AF447 [Archive] - Page 11

safetypee

29th Jun 2009, 19:43

Re avoiding storms (lomapaseo #2535), “unfortunately this is often subjectively interpreted”. I agree, perhaps this is one of the significant differences in this accident – not flight in a Cb, but the margin by which the Cbs were avoided.

Re “Above the storm has been interpreted as good-enough yet is that not a greater risk to pitot, engines etc.?” The report linked in #2526 suggest that the icing conditions can occur above the storm. This together with weather radar weakness in detecting the vertical extent of the core and emerging cells beyond it would exclude Cb over-flight as an option.

EGMA re #2536, the central point in the ‘engine’ report (linked in #2526) is that perceptions or mechanism of conventional icing is not the same as ice particle icing; the latter can have a very sudden onset, see the plots of TAT rise.
The contribution (or otherwise) of drain holes is shown in the presentation Instrument External Probes. (www.sae.org/events/icing/presentations/2007s30duvivier.pdf)
I do not know what the specific changes are between the different pitot designs; shape may be a critical factor or just a simple increase in anti icing heat flow, which was a fix for one of the engine types.

There is no evidence of any upset. It has been shown that the aircraft can be flown without airspeed information, and in other respects – lack of protections, structures, manoeuvre capability, etc, it is comparable with conventional aircraft.

Question: Aside from the debate on integrated automation and degraded operation, would the EFIS still indicate or be able to indicate the reversionary modes (alerts and cautions) with the supposed complete ADIRS shutdown?
If not, then the debate is not so much about gradual degradation of systems and basic control capability, it would be of the crew’s awareness of the change of state and triggering the need for knowledge of the required precautions.

Svarin

29th Jun 2009, 19:51

Reading the ALTN LAW / DIR LAW schematic, I still have a bucketful of questions, all germane to our thread subject. Some of them are :

are all switching to ALTN LAW combined with an AP disconnect ?

is there any condition where the aircraft would switch to ALTN LAW and continue AP operation ?

Thanks

captainflame

29th Jun 2009, 20:54

PJ2:

A 737 stalled ? Oh no !
Surely not due to computers running things ?

You mean the airbus golden rules apply to a boeing aircraft ? Naaaa!

facecious me ! :}

Re: Autopilot lost stuff

To me the 330 autopilot disconnects with a double ADR Fault, but not with an ADR disagree (alone), that is unless you have other things going wrong which trigger AP Lost.

(the boxed items on top of the schematic point to AP lost ..on the left and the unboxed part points to ALT law...bottom)

But also, ADR disagree means one's been tossed and the two remaining disagree right ? so AP lost....
Shoot me if this is wrong.:ouch:

ELAC

29th Jun 2009, 21:03

Quote Svarin:

Reading the ALTN LAW / DIR LAW schematic, I still have a bucketful of questions, all germane to our thread subject. Some of them are :

are all switching to ALTN LAW combined with an AP disconnect ?

is there any condition where the aircraft would switch to ALTN LAW and continue AP operation ?

Svarin,

No, reversion to Alternate Law is not always combined with an autopilot disconnect. Many situations will trigger both, but some do not. A significant example would be the Emergency Electrical Configuration where, with the aircraft in Alternate Law, AP2 remains available until the Land Recovery pushbutton is selected. This is done during approach to recover some of the aircraft functions that are necessary for landing that are not required during cruise flight. In order to maintain within the minimal capacity available from the emergency generator or batteries other functions that are non-essential to the approach and landing are depowered and amongst those is AP2.

ELAC

PJ2

29th Jun 2009, 21:05

Re 737's stalling, yeah, go figure. Something about mind thy airspeed lest the earth rise up and smite thee?...

The way you have interpreted the chart is the way I do as well.

PJ2

orbitsled

29th Jun 2009, 21:43

What is the latest on the presumably sunk AF 330 data recorder/"black box" search? (If this theme has already been more than exhausted [as the things locater batteries must be by now]then please forgive my suddenly barging in here asking that question again plus my laziness in not bothering to wade through all the posts to find out). Anyway, a day or so after the aircraft was missing and presumed crashed into the Atlantic, I was watching a televised press conference on the news where a high ranking AF official was up to bat. At one point he said there was a strong possibility that the flight data recorder may never be found or retrieved. I found that an odd thing to say so early on - particularly since data recorders for years have been specifically designed and improved by clever boffins to be found - and in virtually any environment imaginable (including, I assume, an ocean floor).

BOAC

29th Jun 2009, 21:59

Situation confused by conflicting statements. I guess someone knows.

Graybeard

29th Jun 2009, 22:50

The safety analysis done in the design phase obviously accounted for a single pitot failure, for all conceivable reasons. Could the safety analysis not have considered the possibility of all three freezing over nearly at once, at night, in cruise?

Couldn't Otto have been made smart enough to recognize a drop in all three measured airspeeds with little or no change of angle of attack? He should be able to fly pitch and power as good as a pilot could.

GB

Will Fraser

29th Jun 2009, 22:57

Or couldn't he have ignored the drop of two and relied on the one not changing rate?? Instead there is 'Disagree' when one might have been 'reliable'?? That one could remain servicable but be dropped as a disagreeble partner means there aren't actually three independent samplers?? IOW, could a 'pair' be 1,1a, where a is two seconds ago, meaning consistency? After all, stability can be sampled as well as rate of change, or fault.

ClippedCub

29th Jun 2009, 23:10

Great point Graybeard. I'm still trying to figure out why a system with five computers, quadruply redundant, only had 3 pitots and statics, double redundancy. Plenty of lesser planes have four pitots.

24victor

29th Jun 2009, 23:22

When three pitot heads are rendered inop due to external influences, in this case supposed icing of some description, the design represent a single point of failure. Three heads are the minimum required to allow triplex redundancy and voting logic but if they are all overwhelmed by the same event the number no longer matters. Five, ten, a hundred - they will all succumb in the same way at the same time.

Now that the potential for multiple pitot heads to be offlined by a single meterological phenomena has been clearly established by the recent spate of incidents, the current system, shown to have no redundancy to this catastrophic failure mode, becomes a single point of failure in the safety analysis and as such will have to be addressed.

An alternate system will need to be developed which delivers accurate airspeed without using M. Pitot's somewhat ancient approach.

Rgds.
24V

HarryMann

29th Jun 2009, 23:51

Couldn't Otto have been made smart enough to recognize a drop in all three measured airspeeds with little or no change of angle of attack? He should be able to fly pitch and power as good as a pilot could.Posted as much about 1000 posts ago... quite simple implementation, though just as dangerous if pitch cannot be trusted 100%

24Victor

Assuming that was the onset of the sequence, yes.

Several matrices of multiple probes, burst heated & force drained when off-line and checked for consistency before being voted back in.. that sort of thing?
Then we have hot-wire and hot-film anemometers, which I am sure have been considered (as used in wind tunnels and now in many AirFlowMeters for car engine injection systems)
Then we have the engines, and their pressure ratios to cross-check against

But it's all getting a bit complicated again. Nothing is better than simple & foolproof

jeremiahrex

30th Jun 2009, 00:01

When three pitot heads are rendered inop due to external influences, in this case supposed icing of some description, the design represent a single point of failure.

So let's put four pitot heads on there. From there I can amend what you wrote:

When four pitot heads are rendered inop due to external influences, in this case supposed icing of some description, the design represent a single point of failure.

We can play this game all day long. Four pitot tubes isn't enough, let's put five, five pitot tubes ... ... ... Fifty pitot tubes isn't enough... blah blah blah. You can keep adding more and more of anything to prevent any failure but it's not practical.

Great point Graybeard. I'm still trying to figure out why a system with five computers, quadruply redundant, only had 3 pitots and statics, double redundancy. Plenty of lesser planes have four pitots.

Five computers are there for redudancy of the computers, not the airspeed system. You need to keep in mind that the supreme fear of everyone with FBW systems (prior to the supreme fear of pitot tubes and computers acting strangly) is computers FAILING in flight. Analogous to cables snapping in flight in a mechanical system.

Or couldn't he have ignored the drop of two and relied on the one not changing rate?? Instead there is 'Disagree' when one might have been 'reliable'?? That one could remain servicable but be dropped as a disagreeble partner means there aren't actually three independent samplers?? IOW, could a 'pair' be 1,1a, where a is two seconds ago, meaning consistency? After all, stability can be sampled as well as rate of change, or fault.

I find this statement amusing coming from you. You're asking a computer to determine which airspeed sensor is reliable? This is a situation where (as a designer of control systems) I would be running away as fast as I could. Unless I have a good model of what is happening I wouldn't want to be designing logic to figure out which one is right. The idea of the triple redudant system is that you can use a very simple model to determine which is right. The system will fail in an obvious way and independently of others in the voting pool. If you have to resort to examining each sensor for cues of failure you are probably going to have far too many false positives. I'd punt this to pilots who, even poorly trained, are probably more reliable than my system.

Couldn't Otto have been made smart enough to recognize a drop in all three measured airspeeds with little or no change of angle of attack? He should be able to fly pitch and power as good as a pilot could.

I'd think this would be a good idea too. Since it's not done, I'd assume there is a reason. I have noticed a tendency to keep sensors separate rather than try to crosscheck values with other sensors in a tangential way. I also don't know why autopilots don't fly pitch. This is a very common system for UAVs, this is used in every autopilot where I work. These are both very good questions.

24victor

30th Jun 2009, 00:08

@jeremiahrex

I'd appreciate two things; first you read what I post before replying, and second that you then consider your reply.

As stated, the number of heads doesn't matter if they are all overwhelmed by one single external occurance. This is defined as a single point of failure in a critical system, itself a big no-no. There needs to be an alternate "back up" system which can deliver accurate airspeed without depending on the existing pitot heads.

Rgds.
24V

MacBoero

30th Jun 2009, 00:08

My engineering head says that most of the time the current pitot probes work well enough, and it is an extremely rare occurrence that all three are lost with such tragic consequences.

There is in my mind, one obvious emergency alternative, that is already fitted to these planes, the ram air turbine.

I would imagine that a simple emergency system that was able to deduce the air speed from the RAT output could provide a viable emergency backup airspeed indication, albeit probably less accurate and no so efficient. Mind you if you have nothing else, an inefficient and not quite so accurate method of measuring your airspeed would no doubt still be very welcome.

ClippedCub

30th Jun 2009, 00:19

Five computers are there for redudancy of the computers, not the airspeed system.On a system level, redundancy is determined by the lowest redundant component. Granted, pitots are dumb with no moving parts, other than heat, however this weak link will be investigated, if it's determined to be a single point failure. Sure, we can say backup is pitch/power, but why let it get even that far.

Carrier pilots are taught to fly AOA for approach.

jeremiahrex

30th Jun 2009, 00:19

@24victor

I certainly did read what you posted. Your definition of a single point failure, as applied to pitot tubes in this case, really doesn't make any sense. That is what I was trying to get at in my post. Saying that something which is triple redundant can have a single point failure because all three failed at once makes no sense. If ALL systems of a redundant system fail, that isn't a single point failure, it's really bad luck.

I see what you're getting at by saying that icing causes the single point failure behavior. However, each system is designed to mitigate these risks individually.

It's a design issue, not coping with some worse than expected environment, that makes a single point failure.

rubik101

30th Jun 2009, 00:24

Following MacBearo's idea about using the RAT for speed reference; a piece of bendy plastic affixed to the windscreen with a few engraved lines on it might do just as well, but would not be very scientific.
If the situation is as surmised, pitot icing follwed by an upset, then the ability to restore one's attitude becomes paramount. If all the sensors/instruments are giving erroneous/conflicting/confusing results then it is going to be next to impossible to establish which way is up.
Coupled with the piece of bendy plastic could be a small weight hanging on a strong thread attached to the the fwd glareshield! Remember, gravity sucks.
Cost; about 40 pence.

ClippedCub

30th Jun 2009, 00:25

triple redundant

Three pitots is double redundant, at best.

1. lose one, down to two - 1st level of redundancy, and singly redundant if you exclude human interaction.
2. IF one of the remainder disagree, the pilot chooses which one he likes - 2nd redundancy level, but only due to human interaction.
3. Lose the last one, no backup. System is doubly redundant.

lomapaseo

30th Jun 2009, 00:29

Now that the potential for multiple pitot heads to be offlined by a single meterological phenomena has been clearly established by the recent spate of incidents, the current system, shown to have no redundancy to this catastrophic failure mode, becomes a single point of failure in the safety analysis and as such will have to be addressed.

I don't agree with the presumption that such a single point failure need be presumed catsstophic.

The idea is that you must have enough barriers (layers of cheese) in place to make it extremely improbable to end up catastrophic. So what we are looking for here in the investigation are evidences of other layers of assumptions that might have been at play here.

24victor

30th Jun 2009, 00:31

As Mac'B said, pitot systems work well for the most part, are simple and reliable and understood by pilots, maintainers and designers alike. However, the recent spate of pitot system problems have highlighted a weakness in the design of the "system" in that it relies on multiple-instance of the same technology to achieve the necessary redundancy, and the validity of this reliance has been seriously brought into question.

If pitot icing of some description did overwhelm the system on AF447 it will most likely be declared to be a non-survivable event, one in which all redundant systems have failed. The fallacy in this though is that other similar events have proven survivable as long as there's daylight and a workable natural horizon for reference.

As to the technology change, it's not obvious to me what would be the way to go. One thing I do know, however, is that there's the opportunity for improved combinatorial logic using existing sensor fit that I would guess is being hammered out right now as we speak.

Rgds.
24V

Bleve

30th Jun 2009, 00:31

24victor
An alternate system will need to be developed which delivers accurate airspeed without using M. Pitot's somewhat ancient approach.Yes can be done. From basic aerodynamic theory it follows that velocity squared is inversely proportional to angle of attack. So when flying in a steady state (eg S+L) there is a one to one relationship between speed and angle of attack. So you could have software convert angle of attack into a calculated airspeed (might not be super accurate, but better than nothing) or better still, have the angle of attack displayed directly to the pilots.

If you lost all pitots, you would transition to using thrust to fly an optimum angle of attack (and hence indirectly an airspeed). Flying angles of attack instead of airspeed is routine stuff for modern fighters. For example on the F/A-18 when on final approach, the pilot does not fly a speed, but flies a constant angle of attack as displayed in the HUD.

The use of angle of attack in the event of a total loss of airspeed indications is discussed in this Boeing article:

Aero 12 - Angle of Attack (http://www.boeing.com/commercial/aeromagazine/aero_12/attack_story.html)

The relevent text is:

AOA backup indication following pitot or static system failures. The AOA instrument described in this article is useful as a backup for unreliable airspeed indication caused by pitot or static source blockage because the calculation of indicated AOA is not greatly affected by pitot or static pressure inputs for its calibration, and the displayed value has not been normalized.

Pitot or static system failure requires the flight crew to take several fundamental steps to resolve the problem (see "Erroneous Flight Instrument Information," Aero no. 8, Oct. 1999):

* Recognize an unusual or suspect indication.
* Keep control of the airplane with basic pitch and power skills.
* Take inventory of reliable information.
* Find or maintain favorable flying conditions.
* Get assistance from others.
* Use checklists.

Recognition of a problem will be accomplished by instrument scanning and cross-check practices or crew alerts, depending on the design of the system in the airplane. In this respect, AOA instruments can be useful as an additional cross-check.

Present procedures for unreliable airspeed call for flying the airplane by reference to pitch attitudes, and refer the pilots to reference tables showing pitch attitudes for various configurations, weights, and altitudes that will result in safe angles of attack and speeds. AOA could be useful if the relevant data is included in the pitch and power tables that already exist in the nonnormal checklist procedures. AOA would be most useful in flying the airplane in multiple failure conditions where all pitot or static sources are affected, making all airspeed indicators unreliable.

Care should be taken when flying the airplane by reference to AOA in lieu of airspeed. Control should be made by reference to pitch attitude, using AOA as a cross-check to ensure that the pitch attitude results in the desired speed or AOA. Attempting to follow AOA or speed indications too closely without stabilizing the airplane in pitch can lead to an oscillatory flight path.

ELAC

30th Jun 2009, 00:31

Quote Graybeard:

The safety analysis done in the design phase obviously accounted for a single pitot failure, for all conceivable reasons. Could the safety analysis not have considered the possibility of all three freezing over nearly at once, at night, in cruise?

Couldn't Otto have been made smart enough to recognize a drop in all three measured airspeeds with little or no change of angle of attack? He should be able to fly pitch and power as good as a pilot could.

Quote Will Fraser:

Or couldn't he have ignored the drop of two and relied on the one not changing rate?? Instead there is 'Disagree' when one might have been 'reliable'?? That one could remain servicable but be dropped as a disagreeble partner means there aren't actually three independent samplers?? IOW, could a 'pair' be 1,1a, where a is two seconds ago, meaning consistency? After all, stability can be sampled as well as rate of change, or fault.

Quote ClippedCub:

Great point Graybeard. I'm still trying to figure out why a system with five computers, quadruply redundant, only had 3 pitots and statics, double redundancy. Plenty of lesser planes have four pitots.

This discusion is becoming schizphrenic. First it's "the computers take too much control away and make too many decisions" and now it's "they should be able to retain control and make decisions even when the basic data they use to operate has become seriously corrupted or unreliable". Which do you want?

The pilot and the "computer" each have differing strengths. The design goal has to be to make optimum use of both. In the instance of a particular stream of data from 3 different sources becoming simultaneously different or uncertain you have a situation that most often, using a pilot's awareness of the total dynamic situation, will be solvable fairly quickly and without serious adverse input (though there have been exceptions, Birgenair & AeroPeru, etc.). But, for a computer which has limited capacity to "understand" the broader situation beyond the data streams, trying to code an algorithm that would correctly identify which data source, if any, was correct 100% of the time would be, if not impossible, then probably impossible to do within the time frame of a safe response. There would be a much higher possibility of an adverse control input and the pilot's judgement would not have been accessed at exactly the point where it becomes most valuable.

Using more sources won't resolve the problem, as in addition to the problem of 3 suffering the same failure you now also face the problem of ties where 2 say this and 2 say that, or 3 are simultaneously experiencing the same error but the 1 or 2 in minority are actually providing the accurate data. How would you cope with that scenario ... with even more complexities of logic.

The simplest, and in my opinion best answer to the problem is to let the pilot do the job of distinguishing good from bad in such rare instances. When they've isolated the bad data the good data can then be used by the remaining available systems.

ELAC

BobT

30th Jun 2009, 00:31

@jeremiahrex: I think the phrase you're looking for is "common-mode failure"?

24victor

30th Jun 2009, 00:37

Correct. A triplex system is three-selectable but dual-redundant - my apologies. As to the single-point-of-failure issue, the near-simultaneous failure of a three channel system due to a single cause is indeed a single point of failure to the system, no matter what the textbooks may say.

Rgds.
24V

Will Fraser

30th Jun 2009, 00:43

ELAC

If a computer uses sampled data from three sources, but must have agreement from two for a parameter, isn't it singly redundant? If one drops out, the only pair left have to agree. I was offering an emergency mode, and I still think it makes sense, were there indeed three blocked pitots? If it's important to have three, but eliminate a possible parameter supplied by one, wouldn't that be self defeating? In the absence of another pitot, and tossing a baby out with the bathwater is fatal, what am I missing??

I may seem to be opposed to computers, I am not, being highly critical doesn't mean I propose their demise.

lomapaseo

30th Jun 2009, 00:51

Now that the potential for multiple pitot heads to be offlined by a single meterological phenomena has been clearly established by the recent spate of incidents, the current system, shown to have no redundancy to this catastrophic failure mode, becomes a single point of failure in the safety analysis and as such will have to be addressed.

I don't agree that such a failure condition (common mode or single point) need be considered catastrophic

The idea is that you must have enough presumed barriers present to make it extremely improbable to result in a catastrophe.

So even if the pitot icing is presumed to be present the investigation need examine all the other presumed barriers that might have been overcome.

24victor

30th Jun 2009, 01:10

I don't agree that such a failure condition (common mode or single point) need be considered catastrophic

I agree it can be recovered, and it is a survivable failure if the environment is benign, as has been shown. Nighttime, no moon, CBs up the wazoo is a different matter.

What's strange though is the recent rash of documented problems. Why now all of a sudden and why the A330?

I'm puzzled.....

24V

Mad (Flt) Scientist

30th Jun 2009, 02:06

To support ELAC's point.

In certification terms, we are simply not allowed to retain any systems "in the loop" - whether they be software or hardware - when they are reduced to "taking their best guess" which is what a computer system (just as a pilot) would be reduced to doing when faced by multiple contradictory data sources.

It might seem unfair, but the regulations allow us (the designers) to assume god-like omnipotence from the flight crew when required. We have to assume that systems can fail - but that pilots will unerringly follow the appropriate procedures and, when required to pull a rabbit from a hat, will invoke "airmanship" and all will be well.

A trifle faceatious, but given a situation where a pilot might make the right choice 99% of the time, and a software system 99.9% of the time, if the consequences of error are catastrophic I am more-or-less forced to dump the problem in the pilot's lap. because while it's acceptable for the pilot error rate to be 1%, a software catastrophic failure rate of 0.1% would never, ever, be certifiable.

Add to this that its essentially impossible for the software to cater for all combionation, and it becomes essential for the s/w to at some point "give up" and hope that the pilot can get himself out of trouble.

It's as if the software systems were a reliable and skilled trainee, but somewhat wet behind the ears in terms of thinking outside the box. It at least is pretty good at realising when it's outside its "skill level" and at handing back control.

lomapaseo

30th Jun 2009, 02:19

:ok:Mad (Flt) Scientist

A trifle faceatious, but given a situation where a pilot might make the right choice 99% of the time, and a software system 99.9% of the time, if the consequences of error are catastrophic I am more-or-less forced to dump the problem in the pilot's lap. because while it's acceptable for the pilot error rate to be 1%, a software catastrophic failure rate of 0.1% would never, ever, be certifiable.

Add to this that its essentially impossible for the software to cater for all combionation, and it becomes essential for the s/w to at some point "give up" and hope that the pilot can get himself out of trouble.

Well said :ok:

Now we really do need the pilot error rate verified in this combination and even more important we need to understand if there is a conditional failure lurking that was not considered.

Such a conditional failure might be an unanticipated additional system failure given that one encounters presumed turbulence at night and presumed ice crystals and a presumed failure of the speed measuring system and its cascading computer effects with a 99% crew.

So where is the key that is being missed or do we have something completely different than the above presumptions:confused:

data I want more data, what other combinations were at play in the other events?

jeremiahrex

30th Jun 2009, 04:49

Ironically, the tools of the trade really haven't changed much since the days of the A330. Airbus published a series of papers on their fly by wire system. I do not work in the airline industry directly, I do UAV work designing control systems. It's interesting when I talk to friends who do work for Rockwell Collins and such. They use the same tools I do when I design control systems. A330 used automatic code generation which I have also been using. Things have improved in usability and such as anyone would expect. Most of this isn't an issue of raw horsepower, but of design tools. A redesigned A330 would probably use a different digital bus, serial buses would be ethernet or optical, but the control laws would be very similar.

