AF 447 Search to resume (part2) [Archive] - Page 10

bearfoil

24th May 2011, 14:25

3holelover

As an addendum to your reply to Diversification, I would say that in an earlier discussion it was determined that once in ALTLAW2, Normal Law is inop for the rest of the flight, until the system can be re-indexed.

My recall of the B-2 Guam crash is that in re-indexing the computers in the evening prior to launch, the ground crew neglected to dry out the sensors, and the data loaded was bunk for TO. GIGO. The pilot's of the Liberty had no mystery, when the Computers yack, Adios amigo. Not so pretty clear with AB.

Re 447, a transport of conventional airframe architecture, one could start a train of thought that included, "If not in Normal Law, then straight to direct." The B-2 cannot be flown in any fashion by hand, so its experience is suggestive only. One gets the notion in following this (AB) discussion that in the stink, one needs to know how to fly at least four different a/c.

One cannot wish to hire BoxMonitors and also expect a "Four-in-one Type Rating." Aviation will NEVER be so predictable that one can expect pilots under normal circumstances to revert to "golden arms"* on a milsec's notice.

Machinbird

I think it fair at this point to say "Raise the Nose Up". There is precedent, and neither can be supported by the information at hand, at least not conclusively. Finally getting the nose down, the crew may have succeeded too well, and could not raise it once again. It fits into what happened at Perpignan (loosely).

There was a Pitch problem by definition. Considering the RoD, why not at least consider more than one "recovery" of Pitch authority?

aside. BUSS was one of two systems discussed earlier, along with the unselected AH at the upper left of Captain's Panel. Bean counting can bite.

DozyWannabe

24th May 2011, 14:35

Dozy and syseng68k, I am not trying to be alarmist - but I do find it very telling of the entire world of developing software, that tools like APL, FORTH, and Smalltalk, which are purpose-built for solving specific problems, are universally scorned in favor of bloated "software development universes"

There's your first problem - Smalltalk took a while to catch on in the commercial world, but it has set the stage for languages like Haskell, which are general-purpose, but with very clearly-defined functional properties. They still have to be compiled into machine-readable instructions though...

It may be OK to wade through such dross while sitting in the data center, but pilots with a troubled airplane don't have time to think about such things.

I don't know how many more times we can say this before it sinks in, but:

they don't. Safety-critical real-time software uses a completely different paradigm to any other software development methodology you care to name.

badgerh

24th May 2011, 14:47

It really takes me back all this discussion of IT and SE. I worked on the "Green" compiler for a short while and it was very clear when DoD selected Green as the official Ada language, everyone from Jean Ichbiah down accepted that Ada needed a lower level tasking mechanism than that provided by Green. It did not happen until 95.

deSitter might realise that the A320 flies with 60 000 lines of code, something that would not even get a "Hello World" working in Windoze:=. Small, tight, well tested packages that do a specific task without any excess bloat are the tools that are needed to build ultra-reliable systems. While many could argue with the specification for Airbus' FBW system, few could argue that it does anything other than what the box says (that is good software engineering)

HazelNuts39

24th May 2011, 15:24

I recall reading in the forum (...) that A330 SOP for unreliable air speed called for CT and 5degrees up nose.

The 'Maneuvre d'urgence' contains a note that refers to the follow-up procedure 'Vol avec IAS douteuse/ADR Check' that is reproduced in BEA's Interim Report #1, Appendix 9. There you'll find for FL250 - 370, W>190t: 3.5°/90%N1.

PJ2 has explained that a pilot would not be expected to go to 5° at FL350 and M.82.

gums

24th May 2011, 15:41

Salute!

The B-2 crash was another topic that got my attention like the AF447 one. Guess I am a FBW freak. STOP ME before I read/post/mull/wonder again!!!!

Most of the links do not work now, but someone might find the accident report referenced in this URL from the F-16.net.

http://www.f-16.net/f-16_forum_viewtopic-t-10556.html

Worth a read, as one of the designers chimes in with some good poop.

Some of the pilot's comments are very revealing., as in "...plane was doing exactly what it was supposed to be doing..." I have heard that this past week or so someplace.

jcjeant

24th May 2011, 16:15

Hi,

The 'Maneuvre d'urgence' contains a note that refers to the follow-up procedure 'Vol avec IAS douteuse/ADR Check' that is reproduced in BEA's Interim Report #1, Appendix 9. There you'll find for FL250 - 370, W>190t: 3.5°/90%N1.

PJ2 has explained that a pilot would not be expected to go to 5° at FL350 and M.82. :confused:

http://i.imgur.com/LF5fM.jpg

Golf-Sierra

24th May 2011, 16:30

Why bother? Back to pilot training. We can also do that. We SHOULD be trained to do it (some are).

But what are the limits of what a pilot can do? Set the pitch and adjust the power, OK. Is your average (or even above average) pilot going to be able to factor in issues such as aircraft weight, CofG, bleed and generator load to name a few and select the right values? Will the pilot have any sort of spatial awareness of what is going on with the aircraft? There was a case when a jet took off with the static ports taped up - somehow setting power/pitch didn't ensure a good outcome in that case.

Computers can tackle problems such as these. There are millions of flight hours worth of data available covering thousands of parameters of an aircraft such as the A330. I can imagine that by processing this data it would be possible to develop a probabilistic model of the actual dynamics of the aircraft. Computer processing power is available to analyse the actual flight parameters against such a reference database real-time and (a) identify any discrepancies, (b) extrapolate to a high degree of certainty any missing parameters. The real challenge will be to get such solutions certified.

The pitot-static system relies on a duplication of the same devices to achieve redundancy. This approach was far too simplistic for the computers - not only are they multiplied - but they are in fact totally different computers. If we expose 3 identical probes mounted more or less on the same place to the same conditions we are far more likely to encounter multiple failures then if we have different devices. Why were not the same criteria as applied to the fbw computers applied to the air-data system?

ChristiaanJ

24th May 2011, 16:47

As for rtos, my (avionics) experience in that area is not current, but iirc,
there are at least two rtos's that are fully qualified to DO178 level, so it's
quite likely that they are being used. My avionics experience is not current either.....
Wot's an 'rto'? (other than a rejected take-off)?

thanks for your post on state machines.... saved it. We never used that 'notion', but then I'm an analog dinosaur.... Was a good time actually, until the µP asteroid hit.

RR_NDB

24th May 2011, 16:48

Hi,

Why were not the same criteria as applied to the fbw computers applied to the air-data system?

Simply, because (it seems) there are no solutions yet available (sensors) to have the (could provide) required redundancy.

In an earlier post you could find patents filed by Airbus SAS on sensors (laser based).

We heard about another solution being prepared for short time UAS. A Software based "hysteresis like" band-aid.

kilomikedelta

24th May 2011, 16:52

ChristiaanJ; RTOS= real time operating system K

areobat

24th May 2011, 16:58

Forgive me if this has already been covered - I have tried to keep up on the thread, but the posting has been very prolific.

I work with sensor driven control systems and have noted that when exposed to slightly abnormal conditions, sensors using the same design initially tend to degrade toward failure in a very similar manner. In redundant sensor systems this can result in a common mode error which may be difficult or impossible to detect. It is only when abnormal conditions become excessive and the sensors become erratic that they provide enough differential error to be detected.

Since the ADR's depend on differential errors to detect potential sensor faults, it seems to me that if all pitot tubes initially began to degrade at about the same rate (perhaps due to water buildup at the drains), such a common mode degradation would not be detected initially and would fool the system into believing that the A/C was traveling faster than it really was. The AP would respond accordingly and slow the A/C down. Then, as water/ice build up continued, the differences in readings would have exceeded the error detection threshold for the system, causing the AP, etc to disconnect. But when that finally happened, the A/C would be going slower and closer to the stall speed than the computed flight envelope would expect.

Could a scenario like this have robbed the crew of precious time needed to make corrections? Are there parameters recorded on the FDR that could be used to determine retroactively that something like this occurred?

syseng68k

24th May 2011, 17:05

gums, #2226

back to my cave, now, as the press is now focusing upon "deep stall" and
such. And my pea-brained background causes me to wonder how a system
that works as advertised can allow ( maybe even cause) the confused
aircrew to wind up in a loss of control accident. I thought all those
control laws and sub-laws, and sub-sub-laws would help just a bit.
Something that's been bothering me for some time as well. I'm really not
concerned what language is used to program the system, or any other software
related issue, as the field is by and large, well proven. What does bother
me is more of a human factors issue. If the whole idea of automation is
to reduce workload and do something predictable under all circumstances,
how is it that the system can max out the crew by too many or ambiguous
warning messages to the point that they have no idea of the state of
the aircraft ?. Speculation ?. Well perhaps, but how did a perfectly
servicable aircraft with a highly competent crew just fall out of the
sky ?.

The other point, again, is the probes. It cannot be beyond the wit of man
to design a probe that doesn't overheat on the ground, yet has enough
capability to melt ice under worse case conditions. Any engineer looking
at this cold would put in one or more temp sensors such as platinum film or
even a simple thermostat, perhaps a 3 term controller and big fat heating
element. No on/off switches or modes needed either, further reducing
workload and possibility of human error.

All 3 probes are currently of similar design and would thus be expected
to fail in a similar way worst case, representing an effective single
point of failure. Avoidance of single point failure is the first line of defense
in any safety critical work, especially relevant in this case when one
considers how important the probe info is for safe operation of the aircraft.

Someone correct me if i'm adrift here, but "for want of a nail" seems
quite appropriate w/respect to the probes...

CogSim

24th May 2011, 17:24

When everything is said and done, if the root cause points beyond a doubt to crew action or lack thereof, the approach taken will be, "if it ain't broken, don't fix it". The most recent AIT from Airbus already points in that direction. Given the complexity of systems involved, on the whole, it may the wiser approach. Improvements will come when they are ready. Until then just fly the airplane.

Not saying its good or bad, just the way it is.

Lonewolf_50

24th May 2011, 18:03

All 3 probes are currently of similar design and would thus be expected to fail in a similar way worst case, representing an effective single point of failure. Avoidance of single point failure is the first line of defense in any safety critical work, especially relevant in this case when one considers how important the probe info is for safe operation of the aircraft.

Someone correct me if i'm adrift here, but "for want of a nail" seems
quite appropriate w/respect to the probes...

I think this point is worth repeating, in terms of what a redundant system is, and what it isn't. Unless there is something different about each probe, they represent a potential (in terms of being in identical environment) single point of failure in three part harmony. :( Given the criticality of the probess function, how different can they be and still provide the input that permits airspeed to be used by both the flight crew and the computers in the flight control system?

I'll ask the Airbus drivers a question that has come up before: would an AoA gage (which is apparently not common in any airliner design, and for most regimes of flight a supplemental scan item) be a useful addition to the flying display?

AoA is already detected and provided to the system for protections and laws. Is there a good reason not to feed AoA to the flight crew? Adding "one more thing" to the display or HUD or instrument panel isn't to be done lightly, given ergonomics and scan development.

Or, is the general consensus something like this:

if you are flying, your charge is to stay ahead of the aircraft far enough to avoid getting into marginal AoA conditions? From the comments in this, and a host of other threads regarding varying mishaps, I get the impression that adding an AoA gage isn't perceived as the way ahead.

*shields up*

bearfoil

24th May 2011, 18:07

syseng68k

hello chris. This was a long train on BA038. Redundancy, Reliability, and Reconciliation.

"...All 3 probes are currently of similar design and would thus be expected
to fail in a similar way worst case, representing an effective single
point of failure. Avoidance of single point failure is the first line of defense
in any safety critical work, especially relevant in this case when one
considers how important the probe info is for safe operation of the aircraft...."

************************************************************ *****

Aviation IS "single point". Flying an aircraft is not overly complicated, yet we are discussing complex ways to approach simple things. Of course the solution is complex, it proposes to be so. One Pitot is all one needs. If it plugs, we heat it. If it has a wasp nest in it, my bad. If it has tape over the hole, also my bad, though I did not install the tape. To fix to an a/c three of the same type of pitot is not only redundancy, it is the raison d'etre for three separate flight computers. Collecting, reconciling and determining are slick computer work, but something has to re-simplify to input the single command that keeps the a/c flying. Of course since flight is dynamic, it is composed of sensing trends, and arresting bad behaviour. It is usually no more difficult than juggling one ball. But Nature being who she is, sometimes it requires the panache to juggle two balls. Then Three, etc.

When navigating in a complex system, it takes time, man or machine.
One can have simple, or one can have complex, but one cannot apparently have both. At least not quickly, also apparently. Something about 447's situation caused the autopilot to quit. No big, hand fly. One does not understand why it is called for to "troubleshoot" the thing that caused the issue. Hand fly. She troubleshot herself, hence ACARS, which have nothing to do with aviating.

It really is that simple. If any argument can be proven that these gents got confused, I'll consider it. If they did, who paid them to do it? Who "trained" them to ?

It is counterintuitive. Laugh if you like, intuition in a professional is money in the bank.

It was NOT the pitots. Something got in between a patent and ho hum gotcha and the pilots. Who let the dogs out?

PJ2

24th May 2011, 18:10

syseng68k;
The other point, again, is the probes.

. . . .

Someone correct me if i'm adrift here, but "for want of a nail" seems
quite appropriate w/respect to the probes...
Respectfully, I disagree.

The point in this accident is NOT the probes.

A loss of airspeed information is not cause for Loss of Control.

A series of ECAM messages and chimes, (expected, with such loss of data), is not a cause for LOC.

A loss of attitude information IS cause for LOC but as far as we know, that did not occur here.

In previous pitot incidents, the exact same ECAM messages occurred. The crews continued to fly and within a few moments/minutes indications returned to normal.

We see such "ECAM streams" of multiple faults/failures in the simulator, during practised dual hydraulic failures for example.

As aircraft systems degrade, they engage in their monitoring/BITE behaviours and, according to their individual timings in sending data to the FWC which in turn are distributed to the CMC, DMUs etc, there will be a cascade of re-prioritizing messages until things settle down. I have seen such streams, many times in the simulator, once, during a serious hydraulic emergency in the air. In such circumstances, one must slow things down, wait and respond deliberately, with "pace", but not hurry.

I have previously observed that the UAS QRH drill memorized items to set the pitch at 15, 10, or 5deg and to set the power to the TOGA detent or in the last two cases, to the CLB detent, are intended for immediate "safe" responses right after takeoff, (catering to the Birgenair and Aeroperu accidents). The qualifying condition is at the end of the memorized items, which states that once the aircraft is above the MSA it should be leveled off for "troubleshooting". Such troubleshooting means getting out the QRH and reading-doing the checklist items. The first items involve appropriate pitch and power settings for weights and altitudes.

Ergo, none of the memorized items in the UAS QRH checklist applied here.

The first response would be to do nothing and touch nothing while the QRH was brought out.

The airplane was stable before the event, and, short of significant disturbance either through heavy turbulence, (thunderstorm entry) or intentional alteration of pitch or, (to a lesser extent) power, the aircraft should remain in a stable state for a reasonable period of time while the P1 hand-flies the aircraft and calls for the UAS drill, and the P2 brings out the QRH.

Contrary to some of the ill-informed statements made here and in the media by those who have never flown, or who have never flown the A330, this airplane hand-flies beautifully at all flight levels and is not a "hand-full", unless, like any airplane, it is near/at the boundaries of flight it was designed for and the crew trained for.

The crew could respond to all the messages, once the ECAM had settled down...it doesn't take long, but the professional airline pilots here I'm sure will say that slowing things down a tad (but not dragging it out), and gathering thoughts before launching, is a key to successfull handling of very complex and serious events. One must get one's surprise and rush of adrenaline under control first, then, as a crew, begin.

Even DP Davies advises "lighting up a pipe", (so to speak!), before rushing into drills. He quite markedly states that the only drill which must be done swiftly, accurately, with discipline and deliberation is the rejected takeoff.

However this unfolds on Friday and in the subsequent months, we must bear in mind first, the families whose loved ones died in this accident and set aside any desire to be "first" or "right" with this or that solution to this accident. The presentation of the actual data will not resolve all questions and, as many have already observed, "the crew" are a part of a very complex, dynamic system in which human factors will inevitably play a part.

robertbartsch

24th May 2011, 18:18

What information should we expect from crash investigators later this week? I assume they will not be drawing any conclusions on the likely causes at this juncture; right?

Smilin_Ed

24th May 2011, 18:24

Snowfalcon2
Some sort of airspeed sensor (as opposed to groundspeed, as provided by GPS and inertial) therefore seems fairly indispensable, at least for critical flight regimes at high altitudes and approach/landing phases where the local wind needs to be considered.

Angle of Attack works just great at approach and landing speeds. AoA is the primary speed sensor for carrier landings. At cruise speeds, it's not sufficiently sensitive.

sirgawain123

24th May 2011, 18:29

PJ, respectfully, I understand your explanations, acknowledge your type experience, and consider a nose up command as inappropiate at cruise speed /height for an unreliable air speed event , but No single sentence in the AF card posted here restricts its use to a below_MSA or take_off condition!

And pilots DO Train to follow the card or SOP, not our instinct (provided there is a card /SOP )

Lonewolf_50

24th May 2011, 18:36

PJ:

I will defer to your deeper understanding of this flight problem set.

I will offer, as a point related to training, that since airspeed is an imbedded element of an instrument scan, and a critical performance measure in any instrument scan, the unexpected lack of it disrupts the scan. The "don't pay attention to the airpspeed" scan is a non-standard scan, and (IMO, I am biased due to some years of training pilots) should be practiced so that the PF is flying and crosschecking while deliberately ignoring a fundamental scan item ... while the PNF is doing as you illustrate, and handling the trouble shooting.

EDIT: I don't think I need to tell any experienced pilots this, but for those who aren't -- if you don't practice and use your instrument scan habitually, it tends to start off a touch slow when you begin to use it at need. Also, if you don't practice your degraded mode scan, your scan will tend to be slow (initially) when you need to implement that scan pattern. How much time did this crew have to get into that rhythm? Don't know.

This I have seen first hand, not only in my own flying, but also in hundreds of other pilots, when I gave them instrument checks or was being the SOB at the console for a simulator training event intended to "run them through the wringer." This observation applies to both inexperienced and experienced pilots. How quickly the scan, or degraded mode scan, was established, or re-established, varied with the pilot.

I grant you that crews in some other events where AS became unreliable (under other conditions and variables) were able to manage that transition via one means or another. Based on the points you raise, unreliable airspeed wasn't a new failure mode experienced for the first time by AF 447's crew. What it may have been was that rare failure mode, experienced with some novel other conditions, and most likely for the first time by that crew. (This consideration is related to the question I asked to studi about what Conventional Wisdom is and was among the A330 pilot community in re his described escape maneuver ...)

Friday will hopefully be enlightening.

takata

24th May 2011, 18:38

Hi areobat,
Are there parameters recorded on the FDR that could be used to determine retroactively that something like this occurred?
Certainly. This is the main reason why the BEA should be given all the time necessary to make a complete correlation between all the dataset recorded as, of course, some data could have been erroneously displayed (and recorded). Because all the flight parameters are related to each others, it would be possible to find, beyond any doubt, if anything was wrong with the airspeed before the system started to reject it.

In fact, in normal flight, all the sensors are already not displaying the same data by a certain margin due to their airframe location: an aircraft is almost never flying in a perfect symetrical attitude and this will cause some noticeable variation between the various sensed pressures. This is also the main reason why a clean probe system would very very unlikely be clogged (in flight) at exactly the same rate and at exactly the same time.

syseng68k

24th May 2011, 18:50

ChristiaanJ, #2261:

PS : thanks for your post on state machines.... saved it. We never used
that 'notion', but then I'm an analog dinosaur.... Was a good time actually,
until the µP asteroid hit.
Thanks for that, and for the record, am a bit of a dinosaur here as well :-).
I originally came into embedded work from a hardware, rather than comp sci
background and still do some analog work from time to time. It never
ceases to amaze me what was achieved in the past with mechanical gyros,
servos, synchros and discreet components. Often straddling many disciplines,
the designers of old were masters of their art...

kilomikedelta

24th May 2011, 19:13

syseng68k; as chronicled in the "Lightning Empiricist" www.me.utexas.edu/~longoria/paynter/hmp/LITENING.pdf (http://www.me.utexas.edu/~longoria/paynter/hmp/LITENING.pdf)

RR_NDB

24th May 2011, 19:18

Hi,

Could a scenario like this have robbed the crew of precious time needed to make corrections?
(http://www.pprune.org/tech-log/449639-af-447-search-resume-part2-114.html#post6470779)
Difficult question! (Presented by an "instrumentation professional")

We could pinpoint the moment the AS started to change in respect to "ground speed" (supposing AS sensors LYING and presenting the "identical" info.) BEA is doing all necessary correlations.

But i understand your question is no about BEA task. Is for the System: Until the point (time) the sensors present different info. how to detect they are "failing"?

The "band-aid" we learned is being considered using (for short periods) other references could reduce the criticality of the issue: Reliable "speed info." required by the System.

But the only way to "kill" adequately the issue is with really redundant AS sensors. The ideal is to have at least three (methods) allowing a "voting scheme".

Again AoA comes to my mind...

How the System could work properly if ALL AS SENSORS "lie" to it? How it can detect? Detectors, (sensors) if the System requires (the truth) the real AS, can not LIE together. It´s simply dangerous (to the a/c). And can (i guess) today generate undetectable "strange behavior". Introducing "extra components", not just "robbing precious time".

Golf-Sierra

24th May 2011, 19:40

Simply, because (it seems) there are no solutions yet available (sensors) to have the (could provide) required redundancy.Or is it more a question of history and evolution? First: why is airspeed so relevant? (a) It is a measure of the performance of the aerofoil/airframe (stall/buffet/structural limits), (b) It allows ground speed and track to be calculated, (c) it is a convenient way to ensure separation of aircraft within the same moving mass of air.

1. Initially - given the availability of purely mechanical instruments - the pitot-static system was the easiest way to calculate airspeed.

2. As the aircraft became more complex, the system was multiplied to ensure redundancy.

3. As aviation evolved - everyone got used to using airspeed for the reasons (a)-(c) mentioned above.

4. Flight control/navigation systems evolved - in order to make them 'user friendly' (and backward compatible) designers retained airspeed as a key concept in these systems.

5. Digital data buses were introduced. To minimize the cost/risk of introducing these novel systems - rely as much on existing technology (ain't broken - don't fix it) - hence we rely on the pitot system (btw - invented in the 18th century).

Has anyone ever stepped back and asked - given today's technology - what is the best way to achieve (a), (b) and (c)? A 'clean sheet' approach, without the legacy of the past?

I find it hard to believe there is no other way (as an additional, redundant system) to measure airspeed. Even yet another pitot tube - albeit a retracting one - could provide a working alternative if all the other ones fail. But has anyone ever thought about it?

In an earlier post you could find patents filed by Airbus SAS on sensors (laser based).

Thanks - I'll try to find it ;-)

CogSim

24th May 2011, 19:46

such a common mode degradation would not be detected initially and would fool the system into believing that the A/C was traveling faster than it really was.

Difficult to know. All depends on the nature of icing/ice accrual, which we may never fully know/understand. My guess would be that the crew may have known for some time before AP disconnect that something was wonky with their KIAS. Now, in the a/c that I fly, it would take me, oh, I would say, a few seconds to suspect that something was up with the pitot-static system. That is because I have the luxury of flying a non-FBW a/c. I can't comment on how Airbus drivers are trained to respond. Are the bus drivers at this point thinking "is it the probes or is it the computer". Remember, they probably are not expecting ice at FL350. If this kind of 'thinking' occupies the pilots for, say, a few minutes, we can begin to understand how they can be distracted/fixated. Then we are back to the nature of the ice build up and how aggressively automatics responded.

BJ-ENG

24th May 2011, 19:59

@Diversification

"Given the availability of technologies such as GPS, Inertial navigation,
radio navigation, radar, AOA sensors - is it possible to build an avionics
package which could automatically control (and provide pilots with
information to manually control) the flight throughout all phases without requiring a pitot-static system at all?"

Thanks for the link. Nice idea, but from the description of its limitations it sounds like it would not have been of much help. One of the principles I learnt as a systems eng is the concept of Observability and Controllability(Kalman). If the controller can't observe a system state, then the system remains stable only as long as the unobservable state is also stable. ie; if a critical data measurement such as airspeed is lost (say gets stuck at some value Vk=Vk+1 etc) but nothing else changes, then the system will appear to be stable. Perturb the system, and instability is inevitable. Some systems use an Estimator/Observer swapping system to get over transients, but these are only so good close to regions of stable Operation. Redundancy of data measurement can help, but if all are afflicted by the same malaise, then failure will ensue. Maybe an AoA sensor/ sensors is the answer. If the control system is smart enough to detect the fault, then it needs to degrade gracefully and present the human operators (the pilots) with options, and not overwhelm with information overload. Automation is only as good as the interface between it and the operator, and operator skills when applied to interaction with complex automation, only as good as the procedures (human factors influenced) laid down by the systems designers. If blame is to be apportioned, do NOT lay it in the lap of the pilots.

@deSitter

Dozy and syseng68k are correct in their assertions. APL, FORTH etc are nice tools, but are not as robust as some of the stuff used for safety critical applications - type checking etc. All done to keep the programmer from inflicting bugs on the unsuspecting. In the past I have had to use assembler for time critical embedded underwing stores Mil apps, where thecode produced from the C compiler was simply to inefficient (too slow) or the task - with faster processors, and more I/O functionality on chip, this is no longer necessary. What has not been mentioned here is that software requirements devolve down from system requirements. When I retired a few years back, there was a push in various safety critical industry sectors towards a design process where a system is modelled and simulated (hardware and software) under Matlab and auto coded by the Matlab compiler. The desired effect, theoretically, is to remove the programmer from the loop, and place more of the design task in the lap of the systems engineer. Some proponents have even suggested that simulations should produce straight raw code and forget any intermediate high level code. Nice idea if you can get it to work, but in the real world, it removes a level of validation (programmer checking the high level code),and to my mind is potentially dangerous.

