AF 447 Thread no. 4 [Archive] - Page 2

PJ2

22nd Jun 2011, 08:10

Svarin;

Thank you for the clear explanations and responses.

I think I have a better feel for what you are saying.

First, you say, "It is however unfortunate that ADR2 data and associated RHS airspeed was not recorded on FDR..." We cannot say beyond what the BEA has said, what is and is not recorded but we cannot conclude that because the Airspeed to PFD2 is not recorded that the balance of ADR2's output parameters are not recorded. We may optimistically wait and see. The QAR was on the large electronics bay called "800VU" which was brought to the surface. Among the FCPCs, FCSCs, FMGECs and so on is the DFDAU/FDIMU and QAR recording unit. We can hope for the best. Also, there may be some information which can be retrieved from the EEPROMs of these various units - we just don't know yet.

On your theory, please allow me to re-phrase to see if I get it: - You are claiming that one PRIM remained in Normal Law due to a rare timing and rogue programming issue while two others reverted to Alternate Law, ("All three PRIMs are 99.9999% of the time in full agreement. Not this time."), and that PRIM2 which "remained in Normal Law", ("At 02:10:16, the pitch-up sequence and "zoom-climb" happened with (according to my research and "flimsy theory") PRIM1 & PRIM3 in Alternate 2 and PRIM2 in Normal."), was "in control", (do you claim it was the "Master FCPC"?), and pitched the aircraft up in a response to a false high speed, (High Speed Law) and it is this, not the side stick being pulled back, which led to the stall?

I understand that you are claiming this even though a different PRIM which was in Alternate Law, was also sending orders to the flight controls, ("Occam's try on these hypotheses is the triggering of an undesired normal law (full authority) overspeed protection by PRIM2 only which uses erroneous airspeed data after having unexpectedly returned to Normal law.

Further, might you be claiming that the reason that the Stall warning functioned "as designed" is because at least one PRIM was in Alternate Law?

I welcome a correction to my understanding but there are problems with the theory.

Much of this is beyond the limits of my own knowledge of the airplane but I can't imagine a flight crew permitting such autoflight behaviour without resisting it by pushing against the pitch-up because anyone who flies these aircraft knows what's about to occur next if the pitch up is permitted to continue. In Alternate Law the pilot can resist the pitch up due to high speed protection; in Normal Law this is resisted until the overspeed no longer exists.

The BEA states that the pitch-up was caused by a side-stick being pulled back. We have good reason to take that at face value until the next Interim Report because at some point we're going to have some actual data to examine and the BEA know it.

There is always the possibility of other explanations but the burden of coherence rests upon the proposer. If I understand what I have read, the EFCS Priority Logic ensures the operation of a Master PRIM by rejecting FCPCs/FCSCs which have failed their BITE test.

Any "partial input/control" by other than the Master FCPC is prevented "by design". And if "shared control" actually occurs between PRIMs, (one in Normal, two in Alternate), then there is a second problem beyond the fault in one of the PRIMs which returned it to Normal Law and that is the Priority Law which is permitting one PRIM in Normal Law and one or two PRIM(s) in Alternate Law to in some way, both send orders to the flight controls.

I think such a twin failure is highly improbable, especially in the face of the available information.

The theory must reconcile the comment from the PNF about "Alternate Law", (but not the AP disconnection), and the Stall warning which would not have occurred in Normal Law (as observed by HN39). As stated, while the pilots cannot counter a pitch-up order in an overspeed response in Normal Law, they can in Alternate (VMO2) Law. Instead, the side stick was almost always pulled back.

I think we need to re-focus on why the side stick was pulled back after a stall warning and why it was held fully back for thirty seconds while the aircraft was on the way down at >10,000fpm.

A shift in thinking is not intended to focus on the crew. Most here on the thread know by now that such events do not occur in a vacuum and instead have antecedents long before the actual event. It is up to the investigative body to determine how and why these pathways and factors came together.

The point has been made many times and has again recently...how are we to deal with the #1 cause of transport accidents including fatal accidents: Loss of Control?

What is it about the thousands of crews who fly these aircraft, wracking up millions upon millions of hours and miles uneventfully, that is absent in a few, extremely rare accident?

Leaving aside formal accident reports, (where accident reports have been done and made available...), what do we intuitively know for example about the Airblue A321 CFIT accident at Islamabad, the Afrikiyah A330 LOC accident at Tripoli, the Gulfair A320 LOC accident at Bahrain, the Armavia A320 LOC go-around accident at Sochi and the XL Airways A320 at Perpignan, that can help us place the causes of LOC into perspective and decide what way to go, even if "on the way to somewhere else"? Is it really merely the loss of flying skills or a psychological passiveness, a "non-involvement" with the machine, or is this just a training issue?

There are a number of papers available in this discussion. Some use mathematics which are beyond all readers except specialists but some authors such as Perrow, Reason, Dekker, Helmreich, are very accessible as most here will know.

My suggestion is a broadening of focus in the face of the signficant breadth of expertise on this and the previous threads. I do not believe that the answers to our questions about this accident lie in a detailed comprehension and tracing of the EFCS even though such may be involved in understanding what the crew saw and how they responded. The question is how and why so many transport aircraft accidents have resulted from a LOC followed by stalling the aircraft.

NigelOnDraft

22nd Jun 2011, 08:30

and the Stall warning which would not have occurred in Normal Law (as observed by HN39).
Furthermore it is noteworthy, since stall warning and stall do not occur in normal law, that the master PRIM was functioning in Alternate (2) law.It is my understanding that a "Stall Warning" can occur in Normal Law i.e. it is not "inhibited". It should not be triggered, since the high Alpha protections should keep Alpha short of it, but should they not be able to, then the Stall Warning will occur (as it did in Perpignon).

i.e. I don't think one can read that a "Stall Warning" = "Not in Normal Law". One can read that for a "Stall Warning" (at least) one AoA probe is seeing an AoA that should not be achiveable if Normal Law is functioning and able to control AoA.

HazelNuts39

22nd Jun 2011, 09:36

... the Stall Warning will occur (as it did in Perpignon). i.e. I don't think one can read that a "Stall Warning" = "Not in Normal Law".
From the final report on Perpignan:
The flight control system then passed into direct law. It is likely that the crew did not notice this due to the emergency situation and the aural stall warning that covered the warning of a change of flight control laws. The Air New Zealand pilot, by saying “alpha floor, we’re in manual” likely considered that the alpha floor function had triggered and that in fact the autopilot had disconnected.

NigelOnDraft

22nd Jun 2011, 10:00

Snap ;) From the final report on Perpignan (p97):
The triggering of the first stall warning in normal law, at an angle of attack close to the theoretical angle of attack triggering the warning in landing configuration, indicates that angle of attack sensor 3 was working at that moment.Specifically:At 15 h 45 min 05, the aeroplane was at 2,910 ft altitude and a speed of 99 kt. Pitch angle was 18.6 degrees. The stall warning sounded.At 15 h 45 min 15, the flight control laws, which were in normal law, passed to direct law.i.e. the Stall Warning started in Normal Law, ~10s prior to the change to Direct law...

HazelNuts39

22nd Jun 2011, 10:12

Thanks NoD for that clarification. Sorry for not reading the whole report before posting.

NigelOnDraft

22nd Jun 2011, 11:02

HN39...

No problems... I just recall when I first read it my eyebrows raising, since my training had led me to believe it was an Altn Law thing.

Of course, this is an A330 (PRIM), which might differ from the A320 (ELAC), but I doubt it does in "concept"?

Peter H

22nd Jun 2011, 11:06

Cogsim,
Free downloadable version of this paper at:
http://www.eurekalert.org/jrnls/pnas_pdfs/pnas.201018740.pdf

Chris Scott

22nd Jun 2011, 12:07

Quote from wmelvin:
Does the GA mode also command a flight path? If so, can it use elevator trim to accomplish this?

Haven't been following this thread for some days, so have a lot of catching up to do. But, in case it helps, I think you are referring to an AP/FD function, not an FBW function. On a normal go-around, when the FD is available or already selected, the FD mode changes to "SRS" (speed reference system) as soon as the pilot selects TOGA thrust. (This is announced to both pilots by the FMA-indicators at the top of their PFDs, which show "TOGA/SRS/GA TRK".) SRS uses pitch commands to achieve the IAS appropriate to the configuration. When either the PF (using sidestick) or the AP respond to the pitch commands, the FBW system will control elevator, backed up by autotrim, as required.

Guess I don't have to remind you that the FDs/APs were no longer available on AF447 at the stage when the PF selected TOGA.

DJ77

22nd Jun 2011, 12:52

Guess I don't have to remind you that the FDs/APs were no longer available on AF447 at the stage when the PF selected TOGA.

But the FDs may have automatically re-engage a dozen seconds later when ADR3 came on line again with coherent airspeed. In what mode would they re-engage then (the throttles being in the TOGA gate) ?

HazelNuts39

22nd Jun 2011, 12:53

NigelOnDraft;

Found another tidbit in BEA's 2nd report, where it discusses thirteen reported events of UAS. What do you make of this: The stall warning triggers when the angle of attack passes a variable threshold value. All of these warnings are explicable by the fact that the airplane is in alternate law at cruise mach and in turbulent zones.

NigelOnDraft

22nd Jun 2011, 15:34

HN39 NigelOnDraft;

Found another tidbit in BEA's 2nd report, where it discusses thirteen reported events of UAS. What do you make of this:
Quote:
The stall warning triggers when the angle of attack passes a variable threshold value. All of these warnings are explicable by the fact that the airplane is in alternate law at cruise mach and in turbulent zones.It can be interpreted in a number of ways.

A Stall Warning in Normal Law "needs" some explanation. The Warning is available IMHO (see above), but it should not be triggered due Normal Law's protections - so if it is triggered in Normal Law, a further malfunction or control problem would appear present. The "explanation" at Perpignon was frozen AoA probes. These 13 other cases did not need further "explanation" since the aircraft was in Alternate Law - and as it goes on to say, it is sensitive to control inputs - the 'Stall' trigger AoA is low at high M number.

PJ2

22nd Jun 2011, 16:07

NoD, HN39;

It is difficult to be definitive with the available information, but according to those tables that A33Zab posted here (http://www.pprune.org/tech-log/452836-af447-thread-no-3-a-91.html#post6507823), (table reproduced below) for the A330, the stall warning will occur in Normal Law but not until the Maximum AoA = 23°.

So it is indeed possible to have a stall warning in Normal Law but not until a maximum of 23°, is the way I read the statement beside the "IN NORMAL LAW" qualifier. Perhaps these tables represent the "phase-advanced AoA's" referenced in the AIRPROX AAIB Report.

I don't know whether the A320 stall warning system behaves same way but there is some reason to believe there would be similarities.

http://www.smugmug.com/photos/i-Qr5xMMw/0/X3/i-Qr5xMMw-X3.jpg

I could not determine what the numeric values in the table below Table A meant but in discussion they likely are entry points into Table B. That said, anything "> 200" has no correction from Table B.

Chris Scott

22nd Jun 2011, 16:21

Quote from PJ2:
"The BEA states that the pitch-up was caused by a side-stick being pulled back. We have good reason to take that at face value until the next Interim Report because at some point we're going to have some actual data to examine and the BEA know it."
[my emphasis]

Quote from PJ2:
"I think we need to re-focus on why the side stick was pulled back after a stall warning and why it was held fully back for thirty seconds while the aircraft was on the way down at >10,000fpm."

Quote from BEA Update (2011-05-27):
"The altitude was then about 35000ft, the angle of attack exceeded 40 degrees... [...] The aeroplane's pitch attitude did not exceed 15 degrees... [...] The airplane was subject to roll oscillations that sometimes reached 40 degrees. The PF made an input on the sidestick to the left and nose-up stops, which lasted about 30 seconds."
[my emphasis]

That last sentence, taken at face value (noting PJ2's first comment quoted above) is almost incredible. The beginning of the 30-second period seems roughly to coincide with the THS reaching full-travel (13NU).

It will be interesting to see what change in AoA took place during the 30 seconds, and what change(s) of bank. One would expect both to be considerable, yet there is little to suggest that is what happened.

My proposal is that the EFCS (FBW system) had already applied considerable up-elevator to try and regain 1G (in Pitch-Alternate Law without protections).

However, full aileron and roll-spoilers being required (in Roll-Direct Law) for 30 seconds, to level the wing, is a different matter.

CogSim

22nd Jun 2011, 16:27

Thanks for the link. Downloading it now.

Turbine D

22nd Jun 2011, 17:25

Somewhat old news, but this appeared in the Flightglobal Paris Airshow site.

http://xa.yimg.com/kq/groups/10483604/2002517561/name/Updated%20Stall%20Procedure.pdf
From the Floght global article:
This presentation by Airbus test pilot Xavier Lesceu, given before a performance and operations conference in Dubai in May 2011, contains a detailed explanation of the blanket revision of procedures for stall recovery adopted last year.

It's particularly interesting to read in light of the revelations about Air France flight AF447, notably the observation that the previous recovery procedure could result in "reluctance to apply nose-down input".

P.S. Note the AOA display on the A-380:ok:

gums

22nd Jun 2011, 17:34

A previous contributor brought up “loss of control” as a major cause of crashes. Hell, it's the only cause - act of God ( microburst on short approach or a mountain wave rotor), pilot unable to handle the aircraft's capabilities ( e.g. gee-loc as we saw in the Blue Angel crash awhile back), poor airmanship (e.g. CFIT or poorly executed approaches in bad weather or worse, the Buffalo crash), etc.

What bothers this ol' pilot is the situation where the aircraft itself becomes the problem facing an airman. I specifically refer to the concerns several of us have with respect to the Airbus control laws and “protections”. And BTW, I really dislike the term “protections”, and prefer “limits” when characterizing an aircraft's capabilities to perform the mission, or most importantly, “limits” imposed by FBW systems that seem to me to be more appropriate for autopilot assistance than basic airmanship. If we're too poorly trained to do the approach or cruise or climb without an autopilot, then what in the hell are we doing hauling the SLF's about?

Make no mistake, I flew mostly by myself and used the autopilot a lot ( when I even had one, heh heh) to reduce workload and “assist”. I did not use it as the primary means of flying the mission. I also did not completely depend upon the “limits” designed for the aircraft, and kept my OODA loop very active.

So I joined this discussion when initial findings were made public two years ago that AF447 did not auger in as we usually see with a “death spiral” or loss of control surfaces or even a spin. The impact description reminded me of the situation we encountered 30 years ago with my little FBW jet once discovering that all the “limits” to “protect” us could be overcome by doing things the designers never anticipated. When the AF447 wreckage was discovered, and the latest findings were made public, I became more convinced that the aerodynamic characteristics that likely existed at impact and for some time before were the same as our pilots faced long ago.

So what's the point, Gums?

I see a design that appears more like that of a drone then a plane with a crew onboard to fly the thing when sierra happens. I see a design that provides conflicting warnings to the humans and invokes a myriad of control law reversions due to a relatively well-understood sensor failure. I see a design that continues to “protect” the humans trying to pilot the thing when “normal” flight conditions do not exist. I see a design that has not considered the possibility of the aircraft to reach an aerodynamic condition from which recovery is almost impossible, especially with all the “control laws” I seem to understand a bit better after reading all the stuff here.

I shall not understand the crew actions we have been made aware of, but in the end, I shall ascribe a significant portion of the “cause” to the aircraft design.

Respectfully,

fantom

22nd Jun 2011, 18:27

Gums, Sire,

I note your considerable contribution and experience.

Many, many years ago I flew F4s and other stuff before discovering the amazing Airbus aircraft.

I have about (320 and 330) sixteen years' time and have not been killed so far. Many pond-crossings and visits to the Caribbean/Canada/Far East have failed to down us.

Don't you think we should have fallen victim to the 'design faults' by now? Or, was I living on borrowed time?

BOAC

22nd Jun 2011, 18:33

fantom - perhaps you should consider how long the AF447 Captain had been flying AB and with your obvious statistical view of accidents, whether you will retire before the reaper gets you too?

A33Zab

22nd Jun 2011, 19:08

Gums:

I see a design that appears more like that of a drone then a plane with a crew onboard to fly the thing when sierra happens. I see a design that provides conflicting warnings to the humans and invokes a myriad of control law reversions due to a relatively well-understood sensor failure. I see a design that continues to “protect” the humans trying to pilot the thing when “normal” flight conditions do not exist. I see a design that has not considered the possibility of the aircraft to reach an aerodynamic condition from which recovery is almost impossible, especially with all the “control laws” I seem to understand a bit better after reading all the stuff here.

Maybe that's the wrong point of view?
The design is not different than any other design, it's in basic a design like any other and has to be flown like that. Forget about the laws and protections they do not fly this design, the Pilot (assisted by AP) is in control just like any other design.
This tragedy could happen due to sensor failure, which are used on any other design too.
The failure of these sensors fooled AP, Protections AND human.

henra

22nd Jun 2011, 19:59

I see a design that continues to “protect” the humans trying to pilot the thing when “normal” flight conditions do not exist.

gums,

Here I respectfully disagree.
What I see is an aircraft that has stopped protecting the humans and sadly with the known consequences. In protected law (read Normal Law) this would likely not have happened. Unfortunately there was no Plan B for the protections and so they quit subsequently putting all eggs in the basket of the Pilots.
Reading the bits n'pieces we have it appears this handover of the eggs didn't work well. The pilots occur to have been surprised when they found the eggs in their basket. This is where I think closer investigation is warranted.

I see a design that has not considered the possibility of the aircraft to reach an aerodynamic condition from which recovery is almost impossible, especially with all the “control laws”

I'm still not convinced of this. We do not have sufficent information to be safely able to deduct this from my PoV.
But even if it would finally turn out that the condition was unrecoverable at AoA = 60° it has to be noted that the Aircraft shouldn't have been at this AoA in the first place. Once your 200t Airliner is at Aoa =60° all bets are off anyway. And that statement I would make for all makes and types of Heavies.
These are neither Christen Eagles nor F-16 which are designed for extreme maneuvering. Try this even in a simple piston twin and chances are you're equally dead.

Svarin

22nd Jun 2011, 20:11

Thank you for taking the time to discuss seriously. I will now make a full review of PJ2 very sharp questions and hopefully come up with decent postable answers within 48 hours.

