NTSB release:
two recent incidents in which airspeed and altitude indications in the cockpits of Airbus A-330 aircraft may have malfunctioned. The first incident occurred May 21, 2009, when TAM Airlines flight 8091 (Brazilian registration PT-MVB) flying from Miami, Florida to Sao Paulo, Brazil, experienced a loss of primary speed and altitude information while in cruise flight. Initial reports indicate that the flight crew noted an abrupt drop in indicated outside air temperature, followed by the loss of the Air Data Reference System and disconnections of the autopilot and auto-thrust, along with the loss of speed and altitude information.
Just theorising here (and whilst ignorant of the actual A330 system design); I asked myself "what physical phenomenon could cause a sudden loss of both airspeed and altitude info in a system reliant upon Air Data Reference Units for so many inter-dependent flight control functions?". and "Why the abrupt
drop in IOAT?"
.
I surmised that it would not be solely due to water ingress into (or freezing within) the pitot pressure lines and could only be due to a more insidious pneumatic error, most likely one within the aircraft's static pressure lines. So, a leak or locked pressure?
.
Assume that one (only) static line becomes contaminated by water and that this water contaminant freezes and expands in the high-level cruise - at a low point "water-trap" in the static system. The ADIRU comparator function now has a growing problem integrating and resolving ALL its static inputs. Because it must assimilate inherent minor differences in the various sensed statics, the system won’t fuss over minor errors in quantum, particularly not over one that arises in the stable cruise. However it would if a line froze up in a climb, because the error
rate would be much higher. The static pressure that feeds the barometric height function of the autopilot is now compromised by the error but, in the level cruise, the error is latent and the error-rate isn't rapid enough or yet large enough to excite an ADIRU disagree trip and the aircraft will either climb or descend (very gradually at first).
.
Why will it do that? and why will the flight-crew not notice? Will it climb or descend?
.
During the finite period that the error is compounding, the autopilot's barometric function will maintain (what it interprets to be) the FL350 pressure surface and FL350 will be consistently displayed. However, because of the locked static pressure, that "pseudo level" will not accord to a "real" FL350 at the actual standard pressure datum (QNE: 1013Hpa). The aircraft will actually be climbing due to fuel burn-off, but all the pilots will see over this period is an infinitesimal progressive change in pitch attitude and they'll not notice the minuscule movements (if any) in elevator auto-trim. Postulating here a gradual and insidious error due to a compromised static feed to at least one ADIRU, an error magnitude that's initially below the threshold at which an ADIRU comparator disagree will trigger. Speed would bleed off gradually (see post
2265for the reason) - except that the auto-throttle will be gradually increasing thrust, (albeit minimally) to maintain the stipulated IAS. The actual IAS will however be higher (and will climb gradually).
.
Ultimately however, once a disagreement trip is triggered by error size, what could happen?
.
The ADIRU affected by the compromised static line will trip off as the error size becomes untenable.... and the others will then reject its distorting static pressure contributions.
.
What will suddenly happen to the displayed IAS/MACH, altitude, IOAT and autopilot functions at that point?
.
The speed will change drastically (i.e. increase suddenly to a correct value), the altimeters will jump to the actual increased altitude and the autopilot will disconnect. Auto-thrust will quit and the IOAT will suddenly drop to the true value at the increased altitude (assuming here that it's sensed within the static system).
.
What could trigger a loss of control? Firstly the aircraft's actual altitude (and speed), when the ADIRU "fails", will be nearer to, or even above, coffin corner and sudden manual flight (particularly in Alternate Law) can be quite marginal at that point, particularly if the pilots see the sudden change of IAS/Mach and altitude as an error (rather than what it is, a leap back to reality)..... and inadvertently react with large or uncoordinated manual inputs.
.
Why wouldn't this malfunction scenario be later detected in the aircraft that have survived such encounters?
.
Firstly there's a presumption of pitot probe misbehavior.
Secondly, unless trapped water accumulates such that it can be drained from a limited number of static system low point traps, the water may or may not be detected nor drained (or even if it is, will not be seen as the real villain in the piece).
.
To accept this theory you need to suspend disbelief in the incorruptible infallibility of displays not annunciating errors, have some knowledge of what an ice-locked static pressure can insidiously do to an automated system, believe that computer software programmers just would not have accommodated such a scenario - and do quite a bit of lateral thinking about a cumulative growing error due to burn-off. In respect of inherent software errors, we have the example of the Turkish 737 at Amsterdam for a precursor (i.e. it shows what a RADALT indication glitch, not an annunciated RADALT failure, can do to a flight control system).
.
How does water get into static lines? Does it happen inflight or on the ground?
.
Water ingress is most likely to occur on the ground. In heavy rain water running down fuselage sides can be "sucked in" - in an atmospheric pressure-dropping environment. In some aircraft the static port "bungs" used to plug upwards into the static port but they were also hollow to equalize the pressure. Rain-water running down these hollow bungs would still be sucked up into the system. Nowadays the static ports are left "unbunged" and are usually a number of small holes (about 5 to 15) grouped together, to defeat insect entry. Small diameter holes won't defeat rainwater ingress however.
Why would this process be happening nowadays and not earlier in the A330/A340's life? Minor changes in hardware, software, maintenance routines or operating procedures can introduce unintended consequences. Changes in operating procedures? Perhaps crews are flying higher earlier with lighter load factors.
.
Posts
2406 and
2408 - are also pertinent to this theory.
.
Don’t shoot the speculator. If you don’t like the premise, postulate a more credible scenario…. preferably one that explains how an iced pitot can affect altitude.
.