@mm43

I redid the calculation, and basically it is impossible to determine from it what the terminal RoD was, as depending at what time the Advisory happened, and allowing or not ACARS queue times, the outcome can be very much different.

Tend to agree. However, have you considered a crude calc to guess how
long it would take to reach VT assuming a stall with min or zero lift from
upset to sea level.

The non linear diff equation for a falling object that experiences drag is:

mdv/dt = -m.g +1/2.Cd.p.A.v.v ...... (1)

So, with terminal VT = root(2.m.g/p.Cd.A) ......(2)

Sol is v(t) = VT.tanh(g.t/VT)

From (3) you can make an estimate of the time to reach VT for step
increments in t, and then use (2) thereafter, adjusting for density p. I
suggest a Cd of 1.2 or 1.3, or else just plug in a value, say 70m/s, for VT.

gums

24th May 2011, 20:03

Was wondering about training flights.

- Do you 'bus drivers ever get to see "an approach to stall" during checkout?

- How many of you have ever "felt" the burble or buzz or wing rock or other indications that your AoA is a bit high or mach is too high?

- How many 'bus drivers can recite from memory in 5 seconds what levels of protection "go away" or replaced by other sensor inputs to the FBW system going from "normal;" to "alt 1" to "alt 2" to "direct"?

HazelNuts39

24th May 2011, 20:32

In fact, in normal flight, all the sensors are already not displaying the same data by a certain margin due to their airframe location: an aircraft is almost never flying in a perfect symetrical attitude and this will cause some noticeable variation between the various sensed pressures.I'm not quite sure how relevant this is but, IMVHO, that cannot be said of the pitot pressures.

OK465

24th May 2011, 20:38

I'll ask the Airbus drivers a question that has come up before: would an AoA gage (which is apparently not common in any airliner design, and for most regimes of flight a supplemental scan item) be a useful addition to the flying display?

LW50:

(Disclaimer: This is not an A versus B comment, or an AF447 comment, hopefully just a politely informative one in response to a question. This is a tough crowd.)

Most, if not all, Boeing 737 NG’s (not sure about BBJ’s or special orders) have an AOA display directly visible on both the PFD and in the HUD. Is it useful? Depends on the guy driving.

snowfalcon2

24th May 2011, 20:50

Golf-Sierra: I'll give this a try even if here are many better qualified participants. Bear with me :)

First: why is airspeed so relevant? (a) It is a measure of the performance of the aerofoil/airframe (stall/buffet/structural limits), (b) It allows ground speed and track to be calculated, (c) it is a convenient way to ensure separation of aircraft within the same moving mass of air.

a) correct, airspeed is basic for all aerodynamics.
b) only partly correct, as wind data is also a necessary input.
c) hmm...ground speed would be just as convenient, wouldn't it? At least for the purpose of calculating safe separation distances.

Has anyone ever stepped back and asked - given today's technology - what is the best way to achieve (a), (b) and (c)? A 'clean sheet' approach, without the legacy of the past?

a) angle of attack is in some respects just as useful. But to replace a pitot tube it would IMHO need to have a resolution better than 0.1 degree - not so easy to combine with 100% icing resilience I guess. And most AoA sensors I've seen are relatively delicate mechanically, compared to a pitot tube.
b) For realtime navigation, you need to use ground speed and ground track. VOR, GPS, and inertial methods all work independently of airspeed and have long since replaced airspeed and compass-based dead reckoning. For planning and routeing, fact is that fuel economics depend on airspeed, so it's most reasonable to use it, always together with wind forecast data.
c) radar, TCAS, and more recently ADS-B for ensuring separation.

I find it hard to believe there is no other way (as an additional, redundant system) to measure airspeed. Even yet another pitot tube - albeit a retracting one - could provide a working alternative if all the other ones fail. But has anyone ever thought about it?

If there was an easy solution, it would surely have been found by now. But I'd be interested to hear if this issue has existed for a long time. Or are iced pitot tubes just a recent result of beancounters ordering pilots to save on heating electricity? Surely not... :E

takata

24th May 2011, 20:51

Hi HN39,
I'm not quite sure how relevant this is but, IMVHO, that cannot be said of the pitot pressures.
What do you mean? That any pitot pressure is always perfectly the same?

BOAC

24th May 2011, 20:51

Most, if not all, Boeing 737 NG’s (not sure about BBJ’s or special orders) have an AOA display directly visible on both the PFD and in the HUD. - news to me - got a pic?

Nick L

24th May 2011, 20:57

- news to me - got a pic?

Boeing 737 Flight Instruments (http://www.b737.org.uk/flightinsts.htm)

One of the many customer PFD options is an analogue/digital angle of attack display. The red line is the angle for stick shaker activation, the green band is the range of approach AoA.

Also, I believe an AoA indicator was/is available as a customer option on Airbus aircraft - it is a dial next to the PFDs.

RR_NDB

24th May 2011, 21:01

Hi,

Systemically speaking it is possible ("easily" today) to use two Pitot probes from different mfrs. (Fr and US) as LH and RH (main) sensors?
Question relates to calibration, etc.

Turbine D

24th May 2011, 21:09

takata,

In fact, in normal flight, all the sensors are already not displaying the same data by a certain margin due to their airframe location: an aircraft is almost never flying in a perfect symetrical attitude and this will cause some noticeable variation between the various sensed pressures. This is also the main reason why a clean probe system would very very unlikely be clogged (in flight) at exactly the same rate and at exactly the same time.

I am not sure how to reconcile the above quote with this quote extracted from the EASA AD No. 210-0271 dated 22 December 2010:

It has been identified that, after such an event, if two airspeed sources become similar while still erroneous, the flight guidance computers will:
-Display the FD bars again, and
-Enable AP and AT re-engagement.

Doesn't that say that that speed sensors can go from similar to dissimilar and then back to similar? Similiar at the same time as in normal cruise flight, dissimilar at the same time causing AP & AT disconnect and removal of FD bars, and then similiar again at the same time but giving wrong speed data, e.g., somehow clogged in a similiar fashion.

BOAC

24th May 2011, 21:10

Nick - 'customer option' is not 'most, if not all 737 NG's' in my book..

jcjeant

24th May 2011, 21:19

Hi,

In the press

AFP-24.05.2011

PARIS - The associations of families of victims of the crash of Air France flight from Rio to Paris Monday wrote to Prime Minister Francois Fillon to express "their deep indignation" about "the conduct of the technical investigation chaotic" and leakage in the press.

Families "you want to share their outrage and deep concern about the chaotic progress of the technical investigation" conducted by the Bureau of Investigation and Analysis (BEA), according to this letter which AFP has obtained copy.

"Since the beginning of the operation of data" contained in the black boxes rescued early May off Brazil, "we are witnessing a broad disclosure of information that should remain confidential until the final report and within the strict framework of investigation ".

Families are surprised that these leaks tend to favor the theory of human error and exonerate Air France and Airbus' under investigation as part of the judicial inquiry. "

According to families, these facts "discredit the investigative authority", BEA, and "generate much suspicion on the independence of that body against leaks orchestrated."

The four associations of relatives of victims signed the letter asking to François Fillon "to remind the different actors demands restraint, discipline, confidentiality, justice and ethics to which they would never have departed."

The Wall Street Journal said Monday that the accident of flight AF447 in June 2009 was due to pilot error and poor monitoring procedures.

According to the German magazine Der Spiegel quoted an expert who participated in the analysis of black boxes, the captain was not in the cockpit when the first alarm sounded.

On 20 May, a spokesman for the BEA stated that the investigating agency would publish this weekend "on the factual elements of the flight that will determine the circumstances of the accident, but in no way causes.

OK465

24th May 2011, 21:20

BOAC & Nick:

Nick's HUD picture reference does not have the AOA display. The PFD picture in the section dealing with Integrated Approach Nav (IAN) & NPS shows it clearly.

That would be repeated in the HUD in that configuration.

BOAC, you are correct, "most" is a relative term. The NG's I've dealt with have had AOA since 2001. I'm only familiar with specific carriers and all (not most) of their NG's have it.

(If you're an NG driver, you obviously don't have it. I apologize for exaggerating.)

HazelNuts39

24th May 2011, 21:21

Hi takata;

I mean that as long as the pitot tube is outside the boundary layer (and it is), the pressure inside is insensitive to small variations of the local flow angle.

Nick L

24th May 2011, 21:23

BOAC:
Sorry for the misunderstanding on my part - thought you were questioning the availability of the AoA indicator, rather than its prevalence.

syseng68k

24th May 2011, 22:06

kilomikedelta, #2276

syseng68k; as chronicled in the "Lightning Empiricist" www.me.utexas.edu/~longoria/paynter/hmp/LITENING.pdf (http://www.me.utexas.edu/%7Elongoria/paynter/hmp/LITENING.pdf)
Ok, I give in. Looks like I have exposed one of my more anorak
tendencies http://images.ibsrv.net/ibsrv/res/src:www.pprune.org/get/images/smilies/embarass.gif. Am familiar with Philbrick Research and have seen their
early brick op amps in use, as well as Analog Devices and Burr Brown
parts. And yes, I do buy and read books on early analog computers, as
well as oddball things like a half complete set of Rad Lab volumes. Sad
really, but it's surprising how much of that early work is still
relevant today. The history of electronics and computing can be a rich
source of ideas for modern day designs. For example, embedded systems
with very limited resources.

You probably know this, but if you want to be astounded, take the lid
off an early electromechanical inertial nav system. It's doubtfull if
there are many engineers left in the world now who have the
multidisciplinary skill set to even start to design such a system...

kilomikedelta

24th May 2011, 22:27

syseng68k; Sad really, but it's surprising how much of that early work is still relevant today. The history of electronics and computing can be a rich source of ideas for modern day designs. For example, embedded systems with very limited resources. You probably know this, but if you want to be astounded, take the lid off an early electromechanical inertial nav system. It's doubtfull if there are many engineers left in the world now who have the multidisciplinary skill set to even start to design such a system... Modern work is dependent on all that early work, which is why it is still relevant but no longer taught. Pity how new engineers are poorly grounded in the broad aspects of their craft. It's like my business - recently trained practitioners can't make a diagnosis in the basis of conversing with a patient - they need the imaging technology. Cheers, K PS - I could probably still write a RTOS in 16K of machine code.

Yankee Whisky

24th May 2011, 22:37

Just received.

Black Boxes Point to Pilot Error

By ANDY PASZTOR And DANIEL MICHAELS

(WSJ) The pilots of an Air France jet that crashed into the Atlantic Ocean two years ago apparently became distracted with faulty airspeed indicators and failed to properly deal with other vital systems, including adjusting engine thrust, according to people familiar with preliminary findings from the plane's recorders.

The final moments inside the cockpit of the twin-engine Airbus A330, these people said, indicate the pilots seemingly were confused by alarms they received from various automated flight-control systems as the plane passed through some turbulence typical on the route from Rio de Janeiro to Paris. They also faced unexpectedly heavy icing at 35,000 feet. Such icing is renowned for making airspeed-indicators and other external sensors unreliable.

Ultimately, despite the fact that primary cockpit displays functioned normally, the crew failed to follow standard procedures to maintain or increase thrust and keep the aircraft's nose level, while trouble-shooting and waiting for the airspeed sensors and related functions to return to normal, according to these people.

Slated to be disclosed by investigators on Friday, the sequence of events captured on the recorders is expected to highlight that the jet slowed dangerously shortly after the autopilot disconnected. The pilots almost immediately faced the beginning of what became a series of automation failures or disconnects related to problems with the plane's airspeed sensors, these people said.

The crew methodically tried to respond to the warnings, according to people familiar with the probe, but apparently had difficulty sorting out the warning messages, chimes and other cues while also keeping close track of essential displays showing engine power and aircraft trajectory.

Spokesmen for Air France, a unit of Air France-KLM, and Airbus, a unit of European Aeronautic Defence & Space Co., have declined to comment on any details of the investigation. Airbus last week, however, issued a bulletin reassuring airlines that the preliminary readout of the recorders hasn't prompted any "immediate recommendation" regarding the safety of the global A330 fleet. French investigators, who gave the green light for that statement, also have said their preliminary findings don't highlight any major system failures or malfunctions that could have caused the fatal dive.

The Air France pilots were never trained to handle precisely such an emergency, according to safety experts and a previous report by France's Bureau d'Enquetes et d'Analyses, which is heading up the investigation. All 228 people aboard Flight 447 died in the accident.

The senior captain, Marc Dubois, appears to have been on a routine rest break in the cabin when the fatal chain of events started, according to safety experts familiar with the details, but the cockpit-voice recorder suggests he may have rushed back to the cockpit to join the other two Flight 447 pilots.

Though Friday's announcement won't provide final conclusions or specific causes, investigators believe Air France didn't train its pilots to cope with such automation problems in conjunction with a high-altitude aerodynamic stall, an emergency when the wings lose lift and the plane quickly becomes uncontrollable. Since the crash, Airbus and a number carriers, including Air France, have emphasized such training.

According to a report issued by French investigators in November 2009, Airbus identified 32 instances involving similar model jetliners between 2003 and 2009 in which external speed probes, known as pitot tubes, suffered ice buildup at high altitude and caused "erroneous air speed indications." Over the years, the same models also suffered numerous failures of external temperature-sensors because of icing. Both issues were known to Air France.

Most of the incidents with speed sensors involved probes similar to those on the A330 that crashed. Many were on Air France planes, according to the BEA report.

Friday's update follows sniping between senior officials of Air France and Airbus, usually close corporate allies, who in this case have tried to shift the blame for the accident to each other.

Air France began addressing problems with its pitot tubes almost a year before the crash. Amid several incidents in which air crews lost speed indication at high altitude during 2008, Air France reported the icing problems to Airbus. The two companies discussed solutions and Airbus talked to its supplier.

In April 2009, roughly 45 days before the crash, Airbus proposed that Air France swap out its pitot tubes for a different model believed to be less prone to icing, according to the BEA report. Air France began the work on April 27, 2009, and it received the first batch of new pitot tubes six days before the crash. The plane that crashed hadn't yet received the new equipment.

According to the 2009 report published by investigators after the crash, experts examined 13 other incidents of airspeed-sensor malfunctions on Airbus widebody jets at cruise altitudes. During most of those global incidents-none of which resulted in a crash-both the autopilots and automated engine-thrust systems disconnected on their own, and it took many of the flight crews up to a minute to manually adjust engine thrust.

The earlier report found that pilots in nine of those 13 events received warnings of an impending stall. And in a finding that may have particular relevance to the upcoming update, accident investigators in 2009 also concluded that when airspeed-sensor malfunctions kick off automated thrust controls, "the absence of appropriate manual adjustments" to engines "can present a risk" of a mismatch between power settings and the jet's orientation in the air.

Investigators began focusing on pitot problems from the start, because Flight 447's automated maintenance system broadcast 21 separate messages related to such malfunctions during roughly the last four minutes of the fatal flight. But the final report, which may not be released until 2012, also is expected to delve deeper into how European air-safety regulators dealt with persistent reports of pitot-tube icing prior to the crash.

The previous interim report indicated that in late March 2009, less than three months before the crash, European aviation regulators decided that the string of pitot-icing problems on widebody Airbus models wasn't serious enough to require mandatory replacement of pitot tubes

sensor_validation

24th May 2011, 22:53

I wonder if the WSJ author's have just watched the year old BBC/Nova documentary?

No mention of a control system protection triggered zoom-climb for a while?

JD-EE

24th May 2011, 22:58

Smilin Ed quoting slats "If these systems fail, then control is thrown back to the pilots...."

As Self Loading Freight I find the thought that the automation flies the plane almost exclusively when things are going well and then when things get tough toss it into the laps of pilots who might otherwise get fired if they try to actually fly the plane rather than babysit some automation to be rather troublesome.

Something must be done so that the pilots, even if they are sitting there yawning with nothing to do, are intimately aware of the feel of the plane as a plane at all times. That way when things get tough the transition is not quite such a hostile appearing event.

The current situation might even be made nicer of a row of buttons appears on a touch screen display with options like, recover stall, slow down, TOGA thrust, AOA, and so forth so that the pilot can assist the automation in picking the strategy to deal with data that confuses the automation. The automation can probably react quicker. But the meatware can probably solve the problem quicker - today. (Yeah, I gotta add that proviso. I've seen some amazing "stuff" in the software world. One begins to feel redundant.)

JD-EE

24th May 2011, 23:01

OTOH the post is about mission critical software. I don't see why, say, the inflight entertainment system code needs to be "ultrareliable". If someone in the know can comment on the control logic code metrics in modern a/c, it will be enlightening for the pilot types on the forum.

As SLF who is old enough to remember such comedy routines as "Grace L. Furgesun Airline and Storm Door Company" or Bob Newhart's gems I surely can... surely can... surely can... surely can...

(Is it time to panic yet?)

infrequentflyer789

24th May 2011, 23:06

Hi,

Systemically speaking it is possible ("easily" today) to use two Pitot probes from different mfrs. (Fr and US) as LH and RH (main) sensors?

I recall that after the initial advice (following 447) to replace the dodgy Thales probes, there were not enough Goodrich ones to go round, so it was suggested to use a mixture. I don't have a reference to hand though and not sure if it was AB recommendation or regulator or both. Also, it may only have been allowable as temporary measure.

I would have a general concern (maybe you share) that different probe types with slightly different calibration & response might lead to more (spurious) unreliable airspeed events. Now, if the problem is all probes failing in same way pushing the a/c out of the envelope before the unreliable airspeed reported, then maybe this is good... but if the problem is pilots mishandling reported unreliable airspeed, then maybe this makes things worse.

JD-EE

24th May 2011, 23:20

wozzo, if that WSJ quote resembles what actually happened I do not figure that is pilot error. I take that as a system design failure, which falls into the AirBus lap.

JD-EE

24th May 2011, 23:34

ion berkeley, I'm glad I am not the only one here who might defend Ada. I have seen it work very well to produce military grade software under budget and with far fewer bugs than normal for the size of program involved. They performed to spec and that's what made the company money. If the spec was wrong, that's the DoD's problem (and, sadly, the soldier's problem.)

Ada works very well because you cannot write software with it without very clear "premeditation" for what you are doing. (Yes, I know, a real hairy chested programmer can write FORTRAN in any language. Trust me, it's harder in Ada than in most languages.)

It is also current. The latest release of the Ada specification is a preview of the scheduled 2012 version.

For commercial stuff Ada doesn't work very well because commercial software is seldom thoroughly defined and then developed without massive changes in direction. It is a very capable language. It is rather inflexible, resistant to changes and errors.

john_tullamarine

24th May 2011, 23:41

I would have a general concern (maybe you share) that different probe types with slightly different calibration & response might lead to more (spurious) unreliable airspeed events

Probably not something to worry about.

Caveat - the following is generic, not AB specific.

The pitot tube basically is a bit of water pipe facing forward into the wind (it can tolerate modest out of into wind alignment) and with the other end hooked up to the aircraft's innards. One bit of tin pipe is going to be much the same as another. The only fancy bit is some heating to avoid the thing's icing up.

Generally, system errors (providing the pipe hole is not blocked) are not due to the pitot - but may well be due to static port problems. Apart from icing and like physical obstruction, pitot installations are remarkably reliable.

Mixing up the OEM pitots provides some interim redundancy for icing considerations pending the supply chain's catching up with demand for OEM changeover.

wozzo

24th May 2011, 23:43

wozzo, if that WSJ quote resembles what actually happened I do not figure that is pilot error. I take that as a system design failure, which falls into the AirBus lap.

A more pressing question is: whose conclusion is it at this point? 1) BEA's, 2) the paper's sources (which I would presume is somebody at or close to NTSB) or 3) the journalist's (as a conclusion of his gathered information)?

At least in respect to 1) we will know more Friday.

mm43

24th May 2011, 23:44

Wall Street Journal Report

There is something rather obvious in the WSJ story, i.e. there is absolutely nothing new, and furthermore the unnamed source(s) would appear to be "pick ups" from European papers. The authors IMO have created a story to fill a void, and in doing so have joined the likes of the News of the World etc..

There are better stories on this thread, though not everyone agrees.;)

jcjeant

24th May 2011, 23:59

Hi,

There is something rather obvious in the WSJ story, i.e. there is absolutely nothing new, and furthermore the unnamed source(s) would appear to be "pick ups" from European papers. The authors IMO have created a story to fill a void, and in doing so have joined the likes of the News of the World etc..

There are better stories on this thread, though not everyone agreesFrom the day one of the first leak (printed in Le Figaro and coming from ?) it's nothing new ..
Just parrots who repeats at length of articles:
The pilots made mistakes and the Airbus A330 is not an issue

infrequentflyer789

25th May 2011, 00:02

For commercial stuff Ada doesn't work very well because commercial software is seldom thoroughly defined and then developed without massive changes in direction.

It's a long time ago that I worked on military stuff, but "thoroughly defined" and "developed without massive changes in direction." are not really characterisitcs I'd associate with it ! "Sufficiently ill-defined that the contractor can absolutely guarnatee to claw back overruns (and under-quotes) in change control," and "subject to random changes in direction so often that by the time you go live no one can remember what the original threat was" would be more like it. Maybe I'm too cynical though.

Also, I think those that think Ada has dropped out of use just don't appreciate mil-spec project timescales. I've used Coral 66 (predates Ada by a lot of years) and the last time I was offered work in it (by idiots who just keyword search CVs without reading them) was not many years ago - I suspect it is still in use today...

Khashoggi

25th May 2011, 00:08

Something must be done so that the pilots, even if they are sitting there yawning with nothing to do, are intimately aware of the feel of the plane as a plane at all times. That way when things get tough the transition is not quite such a hostile appearing event.

Having throttles move via actuator to show current thrust level and trending, like Boeing does, would be a start.

Watching throttles physically retard during cruise might have been helpful to this crew in keeping SA.

mm43

25th May 2011, 00:12

The Problematic Surface Currents - some answers?
Originally posted by NWR ...

Anyone interested in the detailed analysis used to refine the search area should see:

Search for AF447: Complimentary Studies (http://wwz.ifremer.fr/lpo/layout/set/print/content/download/41108/560452/file/AF447_Etude_compl%C3%A9mentaire.pdf)Thanks for posting the link to this well presented Ifremer summary (in French) of the surface current research they have undertaken.

Additionally, detailed research by the University of Massachusetts' FVCOM group based at Dartmouth, MA, supported by the Woods Hole Oceanographic Institution at Cape Cod, MA, has resulted in methodology that is now capable of making sense of the surface currents in what was a poorly understood area of circulation in the equatorial latitudes of the North Atlantic.

The currents and resulting drift patterns in this area are irregular and the drift tracks so found also provide some answers as to why the aerial and surface searches failed to find debris and bodies in the first 5/6 days of searching.

Both UMass Dartmouth and WHOI were represented on the BEA's Drift Group, and in the intervening period since then have continued their research, which I am advised will be made public in due course.

JD-EE

25th May 2011, 00:17

We could pinpoint the moment the AS started to change in respect to "ground speed" (supposing AS sensors LYING and presenting the "identical" info.) BEA is doing all necessary correlations.

That would be the moment the aircraft instruments are turned on. Air moves independently (more or less) of the ground below. Planes go through fronts. The trick is to isolate a set of "signatures" for pitots freezing up. Then you pray that set is exhaustive while knowing in your heart it's not even close.

JD-EE

25th May 2011, 00:41

KMD - 16k seems to be a very fancy advanced RTOS to me. The OM-55 Navy SatCom modem used 32k for the entire program and had 16k, with spare space, for RAM. This involved a full multi-tasking (time sliced) operating system - on an 8080. (They cost $100 a pop when it was designed.) The kernel portion was under 1k. The IO routines were small. The rest involved maintaining the DSCS satellite communications protocols running, demodulating the data, and feeding it all to the output while running the modest control panel.

edit: By the way Philbrick is in my engineering DNA. I started designing professionally in about '65 - as in getting real pay for it. And the first job or two involved operational amplifiers with these new fangled RA-909's.

infrequentflyer789

25th May 2011, 00:46

Having throttles move via actuator to show current thrust level and trending, like Boeing does, would be a start.

Unfortunately, a number of people already died in a field near Schipol to disprove that.

If it's handled properly, unreliable airspeed in cruise in a Bus is not fatal - long list of previous incidents show that. Something else happened to 447 - either something else went wrong with the a/c, or the crew; we don't know what yet (whatever the press says).

JD-EE

25th May 2011, 00:48

Yankee Whiskey, that report certainly looks fully as self-serving for "certain parties" as the other "leaks" I've seen. I am betting these are "leaks" from various interested parties rather than from inside BEA. If they are from people privy to the BEA deliberations I bet the data being released is very carefully selected and given a proper propagandistic spin. It's becoming somewhat of an embarrassment to the whole industry.

JD-EE

25th May 2011, 00:57

infrequentflyer789, the proper way to handle changes like that is to charge what it costs and profit margin to recode and KNOW what that cost is. With Ada that is expensive. It tends to get the military to better define the problem.