My point is that I think the design would be similar today because there is a reason they made the choices they did. I'd really love to talk to some of the Airbus designers.

Nightrider

30th Jun 2009, 06:52

If all the systems, especially the pitot / static, gave up their dedicated jobs the aircraft falls back into direct pilot mode... Given the fact that at about 04:10 French summertime the alert level of any European is not at the peak level, it will be too easy to blame any human being at the controls for taking wrong actions based on wrong assumptions / identification.
We need to stop speculating about this as there is absolutely no evidence to this.
We do not even know for sure which presentation of individual problems was available to the crew, all guessing so far.

What caught my attention, as I am not an AB pilot, was the position of the pitot probes and TAT probes. as seen on photo posted by PJ2 in #2529.
They are all located very much on the lower side of the fuselage as well as very far forward. With an approximately 3 degr nose-up attitude in cruise (as I recall to have read here somewhere), a slow down in speed (as may be assumed due to turbulence induced climb) will expose these probes even more prominent to any weather condition the aircraft is facing.
It looks on the photo as if the captain's pitot probe and TAT probe as well as the stby pitot probe are less than a meter apart; excluding FOD as there is no evidence which allows hail to be assumed, there still remains the icing possibility, a fact which is obviously ascertained due to the various bulletins and modifications in force / progress.
Again, I am no AB pilot, but where are the pitot / TAT probes on the 340, are they at the same location?
May a different location of said items provide better protection, i.e. middle of fuselage behind window 3 and L1 door?

Desert Dawg

30th Jun 2009, 07:44

Having kept a close eye on a.net forums, I have noticed that two pilots who regularly post sane comment about this issue have done a lot of work to try and figure out what may have happened.

One poster (Mandala499) who is probably the most sane guy there, has done a good job of trying to figure out the timeline of the ACARS messages and re-order them according to their respective time stamps.

I have shamelessly (sorry Mandala) copied his good work here in order that someone on PPRuNe may make more sense (or gain a better insight) as to what went on at the time these messages were sent?

This is the list reordered...

0209 START
0210 34-11-15-0 FLR EFCS2
EFCS1, AFS - PROBE PITOT 1+2/2+3/1+3 (9DA)
9DA=HEATING ELEMENT PITOT 1 (6DA1/PHC1)
Heating Element Pitot 1 suspected failed.

0210 27-93-34-0 FLR EFCS1
EFCS2-FCPC2(2CE2) WRG:ADIRU1 BUS ADR1-2 TO FCPC2
No Data from ADIRU 1, ADR 1 & 2 no sending signal to FCPC2
No ADR Data from ADIRU 1 to PRIM2.

0210 27-90-45-5 WRN MXSTAT
EFCS1
ERROR NOTICED - Air Data Fluctuation/Inconsistency

0210 27-90-45-0 WRN MXSTAT
EFCS2
ERROR NOTICED - Air Data Fluctuation/Inconsistency

0210 22-10-00-0 WRN AUTO FLT
AP OFF
Autopilot Shut off for safety, result loss of 2 Valid Air Data Channels.
This prevents faulty Air Data from affecting autopilot into making the wrong actions.
Commence AP/FD FAULT ISOLATION PROCEDURE
System Filter & Check:
- DISAGREE AOA Sensor Data in FCPCs
- DISAGREE PITOT PROBE Data in FCPCs
- FAIL ADIRU 1 and 2
- FAIL ADIRU 1 and 3
- FAIL ADIRU 2 and 3
- FAIL ADIRUs

0210 22-62-01-0 WRN AUTO FLT
REAC W/S DET FAULT
Loss of 2 ADRs, autopilot cannot provide Windshear Protection.

0210 27-91-00-5 WRN F/CTL
ALTN LAW
2 ADR REJECTED, NAV DISAGREE NOT YET CONCLUDED - FAULT ISOLATION IN PROGRESS

0210 22-83-00-2 WRN FLAG
LEFT PFD LIMIT
Rejected ADR still feeding data to PFD
If there is valid ADR, it's not being selected for LEFT seat.

0210 22-83-01-2 WRN FLAG
RIGHT PFD SPD LIMIT
Rejected ADR still feeding data to PFD
If there is valid ADR, it's not being selected for RIGHT seat.

0210 22-30-02-5 WRN AUTO FLT
A/THR OFF
Autothrust Shut off for safety, result loss of 2 Valid Air Data Channels.
This prevents faulty Air Data from affecting Autothrust into making the wrong actions.

0210 34-43-00-5 WRN NAV
TCAS FAULT
Loss of ADR1 to Transponder 1 (if selected) or Loss of ADR2 to Transponder2 (if selected)
Loss of Mode C.
This is downstream of loss of ADR.

0210 22-83-00-1 WRN FLAG
LEFT PFD NO F/D
Automatic Flight System (AFS/FMGC) loss of 2 ADR sources.
Safety mechanism, prevents erroneous F/D for pilot to follow

0210 22-83-01-1 WRN FLAG
RIGHT PFD NO F/D
Automatic Flight System (AFS/FMGC) loss of 2 ADR sources.
Safety mechanism, prevents erroneous F/D for pilot to follow

0210 27-23-02-0 WRN F/CTL
RUD TRV LIM FAULT
Loss valid of ADR Data (require 2 ADRs) for FMGC/AFS
FMGC Flight Envelope Module locks in Rudder Travel for safety.

0211 34-12-34-0 FLR IR2
EFCS1X,IR1,IR3, ADIRU2 (1FP2)
ADIRU2(1FP2) - ADR2 self monitoring & PHC rejects own data
Loss of discrete data from ADR2 = PITOT 2, STATIC 2L, STATIC 2R, TAT 2, AOA 2.
NAV DISAGREE CONCLUSION DELAYED - ADDITIONAL FAILURES - RECOMMENCE FAULT ISOL

0211 34-12-00-0 FLR ISIS
ISIS (22FN-10FC) SPEED OR MACH FUNCTION
SUSPECT LOSS OF ADIRU1 AND/OR ADIRU3 FOR ISIS MACH
Suspect Loss of ADIRU3
NAV DISAGREE CONCLUSION DELAYED - ADDITIONAL FAILURES - RECOMMENCE FAULT ISOL

0211 34-12-00-1 WRN FLAG
LEFT PFD NO FPV

0211 34-12-01-1 WRN FLAG
RIGHT PFD NO FPV

0212 34-10-40-0 WRN NAV
ADR DISAGREE
NAV DISAGREE DISCOVERED - FAULT ISOLATION COMPLETED
Due to no further ADR faults occuring.

0213 27-90-02-5 WRN F/CTL
PRIM1 FAULT

0213 27-90-04-0 WRN F/CTL
SEC1 FAULT

0213 22-83-34-9 FLR AFS
FMGEC1(1CA1)

0214 34-10-36-0 WRN MXSTAT
ADR2
RESULT OF 32-12-34-0

0214 21-31-00-2 WRN ADVSRY
CABIN VERTICAL SPEED
LOSS OF ADR DATA

Open to comments?

division1

30th Jun 2009, 08:07

http://i277.photobucket.com/albums/kk76/batcave777/A330_Probes_Location_F-GZCP_2009-06.jpg
http://images.ibsrv.net/ibsrv/res/src:www.pprune.org/get/images/statusicon/user_offline.gif http://images.ibsrv.net/ibsrv/res/src:www.pprune.org/get/images/buttons/report.gif (http://www.pprune.org/report.php?p=5028942)

Your nice pic needs editing, the LOC antenna is an old towel rail under the radome, lol.
What you are pointing at there, is the icing detectors.
Makes one wonder if the ECAM warnings were indicating 'severe icing'?

Airbus Girl

30th Jun 2009, 08:32

Only 2 things to throw in to the mix.

The complete physical loss of an AOA probe can cause incorrect warnings - it has been known for the loss of this to cause a stall warning to occur, amongst other things.

Someone mentioned the OPC/LPC items and how its not always the best to train - suggest reading/ encouraging your airline to adopt ATQP, which is used by BA, Thomas Cook, EasyJet, Virgin and shortly to be used by Thomson. This is a more specific version of the LPC/OPC, I understand it is tailored towards the airline and the individual pilot.

MacBoero

30th Jun 2009, 08:44

Three pitots is double redundant, at best.

1. lose one, down to two - 1st level of redundancy, and singly redundant if you exclude human interaction.
2. IF one of the remainder disagree, the pilot chooses which one he likes - 2nd redundancy level, but only due to human interaction.
3. Lose the last one, no backup. System is doubly redundant.

That is not strictly true. The level of redundancy is a count of the available resources, not the number you can afford to lose. Where you have three sensors, i.e. three pitot sensors, all of them are redundant, i.e. none of them are essential on their own for the system to work, therefore you have triple redundancy. It would take three failures for a triple redundant system to become inoperative.

BOAC

30th Jun 2009, 09:51

I'm sure I asked this before, but cannot now recall if was answered/deleted whatever.

I hear 'undercurrents' that are talking about loss of attitude data. There is nothing specific on anything posted here from the ACARS list to suggest that. The question (again?) is would the loss of the AD part of an ADIRU render the IRU part unusable/unavailable either de facto or due to software intervention?

Squawk_ident

30th Jun 2009, 09:56

Mojomoh
It is a fact that the BEA might very well work on this possibility. I might be wrong but in this case the latest ACARS fault :
0214 21-31-00-2 WRN ADVSRY
CABIN VERTICAL SPEED
LOSS OF ADR DATA
that has just be re-ordered by Desert Dawg, would have been the first warning, not the latest to have been be sent....
Normally the BEA should publish a preliminary report today and not the 2nd of July. At this date is the press point.

takata

30th Jun 2009, 10:23

Squawk_ident:
Mojomoh
It is a fact that the BEA might very well work on this possibility. I might be wrong but in this case the latest ACARS fault :
0214 21-31-00-2 WRN ADVSRY
CABIN VERTICAL SPEED
LOSS OF ADR DATA
that has just be re-ordered by Desert Dawg, would have been the first warning, not the latest to have been be sent....
Normally the BEA should publish a preliminary report today and not the 2nd of July. At this date is the press point. 1. of course, the BEA is investigating the Water/Waste fault reported May 31 at 2245Z as well as all the faults reported during F-GZCP's carreer. But this article (from a regional newspaper) is only a re-shoot from another one published several days ago from another unreliable source (general public information using unverifiable sources and adding counterfactual data to write another "storyline").

2. CABIN VERTICAL SPEED is an ADVISORY (a green button will flash by intermitence on the cabin pressure panel). A cabine decompression issue would be a major issue and full alarms would be displayed by sound and message all over the cockpit. At this point, this fault is about one cabin pressure controller (a second one is in stand-by). This cabin controller needs a differential pressure to work (Cabin pressure & outside air pressure). When two or more ADIRUs are faulted, the outside air pressure is lacking and the cabin pressure can not be monitored automatically anymore. That's why Mandala noted: LOSS OF ADR DATA.

=> This is not a decompression issue.

3. No preliminary BEA report is expected today as it should be released thursday at the press conference.

S~
Olivier

Desert Dawg

30th Jun 2009, 11:42

It is a fact that the BEA might very well work on this possibility. I might be wrong but in this case the latest ACARS fault :
0214 21-31-00-2 WRN ADVSRY
CABIN VERTICAL SPEED
LOSS OF ADR DATA
that has just be re-ordered by Desert Dawg.....

This re-ordered list of ACARS messages was not done by me. It was done by Mandala499 on a.net. All credit to him:ok:

aguadalte

30th Jun 2009, 12:35

BOAC:
I'm sure I asked this before, but cannot now recall if was answered/deleted whatever.

I hear 'undercurrents' that are talking about loss of attitude data. There is nothing specific on anything posted here from the ACARS list to suggest that. The question (again?) is would the loss of the AD part of an ADIRU render the IRU part unusable/unavailable either de facto or due to software intervention?BOAC:
Maybe the answer to your question is here. (http://www.pprune.org/rumours-news/376433-af447-100.html#post5008900)

Graybeard

30th Jun 2009, 12:48

This is the first I have seen of the detail of the failures reported by the ACARS, the number after chapter, such as the -15-0 after 34-11. Indeed, what is the source of this detail? Was it obtained from the original transmissions, or?

GB

Graybeard

30th Jun 2009, 12:57

The other iced pitot incidents did not mention loss of altitude indication, yet this ACARS report shows loss of air data to the transponder. The transponder has no reason to use airspeed. This is one failure that does not relate to the others.

GB

ClippedCub

30th Jun 2009, 13:11

The level of redundancy is a count of the available resources, not the number you can afford to lose.

Depends on your reference frame and interpretation. If you're a passenger, you like to think of three pitots as triply redundant.

If you're a computer, three pitots are singly redundant, since the computer can't decide who's bad when down to two. And if you have five computers, the computers themselves are triply redundant for the same reason.

augustusjeremy

30th Jun 2009, 13:14

0209 START
0210 34-11-15-0 FLR EFCS2
EFCS1, AFS - PROBE PITOT 1+2/2+3/1+3 (9DA)
9DA=HEATING ELEMENT PITOT 1 (6DA1/PHC1)
Heating Element Pitot 1 suspected failed.

0210 27-93-34-0 FLR EFCS1
EFCS2-FCPC2(2CE2) WRG:ADIRU1 BUS ADR1-2 TO FCPC2
No Data from ADIRU 1, ADR 1 & 2 no sending signal to FCPC2
No ADR Data from ADIRU 1 to PRIM2.

Someone came with the answer to my question at last.
Thank you !!!

From flight qantas 72 interim report:

Probe heat computer
Some of the PFR messages indicated a potential fault with the number-1 probe heat
computer (PHC). Those messages could be generated by either a PHC fault or by an
ADIRU fault. The PHC (serial number 2083) was tested by an authorised agency
and no fault was found. Based on a review of available information, the messages
related to the PHC were considered to be spurious.

Arnold E

30th Jun 2009, 13:26

Do we assume now that the pingers are dead at this stage?

augustusjeremy

30th Jun 2009, 13:37

from post 1190:

Quote:
At FL 370 with a SAT to -51 ° C and a wind from 080 to about 18 Kts on AWY UB612 with OFF SET 1R, between the OBD and MLK in radio contact with Khartoum, as we were at the edge of layer cloudy with some light turbulence, I tied PAX.

We were at dusk with low brightness.
Then we entered the layer, and soon after we started having a slight BURNING SMELL that lasted about twenty seconds and that did not appear to be of volcanic origin (no smell of rotten eggs), but rather electrical smell to me and smell the air conditioning for the OPL. Then the smell has disappeared. The odor was confirmed by the PAX booth and PNC between rows 3 and 14 thereafter.

from a poster at the (already famous) Tim Vasquez website:

Quote:
I am an Airbus A330/A340 Senior Training Captain (IRE/TRE) with Cathay Pacific in Hong Kong. As I'm sure you can imagine we experience our fair share of CB activity; and between June and October - Typhoons. We regularly get small ice deposits on the windscreen wipers and ice detector as cold as -54C. Very small amounts, but ice none the less. It only occurs in the upper levels of the anvil of active Cbs and enough to justify the use on engine anti-ice.

On 28th Sept 2004 ( I was a a brand new Captain) there was well defined typhoon ( I can't remember the name) centred on airway A1 between Taiwan and Kagoshima in southern Japan. The SAT at FL390 was around -56C. Heading South, it looked like we could make it over the top of the storm. As we reached the southern rim of the eye the temperature rose instantly to -39C and we entered a violent Cb. The ice build up was dramatic to say the least. Most of the lower half of the windscreen became encrusted and we encountered an electrical BURNING SMELL (which is not uncommon in the A330 in upper cloud).

Once we exited the cloud, the ice disappeared pretty quickly. There was no noticeable effect on the instruments

I posted this some days ago...
Do the PHCs share any buses with other computers/controllers ?

Professorrah

30th Jun 2009, 13:40

No! The expiration time is the guaranteed minim performance, and have been known to last for up to another four weeks after this period:O

augustusjeremy

30th Jun 2009, 14:01

0210 34-11-15-0 FLR EFCS2
EFCS1, AFS - PROBE PITOT 1+2/2+3/1+3 (9DA)
9DA=HEATING ELEMENT PITOT 1 (6DA1/PHC1)
Heating Element Pitot 1 suspected failed.

Bye Bye dual/triple pitot failure hypothesis...

BOAC

30th Jun 2009, 14:14

Any more messages preceding 0210Z sculling around anywhere:confused:

cpdlcads

30th Jun 2009, 14:31

Bleve post # 2562: that's a good article from AERO.

On the 330/340 you can put ''aoa'' into the ACMS on MCDU 3 and this gives a direct readout of aoa typically 2.2 - 2.4 degrees nose up at fl 370 M.81. Now if only AB would copy that info to the PFD, and better still to a separate instrument on the instr panel....

EDLB

30th Jun 2009, 14:43

Quote:
210 34-11-15-0 FLR EFCS2
EFCS1, AFS - PROBE PITOT 1+2/2+3/1+3 (9DA)
9DA=HEATING ELEMENT PITOT 1 (6DA1/PHC1)
Heating Element Pitot 1 suspected failed.

Bye Bye dual/triple pitot failure hypothesis...

Why? A single pitot failure unlikely downs an A330.

That this failure indication shows a failed PTC heating resistor/or wire connection or that it was impossible to keep the PTC at a high enough temperature remains unknown at this stage.

Will Fraser

30th Jun 2009, 15:05

Short of asking the computer to record a "burning smell", then tag it and transmit to mx, the question remains in general what brought this a/c down in a "seemingly" familiar way to other incidents? I am curious about the logic re: pitot sampling. With three pitot heads there are three possible pairs of "source", but when one head "fails" there is only one "source" left since the computer will fail both remaining if there is a "disagree?" Besides, why are pitots still "pointy"? Ice starts at the sharp bits.

Interface. The weakness as I see it. At the very least, I see the foundation as basically backwards. At a critical time in terrible weather at night, I don't want the box to fall all over itself telling me what's wrong, and what to do to fix the computer. I want the box to give me a few crucial cues so the a/c can continue to fly. In other words, give me the good news about what is working, not why the computer has to flop the a/c into my lap. The important cargo is not the computer.

takata

30th Jun 2009, 15:06

augustusjeremy:
210 34-11-15-0 FLR EFCS2
EFCS1, AFS - PROBE PITOT 1+2/2+3/1+3 (9DA)
9DA=HEATING ELEMENT PITOT 1 (6DA1/PHC1)
Heating Element Pitot 1 suspected failed.
Bye Bye dual/triple pitot failure hypothesis...

This is way too much reading into this ACARS sequence. ACARS are only triggered for post-flight maintenance once landed. They are not a kind of FDR giving the full data flow involved behind each events, neither they are a sequential explanation of the in flight cockpit events.

The ground maintenance will download the complete data report from each real time fault or event displayed by ACARS; once it is done, it will appear that nothing is wrong with the probes: from the other reports, by Airbus and Air France, which are describing this sequence of pitot-static line icing, the point is that nothing is discovered "failed" once landed, neither the probe heat units, neither the probe heat computer, neither the probes themselves: ice obstruction is gone.

This ACARS is just pointing at "what may have failed" (9DA: Heating element pitot 1) in order to get this part ready, but also, it is on the first pitot-probe because it is a shortened message send by an expensive system (SATCOM); this doesn't mean that the sequence of faults is anyway complete and that the following won't include one or two remaining probes. Moreover, the Rudder Control Limiter system wouldn't be stopped without an unreliable speed condition concerning two or more units. A single unit fault is considered a minor issue almost transparent for the flight management.

S~
Olivier

augustusjeremy

30th Jun 2009, 15:30

Takata,

I am really getting very confused with all this conflicting information.

In the following message:

0211 34-12-34-0 FLR IR2
EFCS1X,IR1,IR3, ADIRU2 (1FP2)
ADIRU2(1FP2) - ADR2 self monitoring & PHC rejects own data
Loss of discrete data from ADR2 = PITOT 2, STATIC 2L, STATIC 2R, TAT 2, AOA 2.
NAV DISAGREE CONCLUSION DELAYED - ADDITIONAL FAILURES - RECOMMENCE FAULT ISOL
I know you didn't post it... but what do you think is a guess and what is indeed documented ?

How can you get a fault of a inertial reference unit out of conflicting raw air data ? Isn't inertial reference data independent from air data ?

And isn't this fault detected by simple comparison involving INERTIAL DATA only ?

This is a mess...

Squawk_ident

30th Jun 2009, 15:45

The ground maintenance will download the complete data report from each real time fault or event displayed by ACARS;
Interesting but can you describe or explain what "download" means in this precise case. Is it downloaded from a computer inside the company maintenance building or an on-board system or computer. I understand that SATCOM being expensive, only the "headers" are sent and the rest is stored until further treatment. But retrieve from where?

And about the report, the 2nd of July is outside the ICAO delay to publish an incident/accident report as it should be published within one month. May be that the BEA has already released their report to some official aviation bodies.

takata

30th Jun 2009, 15:55

augustusjeremy:
I know you didn't post it... but what do you think is a guess and what is indeed documented ?
How can you get a fault of a inertial reference unit out of conflicting raw air data ? Isn't inertial reference data independent from air data ?
And isn't this fault detected by simple comparison involving INERTIAL DATA only ?
This is a mess... Well, indeed, I didn't posted it but I'm sure it is mostly documented and very difficult to decode without the full data stream and maintenance experience... I think that Mandala 499 (the original poster on Airliners.net) is quoted out of context and this list posted like that without the discussion concerning its meaning isn't complete. The first post concerning the decoding was from Pihero:

Pihero:
After a lot of research through dozens - if not hundreds of pages - from the A330 manuals, coming from different sources, Mandala 499 and I have managed to identify the meaning of the ACARS messages.
To explain it simply is not easy. Let's just say that the messages represent two of the functions of the CMC - Central Maintenance Computer - of the airplane :
1/- A report from the flight warning computer on what is showing on the instrument panels : PFDs, ECAM...etc...
2/- A report from the different BITEs that are present in each system, comparators...etc... They are , I repeat once again, totally transparent to the flight crew, but for us they could give a better picture of what is happening.
I confess I had a terrible problem sorting things out as I started with the assumption that the messages came out on the ground telex machine in their order of detection...It is not so, and thanks to Mandala's good work, we've arrived at a logical linkage of all the messages.
I also had to very carefully take Zeke's caution as to wheter these messages are genuine failures or just transients. I now believe that these faults / failures are for real and there was no indication - or logical explanation - of a return to normal functions.
So I propose that first we'd introduce you to the messages as they appeared on the initial summary document, then Mandala would walk you through what we think was the actual chain of events.
Bear with us, it's quite interesting.
So here is the decode of all the messages in the order of the first summary :

0210Z

A/P OFF : The AFS monitors the air data from the ADRs. Any brutal variation of CAS, ALT, Mach causes the A/P to disengage : here, as the pitot system is suspect, a variation of 20kt or Mach.04 for .45 second is enough to disconnect both FDs and the A/P.
Reactive windshear detection: with the ADRs been rejected by the AFS,, AoA is not accessible any more.
F/CTL Alternate Law : is normally a result of the "ADR DISAGREE" condition. The flight Control Laws revert , from "Normal Law" to "Alternate Law 2". The Prims are in charge of the voting and elimination of a duff ADR, but it takes them 10 seconds to do so (threshold is 16 kt / 10 sec.
Flight Director Flag on captain's PFD
Flight Director Flag on F/O's PFD
Auto Throttle OFF (These last three should have appeared at the same time as the A/P OFF warning.)
TCAS Fault : Result of the loss of the associated ADR (for altitude data)
Speed Limit Flag on Captain's PFD
Speed Limit Flag on F/O's PFD ( these two result of rejected Airspeed information by the EFCS, might be a sign of the PROT LOST, which hasn't been indicated)
Rudder Travel Limiter Fault is normally a result of the "ADR DISAGREE" condition.
EFCS 1 Fault on Maintenance Status
EFCS 2 Fault on Maintenance Status
Probe-Pitot 1+2 / 2+3 / 1+3 / (9DA. Relates to Heating element PITOT 1
Primary Flight Computer #2 (ADIRU1 signal to Prim 2)

0211Z

FPV Flag on Captain's PFD
FPV Flag on F/O's PFD
Speed or Mach function on ISIS (Suspect loss of ADIRU 3 for ISIS MACH )
IR2 Fault (Discrete data streams = Pitot, Static , TAT, OAT to ADIRU 2)

0212Z

ADR DISAGREE : TOOK IT A LONG TIME TO APPEAR NOW !

0213Z

Primary Flight Computer #1 Fault (Crew manipulation suspected, on ADR DISAGREE C/L )
Secondary Flight Computer #1 Fault ------Idem----------------------
ADR2 Fault on Maintenance Status Another very late message
Intermittent Fault on FMGEC #1

0214Z

Cabin Vertical speed Advisory. We now believe that this advisory message is just a result of ADR data

There is a glaring conclusion : there is no way that the ACARS have been transmitted in the order of the summary.
Firstly because we find a 0212z event in the middle of the 0211 ones, and the same for two 0213Z's between 0214z messages...
Secondly, it is also obvious that the ADR DISAGREE message/warning is too late in view of all the happenings that should have been its consequences .
But looking at the system, we can see in fact the trouble-shooting "reasoning" of the system facing multiple incoherent data at the same time.
The explanation will come in the second part, in which we deal with the time tags and propose one - for us the most logical - chain of events.See this post and below:
AF A332 Crash (F-GZCP) - Part 19 — Civil Aviation Forum | Airliners.net (http://www.airliners.net/aviation-forums/general_aviation/read.main/4460194/1/#201)

jcarlosgon

30th Jun 2009, 16:07

cpdlcads
On the 330/340 you can put ''aoa'' into the ACMS on MCDU 3 and this gives a direct readout of aoa typically 2.2 - 2.4 degrees nose up at fl 370 M.81. Now if only AB would copy that info to the PFD, and better still to a separate instrument on the instr panel.... Latest S/Ns have this:

"A backup speed scale and a backup altitude scale replace simultaneously the normal speed and altitude scales when all the three ADRs are switched OFF. This enables the flight crew to fly at a safe speed and altitude in case of an unreliable speedlaltitude indication.
The backup speed scale information is based on the angle-of-attack, and depends on the slatlflap configuration.
The backup altitude scale displays the GPS altitude."

FCOM 1.31.40 pg 32

Sorry, not able to post the image.

takata

30th Jun 2009, 16:10

Squawk_ident:
Is it downloaded from a computer inside the company maintenance building or an on-board system or computer. I understand that SATCOM being expensive, only the "headers" are sent and the rest is stored until further treatment. But retrieve from where?
From F-GZCP on-board system...
It is lost and we are left with our best guesses. From comparisons with other similar incidents documented with other ACARS sequences, be sure that the investigators and Airbus will get much more data than we actually have. But from what we have, there is no reason to believe that F-GZCP crashed at 0214Z.
Something else much more critical happened to her, starting with the failure of the Satcom system (my best guess here would be a double engine flame-out; they would be left to radio com and the aircraft had radio issues before departure).

S~
Olivier

takata

30th Jun 2009, 16:24

jcarlosgon:
Latest S/Ns have this:
"A backup speed scale and a backup altitude scale replace simultaneously the normal speed and altitude scales when all the three ADRs are switched OFF.Yes, you are right. All late aircraft are delivered with standard new BUSS (Back Up Speed Scale). A380, future A350, got it also, and it could be retrofited to older aircraft as well. The pilots from Air France asked for it for their long haul fleet following the numerous speed issues (but the retrofiting is very expensive also).

There is a paper from Joelle Barthe talking about it (at the end):
http://aviationtroubleshooting.*************/2009/06/af447-unreliable-speed-by-joelle-barthe.html

S~
Olivier

Hyperveloce

30th Jun 2009, 16:42

Hi there
In the Air Caraïbes case (I am a bit monomaniac but we have a real time sequence described there, not seen through the ACARS):
22h22mn59s: CAS & Mach plunged from 273 to 85 kts, from Mach 0.80 to 0.26, altitude dropped from 35000 ft to 34700 ft.
in the same instant: FD1/2 and A/P 2 disengaged, red ECAM msg "AUTO FLT AP OFF" (master warning+cavalry charge), and 6 new ECAM msg, among them (in the order given by the report): F/CTL ADR DISAGREE, F/CTL ALTN LAW, F/CTL RUD TRV LIM FAULT, AUTO FLT REAC W/S DET FAULT,... The SPD LIM (and red flag) are also displayed on the two PFD.
the next event in the chronology occurred at 22h23mn36s (STALL), but these msg appeared at 22h22mn59s to the pilots in a matter of a few seconds.
Jeff

PK-KAR

30th Jun 2009, 17:02

I think some explanations is due from this "crosslinkage"... :ugh:

Indeed, what is the source of this detail? Was it obtained from the original transmissions, or?
There was a post on eurocokpit, and there was a link providing "their" own translation of the ACARS... http://www.eurocockpit.com/images/PFR447.php
This was then put into the original ACARS headers list available at http://www.eurocockpit.com/images/acars447.php (this was the one that got everyone going).

Someone came with the answer to my question at last.
:= Be warned! There's no way of guaranteeing the content source (linked above) is correct.

Bye Bye dual/triple pitot failure hypothesis...
More reading needs to be done because NAV ADR DISAGREE came up, which shouldn't put the A/P and A/T off, but an 2 ADR fault would. Intermitten failures??? :confused: Dunno yet.

Any more messages preceding 0210Z sculling around anywhere
I haven't found any either :*

A single pitot failure unlikely downs an A330.
Correct... neither should a dual or triple Pitot failure. The reordered ACARS is only an attempt to piece together a possible sequence of events between 0210 and 0214 UTC... beyond that, it's speculation... but, speculation with some basis can be good for discussion, baseless ones are not... which caused the original AF447 topic here to be locked, and this one opened under heavy moderation (but the mods seemed to have been overwhelmed some of the time... they can't be everywhere at all times)... I've monitored this topic and the one at a.net but has so far refrained from posting on this one until someone put up that reordered ACARS list.

This is way too much reading into this ACARS sequence. ACARS are only triggered for post-flight maintenance once landed. They are not a kind of FDR giving the full data flow involved behind each events, neither they are a sequential explanation of the in flight cockpit events.
Agree and disagree...
Agree in that the ACARS is not the FDR, and the CMCs rely on various sampling rates of the components... intermitten failures can be missed, faulty or rogue items can go back online in sync and the CMC wouldn't report if it went and returned quickly. And there reason why one should not rely on this as an absolute factual basis of the chain of events is in the order in which it was listed... the timestamps has 1 minute resolutions... which is clearly not good enough (but then, can't win it all can we?)... and heck, I resequenced it to make sense TO ME!

Disagree in that... what else do we have? If stuff like that aren't useful, then why did it take >100 pages of what seemingly was running around in circles (at least about 10 pages worth continuously at one time)... The stuff can be useful for discussion purposes, and may allow some of us to get a better idea in the meantime. The list and the work done on it is far far from finished... and might never be... They can find the FDR and CVR tomorrow and provide information whether the understanding from the list is correct or totally wrong... but then, I guess we can't just sit and wait in the forums can we? :)

I for one would be disappointed the stuff to be used by Doombus or Glorybus preachers for their own agendas...

There are quite a bit of background discussions leading to the reordered list... so when just looking at the list, one must take extreme care, otherwise... :yuk:

How can you get a fault of a inertial reference unit out of conflicting raw air data ? Isn't inertial reference data independent from air data ?

And isn't this fault detected by simple comparison involving INERTIAL DATA only ?
A mess indeed... but look at the Qantas case, the preliminary report if I understand correctly reveal some potential problem linkage between the ADR and IR part of the boxes... which needs to be looked at.... :yuk:

Sorry, not able to post the image.
U mean this?
http://www.globalsim.web.id/publicservice/AF447/BUSS.jpg
That BUSS ??? :8

But from what we have, there is no reason to believe that F-GZCP crashed at 0214Z.
Agree... that's why the list was worked at... the simplest conclusion is that it was unlikely the plane hit the water (whether in 1 piece or nor) at 0214Z. The chain of events listed, and other cases such as the Air Caraibes F-OFDF incident, indicate that although the situation in the flight deck may be one of total confusion, the chain of events one can extrapolate/depict from the ACARS indicate that something else must have happened afterwards...

In the Air Caraïbes case (I am a bit monomaniac but we have a real time sequence described there, not seen through the ACARS):
Yes, but that case is no way a twin of F-GZCP, a cousin at best... more work on the ACARS list is needed to even have a fair comparison of the two cases. I'm not rushing because I do not want to fall into the trap of railroading objectivity... :ugh:

In the mean time, I'll drop into this topic once in a while... :E

PK-KAR (a.k.a. MDL499 "On the other place")

takata

30th Jun 2009, 17:06

Hyperveloce:
In the Air Caraïbes case...

Air Caraïbes is the best documented sequence to understand what happened into the cockpit, but this is not fully comparable to what would be the ACARS sequence of this flight. Then, the difference should be notable in term of what would be triggered by the CMC (Central Maintenance Computer) e.g. when or what ACARS will be triggered and time stamped?

Some may be triggered by pilot fault clearance thru ECAM procedures (like NAV ADR DISAGREE). This is obvious from other reports when ECAMS warnings are showing by intermitence when speed (IAS DISAGREE) or other probes are showing large fluctuations. Each warning doesn't mean an ACARS is automaticaly triggered as it may be cleared by itself.

Beside, there is some difference with AF447 about the initial flight parameters (lower speed at Mach 0.80 and A/THR already OFF before the event). The TAT probes also seems to be frozen and the event didn't last more than 2 minutes. But other parameters are the same: altitude, weight (206 t), flying in tropical weather.

S~
Olivier

PJ2

30th Jun 2009, 17:07

takata;
they would be left to radio com and the aircraft had radio issues before departure).
Interesting - could you help out?...I don't recall reading this, (which just means, "I don't recall"); do we know what the nature of the issues was? Thanks!
they would be left to radio com and the aircraft had radio issues before departure).
Precisely.

As I mentioned early in the thread, with only the ACARS messages in hand, the investigative process would logically take each message in turn, look upstream to try to determine which fault might result from previous fault(s) to see what would generate the message, and downstream, to try to develop likely scenarios which might result from upstream failures and the "consequent" messages we see . This appears to be the approach taken with the work quoted from the Airliners.net forum - it will be interesting and helpful to see what the investigators come up with to see how close this is.

The temptation is to over-analyze is absolutely the case here - no wonder this is a mess. There is the latent problem too, to fall into the hind-sight bias trap if sufficient caution and suspension of judgement isn't exercised when examining the Air Caraibe and other incidents. That doesn't mean these incidents are to be dismissed - that would be equally inappropriate.

Thursday will hopefully be helpful with new information and not just a summary of what we have heard already.

cpdlcads

30th Jun 2009, 17:13

jcarlosgon post no 2599:

Yes but you have to turn off the 3 adrs to get this bu sdp scale/gps alt.
What I'd like is a permanent aoa readout

Hyperveloce

30th Jun 2009, 17:15

Yes, but that case is no way a twin of F-GZCP, a cousin at best... more work on the ACARS list is needed to even have a fair comparison of the two cases. I'm not rushing because I do not want to fall into the trap of railroading objectivity... :ugh:

I don't get this because the two Air Caraïbes incidents occurred with two A330-200, and F-GZCP was an A330-203.
Jeff

takata

30th Jun 2009, 17:23

Hi PK-KAR,
Disagree in that... what else do we have?

Well, so you don't disagree.
My words, "too much reading" were about one intrepretation of your A.net post, not directed at your intrepretation of the ACARS, something I don't consider meaningless and, a contrario, very usefull as I was working on it myself.
:)
Good job, you, Pihero and helpers.
S~
Olivier

EGMA

30th Jun 2009, 17:38

Quote: ADR DISAGREE : TOOK IT A LONG TIME TO APPEAR NOW !

Not surprising; there must be a built in time lag to be able to sample speed trends; otherwise we be seeing ADR DISAGREE with every bit of turbulence.

Re my earlier post on pitot icing and safetypee's helpful comments, a possible senario could be:-

(1) Icing of the pitot drains causes an apparent speed increase, a/c slows toward the stall.

(2) PHC 'catches up' with deicing the pitots, speed decreases.

(3) Software senses imminent stall; pitch down.

(4) Cascade of ACARS messages ...

I don't know what the time lag is on the ADR sampling is, but this could be happening in that time. It could also account for other occurences, such as Qantas.

I'm not saying this is what happened, but it fits what little evidence we have.

takata

30th Jun 2009, 17:44

Hi PJ2
PJ2:
they would be left to radio com and the aircraft had radio issues before departure).Interesting - could you help out?...I don't recall reading this, (which just means, "I don't recall"); do we know what the nature of the issues was? Thanks!This little detail was missed by a lot of people. When Eurocockpit investigated to find out the complete ACARS listing (not only the AIRMAN headers), they went into further details about the flight and posted this fact to prove AF/BEA they finaly found the good documents:

In Eurocockpit, June 19th paper:
Pour confirmer que nous avons bien trouvé les bons documents, nous indiquerons par exemple que l'avion est parti sous tolérance technique suite à un échange de RMP (boîtier de contrôle des radios), et qu'il est parti avec le RMP3 INOP, ce qui est par ailleurs parfaitement conforme à la MEL. F-GZCP had a replacement of her Radio Management Panel (RMP) before departure and her RMP3 was listed INOP before the flight, but still in conformity with the MEL. It would be interesting to know if her last communication in flight with the Brazilian ATC @ 0133Z was made via SATCOM or radio.

S~
Olivier

takata

30th Jun 2009, 17:48

Hi Jeff
Hyperveloce:
I don't get this because the two Air Caraïbes incidents occurred with two A330-200, and F-GZCP was an A330-203.
Mandala meant the case is a cousin, not the aircraft. Do you know that Sarkozy is now flying one of this Air Caraibes A330 in place of his A319 considered too small for his big ego?
S~
Olivier

augustusjeremy

30th Jun 2009, 17:49

A mess indeed... but look at the Qantas case, the preliminary report if I understand correctly reveal some potential problem linkage between the ADR and IR part of the boxes... which needs to be looked at....PJ2,

The qantas case might be explained from IR1 providing wrong data to the calculations of the ADR1 output. AOA, calculated airspeed, etc all probably have an inertial component in their calculation/correction.

The opposite (an IR1 fault beginning with an ADR1) is apparently much harder to demonstrate.

What puzzles me the most in this AF447 case is that IR2 fault reporting...This is what is making me refuse to accept that the problem came - at least exclusively - from the pitot/static system.

It is not logical to have inertial data validated by air data - hence the name, inertial.

takata

30th Jun 2009, 18:02

@ augustusjeremy: IR and ADR
I have read (but I can't remember where) that the AOA function is slightly corrected by speed data (may be in the Quantas report). This would trigger a fault on this function without invalidating the AOA and could explain also the false stall warnings when the whole probe-static line is in trouble.

S~
Olivier

augustusjeremy

30th Jun 2009, 18:07

This would trigger a fault on this functionYou mean IR1 or AOA calculation itself ?

The qantas 72 has an IR1 fault reported.

If the AOA includes speed data, and if speed data includes inertial data - which I believe is correct - then an IR1 fault would indeed explain their problems with the AOA.

Squawk_ident

30th Jun 2009, 18:13

Do you know that Sarkozy is now flying one of this Air Caraibes A330 in place of his A319 considered too small for his big ego?
Correct. F-OPTP (they've received the new F-GOTO now) has left the Air Caraïbes fleet last month. And it is insulting for our President to say that he has a big ego. He has a Very Big Ego. And the pitot have been changed on this one.

PK-KAR

30th Jun 2009, 18:19

I don't get this because the two Air Caraïbes incidents occurred with two A330-200, and F-GZCP was an A330-203.
Not the aircraft... but the circumstances surrounding the events of interest!

My words, "too much reading" were about one intrepretation of your A.net post, not directed at your intrepretation of the ACARS, something I don't consider meaningless and, a contrario, very usefull as I was working on it myself.
OK then... :) and yes... reading it (even the translated version made by whoever) requires care due to context... that one is a big one... Context...

---
OK, now everyone is wondering about ADR, IR and AoA...
I wonder if the AoA estimator now links the ADR and IR together? Shouldn't, but then, perhaps someone can provide the details?

takata

30th Jun 2009, 18:30

augustusjeremy:
If the AOA includes speed data, and if speed data includes inertial data - which I believe is correct - then an IR1 fault would indeed explain their problems with the AOA.

My understanding is that ADR is not in charge of AOA calculation, because when ADRs are off, you still have an AOA displayed. If ADR is not doing the math, only the IR is left to do it as all the air data stream is directed to ADIRUs.
Or I'm wrong somewhere.

The ADRs provide a number of outputs to many systems and a blockage of the pitot and/or static systems may also lead to the following:
· SPD LIM flag on PFD
· Alpha floor activation (because AOA outputs from the sensors are
corrected by speed inputs)
· Wind shear warning (due to Mach input)
· Flap load-relief activation
· Flap auto-retraction from 1+F to 1
· Alpha lock on slats retraction (due to the speed logic part of the alpha lock function)
· ALTI DISCREPANCY on ECAM
· RUD TRV LIM FAULT ON on ECAM

Hyperveloce

30th Jun 2009, 18:34

Not the aircraft... but the circumstances surrounding the events of interest!

OK, now everyone is wondering about ADR, IR and AoA...
I wonder if the AoA estimator now links the ADR and IR together? Shouldn't, but then, perhaps someone can provide the details?

a few days ago DJ77 corrected me about the Qantas AoA spikes (ADR) by adding that these spikes were also present on the IRU channels. And indeed, if you look to the multiple graphs at the end of the Australian report (page 31), you can see a spike on the measured pitch, it came just before (a few tens of millisec ?) the first AoA spike (see page 30, AoA Captain), and it seems correlated (at least in time !) with the AP disengagement. This prompted the IRS failure (page 30), just before the ADR failure. Unless my interpretation of these graphs is as flawed as my understanding of your writings :}

PJ2

30th Jun 2009, 18:37

Thank you, takata.

augustusjeremy;
It is not logical to have inertial data validated by air data - hence the name, inertial.
No, it is not and that is a problem to come to terms with.

So - wonder why the message, "0211 ATA: 341200 FLAG ON F/O PFD FPV" and the same for the Captain's PFD?

rgbrock1

30th Jun 2009, 19:05

Hi.

I am simply a SLF member and have been observing the discussions on this board since 1 June 2009. First, I want to offer my gratitude to all you
flight deck members. I applaud your professionalism and everything you do
"up there". As a very skittish member of the flying public I am often comforted by the fact that I am indeed in the hands of professionals.
Now, on to the question at hand. I have not only been reading here on pprune, concerning AF447, but also on Eurocockpit. (I don't speak or read French but they do have translations into English.) On several of the Eurocockpit postings they have been referencing two other incidents involving the Airbus 300-series
and faulty airspeed registers and what-not. (Similar to AF447 and, yes, I'm writing in general terms). What comes to my mind, and this is the question I want to throw out to you professionals, is why in the other two incidents the crew was able to recover (assuming the pitot issue is indeed causal, why the crew of AF447 would not have been able to recover? In both accounts, one written by one of the flight deck members, a good description is given as to the steps taken to correct the issue at hand. Wouldn't the crew of AF447 have done the same? I just see a disparity between the other two accounts, and the outcome, and this one. Or, am i missing the point?
Thanks in advance.

overthewing

30th Jun 2009, 19:07

they would be left to radio com and the aircraft had radio issues before departure).
Interesting - could you help out?...I don't recall reading this, (which just means, "I don't recall"); do we know what the nature of the issues was? Thanks!

I saw a post ages ago - quickly deleted, I think - which said that COM3 was inop when the plane departed. As a non pilot, I have no idea what COM3 is, but I was surprised the post elicited no interest at all.

EGMA

30th Jun 2009, 19:33

In answer to rgbrok1; recovering from upsets ....

If you can see the horizon, you can fly by 'the seat of your pants'.

If you can't you had better hope that the instruments are giving you good info ... or else!

ELAC

30th Jun 2009, 19:53

Quote cpdlcads:

Yes but you have to turn off the 3 adrs to get this bu sdp scale/gps alt.
What I'd like is a permanent aoa readout

cpdlcads,

Actually, the instrument exists and has been an available option for FBW Airbus's for at least 16 years, and probably since the introduction of the A320 in 1989. If you look at a cockpit photo you can even see the "blank" in the upper left corner of the Capt.'s instrument panel where the AoA indicator is meant to be fitted. The problem is not the lack of the instrument, just an unwillingness of the airline's to pay for an instrument that they don't consider necessary.

ELAC

syseng68k

30th Jun 2009, 21:23

No, it is not and that is a problem to come to terms with.

It dependes on what is meant by "validation".

The iru contains a 3 axis gyro triad, either mechanical platform or laser ring, but also most importantly, accelerometers. The gyro triad can only provide attitude info but the accelerometer and gyro data via some fancy math gives absolute position on the earth's surface. Integrate acceleration once to get speed, twice to get distance travelled.

There may well be cross coupling between systems that measure similar parameters. Air data info may be mixed in to the IRU to provide cross referencing, fault detection etc. For example: detection of an unexpected transient between iru and adu calculated air speed that doesn't stabilise within defined time limits, points to ?...

PJ2

30th Jun 2009, 23:51

overthewing;
As a non pilot, I have no idea what COM3 is, but I was surprised the post elicited no interest at all.
VHF COM3 is not the main communications radio. It is used by ACARS and by the 3rd pilot when communicating with company. When out of VHF range, which AF447 was, ACARS automatically switches over to SATCOM. Just like the LAV ACARS message, there would be no real interest in the snag - it's a non-issue.

Lemurian

1st Jul 2009, 00:25

PJ2 {
Just like the LAV ACARS message, there would be no real interest in the snag - it's a non-issue.
...especially when the MEled item was not COM 3 but RMP 3 !

PJ2

1st Jul 2009, 01:04

Oh, was it "RMP3" - thanks Lemurian, - I missed it completely.

