AF447 wreckage found

[JJFFC]

REPORT on the incident on 24 September 1994 during approach to Orly (94) to the Airb

• 2 - ANALYSIS
  
  2.1 ATC Actions
  The aircraft left its cruise level late, on instruction from the ATC. The IAF, the MEL VOR, was flown over at an indicated speed greater than 300 kt whereas speed is limited to 250 kt below level 100. ATC asked the flight crew, who announced a vertical speed of 4,000 feet per minute, to accelerate its descent to level 60, which, according to standard procedure, should be reached 7 NM after passing MEL.
  Heading 330 given by approach control tended to bring the aircraft practically to the FAF for immediate interception of the ILS. Heading 310 reduced the closing angle for the aircraft's route in relation to the ILS axis. This angle was still too wide for the aircraft to align comfortably on the ILS and follow it immediately, all the more in that the indicated speed was still about 235 kt on interception.
  This type of procedure is a practice that allows for traffic to be accelerated when meteorological conditions are favorable, which was the case. The flight crew could, however, in compliance with regulations, express its disagreement if they considered headings given would lead the aircraft to intercept the ILS too close to the final descent point. They did not do so.
  There was no radio communication exchanged during the incident itself.
  After the aircraft came out of the stall, the controller suggested to the flight crew that they stay on heading 180. This complies with the operational instruction aimed at keeping any aircraft with reduced maneuverability to the south of Orly. They were then left the choice of heading to return to their final approach as they wished.
  New clearance for landing was given at 10 h 49 m 54 s. Note that no superfluous requests as to the cause of the incident were made by the controller.
  2.2 Incident Sequence
  The CVR transcription does not indicate an approach briefing. The Captain was performing an automatic approach.
  In level flight at 3,000 feet, the aircraft crossed the glide slope before intercepting the localizer. The flight crew seems to have attributed non-capture of glide to automatic pilot system malfunction, whereas the system logic subordinates it to that of the localizer, and disconnected the automatic pilot. The systems configuration then became AP OFF and ATHR ON. The aural warnings announcing disconnection of the AP and downgrading from CAT 3 to CAT 1 of the system landing capability were not commented on by the flight crew.
  The aircraft was now in being flown manually and locked onto the localizer at an angle of 52° at 210 kt. It was high in relation to the glide slope and to the north of the localizer axis. Aligned and set to descend, the speed was too high and the indicator for deviation in relation to the descent glide slope showed one point. The vertical speed was not commented on.
  At about 2,750 feet, when the “altitude alert” signal sounded, the co-pilot selected 4,000 feet as the altitude to reach in the event of aborted approach, in order to cut off the warning signal.
  This selection, before the capture of runway alignment, was premature and its value was greater than the level-off altitude following a go around.
  Although the throttle levers had been in “flight idle” position, the speed remained high, the aircraft being two hundred feet above the glide slope. The Captain decided to put it in landing configuration. On each of the successive extensions of slats, flaps and landing gear, the speed was close to the maximum authorized value.
  The flaps were positioned at 20 degrees as soon as the speed of 195 kt, that is VFE, was reached. A temporary and minimal excess of VFE (two knots for two seconds), perhaps on going through turbulence, was recorded. The speed protection logic then triggered mode reversion, thus initiating CLB mode due to the altitude selected being higher than the aircraft's altitude.
  This change was not noted by the flight crew who were apparently not reading the FMA and did not notice the LVL CHG pushbutton illuminated on the FCU. They did not comment on the “triple click” signal.
  While the throttle levers were advancing at their nominal speed on automatic by one degree per second, an action, which seems to have been unintentional and unconscious by one of the pilots, on the elevator trim control button led to deflection of the THS, at constant angular velocity, over ten seconds, up to the maximum value of thirteen degrees nose up. Although the characteristic "whooler" aural alarm was heard continuously for ten seconds, it was not commented on by the flight crew and led to no reaction from them.
  This was probably the Captain's responsibility, who was at the controls. It may be explained :
• either by incorrect positioning of the left hand on the control column which would have caused the thumb to press the trim control button,
• or following confusion between two buttons, that of the trim control and that of the instinctive AP disconnect. This pilot has considerable experience on the BAC 111, an aircraft on which the pushbutton on the left control column horn is the automatic pilot instinctive disconnection control. We may surmise that when he sought to counter the aircraft's tendency to pitch up without understanding its origin, confusion could have set in and having reverted to old reflexes in seeking to disconnect the automatic pilot (already disconnected) he operated the control located in the same place as the AP disconnection on BAC 111.
