AF 447 report out

[qquantum]

AF-447 Accident

SLFinAZ – you sound like the NTSB.

As expected, the BEA Report is comprised of carefully crafted smoke — placing blame on the pilots of course — and distraction from the real issues of airplane design and regulator oversight failure that truly were the causes of the accident:

Pressure and Confusion
A review of the CVR transcript (Final Report, Appendix 1) plainly indicates the confusion in the cockpit that resulted from the total loss of airspeed indication, which occurred at a time when they were attempting to avoid the worst of the weather (icing, lightning, and severe turbulence).

In the darkness, in addition to the pressure of weather avoidance, the following compounded pilot confusion:
1. The loss of airspeed information caused a change in the FCS mode at 2h10min06; the fact was indeed mentioned [thanks InfrequentFlyer] at 2h10min22.1, but its import with respect to 2. (below) was lost in the confusion that followed.
2. The FCS Mode change resulted in loss of the envelope speed and angle of attack (AOA) limits — no stall protection — no overspeed protection — no bank angle/pitch angle protection — again the pilots seemed not to notice, as they did not discuss it;
3. The inexperienced FO, who was flying, made a radical pitch control input (full aft stick), which was not noticed by the more experienced FO, as he could not see the opposite control stick in the darkened cockpit (the A330 has independent control sticks, and so the normal means by which one pilot will instantly know what the other pilot is doing with his control stick – by the position of his own stick – was not available);
4. This drastic control input caused the trimmable horizontal stabilizer (THS) to automatically apply full nose‐up trim — a condition that while dangerous, in that it seriously compromised any attempt at recovery, was not detected by the pilots, as they made no mention of it;
5. Examination of the Flight Data Recorder (FDR) data, (Final Report, Appendix 3) indicates that, incredibly, the stall warning ceased (as designed) while the airplane was still in a deeply stalled condition, then reappeared when recovery action was attempted, adding even more confusion to the situation.
From the above it is readily apparent that the pilots were unable to fully recognize and understand the danger of the aircraft configuration and the continued existence and extent of the stall condition — in other words, the aircraft state was not presented to them in a way that would enable them to take proper recovery action.

Conditions of high altitude stall and reversion to Alternate Mode have been very rarely encountered in airline operations, leading to a degree of complacency with respect to knowledge and practice of operation in the Alternate Mode of the FCS, and an unjustified feeling of trust that the airplane “will take care of the situation”. The following flaws in the design of the A‐330 FCS fatally betrayed this trust:

Design Flaws
1. Failure of the FCS to remain in the Normal mode (with envelope protection) resulting from the loss of a single parameter (pitot‐static airspeed). While failure to design for this event may have been excusable during the initial design phase, the simultaneous loss of all pitot‐static systems had occurred in normal airline operations a number of times, and should have provided the impetus for a review of the design — or at least a warning to airline crews of the possibility of such an occurrence, along with appropriate remedial training for such an encounter. On AF‐447, the temporary loss of pitot‐static information caused the FCS to revert to Alternate mode – without envelope protection, at a time when the pilot most needed it – with no indication of airspeed.
If the design had incorporated synthesized speed – from GPS, IRS – which would be accurate enough – the pilot would not have been placed into such dire straits, and with appropriate cautions, would have been able to contend with the problem (in the Normal FCS mode); needless to say, the presentation of angle of attack (AOA) information (now planned for inclusion on Airbus airplanes) would have eased the burden on the pilot.

2. The design of the primary flight control controller such that it is possible for a pilot to make a sustained incorrect or dangerous input, without the awareness of the other crewmember(s).
On AF‐447, the junior co‐pilot’s instinctive reaction to the confusing situation, of pulling the control stick to the maximum nose‐up position, was not detected (in the darkness of the cockpit) by the other two crewmembers until he verbally brought it to their attention at an altitude which was too low to enable a recovery, due to low energy and excessive descent rate.

It can be readily appreciated that an FCS control design in which both controllers move in unison at all times (as in Boeing, MacDonnell Douglas, and most other airplanes) would have enabled instant detection (tactile) by the senior pilot (along with the probability of a sharp rebuke) and subsequent recovery of the airplane. Note that when the original airliner sidestick controller was first designed, some twenty or more years ago, it was not technically feasible to design a parallel (active) sidestick controller, as a mechanical solution would pose major problems of friction and hysteresis; now, however, the required technology has been available for several years, and because tactile communication between pilots is of such vital importance, parallel control should become mandatory on all future sidestick designs.

3. The ability of the FCS to allow the Trimmable Horizontal Stabilizer (THS) to move to a configuration that renders the airplane essentially unrecoverable, without appropriate warning to the pilot.
On AF‐447, the THS moved to the full nose‐up trim position in response to the (incorrect) sustained nose‐up command by the junior FO on the control stick. No warning to the crew of this grossly abnormal stabilizer position was provided. Further, when AOA becomes greater than 30°, or Speed is less than 60kt, auto THS trim is turned off. The result was that the THS was set at full nose‐up trim at 32,000 feet (Final Report, Appendix 3, Page 6), and remained there until impact with the ocean. It can be reasoned therefore, that unless the pilot had detected and manually corrected the trim setting, the airplane could not have been recovered to normal flight with a power setting of other than minimal thrust.
In addition to AF447, a number of previous Airbus accidents have also been characterized by a movement of the THS to the full nose‐up position prior to a crash – Nagoya, Tao Yuan, Perpignan, etc. without the pilot being aware of the change in configuration. Manual trimming is only ever encountered by line pilots in the simulator, and then in a lesson in which a stabilizer mis‐trim is expected to occur. When asked how often they have used manual trim in normal operations, Airbus pilots reply “Never”.
There is a subset of THS settings associated with cruise flight; that the THS was allowed to move outside of this range without a strong warning to the pilot is a major flaw in the FCS design.

4. The FCS design which allows the primary stall‐warning sensor to be declared invalid (when it is still capable of providing a correct indication) based upon another parameter (speed), of questionable validity.
On AF‐447 the stall warning was turned off as a result of an airspeed error (invalid), even though the airplane was deeply stalled – giving the pilot the impression that the airplane was not in a stall. When the senior co‐pilot took control (although the junior FO did not relinquish it) and pushed forward on the stick in an attempt to recover, the stall warning again sounded – leading him to believe that his control input was not correct, thus causing him to release pressure on the stick to get rid of the stall warning. This design is absolutely inexcusable; there was no reason to believe that the AOA vanes became simultaneously unreliable, since matching IRS AOA was present on the FDR data.

In all, a "politically correct" report that omits analysis of significant factual information, and does not criticize either Airbus or the DGAC.

Member – ISASI