heat was inoperative "should have prompted the test conductor or other control room engineers that an air data problem existed." The tripoff of the test software was the fourth indication of an air data problem, but control room personnel were not aware of the catastrophic potential, the report stated. "The control room was not appropriately configured to identify and observe parameters" connected with airspeed failure because of an "incomplete system safety analysis conducted on the Kiel probe which failed to identify this hazard," the report said.
Some experienced test pilots were not comfortable with this explanation. "The test pilot and flight control engineers ought to understand the importance of the right gains," one said.
About 2.5 minutes passed between Lang's first statement about pitot heat and his ejection. "Considering all the information available to the control room team before and at the time of the mishap, it is unreasonable to assume that the control room should have analyzed and responded to this hazard within this limited time frame," the report said. It concluded that the control room did not cause the mishap.
Several individuals highly experienced with flight tests felt the report did not place enough emphasis on the test team's flawed execution of flight test methodology. "I don't care how safe the aircraft is, 70-kt. errors and icing conditions are not acceptable for good flight tests," one individual told AVIATION WEEK & SPACE TECHNOLOGY. "They should have paused instead of pressing on to the next condition."
The board recommended that: