AF 447 Thread no. 4
Join Date: Jul 2009
Location: France - mostly
Age: 84
Posts: 1,682
Likes: 0
Received 0 Likes
on
0 Posts
Phugoid
Originally Posted by sensor validation
Interesting thought exercise - what would have happened if pilot didn't recover Normal control?
Any resemblance to the A340 Airprox incident is coïncidental!
P.S.: Phugoid2: Angles and "gee"
Last edited by HazelNuts39; 1st Jul 2011 at 09:05. Reason: P.S.
Moderator
Of interest to note that, on autopilot height lock without AT, the phugoid degrades to an ASI variation. On aircraft with a significant phugoid motion this is quite obvious to the crew.
Join Date: May 2011
Location: venice, ca
Posts: 61
Likes: 0
Received 0 Likes
on
0 Posts
PJ2
No one is saying Boeing vs AirBus. Or pilot qualifications.
Merely that one key element missing from all of the conversations is, that the fact that thunderstorms are not considered a potential key problem seems to me quite cavalier and attempts to minimize the risk involved are never discussed.
Is anyone saying: "Disregard the potential hazard of violent weather!"
Which raises the question: Does AB seem to feel that AirBus is "Failsafe"?
Is there a culture there which insists on "Staying the Course"?
That to me is the central problem.
No one is saying Boeing vs AirBus. Or pilot qualifications.
Merely that one key element missing from all of the conversations is, that the fact that thunderstorms are not considered a potential key problem seems to me quite cavalier and attempts to minimize the risk involved are never discussed.
Is anyone saying: "Disregard the potential hazard of violent weather!"
Which raises the question: Does AB seem to feel that AirBus is "Failsafe"?
Is there a culture there which insists on "Staying the Course"?
That to me is the central problem.
Join Date: Jul 2002
Location: 40N, 80W
Posts: 233
Likes: 0
Received 0 Likes
on
0 Posts
Failsafe
wallybird7
Which raises the question: Does AB seem to feel that AirBus is "Failsafe"?
Which raises the question: Does AB seem to feel that AirBus is "Failsafe"?
by Captain William Wainwright, Chief Test Pilot, Airbus Industrie,
... There is no need for this type of continuation training on protected fly-by-wire aircraft, although a general knowledge of the principles involved is useful for every pilot. ....
FAST Number 24.
An old reference. I have no idea whether the internal culture has changed.
Join Date: Jun 2011
Location: West of Offa's dyke
Age: 88
Posts: 476
Likes: 0
Received 0 Likes
on
0 Posts
Of interest to note that, on autopilot height lock without AT, the phugoid degrades to an ASI variation.
Join Date: Apr 2011
Location: NottNum
Posts: 25
Likes: 0
Received 0 Likes
on
0 Posts
The crew received a master warning and master caution alert, and the autopilot (AP), autothrust (ATH) and flight directors disengaged. The crew reported airspeed fluctuations on the Captain’s, First Officer’s (FO), and the standby airspeed indicators. They reported receiving a stall warning, noted the flight law switched to Alternate Law, and saw messages indicating NAV ADR DISAGREE and NAV IAS DISCREPANCY. They reported the airspeed fluctuations and warnings lasted about one minute, and they controlled the airplane by pitch and power reference, per applicable checklist procedures until normal airspeed indications returned.
......
Flight law switched to alternate law twice in the initial 35 seconds of the event........ About 35 seconds after the initial fluctuation the flight control laws returned to normal,
....
The crew could re-engage the autopilot, because at least two ADR values were consistent and valid. The EFCS was able to temporarily return to Normal law because the discrepancy between the ADRs was shorter than the confirmation time to latch the Alternate law. When the airspeed discrepancies returned, including the longer duration No.3 airspeed drop, the autopilot disconnected, and Alternate law then latched for the remainder of the flight.