My opinion on the whole matter goes very close to what A33Zab proposed :
The failure of these sensors fooled AP, Protections AND human.My only bias here is that I intend to examine the Flight Controls System first, because :
- it claims ultimate authority in some cases (this authority is built in the design, so to speak), therefore it should give answer first
- it is placed between pilot and aircraft in the control loop, which makes it absolutely necessary to question it when faced with a LoC accident

My insistence stems from the fact that my findings in this regard go much farther than the official ones. I am therefore tempted (by design :O) to take their counterpoint. A kind of balancing act.

This does not exclude finding if & where crew actions could have been better, if & where they had it very wrong, or how pilot training and attitude could evolve for the greater good. I have already posted in this respect and will likely do it again.

But it comes second if one wishes to really understand what they really faced on their last flight, to hopefully come up with realistic answers, both collectively and individually for pilots flying these machines with innocent trusting human beings on board.

Best regards

PS : when disaster strikes, healthy Flight Controls are more important than satisfyingly turning engines. If I had to be left with only one of these two...

Smilin_Ed

22nd Jun 2011, 20:19

......I shall ascribe a significant portion of the “cause” to the aircraft design.

Gums didn't say that aircraft design was the only cause of this accident. What he didn't say is that several other factors will be found;

1. Pilot training factors
2. Supervisory factors
3. Maintenance factors
...and possibly more.

In addition to considering aircraft design, no accident investigation is complete without at least considering the above. I believe that, at least, the first two have some bearing on what happened.

gums

22nd Jun 2011, 22:29

I throw my lot in with Sv, and his approach to the investigation of this terrible accident.

I apologize if I appear to be harsh with respect to my opinions of the Airbus design, but I feel I am more than qualified to comment on ANY CRAFT that is fly-by-wire. I base my opinions upon both my technical background and piloting background.

As Smilin' states, many factors can contribute to "cause", including supervisory, training, crew discipline, etc. However, first thing an accident board does is look at mechanical factors, then human factors. Sure, weather is a player, but only to the extent it may have precipitated an aircraft system problem or a situation that the crew could not handle.

My primary complaint is a reversion process that requires too much thought by the aircrew as to what is still working and what "protections" are lost and/or must be dealt with as in a "normal" aircraft. As Sv states, the flight controls are between the human and the aircraft control surfaces. So it bears the closest scrutiny, especially considering previous incidents involving the same type aircraft.

will answer specific questions later, as we await the next "interim" report/finding.

wes_wall

22nd Jun 2011, 23:59

will answer specific questions later, as we await the next "interim" report/finding.

Do we know approximately when that will be?

galaxy flyer

23rd Jun 2011, 00:14

Or, shorter gums, in a FBW plane, the pilot is merely a voting member of the flight.

bubbers44

23rd Jun 2011, 00:34

gums, don't you think the only reason an airbus pilot would pull the side stick all the way back at FL350 is because airbus said it couldn't stall?

No Boeing pilot would do that. They would hold the appropriate attitude and power for their altitude and weight. No one would pull back as they did. As the Airbus goes through it's laws degrading probably no one is trained for that so what ever law they ended up in let them go into a deep stall. I hope Airbus training corrects this so it doesn't happen again. I'm sure this post won't last long.

RR_NDB

23rd Jun 2011, 01:05

...have precipitated an aircraft system problem or a situation that the crew could not handle (http://www.pprune.org/tech-log/454653-af-447-thread-no-4-a-14.html#post6530465)
My opinion on the whole matter goes very close to what A33Zab proposed: (http://www.pprune.org/tech-log/454653-af-447-thread-no-4-a-14.html#post6530158)The failure of these sensors fooled AP, Protections AND human. (http://www.pprune.org/tech-log/454653-af-447-thread-no-4-a-14.html#post6530028)

The crew never should be "presented" (specially at critical moments) with System "outputs" that they are not capable to understand very fast.

The crews, "Redundant Systems, operators" always must "have chances" to "keep flying" (http://xa.yimg.com/kq/groups/10483604/2002517561/name/Updated%20Stall%20Procedure.pdf) their increasingly complex, and not perfect (never will be), machines.

It seems, is time now for a very serious effort (a/c designers and operators) for "better interfaces" between crew and the advanced planes Systems.

And i´m not speaking of just training. Complex R&D is required to simplify crew task in dealing with "non routine" situations.

What we have today is not we designers understand by "Fault tolerance" and Graceful degradation" in respect to System behavior, etc. being presented to the crew.

Mac

PS: And Airbus SAS share of responsibility in dealing with this effort is an opportunity for the company that introduced the commercial "advanced planes" (FBW+a new philosophy)

john_tullamarine

23rd Jun 2011, 02:09

I'm sure this post won't last long.

bubbers44, why would you think that ? Someone further up the chain might agree with you but the post is fine by me for the moment.

At the end of the day, the investigatory conclusions will be what they will be.

The sequelae are the important things - what the Industry does to plug whatever the hole(s) in the dyke might turn out to be.

It is important that we all keep in mind that aeroplanes are not perfect and the whole operation is based on probabilities (and possibilities, as PJ2, I think, admonished) as well as sensibly mitigated risks.

The overall safety of aviation is a progressive dance sort of animal - we just keep nibbling away at it, improving things here and there and all the while enjoying the benefits.

Machinbird

23rd Jun 2011, 02:11

Going back to a post I made a couple of days ago. It occurs to me that if the Flight Path Angle in the developed stall was around 45 degrees below the horizon, it would be necessary for the crew to push the nose down to at least 35 degrees below the horizon to break a stall.

No big deal to a fighter pilot with altitude.

A transport pilot, particularly one that really didn't understand why his aircraft was giving him no airspeed indications, and who was having trouble integrating the whole picture would have sold his first born in preference to stuffing the nose down 35 degrees below the horizon. That is likely why AF447's crew only gave a cursory attempt at getting the nose down to break the stall.

Would you have the courage to stuff the nose well down with similar indications in night IFR conditions while flying a 200 ton airliner??

Zorin_75

23rd Jun 2011, 02:36

gums, don't you think the only reason an airbus pilot would pull the side stick all the way back at FL350 is because airbus said it couldn't stall?

No Boeing pilot would do that. They would hold the appropriate attitude and power for their altitude and weight. No one would pull back as they did.
:rolleyes:
Boeing guys are a very special breed of course. But what about, say, Dash 8 pilots? They would never pull up in a stall and in any case there's still the stickpusher, right?

People doing the wrong thing because instinct overrules knowledge wasn't invented with FBW controls:
http://www.pprune.org/tech-log/454653-af-447-thread-no-4-a-13.html#post6528494

galaxy flyer

23rd Jun 2011, 02:43

J_T

sequelae

My first instinct was to bet you recently visited a medical professional, UNTIL I did a search and was amazed at the number of times that word has been used on Pprune.

Never argue or doubt the moderators! Or the erudition of the posters.

GF

galaxy flyer

23rd Jun 2011, 02:54

Rockwell-Collins has announced, at Paris, "panic button" that would "rescue" the plane by immediately recovering it from a stall or bringing it to straight and level at a reasonable speed; it might even land the plane. This way lies UAVs as passenger planes.

What are we coming to as pilots? If this is tried, we might has well hire to proverbial "bus driver" as long as conditions are fine, he'll do fine and when this goes wrong, push "PANIC" and wait for the landing.

WRT Machinbird's comment--if you are going downhill with boatloads of ROD, no indications of airspeed, nose 16 degrees above the horizon, pushing the nose down 35 degrees is better than whatever else has been tried. As D.P Davies said, given the choice between stalling and the alternative, try the alternative.

GF

Turbine D

23rd Jun 2011, 02:59

Gums,

Your posts and experiences on FBW aircraft have been extremely enlightening and most welcome as the PPruNe pilots and technical contributors continue to explore the factors causing the demise of AF447. There is no apology required for your conclusion that a certain amount of cause should be laid in the lap of the aircraft designer/producer. As Smilin-Ed points out, there are more causes that will/should be identified in the end. The facts are, things have changed from times ago. Then, there were basically two failure causes, airplane failure (the wing fell off or the engines quit) or pilot failure (poor judgement). Now there are multiple causes besides these two, computer failures, computer logic failures, computer messages that say one thing but mean another, nonexistent training for events that occur and the overall reliance on a man-made system that is deemed to prevent human error while ignoring the possibility that a system error could result in the same disastrous conclusion. The sophistication of today's FBW aircraft now translates into accident investigations, they in turn, become far more complex in determining root causes and recommendation measures.

I see quite a few people believing that substantial information will be forthcoming in the next BEA Interim Report, even some have mentioned causes being stated. I think the bar of expectations is set much too high in this regard. To date, we have received 50 pieces of a 750-1000 piece puzzle. In examining our 50 puzzle pieces, there is a diversity of opinions, theories and proposals as to what these 50 pieces represent. Now think about the BEA folks. Although they are "experts" in accident investigations, probably none of the investigative members are actually experts in the workings, flight handling and technology nuances of the A-330-200 aircraft, human capability under data overload and extreme stress, let alone its FBW system and logic. So they are dependent on contributing experts to assist them in analysis of all the data recovered, plus the recovered components of the aircraft and (sadly) the medical reports of the recovered passenger remains, human factors, pilot training, airline management decisions regarding available equipment and equipment up-grades. This is not and should not be a whizz-bang investigation reaching conclusions and disclosing information or data that is not clearly understood or where consensus has not yet been reached. IMO, the next interim report will give us another 50-75 pieces to examine. There is always the possibility of something of immediate concern being confirmed that will produce a safety recommendation. I don't look for much more.

Once all the data the BEA possesses has been thoroughly wrung out, tested and agreed to, can the process of assigning cause begin. IMO, this is the most difficult phase for committee agreement as it involves significant thought, logic, agreement consensus and legal implications (knowingly or not) going forward. There are different degrees, causes (primary), contributing causes (secondary), and undetermined causes (not enough data to determine). For a cause discussion example, Airbus now states:

For a given configuration, a given speed and a given altitude, Lift is only linked to AoA
For a given aircraft configuration and speed An aircraft stalls for a given AoA
Stall is only an AoA problem

When did Airbus know this? Was AOA available and in the forefront of presentations to the pilots in a moment of severe duress on AF447? If not why not? Is this a primary cause, a secondary cause or no cause at all?

IMO, I don't look for a final report from the BEA for a long time as they sort through everything.

Regards,

TD

Old Carthusian

23rd Jun 2011, 04:15

I have read a lot of speculation on possible failures or problems with the Airbus FBW system on this thread. It has all been very interesting and intelligently argued with lots of well argued logic. But...what seems to be clear is that it is just speculation. People seem over-ready to blame the aircraft because they don't know or understand how it works or how it was designed. The ones who are the most emphatic seem to be the ones with the least understanding. Whilst it is human to seek explanations one does need to consider a set of circumstances from the point of view of the actuality not what the writer would like to believe. So far, though, the evidence/information points in the direction of the human factor not the aircraft. All else could be considered wishful thinking.

Machinbird

23rd Jun 2011, 05:30

So far, though, the evidence/information points in the direction of the human factor not the aircraft. All else could be considered wishful thinking. Just remember, we are outside the aircraft trying to look in to what must have happened. It is very different when you are in the aircraft, with limited and confusing displays, feeling unusual forces, and the aircraft isn't responding in a way you were trained for.
We have to remember that what seems so foolish to us outside observers might make perfect sense given the inside viewpoint. Try to put yourself in the others guy's shoes given the information he was given to act on. The results might surprise you.
If the aircraft had been able to keep its airspeed measurement systems going, none of this would have happened.

3holelover

23rd Jun 2011, 05:33

Now there are multiple causes besides these two, computer failures, computer logic failures, computer messages that say one thing but mean another, nonexistent training for events that occur and the overall reliance on a man-made system that is deemed to prevent human error while ignoring the possibility that a system error could result in the same disastrous conclusion. The sophistication of today's FBW aircraft now translates into accident investigations, they in turn, become far more complex in determining root causes and recommendation measures.[emphasis added]
While all of that is inarguably true, the notion that a "pilot" can be so confused by his training that he's forgotten how to recognize and recover from a stall, is, to me, NOT "sophistication".

An airplane is just a dumb, flying machine. A stupid, GIGO, collection of 'stuff'... and it can fly. ...Just like the damned Wright Flyer. ...Forget how to make it fly right, and you're toast.

In this case, adding to the confusion (made extremely evident in these threads) over just how the beast behaves, ...this crew (a pair of FO's) were thrown into a nightmare.... Bad weather, lost airspeed indication, multiple failure annunciations, loss of confidence in any indications (apparently?), conflicting indications, inopportune loss, and then recovery of valid stall warning, darkness of night, absent Captain, poor to non-existent stall recognition/recovery training.....etc....

I don't think they had any chance, given all that.

Machinbird

23rd Jun 2011, 06:42

While all of that is inarguably true, the notion that a "pilot" can be so confused by his training that he's forgotten how to recognize and recover from a stall, is, to me, NOT "sophistication". Other than the rapidly unwinding altimeter, how do you recognize the stall when your aircraft adopts a relatively stable 16 degree nose up attitude. Is the unwinding altimeter real? (Well, yes, in this case.) Stall warning-its silent. Airspeed- nothing there indicated.
It isn't spinning. Just acts really funky on the roll channel and the pitch channel isn't responding. Sort of like a big easy chair. Has the computer gone stupid? Is this a bad dream? Sorry gentlemen time is up. You flunked the surprise test.

Prior to AF447, no one had characterized the A330 deep stall characteristics. Turns out it is relatively stable. I know there are a lot of professional pilots who must be surprised by this. They were spouting a lot of stall spin theories a year ago.:}

BOAC

23rd Jun 2011, 07:19

the notion that a "pilot" can be so confused by his training that he's forgotten how to recognize and recover from a stall, is, to me, NOT "sophistication". - it depends on your definition of 'sophisticated', actually, one of which is "deceptive; misleading.". Which takes me right back to my age-old proposal in my other thread that the fault lies with the training system which is NOT ready for the automation systems, and 'encourages' a belief that the 'system' will protect you.

As gums and bubbers have eloquently stated, your whole pysche and training 'spin' tells you that the system cannot let you down, just follow the procedures (in this case Airbus have 'taught' you) and you will be fine. As Machinbird says, I cannot see anyone 'brought up' in the modern/AB philosophy seeing the need to make such a drastic change of attitude as that which was required. After all, this aircraft CANNOT stall.

I still await ANYONE who can tell me how autotrim relates to 'received' IAS input OR what baro indications the crew actually were left with. Of more interest than a hairy bat?

PJ2

23rd Jun 2011, 07:46

Since the BEA mini-Report came out on May 27th, I have been thinking about a way to represent what bit of data is given in the Report and somehow combining it with the ACARS messages in a graphic format to see "where" things happened.

The following puts together known data from the May 27th BEA Report with a representation of the altitude profile built from the few data points and timings available from the BEA mini-Report. The large areas of unknowns are filled in with reasonable rates of climb or descent to match known points from the BEA Report.

The intention is to provide an accessible visual profile of the pitch-up and subsequent descent.

Please NOTE: ACARS FLR event timings are best estimates only and are subject to further input and change as more becomes known. They are not the ground-receipt timings. Please feel free to posit alternate times.

To emphasize:

- the entire diagram is largely a guess but I think a reasonable one. It is not built from data that is not readily available from the BEA 1rst, 2nd and May 27th Reports.

- the order of ACARS messages is NOT definitive but representative of approximate placings in the overall flight path.

The diagram is presented purely for the purposes of further discussion through visualizing where, approximately, events occurred. I hope this may help some understand events better - it did for me.

PJ2

http://www.smugmug.com/photos/i-57bkLXS/0/X3/i-57bkLXS-X3.jpg

Zorin_75

23rd Jun 2011, 08:19

Other than the rapidly unwinding altimeter, how do you recognize the stall when your aircraft adopts a relatively stable 16 degree nose up attitude. Is the unwinding altimeter real? (Well, yes, in this case.) Stall warning-its silent. Airspeed- nothing there indicated.
Ok, so let's assume the altimeter isn't real. But then to what perceived situation 16 deg pitch up / TOGA would have been a reasonable response? :confused:
As uncomfortable as the though may be, one explanation is that they may just have reacted to a stall like countless poorly trained/caught off guard/panicked pilots before them? Their plane in any case seems to have reacted like planes have been doing for over 100 years, FBW or not, and crashed accordingly.

Old Carthusian

23rd Jun 2011, 10:09

Machinebird

Just remember, we are outside the aircraft trying to look in to what must have happened. It is very different when you are in the aircraft, with limited and confusing displays, feeling unusual forces, and the aircraft isn't responding in a way you were trained for.
We have to remember that what seems so foolish to us outside observers might make perfect sense given the inside viewpoint. Try to put yourself in the others guy's shoes given the information he was given to act on. The results might surprise you.
If the aircraft had been able to keep its airspeed measurement systems going, none of this would have happened.

This is just my point - the human factor. Whatever happened on that night was because the humans involved did not respond in an appropriate way to the situation they were in. Nothing more, nothing less. To them it might have been appropriate but it wasn't. I suggest you reread pickyperkins (No 257) last post with the most interesting extract about what to do when in a stall. Note the date of the text - this is not new at all. There are two significant questions which in fact are key and that have nothing to do with the aircraft systems - Why did the aircraft fly into a CB when others avoided it? and Why did the PF pull up on the stick for such a long time and induce a stall? I would also suggest more caution in your final statement - you cannot know that if the airspeed systems functioned flawlessly then the accident wouldn't have happened. You can only surmise.

Lonewolf_50

23rd Jun 2011, 12:15

I would also suggest more caution in your final statement - you cannot know that if the airspeed systems functioned flawlessly then the accident wouldn't have happened. You can only surmise.
Respectfully disagree with your statement.

System failure is (based on information so far gleaned) the trigger. BEA had taken that tack long before the wreckage undersea was finally located. Pitot tube issues and recommendations pre-dated the retrieval of the FDRs. It appears that their first estimate was well formed.

The event chain needed a trigger. Absent airspeed system failure, transition out of normal law and trimmed/stable flight state not likely => thus manual flying not required => thus the curious 30 second input not induced=> and so on.

If you wish to focus on human factors, you'll get no argument from me, but the linkage to mechanical factors is critical to the event chain. (There is a valid line of inquiry regarding "how well do you know your machine, and how well can you know your machine?" that was much discussed in one of the earlier threads, over a year ago I think).

How a response to airspeed system malfunction issues should have been addressed, and how the training of crews should have been undertaken for a known failure mode, certainly points to the human factors which include systemic / corporate / cultural human factors.

Getting into a stall in this event chain is a subordinate line of inquiry to response to malfunction. Per your earlier perkins reference, this points to a systemic issue that gums raised.