BeerBaron

1st Jul 2009, 04:19

Article from: Times Online

AIRBUS is expected to face calls to ground its worldwide fleet of long-range airliners tomorrow when French accident investigators issue their first account of what caused Air France Flight 447 to crash off Brazil on June 1.

It is believed that the accident bureau will report that faulty speed data and electronics were the main problem in the disaster, which killed 228 people.

The European Aviation Safety Agency (EASA) is likely to be asked why it had never taken action to remedy trouble that was well known with the Airbus 330 and 340 series. Nearly 1,000 of the aircraft are flying and until last month, no passenger had been killed in one.

"EASA has a legal and moral obligation to get to the bottom of this problem now," said James Healy-Pratt of Stewarts Law in London. "If there is a defective system and the aircraft is unsafe then it should be grounded."

Stewarts Law, which specialises in aviation, is representing the families of 20 victims of the Air France disaster.

Only 11 bodies of the 50 recovered from the Atlantic have been identified. They include Captain Marc Dubois, 58, who is believed to have been resting when his two co-pilots lost control of the aircraft in a storm.

Suspicion over the air data systems on the Airbus 330 and 340 series has increased after the disclosure that the aircraft had experienced 36 episodes similar to the one that brought the aircraft down as it flew from Rio de Janeiro to Paris.

Airbus first reported problems with the speed sensors - known as pitot tubes - in 1994. The company advised remedies, but no mandatory action was taken.

Last weekend, the US National Transportation Safety Board began looking into two incidents in which Airbus A330s flying from the US suffered critical episodes apparently similar to that of the Air France flight.

The fate of the aircraft would probably have remained a mystery had it not automatically transmitted data back to the Air France base.

In the final four minutes, they told a story that was familiar to the airline. Ice particles or water had blocked the three pitot tubes. This upset the air data computers, which in turn caused the automatic pilot to disconnect. The pilots would have had to fly manually in near-impossible conditions.

Airbus fleet may be grounded | The Australian (http://www.theaustralian.news.com.au/story/0,25197,25717126-2703,00.html)

Towhee

1st Jul 2009, 05:48

The Ice Particle Threat to Engines in Flight

This paper discusses jet engine powerloss and damage due to ingestion of ice particles. In the mid-90s several commercial airplane jet engines experienced more frequent powerloss in ice particle conditions, resulting in a focused investigation, and a greater awareness that led to recognition of similar events on other aircraft.

Since the mid-90s, events have been more numerous, and costly, and have generated greater industry interest. These events have been predominately associated with flight at high altitude near deep convective systems, often in tropical regions...

from:

American Institute of Aeronautics and Astronautics (2006), 1801 Alexander Bell Drive, Suite 500, Reston, VA, 20191-4344, USA, American Institute of Aeronautics and Astronautics - Home Page (http://www.aiaa.org)

Mad (Flt) Scientist

1st Jul 2009, 06:09

"EASA has a legal and moral obligation to get to the bottom of this problem now," said James Healy-Pratt of Stewarts Law in London. "If there is a defective system and the aircraft is unsafe then it should be grounded."

Stewarts Law, which specialises in aviation, is representing the families of 20 victims of the Air France disaster.

If that gross misunderstanding of how continuing airworthiness actually works is indicative of their specialism, then I'm not very impressed. Of course, that last sentence casts a fair degree of doubt on their status as a disinterested commentator on the topic.

grumpyoldgeek

1st Jul 2009, 06:15

In the final four minutes, they told a story that was familiar to the airline. Ice particles or water had blocked the three pitot tubes. This upset the air data computers, which in turn caused the automatic pilot to disconnect. The pilots would have had to fly manually in near-impossible conditions.

Reading between the lines, I have to wonder if Airbus had seen the same sequence of ACARS messages in other non-fatal upsets.

4krew

1st Jul 2009, 06:35

Sorry if this info was posted before but it is not possible to me to keep up with this thread size.

Before this AF447 crash Airbus had issued an OPTIONAL pitot change, it was not a recall. Since long Airbus had warned operators of this ADR PITOT
thing and as I hear my friends on A330 are flooded with stories of speed loss in cruise and I wonder if FAA and JAA were also aware of this, its consequences allied with the fact that under total ADR failure the angle of attack sensor is also inhibited putting the pilots clueless

LeandroSecundo

1st Jul 2009, 06:41

Hi,

What can you expect from James Healy, pratt of Stewarts Law in London?We can expect he will use all the legal ways for satisfy the requests of the famillies he defend.
That's what anyone expect from his laywer.

Bye.

PJ2

1st Jul 2009, 07:01

The call for grounding is no surprise, nor is it a surprise to learn who seems to be leading the call.

Though we know differently, the grounding of an aircraft is a flight safety matter, not a legal, economic or political matter.

Such a serious undertaking is for those who do this work including flight safety specialists and those who certify airliners, not "specialists" in the prosecution of aviation accidents whose goal is winning large quantities of money for clients not the enhanced safety of passengers, and who use as their primary weapon the media in which whipped emotion, not knowledge, advances their goal.

We have seen here and elsewhere, claims that "vertical stabilizers come off Airbus airplanes too easily".....-sweeping generalizations that pitot systems are unreliable and that one "solution" is to mount pitot heads nearer the middle of the fuselage away from where the ice hits first or to mount them behind protective covers. Such lack of understanding and knowledge is precisely what such lawyers value most - it is most easily manipulated.

The goal of this meeting should be to enlighten and to state what new information has been found, if any. The pressure to state preliminary causes may be the 30-day requirement but that should not provide a platform for such calls turning what is a serious responsibility into a media circus.

Whether the case for grounding will be proven cannot be presently determined. Any decision would have to be substantiated by a very high standard of evidence. That is the point that should be made in response to any call to ground the aircraft.

LeandroSecundo

1st Jul 2009, 07:31

Hi,

Though we know differently, the grounding of an aircraft is a flight safety matter, not a legal, economic or political matter. Are you sure you can discard the factor "economic" (and BTW .. economic can be linked with "politic")so surely from a decision or not to ground a type of aircraft ?
It was not easy to ground the Concorde .. and in fact this plane was a economic disaster in exploitation .. so it was not a great lost for AF and BA .. just a lost of "prestige"..
For the Airbus type .. it's completely different.
Imagine all the A330 and 340 grounded ...
Who will have the "balls" for take such decision if necessary ?

Bye.

Dave Gittins

1st Jul 2009, 07:48

Nobody was prepared to do it with the DC-10 ... I think the worst that ever got for DC was some limited time ADs

Mad (Flt) Scientist

1st Jul 2009, 08:05

The aircraft isn't going to be "grounded".

And it doesn't require "politics" to interfere.

Per the guidance material for continuing airworthiness in EASA (ACJ39.3(b)(4) is the latest I have here) the probability of a catastrophic event which would require immediate grounding of an affected fleet is 2X10^-6 i.e. one event in 500,000 flight hours.

The current A330 fleet is approx 600 aircraft. Assuming about 50% untilization (which seems to be about the rate for the accident aircraft since delivery) that would imply the fleet is accruing flight hours at about 200,000 fh/month.

There would therefore have to be an expected accident rate of the order of one per three months to require grounding. Since the historic rate is one per ... well, since service entry, it seems clear that the hazard is not sufficient to require grounding by any reasonable assessment of the figures, unless there is something very specific going on (like a production batch issue, in which case only that batch would be impacted of course)

Professorrah

1st Jul 2009, 08:05

An 330 flying into a horrendous storm and crashing due to potential icing of the Pitot tubes and super freezing ice on other areas of the airframe, (some suggest engine ingestion) caused by flight into CB. Surely this cannot be enough to ground the entire 330 fleet. An AD suggesting caution in CB, I can understand.
The DC 10 was a totally different problem and should not be compared in anyway.:ugh:

Towhee

1st Jul 2009, 08:21

June 29, 1994
Boeing mystified over 'violent' 747 stall

Boeing has failed to find the cause of an incident in which a Singapore Airlines (SIA) Boeing 747-400 stalled while at cruising altitude over Bucharest on a Singapore-Heathrow flight (Flight International, 3-9 November, 1993).

Independent reports from two private pilots, who were passengers, subsequently stated that the incident was far more violent than Flight International's report or the SIA statement at the time indicated.

The incident involved cockpit audible stall-warnings which could be heard in the upper-deck cabin, then buffeting, followed by two separate stalls during which the aircraft descended rapidly, losing "several thousand feet" in controlled airspace. SIA would admit only to an unexplained loss of airspeed followed by a pilot decision to descend to increase speed.

One of the pilot passengers reported that some flight attendants were thrown off their feet and that drinks hit the cabin ceiling.
An SIA source says that the pilot and co-pilot were puzzled by an apparent disparity in the airspeed readings of their respective instruments - one of which appeared to be receiving "frozen" speed data. The incident occurred as they tried to decide which instrument was giving correct readings.

Boeing says: "Working with the customer airline and equipment manufacturers, we performed tests on aircraft equipment which we thought might have contributed to this anomaly. We examined the air- data computer, pitot-static probe systems and other equipment. Nothing was discovered that would explain the anomaly.

"The equipment was removed and replaced, pitot-static lines drained and flushed, and the aircraft returned to service. There has been no recurrence." Boeing adds: "We're still working with the airline to see whether we can determine the cause. We have not been informed of other instances like this."

from: Flight International

(apologies if this is off-topic, but it does cite a possible pitot issue)

Peter H

1st Jul 2009, 09:12

May I respectfully suggest that the anticipated official report presents a great opportunity to freeze this thread and start another one. Ideally starting the new thread with a link to the official report.

What is the general feeling? I feel that 132 pages is already long enough.

Regards, Peter

... and many thanks to all the informative posters who have enlivened this investigation so far.

FrequentSLF

1st Jul 2009, 11:26

Already a long thread on the tech forum
http://www.pprune.org/tech-log/376881-technical-alternatives-pitot-tubes.html

LeandroSecundo

1st Jul 2009, 12:20

Hi,

May I respectfully suggest that the anticipated official report presents a great opportunity to freeze this thread and start another one. Ideally starting the new thread with a link to the official report.Great idea :ok:
But I suspect .. all the elements of the first official report are almost already in all the messages of this thread :)
I don't hold my breath for this reports and I think many will not discover new things in.
What will be interesting is the answers to the questions of the journalists (journalists only allowed to be in the meeting room .. no place for famillies .. pilot unions representatives .. etc ..)

Bye.

Daniel_11000

1st Jul 2009, 12:32

I think that the Agencies interpretation is that the fleet need to be grounded if there is 1 every 1.000.000 FH possibility that the problem leading to a catastrophic event can happen ; it is obviously not necessary to wait and see if the catastrophic event happens.

Reading the thread, it seems to me that many similar occurencies already happened to many of 330/340, and maybe, by pure luck or lack of coincidence of other events, those occurencies never became a 'catastrophe'.

Xeque

1st Jul 2009, 12:40

Absolutely correct. That's why on many light aircraft pitot tubes are heated (although on my first aeroplane, a venerable Rallye 100, it wasn't). It didn't really matter, I never flew in conditions where icing might have been a problem.

lomapaseo

1st Jul 2009, 12:53

Daniel_11000

it is obviously not necessary to wait and see if the catastrophic event happens.

Reading the thread, it seems to me that many similar occurencies already happened to many of 330/340, and maybe, by pure luck or lack of coincidence of other events, those occurencies never became a 'catastrophe'.

Of course you don't wait to see if you actually exceed the "guideline" But you do consider the likely combinations of all the known causal factors. And if you don't have enough data than you take a more conservative approach with presuming these combinations. That's why the feds are investigating other related events to see what combines together good and bad.

This kind of analysis goes on all the time in large fleets in a proactive manner before a catatastrophe has even happened.

The fact that the AF accident has happened suggests that there is truly something different from our assumptions to be learned here. If that ingredient is so significant than we need to also consider it in combination with other minor system failures as well.

I say again, don't get too wrapped up in simplified theories about pitot tubes.

Graybeard

1st Jul 2009, 13:12

When the ACARS report shows ADR Fail, it does not have to be all the outputs failed, just any single output. Failed airspeed calculation does not cause a fail of the altitude output.

I'm still perplexed by the TCAS Fail report in the list. ATC/TCAS use altitude, not airspeed. The other incidents did not mention loss of altitude display. In one instance, it was noted the altitude indicated a drop of 300 feet, meaning the ADR was still outputting valid altitude calculation, but perhaps without airspeed trim.

Hyperveloce

1st Jul 2009, 14:19

Hi there,
A little question about the AP disengagement. On the graphs at the end of
http://www.atsb.gov.au/publications/investigation_reports/2008/AAIR/pdf/AO2008070_prelim.pdf
(report on Qantas incident), we can see that when AP1 disengaged, a drift in altitude was initiated and it seems to be corrected (see also elevator position) only when the AP2 was engaged: is it common when the AP goes off, that a drift is being observed on flight parameters ?
Jeff

Mad (Flt) Scientist

1st Jul 2009, 14:24

On most a/c the AP is never entirely "in trim" - there will be servos holding small amounts of torque - just as a pilot hand-flying may not be perfectly in trim, just holding a residual force.

So when an AP (any AP) disengages, it's likely the aircraft will drift slightly to the trim position. Since the AP commanded trim usually lags the aircraft behaviour, you can usually predict the direction of the drift as being a reversal of the most recent aircraft trends.

PJ2

1st Jul 2009, 15:24

Mad(Flt)Scientist;
The aircraft isn't going to be "grounded".
Of course it isn't.

lomapaseo;
I say again, don't get too wrapped up in simplified theories about pitot tubes.
Exactly.

Professorah;
The DC 10 was a totally different problem and should not be compared in anyway.
Mostly agree. It may be instructive to compare nevertheless. Where there are similarities they are political, not technical.

Oddly, the DC10 was grounded not after the Paris cargo door accident, the third time that failure of the cargo door had caused the collapse of the cabin floor indicating a serious and fundamental design flaw (which had been communicated after the first failure), but after the Chicago accident in which no design fault was found concerning the pylon structure. In other words, the grounding was political, not technical or directed towards flight safety.

There were design flaws in the cargo door which became evident during testing before the aircraft went into service. The forward cargo door on fuselage #1 blew open and a larg section of cabin floor collapsed. the problems were recognized but rather than re-design the door to a much safer plug-type installation, (such as the L1011), minor fixes were made but proved ineffective.

After the Windsor accident in which a cargo door blew open (about a month after the airplane entered service), and the floor collapsed, the FAA made a "Gentleman's Agreement" to fix the cargo door to avoid the embarrassing impact on sales that an AD would have. They issued a regular Service Bulletin instead, failing to avoid the Paris accident.

A year after the Paris accident the FAA issued an AD concerning the ability of cabin floors to withstand the differential pressure caused when one side of the pressure vessel lost pressure. This was accomplished through a combination of strengthened cabin floor structure and pressure relief (vent) valves.

The Chicago accident had nothing to do with the cargo door and the pylon design did not have problems in and of itself but was criticized for being vulnerable to maintenance damage, (fracture due to tight clearances) if improper maintenance procedures were used during engine/pylon changes. American Airlines and Continental Airlines had used non-standard methods for complying with Service Bulletins for the replacement of the rear spherical bearing engine mount.

The A330 pitot system per se does not have design flaws of anywhere near the same order as the design problems of the DC10. The pitot system does not have design flaws at all, in the sense that clear and present risk or vulnerability is demonstrated.

Someone mentioned 32 events but did not list them or describe them. They should be part of the present investigation and reviewed to see if there are larger issues at work or if this is component related.

Even with components examined, as lomapaseo correctly states, this is not a "pitot system" accident.

This accident is extremely complex and would be even if we had the boxes. Systems and components fail and aircrews are trained to respond to such failures.

Whether there are larger questions about design complexity and crews' ability to successfully respond and contain cascading system faults is not a matter over which an aircraft would (or should) be grounded but a matter which must be sorted out both within EASA and Airbus as well as other stakeholders such as airlines and aircrew representatives, especially those whose specialties are flight safety.

PJ2

1st Jul 2009, 15:35

GB;
I'm still perplexed by the TCAS Fail report in the list. ATC/TCAS use altitude, not airspeed. The other incidents did not mention loss of altitude display. In one instance, it was noted the altitude indicated a drop of 300 feet, meaning the ADR was still outputting valid altitude calculation, but perhaps without airspeed trim.

This may help:

http://i277.photobucket.com/albums/kk76/batcave777/TCASChematic_2009-07-01_083121.jpg

DJ77

1st Jul 2009, 15:58

From Graybeard:

In one instance, it was noted the altitude indicated a drop of 300 feet, meaning the ADR was still outputting valid altitude calculation, but perhaps without airspeed trim.

Right, an uncorrected altitude has an error magnitude of a few hundred feet. That may be considered unacceptable for TCAS since RAs occur for an anticipated vertical separation of only 700 ft (above 20,000 ft).

PJ2

1st Jul 2009, 16:55

Will Fraser;
it is inconceivable that a major Manufacturer would ignore the need to provide handling cues to a blind FD.
That would be manufacturers, plural, because no transport, McD-D, Boeing, Lockheed or Airbus that I've flown provides this capability, nor does the historical accident record indicate the requirement, nor does an occurence necessarily prove the need.

We have yet to see if there is a design issue with the ISIS.

Re your suggestion to Rubik, fully-gimballed gyros still topple.

Will Fraser

1st Jul 2009, 17:00

PJ2

With a demonstrable history of trouble with flight cues under repetitive situations of AirData anomaly, this accident suggests the reason all prior incidents had acceptable outcomes was merely that the (447) flying pilots had no horizon, no a/s, etc. and were in weather at night. If I read you correctly, you are saying no manufacturer addresses this issue with mitigating (albeit archaic) solutions? That correct?

BOAC

1st Jul 2009, 17:39

This discussion is actually going http://www.pprune.org/safety-crm-qa-emergency-response-planning/379780-computers-cockpit-safety-aviation.html this way - can I elicit any inputs there?

PJ2

1st Jul 2009, 17:55

Will;

If the standby instruments fail, (which there is question of in the 447 ISIS case), there is no other system, archaic or no, and the mechanical standbys in the 320, 330 and 340 were tiny, poorly lit and would be impossible to read in heavy turbulence. These instruments are certainly not going to help you inside a thunderstorm. The B767 standbys were marginally better, (larger) and the L1011's were good, (well lit, readable). The DC8 - 60 series had a standby horizon. A standby altimeter was installed to "permit dispatch capability in the event that the air data computer or servoed altimeter fails." I don't think the DC9 had standby's but I can't recall now.

What I am pleading is the case for examining in detail the recorded issues to see the pattern or common thread if there is one, from which, I think you'd agree, the problem can be defined and if chronic, fixed, and if intermittent and statistically granular, addressed strategically. In part this has already been accomplished with the Unreliable Airspeed memory items and QRH checklist.

I think you need to understand that no bread-and-butter "archane" system presenting basic attitudes/speeds etc is going to right an aircraft or permit the crew to manually do same, that is badly upset.

What such a system must do, (and in my view it requires good flight conditions to do it for the reasons stated, "good" being in cloud, at night, no moon, no visible horizon, possible icing and moderate turbulence) is provide a horizon and a direct speed indication until the crew can stabilize the aircraft.

I can assure you that no instrumentation no matter how robust and no autoflight system will permit safe flight inside, or even offer a good chance of surviving penetration of, a large, developing thunderstorm at high altitude by a transport category aircraft. No pilot, no designer, no certification body and no regulator has a right to expect that any airliner should perform otherwise. If one enters a thunderstorm, one is, for all intents and purposes, in test-pilot territory with an unknown outcome.

If I read you correctly, those are however, the assurances you seek. That correct? If not, we're misconnecting and you need to be more specific and clear.

Squawk_ident

1st Jul 2009, 18:03

I think and hope that one or both of these French newsTV will live cover the press conference. As a reminder between 15 and 17hrs local 13/15UTC.

ITELE - ACCUEIL (http://www.itele.fr/index.html)
There's a short advertising just before the live brodcasting.

BFM TV la nouvelle chaîne de l’information sur la TNT, le câble, le satellite et l'ADSL (http://www.bfmtv.fr/)
about 30 sec delay

There might be others.

llagonne66

1st Jul 2009, 18:09

Mad Scientist

I concur with your analysis.
Since entry into service the A330/A340 (same design / two A/C) fleet has accumulated :
- over 27 700 000 flight hours,
- in over 5 200 000 take-offs.
As the AF447 accident is the first one (one too much of course) with no obvious root cause, I do not see how any Airworthiness Authority could mandate a grounding of the fleet.

surplus1

1st Jul 2009, 19:42

If the standby instruments fail, (which there is question of in the 447 ISIS case), there is no other system, archaic or no, and the mechanical standbys in the 320, 330 and 340 were tiny, poorly lit and would be impossible to read in heavy turbulence. These instruments are certainly not going to help you inside a thunderstorm.

What I am pleading is the case for examining in detail the recorded issues to see the pattern or common thread if there is one, from which, I think you'd agree, the problem can be defined and if chronic, fixed, and if intermittent and statistically granular, addressed strategically. In part this has already been accomplished with the Unreliable Airspeed memory items and QRH checklist.

I think you need to understand that no bread-and-butter "archane" system presenting basic attitudes/speeds etc is going to right an aircraft or permit the crew to manually do same, that is badly upset.

What such a system must do, (and in my view it requires good flight conditions to do it for the reasons stated, "good" being in cloud, at night, no moon, no visible horizon, possible icing and moderate turbulence) is provide a horizon and a direct speed indication until the crew can stabilize the aircraft.

I can assure you that no instrumentation no matter how robust and no autoflight system will permit safe flight inside, or even offer a good chance of surviving penetration of, a large, developing thunderstorm at high altitude by a transport category aircraft. No pilot, no designer, no certification body and no regulator has a right to expect that any airliner should perform otherwise. If one enters a thunderstorm, one is, for all intents and purposes, in test-pilot territory with an unknown outcome.

Well said sir, and thank you for all your other posts as well. They have been informative, measured, well articulated and reflect your professionallism and experience. Kudos captain!

I'm an old retired dog and have never flown a FBW airliner, but I have flown many others, for many years, all over the world. Before this accident I knew little about Airbus products or airliner FBW systems. Now I've read ever single post in several forums and done a lot of independent research reading manuals and official accident/incident reports. I don't know enough to fly one of those things, but I do know enough to observe that I do not regret that I never did.

What you say above about thunderstorms is accurate and well said. What you say about these systems is far too conservative and generous, for me. I appreciate why you take that stance and respect your consevatism and restraint. I am less conservative.

When we have multiple incidents of 3, 5 or all 6 screens going blank due to the failure of a single Bus, not once but several times. When we have a series of upsets or partial upsets from which pilots were lucky enough to recover, sometimes with injury to passengers; when we have the mysterious disappearance of an airliner with a seasoned crew (AF447) and a plethora of automated messages indicating multiple failures and warnings; when we have standy attitude instruments that can share in these malfunctions and that have independent power for no more than 5 minutes, and are difficult if not impossible to read in heavy turbulence; when we have, repeatedly, apparent multiple sensor failures producing erroneous data that disables funcionality at least in part; when we have at least a dozen senior captains in type all debating about how these systems truly function - and not agreeing after a month - I would call these experiences/events more than chronic. There's something very wrong about all this and it is dangerous.