(It helped that this was on the DSCS satellite and that Magnavox (in Torrance Ca) was the major ground systems developer. We understood the machines. And we understood how to use then in networks. The military provided the controls they wanted and we provided the rest. We came in under budget even after the changes requested. Two other projects not so intimately related to the company's hardware work also came in under budget on Ada. They all worked very well going through formal acceptance tests without failures.)

promani

25th May 2011, 00:59

mm43

Do you know if they have continued recovering debris/bodies at the crash site? I am just curious to know, or whether they have given up.

tks.

misd-agin

25th May 2011, 01:01

OK465 (post 2292) -

"BOAC, you are correct, "most" is a relative term. The NG's I've dealt with have had AOA since 2001. I'm only familiar with specific carriers and all (not most) of their NG's have it."

I've been told by someone involved with the AOA program years ago that only AA and DL have ordered that option in the U.S. What carriers have you seen have the AOA gauge on the PFD and/or HUD?

mm43

25th May 2011, 01:29

promani
Do you know if they have continued recovering debris/bodies at the crash site? I am just curious to know, or whether they have given up.I have no information, other than the "Ile de Sein" has returned to the ROP following a crew change in Dakar.

My understanding is that the BEA may still be searching for the missing SSFDR ULB, and there could be other items they wish to recover. The BEA has made it clear that the recovery of bodies is not their mission, and IIRC the French courts have stopped any further recovery of bodies. DNA has been successfully extracted from those brought to the surface, and what may happen next is unclear.

The BEA may have something to say on this matter at their next press release.

jcjeant

25th May 2011, 02:30

Hi,

and IIRC the French courts have stopped any further recovery of bodies.:confused:

Wednesday, May 25, 2011

Two years after the disaster that has killed 228 on 1 June 2009 off the coast of Brazil, two judges wrote to warn families that the remains would not be too damaged up from the bottom of the Atlantic.

« Pour préserver la dignité et le respect » des victimes et de leurs proches, « nous avons pris la décision de ne pas relever les restes trop altérés », écrivent les magistrats Sylvie Zimmermann et Yann Daurelle, dans un courrier dont l'AFP a eu copie. "To preserve the dignity and respect" for victims and their relatives, "we made the decision not to raise too remains altered," wrote the judges Sylvie and Yann Zimmermann Daurelle in a letter which AFP has been copy. Par conséquent, « il a été décidé de ne remonter que deux dépouilles dans des états différents de conservation, afin de déterminer si l'identification est ou non réalisable après un long séjour au fond de l'océan ». Therefore, "it was decided not to recover only two bodies in different states of preservation, to determine if the identification is not feasible or after a long stay at the bottom of the ocean."

En fin de semaine dernière, deux corps de passagers ou membres d'équipage de l'A330 du vol AF447 ont été récupérés. By last weekend, two bodies of passengers or crew of the A330 flight AF447 were recovered.
Victims in a degraded state

« V ous devez savoir que les dépouilles des victimes se trouvant par le fond sont inéluctablement dans un état dégradé à la suite du choc particulièrement violent, du temps écoulé et du milieu environnant », préviennent les juges.
"Y ou should know that the bodies of victims lying in the background are inevitable in a degraded state of shock after particularly violent, time elapsed and the surrounding environment," warn the judges. de plus, « la remontée à la surface est nécessairement un facteur supplémentaire de dégradation ».
again, "the ascent to the surface is necessarily an additional factor of degradation." « Par conséquent, nous ne procéderons qu'au relevage des victimes que l'on peut décemment remettre aux familles à condition qu'elles puissent être identifiées », écrivent-ils.
"Therefore, we will only lift the victims that can deliver decent families provided they can be identified," they write.
« Dans l'hyptohèse où l'identification se révélerait impossible, nous estimons que le respect des disparus et de vous-mêmes commande qu'ils reposent en paix dans leur dernière demeure », concluent les juges.
"In hyptohèse where identification would be impossible, we believe that respect for Missing and control of yourself they rest in peace in their last home," concluded the judges.
Quatre spécialistes de l'Institut de recherche criminelle de la gendarmerie nationale (IRCGN) vont rejoindre les équipes déjà sur place, précisent les magistrats, jugeant « impossible de prendre une décision qui rencontrerait l'agrément de l'ensemble des familles françaises et étrangères ».
Four specialists from the Institute of Criminal Research of the National Gendarmerie (IRCGN) will join the teams already on site, say the judges, saying "Unable to make a decision that is acceptable to all French and foreign families" .
La semaine dernière, Jean-Baptiste Audousset, président de l'association Entraide et Solidarité AF447, avait jugé que le repêchage du premier corps ouvrait une phase « très difficile » voire « traumatisante » pour les familles qui y sont opposées.
Last week, Jean-Baptiste Audousset, president of the Mutual Aid and Solidarity AF447, determined that retrieval of the first body opening phase "very difficult" or "traumatic" for families who oppose it. De leur côté, les familles brésiliennes veulent que tous les corps soient remontés.
For their part, the Brazilian families want all the bodies are assembled.

Google Vertaling (http://translate.google.be/translate?u=http%3A%2F%2Fiphone.lesoir.be%2Factualite%2FMond e%2Farticle_839309.shtml&sl=fr&tl=en&hl=&ie=UTF-8)

Original:
Rio-Paris*: pas de remontée des corps trop abîmés - lesoir.be (http://iphone.lesoir.be/actualite/Monde/article_839309.shtml)

Unfortunately, a number of people already died in a field near Schipol to disprove that.Having throttles move via actuator to show current thrust level and trending, like Boeing does, would be a start.I wonder how many (they are unknow of course :) ) people already survived to prove that ........

davionics

25th May 2011, 02:58

Reliability: a measure of the success with which a system conforms to some authoritative specification of its behaviour.

Safety: Freedom from those conditions that can cause death, injury, occupational illness, damage to (or loss of) equipment (or property), or environmental harm. Given that interpretation, it is then fair to say that there is no safe airplane.

When the behaviour of a system deviates from that which is specified for it, this is called a failure. Failures result from unexpected problems internal to the system that eventually manifest themselves in the system's external behaviour. These problems are called errors and their mechanical or algorithmic cause are termed faults. Systems are composed of components which are themselves systems: hence;
> failure -> fault -> error -> failure -> fault

Software doesn’t deteriorate with age: it is either correct or incorrect but faults can remain dormant for long periods. Ada is very much alive and well. I find it considerably amusing to read posts where the author assumes Ada to be a stale dinosaur - they seem to be quite far removed from reality. We use Ada for commercial projects achieving superior results in comparison with other languages - fewer bugs reach binary, easier to maintain code, certified and tested compilers, self documenting, and standards that read with legal precision... to name a few benefits.

I don't have a problem with the software engineering practices used in avionics. But I am weary of impacts on safety caused by time-cost demands.

There is a list of mechanisms that could make aircraft 'safer' but they aren't implimented because of cost savings. :sad:

http://www.computersociety.it/wp-content/uploads/2008/08/ieee-cc-arinc653_final.pdf

Machinbird

25th May 2011, 03:20

Does anyone know if an approach to stall was ever demonstrated in any FBW version of the Airbus while in Alternate law and with invalid ADR input to the the computers? (Please read this question in an AF447 context)

Judging from the X-31 example, one might want to be seated in an ejection seat while demonstrating that point. :E

If Friday's presentation does include a pitch up into a stall (as has been leaked), did it occur at a speed higher than actual Vstall for the configuration?? If so, AB will have some issues to deal with as well as AF.

OK465

25th May 2011, 03:51

I've been told by someone involved with the AOA program years ago that only AA and DL have ordered that option in the U.S. What carriers have you seen have the AOA gauge on the PFD and/or HUD?

misd-agin: (& BOAC)

Waving the white flag here.

You are correct. Only “some” 737 NG’s have dedicated AOA displays. I am sincerely trying to avoid A versus B and just present facts.

However, any 737 NG with a HUD has, for all practical purposes, inertial AOA displayed.

FPV’s displayed on the PFD also provide some semblance of AOA. However, the A330 FPV in the FPA/TRK mode possibly disappears below the lower white line on the PFD attitude display at high AOA, possibly without any feedback to the pilot as to un-displayed FPA.

NG HUD FPV “ghosts” when non-conformal at high AOA, and NG’s equipped with the analog/digital AOA display have just that much more information available to recognize very high AOA conditions and correlate that info with other displays.

True, it is a customer option.

deSitter

25th May 2011, 04:18

Software doesn’t deteriorate with age: it is either correct or incorrect but faults can remain dormant for long periods. Ada is very much alive and well. I find it considerably amusing to read posts where the author assumes Ada to be a stale dinosaur - they seem to be quite far removed from reality. We use Ada for commercial projects achieving superior results in comparison with other languages - fewer bugs reach binary, easier to maintain code, certified and tested compilers, self documenting, and standards that read with legal precision... to name a few benefits.

How often have I heard, over the course of my so-called "career" as a "professional", this tired refrain?

There are bodies on the sea floor as we speak, that were put there by over-reliance on automation and plain, irreducible cheapness - the corporate mentality, the idea that ideas themselves are real, and that humans need to be removed from the loop. Fault tolerance - my a__.

228 humans have been permanently removed from the loop.

JD-EE

25th May 2011, 04:23

OK465, inertial AOA, speed. and all that is fine in more or less still air or air that is moving horizontally - as happens "99.44%" of the time. When there is an updraft the real AOA may be somewhat different from what is indicated. And when we're speaking of single digit degrees that difference could be significant. It'd be nice to invent a real "relative to the air mass" speed and AOA measurement system. Speed's been done. AOA is an interesting problem.

deSitter

25th May 2011, 04:33

When there is an updraft the real AOA may be somewhat different from what is indicated. And when we're speaking of single digit degrees that difference could be significant. It'd be nice to invent a real "relative to the air mass" speed and AOA measurement system. Speed's been done. AOA is an interesting problem.

This has nothing whatsoever to do with maintaining a stable flight configuration while cruising at Mach 0.8.

JD-EE

25th May 2011, 04:34

deSitter, they might be considered to have killed themselves because of overreliance on air transportation. (If you can be crass I can trump you. If you think the programmers, designers, and everybody else involved with getting that plane into the air is not unset and feeling terrible about this accident you do not understand people very well. Programmers are people, too. And there are times we flat out TELL management there's no way in hell we're going to do what they want simply because it might have a significant probability of killing somebody when it shouldn't. Er we did some GBU-xx work in our facility. I was briefly involved in some of it. I could not handle the images that conjured. It was too close to real killing rather than communicating. I can argue that my work saved soldier's lives while they dealt with people killing me. Making the electronics in a guided bomb was just too much. We feel, too. And THAT is one of the reasons I support the military demands for Ada based software.)

So let's get real, OK. I used to be a company troubleshooter who got shoveled into situations where we had problems. I watched a high percentage of the programs that went through our facility. I was singularly impressed that I was never needed, never called in, for the Ada programs. Everything else, PL1, FORTRAN, C, Assembler*, and others needed me.

* several CPUs, usually to add features to something old.

Ada is more reliable. But, there is absolutely no way to make any human activity, even sitting on the potty and defecating, 100% safe under all conditions.

deSitter

25th May 2011, 04:49

Is that what you think my point is? I don't care what your choice of weapon is, the issue here is computerization for its own sake, of automation in the name of replacing the human spirit - the one that used to carry flight bags full of approach plates and flashlights and candy bars. My bus - Landbus (TM) driver has more authority over his craft than the person who flies me to Tahiti. This isn't about this tool or that, it's about the obsession with automation for its own sake, how it has become an end in itself. The old hands know what I mean. My motorcycle and I have an understanding.

I should also add, that one does not see a similar obsession with automation where it might matter, that is, on runways and taxiways crowded with Cheapbus RJs stewarded (can I say that word now?) by overworked ATC personnel. Why? Because there is no profit in it.

Machinbird

25th May 2011, 05:25

I don't know about automation for its own sake, but I was amazed when I learned that the airlines were using autothrottles (in whichever form you wish to call it) to manage power during cruise, which ought to be the least demanding area of flight. Do you really want to give a crew so little to do that they have resort to reading books to stay awake? Whatever happened to setting XX pounds/hour per engine fuel flow or YY EPR and then backing it off as required to hold your cruise mach. Do you really save that much fuel?

When you leave the crew so far out of the loop in the actual flying of the aircraft, can you really blame them if they have trouble coming up to speed in an emergency?

OK, yes, I'm a dinosaur. I sometimes used autothrottles (technically an approach power compensator) to manage engine power while flying my swept wing bird aboard ship at night when you can use all the help you can get. But using it in cruise??:yuk:

deSitter

25th May 2011, 05:43

What? You need help in a night carrier landing? What sort of pilot are you? :) Just call the ball or shut up and..

RR_NDB

25th May 2011, 05:45

Machinbird @ #2321 (http://www.pprune.org/tech-log/449639-af-447-search-resume-part2-117.html#post6471508)

Judging from the X-31 example, one might want to be seated in an ejection seat while demonstrating that point.

:mad:To avoid the costs of ejection seats (or capsule) and destructive testing of the a/c why not to test in the same flights an augmented "APU" turbine? With a 45° rotating nozzle if necessary?:mad:

Back to uncensored mode:

Question:

A minimum of how many kN, for this class of a/c, would be required to play a "recovery from stall"? And for generic "unusual attitudes"? (using a 45° nozzle)

davionics

25th May 2011, 06:07

deSitter; Very simply, were there no accidents before computers were introduced into aviation?

The impeccable reliability of safety-critical computing has most likely lulled people into a false sense of security. Many accidents just wouldn't happen if there were a sober acknowledgment and balanced processing of the general risks associated with flight.

Mankind continues to push the flight envelope further, soon we will be routinely flying manned sub-orbital craft around the planet, which in itself is hardly a bad thing. Computers have enabled progess. But are passengers really aware (at a concious level) that they are paying to travel at near 800km/hr at -50C temperatures, through potentially hazardous weather, and in the dark?

AF could have eliminated the hazardous weather, and darkness risk factors, sacrificing schedules and incurring the cost of an AOG. A few days late, but so what? Passengers would still be alive?! Is it mankind's impatience, his disregard for the fury of the environment, is this our real culprit?

oldchina

25th May 2011, 06:10

More automation = more dangerous, is that your point?

Take a look at page 21 of this Boeing document, then please shut up.

http://www.boeing.com/news/techissues/pdf/statsum.pdf

deSitter

25th May 2011, 06:24

deSitter; Very simply, were there no accidents before computers were introduced into aviation?

Egads, I stand convicted. Let's get rid of pilots altogether, those accidents-waiting-to-happen! Vive le telechargement!

slats11

25th May 2011, 06:52

keitaidenwa

25th May 2011, 07:16

You are correct. Only “some” 737 NG’s have dedicated AOA displays. I am sincerely trying to avoid A versus B and just present facts.

However, any 737 NG with a HUD has, for all practical purposes, inertial AOA displayed.
...
True, it is a customer option.
The concept of having safety enabling features as "customer option" is somewhat scary. Assume an accident happen and the accident investigation finds out that "lack of AOA information to pilots contributed significantly to the cause". Should the blame fall into the airline beancounters who saved by skipping an "unnecessary option". Or the airplane maker, whose business model includes making extra profit with optional features?

To get back to AF447, the Air France beancounters were reluctant to upgrade pitot tubes to safer ones. I have no idea what the price of the pitot upgrade was, but probably it was not cheap, since it got beancounters on their toes. Blame beancounters? Well, the other side of the coin is that Airbus/Thales was making a profit on what was essentially a safety fix...

Razoray

25th May 2011, 07:25

The impeccable reliability of safety-critical computing has most likely lulled people into a false sense of security. Many accidents just wouldn't happen if there were a sober acknowledgment and balanced processing of the general risks associated with flight.This is an attempt to redirect the recent negative tone of this thread. :eek:

This statement is a very good one. Yes, automation has advanced aviation safety...on the flip side it also has created a false sense of security.

That is why this is a watershed event. It seems that AF447, with what we think we know at this point, is the "perfect storm" of the "human vs. automation" argument. So the point of conversation should not be whether you would rather have HAL flying you around, or a Sky God from the past flying by the seat of his pants! The point should be how do we move beyond this discomfort and meld man and machine. My guess is it may take more man power than originally assumed...which my cause some impediments on advancement.

BOAC

25th May 2011, 07:58

'keitei' makes an interesting point in #2335 .

May we put this 'AoA/FPV' etc discussion to bed here please? You can have a 'safe' AoA with a dangerous FPV and vice versa. AoA, as those who have used it know, is a great tool for approach and landing. Trying to 'peg' a value of 'AoA' or an 'FPV' in the middle of a storm area would, I suggest, defeat most 'sky gods'. The more info you put on a display, the more 'chimes/alerts/ECAM messages you insert, the more challenging it is to sort wheat from chaff when it all turns to crock - sensory overload cuts in big time, and I'm sure happened here, and the captain (reportedly) shouting commands at the pilots could have added to the distraction (Q - what is the first 'sense' to be lost under stress?).

The message is clear, if 'old-fashioned' and not 'software driven'. Maintaining the correct pitch and power will generally get you out of trouble, despite temporary 'excursions', even momentary stalls/high-speed excursions, if the weather is really rough. Overall you should get through it. Rely on what may be badly degraded bells and whistles or excessive clever and pretty CRT displayed info and you may well not.

Squawk_ident

25th May 2011, 08:30

Source Vesseltracker
"Since May 21, another 29 bodies have been recovered from the wreck of the crashed Air France flight from the bottom of the Atlantic by the "Ile de Sein". The ship had returned to the crash site off the Brazilian coast on May 21 coming from Senegal with a replacement crew. Meanwhile a total of 82 human remains have been recovered of the 216 passengers and 12 crew members on board the AF 447 flight."

I think that the authorities are now focusing on bodies recovering rather than the wreckages by themselves.
I'm still wondering if the cockpit has been recovered and bring to the surface.
During the last BEA press conference, Mr Bouillard briefly spoke of the cockpit recovering and it was not clear, even for him, whether it had be lifted to the surface or would be "soon". I have not recorded the footage and I don't recall exactly what he said precisely.

amos2

25th May 2011, 08:43

...and the embarrassment continues!

sensor_validation

25th May 2011, 08:51

There are two problems with unreliable airspeed:
1. The unreliable airpeed per se.
2. The bigger problem is when the system (and the pilot) does not recognise that the airspeed is unreliable - and automation then insidiously takes the aircraft closer to the edge of the flight envelope.

Although the system obviously works most of the time, there is a weakness if the system uses 3 identical tubes to detect a problem. If the problem effects all 3 equally, then it can be missed. It will be unreliable, but not recognised as unreliable. Just as three 2nd graders can't together do 6th grade math, 3 problem tubes can't reliably determine airspeed (nor even the state of unreliable airspeed).

With pitot tubes, you are using air flow through the tube to create a pressure, which you then compensate for altitude by using static sensors, and then converting this compensated pressure back into flow (or airspeed). There are a lot of links in this chain. Even worse, a problem could generate either an over-speed (eg blocked pitot drain hole) or an under-speed (blocked tube).

When it is difficult to measure something important, an alternative that is easy to measure becomes important. And so it was 200-300 years ago - flow was difficult to measure, pressure was easy, and so we calculated flow from pressure.

Maybe the time has come for us to measure flow, and thus airspeed directly. Presumably that is the principle behind the laser systems currently being developed.

It may be that pitot tubes today are dinosaurs looking for a tar pit.

Pitot tube measure airspeed via dynamic pressure, this is also what the wings use to generate lift. Measuring air molecule approach speed (laser?) will still need air density from static pressure and temperature from temperature probe. Pitot tubes are simple and have well known failure modes - how long will it take to develop alternatives to the same level of maturity?

What is not clear is why these simple devices seem to have increased number of incidents in cruise - in conditions that are uncertain and do not form part of any current certification requirements. Is it subtle changes to planned flightpaths or "Climate Change". I have no doubt if a reliable test of the "alleged supercooled liquid" or my preferred explanation of "particle size distribution of micro-fine ice crystals" can be generated - pitot tube heating can be redesigned to prevent blockage - but don't hold your breath waiting to get them introduced any time soon.

The now preferred Goodrich probe has also already suffered icing, but my understanding is that it is less likely for the drain hole to block, so blockage of the ram port should give a more obviously failed low reading, for example:-

Investigation: AO-2009-065 - Unreliable airspeed indication - 710 km south of Guam, 28 October 2009, VH-EBA, Airbus A330 202 (http://www.atsb.gov.au/publications/investigation_reports/2009/aair/ao-2009-065.aspx)

..
To get back to AF447, the Air France beancounters were reluctant to upgrade pitot tubes to safer ones. I have no idea what the price of the pitot upgrade was, but probably it was not cheap, since it got beancounters on their toes. Blame beancounters? Well, the other side of the coin is that Airbus/Thales was making a profit on what was essentially a safety fix...

To be fair there was (and still is) a technical debate as to whether the alternate probes are significantly better for high altitude icing. The change was not a mandatory safety requirement, there was just a logistical supply issue and biggest cost would have been taking planes out of revenue generating service for unscheduled service.

in my last airline

25th May 2011, 10:31

Some great reading and food for thought here. I especially find myself siding with desitter. Aside from the pros and cons of automation I think that EU OPS (JAR OPS) and regulators as a whole have a part to play in the short comings of this accident. Whilst EU OPS has improved the training depts output in low end airlines, their rule-making may have had the opposite effect on the bean-counter led airlines training depts. The bean counters are constantly putting pressure on training dept heads to cut costs and slim down. The, 'we train to proficiency' (no more no less) mentality is now showing the fruits of it's labour. Personally I don't remember any really challenging training scenarios for many years now, actually since 1997. The usual LPC items have been covered and the training day is the usual rushed affair with trainers who have less and less to give, or are allowed to give. Very prescriptive, sterile packages. Very few 'old boys' that put you through the ring with scenarios that are multi dimensional. God forbid that we give our pilots multiple failures, they might fail! That would cost money and that's not an option.
It's time to train hard again, it's time the regulators got real with training, it's time that pilots with 'heavy training files' were given the extra mile, and it's time that PC took a backseat and allowed the truth to be told. A few egos may be bruised but a few lives may be saved.

deSitter

25th May 2011, 11:40

Razoray said "So the point of conversation should not be whether you would rather have HAL flying you around, or a Sky God from the past flying by the seat of his pants!"

That's right, and it's not. It's about over-reliance on automation in all aspects of our modern existence, not just in the air. I can't begin to tell you the damage this has done to my own specialty, physics, where people are starting to take models as reality, and to actually believe that the model is giving them direct information about the world. This has gone so far as to cause people to imagine that they've got reality licked down to the first nanoseconds of existence, and that up to 95 percent of the universe is unobservable, and all this within 100 years of discovering its most basic rules. In this toxic and neurotic environment, it's almost impossible to have a reasoned discussion - the digital universe has acquired a life of its own, and a strange religious fervor has settled over what should be the most rational and sane of investigative bodies. One fantastic whopper after another emerges from the dark vortex of neurosis that has ingested academic physics.

There is no earthly reason to have an airplane whose crew are mere stewards to some cheap pile of circuits somewhere in its chin. There is nothing wrong with using computers to help control an airplane, but from reading all this catechism of modes and laws of the FMC, I'm strongly reminded of the irreal universe of modern physics. The same deadly neurosis is sweeping over aviation under the pretense of cost savings. There is something utterly disturbing about the idea of a perfectly good, flyable airplane falling from the sky because its crew are sitting there staring at screens and processing idiotically coded error reports generated by some pimply digeratus with a belly full of fast food and soda in some tacky office who knows where? I've seen IT/software engineering/whatever buzzword you wish to use from the inside and it's ugly, and whether it's a pile of milspec engineers or a crowd of H1B slaves makes no difference.

DozyWannabe

25th May 2011, 11:45

...some pimply digeratus with a belly full of fast food and soda in some tacky office who knows where?

Jebus - that's some serious bile you have there. Ever tried counselling?

I've seen IT/software engineering/whatever buzzword you wish to use from the inside and it's ugly, and whether it's a pile of milspec engineers or a crowd of H1B slaves makes no difference.

Then as a physicist - a man of science and reason - you of all people should be aware of the dangers of confusing a single anecdote with data.

forget

25th May 2011, 11:45

de sitter. :eek: That is probably the truest statement in ........... the history of the universe. :D

SaturnV

25th May 2011, 12:11

squawk ident, thank you for the update.

That would seem to be a very fast recovery rate, given the time it takes to get to the bottom and then back up.

It may be that the Ile de Sein's crew change was to bring aboard more members of the National Gendarmerie.

The Head of the GTA’s Investigation Unit further indicated that the recovery of bodies is an especially difficult operation whose success in uncertain. Should it succeed, all the necessary arrangements will be made on board by IRCGN* experts whose team will be strengthened. The identification procedure will later be performed in France in accordance with international
protocols.
http://www.diplomatie.gouv.fr/fr/IMG/pdf/17_Lettre_d_info_anglais.pdf

* National Gendarmerie’s Criminal Research Institute (IRCGN)

Speculation, but this recovery phase may be concentrating only on recovery of the bodies, and once that is completed, the Ile de Sein would again swap crews if any other parts of the plane are to be retrieved in the future.

deSitter

25th May 2011, 12:24

DozyWan, anyone who appreciates the ugly reality of pseudo-engineering cannot help but be galled.

DozyWannabe

25th May 2011, 12:29

DozyWan, anyone who appreciates the ugly reality of pseudo-engineering cannot help but be galled.

Trust me, if you'd actually studied Software Engineering at even an undergraduate level, you'd quickly realise it's a discipline that shares the same reliance on repetition, models and a*se-achingly dry textbooks filled with complex graphs and barely-comprehensible formulae as engineering of any other stripe. Are you stating that as far as you're concerned the only "real" engineering exists in the physical realm?

Some Computer Science degrees these days tends to effectively be BSc Java Programming, however a Software Engineering degree is a very different beast that happens to share the same underpinnings.