If you don't expect a stall, if you aren't familiar with what it feels and looks like, and if you don't train for it (<= not sure how valid that statement is, training may vary considerably) it is quite possible to initially react in a sub optimal manner. At that point, you are playing catch up, or as we used to say, you are behind the aircraft.

Is that a human factor? Absolutely. So too is a an altimeter winding down and what it means to you as you assess your situation from the right hand, or left hand, seat. What do you "see," and what does it mean to you?

That's the fourth act of a five act play, however. What was the lead in to that point?

EDIT TO ADD for Machinebird:
Going back to a post I made a couple of days ago. It occurs to me that if the Flight Path Angle in the developed stall was around 45 degrees below the horizon, it would be necessary for the crew to push the nose down to at least 35 degrees below the horizon to break a stall.

No big deal to a fighter pilot with altitude.
FWIW, if this was happening at, say 15K versus 35K, stall AoA would be a bit higher, so not quite as much nose down ... right? :confused: But that's a late in the game event.

Good point, though, in re what one is comfortable with.

What to me is more puzzling is the "why" behind why nose down inputs of lesser magnitude (when you didn't need something like 25-35 degress nose down pitch to unstall the beast) were not apparently made earlier in the process, closer to stall onset. This is where the interface of flight control and cockpit information resources strike me as having a critical interaction that opened the door to the condition, later, where your point on how much nose down you'd need to unstall the plane arrives.

mcdhu

23rd Jun 2011, 13:45

I am in awe of those posting here who clearly have fantastic technical knowledge and also fantastic knowledge of aerodynamics, but one thought keeps coming back to me as I read these fascinating pages with the story unfolding ever so slowly.

That thought is a piece of advice I have been giving out for years:

"If ever you get to 10° NU (or more) in a transport aeroplane - other than on take off (or G/A) - you are doing something badly wrong."

There will probably be those who will now post to prove me wrong, but it has always worked for me (eg forgotten the flaps etc). It might have helped these unfortunate pilots who were confronted with a mystifying set of circumstances. We shall see in the fullness of time.

Jig Peter

23rd Jun 2011, 13:58

@ bubbers44

You should have said "no pilot, whatever aircraft he/she is flying," etc ...
Yet, it appears that ONE pilot did just that, late at night, in an aircraft he was familiar with, during an otherwise quiet flight but with expected turbulence, on a route he had flown several times before ...
The type of aircraft is immaterial, so keep off the ritual "B good, A bad" stuff, there's a good lad - it doesn't help anybody's understanding. And, like all of us (even the conspiracy theorists) wait for the BEA's next statements.

BOAC

23rd Jun 2011, 14:28

Why did the aircraft fly into a CB when others avoided it? - this is a recurring comment here - where do you see that they did? You have read the explanations of the 'weather charts' posted on here?

Machinbird

23rd Jun 2011, 14:36

I would also suggest more caution in your final statement - you cannot know that if the airspeed systems functioned flawlessly then the accident wouldn't have happened. You can only surmise.
Respectfully disagree. That was the second hole in the swiss cheese. The first was flying too close to a CB cell.
I know that if the aircraft had not lost airspeed reference, we would be looking at a very different accident at worst, and probability says strongly that the aircraft would have arrived in Paris.

RR_NDB

23rd Jun 2011, 14:53

CRM Defined (http://www.globalaviation.com/_downloads/cap737.pdf)

2.1 CRM encompasses a wide range of knowledge, skills and attitudes including communications, situational awareness, problem solving, decision making, and teamwork; together with all the attendant sub-disciplines which each of these areas entails. The elements which comprise CRM are not new but have been recognised in one form or another since aviation began, usually under more general headings such as ‘Airmanship’, ‘Captaincy’, ‘Crew Co-operation’, etc. In the past, however, these terms have not been defined, structured or articulated in a formal way, and CRM can be seen as an attempt to remedy this deficiency. CRM can therefore be defined as a management system which makes optimum use of all available resources - equipment, procedures and people - to promote safety and enhance the efficiency of flight operations.

2.2 CRM is concerned not so much with the technical knowledge and skills required to fly and operate an aircraft but rather with the cognitive and interpersonal skills needed to manage the flight within an organised aviation system. In this context, cognitive skills are defined as the mental processes used for gaining and maintaining situational awareness, for solving problems and for taking decisions. Interpersonal skills are regarded as communications and a range of behavioural activities associated with teamwork. In aviation, as in other walks of life, these skill areas often overlap with each other, and they also overlap with the required technical skills. Furthermore, they are not confined to multi-crew aircraft, but also relate to single pilot operations, which invariably need to interface with other aircraft and with various ground support agencies in order to complete their missions successfully.

Question:

Is Airbus SAS advanced planes philosophy a threath to CRM? How to "work together" complex Systems in dealing with "extreme situations"? It´s possible address this issue just by training? It´s possible with the current Standards to safely manage (and operate) an advanced plane when unexpected (or unexpectable) situations arise?

Note: It came to my mind the "Flight Engineer". The third guy capable to manage the old systems (with another type of complexities) and able to act providing to the pilots the right and timely results.:}

How to deal with the low probability(*) but possible (http://www.pprune.org/tech-log/454653-af-447-thread-no-4-a-12.html#post6526410) events in a "complex plane"?:confused:

(*) Thales Pitot "failure" was not considered a so low probability occurrence. And AF was moving" to replace the sensors...Therefore not just possible but probable to fail and create "major" reconfig. of the advanced plane System.

lomapaseo

23rd Jun 2011, 14:56

My sense of the human factors is;

I see some similarities in the ABX cargo DC8 positioning flight where the crew was performing stall tests at night in and out of weather.

The tests went fine until their attitude decayed (deeper than expected into stall) and they failed to realize their rapidly unwinding altitude. Their response was methodolical and calm (senior pilot training another pilot) right up until the "terrain" warning voice.

To me it looked like they lost sensory awareness to what is just a temporary aberation and what is the highest priority response.

my gut feeling tells me that if they were able to see a horizon or had considered the rapidly unwinding altitude they would have reacted differently.

RR_NDB

23rd Jun 2011, 15:02

That was the second hole in the swiss cheese. (http://www.pprune.org/tech-log/454653-af-447-thread-no-4-a-16.html#post6531784)

Which one was the third? We have yet enough info to answer?

cc45

23rd Jun 2011, 15:08

Originally Posted by Old Carthusian
Why did the aircraft fly into a CB when others avoided it?

Also, see "A Detailed Meteorological Analysis" revised June 1, 2011 by Tim Vasquez in response to the new May 27, 2011 BEA data.

A33Zab

23rd Jun 2011, 15:53

RR_NDB:

The crew never should be "presented" (specially at critical moments) with System "outputs" that they are not capable to understand very fast

What is not clear when output is ECAM message:
F/CTL ALTN LAW (PROT LOST)
MAX SPEED……330/.82*

How would you suggest presenting this more clearly to crew?
* actual values depend on configuration.

If you are referring to the intermittent STALLSTALL, I fully agree this should have never been silenced when AOA was above the threshold value whether speed was valid or not.

The crews, "Redundant Systems, operators" always must "have chances" to "keep flying" (http://xa.yimg.com/kq/groups/10483604/2002517561/name/Updated%20Stall%20Procedure.pdf) their increasingly complex, and not perfect (never will be), machines.

Once again, the system doesn’t make up the inputs itself, it executes them from input of PF (AP) and in ALT LAW in such a manner it would not hinder PF to recover A/C from the upset.

gums

23rd Jun 2011, 16:30

I can see that many here cannot appreciate how "benign" a deep stall is in a well-designed airplane. When the wreckage pattern was revealed, I began thinking "deep stall" versus stall-spin or structural damage or .... I came to my conclusion that the plane hit the water in a fully-developed deep stall when BEA provided impact angles and velocities.

So I posted my excerpts from the F-16 Code One magazine. It showed the pitch moment versus AoA for our little jet, and had the statement by a test pilot concerning what it felt like - a Sunday drive except for the rapidly unwinding altimeter. Due to great aerodynamics and a control feature that used the rudder to arrest yaw once A0A was beyond the normal "limit" ( out of control of the pilot, BTW, just the confusers trying to "help" you), there is little, if any, yaw. Due to our leading edge flaps we also had very little buffet to tell you, "hey, you hamburger, you just got us into a deep stall!".

I will guarantee you that if those pilots had seen the films of the Viper in a deep stall that they would have done something else than what they did. Further, except in "direct law", the confusers are still in the game, with various "protections" disabled. So the jet is still trying to "help".

In a fully-developed deep stall in a FBW jet you could let go of the control stick and the jet would be happy to continue the attitude, heading and AoA all the way to impact. After all, it is trying to reduce AoA and still trying to achieve 1 gee ( that's the Airbus, but in the Viper could be trimmed for anything from minus 2 gees +/- to plus 3.5 gees for a neutral stick). In this case, I feel the jet was still trying for the one gee, even at the AoA limit Hence, the THS kept creeping NU. Added gee command by the pilot didn't help, but the pilot could have let go and the jet would have still remained stalled due to c.g., pitch moments at the AoA, etc.

For those wondering about the THS trimming without an airspeed input to the confusers, the gee/rate sensors are completely independent of air data/AoA and are at the core of the FBW system implemented by the Airbus, same as for my jet and the Shuttle and ...... So to provide a 1 gee neutral stick, the gee sensors will move the THS accordingly to maintain the stick deflection command versus the neutral position/command (1 gee), and those puppies are VERY SENSITIVE and are sampled at a very high rate. Think inertial navigation accelerations like less than a hundredth of a gee. Those sensors also do not require an inertial "alignment", as they can be a simple as our old needle/ball doofers for rates and strapdown piezo-electric gizmos for accelerations on all three axis.

The data plot for this accident will reveal some great things about the Airbus aero, and seemingly excellent directional and lateral control capabilities even at a ridiculous AoA. It will also provide a basis for stall recognition and recovery procedures. I think we all want to see this, ya' think? Crying shame that we finally get the data at the expense of many people and an expensive jet.

Lest anyone think I am making excuses for the crew, I'll be clear - I AM!!! I'll admit that some of the control inputs are confusing. I'll also wonder what the CVR will reveal for about two and a half minutes as the crew ponders what the hell is going on. And then I'll try to imagine a revovery at night, in clouds and a confusing array of warning and caution indications. So there, I've said it.

respectfully,

Smilin_Ed

23rd Jun 2011, 16:44

@Old Carthusian: So far, though, the evidence/information points in the direction of the human factor not the aircraft. Human factors are an integral part of aircraft design.

Manufacturers build an aircraft and then publish initial procedures according to how they believe it should be operated, based on their design. These procedures are what pilots get in training. Later, based on operating experience, procedures and training can be modified. Recommendations for modification of stall recovery training have thus already been made by AB.

An aircraft which cannot be safely and efficiently operated by human pilots is deficient in human factors.

PJ2

23rd Jun 2011, 16:49

Lonewolf_50;
System failure is (based on information so far gleaned) the trigger. BEA had taken that tack long before the wreckage undersea was finally located. Pitot tube issues and recommendations pre-dated the retrieval of the FDRs. It appears that their first estimate was well formed.

The event chain needed a trigger. Absent airspeed system failure, transition out of normal law and trimmed/stable flight state not likely => thus manual flying not required => thus the curious 30 second input not induced=> and so on.

If you wish to focus on human factors, you'll get no argument from me, but the linkage to mechanical factors is critical to the event chain. (There is a valid line of inquiry regarding "how well do you know your machine, and how well can you know your machine?" that was much discussed in one of the earlier threads, over a year ago I think).

How a response to airspeed system malfunction issues should have been addressed, and how the training of crews should have been undertaken for a known failure mode, certainly points to the human factors which include systemic / corporate / cultural human factors.

Getting into a stall in this event chain is a subordinate line of inquiry to response to malfunction. Per your earlier perkins reference, this points to a systemic issue that gums raised.

If you don't expect a stall, if you aren't familiar with what it feels and looks like, and if you don't train for it (<= not sure how valid that statement is, training may vary considerably) it is quite possible to initially react in a sub optimal manner. At that point, you are playing catch up, or as we used to say, you are behind the aircraft.
Very well summarized - agree fully.

BOAC;
I still await ANYONE who can tell me how autotrim relates to 'received' IAS input OR what baro indications the crew actually were left with. Of more interest than a hairy bat?
The BEA mini-Report cites altitudes a number of times so the parameters depicting altitude were working. There are no ACARS messages which indicate that the DMCs [Display Monitor Computers] were malfunctioning and no indications that static ports were involved. My sense of it is that the altimeters were functioning normally and I think the assumption is a reasonable one.

The autotrim does not "relate to 'received' IAS". As has been discussed, (gums, Chris Scott, Machinbird et al), pitch control is 'gee-driven' (Nz Law) in Normal and Alternate 1 & 2 Laws. In Direct Law the airplane is a B737...you have to trim it manually; no big deal, if it's trained and encouraged.

For emergency backup of GW and CG computation in case of a dual failure of the two FCMCs, [Fuel Control Monitoring Computers], the FE [Flight Envelope] part of the FMGECs calculates the GW from the WFU [Weight Fuel Used] and the CG from the THS position. The CG calculated here is a function of N1, Vc, Altitude, Mach and the GW from the FE part of the FMGEC and is memorized for used in the event of the above-mentioned dual failure, (IOW the airplane has to have something to fall back on whether in Normal or Alternate Laws because autotrim still functions in both laws).

In Direct Law, pitch trim is manually controlled through the two trim wheels on the pedestal. Manual trim is available in all phases of flight in all laws.

It is a complete mystery to me why it has been said that the use of manual trim is "discouraged". The issue is one of many which requires examination in the manner described by Lonewolf_50, (quoted above), Chris Scott, Machinbird, gums and others. (The Final Report will indeed be very challenging to write.)

Simplified, in Normal and Alternate Laws, movement of the trim wheels disengages the autotrim function during wheel movement but re-engages the autotrim when movement stops. The trim will move back to a position ordered through the AFS [Auto Flight System], which, as stated, is 'gee-driven', again, very simplified.

I think the anecdote about bats is instructive and helpful as well as fascinating...after all, the Wrights learned from observing birds did they not?... ;-)

Regarding the training of the approach to the stall, (Stall recovery is not taught at all, to my knowledge), not only the manufacturer stated, but many regulators and certainly operators, bought into the notion that the airplane was protected against the stall. Those of us who checked out on the airplane early enough to dismiss such claims, (EVERY airplane can be stalled), flew it with the usual regard for the conservation of energy. Someone said that except at takeoff, a 10° pitch attitude in any transport aircraft was cause for serious concern, (or words to that effect). Damn right. But somehow along the way, the mythology became established and that requires examination because automation in and of itself does enhance flight safety, but it has to be used as intended. gums is right...the word "protections" is a misnomer and "limits" describes it better, but the former conveys a sense of security while the latter is merely descriptive. Bluntly speaking, one is a marketing term, the other is an aviation term.

I hope this is of some use, BOAC.

DJ77

23rd Jun 2011, 16:54

Zorin_75

23rd Jun 2011, 17:04

So I posted my excerpts from the F-16 Code One magazine. It showed the pitch moment versus AoA for our little jet, and had the statement by a test pilot concerning what it felt like - a Sunday drive except for the rapidly unwinding altimeter. Due to great aerodynamics and a control feature that used the rudder to arrest yaw once A0A was beyond the normal "limit" ( out of control of the pilot, BTW, just the confusers trying to "help" you), there is little, if any, yaw. Due to our leading edge flaps we also had very little buffet to tell you, "hey, you hamburger, you just got us into a deep stall!".
First of all, thanks a lot for sharing your thoughts and stories, makes always for a fascinating read.

I'd be ready to go with the idea that they didn't see (or didn't believe) what their altimeters and/or ADIs were telling them, such things have happened before. But if they didn't notice they were in a stall, what did they think was happening? After all they made some pretty drastic inputs, so they were reacting to something. What could be the situation they believed to be in? To which 16 deg nose up and full thrust appeared to be a reasonable answer? I'm at a loss with this one. Hopefully the CVR will tell...

ChristiaanJ

23rd Jun 2011, 17:09

how well can you know your machine?
Covers it for me.....

When all around you everything goes to hell in a handbasket, it's not the moment to try and recall every paragraph from the "mind image" (hopefully accurate) of the aircraft systems you slowly built up during your 'on-type' training.

BOAC

23rd Jun 2011, 17:22

Thanks PJ - it would appear, then, from the BEA release that neither of them noticed the altimeter winding up!

Regarding THS then - if you managed to maintain1g flight while reducing IAS by 100kts maintaining enough pitch 'authority' with the elevators, the THS would not move - or would it simply move to maintain a neutral elevator position as a 'human' would do?

New UAS QRH drill - 'Deploy the bat':8

Machinbird

23rd Jun 2011, 17:23

It is a complete mystery to me why it has been said that the use of manual trim is "discouraged". The issue is one of many which requires examination in the manner described by Lonewolf_50, (quoted above), Chris Scott, Machinbird, gums and others. (The Final Report will indeed be very challenging to write.)

Simplified, in Normal and Alternate Laws, movement of the trim wheels disengages the autotrim function during wheel movement but re-engages the autotrim when movement stops. The trim will move back to a position ordered through the AFS [Auto Flight System], which, as stated, is 'gee-driven', again, very simplified.PJ2, your description of the manual pitch trim was my initial understanding of how manual pitch trim works.
That once you let go of it, the system would again move the trim to where it wanted to move it.
Others have stated that once you handle the manual pitch trim, it stays in manual for the duration of the flight and has to be reset on the ground.

May as well sort out this detail fully. If you remained in manual THS, it would have implications for proper flight control function on some of the "protections."

Are there some old wives tales running around here, or possibly differences between aircraft types?

GarageYears

23rd Jun 2011, 17:59

So we all seem to agree that +10 degrees NU in a transport category aircraft at any other flight phase than take-off is likely a bad idea?

Clearly there are reasonable 'limits' for negative climb rates -10K/min is not one in my book.

Ditto for AoA....

I think we can all sketch a flight envelope within which things are likely going well, outside of which something is likely not so good.

Sounds like the protections (limits) of Normal Law?

Normal Law works when all the expected inputs are provided and believed to valid, and is supported by autoflight systems.

However in Alternate it was possible to get the pitch to +16 degrees with a sink rate of -10K/min. Unfortunately the primary computing system in the loop (the human) did not see the flaw and it would seem did not take the appropriate recovery action (or if it was attempted, it was not sustained enough to cause recovery).