  The co-pilot's phrase “take over manually” is not sufficiently explicit. As the aircraft was no longer on automatic pilot, it would have been more appropriate to say “disconnect the auto-throttle”. This may also mean that the co-pilot believed that one automatic pilot had remained active.
  In any event, deflection of the THS created a strong nose up force to the aircraft that the pilot countered by energetic efforts on the elevators, which put the aircraft in a totally out of trim situation.
  This out of trim situation was the second crucial feature in the sequence of events in the incident, the first having been the AFS mode reversion.
  It seems that the flight crew was unaware of this total out of trim situation. They did not carry out the instructions provided for in the event of “High Pitch Force” or “Abnormal pitch behavior” that provide a response to this situation.
  As the auto-throttle was still in operation, the pilot overrode it by manually moving the throttle levers to flight idle for ten seconds before suddenly pushing them back to the maximum thrust position. Four seconds later, he moved them rapidly to flight idle for two seconds, before again pushing them to maximum thrust.
  To try and explain the first positioning of the throttle levers to maximum thrust, we can propose two hypotheses :
• the Captain, noticing the strong reduction in the VC trend, may have thought that the speed was going to decrease significantly. He may have advanced the throttle to avoid stalling,
• the Captain, noticing the problem in the pitch attitude, which would prevent him from continuing his landing, seems to have decided to climb so as to obtain more favorable conditions to deal with the problem. No reason was found for the two other movements of the throttle levers and interviews with the flight crew did not contribute to an understanding of this. It is also clear that the crew, after such a stressful event, could neither remember all their actions, often probably of an instinctive nature, nor even less explain them.
  Under the aerodynamic effect of THS deflection and under the mechanical effect of thrust, the aircraft was thus subjected to a nose up force that could not be controlled by elevators. It rapidly assumed an extreme pitch attitude and angle of attack.
  The level of force applied on the elevators with just the left hand, while the right hand was maneuvering the engine throttle levers, induced load on the aileron controls. The aircraft then went into a regular and slow roll.
  The flight crew was thus confronted by four problems, with the need to:
• Hold the aircraft on a descending path
• Counter the nose up tendency and control thrust
• Pilot the aircraft by switching to instrument flight
• Analyze and decide. The Captain reached a point of saturation and so announced a MAYDAY situation, meaning he indicated that he was in a critical situation. It should be noted here that the flight crew neither acted in a coordinated manner nor relied on rules for dealing with an emergency situation. The Captain did not delegate any task or action to the co-pilot who, in turn, proposed no emergency action. Any notion of managing the flight crew seems to have been forgotten.
  The FD indications on the pitch attitude to be followed to reach an altitude of 4,000 feet could only be interpreted with great difficulty by the flight crew. Also, due to high pitch attitudes, the PFD was automatically purged, to leave essential information only.
  The aircraft thus reached an altitude of 4,100 feet on the verge of a stall, with a minimum recorded speed of about 35 kt. The protection system against high angles of attack cut in and reduced THS deflection from –12.7 to –8.8 degrees, and as a result, the angle of attack from 42 to 30 degrees. The PF does not seem to have noticed the THS pitch down movement, particularly given that a movement of the THS commanded by the automated systems is not announced by the “whooler”. This triggered a reduction in pitch attitude. The aircraft did, however, stall; the “Cricket” stall warning signal and stick shaker were only activated later during descent (see paragraph 2.3.2 below).
  Immediately before, during and after the stall, due the unreliability of the total pressure, the ADC no longer provided speed data, resulting in automatic disconnection of the ATHR, with the throttle levers remaining in the maximum thrust position.
  Just before the stall, the Captain pulled the control column fully back, bringing the elevator to 23 degrees nose up. He then pushed it fully forward, while continuing to counter the roll of 75 degrees to the right with the ailerons. The statistical data shows that, when confronted by a stall, in 80% of cases, pilots pull back the control column, in a sort of reflex movement, which continues the loss of control.