Jig Peter

25th May 2011, 12:38

One or more Pitot tubes have been fitted to most aircraft that have ever flownn and a better system of finding one's airspeed has yet to become general aviation practice - or even perhaps, invented.
This, basically, for those who find to their horror, that all aircraft, ancient of modern, have a "single point of failure".
Mr. Pitot's invention has served aviation well, worldwide, and throughout the ages, so calm down people ... !!

Lonewolf_50

25th May 2011, 12:46

More automation = more dangerous, is that your point?
Strawman, and a misreading of deSitter's theme. His point is behavioral and systemic, which is over-reliance on automation, which leads to an imbalance in the man-machine interface.
Take a look at page 21 of this Boeing document, then please shut up.

One would expect that, over the time frame given, and the amount of time and effort expended, that causal factors would be identified and solutions proposed. The accident rate would be expected to go down, due to a cultural imperative that it do so. It has been reduced thanks to the flying community communicating to, educating, and training pilots, crews, and all ground staff on accident prevention. Likewise the technical fixes/advancements that have come along. (IFF? TCAS? ILS? GPS? Wind Shear detection?)

That said, each tool has its limits, and traps.

What has also happened in the last sixty years, oldchina, is that we now fly successfully in conditions that we could not at the start point of that graph. So we do. In the year 2011, passenger aircraft are able to risk departing from and landing in more dangerous conditions than when I was born. You could say we are collectively trying to get to the very edge of the danger zone on a routine basis. So the risk profile (and the need for greater mitigation) is much higher now.

The man-machine interface is at the heart of modern machine accidents.

The most effective mitigation for that is training and profieincy in use, as well as awareness of the machine's limitations. As true of my car, or lawn mower, as of any aircraft I ever flew.

I don't think those numbers tell you what you were asserting in your demand that deSitter shut up.

forget

25th May 2011, 12:47

Jig Peter's right. The Space Shuttle has ................... pitot tubes.

NASA Media Item (http://mediaarchive.ksc.nasa.gov/imageviewer.cfm?mediaid=29475&mr=l&w=0&h=0&fn=06pd1584&sn=KSC-06pd-1584)

Graybeard

25th May 2011, 12:53

Agreed, Jig Peter. There are thousands of planes relying on pitot at this instant. Icing seems to be a rare event, and even more rare in non-Airbus.

Thanks to Sensor Validation for the OZ link, from which I quote.

On 28 October 2009, an Airbus A330-202 (A330) aircraft, registered VH-EBA (EBA), was being operated as Jetstar flight 12 on a scheduled passenger service from Narita, Japan to Coolangatta, Australia. Soon after entering cloud at 39,000 ft, there was a brief period of disagreement between the aircraft's three sources of airspeed information. The autopilot, autothrust and flight directors disconnected, a NAV ADR DISAGREE caution message occurred, and the flight control system reverted to alternate law, which meant that some flight envelope protections were no longer available. There was no effect on the aircraft's flight path, and the flight crew followed the operator's documented procedures. The airspeed disagreement was due to a temporary obstruction of the captain's and standby pitot probes, probably due to ice crystals. A similar event occurred on the same aircraft on 15 March 2009.

The rate of unreliable airspeed events involving the make of pitot probes fitted to EBA (Goodrich 0851HL) was substantially lower than for other probes previously approved for fitment to A330/A340 aircraft. However, both of the events involving EBA occurred in environmental conditions outside those specified in the certification requirements for the pitot probes. The French Bureau d'Enquêtes et d'Analyses pour la sécurité de l'aviation civile (BEA) has recommended the European Aviation Safety Agency (EASA) to review the certification criteria for pitot probes in icing environments.

Are they building the best pitot they can, or just building to (inadequate) requirements?

3holelover

25th May 2011, 13:43

a better system of finding one's airspeed has yet to become general aviation practiceI'd suggest there is a high probability that the reason that is so, is because "general aviation practice" has commonly been to follow the axiom: If it ain't broke, don't fix it.

As these UAS incidents have been on the increase, and probably already "contributed"* to major loss of life, perhaps it's time to consider Mr. Pitot's tubes "broke"? There are plenty of other ways to measure airspeed... Surely one less disturbed by ice crystals could be adopted for back-up at altitudes where they're encountered?

* Though the statement UAS "is not cause for Loss of Control" is undoubtedly correct, I think it is likely to be a significant link in a chain of causal events.

slats11

25th May 2011, 13:47

Mr. Pitot's invention has served aviation well, worldwide, and throughout the ages, so calm down people ... !!

Very true. But maybe their time is drawing to a close Its not that the pitot tube has suddenly become inadequate. The issue is that the rest of the system has moved on over 200 years - to the point that the system the pitot inputs to now may not adequately cope with the occasional pitot malfunction.GIGO.

Pitot tubes must have been suffering from occasional episodes of icing for many years. The problem is not so much that the tube generates a false airspeed. The problem is that the technology may not be able to reliably pick an UAS state, makes changes assuming the false airspeed to be true, and the pilot is increasingly out of the loop with degraded SA.

I would like to see more emphasis on pilot training and simulation as suggested by others. I really would. Not to turn back the clock and throw out the automation. But to help improve the pilot:system interface, which is something I suspect has been neglected somewhat. For many reasons, I am doubtful that is going to happen however - a new generation less critical of technology, economics, start-up airlines in developing countries (with some very poor track records), existing airlines facing increased competition, reducing hours requirements.......

Its not just aviation. Its every aspect of our lives. Less understanding, but more acceptance of technology (? blind faith) despite this decreased understanding.

forget

25th May 2011, 13:51

Pitot tubes must have been suffering from occasional episodes of icing for many years.

Would it help if the heating elements were beefed up? Too low tech?

bearfoil

25th May 2011, 14:16

On an emergent path to DIRECT LAW, the automatics degrade, losing protections. From 'Monitor' to PIC, the pilot gains SA and acquires command as the Computed Flight Path disappears. I submit that in any "Loss" of acuity, whether Man or Machine, one be selected immediately to Fly the airplane.

BOAC wrote some scholarly papers on this. Can we see the links?

mojodaso

25th May 2011, 14:20

I have little understanding of the complexities being discussed on this forum but have learned a lot from the lively discussion. But there comes a time to acknowledge excellence in an entirely other realm. As General George Patton said, "Sometimes I get carried away by my own elegance" and he was referring to his speech. Terms like "purple pissing Japs" come to mind. BTW General Patton "troubled" the German military stategists who feared his out of the box creativity, but I digress.

I am here to award the General George S. Patton speech elegance medal to deSitter who has risen to commendable heights is his literary elegance rare among the individuals in the digital age.

Following are excerpts of the text considered in this prestigious award.

"…people are starting to take models as reality, and to actually believe that the model is giving them direct information about the world….cause people to imagine that they've got reality licked down to the first nanoseconds of existence… and that up to 95 percent of the universe is unobservable… In this toxic and neurotic environment…the digital universe has acquired a life of its own, and a strange religious fervor has settled over… One fantastic whopper after another emerges from the dark vortex of neurosis that has ingested academic physics…There is no earthly reason to have an airplane whose crew are mere stewards to some cheap pile of circuits somewhere in its chin… irreal universe of modern physics. The same deadly neurosis is sweeping over aviation under the pretense of cost savings. There is something utterly disturbing about the idea of a perfectly good, flyable airplane falling from the sky because its crew are sitting there staring at screens and processing idiotically coded error reports generated by some pimply digeratus with a belly full of fast food and soda in some tacky office… it's ugly, and whether it's a pile of milspec engineers or a crowd of H1B slaves makes no difference…

For anyone violently opposed to this honor, we have just for you the Field Marshal, the Right Honourable Bernard Law Montgomery Operation Market Garden medal which is made of re-cycled aluminium in the shape of a wilted cabbage head. A monetary award of 25 expired stock options in Citibank are included with the prize. (Some have demeaned this award by calling it the ******** Medal in honour of Field Marshall Montgomery, and while it is discriptively accurate of the Field Marshall we at the Military Academy would have preferred the term "Cabbagehead").

The phrase "dark vortex of neurosis that has ingested academic physics" is just so Pattonesque.

deSitter

25th May 2011, 14:23

DozyWannabe said "Trust me, if you'd actually studied Software Engineering at even an undergraduate level, you'd quickly realise it's a discipline that shares the same reliance on repetition, models and a*se-achingly dry textbooks filled with complex graphs and barely-comprehensible formulae as engineering of any other stripe. Are you stating that as far as you're concerned the only "real" engineering exists in the physical realm?"

Yes, that's exactly what I'm stating. If it were real engineering it would be impossible for so many dolts to make money doing it. And the dress-up process for done for it, those ridiculous texts which are a mockery of knowledge compared to, say, the laboriously wheedled out facts of turbulent flow, make it look all the more like an aging strumpet.

Systems integration, which may or may not contain software components, is real engineering. That said, programming and networking are in their best forms elaborately detailed crafts that require extremely skilled craftsmen to execute - and how many of these have I met in my lifetime? Perhaps three.

BOAC

25th May 2011, 14:46

BOAC wrote some scholarly papers on this. Can we see the links?- heck - if it's money you want to borrow, just say......................:)

http://www.pprune.org/safety-crm-qa-emergency-response-planning/379780-computers-cockpit-safety-aviation.html will take you where I think you want - it has dropped to a lower page on the forum, but I suspect will become quite relevant again over the next few weeks.

GarageYears

25th May 2011, 15:11

Presumably there are a fair share of "dolts" in the physics world... however it's rather ironic isn't it? We're sitting here communicating over a massively connected, highly reliable IT network spanning the world, able to message pretty much anyone in realtime, and appear to want to paint the entire slice of the engineering world that make it work (and airplane software, etc - broad-brush "IT") as spotty, big-mac munching, money-grabbing "dolts". Shame on them.

The fact that there are many, many highly educated, professional, thoughtful software engineers, that understand the serious nature of safety critical software (for example - it's not just safety critical s/w) seems to be beyond deSitter - I presume you are bitter for some good reason - maybe Word crashed on you one too many times?

Anyway this thread seems to have seriously lost it's way. Right now we have no evidence that the intrinsic problem relates to the automation. Some here are assuming so and making 'it' (IT) the root of all evil.

Basically I say "bollocks" to that - the days of the open shirted, cigar smoking, "hero"wresting the bucking bronco radial engined monster from the dark skies is GONE.

That is not to say there are not improvements possible - but the Luddites are not going to win.

takata

25th May 2011, 15:30

Hi,
Agreed, Jig Peter. There are thousands of planes relying on pitot at this instant. Icing seems to be a rare event, and even more rare in non-Airbus.
Excepted very few experimental aircraft, all others, civil or military, be there small or big, are still relying on pitot tubes today because it is the most robust piece (of very simple hardware) available for doing quite well the job required in most circumstances. Nonetheless, it is also known as one of the major cause for aircraft accidents (mostly in light aviation).
Icing/obstructions by rain, foreign objects, poor maintenance, is not rare. What is a very rare is the fact that long hauls airliners could be affected at cruise levels and lose more than one probe, or all of them, in a very short window of time (as generaly, it doesn't last more than few dozens of seconds, it is erratic for a short while, then return to normal).

I'm not sure that Airbus airframes are more affected than competitors as no statistics about it is available anywhere (and most of the time, plenty of frequent events, like single failures, are not even reported at all). Only companies operating both Boeing and Airbus on the same lines (and for a long time) could really make an informed comparison about those failure rates related to manufacturers/models. Sadly, they really don't like to publish those informations about their fleet "failure rates": classified matter.

Beside, those probe makers are working for any manufacturer and their specs are based on the same regulation. Hence, such consideration about Airbus probe failure rate could be only based on the fact that AF447 is attracting a wide attention on probes issues related to certain flight conditions. This caused some data to be collected around by digging in A340/330 fleet archives (many such cases were unknown by operator/regulators and Airbus before June 1st 2009).

For example, an internal Delta Air Lines memo is quoted here Incident: Northwest A333 over East China Sea on Jun 23rd 2009, unreliable airspeed (http://avherald.com/h?article=41bb9740) and is showing that there was an internal survey of such kind of issues dating from 2006, which is giving some intersting figures about this failure/rate and issue analysis on Northwest A330s fleet:
A memo dated June 17th 2009 circulating within Delta Airlines (parent company of Northwest Airlines) states, that the airline's data support the theory of blockages rather than icing of pitot tubes stating, that constantly heated items don't just instantly freeze up and thaw again. The manufacturer has indicated, that the drain size of the pitot tubes is insufficient in the original probe. 0.0012 percent of the flights (approx. 1 in 83.300) are affected according to data collected by Delta Airlines since 2006, incidents have only occured on flight levels 330 to 400 in moderate and stronger turbulence during months of May to December between latitudes North 3 and North 37 degrees.

The memo also describes, that usually the airspeed drops to between 80 and 60 KIAS, the airspeed returning to normal within 4 to 32 seconds. The encounter may be single or repeat over a couple of minutes, followed by normal airspeed operation during the remainder of the flight. Master Caution and Master Warning will activate, the autopilot and autothrust systems disengage, the autopilot not accepting to be reengaged until airspeed is back to normal. Autothrottle will enter thrust lock until throttle levers are moved or autothrust is reengaged. If two systems are involved, an ADR DISAGREE message occurs, the fly by wire will drop to alternate law if the disagree lasts more than 10 seconds and will remain in alternate law for the remainder of the flight. Normal autopilot and autothrust operation can be expected once the event is over.

Delta/Northwest Airlines are replacing the pitot tubes on all their A330 aircraft as quickly as possible.One should note also the fact that Northwest A330s were equiped with the same Thales/Sextant "C16195AA" probes as Air France A330s and that they did not change them, neither before nor right after AF447 (despite being aware of some issues as it was monitored from 2006): in fact, there is another incident on their fleet on the 23 June 2009, involving their A330-323, #552, registered N805NW using the same probes (see BEA 2nd report), following the one of the 11 June 2009 involving their A330-223 #620, reg. N854NW, following another one on 10 August 2008 to N809NW (A330-323 #663) after the same thing happening again on 6 August 2007 to N854NW. This frequence of "0.0012 percent of the flights (approx. 1 in 83.300)" should have been considered quite low for an event lasting only "4 to 32 seconds" for such flights cruising at FL330 to 400.

bearfoil

25th May 2011, 15:30

BOAC

:ok:

Garage Years

Whether the leaks are accurate or not, most folks anticipate a political struggle over BEA's work. Shame. And totally unnecessary. On a basic level, alot of folks here see a flaw in the automatic cockpit, and it has little to do with IT.

On both sides, and very much as you say, neither admits to stark reality. GIGO and FAIL happen. "Confusion", distraction, and boredom happen. It is too apparent that at least in one application, no, philosophy, the way out of the weed patch is forestalled by Corporate and Financial reliance on something that is presented a leetle bit as something it is not.

I think for what it's worth, a good example is the lack of readily available fall back flight data, when the event horizon looms near.

takata

"Excepted very few experimental aircraft, all others, civil or military, be there small or big, are still relying on pitot tubes today because it is the most robust piece (of very simple hardware) available for doing quite well the job required in most circumstances. Nonetheless, it is also known as one of the major cause for aircraft accidents".

NO. NO. NO. If I ever thought that a pitot could kill me, I would never fly.

The one-item ultimate MEL has to be the Operator of the aircraft. Now that can be a hard drive or a hardass, but one cannot be unprepared to aviate. Laying a crash off on equipment needs to be demonstrable. ICE is not unknown, nor unprepared for.

Graybeard

25th May 2011, 15:31

from Aero Caraibe report:
At 22:22:59, a very rapid decrease of CAS, of mach, and of altitude (correction of mach). The parameters changed respectively from 273KT to 85KT, MO.80 to MO.26 and altitude from 35,000FT to 34,700FT. At the same time, the FD1&2 and I'AP2 disconnected...

Shortly appeared six ECAM messages: F/CTL ADR DISAGREE; F/CTL ALTN LAW; F/CTL RUD TRV LIM FAULT; AUTO FLT REAC W/S DET FAULT; ENG1 EPR MODE FAULT; ENG2 EPR MODE FAULT. Each message was accompanied with MASTER CAUTION and a SINGLE CHIME. Also, the SPD LIM RED FLAG appeared on both PFD.

At 23:23:36 (their typo) and at 22:23:45, STALL was broadcast over the loudspeaker. It was accompanied by the CRICKET and illumination of MASTER WARNING.

From 22:23:00 to 22:23:54, the value of TAT diminished(?) to -14C.

AT 22:24:25, the CAS increased from 111KT to 275KT, the mach returned to initial value of MO.80 and the altutude increased quickly from 34,200FT to 34,500FT.
-----------
Note: You are welcome to correct my translation, as Spanish is the closest to French I can do.
http://www.eurocockpit.com/docs/ACA.pdf

It's obvious from the above that it was the ram tube that clogged, and the drain remained open, causing the quick decrease of airspeed. The clogging was less than 90 seconds duration. Would a longer clog time have mattered?

If the clogging had been more gradual, would the drop in sensed altitude cause the A/P to command Fly Up, rather than disconnect, and would further clogging cause lower sensed altitude increasing pitch up to the point of a real stall?

Lonewolf_50

25th May 2011, 15:43

takata: thanks for the excerpt from the NW analysis of the malfunction.

This observation of yours is one that the industry may or may not be able to remedy. (Aren't there tools/forums/industry standing working groups that concern themselves with such issues across all corporate boundaries? )

Only companies operating both Boeing and Airbus on the same lines (and for a long time) could really make an informed comparison about those failure rates related to manufacturers/models. Sadly, they really don't like to publish those informations about their fleet "failure rates": classified matter.
Is there not a means to issue "cleansed" or "raw" analysis discovered? Would not the Aircraft manufacturers and any company who operates their aircraft be in dialogue over such malfunctions?

Don't understand the industry well enough to understand if I am even asking the right question.

DozyWannabe

25th May 2011, 15:44

I presume [deSitter is] bitter for some good reason - maybe Word crashed on you one too many times?

He laid it out on the line earlier. It would appear that he got involved with a (software) company or companies that failed, and ever since has had a very dim view of the profession. There were a lot of companies (not just dot-coms) that folded around the turn of the century because far too many wannabe entrepeneurs thought that computer technology was a fail-safe way to make insane amounts of money*, it's true. It's also true that a lot of people decided to take computer science/software engineering courses in the '90s for the same reason. What I've discovered is that the ones who did it for the love of the craft tended to stick with it through the tech crash and beyond whereas those that were in it for the money have switched to management as a career path.

Some are basically ignoring the posting I made earlier where my professor went to visit Airbus - in which he explicitly states that the processes were way in advance in terms of testing and redundancy than he had previously thought and also that pilots were very much in the loop for the requirements-gathering process of the systems that went into the A320 and her descendants. In short, this is not and never was a case of eggheads trying to tell pilots what to do or stop them from doing things the way they wanted. If management and corporate finance departments in airlines are misusing automation in this way then it is a problem within the aviation industry and not the fault of the product, in the same way that blaming the manufacturers of Ginsu kitchen implements for knife crime is also nonsensical.

Anyway this thread seems to have seriously lost it's way.

You're right, and I'm going to leave this part of the discussion there.

[* - EDIT : There's a reason that the successful technology companies were either backed at an early stage by big investors (e.g. Oracle, Apple, Yahoo! and Google were all backed by Sequoia Capital), or piggybacked on the success of long-established companies (as Microsoft did with IBM, a deal partially brokered by Bill Gates's parents both being senior product lawyers for the latter) before they became successes in their own right. Any smaller-level entrepeneurs would have done well to factor that in before they put their money down.]

PickyPerkins

25th May 2011, 15:45

Graybeard

However, both of the events involving EBA occurred in environmental conditions outside those specified in the certification requirements for the pitot probes.

What exactly were the "environmental conditions outside those specified in the certification requirements for the pitot probes"?

takata

25th May 2011, 15:53

Hi Bear,
NO. NO. NO. If I ever thought that a pitot could kill me, I would never fly.
If you ever quote me, please, do not trunk my sentence by removing "(mostly in light aviation)" as in fact it is one of the main accident cause. And here, I really meant "general aviation". But I surely won't dig in my documentation in order to extract some quote for you. I'm just feeling that it is completely useless to argue with you, considering your constant use of this "selective memory" trick.

Graybeard

25th May 2011, 16:06

Maybe one reason for not testing the pitot for icing at high altitude is the lack of an objective test. Airframe, and presumably pitot, icing testing is performed at lower altitudes by following a plane that sprays droplets.

Maybe now with the availability of DC-10 and 747 aerial firefighting tankers, realistic, objective icing tests at cruise altitudes could be performed.

Takata, what is the source of your info that pitot icing in light General Aviation "is one of the main accident cause."?

bearfoil

25th May 2011, 16:07

bonjour Olivier

Had it not been in parents, I would have included it. "Mostly", then, I take your meaning.

takata

"What is a very rare is the fact that long hauls airliners could be affected at cruise levels and lose more than one probe, or all of them, in a very short window of time (as generaly, it doesn't last more than few dozens of seconds, it is erratic for a short while, then return to normal)."

You may be missing my point. It matters not whether it is B or A. If, (When), pitots crap out, it should be no more notable than other transient failures that must not be allowed to endanger a flight. It may be the way it is presented here, but UAS drill seems a bit more of an event than it needs to be. If FMS can quench the 'fire', fine, if it gets wippy and cannot, also fine; there is a critical point, seemingly accentuated by indecision, at which the safety of the a/c and its people seem in doubt.

FIX IT.

Graybeard

25th May 2011, 16:15

Arinc.com aviation has this:

The AMC is an air transport industry activity organized ARINC. The objectives of AMC are to promote reliability and reduced operating cost in air transport avionics by improving maintenance and support techniques through the exchange of technical information. AMC's premier event is the annual Avionics Maintenance Conference, attended by more than 750 avionics maintenance experts from around the world. The AMC meeting report contains technical solutions to maintenance issues that save the airline industry over $50 million annually.

For $250, you can buy your own copy of each year's report. You can bet that pitot have been discussed the last two years, especially.

KBPsen

25th May 2011, 16:23

Precisely.
I was alluding to, among others, your own self.

Diversification

25th May 2011, 16:29

The intereting discussion about airspeed measurements seems fixed on pitot systems. However, several commercially available alternatives exist. Maybe they are too expensive or too new to be used by the civil aircraft industry. Some links to illustrate my statements.
Michigan Aerospace Corporation (http://www.michaero.com)
Ophir Corporation Overview (http://www.ophir.com)
Finally as far as I have found pitot tubes are normally tested in wind-tunnels and some water sprayed on them. However, the possible conditions seem not to cover the altitudes and velocities where many aircraft fly today.
Regards

takata

25th May 2011, 16:57

Maybe one reason for not testing the pitot for icing at high altitude is the lack of an objective test. Airframe, and presumably pitot, icing testing is performed at lower altitudes by following a plane that sprays droplets.
They use also wind-tunnels, but their capacity for simulating "cruise conditions" (speed, temp, particles etc.) are actually too limited. Nonetheless, such tests are showing that probes don't freeze at the same rate as it is a very chaotical process.
The other factor, in fact the primary factor, is to identify (then modeling) the threat in order to address any probe/sensor design flaw: it is probably an ice crystal which size is about a flour grain but may be encountered in very high density ratio in particular conditions. Nobody is able to recreate it in lab and there is no means for taking a sample back into the lab (as no atmosphere sample can survive out of its environment!). This issue need to be studied in situ (into those specific tropical clouds)... and if such phenomenom exist, it is far from being a frequent one.

Takata, what is the source of your info that pitot icing in light General Aviation "is one of the main accident cause."?
You should be able to retrieve it by googling for "pitot+ice": I don't have it here but I think it is taken from a symposium (around 2007) which was addressing those pitots issues, and more generaly those icing problems. There was a dedicated site with several dozens of very interesting papers made by scientists working on such problems for years (this is far from being new, this issue affects everybody in the industry).

ChristiaanJ

25th May 2011, 17:00

Maybe one reason for not testing the pitot for icing at high altitude is the lack of an objective test.I was on the point of posting something similar....

I'm baffled by those who want to replace the pitot by something else.
Nothing wrong with the principle, except the possibility of clogging up by icing (or wasp nests, but that's another story).
Re icing, the solution exists... it's called "pitot heat".

As already mentioned pages back, the certification standards for pitot sensors and pitot heating are ancient and totally obsolete, and I'm amazed that subject was not pursued further..
What's needed is not another gadget, but enough research and hard work to bring those standards up to a satisfactory conformity with the present-day operating environments.
In a way, UAS procedures are a joke... a band-aid on a big open sore. They shouldn't be needed... air data are basic and simple, and should be reliable, not need guessing by the crew "what is it doing now...?"

With Thales and Goodrich both mentioned repeatedly... I'm sure both companies would be delighted having unequivocal and reliable certification standards, rather than being hauled over the hot coals time and again.

Graybeard, you're right about testing.... "proper" icing conditions are not always easy to find, as we found out with Concorde.
And spraying from an aircraft in front doesn't really create the right conditions either.... there are comments in the flight test reports of great chunks of ice and "bloody great snowballs" only barely missing the windshield.
I think the knowledge about the various forms of ice and supercooled water at current operating altitudes (such as in the ITCZ) is still very sketchy, if not anecdotical. Reproducing the same conditions reliably at ground level (wind tunnel or otherwise) isn't evident, either.

Lonewolf_50

25th May 2011, 17:04

GB, thank you. Are operators/pilots a part of that collegial working group, or not?

