Overspeed in cruise due to a tailwind drop

An A340 aircraft was flying at FL380 with a managed Mach number of 0.82 and a tailwind of around 64 kt. Prior to reaching top of descent, a sudden drop in tailwind of 41 kt in 14 seconds caused a significant airspeed increase and triggered an OVERSPEED warning for 9s despite the thrust reduction commanded by the autothrust (A/THR) (fig.1).

The Captain reacted to the overspeed warning by manually disconnecting the autopilot (AP) and then by, applying large pitch up inputs on the side stick. The speedbrakes were not used. The flight crew then selected a Mach number of 0.7, which actually corresponds to an airspeed below VLS. The aircraft consequently started to climb at a pitch rate of up to 5 700 ft/min. The speed was decreasing with the thrust at idle thrust in accordance with the selected Mach. 

The flight crew erroneously applied the OEB49 procedure and switched off the ADR 2 and ADR 3 about 15 seconds after the autopilot disconnection. This caused the aircraft to revert to Alternate law, with the loss of the FD bars and disconnection of autothrust. As a consequence, the thrust remained at the current value which was still idle at that time (fig.2). Indeed the THR LK function at autothrust disconnection maintains the thrust at its current value until the thrust levers are moved again. This is indicated by the associated “ENG THRUST LOCKED” ECAM alert that requests to move the thrust levers and the “THR LOCK” displayed on the FMA.

32 seconds of climb with idle thrust until reaching STALL warning

After the A/THR disconnection, the thrust levers were not moved for 32 s. During this time, the aircraft therefore continued its climb with the thrust at idle and decreasing speed. While reaching FL399, four successive stall warnings triggered. The crew reacted by applying stall recovery maneuvers and sent a MAYDAY call. 

ADRs switched back to ON

The flight crew finally switched ADR2 and ADR3 back to ON. This enabled the flight crew to reengage both the AP and A/THR. The aircraft resumed normal flight and landed without further incident. 

Analysis of the flight data highlights two main aspects of this event: the handling of overspeed and the improper application of the OEB49.   

Overspeed handling

During this event, the flight crew disconnected the autopilot following the OVERSPEED warning However, the autopilot is robust to overspeed situations. The autopilot automatically disconnects only when the filtered Mach becomes higher than M_MO + a margin (M_MO + 0.03 on A330/A340 aircraft). The filtered Mach is a smoothed and slightly delayed Mach which dampens any abrupt variation of the current Mach and makes the autopilot even more robust against automatic disconnection.

Simulations show that if the autopilot had been left engaged, it would have remained engaged during this event (fig.3). As a result, the aircraft would have stayed on its trajectory.

In addition, the use of speedbrakes (S/B) is an efficient way to limit the V_MO/M_MO overshoot in cruise. This event has been simulated with autopilot kept ON and S/B selection at the time the V_ctrend arrow reaches V_MAX. The comparison of the event Mach with the Mach resulting from these simulations shows that the use of AP combined with a S/B extension would have minimized the altitude excursion as well as the V_MAX overshoot and overshoot duration (fig.4).

For more information on the handling of an overspeed situation in cruise, refer to the Safety first article “Management of overspeed events in cruise”.

Improper application of OEB49

During this event, the flight crew interpreted a rising of the alpha protection strip on the PFD as an entry condition of the "Abnormal V Alpha prot" OEB49 and switched off ADR2 and ADR3. However,  none of the OEB entry conditions were actually encountered.

Only 2 cases of improper AoA protection activation have occurred since the introduction of Airbus fly-by-wire aircraft 31 years ago. 

The first time was in November 2012 on an A330 aircraft after the introduction of conic AoA cover plates. All the conic plates were immediately removed subsequent to this event and the original flat cover plate design type was refitted.

The second event occurred 2 years later on an A321 equipped with the initial AoA flat cover plate design. This is the only case of undue AoA protection activation with this configuration which has accumulated more than 300 Million flight hours. 

OEB48 for A320 family and OEB49 for A330/A340 family were however issued at that time to cover the risk of undue activation of AoA protection in case of multiple AoA blockage at a consistent high value. 

These OEB request the flight crew to keep only one ADR ON and switch off the other two ADR. This forces reversion to alternate law which will disable flight envelope protections and thus prevent inappropriate activation of the high angle of attack protection.

OEB48 and OEB49 have two types of entry conditions: one reactive entry and some preventive entries. 

These OEB must be applied only if one of the entry conditions has been confirmed, remembering that only the reactive entry condition requires immediate action. 

Reactive entry condition for OEB48 and OEB49: Incorrect activation of the AoA Protection

The reactive entry condition is unique, simple and the same for the A320 family, A330 and A340 aircraft (fig.5). The OEB procedure must be immediately applied if the aircraft goes to a continuous nose down pitch rate that cannot be stopped with full backward sidestick inputs while flying at a speed above VLS. 