  The aircraft was subjected to a series of four full and rapid rolls. The first was attributed to the force brought to bear by the pilot on the left part of the control column; the following ones were due to pilot overcompensation on the roll then the stall. Having pulled the control column fully back and thus caused maximum nose up pitch, the pilot rectified this by pushing the control column fully forward. The aircraft dipped, with its nose going under the horizon by 32°. The roll-off from +50 to –32° in seven seconds was remarkable.
  During the descent, the pilot, helped by the automatic setting of the THS to –8.8 degrees, reduced angle of attack, gained speed by reducing drag, performed a gentle pull-out (load factor of 2 g for five seconds) and adjusted power. The aircraft came out of the stall at a height of eight hundred feet, still out of trim. The flight parameters were apparently stable thanks to thrust modulation.
  Alpha-trim protection was automatically cancelled as soon as the aircraft came out of the stall : the THS returned to its previous deflection of –12.7 degrees. This automatic movement, without a “whooler”, seems to have gone unnoticed by the Captain. The Captain flew the aircraft, still totally out of trim, on a slightly rising trajectory, and set thrust to around 60% of N1. The speed decreased regularly and reached 140 kt. This situation carried a high potential risk : in the event of an increase in thrust for any reason, the aircraft would inevitably have started climbing with a high angle of attack.
  The co-pilot, reading the ECAM, announced “Pitch trim off”. In fact, the drifting caused by the rolls had disturbed angle of attack assessment and led to their automatic disconnection. The co-pilot re-engaged them and performed tests by deflection in both directions. The “whooler” was identified and the co-pilot declared the trim setting system to be operational. He reduced deflection to –8.4 degrees. This action to reduce the THS angle was beneficial. It nevertheless remains an example of simultaneous piloting, performed without the knowledge of the pilot flying.
  On an outward leg on heading 120, the aircraft at 195 kt and at 2,000 feet was now only slightly out of trim (THS –8.4 degrees nose up; pitch 8° nose down).
  The Captain at first refused to use THS trim. About eighty seconds later, inputs recorded on the FDR and selector noises on the CVR show that he used it but without announcing it, by short touches identical to his way of using trim before the event was triggered. Five minutes after total deflection of the THS, the aircraft was correctly trimmed and piloting had returned to normal.
  Landing took place in configuration with slats and flaps 20 , which in the final approach, led to the announcement “too low flaps” from the GPWS. LOC interception took place by visual alignment with the runway axis. The aircraft crossed the glide slope, remained above then, finally, went below it. These deviations were not announced. The “glide slope” aural warning was heard on final approach.
  On final approach, on reducing speed, the AFS triggered a mode reversion from VS to SPD. As the auto-throttle was disconnected and the flight crew was getting ready to land, this new mode reversion went unnoticed.
  To summarize, this second approach was neither prepared nor stabilized.
  Note : the CVR shows no attempt to determine the anomaly felt on the longitudinal attitude control system, THS and pitch. More generally, there would not seem to have been actions which could be called “return to basics” on the part of the flight crew. In the present case, this would have involved:
• setting the aircraft trim, if necessary using the mechanical control wheel,
• returning to standard flight situation, normal visual flight circuit, briefing and check .list,
• possibly reactivating certain elements of the AFS, after consulting the ECAM. As soon as the situation seemed to have stabilized, conversations resumed in the cockpit. Neither the auto-throttle, nor THS deflection, nor the variations in thrust were mentioned. Neither was mode reversion from VS to LVL CHG brought up. The conversation mainly concerned the AP. The flight crew did not carry out a briefing for the new approach.
  2.3 Operation of AFS Protection
  2.3.1 Protection of Speed Envelope
  The aircraft speed exceeded VFE before capture of ILS. Note that in these circumstances, protection against an overspeed is ensured according to the two following thresholds:
• when the speed becomes equal to VFE, by switching to LVL CHG mode.
• when the speed reaches VFE + 4 kt, by sounding a Continuous Repetitive Chime. The choice of LVL CHG as protection against excess speed led, in the circumstances of the incident, to an increase in thrust at a moment where the goal was to reduce speed, this being incompatible with the goal sought.
  We may note that, if the automatic pilot had been active, it would have caused a nose up attitude, which would also have surprised a flight crew in the middle of intercepting a localizer and whose first objective was to reach the runway.