(I have been to a few "users group" symposiums at the airfcraft level, which is what I had in mind when I asked the question.)

jcjeant

25th May 2011, 18:23

Hi,

Pitot tube......
Pitot tube was designed time ago ....
It was not firstly designed for aviation.
And when used in aviation .. his first usage was to give at the pilot and indication of speed
Today pitot tube is also used to give information to flight computers and this at altitudes not corresponding at the capabilities of the design
So it's not a surprise for everyone that some problems can arise.
Mixing of new and old technology (design) is the safe way to go ????

Machinbird

25th May 2011, 19:22

Pitot tubes have been around for a long time, but they are not the end-all solution for airspeed measurement. Other technology even predates that. Take this example from WWI:

http://thevintageaviator.co.nz/files/images/wilhelm-morrell-anemometer-type-airspeed-indicators/screensize/airspeed_indicators-3-9-10-021.screensize.jpg

Diversification has posted links to two companies doing work with Laser measurement of windspeed. Previously we noted another set of patents related to use of lasers for airspeed measurement.

FBW aircraft have unique requirements for airspeed information that is not obvious to the casual observer. They need to know the airspeed in order to properly set system gains. This is critical for proper performance of the control servo loops.

The increasing prevalence of FBW technology is exacerbating the pre-existing problems with pitot icing.

Used to be, you iced up the pitot enroute, no big deal. Leave the trim and power set and pretty soon it will come back. And if it doesn't, it still flies like an aircraft and you can keep in a safe speed range by proper use of power, speed brakes, attitude, AOA, or whatever else works on that aircraft for that purpose.

On a FBW aircraft that trims itself, the situation is different. The aircraft suddenly has no idea if the power is set correctly, no idea if the control system gain is set correctly, and once it tries to change trim, has no idea if that is set correctly. The designers wisely pass control to a higher level computer that can figure this out.
Unfortunately, the higher level computer may have been processing other tasks, and has not been involved with actual control of the aircraft since 2 landings ago.

Add to this an array of messages sent by the computer relinquishing control trying to describe its problems and advising corrective actions, but initially delivered out of priority sequence. Further add to this what must be a cacophony of bells, clicks, alert tones, and short musical sequences in the audio spectrum.

If the FBW aircraft flew like an aircraft at this point, and I had flown it before in that configuration, probably no big deal, but the computer is still trying to help me out and I am lulled by its help. Four of five critical tasks are still being handled by the computer.

All I have to do is remember to handle the last critical task, wait for the display to settle, and push buttons, turn knobs in a carefully considered sequence.

When you consider the implications of loss of airspeed information on a FBW aircraft in full detail, it is an unacceptable risk.
It is time to provide more diversity in airspeed sources.

gums

25th May 2011, 19:38

Thanks for the link, BOAC. I had seen the thing two years ago when looking here for rumors and facts and opinions from "professional" pilots concerning the AF crash. I didn't post here then, but prolly should have joined the fray.

Despite one poster's complaint here, I have been compelled to add my 2 cents worth as I had experience with both FBW and "modern" cockpits/avionics. Granted, my background was military, but I assure you that several here prolly fly with the Guard or Reserve. point being, the AF crash will certainly raise questions as to FBW and the human interface with the plane. Anyone disagree?

Call me a dinosaur, but I adapted, maybe even prospered. From cables/pulleys/pushrods to hydraulic valves operated by the stick ( zero feel from the control surfaces) to a complete "electric jet" whose performance was only made possible by a FBW system.

On the cockpit side, I went from a fairly sophisticated interceptor with an awesome autopilot and avionics suite for its time to a completely manual, pushrod system and no autopilot or radar for four years, and then to a cosmic jet - the A-7D. Then to the F-16.

The human interface in the cockpit of the 'bus is sure to become an issue after this Friday, ya think? Trust me, I prolly flew with an inertial system and other things before many here. The jet, A-7D, had a HUD that displayed speed, altitude ( radar or baro), AoA and the magic flight path vector with associated pitch lines. It had a projected map display coupled to the nav system and a super ground radar we could use for bombing, navigating and avoiding storms. See the article about the map by Capt McAdoo ( gums in his earlier years with all his teeth, heh heh) here:

http://sluf.org/misc_pages/fwr_winter_1973.pdf

The Vought human factor folks did an awesome job, and we WERE NOT overwhelmed with a deluge of data or confusing failure messages/warnings/cautions when things turned to worms. The biggest thing was reduced pilot workload. Navigation capability was a quantum leap ahead of all other military jets at the time, as was bomb delivery capability. We still carried our circular slide rule and paper maps, but they were for emergencies.

Apparently, some folks are concerned about the human interface in modern airliners, and I go with the folks that desire/demand a better interface. I fully understand the change from "flying" to "managing systems". But I don't understand a cockpit that can overwhelm the crew with a plethora of warnings and cautions and beeps/chirps/etc. And I also don't understand a cockpit that does not supply a straightforward means of reverting to basic flight control laws upon demand by the humans in the cockpit.

Somebody show 'bird how to change the size of his graphics! Doggone page is now a thousand characters in width, gasp.

llagonne66

25th May 2011, 19:45

Main problem this equipment (amongst others) is not its technology (simple and sturdy) but its certification specification dating back roughly to the early jet age in the last millenium.
Today's long-haul operations are led a a far more stringent environment than in those (golden, some of the posters will surely say :)) days.
We can be certain that the people who had established and validated the pitot's specification had never thought about flights at FL 350+, at -50° (and even below) and during several hours.
Time is up to revisit this type of "old" specs to ensure that they are still applicable in today operations.

sensor_validation

25th May 2011, 19:52

Apologies if posted before but details of release on Friday now up on BEA site

25 May 2011 briefingThe BEA has decided to publish a note with information on the first facts established, based on analysis of the data from the flight recorders. This note will be put on line on Friday 27 May at the beginning of the afternoon and will be available in English, French, German and Portuguese. There will be no press briefing.

bearfoil

25th May 2011, 19:56

Well. A Boeing with 8 turbojets and swept wings flew to 50k and higher.
The design is Sixty years old.

The technology is the problem, by process of elimination. Either the computer in the Airbus cannot fly without IAS, or it is incapable of retreating from the stage without insisting it be paid attention to first. Without BUSS, a pilot who has come to lean on a seemingly steady platform (with the encouragement and training and paychex of the operator) is sol. Wouldn't be the first time a lady seduced a gent to his doom.

llagonne66

25th May 2011, 20:01

I dunno about that.
We can even talk about the Blackbird regarding altitude performance !

But, if we come back to airline ops, I guess my point remains valid.
We have a piece of equipment that is designed against specs that are not in line with today's requirements.

bearfoil

25th May 2011, 20:16

llagonne66

You may be right. Some one soon is going to ask if the flight was survivable.

By that I mean, some blend of autoflight (NOT AUTOPILOT), and Captain/FO could have punched through to Paris (Or Afrique, or...). In two years I have been unable to come up with a good story Air France (and Airbus) could use to deflect liability. If there is one, I'm stumped.

Because it looks like she made it to the water with both engines alight. If it is a couple ounces of frozen water, then that makes a poor wall behind which to hide.

You said.... "....But, if we come back to airline ops, I guess my point remains valid. We have a piece of equipment that is designed against specs that are not in line with today's requirements...."

By equipment did you mean PRIM? or PITOT.........

llagonne66

25th May 2011, 20:25

I have strictly no trouble with the liability of anybody in this sad story (Airbus, AF, Thales, ..).

Equipment = pitot of course !!!

DozyWannabe

25th May 2011, 20:32

The technology is the problem, by process of elimination. Either the computer in the Airbus cannot fly without IAS, or it is incapable of retreating from the stage without insisting it be paid attention to first.

Good work, Professor - guess we can all pack up and go home now.

Yeesh... :rolleyes:

gums

25th May 2011, 20:38

Everything you wanted to know about the Blackbirds is here:

SR-71 Online - The Blackbird Archive (http://www.sr-71.org/blackbird/)

And it wasn't FBW.

The other plane was/is the Boeing B-52.

DozyWannabe

25th May 2011, 20:55

The Vought human factor folks did an awesome job, and we WERE NOT overwhelmed with a deluge of data or confusing failure messages/warnings/cautions when things turned to worms.

...

But I don't understand a cockpit that can overwhelm the crew with a plethora of warnings and cautions and beeps/chirps/etc.

This is nothing new, and certainly not manufacturer-specific:

This is on a Hawker-Siddeley Trident 1C (useful part is from 0:00-2:20, especially the last 30 seconds)

YouTube - ‪Blackbox - 05 - Blaming the Pilot - Part 2 of 5‬&rlm;

This is on a Boeing 757 (as is the next) - useful part is 6:30-end

YouTube - ‪(1/5) Birgenair Flight 301 (Mixed Signals)‬&rlm;

(useful part is 7:30-end)

YouTube - ‪AIR CRASH INVESTIGATION -AERO PERU 603 PART 2/5‬&rlm;

Also, SR-71 wasn't perfect - the FSMs required to set the shock cone occasionally "went rogue"...

http://www.pprune.org/military-aircrew/319897-sr71-breakup-m3.html#post4005221

Lonewolf_50

25th May 2011, 21:15

gums:

I recall from an A-7 jock the following comment (or something like this): the A-7 has one pilot and 1.3 pilots worth of workload. :cool:

He tried walking me through which finger on his left had he used to pickle what, and when, during a bombing mission, and I nearly followed him, but got lost ... some years gone. The A-7 guys at the time made a big deal about being single pilot, and leaving the bats to those that needed them. (bat ~ NFO/BN/RIO).

EDIT: from your SR-71 site.
On 24 May 1963, CIA pilot Ken Collins was flying an inertial navigation system test mission. After entering clouds, frozen water fouled the pitot-static boom and prevented correct information from reaching the standby flight instruments and the Triple Display Indicator. The aircraft subsequently entered a stall and control was lost completely followed by the onset of an inverted flat spin. The pilot ejected safely. The wreckage was recovered in two days and persons at the scene were identified and requested to sign secrecy agreements. A cover story for the press described the accident as occurring to an F-105.

Some interesting thoughts on how to improve a pitot tube. If the research into this high altitude ice phenomenon can provide sufficient data to create an improved spec, I don't doubt that the engineers at Thales, Goodrich, and others will be able to provide a more resistant probe.

That would address one of the holes in the cheese, but perhaps not all of the holes in the cheese for the AF447 crash.

RR_NDB

25th May 2011, 21:19

Hi,

Anticipating what we expect to hear about Pitot tubes from BEA there are many of us "looking" to the sensor. The invention of Henri Pitot is in the spot light.

Actually is a very simple and reliable invention. So good that is used in every a/c. And until now, a "killer product" (A trully K.I.S.S. invention)

The current a/c Systems (used by Airbus SAS, Boeing, etc.) need a reliable information of air speed. Certainly much more (than the logged 38, since 2003) cases occurred and created problems.

It seems to me there is an error when dealing with Redundancy in this issue:
(in the "extreme cases")

Why you put Redundancy in a design? When the fail rate of a single critical element is not compatible to your spec of (System) Availability. The need is obvious for "complex items" like computers (that can "fail" by Hardware, Software, etc.). EADS put 3X Redundancy ("acting as 5X")

In the case of a (vital) sensor extremely simple i don´t understand (and not agree) to use "on line" more than one! It seems an unjustifiable use of Redundancy. Perhaps "amplifying" existing limitations of current Pitot sensors (that could create a complex "soup" mixing SW, HW, Laws, etc.) :}with potential to result in stressful (even lethal) scenarios for pilots.

One may ask: And if the device breaks? (Bird impact, etc.). And if the device becomes the nest of the wasp? And if the heater fail? And if the Transducer fails? And if the wiring breaks? etc.

Any of those possibilities IMO not justify to have 3 on line (allowing a voting scheme) (being monitored/scanned) and "capable to degrade" the a/c when there is a AS "disagree". There are other possibilities or reasons to justify the redundancy? Please list! You can do "averaging, etc, by "software", for identical sensors, submitted to quite identical conditions? Why?

If you prefer to have redundant Pitot, no problem: You may put 2, 3..n with just one "on line". You could (should) "interrogate" the others to check if they are alive. Energy to them? Can be supplied. We can optimize this. Ideal number? May be 3.

If the "US made" is better (IF really is) let´s analyze and make ASAP a joint effort (US-EU) to improve the existing models. This is good for the entire Aviation industry.

We need (to deal with the rare "extreme cases") ASAP R&D for better Pitot´s. Redundancy (for identically unreliable sensors) is almost useless. Just tell you (immediately? not sure!) the important sensor(s) are failing.

The reading of n sensors could be used to "anticipate" the Main sensor is going to fail. Alerting the crew before the a/c starts to "degrade". (I´m using the term "degrade" just to simplify). As an alarm of "closeness of extreme conditions".

(to be continued)

Question:

If we make a bigger (size) one (scale 2X, 3X, nX) the "ice issue" could be improved? A bigger one, power modulated (up to 1KW) could solve the issue? No tiny holes easy to clog? (Up to 1KW? Or a non electrical, heater? Or dual heater?)

Why not to test (in real world) the "anti icing" characteristic of new designs (new size, geometry, max power, similarity to "US" model, etc) comparing (in actual flights) to the existing ones. (Checking in real time against the current US and Fr. existing models).

It seems there is a "deadlock" among the players (Cert., Mfrs.,Operators). Time now (and opportunity) to competent technicians to work and SOLVE* the issue. Keeping "bean counters" just waiting the results of the necessary R&D.

*I mean, a Pitot with better characteristics when facing the "extreme conditions"

CogSim

25th May 2011, 21:37

Here's a simple idea. Apply different heat settings to the three pitot probes. In the event of all 3 probes icing up, at least this could ensure an asymmetrical failure. This seems to be a more graceful failure mode than automatics being fooled by wrong readings for some time before the UAS condition finally arises.

Just sayin'...

testpanel

25th May 2011, 23:01

Here's a simple idea. Apply different heat settings to the three pitot probes. In the event of all 3 probes icing up, at least this could ensure an asymmetrical failure.

Sorry for the drift, if my post is impropriate pls disregard.
I was and still am very interested in this awfull accident.
I posted in june 2009 a reply at which I got "hit at" so i did not reply thereafter.
Apparently my suspision was right, the capt was not on the deck, and no, i do not and i don´t want to be right!!

I have read and learned a lot of all the aspects of this accidents, esp. the technical ones here on PPrune.

But, why was this A/C lost while others finished there flight, e.g. IB only 10 or so minutes behind them (but they diverted, 70 miles around or so?)

I am afraid it will turn out to be pilot-error; as mentioned earlier: pitch and power is performance, as far as i know that works in every airplane, A, B, C, E, F etc.

Maybe another simple idea: let pilots fresh from flightschool first do some (tough) turbo-prop flying, in stead of going straight for the big jets, with all the computers, software, defences, back-ups etc etc.

My most importand CRM/MCC is: FLY THE AIRCRAFT.

Hope i am wrong.......

CogSim

25th May 2011, 23:03

With all due respect to the brilliant minds on this forum who have been discussing alternate solutions for the pitot issue and without sounding insensitive to the families and friends of those lost to this tragic event:

The issue of pitot ice, IMVHO, is not something that warrants a complete rethink/redesign of a major sub-system like the pitot-static system. Even if this was possible, it would take years if not decades to get this done. Inferring from Airbus and other airlines' response to this problem, its reasonable to assume that they think this issue can be fixed with minor tweaks/fine-tuning of the existing well-proven system. If this is in fact their assessment, I have to say, I agree with it, notwithstanding the scale of this tragedy. Are there any reported cases of pitot ice triggered UAS events on a/c with Airbus recommended fix (of replacing the pitots) applied?

Having that said, we may learn on Friday that pitots played a more important role in the chain of events than we imagined. Even so, it is hard to conceive of a chain of events that would warrant an extreme reaction like redesigning the entire pitot-static system. Does anybody else think this is the wrong approach? We may end up creating more problems than we solve.

Then again what do I know, I'm only a pilot...

Piper_Driver

25th May 2011, 23:43

Just a wayward thought from an engineer. We know GPS is not accurate enough to be used as a backup airspeed indicator because it tracks ground speed rather that airspeed. the two are often vastly different. Might it be possible to derive a backup airspeed indication by looking at the doppler shift of weather radar returns? After all, the cloud droplets are suspended in the same air mass that the aircraft is flying through. This would only work when there were echo returns present, but then again those are the times when pitot tubes are likely to be fouled by ice.

john_tullamarine

25th May 2011, 23:57

Perhaps the pitot redesign brigade's thrust is analogous to the engineer with a solution looking for a problem (and most of us have been guilty of that at times ..)

As at least one poster suggested a few posts back, if the underlying problem is found to be pitot icing, then the appropriate first tack is to

(a) look at icing requirements in the design standards,

(b) identify and redress the Standards deficiencies and

(c) move via AD (as appropriate) to fix the presumed heating deficiency.

Such, at least, chains up the initiating problem.

That is not to suggest that the Standards ought not to be revisited in respect of automation paradigms and the philosophy of degraded modes and flight deck presentation.

If, and that's still a big if, the fallout is along the lines of the crew's being overwhelmed by mode degradation and associated alerts, then one foresees a period of Regulatory navel gazing (both certification and operational standards) in the coming months.

Lexif

26th May 2011, 00:02

I read the whole thread, and in my personal and unqualified opinion as a mere SLF, it's quite clear that on friday, all the doubters of modern aircraft design philosophy and the conspiracy theorists will have a field day - regardless of what will be revealed, it will be either the fault of Airbus, the BEA or a big coverup...:( So many people here already know what happened and don't need any facts to change their opinion...

I think it's interesting to see how many people either propose new gadgets designed to fix the "AF447-problem" or just see the modern reliance on computers and automation as the cause of the crash, but fail to prove that those "fixes" are more reliable than current "modern" technology. Because that's the design case, to reduce the number of "avoidable" crashes. Not just to fix the cause of this crash, but to improve the whole safety record. None of the doubters of "computerised planes" proved that older planes are safer, and it could very well be that these technological advances (?) improve safety for 99,999% of the flights, and that "fixing" these methods might decrease the safety of 99,999% of all flights, just to fix the freak occurance on 0,001% of all flights. (All figures are made up :ok:)

I'm not judging because I just don't know enough, but in my opinion it's up to those people to prove that on the whole balance, the safety of all flights would be improved by their proposed changes - not just the safety of those flights that encounter the same conditions as those on AF flight 447. So in my opinion it's quite obvious that the changes coming from this crash will be evolutionary (as in "bugfixes") instead of revolutionary.

But we will all know more on friday, for sure...

mm43

26th May 2011, 00:07

Originally posted by CogSim ...

...it is hard to conceive of a chain of events that would warrant an extreme reaction like redesigning the entire pitot-static system.Maybe not, provided that in the CRZ pitch and power along with static pressure and altitude is automatically monitored independently and if UAS starts to become an issue for the A/P it switches to flying the "pitch and power" equivalent to the last valid pitot data. Signal the UAS condition and at the same time show the FPV value. The crew are now aware of the condition, and the "suprise" factor has been mitigated.

As an after-thought, GPS Altitude and GS could be incorporated into the monitored triangle as a backup, should one of the other two components become suspect.

I know its not the total answer, but who/what judges the Judges?

john_tullamarine

26th May 2011, 00:38

the changes coming from this crash will be evolutionary (as in "bugfixes") instead of revolutionary.

Of course this will be the case. It has been so ever since the early days of regulated aviation.

No one is suggesting that we will ever go back to steam driven aeroplanes as representing the state of the art - in spite of the deluded and fond views held by many of us dinosaurs ... :E:}

From that sort of viewpoint, this mishap is no different to any other - an aspect of the investigation will be to look at what changes might be appropriate within the design and operating paradigms.

The interesting aspect here probably will/might be that the evolution may be more significant than what we might have seen in most previous mishaps ?

HarryMann

26th May 2011, 00:48

That is a good point though... (MM43)

Why is there not at least one reversionary A/P mode, when it's either turbulence or UAS that kick it out. As a short /temporary pre-handover mode, a sensible Pitch / Power should not be beyond its grasp, accepting that it's basically a heavily fedback airspeed-centric loop (which is far too inflexible, surely ?)

"Here you are, things are getting difficult for me, but we seem to be flying a stable AoA at a sensible thrust setting - Handing over now "

[.. in a fairly calm but determined fashion, without more than one bell or whistle]

CogSim

26th May 2011, 00:51

There was an intermittent post from bearfoil that seems to have disappeared. There were some important points about how Anomalous Design works. I just wanted to add that in the scenario I envisioned apropos discrepant pitot heat, the probes would still be triple redundant in non-icing environment. In an icing environment, however, they would "switch" to the so called anomalous design mode. I call it switch, but this would of course be completely passive on account of the fact that the heat is applied uniformly through out the entire flight.

This is way outside my areas of expertise, and I may be completely misunderstanding the concept of redundancy, so this post is purely for my own edification.

john_tullamarine

26th May 2011, 00:56

Bearfoil removed his post (although it is still there in the aether, so to speak). You might like to ask him to reinstate it. I thought it a good post

CogSim

26th May 2011, 01:02

Dear bearfoil,

I'm writing to officially request you to reinstate your post re Anomalous Design.

Sincerely yours,
Cog :)

CogSim

26th May 2011, 01:43

FLY THE AIRCRAFT.

I agree with this point.

Still, whenever I hear this, it makes me squirm. As the pilots among us know, sometimes its easier said than done. It's important to keep that in mind come Friday.

Peace.

bearfoil

26th May 2011, 02:02

cogsim

As the design consideration is approached in real time, redundant systems simply fail together. If one system has sensors that have different designs, the chance of double or triple fail becomes remote.

Identical fuel systems in BA038 failed their TRENT 700's only seven seconds apart. The failure tracked identically as each engine spooled up, then starved, and settled, with very close EPR's.

And that is a complex system. A third engine, or two more, would the failure have been the same? Very likely. A redesigned Heat Exchanger, and the problem is solved. Pitots are extremely simple, yet they have remarkably vulnerable features. A narrow aperture surrounded with a sharp leading edge that ices faster than a blunt one.

If ICE is the consideration, three separate design approaches would likely produce three anomalous solutions to the goal. Redundancy works well if in a "fallback" position, so I like your anomalous heat solution. Exposing three identical devices to the exact same conditions will produce three failed devices. If three concurrent readings are desired, better each device has different characteristics.

This is why I never understood the need to "sample" and then ask for a vote.
Likely the results of the election will be the same. If not, they soon will be.
So this is why anomalous design works well when Redundancy is simply a siren song.

This is from memory, so apologies if it isn't what you saw. I think I inserted a snarky comment about "Backup systems". So tell Air France to cancel their Goodrich deliverables, purchase the BUSS from Airbus, and happy skies......

My apologies - I presumed that Bearfoil could see and reinstate the original post which he had deleted. FYI, mods can see a deleted post and reinstate it. All deletion does is hide it from general view. There is one caveat - delete post #1 and the thread disappears into the never never.In future, if you want a deleted post undeleted - simply ask and your wish will be granted. JT

OK465

26th May 2011, 02:40

Exposing three identical devices to the exact same conditions will produce three failed devices. If three concurrent readings are desired, better each device has different characteristics.

If the devices in question are state of the art, then would not the characteristics required of the other two be a step back?

Machinbird

26th May 2011, 03:16

BEARFOIL
As the design consideration is approached in real time, redundant systems simply fail together. If one system has sensors that have different designs, the chance of double or triple fail becomes remote.Insert the word 'identical' in front of 'redundant' and I will fully concur. That was also the point of my earlier post seeking diversity in critical systems.

Yes, additional sensors will increase the logistic tail required to support an aircraft.

I would not advocate wholesale replacement of pitot tubes with a 'new concept' system, that would destroy diversity, not improve it.

Some are pointing to the fact we have documented ~18 instances of Airbus pitot tube freeze up with no adverse result. If AF447 is the one with the adverse result, then how do those statistics look?
Pretty P poor.
Even if we had 500 instances with one bad result, the rate is still unacceptable. The key to good outcomes is avoiding unnecessary risk.

Suppose there is a functional laser airspeed system available already. Suppose the barrier to its use is "we already have a good system with the pitot tube." Don't you think it is possible that by being technological Luddites, we may be holding back a promising new development that only needs a foot in the door to advance? (And to the best of my knowledge, none of my $$ is invested in such a company offering such an airspeed monitoring system.)

In the near term, I like MM43's idea about tiding the aircraft over until things can be stabilized. Give those easily confused computers some realistic data to chew on.:ok:

CogSim

26th May 2011, 03:27

Thanks for the post bear.

If ICE is the consideration, three separate design approaches would likely produce three anomalous solutions to the goal. Redundancy works well if in a "fallback" position, so I like your anomalous heat solution.

You also raised a valid point vis-a-vis the statistical credibility of such a design. Placing confidence in the divergence as you put it. (sorry to keep quoting the deleted post.) Here I think the data collected by Northwest can come in handy. Airbus has a baseline to compare against any data that may be generated from experiments, if they so chose. Who knows, even the beans may be convinced.

Graybeard

26th May 2011, 04:00

Hate to state the obvious, but how many Boeing/Douglas/Lockheed airliners have suffered multiple pitot clogging from ice?

When the pitot get iced, I have seen no mention of windshield getting iced, which means windshield heaters are more robust than pitot heaters.

augustusjeremyreborn

26th May 2011, 04:15

(Beg your mercy beforehand...)

If the rumour is right and there was an uncommanded "pitch-up":

Which really might have happened:

1 - iced pitots leading tho this pitch-up ?

2 - this pitch-up leading to a reduction higher than 30knots in measured airspeed and (not really sure) consequently to the famous acars message about the probes (and maybe the probes weren't "iced" at all) ?

Machinbird

26th May 2011, 04:40

GB
how many Boeing/Douglas/Lockheed airliners have suffered multiple pitot clogging from ice?Offhand, I can think of a B with a bad result, but that was a switchology problem.