Lengthy and cryptic checklists buried in the QRH, and multiple warnings with ECAMS scrolling so fast as to be illegible, and multiple memory items for problems that pilots do not appear (from what I read here, elsewhere and in the official reports) to understad in depth are not a solution for an obvious problem, nor are they a "reason" for its repeated occurrence - they are an excuse. The excuses are too many and too inadequate. They must be replaced by solutions that avoid repetition, not more excuses or modified check lists.

All airplanes have their problems it is true, but these particular designs seem, to me, to have more than their share. The manufacturer has not so far - in my opinion - resolved the problem whatever it is. They need to do so and fast! I don't know enough to suggest a remedy, but I do know that one must be found.

We do not know what happened to AF447 and unless the FDR and CVR are recovered and readable, most probably we will never know. The crew may well have made an error by inadvertently flying into the mother of all cells. I don't know and I am not prepared to guess or to assume without evidence. Even if that is so, there is no doubt in my mind that the systems of this design were less than helpful in what ever situation/scenario presented itself to that crew. That is unacceptable to me.

Some airliners of the type that I have flown have come apart in extreme turbulence. Yes, their pilots made errors but their systems did not induce those errors and did nor create or contribute to them. Most have survived ecounters with severe turbulence and their pilots were never confused with spurious warnings and unreliable instruments and systems producing incomprehensible warnings or uncommanded nose-overs.

Pilot error is something we all have to acknowledge. But, design induced pilot error is just plain unacceptable. This manufacturer needs to take a very hard look at its products. I'm not at all against technology, but experimentation with 'what ifs' should not be a part of airliner designs or operationl- no matter who produces them.

My apologies to all of you; I've already said too much.

ELAC

1st Jul 2009, 19:46

Quote: Will Fraser

... this accident suggests the reason all prior incidents had acceptable outcomes was merely that the (447) flying pilots had no horizon, no a/s, etc. and were in weather at night.

Will,

How have you come to this suggested conclusion?

From the pattern of Failures and Warnings in the ACARS messages it is reasonable to conclude a loss of airspeed information, but nothing more.

Extracting from the last posted summary of ACARS messages (assuming it is correct) the failures reported only lead to 3 items of information: Airspeed; Flight Director, and; Flight Path Vector being removed from the PFDs. Likewise the failure message related to the ISIS is for the speed/mach function which itself should only produce a red SPD flag on the ISIS, not a failure of the entire unit (which would display an OUT OF ORDER flag and related maintenance code). There is no information available to us that would lead to the conclusion that attitude or altitude data was lost, either on the PFDs or on the ISIS.

The problem with this discussion is that, in the absence of any further facts, it has drifted so far off base that we've come to the point of discussing the merits of plumb-bobs of all things. The contributions now seem to fall into the categories of: Declarations regarding the certainty of some critical flaw in design or concept; Various home-brewed plumb-bob solutions to said flaws; Validation of same by anecdotes or experiments in a Cessna, and; Occasional efforts to bring things back to the known facts about the aircraft and the accident.

It would all be quite humorous were it not for the fact that it is actually setting back efforts to understand what did happen to AF447, which is a very important question to those of us who fly the aircraft as pilots or as passengers. All one has to do is read the articles appearing in various media sources (such as those posted here from The Times and The Australian) to see the reverberation effect of inaccurate conclusions stated here becoming magnified and reflect back to us as "consensus opinions of professionals in the field". That's a fault of the media as much as anything, but it does shape perception of what happened and it should be a reminder that this is a "Professional" forum where there's an expectation that what you suggest in your posts is at least a speculation informed by knowledge of the aircraft/crew/accident and supported by the facts available.

The suggestion that the AF crew lost all PFD and/or ISIS data and that this was a or the reason for the accident is not one that is supportable given the known information to date.

0210 22-83-00-2 WRN FLAG
LEFT PFD SPD LIMIT
Rejected ADR still feeding data to PFD
If there is valid ADR, it's not being selected for LEFT seat.

0210 22-83-01-2 WRN FLAG
RIGHT PFD SPD LIMIT
Rejected ADR still feeding data to PFD
If there is valid ADR, it's not being selected for RIGHT seat.

0210 22-83-00-1 WRN FLAG
LEFT PFD NO F/D
Automatic Flight System (AFS/FMGC) loss of 2 ADR sources.
Safety mechanism, prevents erroneous F/D for pilot to follow

0210 22-83-01-1 WRN FLAG
RIGHT PFD NO F/D
Automatic Flight System (AFS/FMGC) loss of 2 ADR sources.
Safety mechanism, prevents erroneous F/D for pilot to follow

0211 34-12-00-0 FLR ISIS
ISIS (22FN-10FC) SPEED OR MACH FUNCTION
SUSPECT LOSS OF ADIRU1 AND/OR ADIRU3 FOR ISIS MACH
Suspect Loss of ADIRU3
NAV DISAGREE CONCLUSION DELAYED - ADDITIONAL FAILURES - RECOMMENCE FAULT ISOL

0211 34-12-00-1 WRN FLAG
LEFT PFD NO FPV

0211 34-12-01-1 WRN FLAG
RIGHT PFD NO FPV

Will Fraser

1st Jul 2009, 20:01

ELAC

Glad you asked. I mean no disrespect, but you are overlooking the obvious. In the absence of suitable technical data, you call me to task because you don't believe in something that I do. (Ostensibly).

With its highly trained and experienced Flight crew on a flag carrier built to exacting specifications, why do you not believe that had the crew had a Horizon, the a/c would not have ended up in the Ocean?

With a Horizon, and power, AB's suggested solution, pitch and power, would be expected to have worked. I believe it too. Call me old fashioned.

rgds.

Will

jcarlosgon

1st Jul 2009, 20:15

surplus1 ...I've already said too much. I don’t think you have said too much. Just check this:

About IFALPA (http://www.aeropers.ch/ids/default.asp?URL=http://www.aeropers.ch/ids/file.asp?FileID=378&TopicID=241)

IFALPA Briefing Leaflet - 30.06.09 (http://javascript%3Cb%3E%3C/b%3E:url_iframe%28%27http://www.aeropers.ch/ids/file.asp?FileID=378%27%29;)

Headline, “IFALPA requirements regarding pilot authority and flight control architecture”. Goes on to:

"The aircraft commander shall be given the authority and capability to select the level of augmentation for the flight control system."

And, wrap up:

"Automatic reconfiguration of pilot authority must be clearly indicated by the system.
Based on established procedures, the level of pilot authority must be selectable by pilot action.
The level of pilot authority must be clearly indicated by the system without any ambiguity.
If it is possible to regain a higher level of augmentation, the procedures shall indicate the status of the system."

Loose rivets

1st Jul 2009, 20:17

Will. I ended up chatting on JB about this point. Paras 4 and 5 are germane

http://www.pprune.org/jet-blast/375943-air-france-jet-missing-18.html#post4993312

lomapaseo

1st Jul 2009, 21:14

ELAC

The problem with this discussion is that, in the absence of any further facts, it has drifted so far off base that we've come to the point of discussing the merits of plumb-bobs of all things. The contributions now seem to fall into the categories of: Declarations regarding the certainty of some critical flaw in design or concept; Various home-brewed plumb-bob solutions to said flaws; Validation of same by anecdotes or experiments in a Cessna, and; Occasional efforts to bring things back to the known facts about the aircraft and the accident.

It would all be quite humorous were it not for the fact that it is actually setting back efforts to understand what did happen to AF447, which is a very important question to those of us who fly the aircraft as pilots or as passengers. All one has to do is read the articles appearing in various media sources (such as those posted here from The Times and The Australian) to see the reverberation effect of inaccurate conclusions stated here becoming magnified and reflect back to us as "consensus opinions of professionals in the field". That's a fault of the media as much as anything, but it does shape perception of what happened and it should be a reminder that this is a "Professional" forum where there's an expectation that what you suggest in your posts is at least a speculation informed by knowledge of the aircraft/crew/accident and supported by the facts available.

Bingo :ok:

I don't mind opinions but they belong in a technical thread not in an accident thread. Even the well advised among us sometimes get too far ahead of the investigation to the disservice of the public. I have no problem in making other pilots aware of possible issues, but there has to be a more delicate way.

takata

1st Jul 2009, 21:19

Will Fraser:
With its highly trained and experienced Flight crew on a flag carrier built to exacting specifications, why do you not believe that had the crew had a Horizon, the a/c would not have ended up in the Ocean?
With a Horizon, and power, AB's suggested solution, pitch and power, would be expected to have worked. I believe it too. Call me old fashioned.You are right, and this is the conclusion based only on the few facts available (ACARS).
Hence, what happened after 02.14?
We just don't know neither when and where she crashed. F-GZCP ended in the Ocean but those ACARS are not saying why she did so.

Short factual summary:
June 1st, at 0210, she was in the middle of a big CB cluster and her Thales ice-sensible pitot-probes started to freeze. Between 0210 and 0214, the various flight systems related to air data stream were automaticaly disconnected (as expected in the A330 documentation). At 0214 (+/-30s), no more ACARS were recieved from F-GZCP. On June 6th, the first bodies and wreckage were spotted and recovered by the Brazilian SAR confirming she had crashed.
End.

Everything else is speculation based on the few clues we have seen from the wreckage, rumors about the investigation work, supposed Airbus design flaws or whatever agenda some people have. All we need now to go further in this case is more facts and less "noise".
S~
Olivier

http://takata1940.free.fr/images1/af447meteo.jpg

captainflame

1st Jul 2009, 21:23

I have to agree with you.:ok:

PJ2

1st Jul 2009, 21:42

Surplus1;

My personal thanks for a fine and collegial post, which speaks, in my view, a very fine truth about our industry and about this aircraft design. As I posted to Will Fraser, I am not a convinced Airbus pilot and do not dispute the serious misgivings which some have intelligently expressed here from a basis of combined experience and knowledge.

I also am not uncomfortable in the airplane. it is a dream to fly automatically and manually - it is an extremely well-thought-out airplane and entirely trustworthy. It is in all ways a "pretty" engineering feat.

That said, like many crews I have had a few serious system abnormalities on the 320/330, (though none as serious as was faced by the AF crew) and have disregarded, where appropriate, both the autoflight system and the ECAM checklist when I thought it was seriously out to lunch, (and it was, as I discovered after talking with maintenance.

On the 320, hand-flew (autothrust OFF) every approach and, until my company prohibited it unless there were no other airplanes in the sky, hand-flew every approach in the 330/340, sometimes to the consternation of the other crew members who had never seen the airplane flown like an airplane but "managed" as though one were at one's desk in some darkened room and what we were looking at outside was a realistic video.

One either submits to the designer's and engineer's intentions or as a professional aviator one draws a firm line over which the engineer is not permitted to cross. Hand-flying isn't "practise" - it is the finest way to maintain situational awareness. It is a human-factors defence activity which necessarily requires thinking and the attention of everyone.

Towards the end of the career I left the automation connected - too much risk to the career to disconnect and have something go wrong. If you ask me, there is something deeply wrong with that attitude but there is something equally wrong with pilots and their associations accepting it without a fight. But unions these days are terribly weakened - such amorphous concerns are largely dismissed and difficult to argue in what has become a singularly-focussed industrial discourse.

Will, I hear you.

Although I came very close once, I haven't lost a good friend to an accident during the career but I've been scared a number of times by weather and what it can do. And in that vein, no matter how many hours they get and how well they memorize, I don't think any pilot graduating from these new MCPL schools is a real pilot until they experience the adrenaline levels that nearly killing oneself and one's passengers brings on, with those aftershocks in the days that follow that startle one into fretfull wakefuless at 3am. I'm not saying this for dramatic effect. It can't be taught but those who have had the experience will already know that.

To me, it isn't young pilots who are the problem; we all must get experience some way. But pilots with less than a couple of thousand hours shouldn't be sitting in the right seat of any airliner faced with all the challenges an airline pilot must contend with. Flying the airplane well and knowing how to program the FMC and understanding IFR and instrument flight isn't what an airline pilot primarily does; - certainly not the captain anyway. That's expected.

The difficulty with the way the industry has change comes more subtlely as years of economic and political pressure and wonderfully safe flying brought about in part by the very automation we are concerning ourselves over, have permitted executive and senior managements to let their standards slide to survive in this extremely difficult enterprise. "Cheaper, faster, better", used to be NASA's credo during the early Shuttle days (and perhaps earlier); now it is aviation's. Seen it, know it and felt it and so have many here, but it is impossible to convey one's concern to those who have lost touch with the business they're in, in the face of "obvious" success, until aviation itself provides the ultimate intervention and dose of harsh reality. Flight safety specialists are usually unpopular millstones who always bring bad tidings, interfere with "progress" and don't have a sense of humour. Kicking tin does that and when serious events occur in flight data but the data is either ignored as commercially inconvenient or used against crews (which kills a just safety culture and stops all safety reporting), one tries to defend oneself against the cynicism that inevitably follows, especially when familiar with the undercurrents of hypocrisy and absence of ethics.

I view the discussion on automation, pitot - static issues, a severely degrading autoflight system with cascading faults in severe weather, in this context. At what point are pilot "over-trained" such that cutting training is a legitimate economic goal; at what point are aircraft "over-engineered" such that pilots may be seen and treated as "managers" instead of aviators?

The notion of "watershed moments" is over-worn, exhausted in the hyperbole of the safety discussion, mine included sometimes. I sense there are extremely valuable lessons for our industry in the present issues under discussion but they are as much philosophical as they are technical or economical; those dialogues have always been viewed as strongly at odds with one another but unless we understand our discomforts with design priorities while still making enough money to stay in business while keeping ones' charges safe, we will see the fatal accident rate begin to slowly climb as the business recovers and grows.

Thanks for the dialogue Will. Strong views held, yet the willingness to engage.

PJ2

eklawyer

1st Jul 2009, 22:01

Came back from the crew bunk in the bowels of the aircraft several months ago. Stood behind my seat to look at all the flashes in front of the aircraft, looked at both ND's with no returns showing.

Leaned over the FO occupying the left seat and turned the radar dim to max, low and behold if it was not painting red it was magenta. Threw the pillock occupying my seat out and initiated the weather avoidance. Followed by a few home truths once clear.

I was horrified what might of happened if I had come back 15 mins later than I did.

Flying into horrendous wx is not beyond the imagination especially at night !

PJ2

1st Jul 2009, 23:07

eklawyer;
Threw the pillock occupying my seat out and initiated the weather avoidance. Followed by a few home truths once clear.

I was horrified what might of happened if I had come back 15 mins later than I did.

Flying into horrendous wx is not beyond the imagination especially at night !
That's pretty worrisome stuff, eh? Don't know about yours, but my airline never once, in 35 years, told us/taught us how to use radar. As a result, I have watched the same kind of lack of understanding about how to set calibration, how to use tilt, how to calculate height, what the beam width is, what does and what doesn't return signal, signal attenutation and shadowing, the use of range and so on.

A friend on the 767 informs me that his F/O actually argued with him (flying in the same general area as AF recently) that the "best" radar for thunderstorm penetration was "MAP". Needless to say he got the same lesson you probably gave. There are as many theories on how to use the gain as there are pilots.

The use of 330/340 radar was only recently placed in the AOM but it never, ever comes up in sim rides, enroute check rides, annual recurrent training or even informal discussions. Not good enough.

Tree

1st Jul 2009, 23:29

A friend on the 767 informs me that his F/O actually argued with him (flying in the same general area as AF recently) that the "best" radar for thunderstorm penetration was "MAP".

Don't knock it until you try it! Based upon my experience and experimentation with the 767 radar, that is the best for painting "dry" ITC buildups. MAP and one notch down from MAX GAIN. This procedure was developed by a group with many decades of ITC experience and in the past also used expensive NV goggles as another layer of detection. NV goggles are now cheap enough in HK that one can afford to do their own research. Our Tech-Safety group also provided a copy of Archie Trammell's VHS tape.

p51guy

2nd Jul 2009, 01:07

Lightning6

2nd Jul 2009, 01:20

EK lawyer said what I said a couple of days ago about the two FO's flying while the captain is taking his rest and how their experience would handle this massive instrument failure. I was deleted soon, so most here didn't see it. Even though people disagreed with me I notice here in the US copilots are not held to captain standards. I really don't think it is much different in other countries. We have an unknown command capability on this flight at the time of the encounter.

I would have thought the experience that the FO's on this flight would have the experience to deal with whatever situation they were confronted with, but in the possibility of a catastrophic and sudden system or airframe failure, would the captain have done any better?

amicus

2nd Jul 2009, 02:30

All thanks for superb, thoughtful, balanced and insightful efforts throughout the course of this extended discussion. Your comments and insights are deeply appreciated by this aerospace engineer who worries about your and your passenger's safety daily and who greatly values and welcomes your highly experienced and most valuable commentaries and discussions at all times. I rely on wise mentors in the aviation community to guide we engineers and hopefully helps us avoid the traps of hubris, over reliance upon automation, overly complex systems, which lead to tempting and allowing airlines to cut corners on costs and training. Such design and system approaches dangerously and imprudently lead some airlines and training schools to advocate that pilots become system monitors rather than skilled airman. There are many questions and ongoing concerns regarding training, airmanship and safety, backup instrumentation and systems design and we engineers ignore your advice, guidance and wise counsel at our peril. Thank you all.

Flight Detent

2nd Jul 2009, 02:48

Whilst I'm reading here about the piloting experience levels and radar operation expertise, and the various levels of indication anomalies...can I remind everyone that the vertical stabilizer was found some 30nm from the site of the main crash debris!

Take that as you will, but for my money that component didn't ride the fuselage all the way to the water.

Maybe that may have had some affect on the piloting capabilities!

Aren't we getting a little sidetracked here!

Cheers...FD...:)

Xeque

2nd Jul 2009, 03:39

I think you are right in what you say on the other thread. Unfortunately, two earlier posts I made in this thread where I expressed similar reservations were deleted.

Will Fraser

2nd Jul 2009, 03:44

Flight Detent

Everything you mention in the opening sentence is connected. There are three VS loss accidents that come to mind. AA587, "pilot induced" over loading the rudder; UAL 232, uncontained turbine disintegration (N1?) which took the fin and rudder with it, and JAL 123, aft bulkhead crippled the Rudder/VS when it let go after a faulty repair of a tailstrike seven years previously. No accident is exactly like another. Nothing is unimportant, and no salient assembly tells all.

This thread is novel in that it allows comment by interested parties regarding information that is available. The Internet is a dynamic force that changes the game (or at least some of the 'rules'). I think it is a force for progress, utimately.

Whatever happened, happened quickly. Did the VS let go but allow for some control? 123 and 232 allowed the pilots to manouver with difficulty, did 447 have a shot after the VS separated? Did they descend in 'reasonable control' though steeply impact the sea some distance from the loss? Or did the empennage fail as a unit along with the aft bulkhead, the HS somewhat attached the rest of the way? Keep in mind the ACARS is a pirated document, not released by AF (to my knowledge). Who could discount the Weather? Other than some rather fantastic and discounted possibilities, anything could have happened.

One other thing. The three I mention lost their VS' in the climb, 447 was in cruise. That is important.

Will

Captain Bob

2nd Jul 2009, 04:22

Quote:
A friend on the 767 informs me that his F/O actually argued with him (flying in the same general area as AF recently) that the "best" radar for thunderstorm penetration was "MAP".

Don't knock it till you try it! Based upon my experience and experimentation with the 767 radar, that is the best for painting "dry" ITC buildups. MAP and one notch down from MAX GAIN. This procedure was developed by a group with many decades of ITC experience and in the past also used expensive NV goggles as another layer of detection. NV goggles are now cheap enough in HK that one can afford to do their own research.

You have to be kidding me? Flying around WX with the MAP Mode on? I hope I am never on any flights you are on. I would never let any of my FO's ever try to do that. 11,000 + hrs on the 757/767 and I have to raise the BS Flag on this one.

:eek:

Graybeard

2nd Jul 2009, 04:23

Thanks, EKlawyer, for sharing your scare. It is relevant.

Quote:
"A friend on the 767 informs me that his F/O actually argued with him (flying in the same general area as AF recently) that the "best" radar for thunderstorm penetration was "MAP". "

Tree confessed: "Don't knock it till you try it! Based upon my experience and experimentation with the 767 radar, that is the best for painting "dry" ITC buildups. MAP and one notch down from MAX GAIN. This procedure was developed by a group with many decades of ITC experience and in the past also used expensive NV goggles as another layer of detection. NV goggles are now cheap enough in HK that one can afford to do their own research."

Dunno whether you guys are flying Collins or Bendix/AlliedSignal/Honeywell, but I can tell you this about Collins WXR:

Rainfall scintillates, which is detected by doppler shift. Ground return doesn't of course, so the Collins radar distinguishes the two, and optimizes the mode selected. There will be a "GCS, Ground Clutter Suppression", IDNT, (ground clutter) Ident, or some other such submode of WX on the control panel. This is especially effective at low altitudes where there is high terrain. This submode will wipe out the gentle rainfall along with the terrain returns, but you don't care about that, anyhow.

If you want to see the high altitude ice crystals after you have picked your route by scanning the wet part of the storm, it's a good idea to have variable gain in WX mode, or use the Turb mode. The Collins WXR operates at full gain in Turb mode, so it will display returns below the level of light rainfall, just like Max gain in WX mode.

Do AF pilots get good WX training?

ArthurBorges

2nd Jul 2009, 04:38

INTERPOL to help co-ordinate international efforts to identify Air France crash victims (http://www.interpol.int/Public/ICPO/PressReleases/PR2009/PR200953.asp)

Graybeard

2nd Jul 2009, 05:55

Thanks for the TCAS block diagram on post 2650, PJ2. It confirms that airspeed is not an input to TCAS, hence not a reason for the NAV TCAS Fail on the ACARS list.
------

From Graybeard:

Quote:
"In one instance, (Delta/NW) it was noted the altitude indicated a drop of 300 feet, meaning the ADR was still outputting valid altitude calculation, but perhaps without airspeed trim. "
--------

DJ77 replied:

"Right, an uncorrected altitude has an error magnitude of a few hundred feet. That may be considered unacceptable for TCAS since RAs occur for an anticipated vertical separation of only 700 ft (above 20,000 ft)."
-----------

Altitude on the PFD was still valid during the Delta/NW event, so the altitude to the TCAS would still have been valid. The ADR will not send different altitudes to these two destinations, except below the QNH transition level.

The TCAS Fail message from AF447 remains unexplained, and not in concert with the other reported failures that can all be explained by erroneous airspeed.

GB

PJ2

2nd Jul 2009, 06:30

GB;
The TCAS Fail message from AF447 remains unexplained, and not in concert with the other reported failures that can all be explained by erroneous airspeed.
Hm, it may be "unexplained" but I don't think it is inexplicable. I think the TCAS indicated "failed" because of the absence of good data from ADIRS 1. I don't think it's more complex than that.