It seems to me that there is a pretty strong argument for a secondary layer of automation that would step in and prevent a sustained abnormal attitude. Sort of like a more sophisticated "stick-pusher", that would override the pilot input (if incorrect) and provide the most appropriate recovery inputs. ND stick in this case...

I'm sure this is going down swimmingly well with the majority of pilots reading this, but I do not fear "poking the bear". We HAVE to do something to prevent a momentary misjudged few seconds worth of incorrect control input sending a jet full of people to the bottom of the Ocean.

OK, so may be none of 'you' are comfortable with yet another layer of 'protection' having control authority over the aircraft? Then at least consider an advanced warning system that will take all the critical input parameters (AoA, altitude, pitch, speed, etc) and provide a prioritized audible warning cue - "Abnormal AoA - control input Nose Down required"...

At least then the PF has something prompting him to THINK is this input right?

From the available information we have so far one critical aspect seems to have been missing - something questioning the control inputs of the PF? This extrapolates from the prior discussion related to control stick deflection (or more accurately NOT) for the PNF.

Looking at the sales figures from the Paris Airshow it would seem Airbus is entirely unscathed by any fallout from AF447... something like 726 aircraft sold for $72B, leaving Boeing in the dust with 142 aircraft worth $22B.

Lonewolf_50

23rd Jun 2011, 18:26

@BOAC:
New UAS QRH drill - 'Deploy the bat'http://images.ibsrv.net/ibsrv/res/src:www.pprune.org/get/images/smilies/nerd.gif
A nice variation on the old gag about Unusual Attitudes recovery.

IF you think your attitude gyro has tumbled:
1. Drop a cat and see which way it lands. (Cats always land on their feet.)
2. Where the cat's feet end up is down.
3. Roll aircraft to wings level based on FARG (Feline Attitude Reference Gyro) :}
(Who needs laser ring gyros, eh? Wait, a bean counter might be reading this ... :eek: )
(they used a chemical depilation, rather than actually shaving the bat)
Something about Shave the Bat rings a bell. This must be included in aviation vernacular, but I'm not sure what practice it ought to be applied to.

"Captain Pteropine sure shaved the bat on that one!"
(Made in reference to a hand flown landing very near stall brought on by a sudden windshear attack in the flare ... )

gums

23rd Jun 2011, 18:27

Some nice points, Garage.

Some do not realize that one of my original jets was the VooDoo, and it had the dreaded "pitch-up". Couldn't deep stall it due to the aero and c.g., but it had two limiters when not in autopilot control stick steering - a basic AoA limiter that we could overcome with 65 pounds of back stick, and a 'pusher" that snatched the stick outta your hands. This was back in early 60's, folks. So it has been tried and flown a long time ago. FBW systems don't act like that! You can pull back at 100 pounds and the command will be "x" gees, or "x" AoA, and if more than the design then that's all you'll get until airspeed is too slow. In other words, the jet will give you all that the designers figure you'll need.

One of my problems with the 'bus is that it seems to ignore the AoA when other air data is outta the loop. I have no problem with the basic "limits" implemented for the 'bus. They seem very reasonable for the mission and the aircraft's aero capabilities. Although I have my personal ideas of implentation, I'll stick with what we have to work with today except ignoring AoA.

So we don't need bitchin' betty telling you to lower the nose! And how is the 'bus gonna do this if it has ignored the AoA? Huh? just use the AoA limiter function and the sucker will gradually lower the nose to reach the 1 gee baseline ( corrected for pitch, so it will be lower than 1 gee in a climb or dive). The problem is if you are climbing at an extreme attitude, then you run outta air molecules over the THS too quickly to get the nose down!!

I also caution folks about the "direct law". Sounds like the jet would fly like a "normal" jet, but it ain't so. There are still control surface deflection rates plus pitch rates computed independently of air data and such in the way. Further, the 'bus ain't no F-22, and getting 3 or 4 gees within a half a second might be a bit disconcerting, ya think? Only way around this, way I see it, is to employ control stick feedback as we now see in several PC flight sims. In other words, you get a "feel" of how much you are asking the beast to do. Only problem is that kinda system need some gee and "q" inputs. Gee ain't a problem, but when the design ignores speed under certain circumstances, then all bets are off. And such is the 'bus control logic at present.

respectfully,

foster23

23rd Jun 2011, 18:39

thank you for a very imformitive post, i cannot thank all of you enough for your posts and links again i take my hat off to every professional person to post on this forum. thanks again from a slf:ok:

PJ2

23rd Jun 2011, 18:55

Machinbird;
That once you let go of it, the system would again move the trim to where it wanted to move it.
Others have stated that once you handle the manual pitch trim, it stays in manual for the duration of the flight and has to be reset on the ground.

May as well sort out this detail fully. If you remained in manual THS, it would have implications for proper flight control function on some of the "protections."

The text I have is not the easiest to read/interpret. One could gain the impression by reading some of the statements, that once the THS is moved manually through the trim wheels, that it is in "manual, mechanical mode", period. However, the relevant statements which make me believe otherwise, are:

A. Mechanical Control Operation
When the trim handwheel installed in the cockpit center pedestal is manually turned by the crew, the chain and cable loop move the input shaft on the THS mechanical actuator. The input shaft moves the mechanical servoloop mechanism through an override mechanism. The override mechanism, which is installed adjacent to the Pitch Trim Actuator (PTA), makes sure that the mechanical control cancels, through a cam and microswitch arrangement, the electrical control.

..(1) Operation of the Override Mechanism

.....(a) Operation of the Mechanical Control
...........1 The input shaft turns.
...........2 A cam turns.
...........3 The cam moves a roller and releases the brake which limits the output shaft of the Pitch Trim Actuator [PTA] and the mechanical input together.
...........4 At the same time a piston is pushed to operate the three override mechanism microswitches.
...........5 The mechanical control now comes on before the electrical control.

.....(b) Release of the Mechanical Control
...........1 The input shaft stops.
...........2 The cam in the PTA is released.
...........3 The internal springs connect the mechanical input to the output shaft of the PTA.
...........4 At the same time the piston moves back from the microswitches.
...........5 The mechanism is now set in the electrical control position.

I think that makes it pretty clear, that once manual input stops, autotrim is reinstated. It also makes sense from the POV of the safety of flight - you cannot have a 1g AFS function safely with manual trim requirement.

BOAC;
Regarding THS then - if you managed to maintain1g flight while reducing IAS by 100kts maintaining enough pitch 'authority' with the elevators, the THS would not move - or would it simply move to maintain a neutral elevator position as a 'human' would do?
The THS would move, doing just as we would do in a non-AFS airplane...trim control column forces out to keep "elevator forces neutral", (bearing in mind that the forces aren't real, being masked by hydraulic servos and are artificially introduced by springs, ;).

The question that the engineers had to come to terms with however is, how do you do that in a FBW system?

For the above reasons suggested by Machinbird, you can't just rely on human input to do the trimming in a FBW automated system.

Maintaining "1g" flight is one solution. Using the elevator, (short term pitch control) as speed changes means that according to Nz Law the THS, (long term pitch control) would change position to maintain full elevator authority.

Maintaining 1g is an indirect response to increases and decreases in airspeed. A decrease in speed causes slightly < 1g as the aircraft pitch reduces, an increase, the opposite. Even in manual flight, the THS responds, both to stick and Nz laws.

Clearly, there are circumstances which you would either not want autotrim or autotrim would not be available in system or sensor failures.

Our human feedback loops are completely transparent to us but are extremely sophisticated and are the "loops" in a non-fbw airplane that we "tune" when we learn how to fly.

But those "loops" must be made visible (from their "automatic transparency!), then designed and built into a FBW system independent of humans for such a system to even function in a rudimentary way, and decisions must be made about such loops about the information signalled back to the servocontrols, the AFS and the crew.

Otherwise, any autoflight system would quickly become unmanageable, highly fatiguing and fundamentally unsafe.

Machinbird

23rd Jun 2011, 19:32

PJ2
Thank you very much for the analysis with references. That is crucial information in understanding a large range of issues regarding the Manual Trim and Automatic Trim systems.:ok: The FCOM references are indeed skimpy and confusing.

HazelNuts39

23rd Jun 2011, 19:32

This is to express my gratitude to A33Zab (AF447 Part 3 #1818 11th june) for digging up and posting the complete Stall Warning schedule of the A330. That is information I've been searching for in vain since s/w was first discussed early in the AF447 threads. So I've promptly incorporated that schedule in a graph that I posted earlier: StallWng2 (https://docs.google.com/leaf?id=0B0CqniOzW0rjM2VjNDlkYjEtZGQyMi00NmI5LTliZjktZGVhMmE 0ZWVlYzMz&hl=en_GB&authkey=CJalyYkH).

A33Zab

23rd Jun 2011, 20:08

Once again, the system doesn’t make up the inputs itself, it executes them from input of PF (AP) and in ALT LAW in such a manner it would not hinder PF to recover A/C from the upset.

Hmmm, doesn't the A/C makes inputs of its own in ALT law, trimming the THS ? Sure, this was due to strange PF inputs but was he really aware of the move ?
[/quote]

The actual logic inside the FCPC is not open to the public, so we have to rely on what is stated in the released documents.

"Pitch:

The side sticks and in some cases the pitch trim control wheels control the aircraft in pitch.
They act on the elevators and on the THS depending on the different laws.

1. Nz law.
This FCPC law is the normal pitch law engaged during the flight phase.
The pilot commands a load factor via a pitch action on the side stick.
The Nz law executes this command, depending on the aircraft feedbacks, so that:
- the short-term orders are executed by the elevator servo controls.
- the long-term orders are executed by the THS actuator (autotrim function).
The gains depend on Vc, on the flap and slat position and on the CG position."

From study material and answer to Machinebird's question:

"An override mechanism, which is installed in the PTA (Pitch Trim Actuator),
makes sure that the mechanical control through the trim wheels cancels the electrical control.
When a manual command is made with the trim wheels, the override
mechanism gives priority over the electrical command from the FCPCs.
It mechanically disconnects the PTAoutput from the mechanical input(via
electro-magnetic clutch) and also operates the overriding detection
switches which in turn signal the FCPC's to stop any electrical command
from the FCPC's."

It's not stated but it seems logical that when a manual pitch trim wheel
command is made or an autotrim command is cancelled by holding the
manual trim wheels (THS runaway) the side stick should be released to neutral.
In that case there is no SS input anymore and when manual input on Trim wheel stops also,
the electro-magnetic clutch is released again and THS system is ready to
take new SS orders.

Cryptic schematic but could not find any better:

http://i474.photobucket.com/albums/rr101/Zab999/THS_OPS.jpg

Don't you agree that even without pilot input the THS would trim up once the A/C is stalled ?

In ALT 2: The HI AOA Protection is lost, in case of a dual ADR failure (or ADR DISAGREE).

HazelNuts39

23rd Jun 2011, 20:58

no indications that static ports were involved. My sense of it is that the altimeters were functioning normally and I think the assumption is a reasonable one. Agreed, except that when IAS dropped below 60, then 30 kts, I think that was due to changes in the fuselage pressure distribution near the static ports (over-reading static pressure) due to high AoA, as much as or even more than due to the pitots under-reading total pressure. For what it's worth, CAS never drops below 140 kt in my simulation. That 140 kt is quite capable of pointing the AoA vanes in the right direction.

...after all, the Wrights learned from observing birds did they not?... ;-) And don't forget Otto Lilienthal (recently celebrated on another PPRuNe thread), and who still knows the Minimoa?

Svarin

23rd Jun 2011, 21:19

PJ2, in answer to your post #258 :

PRIM2 which "remained in Normal Law"More accurately, it did not remain in Normal, it would have returned to it at the end of the 10 seconds monitoring process. This ADRs monitoring process by PRIMs specifically allow return to Normal law in some cases. During the process itself, it is in Alternate 2.

was "in control", (do you claim it was the "Master FCPC"?)No I do not. I expect it would have acted upon its sole authority following Normal law and quite possibly its protections, interfering badly with what PRIM1 was doing according to PF orders. Being in Normal while Master was in Alternate 2, it would have deemed its Normal law better than what was asked by Master PRIM (PRIM1), thus resisting it.

Any "partial input/control" by other than the Master FCPC is prevented "by design".Not quite. Especially on elevator control, the need to activate all servos simultaneously under certain conditions make it necessary to cater for dual PRIM outputs onto parallel servos. Such thing is therefore not positively excluded from the design.

The theory must reconcile the comment from the PNF about "Alternate Law"Alternate 2 law was latched by at least Master PRIM1, and likely PRIM3, thus triggering the Alternate law ECAM and PFD effects.

The BEA states that the pitch-up was caused by a side-stick being pulled back.Not quite. Their wording was extremely careful (BEA text in italics):

From 2h10min05, the A/P then A/THR disengaged and the PF said "I have the controls". The airplane began to roll to the right and the PF made a left nose-up input.

The monitoring process takes place in Alternate 2. 10 seconds elapsed, then :

At 2h10min16, the PNF said "so, we've lost the speeds" then "alternate law [...]".
The airplane pitch attitude increased progressively beyond 10 degrees and the plane started to climb. The PF made nose-down control inputs and alternately left and right roll inputs.

The climb is not correlated with the initial left nose-up input. 10 seconds between the two. Time for PRIM2 to return to Normal. I posit these nose-down inputs were an unsuccessful reaction to the zoom-climb/pitch-up (manual THS should have been used then, easy to say now of course), and not the initiators of the following :

The vertical speed, which had reached 7000 ft/min, dropped to 700 ft/min and the roll varied between 12 degrees right and 10 degrees left.

I posit these are only the result of depleting kinetic energy. No updraft here, speed lost for height gained, no added energy. Roll variations might be the result of conflicting actions of PRIM1 and PRIM2 in different laws over ailerons and roll spoilers which the PF would therefore have had enormous difficulty controlling.

I think we need to re-focus on why the side stick was pulled back after a stall warningI agree that we should be questioning this action. After flight controls have cleared the investigation filter ;)

why it was held fully back for thirty seconds while the aircraft was on the way down at >10,000fpm.
It was actually "to the nose-up and left stops".

If flight controls were compromised, as the theory I offer seriously suggests (this is no fancy), then PF actions cannot be understood without the full traces of computers states, surfaces actuation/position, and so on, simply because his actions and the aircraft reactions would make no sense to him. This could lead him to trying things which would make no sense to us.

HazelNuts39

23rd Jun 2011, 21:54

The climb is not correlated with the initial left nose-up input. 10 seconds between the two. Time for PRIM2 to return to Normal. I posit these nose-down inputs were an unsuccessful reaction to the zoom-climb/pitch-upWhat would cause PRIM2 in Normal to command the zoom-climb pitch-up?

sensor_validation

23rd Jun 2011, 22:17

What would cause PRIM2 in Normal to command the zoom-climb pitch-up?

same thing as that 2000 A340 AIRPROX?
Ten seconds after the autopilot disengaged, the corrected or phase-advanced angle of attack (a computed parameter which is not recorded but can be calculated by Airbus Industrie from the DFDR data) reached the ‘alpha prot’ value. This angle of attack excursion beyond alpha prot caused a change in the pitch flight control law from normal law (NZ law) to angle of attack protection law (AoA law). If both sidesticks are at neutral, the AoA protection law seeks to hold the angle of attack constant at alpha prot until a sidestick pitch command is made.

Lonewolf_50

24th Jun 2011, 02:14

PJ, thanks for that graphic, A33Zab, much thanks for your diagram.

In walking through PJ's proposed event sequence, it's the same place I get stuck as the first read through I did of the second interim report.

I still don't understand ...
At 2 h 10 min 51, the stall warning was triggered again. The thrust levers were positioned in the TO/GA detent and the PF maintained nose-up inputs. The recorded angle of attack, of around 6 degrees at the triggering of the stall warning, continued to increase. The trimmable horizontal stabilizer (THS) passed from 3 to 13 degrees nose-up in about 1 minute and remained in the latter position until the end of the flight.
Was the pilot flying (or think he was flying)
a g command,?
a nose attitude?
an AoA (with no AoA reference in the cockpit)
another profile and expecting something else to happen next?

For that matter, what response was he expecting from the aircraft?

A guess here: he expected to escape the stall alert. Apparently, we go down the timeline and the stall alert went away. Did the crew deem the maneuver successful? :confused: Based on pre-event conversation, there was still probably a concern with altitude, since they were worried about their scheduled climb and the temps at altitude not developing as forecast.

This leads to a question I still have: why no deliberate act to descend with stall warning no longer active, as they'd been concerned with altitude just a few minutes previous to all this going down. (Guess: deeply concerned with airspeed, or its lack of indication)
==
If PJ's sequence is about right, the Captain re-enters and has to figure out what's going on while they are still in a diagnostic mode. He has something between two and three minutes to assess and call for the correct remedial actions( X, Y, Z and beyond) until recovery.

It appears that he may have suggested, or ordered, engines to idle, nose down commands ... and the stall alert goes off again.

With no disrespect to the dead intended, did the next CVR recorded voice transmission come out as "what's it doing now" in three part harmony? :confused:

OK465

24th Jun 2011, 02:18

Whilst there's a slight break in the Tech action...

LW 50:

I think I flew with Harry Pteropine when he was an FO.

Last I heard, he retired from a fly-by-night cargo operation and became a safety consultant.

He was noted for being able to hang upside down and view all the facts from a different angle.

:ok:

RR_NDB

24th Jun 2011, 02:46

What is not clear when output is ECAM message: F/CTL ALTN LAW (PROT LOST) MAX SPEED……330/.82 (actual values depend on configuration).>>> Nothing,

The System "output": Data (displays, aural info, etc.) and inputs to a/c flying surfaces (e.g. to THS, etc.) must be easily (and very fast) understood and understandable by the crew. It´s absolutely necessary an interface designed to present in real time a clear and reliable "picture" of "what´s going on" (and changing) in the plane.