  2.3.2 Analysis of the Stall Protection Logic
  Stall protection is organized around three angle of attack thresholds, that for Alpha-floor, that for Alpha-trim and that for triggering the stall warning (see 1.16.1.4).
  Alpha-floor protection could not play its role as, when angle of attack of 14.5° was reached, the throttle levers were already on maximum thrust.
  Alpha-trim protection was triggered at a value for angle of attack of slightly less than 15° in conditions where the flight dynamics were close to the extreme. It should be noted that it also functioned after coming out of the stall by giving the opposite order to the THS.
  The stall warning did not sound and the stick shaker did not operate in the flight phase prior to the stall. When questioned, the aircraft manufacturer indicated that the cause for non-operation of these two warnings was the disturbance of the angle of attack sensors due to the dynamics of the aircraft's movements, with the speed having dropped below 60 kt before the angle of attack reached 17.5°. The flight crew had, however, been warned of the approach of a stall by buffeting.
  3 - CONCLUSIONS
  
  3.1 Findings
• The flight crew was properly licensed to conduct the flight. A third pilot undergoing familiarization was in the observer's seat.
• The meteorological conditions were excellent.
• The aircraft was normally certified and maintained. No non-availability of equipment (with the exception of the FDR) was noted. Ground checks after the incident, and subsequent flights of the aircraft showed no evidence of any operating anomaly.
• The Captain, at the controls, started an automatic approach.
• Approach control asked the aircraft to shorten its path, which led to ILS interception closer to the runway than provided for by standard procedure.
• According to the systems logic, the glide, encountered before the localizer, was not automatically captured . The Captain then disconnected both automatic pilots, leaving the auto-throttle in operation.
• An altitude of 4,000 feet was selected before establishment of the aircraft on ILS as go around altitude. The go around altitude in the procedures is 2,000 feet.
• When flaps were selected at 20 degrees, the speed was slightly greater than VMAX, which activated speed protection, leading to reversion of VS mode to LVL CHG mode.
• Due to the altitude selected being greater than that of the aircraft, the auto-throttle commanded an increase in thrust. The pilot maintained the aircraft on descent.
• He accidentally caused the trim to its electrical stop at thirteen degrees nose up, which put the aircraft in a totally out of trim situation.
• To counter the effect of THS deflection, he moved the elevator control to its mechanical stop of fifteen degrees nose down, by effort applied on the control column.
• A sudden increase in thrust was commanded manually.
• Under the effect of the additional force, the aircraft pulled up rapidly. The pilot continued to counter by continuous effort on pitch and by temporarily holding the thrust levers in the idle position. He neither corrected trim, which remained on pull-up stop nor disconnected the auto-throttle.
• The aircraft took a path with a very steep slope, with roll angle reaching extremely high values. It climbed to an altitude of 4,100 feet and minimum speed recorded was 35 kt. Alpha-trim protection reduced the THS deflection by four degrees.
• Under the effect of strong drift on full and rapid rolls, the angle of attack sensors were disturbed, which led to automatic disconnection of the two pitch-trims. The auto-throttle was inhibited for the same reasons.
• Due to the dynamic of the aircraft's movements, the stall warning and the stick shaker did not function in a preventive manner.
• The flight crew regained control of the aircraft after the stall. 3.2 Probable Causes
  The direct causes of the unusual attitudes and the stall to which the aircraft was subjected were a movement of the THS towards the full pitch-up position and a rapid increase in thrust, both of which maneuvers were the due to the Captain, following an AFS mode reversion which was not understood. The pitch-up force caused a sudden change in attitude that the flight crew was unable to contain with the elevators.
  The following elements contributed to the incident:
• Too rapid an approach, due to a late start in the descent, followed by a reduction of the standard procedure.
• Inadequate crew resource management.
• Premature selection of the go around altitude and precipitous setting of the configuration with slats and flaps at 20-20, which led to activation of the speed protection.