Daniel_11000

2nd Jul 2009, 06:32

LOMAPASEO

Agreed. The subject of my post was not on ‘pitot probes’ or something similar.
I was merely explaining that it is not sufficient to divide (catastrophic events) by (fleet flight hours) in order to verify the probability of an event.
What is important in the analysis is to be sure that the probability of an event to develop , for whatever reason, in a catastrophic event is below a certain level.
In our case , is not sufficient to divide one(AF 447) catastrophic event by the fleet FH, but in my opinion we should sum all similar events (the pitot problem that we know that could/can lead to catastrophic events) already happened and sum them in the formula. By this I am not saying that the pitot problem caused that AF447 event. I am merely saying that concurrent pitot problems can lead to catastrophic events , either alone or in conjunction with other more probable failures.

takata

2nd Jul 2009, 08:10

Greybeard:
Thanks for the TCAS block diagram on post 2650, PJ2. It confirms that airspeed is not an input to TCAS, hence not a reason for the NAV TCAS Fail on the ACARS list.
[...]
Altitude on the PFD was still valid during the Delta/NW event, so the altitude to the TCAS would still have been valid. The ADR will not send different altitudes to these two destinations, except below the QNH transition level. The TCAS Fail message from AF447 remains unexplained, and not in concert with the other reported failures that can all be explained by erroneous airspeed.One case of unreliable airspeed is always different from another. Look at the two cases investigated by the NTSB:

NTSB INVESTIGATING TWO RECENT INCIDENTS INVOLVING POSSIBLE A-330 SPEED AND ALTITUDE INDICATION ANOMALIES
The National Transportation Safety Board is investigating two recent incidents in which airspeed and altitude indications in the cockpits of Airbus A-330 aircraft may have malfunctioned.
The first incident occurred May 21, 2009, when TAM Airlines flight 8091 (Brazilian registration PT-MVB) flying from Miami, Florida to Sao Paulo, Brazil, experienced a loss of primary speed and altitude information while in cruise flight. Initial reports indicate that the flight crew noted an abrupt drop in indicated outside air temperature, followed by the loss of the Air Data Reference System and disconnections of the autopilot and autothrust, along with the loss of speed and altitude information. The flight crew used backup instruments and primary data was restored in about 5 minutes. The flight landed at Sao Paulo with no further incident and there were no injuries and damage.Then, NW incident is not exactly the same as TAM, but the root is common. As well, the same variations (speed or altitude, speed and altitude) are shown in other cases from Air France, Air Tahiti and Air Caraïbes. They are not triggering exactly the same faults depending of the conditions (exposure time is an important factor here) affecting the lines of the pitot/static system.

But the general context is almost identical (as well as the crews reaction) and it is described also fairly well in the Airbus A330/A340 Flight Crew Training Manual:

FCTM A330/A340 Non-normal Operations 8.110.3 Miscellaneous REV 1 (6 JUN 05)

UNRELIABLE AIRSPEED INDICATIONS

Unreliable airspeed indications can result from blocked or frozen lines in the
pitot/static system.

Most failure modes of the airspeed/altitude system are detected by the ADIRS
and lead to the loss of the corresponding cockpit indication(s) and the triggering
of associated ECAM procedures. The fault sensing logic relies on a voting
principle whereby if one source diverges from the average value, it is
automatically rejected and the system continues to operate normally with the
remaining two sources. This principle applies to flight controls and flight
guidance systems.

However, there may be some cases where the airspeed or altitude output is
erroneous without being recognised as such by the ADIRS. In these cases, the
cockpit indications appear normal but are actually false and pilots must rely on
their basic flying skills to identify the faulty source and take the required
corrective action. When only one source provides erroneous data, a simple
crosscheck of the parameters generated by the three ADRs allows the faulty
ADR to be identified. This identification becomes more difficult in extreme
situations when two or all three ADR sources provide erroneous information.

Normally, each PRIM receives speed information from each ADIRU and
compares the three values. Pressure altitude information is not used by the
PRIM. Each FE computer receives both speed and pressure information from
each ADIRU and compares the three values.
In a failure situation, various combinations of ADR faults may occur, each
interpreted differently by the PRIM and FE computers:

· One ADR output is erroneous and the two remaining ADRs are
correct. The PRIMs and the FEs reject the faulty ADR. On basic
A333/A343 aircraft, there is no ECAM alert, however one PFD will display
some incorrect parameters. On the A346 and enhanced A333 aircraft, if
one ADR output is erroneous, and if this ADR is used to display the speed
information on either PFD, a NAV IAS DISCREPANCY caution is
triggered. In all cases, CAT3 DUAL will be displayed as an INOP SYS on
the STATUS page.

· Two ADR outputs are erroneous but different and the remaining ADR
is correct, or if all three ADR outputs are erroneous but different. The
AP and A/THR will disconnect. If the disagreement lasts for more than 10
seconds, the PRIM triggers the NAV ADR DISAGREE ECAM caution.
Flight controls revert to ALTN 2 law. The SPD LIM flag is displayed on
both PFDs, however VLS and VSW are not displayed. This condition is
latched until a PRIM reset is performed on ground without any hydraulic
pressure. However, if the disagreement was transient, the AP and A/THR
can be re-engaged when the NAV ADR DISAGREE message has
disappeared.

· One ADR is correct but the other two ADRs provide the same
erroneous output, or if all three ADRs provide consistent and
erroneous data. The PRIMs and FEs will reject the “good” outlier ADR
and will continue to operate normally using the two consistent but faulty
ADRs.

Any erroneous speed/altitude indication will always be associated with one or
more of the following cues:
· Fluctuations in airspeed indications
· Abnormal correlation of basic flight parameters (IAS, pitch, attitude, thrust,
climb rate); e.g IAS increasing with large nose-up pitch attitude, IAS
decreasing with large nose down pitch attitude, IAS decreasing, with nose
down pitch attitude and aircraft descending
· Abnormal AP/FD/A/THR behavior
· Stall or overspeed warnings
· Reduction in aerodynamic noise, with increasing IAS
· Increase in aerodynamic noise, with decreasing IAS

The ADRs provide a number of outputs to many systems and a blockage of the
pitot and/or static systems may also lead to the following:
· SPD LIM flag on PFD
· Alpha floor activation (because AOA outputs from the sensors are
corrected by speed inputs)
· Wind shear warning (due to Mach input)
· Flap load-relief activation
· Flap auto-retraction from 1+F to 1
· Alpha lock on slats retraction (due to the speed logic part of the alpha lock
function)
· ALTI DISCREPANCY on ECAM
· RUD TRV LIM FAULT ON on ECAM

Always apply the ECAM procedure. If the failure is not annunciated on ECAM,
crosscheck all IAS/ALTITUDE sources (ADR 1, 2, & 3, and ISIS/STBY INST).
Early recognition of erroneous airspeed indications requires some familiarity with
the relationship between attitude, thrust setting and airspeed. If it is positively
confirmed that the outlier ADR is at fault and that the other two ADRs are
correct, select the faulty ADR OFF. This action will generate an ECAM
procedure, which should be applied in order to reconfigure the PFD to display
correct information.

However, in very extreme circumstances, two or all three ADRs may provide
identical but erroneous data. If there is any doubt, then do not instinctively reject
the outlier ADR, although the temptation may exist if the other two ADR outputs
are consistent. In most cases, this decision would be correct, but not in the case
where two speed/altitude indications are consistent but wrong. Apply the initial
actions of the UNRELIABLE SPEED INDICATION QRH procedure from memory
as they quickly provide a safe flight condition in all phases of flight and aircraft
configuration. Rely on the primary flight parameters of pitch attitude and thrust
setting.

Because the displayed information may be erroneous, the flying accuracy cannot
be assumed. Incorrect transponder altitude reporting could cause confusion.
Therefore, declare a MAYDAY to advise ATC and other aircraft of the situation.
Reference to the QRH should only be made when a safe flight path has been
established. The QRH provides pitch attitude and thrust settings for each flight
phase and for different weights.

After applying the QRH procedure, and when the aircraft flight path is stabilised,
attempt to identify the faulty ADR(s). Once the faulty ADR(s) has/have been
positively identified, it/they should be switched OFF. This will trigger the
corresponding ECAM procedure, which should be applied.

Depending of the cause of the failure, the altitude indication may also be
unreliable. However, there are a number of correct indications available to the
crew:

Unreliable Parameter: Altitude

Disregard:
.. Altimeter
.. IAS/TAS
.. Wind
.. V/S
.. FPA

Use:
... GPS altitude (on GPS monitor page)
... RA (low level)

Unreliable Parameter: Speed

Disregard:
.. IAS/TAS
.. Wind

Use:
... GPS GS (on GPS monitor page)

When flying the aircraft with unreliable speed and/or altitude indications, it is
recommended to change only one flying parameter at a time; e.g. speed, altitude
or configuration. Consequently, plan to be at VAPP by the final approach fix.
______________
[addition for people not familiar with airliners procedures: this kind of Non-Normal Operation is to be found in every aircraft manual for such an issue; this is not only related to A330/A340]

Lemurian

2nd Jul 2009, 08:21

Hello,
This is a joint effort at describing what the messages tell us.
It's about how these ACARS messages could have been translated into the flight-deck environment and the piloting issues that we could see. I tried to keep as factual as possible except in two cases where there is some uncertainty as to the meaning of a message.
I also refrained from speculating as to the check-lists they could have performed, except the "unreliable airspeed" QRH procedure.

THE COCKPIT ENVIRONMENT

AUTO FLIGHT AP OFF : Red Master Warning light / Cavalry Charge

REAC W/S DET FAULT : Red Flag on PFDs

F/CTL ALTN LAW : Amber Master Caution / Chime

Flags on PFDs : Red “FD” Flags on PFDs

AUTO FLIGHT ATHR OFF : Amber Master Caution / Chime *

NAV TCAS FAULT : Red Flags on PFDs / NDs

Flags on PFDs : Red “SPD LIM” Flags on PFDs

F/CTL RUD TRV LIM FAULT : Amber Master Caution / Chime

Flags on PFDs : Red “FPV” Flags on PFDs

NAV ADR DISAGREE : Amber Master Caution / Chime

ISIS SPD/MACH Flags : Red Flags on ISIS SPD /Mach

IR2 FAULT : Amber Master Caution / Chime
(With extreme caution: It was only a “Maintenance Status at 0211Z,
If an ECAM fault was announced later, it would mean the loss of HDG
And ATT for the F/Os PFD and ND.)

F/CTL PRIM1 FAULT : Amber Master Caution / Chime

F/CTL SEC1 FAULT : Amber Master Caution / Chime

As one can see from this list, there is only one red warning : The Auto-pilot disconnect.
All the rest of the ECAM or PFD/ND messages are at a lower level and present no real urgency.
On the other hand, the annunciations, both aural and visual coming at a very high rate couldn’t have helped the crew to keep or regain any SA they had.

(*) See the A/THR issue below

FLIGHT MANAGEMENT AND PILOTING SITUATION

Task attributions in an abnormal situation are generally well defined in a modern flight-deck: One flies and communicates, the other manages the systems and the check-lists..

There is some uncertainty, though, as to who the “Pilot Flying” was. With the Captain in the LH seat, either one could have been it. During the Captain’s rest, only the most experienced co-pilot could have been PF and only from the RH seat, the second co-pilot being in charge of the systems, radio-com and navigation.(AF SOPs)
It was then up to him to keep an update of the weather at alternates, keep a sharp eye on the PETs between the alternates in an ETOPS environment, help with the radar… It’s also his job to compute at every reporting waypoint engine and speed parameters for turbulence penetration, altitude capability and possible step climb, the fuel situation…etc.,..

-What piloting instruments were available ?

It looks from the messages that they, quite early in the chain of events, lost SPEED and Mach information, both on the PFDs and the ISIS, and the FPV, flight path vector.
They, of course were without Flight Directors and auto thrust. The A/THR disconnect, apart from the amber caution light would have triggered a “Thrust lock” indication on the ECAM, indicating the need to use manual throttle.
Nothing else was lost…….until the possibility after 0211Z of an IR #2 failure, causing the loss of attitude and heading indications on the RH side. A “switching” to the IR #3 would have been needed to recover these indications on the F/O’s side.
The ISIS, also minus speed indication could have been used...but from the RHS ? Not easy and vertigo-inducing.
So, we’re left with the necessity of an “UNRELIABLE AIRSPEED INDICATION” check-list, in itself a non-event in most conditions. In this case, they had the speed, they had the thrust..just match the T/Ls with the present N1 and they would have been very close to the needed parameters for level flying at the same speed.

-Alternate Law handling issues.
With the “ADR DISAGREE” situation the flight control laws would have reverted to “ALTERNATE LAW 2”, with most of the envelope protections unavailable except the load factor in pitch.
-Roll Direct : there is a direct stick-to-surface relationship. All ailerons are available and spoilers 2, 3 and 6 are used for roll augmentation (until 0213Z that is, as the loss (?) of SEC1 would render spoiler #6 on both sides unavailable).But there is enough surfaces to guarantee a minimum of 20°/s roll rate if needed.
By personal experience, alternate law flying is hardly noticeable : the ailerons feel a bit heavier and slower to respond but that’s about it.

Dysag

2nd Jul 2009, 08:22

A draft of a final report will always be reviewed by manufacturer and operator before release. Is it so surprising that they also get sight of a first report?

Furthermore, the Air France CEO is more or less re-stating the BEA's terms of reference: reveal the established facts at this stage and not enter into speculation of cause.

marchino61

2nd Jul 2009, 09:18

Furthermore, the Air France CEO is more or less re-stating the BEA's terms of reference: reveal the established facts at this stage and not enter into speculation of cause.

I agree - I think you will find this is standard practice for most (all?) countries' accident investigators, that the initial report is only a statement of the facts known so far.

gonebutnotforgotten

2nd Jul 2009, 09:45

Re Lemurian's instructive post about the likely cockpit scene. quote (emphasis added):

So, we’re left with the necessity of an “UNRELIABLE AIRSPEED INDICATION” check-list, in itself a non-event in most conditions. In this case, they had the speed, they had the thrust..just match the T/Ls with the present N1 and they would have been very close to the needed parameters for level flying at the same speed.

By personal experience, alternate law flying is hardly noticeable : the ailerons feel a bit heavier and slower to respond but that’s about it.

This is a point which I, as a non airbus ex-pilot, find not only interesting but possibly the key to the question often raised in this thread about why AF447 came to grief while others survived a similar emergency.

As I understand it, in all laws other than direct, the basic pitch law remains C*, which means that the stick demands vertical acceleration, and the aircraft exhibits no natural speed stability. So while alternate may well be a no-brainer in smooth conditions, just how easy is it in turbulence? In a conventional aircraft in severe turbulence one is taught not worry about altitude but to gently control attitude within bounds and leave the trim severely alone. But from the A320 onwards, the side stick idoesn't control attitude directly, and the Horizontal Stabiliser is free to do its own thing (unlike conventional controls where if you don't touch it, it stays put).

The thread on LH landing accident at Hamburg last year revealed widespread lack of understanding of the Airbus control laws in roll (specifically what to in a cross wind, with many contributors swearing that it was totally conventional, it isn't), is there a similar lack of knowledge being shown here, in an admittedly much less common situation?

Even if the conditions in which AF447 found itself were not as awful as some have suggested, I can well see how skills appropriate to conventional aircraft may have been inadequate on that night.

Lemurian

2nd Jul 2009, 10:04

and the aircraft exhibits no natural speed stability
Careful here with the vocabulary.
"high - or low - speed stability" refers to a somewhat degraded protection that uses pitch control to prevent an over -or under -speed situation : too fast and a gentle pitch-up is introduced, too slow and a nose-down pitch comes in.
Aerodynamically, the aircraft is just like any other "un-protected" product, and they generally don't fall from the air in droves !

Meikleour

2nd Jul 2009, 10:16

Lemurian

I beg to differ with your comment about handling in ALT2 being little different. Have you experienced this in flight rather than in the sim? I have flown an A330 in ALT2 due to a twin ADR disagree situation (one blocked pitot + a different failed ADR) and I was quite surprised at how rapidly the aircraft banked versus the normal roll rate. It also exibited a strong natural tendency to return to wings level with the stick neutral. It is very easy to overbank in ALT2 law.

Lemurian

2nd Jul 2009, 10:32

Meikleour,
Your experience is better than mine, then. I bow to it.
I understand that you adapted and didn't overbank, or did you ?
The tendency towards wing level is what I remember, and I put it into the "heavier feel" that I experienced.
A contribution like yours is important as, past the factual treatment of the ACARS messages, the hypothesis on how this cockpit could have looked like (and the resultant conclusion that - on the basis of the ACARS messages - that situation was quite manageable), the airplane still crashed.
So, IMO, we have to string in more information.
I hope that we'll learn some more this afternoon.

gonebutnotforgotten

2nd Jul 2009, 11:43

Lemurian,

Aerodynamically, the aircraft is just like any other "un-protected" product, and they generally don't fall from the air in droves !

Agreed, I'm not arguing that the A320+ series aircraft are naturally speed unstable , I know they are not, but the question is how do they appear to the pilot who is interacting with them through the side stick via some subtle control law logic? If I have misunderstood how C* works, then perhaps someone could put me right, but as I see it, in normal and alternate laws, the stick commands vertical acceleration, while the speed is controlled by the AT. if AT is disconnected then the pilot has to control speed directly through via the thrust levers, but the aircraft will have no tendency to regain any particular speed once disturbed. If this is not the case, could someone explain how the pitch control laws change when the AT is disconnected? It was noticeable that the encyclopaedic description of control systems posted a few hundred posts ago dealt with the 'hip bone's connected to the thigh bone' aspect of the system, and not with how the confounded thing actually works. In partial answer to your reply to Meikleour, I think 'the airplane still crashed' because it wasn't easy to control it in those circumstances (night , turbulence, no speed indications, warnings coming at you every 3 secs, and no natural speed stability), and understanding of the subtle differences between these FBW aircraft and conventional ones is not good.

UNCTUOUS

2nd Jul 2009, 11:48

Takata’s citation (post 2686 (http://www.pprune.org/rumours-news/376433-af447-135.html#post5035315)) from the FCTM (Flight Crew Training Manual) would seem to be endorsing the theory put forward by UNCTUOUS at posts 2219 (http://www.pprune.org/rumours-news/376433-af447-112.html#post5015371) and 2412 (http://www.pprune.org/rumours-news/376433-af447-121.html#post5023126)
Most failure modes of the airspeed/altitude system are detected by the ADIRS
and lead to the loss of the corresponding cockpit indication(s) and the triggering
of associated ECAM procedures. The fault sensing logic relies on a voting
principle whereby if one source diverges from the average value, it is
automatically rejected and the system continues to operate normally with the
remaining two sources. This principle applies to flight controls and flight
guidance systems.

However, there may be some cases where the airspeed or altitude output is
erroneous without being recognised as such by the ADIRS. In these cases, the
cockpit indications appear normal but are actually false and pilots must rely on
their basic flying skills to identify the faulty source and take the required
corrective action. When only one source provides erroneous data, a simple
crosscheck of the parameters generated by the three ADRs allows the faulty
ADR to be identified. This identification becomes more difficult in extreme
situations when two or all three ADR sources provide erroneous information. etc etc ...
From a private email: AF447 FPV & Ps data
Excellent piece of lateral thinking on the Static ports. I have been struggling to interpret the Flight Path Vector flag on the PFD (see ACARS PFR). Whilst the FCOM & FCTM make no reference to static pressure data as an input to the FPV I have in the past come across reference to the FPV being unusable when static pressure data is unreliable.

With detected erroneous static pressure data one expects airspeed/Mach, altitude, vertical speed, FPV, AP/FD and ATC altitude reporting to be affected. Setting the ultimate component aside, and noting the ACARS shows flags for the FD, shows an AP involuntary disengagement, shows PFD FPV flags, along with speed/Mach function for the ISIS and a variety of detailed messages regarding pitot-probes, one is at a loss* to explain the lack of reports for altitude and vertical speed.

Static isn’t just the hash detected by the ears. Obstructed/iced static lines may prove to be the glue that ties in all the AF447 esoteric failure indications. Read Takata’s entire FCTM citation and you get the impression that the safety factor afforded by triple redundancy is more precisely a fallible fallacy foisted upon a gullible coterie of aviating automatons.
.

Grayengineer

2nd Jul 2009, 12:30

It is a little disturbing to see experienced captains arguing strongly on opposite views on how to use weather radar. The view that 447 with two FOs flew into a monster is not hard to imagine now. I think that out of this investigation will be the need to make this equipment easier to use and part of sims.

takata

2nd Jul 2009, 12:54

UNCTUOUS:
Static isn’t just the hash detected by the ears. Obstructed/iced static lines may prove to be the glue that ties in all the AF447 esoteric failure indications. Read Takata’s entire FCTM citation and you get the impression that the safety factor afforded by triple redundancy is more precisely a fallible fallacy foisted upon a gullible coterie of aviating automatons.Hi,
I agree with the general point saying that the static pressure was at some point contamined as the TCAS and Cabin controller reacted also, altitude being also unreliable, but we don't know the error magnitude for sure. It could be a function of dynamic pressure correcting static pressure.

As for the pernicious contamination from the ground, I do not share your point because:
1. the system reacted and disconnected the flight envelope protections, showing that it was an abrupt change of air data stream at 0210.
2. the flightpath doesn't show any acceleration of F-GZCP during her whole flight.
3. GPS altitude could be used to control Indicated altitude at any time.
4. Your premice being "loss of control between 0210-0214" is based on nothing acertained until now; this is by far not the only possibility behind this catastrophe. We'll certainly learn more in a few minutes about it.

Then, your "fallible fallacy foisted upon a gullible coterie of aviating automatons" is falling short of your main point. A triple redundant air data system linked to automation or a triple redundant system linked to no automation would not change the problem of icing all the probes beyond specification or beyond design limit (here is pointed the Thales 'AA' probe as underperforming due to drainage system). Beside, triple analogic instrumentation showing three different unreliable value-sets won't help the pilot very much for the same reasons.

S~
Olivier

blueloo

2nd Jul 2009, 13:14

Any updates on the FDR/CVR recovery - a couple of false(?) reports of the pingers being detected early on, and unfortunately no hint of the signals being heard since then....

Graybeard

2nd Jul 2009, 13:32

Thanks for the replies, PJ2 and Takata.

First:
"Hm, it may be "unexplained" but I don't think it is inexplicable. I think the TCAS indicated "failed" because of the absence of good data from ADIRS 1. I don't think it's more complex than that."

-----------

Each LRU, Line Replaceable Unit, as in the ADIRU, is a conglomeration of separate, often independent, functions, i.e.:
Altitude - independent computation, save for low speed trim.
Airspeed - depends on altitude for computation.
Vertical Speed - depends on altitude/rate
Pitch
Roll
Heading
Ground Speed
Lat/Long
etc.

Each of these functions outputs one or more words on a common Arinc 429 data bus. The receiving device recognizes and sorts the words by their three digit identification labels. Each word has its own SSM, Sign Status Matrix to tell the receiving device its health. The receiving devices may also receive the same words from the other sensors, to use in case of Fail Warn from the primary, or for comparison.