How would you suggest presenting this more clearly to crew? >>> In similar cases, UAS (reason for Law change)

If you are referring to the intermittent STALLSTALL, I fully agree this should have never been silenced when AOA was above the threshold value whether speed was valid or not. >>> I am referring to all System outputs that could difficult (and dangerously, delay) proper and fast crew actions. (http://www.pprune.org/tech-log/454653-af-447-thread-no-4-a-16.html#post6531820) And also even potentially creating "extra CRM issues". (http://www.pprune.org/tech-log/454653-af-447-thread-no-4-a-16.html#post6531820)

the system doesn’t make up the inputs itself >>> When System changes its mode (for any reason) it´s "doing an input" (it´s "changing" the plane.). And this could be subject of improvements. I´ll repeat: Airbus SAS share of responsibility in dealing with this effort is an opportunity for the company that introduced the commercial "advanced planes"... (http://www.pprune.org/tech-log/454653-af-447-thread-no-4-a-15.html#post6530620)

The crews, "Redundant Systems, operators" always must "have chances" to "keep flying" their increasingly complex, and not perfect (never will be), machines. (http://www.pprune.org/tech-log/454653-af-447-thread-no-4-a-15.html#post6530620)AoA indication is vital (considering you can stall a´bus :})

My comments are not just on AF447 case. Other incidents/accidents can be related to these issues. And are not for just A (or B) but for "advanced planes", an important, "powerful" (and evolving :})trend.

Old Carthusian

24th Jun 2011, 06:03

Smilin Ed

Human factors are an integral part of aircraft design.

Manufacturers build an aircraft and then publish initial procedures according to how they believe it should be operated, based on their design. These procedures are what pilots get in training. Later, based on operating experience, procedures and training can be modified. Recommendations for modification of stall recovery training have thus already been made by AB.

An aircraft which cannot be safely and efficiently operated by human pilots is deficient in human factors.

I think you misunderstand - you seem to be describing the machine/human interface. Human factors does not refer to aircraft and how they operate but to people and how they respond to the situations they find themselves in. An awful lot of the discussion in these threads has focused on the possible trouble with the systems and how this has impacted on the pilots involved (a lot of this clearly ill-informed) but very little has focused the pilots themselves. Some have certainly asked questions but answers there have been few. The key to this disaster is the flight deck crew not the systems - which no doubt can be improved, systems always can. Information so far released contains hints of complacency and casualness (for example there does not seem to have been any sense of urgency in entering an area of turbulent weather). More examination of possible mental states would I believe be more fruitful. I realise that some of us don't really want to go in this direction (I am a pilot too but not on big jets) but to understand this accident I would suggest it is necessary to leave no stone unturned no matter how painful it is. Some have already shown this aversion to commenting on the pilots and I have to regretfully submit that this is not the right approach.

BOAC

24th Jun 2011, 06:54

this is not the right approach - I'm sure the majority here see the 'pilots' actions as a major factor in this accident and thus a subject to be examined thoroughly, but the question is 'why did they do xxx' - if indeed they did.

Could you answer #302 please?

HazelNuts39

24th Jun 2011, 07:24

same thing as that 2000 A340 AIRPROX?
Quote:
Ten seconds after the autopilot disengaged, the corrected or phase-advanced angle of attack (a computed parameter which is not recorded but can be calculated by Airbus Industrie from the DFDR data) reached the ‘alpha prot’ value. This angle of attack excursion beyond alpha prot caused a change in the pitch flight control law from normal law (NZ law) to angle of attack protection law (AoA law). If both sidesticks are at neutral, the AoA protection law seeks to hold the angle of attack constant at alpha prot until a sidestick pitch command is made.In normal law (AoA law) no stall warning, no stall: AoA remains at alphaprot.

henra

24th Jun 2011, 09:52

The airplane pitch attitude increased progressively beyond 10 degrees and the plane started to climb. The PF made nose-down control inputs and alternately left and right roll inputs.
The climb is not correlated with the initial left nose-up input. 10 seconds between the two. Time for PRIM2 to return to Normal. I posit these nose-down inputs were an unsuccessful reaction to the zoom-climb/pitch-up (manual THS should have been used then, easy to say now of course), and not the initiators of the following :
The vertical speed, which had reached 7000 ft/min, dropped to 700 ft/min and the roll varied between 12 degrees right and 10 degrees left.

From the BEA Note:

The airplane’s pitch attitude increased progressively beyond 10 degrees and the plane started
to climb. The PF made nose-down control inputs and alternately left and right roll inputs. The
vertical speed, which had reached 7,000 ft/min, dropped to 700 ft/min and the roll varied
between 12 degrees right and 10 degrees left. The speed displayed on the left side increased
sharply to 215 kt (Mach 0.68). The airplane was then at an altitude of about 37,500 ft and the
recorded angle of attack was around 4 degrees.
So, what does it tell us ?

So we know pretty safely AoA was 4°, speed was >215 kts.
If we now assume a pitch of >10° (see first quote),
this gives a FPA of >6° at ~400kts TAS.
This equals a V/S of >4000 fpm.

Taking this together it does not seem that the depleted energy was the reason for the reduction of the climb rate.
There is only one way how with the data points we have the V/S can have gone down to 700 fpm if speed was >215 kts an AoA was 4°. And that is that the Pitch must have reduced after the initial Pitch Up.

Therefore I conclude that the Nose Down input of the pilots have not been unsuccessful. They might have yielded slower response than expected or resulted in confusing somatogravic results but going purely by the facts I tend to disagree with your scenario that the control system did not follow the Nose down commands.

Edit:
The somatogravic point is the one which is the most intreaguing for me.
If they accidentally overcontrolled the aircraft leading to the initial climb, (e.g. due to mxing up with Roll correction input) then started to deplete energy due to the steep climb, a sudden and significant lowering of the nose (reducng V/S from 7000 to 700 fpm would fall into this category) would give a 'falling sensation'. Being relatively close to the stall speed, a subsequent pull up reaction to any pitch would lead to a reasonable 1g result, because there is no more lift available.
This 1g fits well into the normal range of things and would feel like normal attitude again. in complete darkness with no external references I'm afraid these sensations can play nasty tricks on you. Once your personal G force reference system is shifted (Falling vs. stable 1g), its difficult to go back to the original one. Re- aligning this personal reference system with the instruments in a situation where you are not sure which instruments are working properly might not be easy.
During and post stall any NU input will yield </=1g and thus feel benign.

RetiredF4

24th Jun 2011, 10:43

Henra
Taking this together it does not seem that the depleted energy was the reason for the reduction of the climb rate.
There is only one way how with the data points we have the V/S can have gone down to 700 fpm if speed was >215 kts an AoA was 4°. And that is that the Pitch must have reduced after the initial Pitch Up.

V/S can have been reducedby other factors as well like bank angle / roll to left and right, decaying airspeed, drag by deflected ailerons / rudder.

Concerning AOA: The relationship between AOA and pitch is not factual, theoretically a pitch of 90° with an AOA of 0° is achievable (not in an transport ac, but in a fighter ac).

I did observe lots of misunderstandings concerning unloading (stick forward) in nose high situations after more than 1 g was applied. 0,5 g already feels like a lot of unloading, stops the increase in pitch rate and reduces the AOA somewhat, but doesn´t change the (upward) flightpath immidiately and drastically. To really get the nose travel downward fast (and that is necessary in a nose high low energy state) unloading to at least zero g and below zero AOA is necessary, a vey uncomfortable thing to do if you are not used to it. And it takes some patience to wait till the nose is definitively below the horizon until further actions (like rolling wings level and applying power) have enough positive influence.

So i agree, nose down input had some effect, but not enough (Unload not high enough and not long enough).

Applying TOGA at that point was IMHO the worst thing which could be done by the crew. As long as the nose was above the horizon this TOGA produced a pitch up from the underslung engines and some noise, but no positve effect for recovery. That coupled with nose up stick input kicked the ship straight in to the fully developped stall.

That is no direct blame to the crew at the moment, as it affords training and expierience to act accordingly in a situation like this. A fighter pilot gets lots of training and application of those procedures in daily flying, the stall aproches in landing configuration or in medium altitude for air transport pilots in the simulator falls way short to that demand.

Concerning the somatogravic illiusions, spot on!

henra

24th Jun 2011, 11:00

.

V/S can have been reducedby other factors as well like bank angle / roll to left and right, decaying airspeed, drag by deflected ailerons / rudder.

Concerning AOA: The relationship between AOA and pitch is not factual, theoretically a pitch of 90° with an AOA of 0° is achievable (not in an transport ac, but in a fighter ac).

retiredf4,
No disagreement here. The only thing which I did was to derive the Flight Path Angle:
Flight Path Angle = Pitch - AoA
And consequently VS = Sin(Flight Patch Angle) * TAS
All I wanted to show is that 700 fpm at 400kts TAS means a Pitch attitude of significantly less than 10°..
In fact it would mean a Flight Path Angle of ~1° and thus a pitch of ~5°.

Regarding Roll it was stated that it varied between 10 - 12° left/right, so you would have to multiply the V/S with the Cosine of 12°, which would drecrease the Vs by less than 5%. Doesn't change the whole picture though.
Any speed reduction is already included as i assumed the 215kts IAS to be correct at that moment.

A33Zab

24th Jun 2011, 12:15

Svarin:

What's taken place inside FCPC's and FCSC's is not open to the public,
The only thing we know is: What is going in and what should be coming out.

I know the system only like it is advertised to operate in normal and outside the normal conditions.

If system had act like you say it did, it is NOT how it is advertised and would be a serious flaw.

There's only 1 PRIM in control and that will be the one which is capable of computing the highest level of law. (=NORMAL LAW, ALTERNATE, DIRECT).
The priority order is PRIM 1, 2, 3, FCSC.

This would maybe be the easiest part to design, and is common in all kinds of systems having multiple controllers.
Just take the output of controller 1 and use it as inhibiting input for the other controller(s). There you would have ensured the only 1 in control logic.
This inhibit could fail so it would be monitored and a message would be set if it did.

There is only 1 in control doesn't mean the others are doing nothing, the others are computing the 'same' output but this output is not used for servo command but for monitoring the output of the PRIM in control.
These other PRIMS are in MONITORING mode.

If the MONITORING PRIM's decide that the output of PRIM in CONTROL is not in agree with their own output a message would set and PRIM in CONTROL role will be transferred to the next PRIM acc. the priority rules.

At that time there were no messages present which would justify a PRIM in CONTROL change.
The wiring issue of FCPC 2 would possible be a reason to outvote this PRIM for taking CONTROL until there was no other PRIM left.

PJ2:
Any "partial input/control" by other than the Master FCPC is prevented "by design".

Svarin:
Not quite. Especially on elevator control, the need to activate all servos simultaneously under certain conditions make it necessary to cater for dual PRIM outputs onto parallel servos. Such thing is therefore not positively excluded from the design.

You are right by saying that (elevator only) all servos can operate simultaneously under certain conditions e.g. when inb. servos are unable to perform the commanded elevator position (due to aerodynamic load) the outb. servo’s (controlled by the executing part of PRIM 2) will assist and become active (i.s.o. dampening) parallel to Inb. (PRIM 1) servo's.

But NOT in the way you suggest (2 PRIM's) in control at the same time.
To explain this behavior you need to know a PRIM consist of 2 seggrated parts, a CONTROL part and an EXECUTING part.
For the CONTROL part there remain only 1 control and it is this 1 in control which demands the EXECUTING part of the other to assist its own EXECUTING part.

There are more situations were PRIM 1 in CONTROL needs output confirmation of other PRIM (e.g. Ground Spoiler) or other specific PRIM 1 function but that would take place in another flight phase.

Image below could clear some mis-interpretations,
Crosslinks between PRIMS and FCSC inputs are omitted for clarity.

http://i474.photobucket.com/albums/rr101/Zab999/PRIMSCHEMATIC-1.jpg

Svarin

24th Jun 2011, 15:31

Thank you very much A33Zab for this great technically enlightening information.

I will repeat again that I do not believe this design would be flawed in general, but that it ended up in an unexpected/unforeseen/viewed-as-impossible condition in this particular case.

What brings me to this view is the simultaneity/combination of unreliable airspeed (the Probe stuff) with unexpected loss of ADR1 by PRIM2 (the Wiring stuff). I do not believe such scenario was ever considered in design. It is way too far out of bounds, and I do not expect any design to take this strangest of cases into account.

I am therefore not discussing a design flaw, but a very strange failure combination, that is so strange as to put the whole flight controls system out of its designed domain. According to logical consequences of this dual failure, PRIM2 could have returned alone to Normal law (an undesired outcome) while PRIM1 & 3 would have correctly latched Alt2.

A33Zab :
There's only 1 PRIM in control and that will be the one which is capable of computing the highest level of law. (=NORMAL LAW, ALTERNATE, DIRECT).
The priority order is PRIM 1, 2, 3, FCSC.According to this, if PRIM2 had reverted to Normal it should take over control. This would fault PRIM1, if I understand right. PRIM1 was indeed faulted, but much later in the sequence.

However, PRIM1 is perfectly justified in operating Alt2 because of the UAS situation which triggered the 10 seconds monitoring process.

Remember this process did not trigger the NAV ADR DISAGREE condition immediately (as was the case in the Air Caraibe incidents) but at 02:12 approx.

PRIM1 being justified in operating Alt2 because of UAS, it can see no reason to defer to PRIM2 and its Normal law. Logically, the maximum control law should be Alt2. This is not an internal fault from PRIM1 which prevents it from computing Normal law, it is an external condition that justifies its operating Alt2.

If the MONITORING PRIM's decide that the output of PRIM in CONTROL is not in agree with their own output a message would set and PRIM in CONTROL role will be transferred to the next PRIM acc. the priority rules. The second interim report does hint at such a problem regarding the FMGEC1 FLR message. But again, this is later in the sequence.

However, if PRIM1 had remained Master, while PRIM2 had reverted to Normal and PRIM1 & 3 had latched Alternate 2, this means that PRIM1 is in COM (command) role, and both PRIMs 2 & 3 are in the MON (monitor) role.

But if PRIM2 reverted to Normal while PRIM3 latched Alternate 2, how would they agree on the fact that the COM from PRIM1 is wrong, for example ? I understand that PRIM1-COM could be outvoted by both other PRIMs-MON, but what if the monitoring PRIMs disagree ?

I take it that it would seriously delay recognition of trouble by the system. Such delay appears in the ADR DISAGREE and FMGEC1, PRIM1 and SEC1 faults/resets.

PRIM2 is never faulted. Its returning to Normal law would be the logical consequence of its losing ADR1 connection while searching for the outlier ADR.

Both PRIM1 and PRIM2 would have ended up in a condition where both would be justified by their programming in taking control.
-PRIM1 because it correctly recognized the UAS and correctly applied Alt2
-PRIM2 because it operates a "better" law : Normal (but it should not and fails to see this)

This looks like crossing logics with non-intersecting parameters where a decision cannot be made by logic alone.

How is this sorted out ?

BOAC

24th Jun 2011, 15:35

This looks like crossing logics with non-intersecting parameters where a decision cannot be made by logic alone.

How is this sorted out ? - err (yes, whatever that means) - by a pilot, or is it appearing that the a/c was probably 'un-flyable' in this condition?

fyrefli

24th Jun 2011, 15:58

There's only 1 PRIM in control and that will be the one which is capable of computing the highest level of law.

If the MONITORING PRIM's decide that the output of PRIM in CONTROL is not in agree with their own output a message would set and PRIM in CONTROL role will be transferred to the next PRIM acc. the priority rules.

Is there not an inherent contradiction in the above two rules? If one PRIM can compute a higher law than the other two, surely they're quite likely to disagree with it??

(Excuse me for butting in - I fly somewhat simpler aircraft, and have only contributed to these threads three or four times on matters I know quite a bit about, but I have read all of all four of them in some detail as they've developed and, FWIW, I *am* a software engineer.)

A33Zab

24th Jun 2011, 15:59

RR_DNB:

I am not in the position (no crew role) to justify or debate this matter.

I would suggest to take a look at ECAM (http://www.pprune.org/tech-log/452836-af447-thread-no-3-a-97.html#post6511514) as an example how it is presented to a crew, besides the local, aural warning and STATUS page with more information.

But if I am allowed (as technician) to comment:

UAS (ALT LAW DUE TO 3 PITOT BLOCKED) is not acc. ECAM protocol (missing preceding header) and too many characters (24 available) but more of all this can't be determined by EFCS.
EFCS don't know if the UAS is caused by PITOT, ADM or ADIRU failure, they only know FCPC's have no or conflicting ADR input.

Up to 1 minute after the event the CMC correlates this ADR disagree with the PITOT failure.
Don't think a crew will wait that long to be clearly notified.

GarageYears

24th Jun 2011, 16:11

- err (yes, whatever that means) - by a pilot, or is it appearing that the a/c was probably 'un-flyable' in this condition? If I am following all this correctly, then the issue in hand is not one of whether it was flyable, but simply which mode (Law) the control system was operating i.e. was it Normal or Alt.

Now, not withstanding the actual control law in effect, no matter what it was, the aircraft intrinsically was flyable. The question is still centered around what caused the zoom-climb?

In Alt Law I can only get to FL380 via PF input, I can't figure any other plausible explanation.

In Normal I believe the postulated theory is the aircraft, due to blocked pitots, believed it was in an overspeed condition and applied a pitch-up command, resulting in the climb and ultimately 13 degrees NU on the THS.

The part I don't follow is how we arrive at the overspeed? Since altitude sensing (static ports open) appears to have operated throughout, then with the dynamic port (ONLY) blocked, indicated speed would fall (which appears consistent with what BEA is reporting).

There are other parts related to Normal Law operation that I am not following, but the fundamental issue is this overspeed theory. Please enlighten me?

BOAC

24th Jun 2011, 16:19

In Normal I believe the postulated theory is the aircraft, due to block pitots, believed it was in an overspeed condition and applied a pitch-up command, resulting in the climb and ultimately 13 degrees NU on the THS. - ok - so how is this countered? Does the system 'know better' and ignore any 'human' pitch down elevator commands by increasing THS angle? I still cannot readily accept that 2 pilots would sit, apparently silently, while their a/c launches into orbit What was said?

A33Zab

24th Jun 2011, 16:57

"Is there not an inherent contradiction in the above two rules? If one PRIM can compute a higher law than the other two, surely they're quite likely to disagree with it??"

Maybe I was not clear enough.

Priority (for the CONTROL)
1/FCPC 1 NORMAL LAW
2/FCPC 2 NORMAL LAW
3/FCPC 3 NORMAL LAW
4/FCPC 1 ALTERNATE LAW
5/FCPC 2 ALTERNATE LAW
6/FCPC 3 ALTERNATE LAW
7/FCPC 1 DIRECT LAW
8/FCPC 2 DIRECT LAW
9/FCPC 3 DIRECT LAW

10/FCSC 1 AND/OR* FCSC 2 YAW ALTERNATE/DIRECT LAW
* system setup is different and depends on several configurations.