I suspect that the question is better asked from the FBW/ Non-FBW perspective.
There are differing dependencies as mentioned earlier.

Does anyone know of a FBW airliner that does not use airspeed in the control gain calculations?

Isn't comparing windshield and pitot heating like comparing apples and oranges? Very different systems, performing different functions with different operating principles.

captainsuperstorm

26th May 2011, 04:53

guys,

why don't you wait a few days to get the result, instead to come with xxxx thousand of hypothetical answers.?

get a life!

Graybeard

26th May 2011, 05:23

Machinbird: Isn't comparing windshield and pitot heating like comparing apples and oranges? Very different systems, performing different functions with different operating principles.

Very different devices, sure, but they're heated just enough to keep ice from accumulating. They're in the exact same icing, which is reportedly outside of certification requirements, yet no report of windshield icing over?

I don't think FBW by itself is such a big deal, except it would seem easier to incorporate a reversionary pitch/power mode.

CogSim

26th May 2011, 06:05

Very different devices, sure, but they're heated just enough to keep ice from accumulating. They're in the exact same icing, which is reportedly outside of certification requirements, yet no report of windshield icing over?

From this NASA tutorial (http://aircrafticing.grc.nasa.gov/courses/inflight_icing/main.html):

http://img13.imageshack.us/img13/5715/ice1n.gif
http://img218.imageshack.us/img218/4587/ice2u.gif
http://img225.imageshack.us/img225/1273/ice3.gif

kiwiandrew

26th May 2011, 06:09

@GB

When the pitot get iced, I have seen no mention of windshield getting iced, which means windshield heaters are more robust than pitot heaters.

or possibly just that the windshield is less prone to icing than the pitots ? My (non-expert) understanding was that small items protruding ( such as pitots) ice up more easily than large surfaces (such as windshields) .

bearfoil

26th May 2011, 06:41

John Thanks, I'll remember that.

********

If a particular type is prone to eccentric behaviour it can be banal or it can be lethal. Boeing Rudder Actuator, TRENT FOHE, MD screwjack Mx demands, etc. I take particular note of NASA's warning re: Probe Icing. Rather than wait for UAS as a predictor of Probe Icing, how about a lit probe just out the F/O's side glass?

Kidding aside, Pitots are simply not the problem, not the proximal problem, anyway. There is a "procuring cause" but that remains to be seen.

OK465 "If the devices in question are state of the art, then would not the characteristics required of the other two be a step back? " See below? Anomalous design? The bold after "most definitely".

Machinbird "I would not advocate wholesale replacement of pitot tubes with a 'new concept' system, that would destroy diversity, not improve it."

Most definitely. "The original code for this system was written in isolation by three separate teams." Different is good, but not in sensors?

The AD's spend all their time assuring the three probes are not discrepant, then go all wonky when they are? Good mission, no follow through? This just smells like over reliance on development, and over confidence in outcome. Otherwise UAS would be a yawner.

kiwiandrew You and cogsim crossed.

If the leading edge of the Probe aperture needs to be razor sharp for less drag, why not polish the radome instead and make the business end of Thales a doughnut?

It isn't the pitots; with a boring flip (FMS) to the PF, who needs state of the art pitots?

The bottom line for me is that the system looks superb, but someone went to lunch instead of the meeting where the Pilots and the FMS were introduced.

Someone gas up the forklift. I think Friday, Truth be told, will be about humans, not pitots?

Machinbird: Pitch rate/g-rate transparency, Perpignan?

Machinbird

26th May 2011, 06:44

I don't think FBW by itself is such a big deal, except it would seem easier to incorporate a reversionary pitch/power mode.

Maybe we will learn something Friday regarding how different FBW is.
Here is some "homework" for those who wish to get their minds ready to understand a bit more about what makes FBW different.
Fly-By-Wire A Primer for Aviation Accident Investigators (http://cf.alpa.org/internet/alp/2000/febfbw.htm)
The quiz question is: How does the pitch feedback in the A320 at 180 knots differ from that at 230 knots?:8:eek::}

snowfalcon2

26th May 2011, 07:08

Anyone here that can comment on ultrasonic airspeed measurement ?

I did a little googling of this potential alternative (??) to pitot sensing and found out that there are commercial "high grade" products available for wind sensors (http://www.vaisala.com/en/products/windsensors/Pages/default.aspx) as well as for helicopters (http://www.cwc-is.com/Ultrasonic-Low-Airspeed-&-Side-Slip-Probe-pd-49,3,,.php). But the limits of its accuracy seems to be around 150 knots top speed.
Any hope of developing this for airliners? (Wikipedia does note that "Another disadvantage is lower accuracy due to precipitation, where rain drops may vary the speed of sound.")

Another potentially usable technology would be the hot wire mass flow sensor (http://en.wikipedia.org/wiki/Anemometer#Hot-wire_anemometers), where the air flowing past cools down an electrically heated wire and the airspeed can be calculated from the wire's electrical resistance which changes according to temperature. But this is not seen on airliners either. Anyone knowing if this is due to inherent drawbacks compared to pitot tubes, or just an aversion to try new technology?

Obviously these technologies must have some drawbacks compared to pitot tubes, otherwise they would already be in widespread use. It would be interesting to know where the problem areas are.

******
Bearfoil

how about a lit probe just out the F/O's side glass?

ATR's used to have exactly such a device (http://www.skybrary.aero/index.php/AT43,_en-route,_Folgefonna_Norway,_2005_(WX_LOC)). IIRC it was deployed after the Roselawn crash, but nowadays it's not not so widely used (optional equipment?) as the knowledge of the plane's icing behaviour and how to manage icing conditions is improved. Today they handle icing conditions just fine.

rudderrudderrat

26th May 2011, 07:11

Hi Machinbird,

Thanks for the very interesting article.
That's the first time I've read and understood that the flight control Law on A320 is pitch rate below 210 Kts and delta g above.

I wish AI had fitted a big red switch to turn off the Flight Control computers and place it into Direct Law. I am led to believe that B777 has one fitted?

bearfoil

26th May 2011, 07:13

snowfalcon2

"Another potentially usable technology would be the hot wire mass flow sensor (http://en.wikipedia.org/wiki/Anemometer#Hot-wire_anemometers), where the air flowing past cools down an electrically heated wire and the airspeed can be calculated from the wire's electrical resistance which changes according to temperature."

Kinda like the Pitot/HEAT combo, but without the Pitot?

Shows promise. That will save expensing for three pitots.

cheers:ok:

Svarin

26th May 2011, 07:25

Machinbird posted a link to an article by F/O Stowe from Delta.

I cannot resist quoting this :

If loss of control or aircraft handling qualities are suspected in an FBW accident, first assume that the FCS--and not the pilot--induced it until proven otherwise (it might be "designer error").Thank you, Officer Stowe. I feel suddenly very much less alone.

sensor_validation

26th May 2011, 08:27

Another potentially usable technology would be the hot wire mass flow sensor (http://en.wikipedia.org/wiki/Anemometer#Hot-wire_anemometers), where the air flowing past cools down an electrically heated wire and the airspeed can be calculated from the wire's electrical resistance which changes according to temperature. But this is not seen on airliners either. Anyone knowing if this is due to inherent drawbacks compared to pitot tubes, or just an aversion to try new technology?

Hot wire anemometers are used a lot in wind tunnels, I am only familiar with the type that run at constant temperature/resistance - then the input power is direct measure of the heat loss via conduction to the air mass passing, you also don't have to worry too much about the wire changing in length/tension due to expansion. You would still need good measurement of static pressure and temperature for air density and calibration. The hot wires in the lab are pretty delicate, but I suspect they wouldn't work well at all in rain or ice because the heat loss due to latent heat of melting or evaporation would be confused with high flow...

I suggest it is impossible to stop pitot tubes from ever blocking when snowballs thrown at them, but it must be possible by design to ensure the drain hole stays clear of ice. The ability to generate a false reading, which is 'live' with altitude changes when blocked, has been the killer in the past.

Perhaps could use microwave heating of the pitot cavities so not rely on conduction from metal surface to sharp ice crystals? Currently most heat will be lost by the 'wind-chill factor' on the outside of the tube. But even just upping the applied heating voltage by say 20% (power by 40%) without any mechanical/electrical pitot design change would take years to introduce even if feasible...

fireflybob

26th May 2011, 09:10

Why not give the pilots angle of attack information?

DType

26th May 2011, 09:25

The first wet motor race using hot wire mass flow sensors to determine fuel flow rate was an interesting disaster. Don't know if they overcame the problem, or changed the sensor type!

infrequentflyer789

26th May 2011, 10:02

Maybe we will learn something Friday regarding how different FBW is.
Here is some "homework" for those who wish to get their minds ready to understand a bit more about what makes FBW different.
Fly-By-Wire A Primer for Aviation Accident Investigators (http://cf.alpa.org/internet/alp/2000/febfbw.htm)
The quiz question is: How does the pitch feedback in the A320 at 180 knots differ from that at 230 knots?:8:eek::}

Trick question ? Is that 180 indicated and 180 actual, or 180 indicated and 230 actual ? The latter would be different again if only because the aerodynamic response would change, no ?

There is also the question of what the FBW uses to calculate gain in the event of unrelaible airspeed - last-known-good value (which might be wrong...) or fixed mid-value or some other calculated value ? I doubt it uses known-bad data, so if you do have 180-indicated at 230-real, that doesn't mean you'll get the gain set to the normal value used at 180. Am I on the right track ?

A page or so back in the thread, someone posted on an airline investigation showing pitot issues -> unreliable airspeed on one in 80k flights (!) - by my reckoning that's a lot of issues over the years worldwide (even if only Thales equipped buses) , far more than just the other events listed in the reports, yet without planes falling out of the sky.

So on that track, the answer to "How does the pitch feedback differ" would be: not by enough to cause a serious problem if the speed indication is wrong. Until 447. Something different to all the other cases happened on this flight, what, we don't know yet (maybe the VS really did fall off :E). Tomorrow we may know.

sensor_validation

26th May 2011, 10:08

The first wet motor race using hot wire mass flow sensors to determine fuel flow rate was an interesting disaster. Don't know if they overcame the problem, or changed the sensor type!

Good point, most cars these days use thermal massflow sensor to measure air flow to calculate fuel injection times. There's normally a flap valve on inlet to take in warm air on start-up to speed up engine heat up, maybe there's also a dewpoint sensor to ensure air always above dewpoint, or its just mechanical design to not draw in water droplets. Racing cars use ram air effect and want coldest possible air to maximize inlet air density to maximize available power - and most have clearly solved the problem.

mitrosft

26th May 2011, 10:16

Gibon2

26th May 2011, 10:26

SLF here. Forgive me for butting in, but what I find very puzzling about all the discussion on pitots, icing, FBW, human-machine interface, etc, is that none if it seems to consider why all this is coming up now. The A330, whatever its faults, was not introduced yesterday. It has been in commercial service since 1994. More than 700 of them are plying the world's airways. It flew in commercial service for 15 years without a fatal accident. Countless gazillions of miles have been flown by A330s, surely in all conceivable combinations of weather, crew experience, captain-in-cockpit-or-not, etc etc.

So what has changed? Why are icing pitots now a concern? Why is FBW now a concern? Why is lack of an AoA indicator now a concern? If there was something awry with the design philosophy of the A330, wouldn't it have shown up years ago? The A330 is, I presume, pretty much the same today as it was in 1994. So is the weather, and the way that pitots ice or don't ice. What does that leave? Is it the pilots that have changed over the past decade?

Svarin

26th May 2011, 11:16

Gibon2,

you are absolutely right.

Did the aircraft change over the years ? Yes and No. No it did not go through any kind of major re-design, and its various versions are quite stable. Yes, some things change in this aircraft, like in any other. What is specific to FBW aircraft is the changing of Flight Controls Computers, through successive software versions. This is done very discreetly. Some mistakes get corrected before they have a chance to do damage. Some are corrected after a fact (or not). But more than that, the very multiplicity of successive versions of such a critically critical piece of software and equipment will introduce a whole new set of potential problems. Specialists call these Byzantine faults, in reference to an ancient war involving traitorous generals. You can add to the can of worms the parallel evolution of other components software versions, like Air Data Computers for example. All these computers and their brand new updated versions do communicate together all the time. Extremely well, usually. Unfortunately, the public will not be educated on this subject by the upcoming inquiry, I would wager.

Of course, such faults as I hint to in the previous paragraph happen very rarely, and that is a blessing. But they do happen, and those who know what they are talking about in IT knew about the potential for it for years, too. Statistically speaking, it would be very difficult to say that such aircraft is inherently safer or more dangerous than this one in the field of modern commercial aviation. However, it is a certainty that Airbus is on the side of "the computers are always right and will have the last word". Boeing would say "the computers are very good, use them, and if you feel like you are better, you are free to give it a try, but dont come back to us crying". A difference in philosophy, not in numerical safety.

Did the pilots change over the years ? Certainly. Nowadays, at some airlines, an instructor or examiner will slap your hand if you choose to fly manually during some parts of a sim check. It is forbidden to touch the manual pitch trim of any Airbus if it is not flying in Direct Law, which never happens in the sim, except for one minute and a half upon initial training so the appropriate box can be ticked. Yes, airline pilots had to go through major rethinking of their role, function, skillset, attitude, etc... It is called "progress". Those who resist this are called "Luddites" or "dinosaurs", regardless of age, by the way.

So, dear Mr Passenger, here was a short answer to your very relevant questions.

Best regards

Svarin

May 26th 2011 at 1205UTC - This post has been edited by parties unknown to me. Profanity was removed. I can accept that. However, Airbus "philosophy sentence" has been modified. I rest my case that a vast majority of professionals -including myself- perceive this particular manufacturer as always trying to deflect blame for an incident or accident from its own design towards so-called "pilot error". This would not be a responsible attitude.

john_tullamarine

26th May 2011, 12:00

So what has changed?

It's not quite as simple as that -

(a) certification processes are very comprehensive and address a generalised set of requirements held to provide a very high probability of successful in-service operation.

(b) the aircraft as it comes through the certification process will have shown compliance with the set of certification requirements pertinent to the design

(c) however, the certification standards don't provide an absolute guarantee that the aircraft will be able to weather every conceivable set of circumstances with which it might be tested in service

(d) sometimes (and this may take quite some time to materialise) a set of circumstances will arise which conspire to defeat the capabilities of the aircraft and the presumptions which went into the design and certification processes. It may turn out that this sort of situation confronted the crew of the mishap aircraft which is the subject of this thread.

(e) sometimes a comparatively simple problem within the state of the art knowledge combined with significant design advances will present a problem. The early Comet fatigue problems are a useful instance of this.

(f) sometimes the man-machine relationship may not quite work as well as was presumed and intended. This sort of consideration may turn out to be material in the present case under discussion.

It is common to see progressive minor changes to an aircraft Type as in-service knowledge is accumulated.

Sometimes such development is subtle in that it is not evident to the wider Industry. Instances include routine engineering design and maintenance practices changes. All Types experience this sort of development throughout the life of Type.

Sometimes changes may need to be effected quickly and these usually end up as Airworthiness Directives. I can't bring to mind any aircraft which has not been the subject of ADs.

Very occasionally, a Type may have problems arising sufficient to warrant a revisit of the Type Certification process. Not many Types are subject to this re-examination.

At the end of the day, do I worry about flying on either a Boeing or Airbus (or any other reputable) aircraft ? Of course not.

Having been involved in the design and certification processes for just about all of my working life, I am content to accept the low risks inherent in flying in certificated aircraft and equally content to accept that they are not perfect and come with flaws.

If the flaws are minor, such are worked around by engineering, maintenance and operational standard practices - if major, by modifications, as appropriate, to aircraft or procedures. All part of normal aeronautical processes.

infrequentflyer789

26th May 2011, 12:12

@Gibon2

Good question, I've seen raised elsewhere too (more below)

@Svarin

Good points, especially the piloting changes - I don't think any of the a/c designers, A or B or other, intended the result of improving the plane/automatics side of pilot+plane to be that the airlines then dumb down the pilot side to compensate :(

I would venture to add:

Unique circumstances is possible - even after all those years. BA038 fell out of the sky after almost the same length of exemplary 777 service. The design failing blamed has been there from the start - it just took that long to show up. The investigation went through probably millions of hours (175k flights) of past 777 flight data and found that the BA038 flight was unique. No other flight in all that time went through the same environmental conditions.

Selective reporting is also possible - maybe the pitot events have always been happening but not reported. Usually the events last only seconds and cause few or no problems. After one or two incidents raise the profile (before 447), maybe you start to get more events acutally reported. After BA038 I think there were some other brief transient rollbacks reported (at altitude where didn't cause a problem) that may well be the same cause, but were just never reported before.

Svarin

26th May 2011, 12:26

infrequentflyer789 wrote :

I don't think any of the a/c designers, A or B or other, intended the result of improving the plane/automatics side of pilot+plane to be that the airlines then dumb down the pilot side to compensateThen why the aircraft that can be flown by "concierges" ? If not to recruit, train, pay, and respect pilots like "concierges" ? Remember the late eighties. Refusing to see an intent there is naive.

Graybeard

26th May 2011, 12:27

OK, I apologize for the wrong way detour, comparing pitot icing to windshield icing. At some point I knew better.

Should I remove the errant posts, or just leave them?

jcjeant

26th May 2011, 12:34

Hi,

maybe the pitot events have always been happening but not reportedMethink it was a know problem .....

In December 1995, Airbus was the finding of a lack of certification of pitot probes: Ice crystals clog the probe which causes severe degradation of calculating flight parameters. This is not a failure, it is a defect of the Pitot probes. According to the regulations in force on the day of the accident, Airbus had an obligation to correct this defect.

Instead of eliminating this defect, Airbus decided to ask the drivers to ensure accountability through the application of the procedure: Following the amendment of the Aircraft Flight Manual for the A330 Airbus, the DGAC imposed in February 2001 a new procedure for pilots titled "Unreliable airspeed conditions" in case of loss or inconsistent speeds measured [AD 2001-069 (B)]. The FAA took over the DGAC AD in June 2001, but noting that this initiative was in response to an "unsafe condition" that could lead to the A330 outside its flight envelope [AD 2001-13-13].

The regulations in force at the time of the accident did not allow a manufacturer to remedy a default by the application of a procedure. In addition, this procedure will be difficult to apply when two precursor events of the accident of Flight 447. Airbus will admit eight months before the crash on 1 June 2009, but nothing will change:

At the end of August and early September 2008, two A330s for Air Caraïbes Atlantique (ACA) encounter severe icing conditions that cause the cruise blocked pitot probes Thales SA and inconsistent measured velocities. During the following October, the Directorate of ACA initiates a meeting at the premises of Airbus in Toulouse. According to the report of the Flight Safety Officer, Airbus engineers have understood at that meeting "the difficulty encountered by the crew for a rapid implementation and effective procedure SPEED INDICATION unreliable and" thinking therefore a modification of checklists.

This procedure made available to drivers to compensate for the lack of pitot probes and "unsafe condition" that resulted was not only inappropriate but also ineffective.

But after the crash of Flight 447, Airbus that did not stop to remind drivers that this procedure should be applied in case of inconsistency of measured velocities (Accident Information Telex No. 2 dated 4 June 2009)

1995/Novembre December 1996: TFU 34.13.00.005 (see document). Airbus made the finding of a lack of certification on pitot probes and Launches Development of the probe Goodrich P / N 0851HL.

"STRONG cumulonimbus (Cb) A HIGH DENSITY OF Containing ICE CRYSTALS CAN BEEN COUNTERED, PARTICULARLY IN THE Intertropical Convergence Zone (ITCZ). IN AN ICY SUCHA AND TURBULENT ATMOSPHERE, THE A / C AIR DATA PARAMETERS (PRESSURE DEPENDENT) MAY BE DEGRADED Severely, Even Though THE PROBE HEATERS WORK Properly.

IT HAS THE CHARACTERISTICS OF THAT Appeared SUCHA AN ENVIRONMENT COULD EXCEED THE WEATHER SPECIFICATIONS FOR THE PITOT PROBES Which ARE CURRENTLY CERTIFIED.

THE WEATHER SPECIFICATIONS (ICING / LIQUID WATER CONTENT / GUTLET SIZE) TO THE PITOT PROBES Which RESIST SHALL HAVE BEEN UPDATED WITH MORE Therefor Stringent REQUIREMENTS ON THE BASIS OF THE FIELD EXPERIENCE AND RECENT EXTENSIVE FLIGHT TESTING.

AIRBUS HAS LAUNCHED THE DEVELOPMENT OF THE modificiation followin:

1. DEVELOPMENT OF A NEW PITOT PROBE ABLE TO MATCH THE NEW REQUIREMENTS. ALL FLIGHT AND WIND TUNNEL TESTS TESTS ARE COMPLETED AND NOW SUCCESSFULL: THE CERTIFICATION OF A NEW PITOT PROBE HAS BEEN IN EARLY NOVEMBER Obtained 1996 (NEW PITOT PROBE: P / N 44836 851HL MOD). "(See document)

November 1996: The probe Rosemount P / N 0851GR is replaced by the probe Goodrich P / N 0851HL, (Service Bulletin A330-34-3038 for Model A330-301, -321, -322, -341, and -342 Series Airplanes) (ref. FAA states that this replacement is made necessary because the inconsistency of measured velocities can cause the A330 outside its flight envelope). This new probe is duly certified by Airbus.

December 1998: Emergence of the probe Sextant P / N C16195AA who replaces her as the probe Rosemount P / N 0851GR but for a limited number of A330 (Service Bulletin A330-34-3071 for Model A330-301 Series Airplanes) (ref.FAA). How the new probe has it been certified by the DGCA considering the experience Rosemount? For more demonstrates its inefficiency!

August 2001: The DGAC mandated these two replacements by AD 2001-354 (B) (see document):

"The following measures are rendered mandatory from the date of entry into force of this AD: Before December 31, 2003, unless already done, remove the pitot probe type ROSEMOUNT P / N 0851GR and replace them either by probes BF GOODRICH AEROSPACE type P / N 0851HL, according to the instructions of SB A330-34-3038, or by type probes SEXTANT P / N C16195AA accordance with instructions of SB A330-34-3071. "

July 2002: In the ILO 999.0068/02/VHR SE (see document), Airbus made the observation of defects of the probe Thales (formerly Sextant) P / N C16195AA

THE AIM OF THIS IS TO INFORM THE ILO OPERATORS THAT SEVERAL OPERATORS HAVE REPORTED SINGLE AISLE AIRSPEED ON AIRCRAFT FITTED WITH Discrepancy THALES PITOT PROBES PN C16195AA.

.

Following is a series of conflicting decisions that demonstrate the inability of Airbus to get rid of one type of probe that meet standards dating from 1947, unsuited to the reality of the environment in which the aircraft ( see previous notes). The observation made for the probe Rosemount in 1996 has obviously not been used for the probe C16195AA!

September 2007: In a Service Bulletin (see document), Airbus recommends replacing the probe Thales P / N C16195AA by sondeThalès P / N C16195BA following further serious incidents.

September / October 2008: defects of the probe C16195BA Thales, "which was not designed to address the problems of icing, are recognized by Airbus and Air France (see the document Info TFN No. 5).

June 9, 2009: One week after the accident of Flight 447, the A330-F GZCP probe was equipped with Thales C16195-AA, Airbus launched an investigation into the case of inconsistency between the measured speeds reported by operators on Airbus A330/340 and took in early August decision to focus the probe Pitot Goodrich P / N 0851HL. EASA followed of course ...

One issue on which the DGCA must be answered is "How the Sextant pitot probe (later Thales) C16195-AA she was certified in 1998 given the experience Rosemount? "

sensor_validation

26th May 2011, 12:40

I believe that Airbus software is probably missing simple protection in airspeed data readouts. At least manuals in previous posts do not describe any such measures.

If ALL Pitot tubes freezes and IAS deviates by 1-50% then computer before admitting that airspeed data is correct should check the acceleration/decelaration rate from inertial sensors. This simple cross check would protect from any type of tubes failure (freezing, blockage etc)

Don't under-estimate Airbus engineers, 3 sensors, median filters, time delays are all included to minimize false alarms, but what is left is the remote possibility that any 2 may fail in exactly the same way at the same time - so check out the following, especially the 'foreign filing date Sep 23, 2009' :-

United States Patent Application 20110071710 Kind Code A1 Puig; Stephane ; et al. March 24, 2011
METHOD AND DEVICE FOR DETECTING AN ERRONEOUS SPEED GENERATED BY AN AIR DATA INERTIAL REFERENCE SYSTEM Full text is available on uspto.gov, the "BACKGROUND" section is very clear why such a new idea would be useful.

Svarin

26th May 2011, 12:44

It must be stressed here, mostly to attention of the potential reading public, that safety, especially safety as a statistic, is not at stake when discussing the various merits or failings of this or that design. Another simpler way of putting it is, as a passenger, it doesnt matter which type of aircraft one flies in. In the modern day, all recent aircraft types have a very excellent safety record.

As a pilot, it becomes very different. At one end of manual, old-school, dinosaur-like thinking, the pilot has all authority and all responsibility. At the other end of fully automated drone-like transportation system, the system itself, its computers, have all authority and all responsibilty.

The real philosophical question faced today by passengers is whether they would entrust their lives to a (very well-trained) human pilot (who will share their fate), or to a (very well-designed) computer.

In our subject matter, the problem is the aircraft and its designers claim full authority in the name of "envelope protections", which could allow a "concierge" to fly the airplane, but then when things go wrong, some fault is always found with the pilots which somehow shadows that of the design.

Ultimate authority cannot be separated from ultimate responsibilty.