So it does appear the aircraft will return to Normal law (which would almost certainly have saved the day in AF 447)from ALT 2 but only if the time which the speeds disagree is short enough. Suspect that needs a rethink, apart from that it's hard to find fault with the aircraft.Also, there is a note at the bottom which shows the NTSB had made a link between this incident and the AF accident some time ago.
Per Ardua ad Astraeus
Join Date: Mar 2000
Location: UK
Posts: 18,579
Likes: 0
Received 0 Likes
on
0 Posts
PJ - you may elect to 'opt out' of the argument, but I will continue to press for a major change in attitudes for all, but particularly fbw system training. As I have said elsewhere, a lot of the current 'problems' derive from a mind-set based on 'promotional' talk and an apparent over-reliance on the ability to automate.
You say "you shrink the argument to Airbus system design, resisting every point of explanation regarding the "new" technology offered by those who actually know and fly the machine." No - I was equally critical of the 737 A/T failure at AMS and the 'training' involved. It seems to me that a Gallic shrug is all that is required when the software elects to automatically climb a 340 more than 2000 ft and reduce its speed towards Vls following turbulence and a minor overspeed detection. "It's OK, mes amis, we have changed the code" - not 'why is it designed that way'. Is the way we train our crews adequate for this system design? There has been no "point of explanation" about this logic, merely 'how it works' and not 'why?' Do I take it therefore that you find this 'reaction' acceptable? As for "you shrink the argument to Airbus system design", perhaps revisit the thread title?
As for 'gamers' operating modern aircraft, yes, we will go that way. Let's hope there are always enough tokens for them to put in the slots and that no-one ever pulls the power plug out of the wall.
For 'Smilin_Ed' also, would a competent pilot have zoomed a 340 to 380+ over the North Atlantic with a minor overspeed in turbulence? Most 'competent pilots' know full well that climbing a heavy aircraft from cruise and increasing towards a limiting alpha with turbulence is not a good idea. I would have hoped the designers thought the same way too and that pilots would have flagged this up. That is what I mean. I am not referring to 447. In my book, the jury is still out on the 'zoom climb'.
JD-EE, I disagree - it was the 'system' that trimmed the tail at AMS, PGF and with 447 (and several other cases), not the 'pilots'. In all cases they made no deliberate attempt to trim that far.
You say "you shrink the argument to Airbus system design, resisting every point of explanation regarding the "new" technology offered by those who actually know and fly the machine." No - I was equally critical of the 737 A/T failure at AMS and the 'training' involved. It seems to me that a Gallic shrug is all that is required when the software elects to automatically climb a 340 more than 2000 ft and reduce its speed towards Vls following turbulence and a minor overspeed detection. "It's OK, mes amis, we have changed the code" - not 'why is it designed that way'. Is the way we train our crews adequate for this system design? There has been no "point of explanation" about this logic, merely 'how it works' and not 'why?' Do I take it therefore that you find this 'reaction' acceptable? As for "you shrink the argument to Airbus system design", perhaps revisit the thread title?
As for 'gamers' operating modern aircraft, yes, we will go that way. Let's hope there are always enough tokens for them to put in the slots and that no-one ever pulls the power plug out of the wall.
For 'Smilin_Ed' also, would a competent pilot have zoomed a 340 to 380+ over the North Atlantic with a minor overspeed in turbulence? Most 'competent pilots' know full well that climbing a heavy aircraft from cruise and increasing towards a limiting alpha with turbulence is not a good idea. I would have hoped the designers thought the same way too and that pilots would have flagged this up. That is what I mean. I am not referring to 447. In my book, the jury is still out on the 'zoom climb'.
JD-EE, I disagree - it was the 'system' that trimmed the tail at AMS, PGF and with 447 (and several other cases), not the 'pilots'. In all cases they made no deliberate attempt to trim that far.
Join Date: Jul 2009
Location: UK
Posts: 134
Likes: 0
Received 0 Likes
on
0 Posts
Re A340 airprox zoom climb
@Grity
Thanks for the update - I started on a more detailed digitization of the graphs (there are shareware/opensource tools) - but didn't get too far! Your plots do show the effect of pilot intervention to cut the peak height reached, but its interesting to see the AoA on the way down back in same range as on the way up!