11 MANUAL (THS) with Elevators centered.

If one PRIM is not capable of computing a higher law this doesn't mean it is NOT capable of computing a lower law or failed totally.

Machinbird

24th Jun 2011, 17:21

The part I don't follow is how we arrive at the overspeed? Since altitude sensing (static ports open) appears to have operated throughout, then with the dynamic port (ONLY) blocked, indicated speed would fall (which appears consistent with what BEA is reporting).
Sorry, that is backwards. When you climb with a blocked pitot, the airspeed winds up, not down. Static is dropping and pitot pressure (trapped) stays constant. Delta P is higher which indicates higher airspeed. If I hadn't wound an airspeed completely around once climbing on top of an overcast, I'd probably be confused also.:}

GarageYears

24th Jun 2011, 17:27

Sorry, that is backwards. When you climb with a blocked pitot, the airspeed winds up, not down. Static is dropping and pitot pressure (trapped) stays constant. Delta P is higher which indicates higher airspeed. If I hadn't wound an airspeed completely around once climbing on top of an overcast, I'd probably be confused also.http://images.ibsrv.net/ibsrv/res/src:www.pprune.org/get/images/smilies/badteeth.gif

So you're assuming unequivocally that the DRAIN port was also blocked? Because most of what I can find relating to block pitots DOES NOT support that as the 'usual' failure mode. With the drain OPEN and the main port blocked, the pitot internal pressure drops to near static, resulting in decreasing speed indication. I can't find the reference to hand now, but in something like 90% of recent pitot icing incidents this was the failure mode - blocked main port and open drain.

Secondly, how does that tie into the BEA reports of the speeds dropping below 60kts and then recovering?

PickyPerkins

24th Jun 2011, 17:54

henra
Taking these aspects altogether, even if I have no specific data for the given case I would strongly tend to believe that ND elevator would have lead to Nose Down attitude change even at these AoA.

Thanks for your comment.

Looking at Fig. 6 (see below) of the NASA report "Dynamic Modelling and Simulation of Large Transport Aeroplanes in Upset Conditions", I see that for the generic twin jet transport model used in that study there was no reversal of pitching moment, Cm, for any elevator angle (between +20 and -30) or any AoA (between -5° and +85°).

http://pp.home.infionline.net/fig6.jpg

Although those results were with "CG=mid", these results are not dependent on the position of the CG.
The efect of a different THS setting might be another matter.

Note: This report was originally pointed to by BJ-ENG on 8th May 2011 in post 943, then again by Beispiel on 9th May, 2011 in post 990, and by Hazel Nuts on 18 June 2011 in post 143.

RR_NDB

24th Jun 2011, 18:57

Hi A33Zab,

Don't think a crew will wait that long to be clearly notified (http://www.pprune.org/tech-log/454653-af-447-thread-no-4-a-18.html#post6534019).

Processors (i was fascinated when received the Intel 4004 chipset to design and construct my first computer) computers and Systems are so integrated to our lives making us sometimes forget there other ways to "process and present" the information we need to perform our tasks.

My concerns perhaps can be expressed saying: Are this impressive arsenal of computational power being capable to allow the crews to properly exercise his capabilities (of simply keep flying the a/c or operate it safely) in all possible situations? Observe, here we cannot say just "probable situations". This is simply not affordable in the design of an airliner (http://www.pprune.org/tech-log/454653-af-447-thread-no-4-a-12.html#post6526410).

I´m not against automation or the growing use of "advanced System´s", etc.

PJ2

24th Jun 2011, 19:04

Svarin;

Thanks for your response. Respectfully, I would like to continue challenging your theory as a way of proving-disproving through "finding out". In the end, we may find that it cannot be settled. The theory, engaging and "possible", may still be trying to fit known facts "into the box" as opposed to examining why the PF pitched the aircraft up and continued to do so.

was "in control", (do you claim it was the "Master FCPC"?) Svarin: No I do not. I expect it would have acted upon its sole authority following Normal law and quite possibly its protections, interfering badly with what PRIM1 was doing according to PF orders. Being in Normal while Master was in Alternate 2, it would have deemed its Normal law better than what was asked by Master PRIM (PRIM1), thus resisting it.
Any "partial input/control" by other than the Master FCPC is prevented "by design". Svarin: Not quite. Especially on elevator control, the need to activate all servos simultaneously under certain conditions make it necessary to cater for dual PRIM outputs onto parallel servos. Such thing is therefore not positively excluded from the design.
The theory must reconcile the comment from the PNF about "Alternate Law" Svarin: Alternate 2 law was latched by at least Master PRIM1, and likely PRIM3, thus triggering the Alternate law ECAM and PFD effects.
Regardless of how it is put in your theory, in the above responses to my post, it is being claimed that two PRIMs, #1 and #2, are contributing to or co-sharing control of the aircraft....#2 providing those responses which apply in Normal Law and #1 giving those responses expected in Alternate Law.

The Priority Logic of the EFCS which is located in the FCPCs but independent of the controlling/monitoring functions of the FCPCs plus PRIM #2's failure to remain in Alternate Law due to a programming error, are, (as A33Zab has also said about the latter), two very serious flaws emerging independently and concurrently.

I agree completely with your comment therefore, that this is indeed a "very strange failure combination, so strange as to put the whole flight controls system out of its designed domain."

On another post...This looks like crossing logics with non-intersecting parameters where a decision cannot be made by logic alone.

How is this sorted out ?
I suggest respectfully that it cannot be "sorted out" because it has not been established that this is what happened. It remains a theory. One can only "sort out" inconsistencies in theories through a tautology or by broadening the theory to reasonably account for inconsistencies.

If I may, it is claimed that there is a "Master PRIM", but that there is another, working independently which materially affects control of the aircraft. The theory cannot have it both ways. Instead of asking the question of how to sort it out, (see "Byzantine failures" in previous threads), it needs to explain, beyond claiming rogue programming or rare events, why the Priority Logic as thoroughly explained by A33Zab's substantive posts, and the PRIM2 control in Alternate Law did not fully apply and instead caused a pitch-up of the aircraft in response to a false CAS > VMO + 4kts (where does that indication come from? - it can't be just "spurious"), the evidence for which, it is claimed, is some nose-down inputs during the pitch-up. Remember, the FMGECs supply orders to the FCPCs and the FCSCs and are also monitoring inconsistencies in output.

The Overspeed pitchup is a limited response in Nz Law...+ 0.3g (on top of Nz 1g) and a 22.5deg pitch up IIRC but more importantly, the High Speed Protection Law is overrideable in Alternate Law (specifically, VMO 2 Law) but not in Normal Law until the speed falls below a certain threshold. If it was overrideable as claimed, (reduced climb rate in response to ND stick inputs in the pitch-up), then Normal Law clearly did not apply at that point, so at what point did PRIM 2 stop "interferring" and why?

The other theory about the pitch up was re-introduced by sensor validation in response to HN39's question, What caused the pitch-up? I think the AAIB Report, which deals mainly with the TCAS - AIRPROX event, does not explain the AoA response accurately and perhaps even glosses over some characteristics of the A340 (and A330) Alpha response in 2001, which were changed as a result of an ADR/Pitot incident on the A330 in 1996 which also resulted in changes to the stall warning and brought in te notion of returning to Normal Law after a short period of time, (because the aircraft involved in the incident latched in Alternate Law, period). The change in question concerns the Alpha Prot Law which was and is inhibited above M0.53 by the updated FMGEC Standard.

Svarin

24th Jun 2011, 19:41

PJ2,

I would like to continue challenging your theory as a way of proving-disproving through "finding out".Thank you for this discussion opportunity. Such is what I am looking for.

The failures that I am putting forward are very simple :
- the probes failure, triggering the monitoring process
- the "wiring" failure, which deprives PRIM2 of critical information (ADR1) at a critical moment (inside the monitoring process itself)

The "programming error" I posit would only be an oversight in a newer version software that fails to consider compatibility with a previous version of software on another type of computer (i.e. ADR x FCPC, different manufacturers) only in the very specific instance of the monitoring process that is triggered inside the PRIMs by the probes failure. This would entail misunderstanding between ADR1 and PRIM2 at this very moment. This explains the sheer coincidence.

edit : But whatever its cause, the wiring fault did happen and it is a loss of connectivity. The wiring fault is not a hypothesis but a fact. The timing of this fault compared to that of the probe fault begs for a sub-theory that explains the coincidence.

The design "backdoor" is the possibility for PRIMs to revoke Alternate 2 law and return into Normal after 10 seconds if ADR values appear more or less consistent. This "backdoor" was likely breached when PRIM2 lost ADR1, thus fooling its overview of the UAS condition.

This possibility overall could not be foreseen. There is no way a design would be prepared against this.

Sorting out :

I asked that question with regard to the priority logic among PRIMs.

PRIM1 is Master and Alt2. It does not go to Alt2 because it fails to compute Normal, it goes to Alt2 because it is the right thing to do in an UAS context which it correctly identified. It is rightfully Master PRIM because Alt2 is the correct law to use because of UAS.

PRIM2 is not Master, but in Normal. Its "wiring" failure fooled it into believing itself out of the UAS context. However, Normal is the preferred law, which would make PRIM2 entitled to challenge mastery of PRIM1 according to the priority logic. It views itself as the one which can compute Normal, while the others cannot.

The priority logic looks to me very much strained here. This is what I would like to see sorted out.

Unless this very curious mastery dilemma is clearly broken, flight controls look very much compromised to me.

High Speed Protection is only the simplest way of seeing how a rogue PRIM would interfere. I would think the real events were infinitely more complex, but as A33Zab wrote, this requires knowledge of PRIMs inner workings.

barit1

24th Jun 2011, 19:48

Evidently the A330 pitot and the 727 pitot (NWA accident) behaved differently when iced up. The 727 was climbing, low-altitude pitot air was trapped in the system, and as static pressure dropped with altitude, the IAS display kept increasing.

But this is explained by the fact the 727 crew DID NOT TURN ON pitot heat at all, so both the ram and drain ports were blocked.

Smilin_Ed

24th Jun 2011, 20:21

I think you misunderstand - you seem to be describing the machine/human interface. Human factors does not refer to aircraft and how they operate but to people and how they respond to the situations they find themselves in.

They are part of the same thing. If the man/machine interface is not adequate, the human pilot can't fly it properly.

Machinbird

24th Jun 2011, 21:31

GY,
Secondly, how does that tie into the BEA reports of the speeds dropping below 60kts and then recovering? Some have speculated that the RHS airspeed oversped. Since that side is not monitored by the DFDR, there is some possibility that this happened.

I personally don't hold to this notion, but with the information we have at the moment, it is still a possibility.

I tend to believe that the PF accidentally got some back stick mixed in with his lateral control efforts, causing a net nose up input over time.

HazelNuts39

24th Jun 2011, 22:07

I tend to believe that the PF accidentally got some back stick mixed in with his lateral control efforts, causing a net nose up input over time. Agreed.
Some have speculated that the RHS airspeed oversped. (...) I personally don't hold to this notion, but with the information we have at the moment, it is still a possibility.I don't share that view either. If that had happened, ADR2 would have been the outlier and would have been rejected by the PRIMs. If, as svarin speculates, PRIM2 was deprived of ADR1, it would have declared ADR DISAGREE.

The occurrence of stall warning and stall point towards Alternate Law2. Is there anything in BEA's Update that points towards Normal Law?

BEA tells us that nose-up sidestick commands were made, and nose-up pitch and climb followed. In response to nose-down ss input the rate of climb reduced from 7000 to 700 fpm. We don't have all the data yet, but I expect we will get them. If the airplane response had been obviously at odds with the sidestick commands, wouldn't BEA have observed that?

A33Zab

24th Jun 2011, 22:30

PRIMS workings

I think it makes more clear to copy your posting in whole and comment on specific parts of it.

I will repeat again that I do not believe this design would be flawed in general, but that it ended up in an unexpected/unforeseen/viewed-as-impossible condition in this particular case.

What brings me to this view is the simultaneity/combination of unreliable airspeed (the Probe stuff) with unexpected loss of ADR1 by PRIM2 (the Wiring stuff). I do not believe such scenario was ever considered in design. It is way too far out of bounds, and I do not expect any design to take this strangest of cases into account.

I am therefore not discussing a design flaw, but a very strange failure combination, that is so strange as to put the whole flight controls system out of its designed domain. According to logical consequences of this dual failure, PRIM2 could have returned alone to Normal law (an undesired outcome) while PRIM1 & 3 would have correctly latched Alt2.

I call this a most serious design flaw if it leads to such A/C behaviour,
why are you convinced PRIM 2 reverted to NORMAL LAW?
Why should PRIM 2 revert (as the only one) to NORMAL while there is a common ALT 2 situation declared?

A33Zab:

Quote:
There's only 1 PRIM in control and that will be the one which is capable of computing the highest level of law. (=NORMAL LAW, ALTERNATE, DIRECT).The priority order is PRIM 1, 2, 3, FCSC.

According to this, if PRIM2 had reverted to Normal it should take over control. This would fault PRIM1, if I understand right. PRIM1 was indeed faulted, but much later in the sequence.
[/quote]

Not faulted PRIM 1, being only capable of computing a lower law than other PRIMs would not fault a PRIM, only sets a maintenance message.
PRIM 1 was indeed faulted later in the sequence, however I will not be surprised if the outcome will be the result of pilot action as is SEC 1 message.

However, PRIM1 is perfectly justified in operating Alt2 because of the UAS situation which triggered the 10 seconds monitoring process.

Remember this process did not trigger the NAV ADR DISAGREE condition immediately (as was the case in the Air Caraibe incidents) but at 02:12 approx.

Just because! the NAV ADR DISAGREE was triggerd much later in the sequence the speeds didn't disagreed that much and/or that long enough initially to set the NAV ADR DISAGREE.
I really don't know how much time it will require to trigger this message.

EDIT: In our A330 manual (Enhanced - equipped with BUSS mod) is stated:
if the ADR disagree last for more than 10s the PRIMs trigger the NAV ADR DISAGREE ECAM Caution.
The flight controls revert to ALTN 2 LAW

BEA:

Note: The inconsistency between the speeds displayed on the left side and on the ISIS lasted a little lessthan one minute.

Why didn't it trigger NAV ADR DISAGREE earlier?

PRIM1 being justified in operating Alt2 because of UAS, it can see no reason to defer to PRIM2 and its Normal law. Logically, the maximum control law should be Alt2. This is not an internal fault from PRIM1 which prevents it from computing Normal law, it is an external condition that justifies its operating Alt2.

If and only if PRIM 2 could compute NORMAL LAW it would become the PRIM in control, no doubt about that, if not this would be the serious system flaw and BEA/AIB should ring all available alarm bells.

AMM:

The Law is such that:
- each computer (FCPC) establishes the highest level of law (normal, Alternate or Direct) it can engage,
taking into account the results of the internal monitoring functions and the availability:
- of the ADIRUs.
- of the control components
- of the control surfaces, THS and S/F.
among the FCPC which can engage the highest level of law, the FCPC having the top priority is chosen.
If only 1 FCPC is capable of the highest level of law, this FCPC is selected whatever its priority level.

Quote:
If the MONITORING PRIM's decide that the output of PRIM in CONTROL is not in agree with their own output a message would set and PRIM in CONTROL role will be transferred to the next PRIM acc. the priority rules.
The second interim report does hint at such a problem regarding the FMGEC1 FLR message. But again, this is later in the sequence.

However, if PRIM1 had remained Master, while PRIM2 had reverted to Normal and PRIM1 & 3 had latched Alternate 2, this means that PRIM1 is in COM (command) role, and both PRIMs 2 & 3 are in the MON (monitor) role.

But if PRIM2 reverted to Normal while PRIM3 latched Alternate 2, how would they agree on the fact that the COM from PRIM1 is wrong, for example ? I understand that PRIM1-COM could be outvoted by both other PRIMs-MON, but what if the monitoring PRIMs disagree ?

FMGEC is different, there are only 2 a COM and a MON, if they disagree the 3rd reference is the crew. They have to decide which FMGEC failed.

Very remote (MON disagree) because all the FCPC's get the same information - ADR 1 + ADR 2 + ADR 3 - being valid or false.
(Except as you say PRIM 2 is missing ADR 1 data, but then again that could be a reason to prevent PRIM 2 to become in CONTROL, maybe only as last resource)
To give you an answer I guess the MON closest to COM will be validated and other MON declared due for maintenance.

I take it that it would seriously delay recognition of trouble by the system. Such delay appears in the ADR DISAGREE and FMGEC1, PRIM1 and SEC1 faults/resets.

PRIM2 is never faulted. Its returning to Normal law would be the logical consequence of its losing ADR1 connection while searching for the outlier ADR.

Both PRIM1 and PRIM2 would have ended up in a condition where both would be justified by their programming in taking control.
-PRIM1 because it correctly recognized the UAS and correctly applied Alt2
-PRIM2 because it operates a "better" law : Normal (but it should not and fails to see this)

PRIM 2 (or its connection with ADR 1 bus) is faulted but for maintenance only, this was no reason to declare it a total failure.
A total failure would mean the EXECUTION part is also not available.

This looks like crossing logics with non-intersecting parameters where a decision cannot be made by logic alone.

How is this sorted out ?

IMO the logic did sorted this out as designed, only - with respect - couldn't convince you yet.

Anyway we have to wait until end of july what actually happened untill then we will debate this matter.

PJ2

24th Jun 2011, 23:21

If the airplane response had been obviously at odds with the sidestick commands, wouldn't BEA have observed that?
Yes indeed, I should think so. If known to be the case, it would be a serious abberation in computer behaviour that would demand of the appropriate parties prompt action and suitable cautions/warnings to operators, none of which occured.

JD-EE

24th Jun 2011, 23:55

I realise that some of us don't really want to go in this direction (I am a pilot too but not on big jets) but to understand this accident I would suggest it is necessary to leave no stone unturned no matter how painful it is. Some have already shown this aversion to commenting on the pilots and I have to regretfully submit that this is not the right approach.

I can't speak for others. I have, for myself, figured that the pilots did some things which appear to be disastrously wrong. Now, they either both had a really bad hangover or other form of really bad day or something led them to commit errors all the while thinking they were the correct thing to do.

The former case is unprovable. We can look at other issues to resolve the situation. Can we answer the "why" questions for "entering the storm", "pulling up on the stick in response to disconnects", "continuing the same errors after the second stall warning", and others?