The only difference is not in numbers but in philosophy. As a passenger, I can entrust my life to someone who puts his own life on the line with mine. I can accept responsibilty and pay the ultimate price if I fail to deliver that promise as a pilot. But I will not accept to play scapegoat for a system that claims to be safer than I am when it is easy, and that evades responsibility when things go wrong.

davionics

26th May 2011, 12:48

Dependability of a system is that property of a system which allows reliance to be justifiably placed on the service it delivers.

Models and meta-models can never account for all the situations and unplanned events in the real world. Dependance on services provided by systems (be they mechanical, electrical, meteorological, organisational, biological, hardware or software) is what every pilot must contend with to operate within safe limits.

It would make sense to use multiple air data sensors (N-version redundancy), of multiple designs (diversity of design), using various watchdogs (error detection) to monitor the health of each sensor and provide the pilots with pure go-no-go data. Technology exists such that a pilot should never be in a position where he or she has to question the quality of primary air data. Air data systems on passenger A/C without the aforementioned should be rated VFR only IMHO.

forget

26th May 2011, 13:01

sensor-validation, Interesting find on the Airbus Patent Application. You won't mind if I post a direct link?

METHOD AND DEVICE FOR DETECTING AN ERRONEOUS SPEED GENERATED BY AN AIR DATA INERTIAL REFERENCE SYSTEM - AIRBUS OPERATIONS (http://www.freepatentsonline.com/y2011/0071710.html)

syseng68k

26th May 2011, 13:23

Technology exists such that a pilot should never be in a position where he or she has to question the quality of primary air data. Air data systems on passenger A/C without the aforementioned should be rated VFR only IMHO.
Away for a couple of days and catching up, but the above just about sums up my gut feelings as well. This problem has been known about for years, with fwics, many examples of uas causing at very minimum, added crew workload and stress. I know change in aviation is glacial, but this problem should have been fixed as a regulatory requirement years ago.

Have been trying to think of a suitable analogy, so how about this:

Buying a new car from the showroom, salesman tells you how good and reliable the car is, but then tells you that when it's very cold, there's an intermittent fault that causes the headlights and instruments to fail. It usually only happens for a short period, but could cause a serious accident if the car is travelling at speed. The manufacturers have been trying to correct the fault for some time, but with no success. The advice is therefore, not to travel at more than 20mph at night. Does anyone think that such a vehicle would be allowed to be sold anywhere ?...

I think sometimes you need a sense of the surreal to put things into perspective...

mitrosft

26th May 2011, 13:25

Don't under-estimate Airbus engineers, 3 sensors, median filters, time delays are all included to minimize false alarms, but what is left is the remote possibility that any 2 may fail in exactly the same way at the same time - so check out the following, especially the 'foreign filing date Sep 23, 2009' :-

Quote:
United States Patent Application 20110071710 Kind Code A1 Puig; Stephane ; et al. March 24, 2011
METHOD AND DEVICE FOR DETECTING AN ERRONEOUS SPEED GENERATED BY AN AIR DATA INERTIAL REFERENCE SYSTEM

Well I agree that from Airbus engineers point of view double or triple Pitot's failure is a very low probability event. My university used to deal with "aircrafts" going out of the atmosphere and then back in, so Pitot's were one of the many sensors allowing computer to integrate positions and speed. And cross checking was a must. Remember this knowlege was around from 12 April 1961 and culminated by Russian space shuttle flown 100% by on-board computers.

Very sad that we paid such big price for engineering mistake or in fact "overseeing" the probability of failure being not so low. For example bird strike coud give the same result for all three tubes, since birds do fly in formations (flocks).

GarageYears

26th May 2011, 13:33

Thinking out loud....

Ok, so a pitot in it's simplest form is a tube facing into the 'liquid' flow, such that the resulting pressure can be measured with a transducer (diaphragm). At a constant (fixed) altitude that's all you need to measure 'speed' (once calibrated). However the measured pressure is a function of two components - there is a static component to the pressure (effectively due to the mass of the column of air pressing down on the diaphragm) and the dynamic component due to movement (effectively the additional pressure due to more air molecules pressing on the diaphragm). So if the thing that needs it's speed measured can change altitude, then we need to measure both dynamic and static pressure, and subtract the later from the former to derive speed irrespective of altitude. So far so good? (Please excuse the layman-esque language, but longer words make my head ache).

Alrighty then... so all's well and good until something blocks the dynamic tube - moisture, bees, ice, whatever - bad things happen.

Considering moisture - water - pretty common on Earth, so what's the solution - drain holes. Now this is where I need some help. Obviously the drain holes MUST be significantly smaller than the inlet port (otherwise there would be no pressure to measure - all the air would flow out the 'drain'...), so in normal operation we have air entering the inlet port and some portion of that flow exiting the drain? Clearly it is possible to calibrate the sensor to compensate for this, so the speed measurement still occurs.

However, block the inlet (ice), with the drain still open and the pressure will drop to static (indicated speed will decrease, at the limit to zero). My assumption is this is the failure mode we are discussing? (Since a blocked DRAIN alone will cause the speed to over-read).

My thought is this - in BOTH malfunction cases the flow inside the pitot has stopped at least through the drain - so why not include a mass-flow sensor right there in the drain outlet? Can we compare the GPS/INS derived speed to the pitot derived output and cross-check this with the mass-flow value, and figure out if we have a sensor problem? If our GPS ground speed is 400 knots and the pitot IAS is 80knots, with mass-flow derived value of 0 then there's a problem? I am presuming that pitot icing occurs fairly rapidly.

Am I oversimplifying?

- GY

3holelover

26th May 2011, 13:42

If you view an accident as a series of links in a chain, or a series of holes in slices of cheese - whichever one prefers - surely the elimination of any link, or hole, is a valuable goal. Granted, we do NOT know yet, but we obviously have good reason to believe that UAS was a contributing factor here. Yes, we could view that as something that "should" have been little more than another snag in the book for the makers of the pitot probes to ponder as they look toward eventual corrective actions... but the truth is, in this case, that may well have been a single link which, if it hadn't occurred, would have meant this conversation wouldn't be happening (and a ship load of trusting souls would still be alive!)

I know UAS alone should not have led to this result. ...but then, neither should a fuel leak in one engine have led to all tanks empty.... but it did, and the fuel leak should never have occurred. ...and, I feel just as strongly, airspeed indication should never be unreliable.

This one is serious of course, but how did it become that way? That has been the question from the beginning...how did this aircraft go from stable, M0.82 flight at FL350, to a pancake impact with the sea in less than six minutes? Thankfully, very soon we'll know much more.

I hope I'm not getting under your skin.:ouch:

Cheers,
3hl

bearfoil

26th May 2011, 13:59

I like simple. Nomenclature is a challenge, it was ever so. On either side of an event, I see two bookends. One is "Proximal" cause, ie engine spool down, the other is "procuring cause", cold soaked fuel in China.

In between are fuel supply architecture, spar valve actions, low and high pressure pumps, SOPs, and a flawed design re: Heat exchanger and spill circuitry.

I have never liked the cheese hole theory, it makes me hungry and I get distracted.

I am one hundred per cent on board wih PJ2. When one says "It was not the pitots", one expects a little slack. Given the 17 year history of A330 and a "gazillion miles", and the unfortunate smoking gun of poor crisis management in dependability, by now, don't we know what we mean ?

:ok:

takata

26th May 2011, 14:09

Hi, jcjeant,
Methink it was a know problem .....
Please, do not quote from any "sources" whithout also providing a link or a credit for your quotes. Also, in past posts, you should refrain from posting translated French press articles into English using auto-translation (everybody can do it himself, but the end result is most of the time meaningless).

Of course, one could certainly point that what you have posted above is far from an "objective" point of view about those probes issues but, as it seems to comfort you and few others into your Airbus consipiracy feelings, please, go ahead but you should certainly include the source where it comes from.
S~
Olivier

bearfoil

26th May 2011, 14:20

takata

"...Please, do not quote from any "sources" whithout also providing a link or a credit for your quotes. Also, in past posts, you should refrain from posting translated French press articles into English using auto-translation (everybody can do it himself, but the result is most of the time totally meaningless).

Of course, one could certainly point that what you have posted above is far from an "objective" point of view about those probes issues but, as it seems to comfort you and few others into your Airbus consipiracy feelings, please, go ahead but you should include the source where it comes from.
S~
Olivier ...."

"Conspiracy" is a volatile word, and unfortunately has acquired the status (Urban) of instigating severe reactions. It is a crime, a serious felony, depending on INTENT. A Board projecting profit lines for the next quarter with proprietary data are 'conspiring' to succeed.

INTENT is perhaps the squishiest word on the Planet, yet the basis for virtually all of our Law. If the plan is to avoid or circumvent the regulations it may be borderline chargeable. If it is blatant, void of consideration of "Duty of Care", it may be criminal.

Hunched together at either end of the spectrum, nothing is gained, certainly not progress, by expecting great loads of intelligent thought to disappear upon the utterance of a word.

It is a tactic, nothing more.

bear

takata

26th May 2011, 14:36

Hi Bear,
It is a tactic, nothing more."
Well, I've also read a few late posts from you in the R&N thread where you mentioned (as a fact) that AF447 lost also Inertial References (horizon, attitude, etc.).
Hence, as your high morale stance may be sincerly doubted and those garbagistic uterly farcicalious numerous posts in the vein of the above are suggesting to me is that you are simply using your own proved "tactic, nothing more".
"Diffame, diffame, et diffame encore... il en restera toujours quelque chose d'utile à la fin !"

syseng68k

26th May 2011, 14:40

takata, #2437

Sorry, but I didn't get any feeling of "conspiracy" from any part of the post you were discussing, or any problem with the translation. The point of it, afaics, was to illustrate that the problem is real and has been known about for quite a long time. If we clear away the bs, politics, bean counting, weasel words and excuses, we are still left with a failing that can have serious consequences.

If you think that this is not the case, then please explain...

Regards,

Chris

gums

26th May 2011, 14:44

Salute all!

A huge attaboy for the post by Sv concerning philosophy.

This shall be my last post on the matter until we all dissect the AF/BEA/Airbus folks' interpretation of the accident. I also thank all here for their nice comments ( a degree of acceptance amongst a group of "heavy" pilots, although I never flew a "heavy") and hope I have added to a technical understanding of FBW designs, design philosophy and corrections to both design and pilot procedures when unexpected situations are encountered that the design folks or pilots had not allowed for, however remote.

This is what got my attention from Sv:

Ultimate authority cannot be separated from ultimate responsibilty.

The only difference is not in numbers but in philosophy. As a passenger, I can entrust my life to someone who puts his own life on the line with mine. I can accept responsibilty and pay the ultimate price if I fail to deliver that promise as a pilot. But I will not accept to play scapegoat for a system that claims to be safer than I am when it is easy, and that evades responsibility when things go wrong.That quote embodies the most profound thoughts I have seen on this topic. In short, rules to live by.

I am a "dinosaur" according to many. But I am an enlightened dinosaur. I moved up through the technological improvements in our jets gladly. I accepted the new capabilities and the new limitations on my superior aviating skills, heh heh. Most of all, I got to see problems and solutions along the way. Neither the pilots nor the designers were perfect. But both groups admitted it, and we sought and implemented solutions to prevent future accidents and to "improve" aircraft capabilities.

The last thing we did was tell the designers we didn't know that their jet could enter into an unrecoverable deep stall. The designers didn't tell us, "well, Gums, what in the hell were you thinking pointing the nose up at 80 degrees and not pulling down before the airspeed go too slow for the elevators to work?".

Later, when we found that our quad-redundant flight control computers and sensors went off-line due to a single-point-failure in the power supply system, we were livid!!! At the interim accident briefing our Wing CO came outta his seat and we had to hold him back before he punched out the GD briefer. Did the GD folks balk? No, they developed a better power supply system and we flew with a kludge, hot-wired-to-aircraft battery system for a year or so.

I don't see this with the Airbus folks. Sorry. I also do not comprehend an aircraft designed to fly at the "edge of the envelope" or all bets are off and we hand off the plane to the crew. Hal says, " I do not understand what is happening, Dave, you have the stick", GASP!

Lonewolf_50

26th May 2011, 15:03

Instead of the swiss cheese model, bear, may I suggest "the links in the mishap chain" as a supplement. This model I was familiar with before the cheese model. It tends to indicate a serial order of causes and contributions to a mishap. Any one of these links being broken ends the accident event chain, and the mishap doesn't occur.

TEXT EDITED OUT, 3holelover covered this more concisely. LW50

"It's not the pitot tubes" is most likely right from an analytical sense, since pitot tube malfunctions are neither unknown nor new. You then trip over two systems interface issues: one is hardware to hardware, the other is hardware to wetware. (wetware ~ human brain) Since such issues can get quite complex, the easy soundbyte isn't available ... but giving out an uncomplicated soundbyte is what is asked for in the public information sector of the process. :p

Were no rice bowls at risk of being tipped, you'd get a different (and cleaner) analytic approach from parties A, B, C, D, etcetera, and different PR emissions.

3holelover

26th May 2011, 15:07

one expects a little slack. [....] by now, don't we know what we mean ?

Yessir. True enough. I'll offer my humble apologies, and lots of slack... and shut up now. :oh:

Safety Concerns

26th May 2011, 15:10

As a passenger, I can entrust my life to someone who puts his own life on the line with mine.

As a fare paying passenger I want to know that you are doing exactly as required by the regulations and that you have taken all reasonable care to ensure that I arrive in one piece at my destination. I do not want a chancer up front.

Computer easily wins if given a choice because humans are more fallible. Simple statistical fact.

f you view an accident as a series of links in a chain, or a series of holes in slices of cheese - whichever one prefers - surely the elimination of any link, or hole, is a valuable goal.

Most sensible comment since the beginning of the thread.

jcjeant you are getting boring. Air France had every opportunity to replace the probes just like everyone else. The fact they questioned it and left it very late before replacing, apparently to save money, says more about Air France than Airbus, Thales or Goodrich.

The A330 is a mighty fine aircraft. Pilots will never match the computers and its pretty blinkered to think you can. Safety statistics have never been better. Even if the software pitched the aircraft up in this case and I say IF, there was still no guarantee that this aircraft would have been saved.

I remind you all of the analogue 757 that lost its speed indications, the Birginair 757 that had ONE blocked tube.

Think about it.

OK465

26th May 2011, 15:17

“Nowadays, at some airlines, an instructor or examiner will slap your hand if you choose to fly manually during some parts of a sim check. It is forbidden to touch the manual pitch trim of any Airbus if it is not flying in Direct Law, which never happens in the sim, except for one minute and a half upon initial training so the appropriate box can be ticked.”

On any specific FFS IOS Malfunction page under FLIGHT CONTROLS, you can count more than 20 selectable icons and under ADIRU, you can count more than 10.

In both B & A simulators, you see numbers of malfunctions available which are not incorporated in any training syllabus and are thus never utilized. (“Only move the shiny switches.”)

I realize there is a certain basic common default package, however.

bearfoil

26th May 2011, 15:19

3holelover

Sorry if I was a little too assertive there, but Lonewolf and you have given me a thought.

I think honestly that what I see with the cheese is metaphoria. It is not helpful to simplify with homily a serious safety discussion. I am pedantic here, but sometimes.....

Cheese emphasizes the randomness of this outcome, and it was not random, I'll bet my Calloway. It was predictable, borderline inevitable, and I think that is where Svarin and PJ2 are taking us all. It was a block, no a loaf, of cheese, with one void only, impossible to misalign.

If 447 wandered into Scratch's cave, that is a bad thing, throw in Ice, more bad, virtually any "mitigating" excuse is just that, an excuse. I smell some corporate nonchalance, here, will it be reinforced tomorrow? Defended?

Lonewolf_50

26th May 2011, 15:23

bear, my love of links (golf or sausage) aside, the variables interact with each other in dynamic systems. (Such as the case under consideration).

I think you are being reductionist with your block of sharp cheddar.

I believe the BEA will not be reductionist.

jcjeant

26th May 2011, 15:27

Hi,

go ahead but you should certainly include the source where it comes from.No probs ..
Les dossiers noirs du transport aérien (http://henrimarnetcornus.20minutes-blogs.fr)
it's from one of the expert (member) of this family association
Bienvenue sur le site de l'association entraide et solidarité vol AF447 (http://www.asso-af447.fr)
Liste des membres du Conseil d (http://www.asso-af447.fr/liste-des-membres-du-conseil-dadministration-du-bureau-et-des-commissions.html)

bearfoil

26th May 2011, 15:28

Lonewolf

"...bear, my love of links (golf or sausage) aside, the variables interact with each other in dynamic systems. (Such as the case under consideration)..."

Of course, and my post was simplistic. Millions of people are going to be assaulted with reductionist rhetoric tomorrow, from all sides. After 38 logged events, one believes the pile of Swiss is getting a bit rangy. A causal chain becomes a necklace after enough iterations.

takata

26th May 2011, 15:39

Hi Chris,
If you think that this is not the case, then please explain...
My main concern with jcjeant's post is that it is posted from a source which is not quoted at the first place. (Now, it is also translated with meaningless sentences). Anyway, I know that it is taken from a place where you can only find a compilation of documents (duely commentented) aimed at charging Airbus for its so many so-called wrong doings. There is nothing objective in such compilation as any communication on safety issues can be freely used as a proof of what they are suggesting: they did nothing and everything was aimed at discharging the manufacturer in case of trouble.

I myself posted about it, saying that it was a long story with Airbus "probe issues" (including the part of the manual dated from December 1999 explaining how to indentify unreliable air data).

Nonetheless, the way this issue is presented and commented is completely misleading:
Fact #1: Airbus did certainly something when the first issues appeared with Goodrich/ Rosemount P/N 0851GR which was the original probe on A330 (and issues were quite different from today context)... they developped with Goodrich the P/N 0851HL (not the Thales/Sextant C16195AA and later BA).
Fact#2: They worked on systems like the BUSS (Back-Up Speed System) and invested further in R&D technology (l@aser probes, etc.).
Fact#3: Emphasis was also put on the crew training for detecting any possible Air data issues ; the fact is that possible Air data issues must be, in any case, monitored in flight because there is plenty of different cases following various "contaminations" of an anemometric chain. This is not a single case issue with a single procedure to follow as it is too complex to indentify correctly what is causing those Air data to be unreliable at the first place.

Now, it may appear that the weakest link was the last one and we'll see that tomorow. From what I have read on the crew training by Air France, they were simply not drilled at tackling this situation at cruise level: a single training was made months ago about another critical situation (UAS in approach or landing phase), but here, there was no switch to Alternate Law and the basic reaction would have to be quite different in this case, with much more thinking (and time) about what to do before altering their flight parameters (possibly safe when this event started).

CogSim

26th May 2011, 16:22

The real philosophical question faced today by passengers is whether they would entrust their lives to a (very well-trained) human pilot (who will share their fate), or to a (very well-designed) computer.

I never quite understood why this has to be a choice. It seems to me that future systems will need to seriously consider a solution where the pilot and the computer work together if we need to see improvements (in safety and other areas) in an already extremely safe system (as you pointed out in your earlier post).

But I will not accept to play scapegoat for a system that claims to be safer than I am when it is easy, and that evades responsibility when things go wrong.

I would replace when it is easy with when things work, because, that is by definition, what makes FBW flight safer than purely human operated flight. Realistically, we (as pilots) don't know anything about the hairy situations that were successfully negotiated by computers. And somewhere in there lies the paradox setup by the false dilemma of "either computer or human" type thinking.

Lonewolf_50

26th May 2011, 16:35

for takata

Fact#3: Emphasis was also put on the crew training for detecting any possible Air data issues ; the fact is that possible Air data issues must be, in any case, monitored in flight because there is plenty of different cases following various "contaminations" of an anemometric chain.

This is not a single case issue with a single procedure to follow as it is too complex to indentify correctly what is causing those Air data to be unreliable at the first place.

With that mouthful digested after reading it thrice, I am curious:

What tools are provided the flight deck crew for inflight trouble shooting and remedy of this complex failure mode? QRH and ECAMS are two resources that seem obvious to me, are there others?

It is apparent to me that cues and warnings to the crew that something is amiss are available, but what is unclear to me is the immediacy of the prompt. (Compare to an engine low power alert, a chip detector alert, fire alert, low oil pressure alert, where immediacy is due to "on/off" threshold of a switch being met). {If you wish, use "warning" rather than "alert" in the above.}

From numerous posts, the average A330 aircrew are aware that airmass data can be wrong, even though correct airmass data is integral to the aircraft functioning properly and safely. (This is not an alarmist comment, as the average aircrew are also aware that the engines can go badly wrong, and power is integral to a passenger jet operating properly and safely).

What is unclear to me is whether or not this failure mode, airmass data to the pilot displays and the flight computer, is insidious, or "creeping up on you," in nature.

Can you help me understand?

To put this in context, a few decades ago the squadron I was in lost an aircraft (not the crew) thanks to an insidious fuel transfer problem going undetected for long enough for it to become a problem. The result was that fuel on board was not all usable. Once they were aware of the problem, they did their best to overcome this malfunction but ran out of gas before finding somewhere dry to land. Put another way, they were playing "catch up" once they were alert to the problem. (I operate under the feeling that AF 447's crew were playing "catch up", but Friday may prove me wrong).

for cogsim:
Realistically, we (as pilots) don't know anything about the hairy situations that were successfully negotiated by computers. And somewhere in there lies the paradox setup by the false dilemma of "either computer or human" type thinking.
I agree with your false dilemma point, but am not comfortable with the "ignorance is bliss" state of the point preceeding it. The cold comfort of statistics is that the odds are that we can wallow in bliss on your (or my) next trip.

Dalex64

26th May 2011, 16:40

Maybe the pitot tubes clog up somewhat symmetrically, so before they disagree they all report a massive increase in airspeed.

The autopilot pitches the airplane up sharply, then the sensors disagree, and dump the whole mess into the laps of the pilots, dropping stall protection at the same time.

Maybe that's the case, maybe it isn't, and the pilots pitched the airplane up. But if it was the autopilot:

My question is, why doesn't the software realize, especially when in cruise, that pitch and power haven't changed much, GPS altitude is relatively stable, that a big increase in airspeed is simply illogical?

I'll back ADA as a strong programming language. It helps prevent PROGRAMMING errors, syntax errors, buffer overruns and such.

No matter what the programming language is, though, it doesn't prevent otherwise correctly coded software that has errors in human logical thinking. If the software isn't written to identify such a situation and fall back to a pitch and power mode on its own, then it simply won't happen.

llagonne66

26th May 2011, 16:47

Well, it surely smelled like "dossiers noirs" which has been now confirmed by jcjeant.
Nothing else to add about that source.:{

CogSim

26th May 2011, 17:04

I agree with your false dilemma point, but am not comfortable with the "ignorance is bliss" state of the point preceeding it. The cold comfort of statistics is that the odds are that we can wallow in bliss on your (or my) next trip.

Neither am I. My point is that this is the dilemma we face, like it or not. Its an all or nothing deal. So you are completely ignorant or completely "in control" as the poor crew of 447 found out.

takata

26th May 2011, 17:10

Hi Lonewolf,
What tools are provided the flight deck crew for inflight trouble shooting and remedy of this complex failure mode? QRH and ECAMS are two resources that seem obvious to me, are there others?
Well no QRH/ECAMS.... as it depends on conditions and are flight phase related:
Cross-checking of all instruments (various displays), GPS ground speed, Radio Alt, airflow sound on airframe, thrust setting in relation with air data, autothrust erratic behavior, etc.
The first step is to identify if the system may have been fooled and turn off any ADR if they seem unreliable (but to keep one, even wrong, for still having the Stall warning).
Next is ECAM troubleshooting. Read again those PJ2 posts as he already described the process many times.

syseng68k

26th May 2011, 17:11

takata, #2450

Hi,

Thanks for the reply.

I thought you were perhaps being a bit paranoid, but yes, there are
always those in life who do little but try to find fault and apportion
blame. Iirc, others have said, the A330 has a decade or more of impeccable
safety record, so there can be nothing fundamentally wrong with it.
If airbus make recommendations to customers that they then choose to
ignore, or drag their feet in implementation, then it's clear who is
at fault. Perhaps part of the problem is that there is not enough
regulatory involvement. A recommendation is, after all, not a legal
requirement.

I'm not so clear about the second part of Fact3 paragraph, which, no
disrespect intended, looks a bit smoke and mirrors. Irrespective
of how complex such problems are, they *all* need to be identified,
together with a defined procedure to allow the crew to recover from the
situation. Anything alse is just dodging the issue. Perhaps this has
been done and is being ignored by the airlines in terms of training,
but not enough data here to comment on that.

The probe icing problem still nags though, one of the failure
modes of your "too complex" set and the first and critical link in so
many parts of the system. Looking in from outside, it really does
amaze me that this has been allowed to drag on for so long. As an insider,
perhaps you could comment on the reasons for this ?. Irrespective
of how serious the problem is in reality, fixing that would be one fewer
item to cause trouble and one more step towards the goal of "zero defects".

There's a good systems reason to fix it. While it's easy to design a system
that only ever gets fed good data, the software overhead involved
in trapping and recovering from bad data can be considerable and complex
in itself. Thus, more likely to have hidden faults in implementation. This
means that any primary data source has the added responsibility to ensure
unambiguous output at all times. That is, the data is always within expected
limits, or a clear error signal generated. Of course it doesn't absolve
the data consumers of the responsibility of doing their own checks, but
it's one less thing to have to deal with. In essence, it's better not to to
have to deal with errors in the first place. Better if they can be
designed / engineered out...

infrequentflyer789

26th May 2011, 17:16

My question is, why doesn't the software realize, especially when in cruise, that pitch and power haven't changed much, GPS altitude is relatively stable, that a big increase in airspeed is simply illogical?