A blocked pitot, for example, will not disable altitude computation, nor IRU functions. This was seen in the Delta/NW incident.

TAM and others loss of airspeed AND altitude indication to the pilots indicates a different situation entirely. It provides evidence of a static source problem, such as frozen static lines, rather than iced pitot, or in addition to iced pitot.

GB

deSitter

2nd Jul 2009, 13:32

Upshot - BEA say it did not break up in flight but entered the water vertically at high speed.

So, explain the perfectly intact tail.

-drl

takata

2nd Jul 2009, 13:37

deSitter:
Upshot - BEA say it did not break up in flight but entered the water vertically at high speed.Absolutely incorrect:
"L'avion est entré au contact de l'eau en ligne de vol avec une forte acceleration verticale"

Meaning:
en ligne de vol = horizontaly (not verticaly)
+ acceleration verticale = stalled

No mention of the global impact force from the conference, I need to read the report. But no surprise from the press headlines, it was too technical to be understand rightly (certainly inacurately translated). I have watched the conference on TV.

deSitter

2nd Jul 2009, 13:40

takata, I am quoting verbatim from the english tranlsation of the briefing I was just watching on CNN, repeated twice - the plane entered the water vertically (same word in French, impossible to mistranslate I assume - I could not hear the French commentary).

-drl

Squawk_ident

2nd Jul 2009, 13:40

Mr Bouillard said that the vertical stabilizer is likely to have detached from the back to the front with a slight movement to the left.
Aircraft touched the ocean in a state of flight with a strong vertical acceleration

deSitter

2nd Jul 2009, 13:43

takata - "ligne de vol" is direction of flight - "acceleration verticale" means just what is says.

"L'avion est entré en contact de l'eau en ligne de vol avec une forte acceleration verticale" - The airplane made contact with the water on a line of flight with a strong vertical acceleration. I suppose this could be considered ambiguous by some. There is no report posted on BEA website yet.

-drl

BOAC

2nd Jul 2009, 13:46

Squabble, Squabble, Squabble - we're off again. It is UNBELIEVABLE! Bar a few posters, no-one appears capable of getting anything right on this thread:ugh:

Shall we wait for the official statement, (translated correctly into English?)....and as for quoting CNN:ugh:

takata

2nd Jul 2009, 13:48

deSitter:
takata - "ligne de vol" is direction of flight - "acceleration verticale" means just what is says.Thank you for explaining me what it means in my mother tongue!
"Ligne de vol" is attitude of flight, not direction. Even French people without aviation understanding (e.g. translators) may be confused, but it is the meaning.

S~
Olivier

deSitter

2nd Jul 2009, 13:50

BOAC - no one is "quoting CNN", I was repeating VERBATIM the words of the running English translation of the live briefing.

-drl

Wilbur60

2nd Jul 2009, 13:51

Sleepypilot

I didn't mean a diversion for weather,of course,but diverting to an enroute AIRPORT for landing...!!
In this particular case the Capt. got a wake-up call in the bunk when nearing the (new) tod..
Have a nice nap,chap

Wilbur

Squawk_ident

2nd Jul 2009, 14:04

The last ACARS transmission was received at 02.14.28 (UTC time)
No FPL transmission was received by Dakar although Atlantico had a telephone call to Dakar with the element of AF447.
At 02.01 a contact through ADS (Air Data System) was attempted by the crew to join Dakar
Part of radar protection "radôme" and engine(s) protection were recovered.
No life jacket were found inflated
It seems that only Madrid and then Brest Control started to worry near 0800/0830 (local)

Up till the 10/07 BB signal may be received. After the 14/07 other means should be used (??)

Idle Thrust

2nd Jul 2009, 14:10

I have read this thread with interest and hesitated to post but now that the subject of "dry thunderstorms" has been raised, I'll make a small contribution.

Most of my career was spent flying in the northern hemisphere, a lot of it fairly far "north" at that. Towards the end of my 20K hours my employer began routes across the ITCZ and after some long chats with a friend with extensive experience there, I was very concerned about running into a CB which did not paint on the radar in the dark. He talked of using NVGs and various radar techniques to avoid such an event.

A couple of points, first I always made certain that I was in the cockpit during the ITCZ phase of flight - the bunk was not an option. Second I learned from other pilots that there were some creative ways to use the radar to detect CBs that would otherwise go undetected due to the lack of moisture. I won't go into them here, mainly because memory has caused details to fade, the point is that the use of radar is not an exact science - experience and technique is crucial. And that may well have been a factor in this accident.

I think I was as close to the edge of my seat transiting the ITCZ as I ever was during a CAT III approach to an icy runway.

Edited for format.

mollyd

2nd Jul 2009, 14:11

With differing translations I think we need to wait for the official one!

Air France jet 'broke on impact'

French investigators trying to find out why an Air France plane crashed in the Atlantic say they believe it broke up on contact with water, not in the air.
They said they reached that conclusion after examining the plane's wreckage.
All 228 people aboard the plane were killed when it plunged into the ocean en route from Rio de Janeiro to Paris on 1 June.
Teams looking for the plane's flight data recorders will continue operations for another 10 days, an official said.
Alain Bouillard of the investigating team said the plane probably hit the water belly-first.
He said the plane "appears to have hit the surface of the water in flying position with a strong acceleration".
The investigators also said that faulty speed sensors, which were suspected of being behind the crash, had been "a factor but not the cause".

Graybeard

2nd Jul 2009, 14:17

Hmm, the "impossible" flat spin of a jet transport.

protectthehornet

2nd Jul 2009, 14:19

I appreciate the translation problems. But, if the plane ''landed on its belly'', can we think that the crew made an effort to land upon the water (ditch)?

could the plane have stalled, lost a massive amount of altitude and had its engines quit, recovery at the last second (albeit with a high rate of descent...vertical acceleration) and the crew tried for a landing?

I think we will never really know what happened without the CVR/FDR.

----

also wondering if the plane was spinning at time of impact...could plane have come down in a flat spin?

Lemurian

2nd Jul 2009, 14:24

Takata, attention !!!!!!!
Absolutely incorrect:
"L'avion est entré au contact de l'eau en ligne de vol avec une forte acceleration verticale"

Meaning:
en ligne de vol = horizontaly (not verticaly)
+ acceleration verticale = stalled
That's a very fast conclusion, to which, I for one do not subscribe.

Actually, He said the plane "appears to have hit the surface of the water in flying position with a strong vertical acceleration".
(stress by me)
is a lot more correct.

Beausoleil

2nd Jul 2009, 14:32

.
I was merely explaining that it is not sufficient to divide (catastrophic events) by (fleet flight hours) in order to verify the probability of an event.

"The probability of an event" is not a well defined concept. You need to ask a specific question, then use historical data appropriately to get a quantitative answer.

Dividing the number of catastrophic events by the number of fleet flight hours gives you the answer to the question "What is the probability that an A330 will experience a catastrophic event in any given hour chosen at random from a spectrum of flights similar to those the fleet has undertaken so far?"

This number wouldn't be appropriate, for instance, to figure out the probability of a catastrophic event in a flight that routinely experienced severe turbulence (by which I mean turbulence like the AF flight encountered - I may have the terminology wrong), because the underlying sample of flights is not representative of that situation. For that, you should ask how many A330s encountered severe turbulence to date and use that as the base population.

However, if the question is "should we ground all A330s today?" dividing the catastrophic incidents to date by the total flight hours to date is not an unreasonable way to gain a quantitative piece of information.

Insofar as long haul aircraft probably all fly roughly the same spectrum of routes, there doesn't seem much evidence that the A330 is more dangerous than the others. One question would be "why ground just that one?"

Dagger Dirk

2nd Jul 2009, 14:42

ref Takata's post 2694 (http://www.pprune.org/rumours-news/376433-af447-135.html#post5035910)
As for the pernicious contamination from the ground, I do not share your point because:
1. the system reacted and disconnected the flight envelope protections, showing that it was an abrupt change of air data stream at 0210.
2. the flightpath doesn't show any acceleration of F-GZCP during her whole flight.
3. GPS altitude could be used to control Indicated altitude at any time.
4. Your premise being "loss of control between 0210-0214" is based on nothing acertained until now; this is by far not the only possibility behind this catastrophe.

I think that UNCTUOUS was inferring that the water present in the static lines froze and expanded in the lines at height - blocking the static line and locking in the static pressure. That can happen as a function of:
a. water pooling (flowing from another area after the climb and due to angle of incidence in the cruise)
b. thermal soak (cooling time - explaining why it took around 3 hours)
.
If, in consequence, the sudden ADIRS disagreement precipitated an autopilot disconnect, then it's possible that a loss of control ensued (due to Alternate Law coupled to heavy handed inputs at a height at which pilots aren't used to hand-flying anyway). Very few pilots would have hand-flown at FL300 and above.
If pitch protection is still in force in Alternate Law, during an upset it may well work AGAINST a successful recovery. Anybody who's practiced unusual attitudes knows that once a jet's nose drops significantly below the horizon at speed, you are then battling to not exceed VNE/max Mach by a wide margin. Success there is tied to generating drag via g, after (but not whilst) rapidly finding wings level then pitching back up to the horizon (and using idle thrust/speedbrakes to control the rate of speed increase). All this depends upon having a valid attitude source. If you don't, then the LOC becomes terminal due to disorientation. If pitch protection affects the rate at which you can pitch, then likewise you are probably going to exceed VNE by a VERY wide margin.

That's what likely happened in the 4 minutes immediately prior to the final ACARS msg. Any less rapid a sequence would have permitted at least a Mayday call to have been transmitted.

SLFinAZ

2nd Jul 2009, 14:45

Speaking as an SLF i think this defines the conundrum and the appropriate path of action very nicely...

"One either submits to the designer's and engineer's intentions or as a professional aviator one draws a firm line over which the engineer is not permitted to cross. Hand-flying isn't "practise" - it is the finest way to maintain situational awareness. It is a human-factors defence activity which necessarily requires thinking and the attention of everyone."

I think in the end the effect of automation on the pilots ability to aviate under conditions of extreme duress goes to the heart of the matter. In my mind the thousands of hours a senior captain acquired hand flying under stress (arrival/departure in traffic, takeoff/approach in adverse weather etc) mentally prepared him for the unexpected. The more complex the mental aspects of "normal" flying the easier to transition to handling a truly catastrophic event (while a sim will help your preprepared since you know something will go wrong).

BOAC

2nd Jul 2009, 14:52

Well, still a way to go on the 'announcements' it would seem. Original translation now amended.
Crash: Air France A332 over Atlantic on Jun 1st 2009, aircraft impacted ocean (http://avherald.com/h?article=41a81ef1/0035&opt=0)

Dutch Bru

2nd Jul 2009, 15:05

http://www.bea.aero/docspa/2009/f-cp090601e1/pdf/f-cp090601e1.pdf

Squawk_ident

2nd Jul 2009, 15:07

http://www.bea.aero/docspa/2009/f-cp090601e1/pdf/f-cp090601e1.pdf

In English

http://www.bea.aero/docspa/2009/f-cp090601e1.en/pdf/f-cp090601e1.en.pdf

BOAC

2nd Jul 2009, 15:14

Thanks for the effort, DB, but I think there is either a problem with the link or access is restricted?

SaturnV

2nd Jul 2009, 15:17

It takes a while to download. The pdf version is 128 pages.

Dutch Bru

2nd Jul 2009, 15:19

For me the link works fine, BOAC even clicked from my post.

It's a heavy document though (> 11MB and 126 pages and of course in French....)

But here is the BEA page with a link to the english version which, surprise, surprise, is "only" 72 pages (I'll look for the differences though it may take a bit of time....)

News (http://www.bea.aero/anglaise/actualite/actu.htm)

Direct link:
http://www.bea.aero/docspa/2009/f-cp090601e1.en/pdf/f-cp090601e1.en.pdf

Razoray

2nd Jul 2009, 15:19

Crash: Air France A332 over Atlantic on Jun 1st 2009, aircraft impacted ocean
By Simon Hradecky, created Thursday, Jul 2nd 2009 13:11Z, last updated Thursday, Jul 2nd 2009 15:16Z
The BEA has concluded their press conference introducing the results of their investigation and their preliminary report so far.

The key sentences have been (according to simultaneous English translation by BEA):

- No technical problems with the airplane before the takeoff.
- The airplane did NOT break up in flight.
- The 24 ACARS messages refer to the loss of airspeed (pitot tubes)
- The airplane also lost information about the direction the airplane was going to.
- The airplane hit the ocean in a flat attitude at high vertical speed.
- Weather was a classic ITZ scenario.

Nothing had been found before June 6th, then the first bodies and parts have been found. Parts from the nose to the tail of the airplane have been found including parts of the structural body of the airplane, one part of the engine and parts of the main cabin have been recovered. No clothes have been found, recovered life vests were not inflated. 51 bodies were recovered.

One of the cockpit walls has been found deformed. A large part of the crew rest room has been found, impact marks indicating that something came from the bottom up to the top. The debris recovered so far suggests, that the airplane did not break up in flight, but went down vertically.

Three other flights (IB-6024 [A343, Rio De Janeiro GIG-Madrid MAD 12 minutes behind AF-447], LH-507 [B744, Sao Paulo GRU-Frankfurt FRA] 20 minutes behind AF-447, AF-459 [A332, Sao Paulo GRU-Paris CDG 37 minutes behind AF-447]) tracked the route ORARO to TASIL between FL350 and FL370 around the time of the crash. They all had to avoid storm cells and diverted from the airway between 11 and 80nm. They experienced moderate turbulence. All three flights had problems to establish communication with Dakar. There were no satellite phone conversations from those crews.

The weather in the Intertropical Convergence Zone was a classic scenario with storm cells.

The airplane had started the engines at 22:10Z and got airborne at 22:29Z. Last radio communication was at 01:35Z. No transfer had been completed from Rio's control to Dakar control. An attempt by the AF-447 crew to establish contact with Dakar Control has been detected at 02:01Z (the wording to the means of communication was unclear, supposedly it was a digital data transmission via ACARS). No distress call was detected.

First alerts were sent at around 8:30 (unclear whether GMT, local Europe, local Brazil).

The BEA refuses to believe, the black boxes would not be found, however stated, that the search for the recorders will be terminated on July 10th.

The Original BEA English translation said: The airplane went down vertically, a review of French wording offers a different picture however stating, that the airplane came down in a flat attitude at high vertical speed.

The full preliminary report has just been published: French Version (13MB) (http://www.bea.aero/docspa/2009/f-cp090601e1/pdf/f-cp090601e1.pdf) and English Version (3MB) (http://www.bea.aero/docspa/2009/f-cp090601e1.en/pdf/f-cp090601e1.en.pdf).

takata

2nd Jul 2009, 15:22

Dagger Dirk:
I think that UNCTUOUS was inferring that the water present in the static lines froze and expanded in the lines at height - blocking the static line and locking in the static pressure. That can happen as a function of:
a. water pooling (flowing from another area after the climb and due to angle of incidence in the cruise)
b. thermal soak (cooling time - explaining why it took around 3 hours)Ok, why not but suddendly like that? And once it is frozen, after around 3 hrs, why would the static lines just became clean all together after few minutes, and why maintenance would not discover any problem (beside the pitot-probes) once grounded?

I'm much more prone to believe that this is an explanation in order to twist the sequence and legitimate the following:
.
If, in consequence, the sudden ADIRS disagreement precipitated an autopilot disconnect, then it's possible that a loss of control ensued (due to Alternate Law coupled to heavy handed inputs at a height at which pilots aren't used to hand-flying anyway). Very few pilots would have hand-flown at FL300 and above.Well, at FL350, the aircraft is flying level and all Airbus are flown in direct law without much trouble (ask Lemurian, it is like a 737). They have even been certified like that, before introducing the various level of fligh envelope protection. Not a single report from any previous freezing incident included the quote: "we were left with an uncontrolable aircraft impossible to be hand flown because A/THR and AP disconnected"...

If pitch protection is still in force in Alternate Law, during an upset it may well work AGAINST a successful recovery. Anybody who's practiced unusual attitudes knows that once a jet's nose drops significantly below the horizon at speed, you are then battling to not exceed VNE/max Mach by a wide margin. Here is the main point. But sorry, pitch protection disengaged in ALT2. Moreover, we already know the altitude (FL350) and speed (cruise) at 0210, it was sent by the positional report few secs before the first ACARS. The aircraft wasn't at all in an uncontrolable attitude at this point.

Success there is tied to generating drag via g, after (but not whilst) rapidly finding wings level then pitching back up to the horizon (and using idle thrust/speedbrakes to control the rate of speed increase). All this depends upon having a valid attitude source. If you don't, then the LOC becomes terminal due to disorientation. If pitch protection affects the rate at which you can pitch, then likewise you are probably going to exceed VNE by a VERY wide margin.Sure, but nobody previously lost control, just maintained pitch and power and waited until the speed come back. In your scenario, the aircraft is starting to break appart... but, sorry, she didn't and it is now confirmed as a fact. Moreover, the area searched so far was a 80 km circle around her last position and they didn't found any wreckage at the botom of the sea. => she didn't crashed around this point.

That's what likely happened in the 4 minutes immediately prior to the final ACARS msg. Any less rapid a sequence would have permitted at least a Mayday call to have been transmitted.Who told you that they didn't tried to transmit a Mayday?
Nobody heard from them on radio/statelite. Their last contact with Brazilian ATC (0145 and few secs). Then, the tried, without success, to contact Dakar at 0201 (the call was logged). Dakar ATC wasn't informed of AF 447 flight plan from the Brazilian ATC... go figure, it takes the Spanish ATC to give an alert at 0615 utc. Moreover, the BEA presented the fact that the closest aircraft (AF, IB, LH) had all experienced transmition problems in this area at the same time. None were able to use their VHF.
ACARS are relying on SATCOM. There is plenty of reasons why SATCOM could stop transmiting. One is a double engine failure (e.g. engine icing or stalled if they lost control).

Last point from the BEA conference: they underlined that nobody recieved any AF 447 report of "strong turbulences" during this flight. The 0145 ATC contact was her last. Neither ATC or Air France (as I suspected it from the first Air France conference) recieved anything.

PJ2

2nd Jul 2009, 15:24

GB;
Hmm, the "impossible" flat spin of a jet transport. Ouch.

Not impossible, merely improbable given possible entry into a thunderstorm.

http://i277.photobucket.com/albums/kk76/batcave777/boac911falling.jpg

One thing flight safety investigators and specialists don't do is hitch their wagon to theories and stick with them in the face of new evidence. I would have thought (and did) that, as the impact is described, a high-speed vertical trajectory in a flat attitude/spin, (indicating a very high angle of attack), would have resulted in greater evidence of a) compression stress and b) evidence of shattering of parts instead of large intact structures but there it is.

How this conclusion was reached will be revealed in the coming days/weeks but at least we know more now and it will be fascinating to learn how this was concluded.

Carjockey

2nd Jul 2009, 15:28

The aircraft did not break up in flight

Well I would like to believe that, but without benefit of CVR/FDR, just how did BEA establish this "fact"?

SaturnV

2nd Jul 2009, 15:34

The English version is 55 pages shorter and looks to be minus the annexes.

Oilandgasman

2nd Jul 2009, 15:34

During the Press Conference the BEA stated that they would "listen" for the CVR and FDR for another 10 days and then they would continue the search with another method (sonar?) "until these units were found"
It was also stated that the aircraft impacted the sea tail first slight bank to the left and almost flat. This conclusion reached from evidence on the VS, which was torn from the fuselage aft to forward, the galley tray damage and pieces of the cabin floor which were bulged upwards. It was also stated that the A/C accelerated to the surface of the sea. He also stated that the A/C did not call Senegal and three other aircraft crew interviewed, who flew the route within 30 mins of AF447, had encountered moderate turbulence and had diverted from 10 to 80 kilometers from course to minimise the impact of this. These A/C also heard nothing from AF447. The pitot problems were stated to be "involved in the incident but not the sole cause" No sign of the presentation being posted on the net as yet.

Mercenary Pilot

2nd Jul 2009, 15:48

Well I would like to believe that, but without benefit of CVR/FDR, just how did BEA establish this "fact"?By engineering analysis on the wreckage, much is known about structural deformation and they can accurately tell how the aircraft came apart.

They can specify facts without the FDR/CVR's.

lomapaseo

2nd Jul 2009, 15:56

PJ2

One thing flight safety investigators and specialists don't do is hitch their wagon to theories and stick with them in the face of new evidence. I would have thought (and did) that, as the impact is described, a high-speed vertical trajectory in a flat attitude/spin, (indicating a very high angle of attack), would have resulted in greater evidence of a) compression stress and b) evidence of shattering of parts instead of large intact structures but there it is.

How this conclusion was reached will be revealed in the coming days/weeks but at least we know more now and it will be fascinating to learn how this was concluded.

Well I thought that you and others had got it mostly right. I had interpreted the largely intact parts as being from a flat low forward speed impact with the water and the recovered parts significantly protected from severe damage by the hydraulic crushing of the planes underbelly.

The only evidence of hydraulic crushing that I might have recognized was the bottom of the crew rest module in the belly (I had pointed to this earlier as of interest).

Of course the crushed metal fragmentated pieces would have sunk.

I like you will be interested on their change of opinion from their earlier comments about it breaking up in the air to the supposedly new comments about it being intact in their latest release.

I hestitate to form an opinion based solely on the reports in the news (I don't trust their interpretations or translations). However I do look forward to this board's interpretations since we have enough divergence of experiences to not miss the more subtle stuff:ok:

SaturnV

2nd Jul 2009, 16:00

Given this has been the subject of some interest:

Co-pilot #1:
Airbus A330 type rating issued 1st October 2002
• Line oriented flight training completed 25 October 2002

Flying hours:
o total: 6,547 flying hours
o on type: 4,479 flying hours

Co-pilot #2

Airbus A330 type rating issued on 1 December 2008
• Line oriented flight training completed 22 December 2008

Flying hours:
o total: 2,936
o on type: 807

takata

2nd Jul 2009, 16:14

PJ2:
One thing flight safety investigators and specialists don't do is hitch their wagon to theories and stick with them in the face of new evidence. I would have thought (and did) that, as the impact is described, a high-speed vertical trajectory in a flat attitude/spin, (indicating a very high angle of attack), would have resulted in greater evidence of a) compression stress and b) evidence of shattering of parts instead of large intact structures but there it is.

How this conclusion was reached will be revealed in the coming days/weeks but at least we know more now and it will be fascinating to learn how this was concluded.

Well, the vertical part on the report is "high vertical acceleration" (observed in recovered objects relative to their horizontal position in the airframe), this mention quoted of "high-speed vertical trajectory" just doesn't exist in the report. There is nothing on it to deduct a flat/spin right now. I guess that any ditching would cause a fair amount of "high vertical acceleration" depending of the aircraft pitch when the cabin hit the water.

I'm still reading the report, it is fairly long and detailed.
S~
Olivier

SaturnV

2nd Jul 2009, 16:20

From the English Version:
1.12.2 Identification of the items recovered
The identification of the debris shows that it consists mainly of light items belonging to the cabin fittings and holds (bulkheads, galley, ceiling or floor panels, seats, overhead baggage bins, cabin and hold lining).