@HazelNuts39
Do you get the phugoid plot purely from energy considerations assuming initial AoA correct for 1g flight? If so can it be redone with an initial AoA giving 1.5g which should give a higher climb rate and shorter period.
I assume natural damping very difficult to model but how much of a roller-coaster ride is it in an A340/A330 with rearward cg @FL350 without pitch and throttle control if you don't start with a trimmed condition?
@Grity
Thanks for the update - I started on a more detailed digitization of the graphs (there are shareware/opensource tools) - but didn't get too far! Your plots do show the effect of pilot intervention to cut the peak height reached, but its interesting to see the AoA on the way down back in same range as on the way up!
@HazelNuts39
Do you get the phugoid plot purely from energy considerations assuming initial AoA correct for 1g flight? If so can it be redone with an initial AoA giving 1.5g which should give a higher climb rate and shorter period.
I assume natural damping very difficult to model but how much of a roller-coaster ride is it in an A340/A330 with rearward cg @FL350 without pitch and throttle control if you don't start with a trimmed condition?
Join Date: Jul 2009
Location: France - mostly
Age: 84
Posts: 1,682
Likes: 0
Received 0 Likes
on
0 Posts
Originally Posted by sensor validation
Do you get the phugoid plot purely from energy considerations assuming initial AoA correct for 1g flight?
P.S. The aero data are those of an A330 at 205t/37%, since I don't have these for the A340 incident.
Last edited by HazelNuts39; 1st Jul 2011 at 11:08. Reason: P.S.
I presume this discussion on phugoid oscillations relates to the A340 AIRPROX? I used to do a nice one myself occasionally in the climb on aeroplanes like VC10 and B707 – unintentionally, of course, and usually due to coarse pitch selections using the AP pitch wheel.
AF447, on the other hand, seems to have shown no sign of one – probably because of the G-control provided by Pitch-Alternate Law. Unfortunately, that same law, coupled with a lack of any sustained pitch-down commands on the sidestick, seems to have led to the super-stall.
So we can now see only too clearly that the flight-path stability provided by C* Law, with its normal low-speed protections invalidated due to the UAS, necessitates firm action by the pilot if – for whatever reason – the aircraft enters a climb which cannot be sustained by its performance capability. This action seems to have been largely absent in AF447, and seems to have come late in the day on the A340 AIRPROX incident.
This leads me to wonder if, in the event of the systems diagnosing UAS, it would be better for the EFCS to downgrade to Pitch-Direct instead of Pitch-Alternate. It also occurs to me, however, that the PF needs some warning, if at all possible, that he/she is about to lose the longitudinal stability of C*. The AP has already disconnected, but a short period of mental preparation for stick-to-surface control might be useful.
Stick-to-surface hand flying at high altitude, particularly in turbulence, requires a fair amount of concentration. I once shared the task with my skipper on a B707 for the last 6 or 7 hours of a CCS-LGW flight, including step-climbs up to FL410. 20 minutes at a time was enough, and we had the benefit of reliable airspeed indications.
AF447, on the other hand, seems to have shown no sign of one – probably because of the G-control provided by Pitch-Alternate Law. Unfortunately, that same law, coupled with a lack of any sustained pitch-down commands on the sidestick, seems to have led to the super-stall.
So we can now see only too clearly that the flight-path stability provided by C* Law, with its normal low-speed protections invalidated due to the UAS, necessitates firm action by the pilot if – for whatever reason – the aircraft enters a climb which cannot be sustained by its performance capability. This action seems to have been largely absent in AF447, and seems to have come late in the day on the A340 AIRPROX incident.
This leads me to wonder if, in the event of the systems diagnosing UAS, it would be better for the EFCS to downgrade to Pitch-Direct instead of Pitch-Alternate. It also occurs to me, however, that the PF needs some warning, if at all possible, that he/she is about to lose the longitudinal stability of C*. The AP has already disconnected, but a short period of mental preparation for stick-to-surface control might be useful.