• Difficulty in understanding the action of the auto-throttle increasing thrust in its overspeed protection function. 4 - RECOMMENDATIONS
  
  4.1 Measures Taken
  After the incident and on the basis of the first facts established as communicated by the BEA([3]), the French Civil Aviation Authority (Direction Générale de l'Aviation Civile) informed French operators of the Airbus A 310 and A 300-600 (these two types have identical protection). It asked them in particular first to draw the attention of flight crews to the need to respect limit speeds provided for different aircraft configurations and, secondly, to ensure they are fully informed as to the logic of the protection system in the event of abnormal speed.
  The DGAC also warned the civil aviation authorities of the countries using these aircraft, recommending them to take similar action with the operators under their authority.
  4.2 Intermediate Recommendation
  Following several accident investigations in which the Bureau Enquêtes-Accidents participated, the following recommendation was issued on 24 January 1995:
  Various incidents or accidents (see list below) involving public transport aircraft show the following common characteristics:
  1. Configuration: Automatic Pilot and/or auto-throttle lever (or auto thrust) in operation.
  2. Circumstances: pilot flying overrides (voluntarily or involuntarily) the Automatic Flight System, or acts contrary to the indications of the Flight Director.
  3. Aggravating circumstances:
     a) the pilot flying is not always aware of his action in opposition with the Automatic Flight Systems and never perceives the consequences thereof,
     b) the pilot not flying (even instructors) is not aware of the conflict between the pilot at the controls and the Automatic Flight Systems.
  4. Consequences:
     
     • the reaction of the Automatic Flight Systems leads to potentially dangerous configurations: out of trim, engine thrust incompatible with the trajectory chosen by the pilot, etc.
     • Flight crew, either is not aware of the situation, and thus cannot take corrective measures,
       or observes the aircraft configuration without understanding the causes. This incomprehension (also related to limited knowledge of systems) leads to a loss of time in analyzing the situation, or even to an erroneous analysis, generally associated with a lack of adequate communication between crew members
       This has led to highly dangerous attitudes: extreme attitudes or rolls, loss of speed (including stalls) or excess speed, etc.
  As a result, the Bureau Enquêtes-Accidents recommends:
• - that a study be launched so that the pilot's priority over all Automatic Flight Systems is maintained in all circumstances.
  This could be done :
  a) by the disconnection of Automatic Flight Systems (automatic pilot and auto .throttle lever or auto thrust) in the event of conflict between the pilot's actions and those of the Automatic Flight System or Flight Director.
  b) and/or by clear information in the cockpit (possibly an alarm) warning the flight crew of such a conflict.
  List of events:
  
  • Incident to an A 300 .B4 on approach to Helsinki (Finland) on 9 January 1989
  • Accident to the A320 .231 VT .EPN at Bangalore (India) on 14 February 1990
  • Incident to the A310 D .ADAC on approach to Moscow on 11 February 1991
  • Accident to the B747 .400 F .GITA at Tahiti .Faaa on 13 September 1993
  • Accident to the A310 .300 F .OGQS near Novokuzniesk (Siberia) on 22 mars 1994
  • Accident to the A300 .600 B1816 at Nagoya on 26 April 1994
  • Incident to an A310 .325 on approach to runway 26 at Orly on 24 September 1994
  4.3 New Recommendations
  4.3.1 Speed Protection System Activation Display
  The flight crew noticed neither the initiation of the flight envelope speed protection nor the mode change which resulted from it. Further, we may note that the denomination "LVL CHG" is inappropriate to indicate activation of speed protection. LVL CHG is the process used and not the goal.
  The BEA considers that recommendation 4.4.2 issued in the context of the investigation into the accident that occurred on 20 January 1992 near Mont Ste Odile corresponds to the problem identified here. It is repeated below, with the grounds given:
  In its analysis of this accident, the commission has been led to note deficiencies in the effectiveness of the display to the flight crew of the various active modes, the references used, actions in progress and targets pursued with regard to the Autopilot devices, notably in the vertical plane. Most particularly, in the opinion of the commission, the total information presented is inadequate in terms of its likelihood of alerting a crew, who at a given moment have an incorrect mental picture of the state of the automatic devices. In practice, a good number of observations made by the commission apply to one degree or another to all new-generation aircraft …
  Consequently, the commission recommends that for all new-generation aircraft:
  - consideration should be given by the competent authorities and organizations with a view to improving, in a standardized fashion on an international basis, the presentation and the symbols for displays and information relating to the different Autopilot active modes, notably in the vertical plane.