It looks to me like a training error led to the pull ups, especially after the plane spuriously (with perhaps no accurate remedy possible) dropped the stall warnings when the measurable air speeds dropped to or below 60 knots. With that revised AirBus stall training syllabus I'm inclined to look to the training issue as the most serious one other than the pitot probes, of course.

But, that's just my hypothesis. There could be a real wiring problem, as unlikely as I see it, involved to compound the problems. There could be other problems that could have lead to the stall and led to it not being diagnosed in time. So that's what we're all discussing.

bubbers44

25th Jun 2011, 00:58

No pilot I know would pull full up at altitude because of loss of airspeed. We fly pitch and power for altitude and weight. Never would we pull up in a steep climb at that altitude. We have a checklist for that. Too bad the captain went back for rest when it happened. He could have handled it properly in my opinion. I only did one of those long flights to Sao Paulo and back and I didn't like leaving the cockpit to two FO's even though I trusted them. I never did it again. All of our junior FO's had at least 3 times the experience of the PF in Air France. Probably 100 times more hands on no autopilot flying.

Machinbird

25th Jun 2011, 03:22

I hope this Wall Street Journal article is not old news. Seems like AF447 may have been one of the motivating reasons.
Major Changes Building in Commercial-Pilot Training - WSJ.com (http://online.wsj.com/article/SB10001424052702303339904576404463587554554.html?mod=dist_sm artbrief) (a truncated teaser)
They are talking about actual flying training! Not that simulator stuff. The kind of training where improper performance will create an immediate and visible impression on the psyche.

PickyPerkins

25th Jun 2011, 04:28

A major part of this thread has been and still is (very appropriately and usefully) along the lines of looking at the bark of one tree using a variety of microscopes. I would like to step back for a moment and try to look at the wood. Bear with me for a moment.

A good deal of the credit for eventually finding AF447 must go to the Russians who pointed out that in nine fatal LOC cases they had looked at of a/c getting into trouble at high altitudes, eight had crashed within 10 miles of the start of the event. The images below from the Metron report (http://www.bea.aero/fr/enquetes/vol.af.447/metron.search.analysis.pdf) list the cases and show the distribution of distances.
http://pp.home.infionline.net/fig34.jpg
http://pp.home.infionline.net/table3.jpg

The a/c involved were an A-310, a Tu-154B, two Tu-154Ms, two B737s, an IL-18V, an ATR 72, a MD-82, and if we add AF447, an A-330-200.
One case involved icing, and the Silk Air case may have involved something unusual.

In six cases the LOC started at over 30,000 ft above the crash site, and in eight cases at over 20,000 ft above the crash site, i.e. with plenty of altitude to execute a recovery.

So here we have nine out of ten fatal LOC cases involving a/c manufacturers from different countries, flown by crews from different airlines, regulated by different government authorities, with crews trained under different systems, and using different technologies, some FBW, some not, but all but one of which crashed within ten miles of the start of the incident.

To me as a distant observer there is more than a hint of human factors, or human/machine interface factors, at work here. These data do not prove anything, but do hint (to me) that these (very, very, rare) accidents do happen whether the technology is FBW or not, i.e. human factors or human/machine factors were likely to be important (or dominant) causal factors in the outcome independent of technology, training, nationality, government regulation, or ………

And now back to the microscopes.

jcjeant

25th Jun 2011, 04:29

Hi,

Before new airline pilots receive their licenses or get behind the controls to fly passengers, according to the recommendations, they should receive instruction in small, aerobatic aircraft about how ...

I suggest this woman as chief instructor:
YouTube - ‪Svetlana Kapanina Aerobatic Pilot.‬&rlm;

hetfield

25th Jun 2011, 06:25

The aircraft, still trimmed at 2.2deg nose-up pitched up to reach 29deg and the speed had decreased to 145 knots. The captain meanwhile reduced thrust on the no. 1 engine to idle and cut off the hydraulic system in accordance with the flight test order. Immediately after it activated, the autopilot switched to altitude acquisition mode (altitude had been set at 2000 feet on the previous flight phase). This caused the pitch attitude to increase to 32deg in an attempt to reach 2000 feet. The speed decreased further to 100 knots (minimum control speed=118 kts).ASN Aircraft accident Airbus A330-321 F-WWKH Toulouse-Blagnac Airport (TLS) (http://aviation-safety.net/database/record.php?id=19940630-0)

Even if this has little or nothing to do with AF447, it shows that also the top guys (AB test pilots) didn't have a clear picture about the situation (alt acquisition mode/versus protections).

Old Carthusian

25th Jun 2011, 09:02

BOAC - Apologies for the slow reply. Details of other aircraft deviating round the weather front can be found in already released BEA reports and in various posts in the threads on this subject. I am sure that if you look you will come across them.

Smilin Ed - What you are referencing are the inputs into the interface. The human factors, the reasons or motivations for the inputs are not covered by aircraft designers. However, as these govern the inputs into the interface they are very important.

sensor_validation

25th Jun 2011, 09:37

@PickyPerkins (http://www.pprune.org/members/54143-pickyperkins)

Worth noting that AF447 is an outlier on that table in terms of full incident duration ~4mins 23 seconds which equates to 8,000 ft/min average vertical speed.

BOAC

25th Jun 2011, 11:41

BOAC - Apologies for the slow reply. Details of other aircraft deviating round the weather front can be found in already released BEA reports and in various posts in the threads on this subject. I am sure that if you look you will come across them.- is it perhaps that you have missed the 12 deg deviation of AF447 in the report? As far as I know there is no evidence that they 'flew into a CB'.

bubbers44

25th Jun 2011, 13:33

I agree, nowhere is there any evidence they flew into a CB. All we know is evidence that the pitot tubes froze up causing unreliable airspeed. Previous similar freeze ups have occured with the A330 with several airlines without flying into CB's.

BOAC

25th Jun 2011, 13:54

To save me hours of searching - can someone quicklink to the report of the 'zoom climb' ?LH 340? over the Atlantic please? I think the analysis of why that beast lept for the heavens would be useful.

PJ2

25th Jun 2011, 14:07

BOAC...Air Accidents Investigation: Airbus A330 C-GGWD and Airbus A340 TC-JDN (http://www.aaib.gov.uk/publications/bulletins/june_2001/airbus_a330_c_ggwd_and_airbus_a340_tc_jdn.cfm)

Read it carefully. I doubt if there is a relationship between the two behaviours of the aircraft but take a look for yourself and see what you think. The report focuses on a TCAS and AIRPROX event and I don't think does a credible job of explaining the pitch up.

The summary of the behaviour of the A340 in the "zoom-climb" claims that in the overspeed and turbulence, that the AFS reverted to the Alpha Protection Law. From my research, that was changed before this event occurred to inhibit the AoA Protection Law above M0.53. The other frustrating aspect is, the recorder data that is included with the report does not have AoA...the very parameter claimed to have caused the triggering of the AoA Prot Law and the cause of the zoom-climb.

Anyway...these things are complicated. Maybe I'm mis-reading it all.

BOAC

25th Jun 2011, 14:49

Interesting, PJ (many thanks for the link). I disagree (from a position of ignorance on the AB system!) with your 'doubt' of a 'relationship' - ignoring the trigger for a/p dropout, we appear to have a similar manouevre induced by the FCS and not the crew, resulting a (co-incidental) 'arrival' at FL380 after a 6000fpm zoom during which the IAS decayed below Vls. OK, I'm easily swayed by these things, but???????

I do not understand why the alpha reached 'alpha-prot' all on its own? It then goes on to say that if the sidestick is left untouched in pitch, alpha remains at alpha-prot, and that application of full back stick would take it to alpha-max and that a determined nose-down input is required to stop this. So, this a/c,all on its own, raised the nose to alpha-prot and climbed - with no crew action to cause it. The report goes on

"For 18 seconds after the autopilot disengaged the aircraft remained within 200 feet altitude of FL 360 but once AoA law was invoked at 14:21:50 hrs, the aircraft’s attitude began to pitch nose-up. The pitchup trend continued for 17 seconds reaching a peak of 15° nose-up shortly before the first nose-down sidestick command was applied. Throughout this phase the aircraft climbed rapidly (reaching a peak rate of about 6,000 ft/min) due to the increase in lift created by the flight control system’s capture of alpha prot. The aircraft reached its apogee at FL 384 at 14:22:28 hrs where the airspeed had decayed to 205 KIAS and 0.67 Mach even though full thrust had been applied."

I then am told that there is no indication in this system to the crew that this 'law' has been invoked? I am struggling to see, through my ignorant eyes, why this is not relevant to 447? I know, different type and 'history', but is there not an Occams Razor lurking here?

sensor_validation

25th Jun 2011, 15:17

... I am struggling to see, through my ignorant eyes, why this is not relevant to 447? I know, different type and 'history', but is there not an Occams Razor lurking here?

Note this report was discussed on these forums as soon as the crash site located - the 'zoom-climb' to loose speed and stall from height being the simplest explanation Mr Occam could suggest. But clear air turbulence, daytime, 4 engines ... no Unreliable Airspeeds or Alternate 2 law - so very different protections active. Trying to match pilot inputs and the resulting elevator, Stab. and engine speeds to the resulting flightpath from the low res FDR plots in this report is still quite a challenge - what sense and scale is on the 'SS1 PT'? Compare/contrast the higher quality better labelled plots in the QF72 first interim report Investigation: AO-2008-070 - In-flight upset, VH-QPA, Airbus A330-303, 154 km west of Learmonth, Western Australia, 7 October 2008 (http://www.atsb.gov.au/publications/investigation_reports/2008/aair/ao-2008-070.aspx) , which is relevant with respect to the dynamic response of an A330 at FL370 but control system glitches not believed to be directly related to AF447?

DJ77

25th Jun 2011, 16:00

There are at least 5 computer systems monitoring airspeed: 2 FMGECs and 3 FCPCs (a weird architecture for me but what do I know?).

The previous 2 or 3 days discussions suggested the following possible sequence of events (of course open to discussion):

Pitot 1 tip freezes. ADR1 output indicates rapidly decreasing airspeed/Mach.

FCPCs and the AFS part of FMGECs detect the discrepancy and launch monitoring functions:

AFSs quickly reject ADR1 (tolerance threshold = 20 kt for 0.45 s) and uses remaining ADRs

FCPCs would reject ADR1 if its error relative to median CAS was still above 16 kt after 10 seconds. In the meantime, having detected the median CAS value decreased more than 30 kt in 1 second they launch the “median CAS monitoring function”:

• Master FCPC (FCPC1) broadcasts it intends to change the flight control law from normal to ALT2.

• Master FMGEC/AFS receives the ALT2 request from FCPC1, disengages AP and A/THR then acknowledges the message.

• Receiving acknowledgment that AP and A/THR are off, FCPC 1 activates ALT2 law and notifies other FCPCs.

• All FCPCs start computing flight control commands according to ALT2 law, using limited pitch rate feedback and gains for an initial period of 10 seconds. “F/CTL ALT LAW” is displayed on the ECAM. At this stage, ALT2 law is temporary. If at the end of the monitoring period the median CAS value is found less than the value registered at the start of the period minus 50 kt, ALT law will be latched.

• At some point before the end of the monitoring process FCPC2 loses connectivity with ADR1. For FCPC2 the median CAS becomes the average of ADR 2 and 3 CAS values, practically unchanged compared to the initial value.

• The 10 seconds period ends. Because their final median CAS value is beyond the 50 kt tolerance, FCPC1 and FCPC3 signal normal law unavailable. They also reject ADR1. FCPC2 finds its median value in tolerance and able to compute normal law.

• Before latching ALT law, the FCPC priority logic must be invoked otherwise the master FCPC would force other FCPCs to change law and would never relinquish mastership.

• Priority logic grants mastership to FCPC2 because it is claiming the highest level of flight control law.

• End of “median CAS monitoring function”.

Now comes perhaps the most arguable part of this scenario. Pitot2 and Pitot3 start icing simultaneously but not as fast as Pitot1. CAS does not decay fast enough to trigger another “CAS monitoring function”. However, it triggers the AoA protection law instead, due to the “phase advanced AoA calculation” similar to the TC-JDN A340 Airprox incident. That this function is now inhibited above M 0.53 is irrelevant in this case since the measured Mach number was soon showing less than that.

The A/C start a zoom climb, trying to maintain about Alpha Prot AoA, apparently confusing the PF beyond any understanding.

Perhaps all of the above is just garbage but:
1/ The claim found in the Airbus FCTM that simultaneous obstruction of two pitots is “highly improbable” is a weak case when there is a common cause. These pieces of hardware are built under tight tolerances, live the same life in the same environment and pitots 2 and 3 occupy exactly symmetric positions on the fuselage (contrary to pitot1). Additionally, ice ingestion is not a slow process at cruising speed when the Ice Water Contents in atmosphere reaches 9 g per cubic meter.

2/ I believe the “phase advanced AoA calculation” uses a time derivative of CAS in order to anticipate the interception of Alpha Prot speed and prevent any slower speed. AoA may not be precise or stable enough and its variation is not linear with speed.

hetfield

25th Jun 2011, 16:12

The previous 2 or 3 days discussions suggested.....that none of the three pilots had any idea what's going on.

This, in a modern, highly sophisticated airplane.......

Optimum interface? I'm afraid no!

RR_NDB

25th Jun 2011, 16:18

PJ2,

Anyway...these things are complicated. Maybe I'm mis-reading it all.
(http://www.pprune.org/tech-log/454653-af-447-thread-no-4-a-19.html#post6535597)

When trying to understand this "things" we must remember they are "complex feedback Systems" eventually with crew actions affecting final results (crew with his own feedbacks not always logical and understandable by us).

Many years ago i worked (Testability of complex electronic Systems) in diagnosing "complex digital circuitry" full of feedback loops. The only way we found adequate to diagnose a faulty circuit down to the component level was "to open the feedback loops" at least, momentarily.

The simple reason is: When there is a certain failure, the "feedback loops" make the "failure" appear also in the inputs of the System. And this was for a Hardware in a lab, in a bench with all necessary stuff (Digital storage scopes, logic analyzers, recorders, etc.)

When investigating incidents (e.g. AIRPROX) or accidents (AF447) i suspect the current FDR´s may be not are enough to provide all the required details (e.g. the WRG fault) to allow a definitive conclusion.

RR_NDB

25th Jun 2011, 16:27

These pieces of hardware are built under tight tolerances, live the same life in the same environment and pitots 2 and 3 occupy exactly symmetric positions on the fuselage (http://www.pprune.org/tech-log/454653-af-447-thread-no-4-a-19.html#post6535787)

Considering Airbus SAS didn´t have supply of "hotter" Pitot´s a much safer approach would be to put several Pitot´s in selected locations of the a/c and feeding a reliable "voting scheme" subsystem.

The "redundancy" used in this design may be is "amplifying problems".

SaturnV

25th Jun 2011, 17:02

In Annexe 1 of the French version of the first interim BEA report, Meteo France's analysis of Meteosat 9 imagery indicated AF447 flew into a cloud with tops of 500 to 520, while in an area where mature convective storms were embedded within layers of cumulus, altocumulus, and stratocumulus.

Dans la nuit du 31 mai au 1er juin 2009, au-dessus de l’océan, la ZCIT est le siège d’une activité orageuse marquée mais discontinue : on distingue plusieurs amas convectifs (multicellulaires) séparés par des zones de Cumulus, Stratocumulus et Altocumulus.
....
On constate qu’à 2 h 07 les températures les plus froides sont de l’ordre de -75 °C à -80 °C, alors que la tropopause se situe entre les FL500 et FL520, avec une température voisine de - 80°C : certains des cumulonimbus de l’amas ont atteint l’altitude de la tropopause et leur stade de maturité, mais l’imagerie ne révèle aucun développement vertical exceptionnel du point de vue climatologique, qui serait caractérisé par un « overshoot ».

Vasquez concluded the cloud tops were FL560 at about 2 h 10.

What sort of cloud does one find at FL500 in the ITCZ?

foster23

25th Jun 2011, 18:22

many thanks again for one of many useful links :ok:

OK465

25th Jun 2011, 20:36

Due to limited availability of class slots, I had to do my A330 ground school with a class start time of 2 AM. (This time is more suited for leaving a bar than being alert & receptive to technical instruction.)

However, reading some of the knowledgeable detailed technical discussions here, I’m having flashbacks, not to the information presented, but to the difficulty in trying to understand what it actually meant at oh-dark-thirty in the wee hours.

Now occasionally in my head, in imaginary digitized voice, I'm sure I will hear all these computers "broadcasting, receiving, requesting, acknowledging, discussing, granting and permitting".

(Previously I never gave it a second thought with the SS firmly, i.e. lightly, in hand.)

infrequentflyer789

25th Jun 2011, 22:55

[...]we appear to have a similar manouevre induced by the FCS and not the crew, resulting a (co-incidental) 'arrival' at FL380 after a 6000fpm zoom during which the IAS decayed below Vls. OK, I'm easily swayed by these things, but???????
[...]
I do not understand why the alpha reached 'alpha-prot' all on its own?
[...]
I am struggling to see, through my ignorant eyes, why this is not relevant to 447? I know, different type and 'history', but is there not an Occams Razor lurking here?

There is no indication so far the the 447 zoom climb was induced by the FCS, while there is knowledge of PF nose-up input prior to the climb. If invoking Occam, why would you add an FCS law change as cause of climb when there is already a known nose-up input from PF ?

In the other incident, my understanding would be alpha reached alpha prot due to severe turbulence causing fluctuations in speed etc., followed by (I think) crew reducing speed after momentary overspeed warning (hence next downward fluctuation in speed maybe takes alpha momentarily over alpha prot, and engages the law).

The other difference is that the other incident is in normal law, while 447 was in alternate, which doesn't have the alpha prot law.

[ Note: I know there are some posts on a theory that maybe 447 was still in normal law through one of the PRIMs, and therefore the climb oculd have been a protection doing the wrong thing - I think there is a fundamental flaw with that theory, which is that in normal law the FCS would never have allowed the a/c t exceed alpha max, which it clearly did. ]

GarageYears

26th Jun 2011, 00:10

Note: I know there are some posts on a theory that maybe 447 was still in normal law through one of the PRIMs, and therefore the climb oculd have been a protection doing the wrong thing - I think there is a fundamental flaw with that theory, which is that in normal law the FCS would never have allowed the a/c t exceed alpha max, which it clearly did

IF789: Right on w.r.t. this :ok: There are a number of problems with this 'hung on in Normal' theory - most significant of which is the lack of any comment within the BEA note of May 27th. I hardy can conceive of them (a) not reporting a disagreement of control law with that reported by the crew:

the PNF said "so, we’ve lost the speeds" then "alternate law […]".