Stick-to-surface hand flying at high altitude, particularly in turbulence, requires a fair amount of concentration. I once shared the task with my skipper on a B707 for the last 6 or 7 hours of a CCS-LGW flight, including step-climbs up to FL410. 20 minutes at a time was enough, and we had the benefit of reliable airspeed indications.
Join Date: Feb 2011
Location: Nearby SBBR and SDAM
Posts: 875
Likes: 0
Received 0 Likes
on
0 Posts
UAS early warning
Chris Scott,
It seems useful immediately warn the crew when "UAS starts". I suspect F-GZCP was not equipped with the add on to warn on UAS like N805NW (A330-323). I also would prefer to know (immediately) the reason for Law change, because could led PF to a more "graceful degradation situation" (a/c+PF) specially when facing "extreme conditions".
...but a short period of mental preparation for stick-to-surface control might be useful.
Per Ardua ad Astraeus
Join Date: Mar 2000
Location: UK
Posts: 18,579
Likes: 0
Received 0 Likes
on
0 Posts
Originally Posted by CS
Stick-to-surface hand flying at high altitude, particularly in turbulence, requires a fair amount of concentration
Join Date: Feb 2011
Location: Nearby SBBR and SDAM
Posts: 875
Likes: 0
Received 0 Likes
on
0 Posts
Why use redundancy in a System design
Hi,
When you have 3, 5, 7, (odd number), etc. critical elements, your System is able to:
1. Compare elements trying to figure out the “truth” i.e. their correct “output”
2. “Vote” to select the best ones (the ones that are probably presenting correct results)
3. Implement a more “fault tolerant” system for a better (safer) System availability
4. Promote a “graceful degradation” in the overall system
But this is only valid for elements with low chances to fail simultaneously. This is well done In Airbus SAS planes with triple critical computing elements (acting as 5). A solid Engineering approach.
When you have identical elements, subjected to the same environment and clearly failing simultaneously (IIRC 38 cases of UAS analyzed since 2003) something should be done earlier (IMHO urgently).
The current redundancy is only useful when you have a Pitot heater failure, interface failure, “wiring”, etc. Simply because the chances of simultaneous failures of this category are near zero.
What is the net result of the current AS "redundancy"?
1. To degrade the System (no longer able to work at “full specs” due a plane itself limitation) triggering (without early warning*) a major reconfig in the plane control System
So the question? Why they used redundancy? The reason i call it “ridiculous” is because the use of n identical and non adequate AS sensors failing simultaneously is absolutely useless.
This seems a “conceptual error” that seems incorrectly being used in other a/c designs. And not helping in two very important "features"
1. Fault tolerance (a/c)
2. Graceful degradation (a/c+crew)
The only result of this redundancy is to realize that the plane is entering a dangerous "space". In a plane using improper AS sensor specification (non adequate product) of an important a/c element (to the control System)
AF447 crew, in the first moment, were informed on UAS condition? When (if ever) they realized the plane was affected by a "simple and brief" UAS condition?
I suspect F-GZCP was not equipped with the add on to warn on UAS like N805NW (A330-323). Is that true? (This UAS early warning “add on” should be a standard item and not an optional item for the operator)
I would prefer to know (immediately) the reason for Law change. Why? Simply because could provide a more graceful degradation situation (a/c+crew) when entering and facing “extreme” conditions.
AF447 (a/c+crew) apparently instead had an “accelerated degradation”, due (triggered by) a flawed System design using "redundant" inadequate AS sensors for typical (possible) atmospheric conditions.
The statistics (low UAS probability) is no excuses in this issue. Urgent results from R&D being done, is required. After all, Airbus SAS introduced "advanced planes" and this seems to be the inexorable industry trend.