Approximately thirty pieces are external parts of the plane (vertical stabiliser, pieces of the radome, the engine cowl, the under belly fairing, the flap actuator fairing, the trimmable horizontal stabiliser and the secondary control surfaces). The identified debris thus comes from all the areas of the plane.

An ELT distress beacon with manual tripping was also recovered. This had not been actuated. Its switch was found in the “OFF” position.

1.12.3 Visual inspection
A first visual inspection brought to light the following.
The tail fin was damaged during its recovery and transport but the photographs available made it possible to identify the damage that was not the result of the accident. The middle and rear fasteners with the related fragments of the fuselage hoop frames were present in the fin base. The distortions of the frames showed that they broke during a forward motion
with a slight twisting component towards the left.

Part of the radome was found, representing approximately a fifth of its circumference along its upper part.

The galley, identified as G2, located at the level of door 2 on the right-hand side, was not very distorted. Baskets and racks were compressed in the lower part of both galley carts.

The distortions observed in the metal vertical reinforcements of a toilet door showed evidence of great compressive forces

Fragments of the walls of the flight crew rest module were crumpled and those of the ceiling were deformed downwards. The floor was curved under the effect of a strong upward pressure from below. The connecting brackets between the floor and the walls were bent backwards.

1.12.4 Summary of visual examination
Observations of the tail fin and on the parts from the passenger (galley, toilet door, crew rest module) showed that the airplane had likely struck the surface of the water in a straight line, with a high rate vertical acceleration.

1.13 Medical and Pathological Information
Sailors from the Frigate Ventôse recovered about thirty bodies. A visual examination of the bodies showed that they were clothed and relatively well preserved. All of them were handed over to the Brazilian Navy to be transferred to the Recife morgue. At this stage of the investigation, the BEA has not yet had access to the autopsy data

HarryMann

2nd Jul 2009, 16:21

One of my ground school instructors had been accident investigator in the USAF. He said victims of a flat spin were intact in their seats, just dead.A gross appproximation maybe! The tell-tale would be as in the LHR Staines accident, yes 'likely' to be still strapped in, but with compressed verterbae almost uniformly.

Look, there's a whole host of people here, maybe pilots maybe not, but this is engineering and kinematics stuff, or a lot of it is... accident investigation - certainly impact dynamics is NOT necessarily just about flying and piloting knowledge, unless so many have had a lot of accidents & walked away... there's opinions flying about like wasps in a jam-jar here, and that's all most of them are, 6 possibilities back ther in ONE post!!

We need to take deep breath... and let some experts think this through a bit.

====

For what it is worth, 'high acceleration' an engineer usually means in this context... a/c arrived with large deceleration upon impact e.g. it was travelling fast & stopped very quickly.

High acceleration is just they way it is said... inplying large forces.

I also interpret the previous line to mean the trajectory was predominantly vertical but the attitude was predominantly horizonatal (line of normal flight)

In fact much as takata said...

syseng68k

2nd Jul 2009, 16:23

What doesn't quite sync is that we are told that the VS broke off with pressure from back to front, yet also that the ac hit the water flat ?.

Looking at the photos of the VS and what must have been the considerable force involved in it's separation, how could this have happened aka the reported scenario ?. All the leverage would be in the wrong direction.

PJ2

2nd Jul 2009, 16:25

jehrler;

Sorry, should have titled it- it is an amateur photo taken of the BOAC 911, B707 which broke apart mid-air due turbulence over Mt. Fuji on the 5th of March, 1966; the information on the web indicates that the tail broke off towards the end of the vertical, flat-attitude descent; the photo illustrates what many would call a "flat-spin" but I would characterize as a "brick" because the airplane isn't "spinning" in a way most think of as a spin. The main factor is, the airplane is fully stalled; you can see the "lumpy", turbulent air above the wings, made visible possibly by the vaporizing fuel pouring from the wings or condensation caused by the very low pressure above the wings as "the brick" fell vertically. Bit clinical I know, but those are the dynamics.

hellsbrink

2nd Jul 2009, 16:28

Well I would like to believe that, but without benefit of CVR/FDR, just how did BEA establish this "fact"?

Easily. Compression. It says so in the (english) report. Certain parts that were recovered and, according to the report, were compressed as the floor came up and the ceiling stayed where it was (compressing things there too). That would never happen with the aircraft breaking up in mid air (and, realistically, I would reckon there would have been more debris found if it had) as the compressive forces, on different parts of the aircraft from nose to tail, as various bits would have hit at a different speed so wouldn't have a "uniform" compression.

Two bits to pull out of the report...

Recovered bodies were fully clothed...... Can we stop all the speculation of clothes being ripped off as the aircraft fell apart at 35k?

VS broke off in a FORWARD direction......... I do hope that was a mistranslation.

HarryMann

2nd Jul 2009, 16:33

Looking at the photos of the VS and what must have been the considerable force involved in it's separation, how could this have happened aka the reported scenario ?. All the leverage would be in the wrong direction.It's possible the aircraft could have been somewhat tail-down & travelling backwards at time of impact - though fundamentally descending vertically..

Have you heard of a 'falling-leaf' mode.. of course you have, the body is shuttling between 2 or 3 different modes of descent, first backwards and then flipping and travelling forwards.

The HS tail & wings would have broken off too, and the fuse into parts as well either side of the centre-section probably, but of course, the VS is positively buoyant and came back up.

I agree breaking off forward is what in the US they call 'counter-intuitive'

I believe the damage to the lower rudder area might be one piece of evidence that has produced this conclusion, but not the only one. In fact , if so, this shows what an incredibly strong structure the VS is...

PJ2

2nd Jul 2009, 16:42

HarryMann;
We need to take deep breath... and let some experts think this through a bit.
Yes, exactly.

One thing this new information affords, if correct, is, the location of the impact point can be more closely approximated using the kinds of techniques we have seen described working backwards from where the vertical stab was located.

If this new assessment of the condition of the aircraft's descent and impact is true, the recorders will not have been ejected as projectiles at some point at high altitude but will be within a smaller radius of the yet-to-be-determined point of impact of an intact airframe, deep-water ocean currents notwithstanding.

hellsbrink

2nd Jul 2009, 16:43

It's possible the aircraft could have been somewhat tail-down & travelling backwards at time of impact - though fundamentally descending vertically..

Ok, not a flyboy (as y'all know) but that is the scenario that crossed my mind too and not a "Top Gun" style flat spin from 35k.

What could cause that to happen as I didn't think it was really possible unless under some really strange circumstances (have a theory but won't share it)? I mean, I thought you tended to go "nose down" in a stall (or soon after) so this "Flat Backwards" bit is bugging me. So is it *possible* or is it, as I posted earlier, a mistranslation?

SaturnV

2nd Jul 2009, 16:55

Pj2, the search grids are for a 40 nm radius circle centered on the last known position "derniere position connue" with additional grids to the west, and to the north to Tasil. Unfortunately, the chart only gives longitude for the squares, and no latitude. The search grids do not extend to the east or southeast beyond the circumference of the circle.

"Le premier message de position (message de type AOC) a été émis le 31 mai
à 22 h 39. Le 1er juin à 2 h 10 min 34, la dernière position reçue était +02,98°
(nord) de latitude et -030,59° (ouest) de longitude. La position transmise est
la position FM de l’avion. En conditions normales, cette position est proche de
la position GPS."

SaturnV

2nd Jul 2009, 16:59

The VS en francais, for those who doubt the English version.

La dérive a été endommagée pendant sa récupération et son transport mais les photos disponibles permettent d’identifier les dommages qui ne résultent
pas de l’accident. Les attaches du milieu et de l’arrière avec les fragments de cadres de fuselage associés sont présentes en pied de dérive. Les déformations
des cadres montrent qu’ils se sont rompus dans un mouvement vers l’avant avec une légère composante en torsion vers la gauche.

avant = forward

lomapaseo

2nd Jul 2009, 17:07

Are some of you describing a scenario where the aircraft falling looks like the video of the F117 airshow crash over Baltimore MD?

BOAC

2nd Jul 2009, 17:09

I fear this is now going badly for AI and all who promote FBW and the 'protection' offered by multi-redundant systems and software.

IF the a/c had been thought to have broken up at high or medium level due to 'exceptional' turbulence' then Force Majeure could have been declared.

As it is, barring some unknown other structural failure (HS or forward section separation?), it is looking as if all these 'protections' didn't. There is the bad news for a 'failsafe' design.

I sense this will reverberate heavily.

hellsbrink

2nd Jul 2009, 17:09

HarryMann

2nd Jul 2009, 17:13

Can I ask again, a recent question of mine that wasn't answered at the time

In the cruise with relatively aft c.g. (due to trim drag tank being full/relatively full)

What is the effect on this aft c.g. posn. (33% MAC?) when the system reverts to Alt2 law or even Direct law?

Obviously the pitch stability (c.g. closer to Neutral Point) is less strong, wondering if anyone has even contemplated this, let alone flown this config in the simulator?

Thanks...

hellsbrink

2nd Jul 2009, 17:18

From the (english) BEA report http://www.bea.aero/docspa/2009/f-cp090601e1.en/pdf/f-cp090601e1.en.pdf

1.6.3 Weight and balance
The aircraft left the gate with a calculated weight of 233,257 kg. The estimated takeoff weight
was 232,757 kg (11), for a maximum authorised takeoff weight of 233 t. This takeoff weight
broke down as follows:
• empty weight in operating condition: 126,010 kg,
• passenger weight: 17,615 kg (126 men, 82 women, 7 children and one baby (12)),
• weight in cargo compartment (freight and luggage): 18,732 kg,
• fuel weight: 70,400 kg.
(11) A quantity of 500 kg of fuel had been taken into account for taxiing between the ramp and takeoff
brake-release.
(14) Air France applies a standard weight of 91 kg for a man, 72 kg for a woman and 35 kg for a child,
which is compatible with the European regulations.
18
The on-board fuel weight corresponded to forecast trip fuel of 63,900 kg, route factor fuel of
1,460 kg, final reserve of 2,200 kg, fuel to alternate airport reserve of 1,900 kg and 940 kg
additional fuel. An LMC corrected the definitive load sheet to take into account one passenger
fewer without baggage.
The balance corresponding to the aircraft’s takeoff weight and given on the definitive load
sheet (after LMC) was 23.3% of the MAC, for a forward limit of 22.7% and an aft limit of
36.2% at takeoff.
On the basis of the operational flight plan, it is possible to estimate the trip fuel at 27.8 t after
a flying time of 3 h 41 min (13), the aircraft would then have had an estimated weight of 205 t
and balance comprised between 37.3% and 37.8 % (14), which is within the limits of the operating
envelope (Operating Manual TU page 12.28.10.9).

Will Fraser

2nd Jul 2009, 17:23

It truly doesn't seem to jell. If a/c impacted "flat" with high velocity, how did the VS separate 'forward'. Likewise, if the VS failed at altitude (separated) to fail forward the a/c was travelling 'tail first'. I also don't get completely the 'Ligne de vol'. Do they mean that the heading of the a/c was in its planned direction? That would be coincidental without directional control. How could that have been determined? Similarly, if the VS separated 'on site' why no major dimpling, compression, or tearing?

Its condition still suggests an airborne failure, leaving the Fuselage to decelerate and perhaps 'flutter' to the sea before the major portion of the airframe.

gonebutnotforgotten

2nd Jul 2009, 17:25

Takata

Are you sure it is as easy to fly as you suggest:

Well, at FL350, the aircraft is flying level and all Airbus are flown in direct law without much trouble (ask Lemurian, it is like a 737). They have even been certified like that, before introducing the various level of fligh envelope protection. Not a single report from any previous freezing incident included the quote: "we were left with an uncontrolable aircraft impossible to be hand flown because A/THR and AP disconnected"...

The preliminary report says (note on page 54):

Note : la loi de commande alternate 2 est une loi en facteur de charge en tangage et loi directe en roulis. Seule la protection en facteur de charge reste disponible. Dans certains cas, les stabilités haute et basse vitesses peuvent également être disponibles.

As I understand it there is no way for the crew to revert to direct law at FL350 (though I gather there are some at low speed). So my previous comments still stand, I wouldn't be confident that my basic handling skills, such as they were, acquired on conventional aircraft, would have served me well on that night. To judge from this thread, not many AB pilots have thought through how they would control the aircraft in this condition, and it looks as if the FCOM doesn't help a lot either.

Rustum

2nd Jul 2009, 17:26

Hellsbrink:

VS broke off in a FORWARD direction......... I do hope that was a mistranslation.

SLF here and I have a few 'common sense' questions because I do not see a problem with the VS having come off with forward movement:

1. Would it be correct to assume that the plane did not fall quite like a brick, i.e. at a right angle, into the ocean?

2. That some forward momentum sheared the VS's attachments, these emerging as weak points at the moment of impact because of uncommon forces acting on it?

Thank you

Grayengineer

2nd Jul 2009, 17:27

The VS would have torn off forward if the a/c had some forward speed and abruptly stopped, since the VS wants to keep it's forward motion (Newton's First Law).

slip and turn

2nd Jul 2009, 17:28

I only have schoolboy French but does not 'rompus dans un mouvement vers l’avant avec une légère composante en torsion vers la gauche.' indicate 'broken in a forward motion WITH a LIGHT (not heavy*) torsional component to the left' i.e. spin?

Edit: Sorry everybody - had to have my French corrected by Jig Peter "légère" = LIGHT Thanks Peter:ok:

jcarlosgon

2nd Jul 2009, 17:28

HarryMann (http://www.pprune.org/members/215217-harrymann)

Can I ask again, a recent question of mine that wasn't answered at the time
In the cruise with relatively aft c.g. (due to trim drag tank being full/relatively full)
What is the effect on this aft c.g. posn. (33% MAC?) when the system reverts to Alt2 law or even Direct law?
Obviously the pitch stability (c.g. closer to Neutral Point) is less strong, wondering if anyone has even contemplated this, let alone flown this config in the simulator?

Good question, that some of us, moving from A310 to A330, ask. On the 310 the turbulence procedure includes forward fuel transfer, but not on 330.

I’ve only flown Alternate Law in the sim at low altitudes, so the CG is always ahead of about 28%. In cruise is about 36 to 38% most of the flight.

Grayengineer

2nd Jul 2009, 17:36

With regards to debri and detachments at impact. With such a high vertical deceleration many of the structural componments will act like springs and after being deformed will spring back and may cause great internal stress revisted by the springback. This could have "thrown" the VS and other objects away or within the a/c.

Jig Peter

2nd Jul 2009, 17:36

@slip & turn

"légère" = LIGHT
Salut !!!

Meikleour

2nd Jul 2009, 17:39

Lemurian,

In my incident we were in cirrus cloud with ice flowing up the windscreen (SAT -50C note!) when all speed indications to the left PFD were lost (Vmax and VLS came together) and right PFD speed dropped to an inaccurate 160kts. A/P and ATH disconnected. The ECAM was almost unreadable due to it constantly streaming and changing. Alternating `STALL, STALL` and high speed warnings received. What was initially the most pressing problem was to maintain the speed down to the ALT2 MMO of .82M versus normal MMO.

Once out of icing after a priority descent the probes cleared and the flight continued for ~1.5 hrs to destination - still in ALT2 law. This happened 14 years ago and resulted in several changes to the hardware and software of the A330.

Graybeard

2nd Jul 2009, 17:42

I believe the aft fuselage that supports the Vertical Stabilizer is unpressurized, and may not have to be as strong as the pressure vessel.

The plane hit the water tail-low. That could have forced the aft fuselage to bend or break upward into the rudder, ripping the entire assembly free, and leaving the damaged bottom of the rudder as evidence.

GB

SaturnV

2nd Jul 2009, 17:46

Flights preceding and following AF447:

Flight LH507 (B747-400) preceded flight AF447 by about twenty minutes at FL350. The crew reported that it flew at the upper limit of the cloud layer and then in the clouds in the region of ORARO. In this zone they saw green echoes on the radar on their path, which they avoided by changing their route by about ten nautical miles to the west. While flying through this zone, which took about fifteen minutes, they felt moderate turbulence and did not observe any lightning. They lowered their speed to the speed recommended in turbulent zones. They saw bright St Elmo’s fire on the windshield on the left-hand side. The crew listened into the 121.5 MHz frequency throughout the flight without hearing any message from AF447.

Flight IB6024 (Airbus A340) passed at the level of the ORARO waypoint at FL370 approximately twelve minutes after AF447. The crew saw AF447 take off while taxiing at Rio de Janeiro. When passing the INTOL waypoint, they encountered conditions typical of the inter-tropical convergence zone. These conditions were particularly severe 70 NM to 30 NM before the TASIL waypoint. They moved away from the route by about 30 NM to the east to avoid cumulonimbus formations with a significant vertical development, and then returned to the airway in clear skies close to the TASIL waypoint.

Flight AF459 (Airbus A330-203) passed at the level of the ORARO waypoint approximately 37 minutes after l’AF447. The sky was clear but the half-moon, visible to the aft left of the aircraft, did not make it possible to see the contour of the cloud mass distinctly. After flying through a turbulent zone
in the head of a cumulus congestus formation at the level of NATAL, without having detected this zone on the radar, he selected gain in MAX mode. At about 2 h 00, he observed a first echo that differed significantly depending on whether the radar’s gain was in CAL or MAX mode. The TILT was set between -1° and 1.5°. He decided to take evasive action to the west, which resulted in a deviation of 20 NM to the left of the route. During this evasive
action, a vast squall line with an estimated length of 150 NM appeared on the screen, which was set to a scale of 160 NM. The echoes were yellow and red when the radar was set with gain on the MAX position and green and yellow when the gain was on the CAL position. No lightning was observed.
ATLANTICO control, informed by the crew of their decision to avoid this squall line by taking evasive action to the east, asked them to return to the airway as soon as they could. This evasive action meant the aircraft flew between 70 and 80 NM to the right of the planned route. In addition, the crew was authorised to climb from FL350 to FL370.

Road_Hog

2nd Jul 2009, 18:00

As stated in every proper safety briefing, the life jackets should not be inflated until the wearer is clear of the aircraft.

Quite right, but two things, how many aircraft impacts at sea, result in survivors and also, I don't think it was a case of inflated life jackets, I think it was a case of nobody wearing one.

Coming back to an original post/point of mine, AF decleared it a lightning strike as the cause almost immediately and have never explained this opinion. They should be asked to explain this view.

Also, the theory was, a few days ago, that the aircraft must have broken up in flight, because of the two different groupings of bodies recovered, even accounting for tidal/wind conditions. This seems to be contrary to the current official announcement.

Grayengineer

2nd Jul 2009, 18:05

Tail low impacts seem to tear the tail section from the pressure bulkhead, but usually, from the pictures of such crashes the VS stays on. Haven't seen enough to say for sure.

Grayengineer

2nd Jul 2009, 18:15

Most of the a/c damage was compressional - horizontal components in cabinets pancaked and vertical components survived intact if not in perfect condition. Also the large sections have multiple cracks much like when a plate is dropped as an analogy. Also the deck being bent upward would require a huge vertical pressure load - e.g. water. I agree with the French engineers of the type of damage versus impact mode.

hellsbrink

2nd Jul 2009, 18:16

SLF here and I have a few 'common sense' questions because I do not see a problem with the VS having come off with forward movement:

1. Would it be correct to assume that the plane did not fall quite like a brick, i.e. at a right angle, into the ocean?

2. That some forward momentum sheared the VS's attachments, these emerging as weak points at the moment of impact because of uncommon forces acting on it?

Thank you

1. BEA are, effectively, saying she went in "flat". So she could have flown like a "Branson Balloon", but not in a vertical alignment. They say she went in hard so certain things do make sense (and other "theories" disproven).

2. No, I'm questioning the report saying the VS came off in a forward direction based on the rear and centre mounts "existing". Surely, if the force was "forward", the rear mounting point would fail first as it would pull beyond it's stress point as it would be being stressed the most first. Maybe whoever typed up the report had brain fade for a minute?

wes_wall

2nd Jul 2009, 18:47

No surprise paxs were without life preservers. This was not a prepared emergency. The airplane was not attempting to ditch.

EGMA

2nd Jul 2009, 18:59

If the VS failed due to rapid forward deceleration I would expect to see more damage at the leading edge adjacent to the tail cone - there is virtually none, just a missing fairing.

A forward deceleration would cause the VS to 'cart wheel'; its C of G is some distance above the attachment points.

Perhaps I misunderstand the report ...

ClippedCub

2nd Jul 2009, 18:59

Alain Bouillard of the investigating team said the plane probably hit the water belly-first.

They're not sure?

They think the plane was intact upon impact because the debris and bodies have been located within 100nm or more of each other after days at drift and they've found parts from different parts of the plane. Reverse drift charts would show if that range collaspes at ground zero.

The state of the vertical tail is what I've been saying all along, the afterbody broke from around it. The tail didn't break off in the forward direction, the afterbody broke away in the aft direction upon water impact in this case. Until they quit saying 'probably hit the water water belly-first', and say that all damage from front to back of the plane shows consistant orientation of failure, then I'm not ruling out inflight breakup.

Yes, airliners will flat spin with aft cg, and they'll regular spin just fine too.

takata

2nd Jul 2009, 19:01

gonebutnotforgotten:
The preliminary report says (note on page 54):

Note : la loi de commande alternate 2 est une loi en facteur de charge en tangage et loi directe en roulis. Seule la protection en facteur de charge reste disponible. Dans certains cas, les stabilités haute et basse vitesses peuvent également être disponibles.

As I understand it there is no way for the crew to revert to direct law at FL350 (though I gather there are some at low speed). So my previous comments still stand, I wouldn't be confident that my basic handling skills, such as they were, acquired on conventional aircraft, would have served me well on that night. To judge from this thread, not many AB pilots have thought through how they would control the aircraft in this condition, and it looks as if the FCOM doesn't help a lot either.

Hi,
Ok. My understanding of what you say is that you are totally confused about how those Airbus are flying and what people are saying. The direct law is what is left when all computer assisted protections are gone. The only one remaining when going to Alternate Law 2 (with an airspeed disagreement triggered) is the load factor airframe protection on pitch axis as all other computer assisted protections are derived from various speed vectors (high speed, low speed, alpha prot, etc.).

loi alternate 2:
- "facteur de charge en tangage" (pitch, full deflection limited to +30/-15 deg and imputs are corrected in order to not exceed the load factor limited to +2.5g/-1.0g).
- "directe en roulis" (roll = direct, stick imputs = aileron moving, 20 deg/sec)
- "directe en lacet" (rudder = direct, stick imputs = rudder moving, full deflection is still limited to a function of speed depending on the last accurate speed until slats are deployed).

What some people do understand by reversion is that the flight controls are being degraded when, in fact, it is the computer various protections which are degraded depending on what data the computer is still able to process.

And yes, direct law is the mode used to test fly any new aircraft going off the assembly lines at which every basic pilot is trained... and all your "basic handling skills, such as they were, acquired on conventional aircraft" would have served you very well because you would have a conventional aircraft to fly.

S~
Olivier