It does. That is what happened as far as we know today (tomorrow maybe we'll know more) - from BEA original reports on the ACARS messages:This message, transmitted by the FCDC2 (EFCS2), means that the FCPCs (or
PRIMs) triggered one of the speed monitoring processes: they have detected
a decrease of more than 30 kt in one second of the “polled” speed value
As I read it, the computers will tolerate a transient (<10 seconds) period of dodgy values and revert back to normal if everything comes back into line - but if the values stay out of expected range, you are in alternate law etc for rest of the flight. Note that the BEA use the phrase "one of the speed monitoring processes" - which implies to me that there are other cross-checking processes as well as this one.

One thing we might find out tomorrow is whether the pitots failed in a way that slipped through this monitoring - maybe a symettrical and gradual speed increase or decrease - leading the plane to be already doing the wrong thing by the time the fault is detected.

Lonewolf_50

26th May 2011, 17:24

Well no QRH/ECAMS.... as it depends on conditions and are flight phase related:
---
Next is ECAM troubleshooting. Read again those PJ2 posts as he already described the process many times.
I understand your answer to mean "no alert," but am not sure that this is what you meant.

Cross-checking of all instruments (various displays), GPS ground speed, Radio Alt, airflow sound on airframe, thrust setting in relation with air data, autothrust erratic behavior, etc.
Roger, but what is the cue that gets you disbelieving your airmass data in the first place? Most of the time, (just like the engines engines) it works just fine, does it not?
The first step is to identify if the system may have been fooled and turn off any ADR if they seem unreliable (but to keep one, even wrong, for still having the Stall warning).

Understood, even if they way I asked the question didn't get me the answers to what I don't understand.

I'll review what PJ2 has said again, with your points in mind, and see what shakes loose.

takata

26th May 2011, 17:35

Chris,
As an insider, perhaps you could comment on the reasons for this ?
I have stricly no whatsoever connection with Airbus, Thales, AF, investigation (or anybody else interests in this story) as I'm investigating it for my own personal account in relation with human-machine interfaces and ergonomy issues.

PJ2

26th May 2011, 17:39

3holelover;

First, thank you for your moderate and patient response, and the opportunity to respond.

No, I did not mean or intend the post to sound and read as it did. It was too blunt. The post is deleted.

My point, I think, has been badly misunderstood because I have not explained it very well. Too much in a hurry and too little time to write well while on vacation....I should just take my wife's advice, and after this last post, I am going to!

I've read the document describing the Air Caraibe incident. I read (and re-read) the Airbus FCOM Bulletin posted by Takata, (since updated as A330 FCOM Bulletin #810/1, June, 2004). I have read extensively in the A332 AMM, in several Flight Crew Training Manuals regarding the SOPs for handling a loss of airspeed and/or altitude data. I've flown the 'bus since 1992 and instructed on the airplane and flown the A330/A340 since 1999. I have done a number of scenarios in a Level D A330 simulator. Like everyone, I am trying to understand how the accident happened.

There are 36 previous pitot events described in the BEA's Second Interim Report, Appendix 7.

I understand very well that once known, potential risks must be mitigated. My comments are not to be mistaken for an insensitivity to this primary requirement.

There is a history (of pitot problems) here but as has been eloquently pointed out by John Tullamarine and others, there are always changes underway which address issues raised in-service.

I think it is reasonable to assume that the software on this aircraft is not what it was when first introduced. I don't think such a process is nefarious. At the same time, I am aware of the controversies. The issue is well-discussed by a number of posters here.

I am also more than keenly aware of hindsight bias and am concerned that many of the comments which claim that "action was not taken" are based in such bias.

The view that the flight controls and computers were, though such an event is demonstrably, exceedingly rare, were a "trap" for pilots, is simply too facile, and I simply do not believe that this is the case, in isolation from other possible factors.

Further, 36 previous events did not result in an accident and the logical question to ask therefore is, Why here?

So...how to discuss the accident within such a context, without conveying the the impression that, "if not the flight control computers, then the pilots"?

In my clumsy and rushed way, I did, and now have deleted the post. But that doesn't alleviate the question that all investigators (I am not an accident investigator, btw), would ask...How did this happen and why? What can and must be changed to prevent such a reoccurrence?

I do not make the connection, "if not the computers, then the pilots". Even if the immediate causes are simple, the causal complexity of this accident is deeper and the lessons more important than "handing this accident to the crew".

The risk in talking about all causal pathways including human factors is just this. Rather than elaborate further at this point, I think it is best just to leave it there.

No offence taken - quite the contrary.

takata

26th May 2011, 17:49

Roger, but what is the cue that gets you disbelieving your airmass data in the first place?
IMC Flight: pilots are supposed to watch their instruments and notice any change of monitored values which are all related to each others: temperature, altitude, airspeed, pitch, thrust... even to ear or feel "how" they are flying (turbulence, buffet...) and have a good feeling if everything looks ok or if something is turning wrong.
Alerts are supposed to catch their attention only if their situation awareness is low because they are distracted by something else.

Lonewolf_50

26th May 2011, 17:56

PJ2/takata
From one of PJ2's posts in the past.

As we are aware, the AD that was released on December 22, 2010 states,

"However, in some cases, the autopilot orders may be inappropriate, such as possible abrupt pitch command.

In order to prevent such event which may, under specific circumstances, constitute an unsafe condition, this AD requires an amendment of the Flight Manual to ensure that flight crews apply the appropriate operational procedure."

1. If the "alert" I was asking about is this abrupt pitch command, then takata's response does not satisfy. This goes back to basic upset and UA training, a different road we've traveled more than once in this thread.

EDIT:

takata, if I may misquote Sir Joseph Porter, KCB, pray don't try to patronize me.
IMC Flight: pilots are supposed to watch their instruments and notice any change of monitored values which are all related to each others: temperature, altitude, airspeed, pitch, thrust... even to ear or feel "how" they are flying (turbulence, buffet...) and have a good feeling if everything looks ok or if something is turning wrong.
Given the hours I spent teaching instrument flying, thanks so much for that.
Alerts are supposed to catch their attention only if their situation awareness is low because they are distracted by something else.
Uh, no.

A key function of a cockpit alert is to inform the pilot of a change of state beyond normal, set, or expected parameters. See my mentioning a chip light up there, or a fire warning light. That isn't a matter of a distracted pilot not monitoring the internal gears or the firewall, it is a matter of identifying a condition that may require immediate attention beyond normal scan and activity. (I have typically seen alerts are coded with different colors, to help with "immediate" or "pretty soon" or "we can take our time with this one" classes of malfunctions, but that will vary with platform and design philosophy.)

Sometimes, its a small "Off" flag on a radio instrument. Other times, a blinking light.

Tell me, do you design applications related to ergonimics? :eek:

2. AD assumption seems to be that previous FM's were deficient.

3. I'll let it go at that.

EDIT: interesting patent description, for those interested, per the link alluded to a few posts up, about a back up system.

United States Patent Application: 0110071710 (http://appft.uspto.gov/netacgi/nph-Parser?Sect1=PTO2&Sect2=HITOFF&p=1&u=%2Fnetahtml%2FPTO%2Fsearch-bool.html&r=1&f=G&l=50&co1=AND&d=PG01&s1=20110071710&OS=20110071710&RS=20110071710)

Porker1

26th May 2011, 18:00

Surprised to see that no one has reported on the "leak" on France Info this morning - I was listening to the radio on the way to work. They claimed to have some inside info on what will be announced by the BEA tomorrow. In brief:

- yes the pitots iced up, the flight computers gave up and passed the control to the pilots;
- yes the a/c stalled but (as you'd expect!) the crew then correctly applied the textbook approach to deal with the stall but this did not work;
- yes the captain had briefly left the cockpit but was back in the cockpit for the critical part of the incident.

The article suggested that the incident was as yet inexplicable given current state of the investigation, and concluded that major conclusions would have to be drawn by the industry with regard to contingency procedures, training, system certification, high altitude aerodynamics and more.....

What I found interesting and reassuring was the avoidance of kneejerk reaction blaming just the crew - guess we'll hear whether their leak is correct tomorrow. You can hear the article at the link below - note that they say the more interesting things in the audio stream compared to the written synopsis.

Vol Rio-Paris : le BEA s'apprête à rendre publique une note sur les circonstances de l'accident - international - toute l'actualité internationale - France Info (http://www.france-info.com/monde-ameriques-2011-05-26-vol-rio-paris-le-bea-s-apprete-a-rendre-publique-une-note-sur-les-539041-14-16.html#)

takata

26th May 2011, 18:18

1. If the "alert" I was asking about is this abrupt pitch command, then takata's response does not satisfy. This goes back to basic upset and UA training, a different road we've traveled more than once in this thread.
2. AD assumption seems to be that previous FM's were deficient.
3. I'll let it go at that.
You'll let it here because you are not interested at looking further than a FBW induced upset. Now, there are already some pretty good clues that AP did not order a pitch up and was possibly never fooled.
1) AP kicked off whith ADR faults without a single ADR previously rejected (it would take a double probe simultaneous failure to fool the system).
2) It could not have been re-engaged later because this fault was never cleared until before impact (RTL).

Flyinheavy

26th May 2011, 18:18

@Takata

Are you a pilot? From your location Toulouse one could think you are just lobbying for AI.

How do you spell alerteness? During 11 hours?

If one imagine the situation: crossing the ITC possibly concentrated not to hit one of the bigger red things on the screen, when all of a sudden a lot of chimes alerts and so on went off...

Lets wait for the BEA rep tomorrow....

CONF iture

26th May 2011, 18:21

STALL WARNING during more than three (3) minutes
JE NE COMPRENDS RIEN said one pilot

Let's see what the BEA will reveal tomorrow ... ?

Thanks for the link Porker.

jcjeant

26th May 2011, 18:38

Hi,

More in Liberation newspaper: (judiciary experts comments)
AF447: un rapport d'experts met en cause Airbus et Air France - Libération (http://www.liberation.fr/economie/01012339795-af447-airbus-air-france-rio-paris-rapport-experts)
The written report
rapport d'expertise Rio-Paris (http://www.scribd.com/doc/56400906/rapport-d-expertise-Rio-Paris)
I let you make the translation ...........

takata

26th May 2011, 18:49

Hi Flyinheavy,
How do you spell alerteness? During 11 hours?
point 1.
If one imagine the situation: crossing the ITC possibly concentrated not to hit one of the bigger red things on the screen, when all of a sudden a lot of chimes alerts and so on went off...
point 2.
Can't you see a paradoxe here between 1 & 2?
No PF is flying an 11 hours leg. What is he supposed to do, then at cruise, at night, in weather avoidance mode, with AP and ATHR, beside monitoring his flight intruments?
What about some task sharing for this radar tilting and cb avoidance? are you flying alone, sir?
IMC: Instrument meteorological conditions (IMC) is an aviation flight category that describes weather conditions that require pilots to fly primarily by reference to instruments...
Doesn't it sound more than adequate for ITC crossings? or maybe are you suggesting me that it would take them 11 hours to cross it? Beside, they were in the first third of the flight (3 hours+) and the PF has already been relieved.

"when all of a sudden a lot of chimes alerts and so on went off."
Here is your single and very valid point: surprise, noise, stress... bad documentation, bad "crisis" ergonomy, bad training as not realisticaly or specifically adressed.... we'll see.

Experience return: I'm pretty sure, after AF447, that the general situation awareness has steeply increased for all the crews flying in similar conditions, whaterver their company or aircraft model.

do you think that all the people living in Washington DC. are potential lobyists for Obama administration?

Lonewolf_50

26th May 2011, 19:11

You'll let it here because you are not interested
Wrong. Your mind reading score is 0 out of 100.

at looking further than a FBW induced upset.
Actually, it intrigues the hell out of me, but I've a finite amount of time to engage with you. You are unable to answer my question, no problem, I appreciate the attempt.
Now, there are already some pretty good clues that AP did not order a pitch up and was possibly never fooled.

Which tells me you don't know ... no problem, it's a thorny question. The information should be with us shortly.

Note: what has been discussed in this thread is that in some previous Unreliable Airspeed incidences, there were pitch up, but not in all. My point on "alerts" is that if your "alert" is the pitch up, you are already behind the aircraft ... which is an ergonomics and systems design issue when you have a known issue (back to 1999 at least ...) If there were other alerts, that is what remains unclear to me. If in this case the pitch up of some other incidents wasn't a symptom, ... we'll find out soon enough.

takata, do you understand how to stall an aircraft? :confused: The scenario looks to have been open to more than one path to that destination. You will I am sure explain the stall in your own words.

There are reasons one enters turbulent air in a restricted window of airspeeds. (model dependent)
1) AP kicked off whith ADR faults without a single ADR previously rejected (it would take a double probe simultaneous failure to fool the system).
2) It could not have been re-engaged later because this fault was never cleared until before impact (RTL).
Thank you, that is old ground you are covering, and you still have not addressed my inquiry into alerts. Cheers. Appreciate your trying.

I am pretty sure that you don't understand what I am asking, and I am also not sure that I am asking clearly enough.

EDIT:
Conf iture ..
STALL WARNING during more than three (3) minutes
JE NE COMPRENDS RIEN said one pilot

My horrid grasp of French parses this as

"I don't understand this thing (that thing?)"

Am I close?

jcjeant

26th May 2011, 19:21

Hi,

"I don't understand this thing (that thing?)"

I don't understand anything seem's better .... IMHO

HazelNuts39

26th May 2011, 20:02

Note: what has been discussed in this thread is that in some previous Unreliable Airspeed incidences, there were pitch up, but not in all.
I don't remember that, and did not find it in the BEA report. Where did you see that?

Lonewolf_50

26th May 2011, 20:07

HN39:

I am not referring to the BEA report, but on the continuing series of threads on this crash.

Some pages back, there was the A340/A330 incident where was discussed "a near miss" where one plane did a bit of a zoom climb. Also, when I went back to some of PJ2's older posts, I found something he'd dug out of another report. That is what I put in qoutes in the post where I address Takata and PJ2.

EDIT: here is what caught my eye.
The post was PJ2 responding to you:

HN39;
I was unable to locate "Appendix B". If the report has something to contribute to an understanding of the AFS especially the reconfiguration of flight laws from Nz to AlphaProt Law, I'm sure what there is in this report will be available and its relevance hopefully established. There are some primary differences in that event: For an AlphaProt Law response, the aircraft must be in Nz Law as the response (HIGH AoA and PITCH ATT) wouldn't be available in either Pitch Alternate law.

As we are aware, the AD that was released on December 22, 2010 states, "However, in some cases, the autopilot orders may be inappropriate, such as possible abrupt pitch command. In order to prevent such event which may, under specific circumstances, constitute an unsafe condition, this AD requires an amendment of the Flight Manual to ensure that flight crews apply the appropriate operational procedure."

The AD does not mention those "specific circumstances", nor do we know to what event(s) the characterization of "abrupt" refers, if any. Perhaps the dots are still too far apart to see viable connections but this event and the one to which I refer above concerning the UAS QRH Drill, are possible areas to focus upon along with weather.

http://www.pprune.org/tech-log/449639-af-447-search-resume-part2-43.html#post6435101

To be clear, PJ2 took the position during that element of the discussion that the aircraft was stable, (see the part of the post where he addressed takata before he addressed you).

If you think I have misinterpreted this, or I am making too far of an intuitive leap, please advise.

What I gathered from the 340/330 near miss was that an uncommanded pitch input was made, and the pilots got it sorted out in a few thousand feet, and returned to flying on altitude and airpseed, and arrived at destination. What made that interesting was that another aircraft saw it. As I understand it, the report was initially more concerned with the "near miss" than perhaps anomalies in flight control inputs.

The other incidents discussed, which included uncommanded flight control inputs, altitude excursions, and various upsets that the pilots recovered from have been part and parcel to this discussion at various times. Air Carriebe and Qantas were two of them.

If my synthesis is turning out a stew, instead of a cake, please advise.

HazelNuts39

26th May 2011, 20:30

Lonewolf_50;

The discussion I had with PJ2 was about an A340 AIRPROX incident due to turbulence, which activated High-AoA protection. It was not an UAS incident, and it has afaik no connection to AF447. The BEA analysis of 13 UAS incidents does not contain any reference to an uncommanded pitch-up, nor does the table in app.7 . The report states: With regard to crew reactions, the following points are notable:
The variations in altitude stayed within a range of more or less one thousand
feet. Five cases of a voluntary descent were observed, of which one was of
3,500 feet. These descents followed a stall warning;

Lonewolf_50

26th May 2011, 20:40

Thank you, sorry for having crossed my own wires on that. :O

Appreciate your clearing that up.

sensor_validation

26th May 2011, 20:45

Lonewolf_50

The airprox report is summarized in this post

http://www.pprune.org/tech-log/449639-af-447-search-resume-part2-42.html#post6434021

and the UK AAIB report can now be found complete with appendices at

Air Accidents Investigation: Airbus A330 C-GGWD and Airbus A340 TC-JDN (http://www.aaib.gov.uk/publications/bulletins/june_2001/airbus_a330_c_ggwd_and_airbus_a340_tc_jdn.cfm)

mm43

26th May 2011, 20:52

Originally posted by takata ...

Alerts are supposed to catch their attention only if their situation awareness is low because they are distracted by something else. That will undoubtedly be the crux of the matter - the aviate, navigate and communicate chain became broken.:sad:

bearfoil

26th May 2011, 21:10

mm43

Hi mm. I am not sure what you are saying here......

"...That will undoubtedly be the crux of the matter - the aviate, navigate and communicate chain became broken.http://images.ibsrv.net/ibsrv/res/src:www.pprune.org/get/images/smilies/puppy_dog_eyes.gif"

"ne comprends pas" means one thing, "ne...riens" another. This snippet, if accurate, says so much. It is a closure, a juncture of CRM. The flight is being re-set in the view of at least one pilot. I think the comment is within the boundaries of "Aviate," alone, not comms or Nav. No one would get to this point re: the mundane. Not even atrocious and frightening weather weather. The airplane is an unknown to him here, and shows a frustrated pilot partially into a situation with which he is greatly uncomfortable, and has no experience of. This moment is the initial onset of upset, or the immediate prelude. Again, if accurate, a year's worth of speculation coalesces into epiphane for all of us connected in any way with this tragedy. They are speaking to us.

mm43

26th May 2011, 21:19

bearfoil

My oblique reference was related to matters discussed many thousands of posts ago, and I don't intend to elaborate further.

Lonewolf_50

26th May 2011, 21:24

respectfully, mm, no sir. takata's statement that you qouted is not correct, insofar as what the intention of an alert is, nor the context he claims.

The conclusion you drew from it at odds with what appears to have happened: things had boiled down to aviate alone, which became (for whatever reason) an overhelming task. Task saturation isn't a pretty sight.

EDIT: never mind, I see what you were getting at.

DingerX

26th May 2011, 21:24

Well, I've been reading this for a while. It's been quite interesting, including the C vs. Ada fights and the veiled reference to flying the Skyraider.
That expert report table with the 36/43 incidents is pretty impressive, as is the note that nearly two-thirds of the events were reported after AF447 (although most of them occurred beforehand).
Isn't the industry standard one catastrophic failure ever 30 or so incidents?
One of the "take-aways" from this discussion could be that, regardless of whether FBW plays a role in this accident, what it does do is increase the criticality of a certain piece of equipment, and it did so based on underreported reliability data (even if the Thales AA was a particularly bad design, from this data every pitot tube should suffer from underreported failures).
Or, in other terms: in-service reliability figures are scientifically worthless.
The "responsibility/authority" distinction is at least superficially appealing. Another way to put it is that if a system design routinely drops a load in the operator's lap, the designers cannot expect more than 29 out of 30 operators to make the right decision. On the other side, at least 20 out of 30 operators are going to do everything they can not to be #30.
And the Swiss cheese analogy has its charms too, if only because the next slice is more likely to have the same holes as the previous one than not.

please carry on.

Safety Concerns

26th May 2011, 21:34

As a result of the blocked static ports the basic flight instruments relayed false airspeed, altitude and vertical speed data. Because the failure was not in any of the instruments but rather in a common supporting system, thereby defeating redundancy, the altimeter also relayed the false altitude information to the Air Traffic Controller.

Although the pilots were quite cognizant of the possibility that all of the flight instruments were providing inaccurate data, the correlation between the altitude data given by ATC and that on the altimeter likely further compounded the confusion.

Also contributing to their difficulty were the numerous cockpit alarms that the computer system generated, which conflicted both with each other and with the instruments. This lack of situational awareness can be seen in the CVR transcript. The fact that the flight took place at night and over water thus not giving the pilots any visual references was also a major factor.

sound familiar? It ain't the bus at fault it is sadly human limitation as to how much can be processed at any given moment when everything is going wrong.

Aeroperu 603

Lonewolf_50

26th May 2011, 21:50

HN39, I knew I remember something about a pitchup ...
http://www.pprune.org/rumours-news/375937-air-france-a330-200-missing-13.html#post4966826
It was a guess by one of the posters here based on something in an A330 (not the A340 in the AIRPROX event)

Another IRU fault resulting in sudden departure from controlled flight?

Several months ago an A330 transiting across Australia suffered a transient electrical fault in IRU1. It caused AP1 to think the aircraft had pitched down ~40 degrees. Needless to say it pitched up in response. Fortunately they recovered and the aircraft landed safely after diverting.

I wonder if this did similar, only in the opposite sense? http://images.ibsrv.net/ibsrv/res/src:www.pprune.org/get/images/smilies/eek.gif

ECAM Actions.

Of other interest ...

http://www.pprune.org/rumours-news/375937-air-france-a330-200-missing-19.html#post4967466

promani

26th May 2011, 21:52

One thing I have noticed, or missed, is that with all these 'leaks' and speculations, there is no mention of why AF447 flew into the CBs, and appeared to make a last minute adjustment to their course. I wonder if that will be revealed tomorrow?
Also with all the past accidents involving pitot tube, gung-ho pilots, flying into storms, computer failures, isn't it time for manufacturers to produce aircraft and softwares that can prevent the constant repetition of these accidents?

infrequentflyer789

26th May 2011, 21:59

- yes the pitots iced up, the flight computers gave up and passed the control to the pilots;
- yes the a/c stalled but (as you'd expect!) the crew then correctly applied the textbook approach to deal with the stall but this did not work;
- yes the captain had briefly left the cockpit but was back in the cockpit for the critical part of the incident.

Wasn't going to look at any more "leaks" but that sounded just too interesting - thanks for the link.

To me the most interesting thing is not what it says, but that it appears to completely contradict the earlier leaks. If the crew did everything by the book and still ended up in irrecoverable stall, then (IMHO) it can't possibly be true that the aircraft is exonerated and the crew at fault.

At least one set of leaks is therefore wrong - and always possibly both. Roll on tomorrow.

HazelNuts39

26th May 2011, 22:01

Lonewolf_50;

If the reference is to QF72; it pitched down uncommanded approx 10 degrees (from +2.5 to - 8), then during recovery in response to pilot sidestick command 7 deg up to approx -1 degree.

Regards,
HN39

JD-EE

26th May 2011, 22:08

CogSim, the last line of your recognizing icing posting prompted an "Oh goodie!" from me - in a very sarcastic tone.

"Under some icing conditions, even a 3-minute exposure can substantially affect the handling of the aircraft."

Riiiiight - and who knows what the handling feels like when the computer has been flying? And then the computer, where all this handling data lived as bits and bytes, flips the pilot the bird and says he has the stick. No WONDER pilots get confused when things pickle. They don't have critical data and there may be no good way to transfer that critical data to the pilot in time.

If pilots are going to be expected to take over when things get tough they should be far more involved in the routine flight of the plane so they have this feel. That phrase proves this to me.

{o.o}

JD-EE

26th May 2011, 22:18

sensor_validation, I get the impression that one of the best improvements for a pitot would be some form of airflow measurement out of the drain hole. If either the probe or the hole ices the airflow through will diminish. With a moniker like yours that's a design challenge for you. Measure the existence of airflow without increasing the chances of the probe icing.

{^_^}

Lonewolf_50

26th May 2011, 22:31

From about two years ago, from poster snaproll3480
According to the QRH and based on a weight around 210t:
(speeds are approximate)

Green Dot (minimum clean speed): 245 kts

Turbulence penetration speed: 260 kts

Vls w/ 0.3g buffett margin: 235 kts

Speeds are all indicated so no ISA deviation necessary.
HN39

Thanks for the detail, HazelNuts, yet again I doff my cap.

In re the pitch down versus pitch up.

With the above airspeed limits in mind, how benign do you think an unexpected ten degree nose down pitch is while on IMC, and possibly in turbulent air, with those limits considered?

NOTE: this is not a declaration nor an assertion that such is what happened with AF 447, but an inquiry regarding, as a pilot, your tolerance for a sudden ten degree nose down event. The closest thing like it from my own experience was a runaway nose trim event (which was a bugger, but manageable) but that was not on a FBW aircraft, so my personal points of reference are vague at best.
I will refer to AMF's comments on upset response from about the time AF 447 went down, which sentiment seems to not be confined to him.

The fact is, most pilots train for unusual attitude recovery where the recovery is accomplished in benign conditions with all flight controls working normally, a full panel, not to mention the engines running and outside visual reference. Many places don't even give "jet upset" training...i.e. loss of aerodynamic control at high altitude.

And a real-world jet upset, let alone sever or extreme turbulence involving all the forces, cannot be rendered or trained well in a simulator because the test pilots during certification don't even put the aircraft through those paces.
Also something that caught my eye ... http://www.pprune.org/rumours-news/375937-air-france-a330-200-missing-40.html#post4972892

Regards

LW50