PPRuNe Forums - View Single Post - AF 447 Thread No. 9
View Single Post
Old 7th Aug 2012, 00:41
  #1080 (permalink)  
RR_NDB
 
Join Date: Feb 2011
Location: Nearby SBBR and SDAM
Posts: 875
Likes: 0
Received 0 Likes on 0 Posts
Fault tolerance and graceful degradation

BEA Final report 2.1.2.4 Identification of the situation
Three seconds after the autopilot disconnection, the ECAM displays no information that is likely to point to a speed indication problem:
The ECAM mentions a maximum speed that should not be exceeded but does not mention a minimum speed. This could lead crews to suppose that the main risk is overspeed. In the absence of any reliable speed indication, this might lead to a protective nose-up input that is more or less instinctive.

Thus, having identified the loss of airspeed information, the PNF turned his attention to the ECAM, undoubtedly in an attempt to refine his diagnosis and to monitor any actions displayed. He started to read the messages, and consequently called out the loss of autothrust and the reconfiguration to alternate law. The successive display of different messages probably added to the confusion experienced by the crew in its analysis and management.
In the absence of a specific message expressing detection of unreliable speed by the systems, the crew was unable to identify any logical link between the symptoms perceived and these ECAM messages. The impression of an accumulation of failures created as a result probably did not incite the crew to link the anomaly with a particular procedure, in this case the “Vol avec IAS douteuse” procedure.


K.I.S.S. has it counterpart: Keep It Complex Stupid

Question: How they could diagnose the UAS? (The so called, non event)



We still today have two problems:

1) Important (redundant) elements prone to fail simultaneously
2) Diagnosability of UAS
RR_NDB is offline