Preventive entries based on PFD speedscale monitoring

These OEB also describe “preventive” entry conditions that enable to detect an abnormal overestimation of the αProt strip on the PFD, which could lead to an undue activation of the AoA protection later in the flight. The flight crew must confirm that all the parameters of the preventive entry condition are true before applying the OEB.

The effects on the PFD speedscale differ depending on the aircraft type:

• A330/A340 aircraft (OEB49)

On A330 or A340 aircraft, the preventive entry condition is when the αProt strip continuously increases and exceeds Green Dot (GD) speed as the Mach increases in a stabilized wings-level flight path (typically during the climb phase) (fig.6).

In the event described, the flight crew of the A340 improperly applied OEB49. The  αProt strip increase above green dot speed did not occur with Mach increasing and in stabilized wings-level flight, but instead resulted from sidestick pitch up inputs (fig.7). 

The preventive entry condition of the OEB49 was therefore not fulfilled. The reactive entry was not fulfilled either as the aircraft was climbing when the OEB was applied.

• A320 family aircraft (OEB48)

On A320 family aircraft, by design, the αProt strip is limited by VLS out of g-load conditions, so that an abnormal αProt strip increase becomes visible only during manoeuvers (turn or pitch change)

1st preventive entry : The αMax strip completely hides the αProt strip  in a stabilized wings-level flight path (without an increase in load factor)

2nd preventive entry : With the Auto Pilot (AP) engaged and the speed brakes in the retracted position, the αProt strip rapidly moves by more than 30 kt during flight maneuvers with an increase in load factor, for example turns or pitch variations.

No reported cases of proper application of OEB48/49 

No cases of proper OEB48 & OEB49 application have been reported to Airbus since their publication in December 2014. However, there were six cases of improper application of these OEB procedures.

The OEB was applied in one event where the aircraft was already in alternate law when AoA protection is not available.

Two cases were reported on A320 family after a normal 20 kt αProt strip increase during a turn with autopilot engaged.

Three cases, including the A340 event described, occurred in similar conditions. The OEB was improperly applied in an overspeed context, after take-over with significant pitch-up inputs applied. 

Improperly applying these OEB in overspeed situations could result from inappropriate training for the following reasons: The current simulators cannot properly simulate the scenario requiring the application of these OEB. However some operators wrongly use some scenarios such as the dual “TOTAL PITOT BLOCKAGE” to train their pilots to switch off two ADR following an undue activation of the High Speed Protection. This undoubtedly generates negative training and can impair the pilots’ understanding and trust of the flight envelope protection.. The article “The Adverse Effects of Unrealistic Simulator Scenarios” explains why the use of the Dual “TOTAL PITOT BLOCKAGE” scenario in simulators is inappropriate and must not be used.

Ensuring that Flight crews understand the reasons for applying OEB48/49 and knowing their entry conditions is essential. Supporting training material, such as instructional videos, are available on the Airbus World portal. For more information on the material available, refer to Flight Operations Transmission (FOT) 999.0148/14 Rev 01 dated 23-DEC-2014 for A330/A340 aircraft and to FOT 999.0147/14 Rev 01 dated 23-DEC-2014 for A320 family aircraft.

Switching two ADR to OFF has a significant consequences for the flight, especially in dynamic conditions.

Reversion to ALTERNATE law means the loss of the flight envelope protections including High angle of attack, bank angle and pitch attitude protections.  The loss of autopilot and Flight Directors increases the workload of the flight crew. Finally, when the A/THR disconnects the thrust remains at this value as long as the thrust levers are not moved. 

Two modifications are now available that will cancel OEB48 & 49 when implemented on affected aircraft.

These modifications consists in installing at least two Thales AoA probes, which are more robust to potential blockage at high AoA value, and in a software update for the Flight Control Computers 

This software update introduces two additional monitoring functions:

• Reinforced AoA monitoring

Updated monitoring will detect AoA probe blockages including multiple and consistent blockages and will reject the data of the concerned probe(s).

• “AoA protection watchdog” monitoring

This function is an additional, independent monitoring that is active at high speeds. It detects inconsistencies between the actual aircraft behavior and the AoA protection activation. In the case of inconsistency, it disables the AoA protection. This independent monitoring would detect undue activation of the AoA protection caused by any possible unforeseen conditions.

Note: These two monitoring functions are already implemented on all A350 and A380 aircraft.

The installation of the probes and of the software update is mandated by Airworthiness Directives on A320 family and A330/A340 aircraft and cancels the OEB48/49. 

OEB48 & 49 must not be applied after the fix

It is the operator’s responsibility to remove the OEB from the FCOM and QRH as soon as the corrective modifications are installed on the aircraft and inform flight crews that the OEB is cancelled and its procedure must not be applied anymore.