(*) From an "instrumentation point of view" i guess it´s possible to have a safe early warning (real time) before a Law change triggered by this condition
When you have 3, 5, 7, (odd number), etc. critical elements, your System is able to:
1. Compare elements trying to figure out the “truth” i.e. their correct “output”
2. “Vote” to select the best ones (the ones that are probably presenting correct results)
3. Implement a more “fault tolerant” system for a better (safer) System availability
4. Promote a “graceful degradation” in the overall system
But this is only valid for elements with low chances to fail simultaneously. This is well done In Airbus SAS planes with triple critical computing elements (acting as 5). A solid Engineering approach.
When you have identical elements, subjected to the same environment and clearly failing simultaneously (IIRC 38 cases of UAS analyzed since 2003) something should be done earlier (IMHO urgently).
The current redundancy is only useful when you have a Pitot heater failure, interface failure, “wiring”, etc. Simply because the chances of simultaneous failures of this category are near zero.
What is the net result of the current AS "redundancy"?
1. To degrade the System (no longer able to work at “full specs” due a plane itself limitation) triggering (without early warning*) a major reconfig in the plane control System
So the question? Why they used redundancy? The reason i call it “ridiculous” is because the use of n identical and non adequate AS sensors failing simultaneously is absolutely useless.
This seems a “conceptual error” that seems incorrectly being used in other a/c designs. And not helping in two very important "features"
1. Fault tolerance (a/c)
2. Graceful degradation (a/c+crew)
The only result of this redundancy is to realize that the plane is entering a dangerous "space". In a plane using improper AS sensor specification (non adequate product) of an important a/c element (to the control System)
AF447 crew, in the first moment, were informed on UAS condition? When (if ever) they realized the plane was affected by a "simple and brief" UAS condition?
I suspect F-GZCP was not equipped with the add on to warn on UAS like N805NW (A330-323). Is that true? (This UAS early warning “add on” should be a standard item and not an optional item for the operator)
I would prefer to know (immediately) the reason for Law change. Why? Simply because could provide a more graceful degradation situation (a/c+crew) when entering and facing “extreme” conditions.
AF447 (a/c+crew) apparently instead had an “accelerated degradation”, due (triggered by) a flawed System design using "redundant" inadequate AS sensors for typical (possible) atmospheric conditions.
The statistics (low UAS probability) is no excuses in this issue. Urgent results from R&D being done, is required. After all, Airbus SAS introduced "advanced planes" and this seems to be the inexorable industry trend.
(*) From an "instrumentation point of view" i guess it´s possible to have a safe early warning (real time) before a Law change triggered by this condition
Redundancy
RR NDB
Excellent post above
It does an exccelent job of putting perspective how reduncay works in complex systems (with the pilot) and where it might not work.
Your knowledge and understanding is way beyond the more simple use of the words by 99% of posters, you can bet that the Airbus designers have equal but deeper knowlege and understanding as well.
to wit
One might now suspect where to look for the swiss cheese layer that has gone wrong in this accident to make this the only so-far upset accdent associated with a probable icing failure of the pitot system.
To me all this talk about poor design and reversion laws in the many many pages of these postings is way too presumptious
Excellent post above
It does an exccelent job of putting perspective how reduncay works in complex systems (with the pilot) and where it might not work.
Your knowledge and understanding is way beyond the more simple use of the words by 99% of posters, you can bet that the Airbus designers have equal but deeper knowlege and understanding as well.
to wit
1. Fault tolerance (a/c)
2. Graceful degradation (a/c+crew)
2. Graceful degradation (a/c+crew)
To me all this talk about poor design and reversion laws in the many many pages of these postings is way too presumptious
Join Date: Feb 2001
Location: right here inside my head
Age: 65
Posts: 178
Likes: 0
Received 0 Likes
on
0 Posts
Originally Posted by Lomapaseo
One might now suspect where to look for the swiss cheese layer that has gone wrong in this accident
No single slice alone can be blamed.
On one hand, there is discussion here about the absolute necessity for pilots to exercise basic airmanship and “fly” the aircraft when automated systems degrade…but on the other hand thought is presented as to having the present degraded systems capabilities modified and “improved” so that in a degraded systems situation, “piloting responsibilities” and airmanship requirements are made less demanding by…
...the aircraft systems.
???
Just for information…
I’m often in a simulator by myself, doing calibrations and setups. I can get up and leave the simulator pilot seats unoccupied and the sim unfrozen in alternate law in level flight with constant thrust at high altitude, with A/P & A/T disconnected, and take a ten minute phone call in the back.
When I come back, the only significant change in conditions will be that the sim is now about 70-80 NM down the road. When I climb back in a seat, at this point I can take additional time for mental preparation.
Tolerant? Graceful?
True, it is a sim, but maybe you get the idea.
...the aircraft systems.
???
Just for information…
I’m often in a simulator by myself, doing calibrations and setups. I can get up and leave the simulator pilot seats unoccupied and the sim unfrozen in alternate law in level flight with constant thrust at high altitude, with A/P & A/T disconnected, and take a ten minute phone call in the back.
When I come back, the only significant change in conditions will be that the sim is now about 70-80 NM down the road. When I climb back in a seat, at this point I can take additional time for mental preparation.
Tolerant? Graceful?
True, it is a sim, but maybe you get the idea.
Join Date: Aug 2009
Location: Germany
Age: 67
Posts: 1,777
Likes: 0
Received 0 Likes
on
0 Posts
Hi,
You are lucky .. never the plane go in a right bank .. when you was making your call 
I’m often in a simulator by myself, doing calibrations and setups. I can get up and leave the simulator pilot seats unoccupied and the sim unfrozen in alternate law in level flight with constant thrust at high altitude, with A/P & A/T disconnected, and take a ten minute phone call in the back.
When I come back, the only significant change in conditions will be that the sim is now about 70-80 NM down the road. When I climb back in a seat, at this point I can take additional time for mental preparation.
Tolerant? Graceful?
True, it is a sim, but maybe you get the idea.
When I come back, the only significant change in conditions will be that the sim is now about 70-80 NM down the road. When I climb back in a seat, at this point I can take additional time for mental preparation.
Tolerant? Graceful?
True, it is a sim, but maybe you get the idea.
RR_NDB,
In replying to my post, you have missed the point I was trying to make, although you have made another perfectly reasonable one. I doubt it's possible to delay the downgrade from Normal Law. The question is: should the pitch element be downgraded to Pitch-Alternate (retaining C*) or Pitch-Direct (stick-to-elevator and manual THS)? If the latter (for the reason I stated), it would be a very big, instant step. As the system is capable of providing Pitch-Alternate (ALT 2), my suggestion is that it could do that for a period of – say – 20 seconds with an ECAM warning that Direct law will follow. This might give the PF enough time, if necessary, to discard his/her meal tray, retract the table, and concentrate on the job in hand.
BOAC,
I was not expressing an opinion on whether an aircraft might continue or divert following a UAS incident: that would be for the captain to decide. My little tale about hand-flying stick-to-elevator at high altitude was merely to illustrate to the non-flyers on this forum that it involves a significant workload, even in level flight when airspeed indications are available.
In replying to my post, you have missed the point I was trying to make, although you have made another perfectly reasonable one. I doubt it's possible to delay the downgrade from Normal Law. The question is: should the pitch element be downgraded to Pitch-Alternate (retaining C*) or Pitch-Direct (stick-to-elevator and manual THS)? If the latter (for the reason I stated), it would be a very big, instant step. As the system is capable of providing Pitch-Alternate (ALT 2), my suggestion is that it could do that for a period of – say – 20 seconds with an ECAM warning that Direct law will follow. This might give the PF enough time, if necessary, to discard his/her meal tray, retract the table, and concentrate on the job in hand.
BOAC,
I was not expressing an opinion on whether an aircraft might continue or divert following a UAS incident: that would be for the captain to decide. My little tale about hand-flying stick-to-elevator at high altitude was merely to illustrate to the non-flyers on this forum that it involves a significant workload, even in level flight when airspeed indications are available.