If this had been in error or something mislead the crew, then I firmly believe that would have been stated in the note. Otherwise the BEA have simply hung the crew out to dry to some extent. I realized that many folk have been attempting to "fit the foot to the shoe" and have been postulating theories that might work with the data we have, but Occam doesn't sit comfortably with any in my opinion.

The BEA data is maddeningly thin, but the shortest distant between two lines is most often the route traveled.

A33Zab

26th Jun 2011, 01:23

Updated here: LINK (http://www.pprune.org/tech-log/454653-af-447-thread-no-4-a-35.html#post6549447)

Old Carthusian

26th Jun 2011, 04:16

I am probably guilty of inaccurate terminology here, apologies all - there is ample evidence that they flew into turbulent weather though.

CogSim

26th Jun 2011, 05:35

This was first brought to attention by takata in this post (http://www.pprune.org/5031377-post2542.html).

Airliners.net post with reordered ACARS message list. (http://www.airliners.net/aviation-forums/general_aviation/read.main/4460194/1/#211) Since there is some discussion about the delay in NAV ADR DISAGREE, I thought I'd post it to help refocus.

Originally posted on Airliners.net (http://www.airliners.net/aviation-forums/general_aviation/read.main/4460194/1/#211)

This is the list reordered...

0209 START
0210 34-11-15-0 FLR EFCS2
EFCS1, AFS - PROBE PITOT 1+2/2+3/1+3 (9DA)
9DA=HEATING ELEMENT PITOT 1 (6DA1/PHC1)
Heating Element Pitot 1 suspected failed.

0210 27-93-34-0 FLR EFCS1
EFCS2-FCPC2(2CE2) WRG:ADIRU1 BUS ADR1-2 TO FCPC2
No Data from ADIRU 1, ADR 1 & 2 no sending signal to FCPC2
No ADR Data from ADIRU 1 to PRIM2.

0210 27-90-45-5 WRN MXSTAT
EFCS1
ERROR NOTICED - Air Data Fluctuation/Inconsistency

0210 27-90-45-0 WRN MXSTAT
EFCS2
ERROR NOTICED - Air Data Fluctuation/Inconsistency

0210 22-10-00-0 WRN AUTO FLT
AP OFF
Autopilot Shut off for safety, result loss of 2 Valid Air Data Channels.
This prevents faulty Air Data from affecting autopilot into making the wrong actions.
Commence AP/FD FAULT ISOLATION PROCEDURE
System Filter & Check:
- DISAGREE AOA Sensor Data in FCPCs
- DISAGREE PITOT PROBE Data in FCPCs
- FAIL ADIRU 1 and 2
- FAIL ADIRU 1 and 3
- FAIL ADIRU 2 and 3
- FAIL ADIRUs

0210 22-62-01-0 WRN AUTO FLT
REAC W/S DET FAULT
Loss of 2 ADRs, autopilot cannot provide Windshear Protection.

0210 27-91-00-5 WRN F/CTL
ALTN LAW
2 ADR REJECTED, NAV DISAGREE NOT YET CONCLUDED - FAULT ISOLATION IN PROGRESS

0210 22-83-00-2 WRN FLAG
LEFT PFD LIMIT
Rejected ADR still feeding data to PFD
If there is valid ADR, it's not being selected for LEFT seat.

0210 22-83-01-2 WRN FLAG
RIGHT PFD SPD LIMIT
Rejected ADR still feeding data to PFD
If there is valid ADR, it's not being selected for RIGHT seat.

0210 22-30-02-5 WRN AUTO FLT
A/THR OFF
Autothrust Shut off for safety, result loss of 2 Valid Air Data Channels.
This prevents faulty Air Data from affecting Autothrust into making the wrong actions.

0210 34-43-00-5 WRN NAV
TCAS FAULT
Loss of ADR1 to Transponder 1 (if selected) or Loss of ADR2 to Transponder2 (if selected)
Loss of Mode C.
This is downstream of loss of ADR.

0210 22-83-00-1 WRN FLAG
LEFT PFD NO F/D
Automatic Flight System (AFS/FMGC) loss of 2 ADR sources.
Safety mechanism, prevents erroneous F/D for pilot to follow

0210 22-83-01-1 WRN FLAG
RIGHT PFD NO F/D
Automatic Flight System (AFS/FMGC) loss of 2 ADR sources.
Safety mechanism, prevents erroneous F/D for pilot to follow

0210 27-23-02-0 WRN F/CTL
RUD TRV LIM FAULT
Loss valid of ADR Data (require 2 ADRs) for FMGC/AFS
FMGC Flight Envelope Module locks in Rudder Travel for safety.

0211 34-12-34-0 FLR IR2
EFCS1X,IR1,IR3, ADIRU2 (1FP2)
ADIRU2(1FP2) - ADR2 self monitoring & PHC rejects own data
Loss of discrete data from ADR2 = PITOT 2, STATIC 2L, STATIC 2R, TAT 2, AOA 2.
NAV DISAGREE CONCLUSION DELAYED - ADDITIONAL FAILURES - RECOMMENCE FAULT ISOL

0211 34-12-00-0 FLR ISIS
ISIS (22FN-10FC) SPEED OR MACH FUNCTION
SUSPECT LOSS OF ADIRU1 AND/OR ADIRU3 FOR ISIS MACH
Suspect Loss of ADIRU3
NAV DISAGREE CONCLUSION DELAYED - ADDITIONAL FAILURES - RECOMMENCE FAULT ISOL

0211 34-12-00-1 WRN FLAG
LEFT PFD NO FPV

0211 34-12-01-1 WRN FLAG
RIGHT PFD NO FPV

0212 34-10-40-0 WRN NAV
ADR DISAGREE
NAV DISAGREE DISCOVERED - FAULT ISOLATION COMPLETED
Due to no further ADR faults occuring.

0213 27-90-02-5 WRN F/CTL
PRIM1 FAULT

0213 27-90-04-0 WRN F/CTL
SEC1 FAULT

0213 22-83-34-9 FLR AFS
FMGEC1(1CA1)

0214 34-10-36-0 WRN MXSTAT
ADR2
RESULT OF 32-12-34-0

0214 21-31-00-2 WRN ADVSRY
CABIN VERTICAL SPEED
LOSS OF ADR DATA

------------
Be warned, the above is still incomplete. More cross checking is needed. The failures here aren't simply upstream faults leading to downstream failures, but there are some "same level" data feed, and "upstream" data feeds... and I do not guarantee the above is correct.

jcjeant

26th Jun 2011, 05:48

Hi,

I want also brought to attention .. this ...

In the BEA note (27 May 2011)

The chronology of events is not rigorous: A 2h10min51sec it is said that a couple of seconds later, the speeds become consistent. So, 2h11min06sec speeds are consistent. It is said, small on the next line (foot note), that the inconsistency between the speeds lasted less than one minute. So let's say 59 seconds. This therefore means that the inconsistency between the speeds appeared earlier than 2h10min07sec. So before 2h10min07sec speeds were consistent. So why 2h10min05sec to the autopilot and auto-thrust and disengage the OP says "I have control"? The autopilot had disengaged while he speeds were consistent?

This BEA note can't be a serious one to elaborate any scenarios from it
Only the FDR can be a valable source for a scenario .. instead of some truncated dialogues between pilots and fantasy timing ..

NigelOnDraft

26th Jun 2011, 06:47

So before 2h10min07sec speeds were consistent. So why 2h10min05sec to the autopilot and auto-thrust and disengage the OP says "I have control"? The autopilot had disengaged while he speeds were consistent?

This BEA note can't be a serious one to elaborate any scenarios from it
Disagree, suggest you read the report closely again.

The aircraft, and it's systems (AP etc.) work from 3 airspeed sources. The FDR only records 2 of those. So prior the 2:10:07 any observations / system anomalies would be down to the 3rd (unrecorded) speed source.

PA 18 151

26th Jun 2011, 07:16

How an aircraft aerodynamically moves though the airmass is essentially an engineering problem which is very well understood. Computers solve these engineering problems very well, better than humans, and it is clear that automation of the nature used by Airbus has saved many lives. Computers, as well as pilots, require sensors to fly and if the aircraft sensors are working it makes sense for the aircraft to fly the aircraft instead of the pilots. When all aircraft systems are working, it also makes sense for the aircraft to override all 'flying' actions that the pilots make which the equations for flight deem to be dangerous. i.e. Normal Law.

When the aircraft sensors fail, as they appear to have done here, it is essential that the aircraft hands over control of the flying of the plane to the pilots. This appears to have been done properly. As the aircraft had degraded sensor information it removed any protections that rely on this sensor information. This is also a correct action to take, aircraft in ALT 2, no AoA protections in place.

It then appears that the pilots mismanaged the further flying of the aircraft. Unusual, but the evidence we have so far points strongly in this direction. The reported sidestick position invalidates all the other improbable theories proposed so far.

On the descent, it appears that the input from the aircraft sensors became valid again. This is entirely to be expected if the initial problem was icing. The aircraft would presumably have known that all it's sensors were now working. However it was latched into ALT 2, AoA protections are not in place, and so it could do nothing about the stall.

If once the aircraft had validated the sensor data, it could have legitimately reverted to normal law, it could then have applied AoA protections and all on board saved.

So why is this not programmed to happen?

BOAC

26th Jun 2011, 08:03

OC - if it helps with your 'terminology' the ITCZ IS an area of 'turbulent weather' which pretty much circles the globe, commonly with CB activity but generally always with 'bumps'. It may help you to Google ITCZ and see? As such, dozens if not hundreds of aircraft penetrate this 'zone' every day and nearly always experience 'turbulent weather'. Sometimes light or moderate, occasionally severe. It may be that 447 did fly into a CB - we do not yet know, but I do not see any evidence of it so far. Very few of them experience the loss of pitot systems which appear to have triggered this event so until we can establish that an 'active' CB was penetrated by them it is not really relevant.

For Saturn, I have never been to FL500 in the ITCZ so I cannot answer your question but I would expect (and not be particularly surprised by) the activity on an active ITCZ to easily produce water vapour up to FL560. It may be useful to try and look at other Sat weather images of the zone on other days. I believe it is generally accepted that the tropopause can be at FL560+ in the tropics so it should not be a surprise.

jcjeant

26th Jun 2011, 08:28

Hi,

Quote:
So before 2h10min07sec speeds were consistent. So why 2h10min05sec to the autopilot and auto-thrust and disengage the OP says "I have control"? The autopilot had disengaged while he speeds were consistent?

This BEA note can't be a serious one to elaborate any scenarios from it
Disagree, suggest you read the report closely again.

The aircraft, and it's systems (AP etc.) work from 3 airspeed sources. The FDR only records 2 of those. So prior the 2:10:07 any observations / system anomalies would be down to the 3rd (unrecorded) speed source. It's no matter of airspeed sources or what is recorded or not .. it's simply matter of timing described by BEA.
The numbers are there black on white .. no need of "what if" or or complicated scenarios
Make the maths ... it's simple arithmetic ... and something is wrong ..

L337

26th Jun 2011, 09:11

0210 22-30-02-5 WRN AUTO FLT
A/THR OFF
Autothrust Shut off for safety, result loss of 2 Valid Air Data Channels.
This prevents faulty Air Data from affecting Autothrust into making the wrong actions.

Because of the Airbus A/T design, the thrust would have gone to full power. A fundamental design flaw, imho, and one that will never be admitted to by Airbus. I hated the T/L not moving design of the Airbus. It works fine when all is going smoothly. But in the failure case, and non standard configuration case it causes more trouble than it is worth. It is so difficult to work out what it is or is not doing under high workload situations. Very often all you have to go on is the "cyan arc." a tiny blue trend line. Miss that and chaos can ensue.

With all the warnings and the chaos on the flight deck, it is doubtful if the FO hd the spare capacity to even notice the AT going to full power. That would have instantly de-stabilised the aircraft. Making a bad situation far worse.

Graybeard

26th Jun 2011, 09:25

Thanks, Cogsim:
0210 34-43-00-5 WRN NAV
TCAS FAULT
Loss of ADR1 to Transponder 1 (if selected) or Loss of ADR2 to Transponder2 (if selected)
Loss of Mode C.
This is downstream of loss of ADR.

Loss of Mode C results in TCAS Off, not TCAS Fail.

I can only conclude the BEA reporting is inaccurate.

AlphaZuluRomeo

26th Jun 2011, 09:46

Hi
If once the aircraft had validated the sensor data, it could have legitimately reverted to normal law, it could then have applied AoA protections and all on board saved.

So why is this not programmed to happen?

I think you misinterpreted what "valid speed" means. When the BEA writes "The speeds became valid again", it means the speeds were no longer below 60kt (for AoA stall warning) or below 30kt (for speed itself).
A valid speed (system speaking) is not by definition a correct speed (i.e. real).
The system cannot know if the sensed speed, after the pitot failure/icing, is back to correct values. In fact in some cases, speeds may be valid (above 60kt), consistent (3 equal values, or at last 2 equal values, the third being voted out) but not correct.
It's only the discrepency in speeds (from 3 sensors) that make the system decide "We got a problem". Unless you can confirm the correct speed by other means, it's safer IMO that the system let the crew decide. That needs the crew to be trained for such situations, and the SOP to be OK.

For the system to be able to decide, by itself, that the speeds are back to correct values, it would need to compare the ADR speeds with other sources. Perhaps the INU/GPS may be a source, here, in combination with the altitude (pression), the temperature and the wind speed/direction. If you have all of them, I suppose it's just maths (which a computer can do, and quickly).
The wind speed will be a problem, to me. How do you know it ?

HazelNuts39

26th Jun 2011, 09:55

CogSim;

It should be noted that both referenced posts are dated 30 june 2009, i.e. before BEA published its first Interim Report. I believe BEA's reports are based on more authoritative information than these posters (with all due respect) had at their disposal at that time.

PA 18 151

26th Jun 2011, 09:59

Hi

I think you misinterpreted what "valid speed" means. When the BEA writes "The speeds became valid again", it means the speeds were no longer below 60kt (for AoA stall warning) or below 30kt (for speed itself).Thanks for reply. I should have quoted the report, I was referring to the reported fact that the speeds became consistent during the descent (as to be expected once the icing conditions had been left behind if the initial problem was pitot icing, which appears likely)

"Around fifteen seconds later, the speed displayed on the ISIS increased sharply towards 185 kt; it was then consistent with the other recorded speed."

It was inconsistent speeds that caused the aircraft to depart normal law and hand control to the pilots. If the speeds later became consistent there should be, IMO, logic that at least contemplates a return to normal law. 185kts is well above the lower limit where the aircraft ignores the speeds as being out of range.

Had the aircraft returned to normal law, applied AoA protection, it almost certainly would have recovered in the 30,000ft available.

Apart from that I cannot, with the information available, fault the aircraft at all.

Why is ALT 2 latched?

HazelNuts39

26th Jun 2011, 10:13

It was inconsistent speeds that caused the aircraft to depart normal law and hand control to the pilots.IIRC it was not an inconsistency between the three ADR speeds, but a sudden drop in one of them, the "polled" value that the PRIMs were using and considered the most accurate of the three. That anomaly was confirmed at the end of the monitoring period.

AlphaZuluRomeo

26th Jun 2011, 10:18

PA 18 151 : My mistake on the "valid" speed.;)
I agree with you, in AF447's case, a return to normal law may have helped, or even have saved the plane.
But I stand still : how can the system decide the speeds are corrects ? It would be a guess. And I think that, in other scenarii, such a guess would be wrong and lead to incorrect actions by the system.
That's why I suggested a comparison between the ADR speeds and other sources. The ADR redudancy is not enough, as 3 (identical) probes can be faulted by an identical phenomenon at ~ the same time : icing, ash cloud...

I suppose that's why ALT2 is latched. The point is, as you said : If the aircraft system doesn't know, let's give control to the crew.
The aircraft system cannot know, cannot be 100% sure (using only the ADRs) that the speeds are back to correct values "just" because the speeds have rised, and/or are consistent again. The crew is better IMO to assume that, based on other sources (pitch, power, feel, visual clues...)

For the record : Agreed with the rest of your posts :ok:

PA 18 151

26th Jun 2011, 10:38

IIRC it was not an inconsistency between the three ADR speeds, but a sudden drop in one of them, the "polled" value that the PRIMs were using and considered the most accurate of the three. That anomaly was confirmed at the end of the monitoring period.Hi Hazelnuts,

Yes, it used polled value, explained by BEA (Interim Report 2) my italics:Like the FMGECs, the PRIMs consolidate the parameters that they use by means of monitoring mechanisms. Concerning the airspeed, it is the voted value that is used. In normal operation, this is the median value. When one of the three speeds deviates too much from the other two, it is automatically rejected by the PRIMs and the polled value then becomes the average of the two remaining values. But if the difference between these two remaining values becomes too great the PRIMs reject them and the control law switches to alternate 2.
So my reading is:
1) No single value is more imporant than the other in normal operations
2) When one becomes inconsistent with the other two it is rejected
3) When the other two become inconsistent with each other the law goes to ALT 2

It is inconsistent speeds that causes the plane to reject them

Consistent AND valid = Correct

The speeds later became Consistent AND Valid therefore they should have been considered correct. i.e. Normal Law conditions = AoA protections = aircraft breaks the stall.

AlphaZuluRomeo:

Consistent AND valid = Correct

Well, yes it's a good assumption to make that the crew will act correctly once the plane hands over control. Is this what the designers assumed too? Perhaps another flaw in system design?

Normal Law would almost certainly have saved the day. I submit that from the evidence we have, for over two minutes and 30000 ft AFTER the initial problem, that normal law conditions existed. Unfortunately in the interim, ALT 2 had been latched, and the aircraft was unable to break the stall the pilots had caused and failed to recover from.

infrequentflyer789

26th Jun 2011, 11:21

Pls. comment, correct or update as required.

Very nice timeline, hope we get that level of presentation in the BEA reports (though just fdr traces would be ok).

Haven't gong through it all, but it looks right per the information we have to date. One comment - initially there was a PF left + nose-up input which seems to be missing.

HazelNuts39

26th Jun 2011, 12:25

So my reading is:
1) No single value is more imporant than the other in normal operations ...That is correct as far as the voting system goes. Once voted, the "polled" value is used by the PRIMs in performing their function. The voted value triggered the monitoring process described in BEA's discussion of the PROBE PITOT fault message, and its downstream conditions such as AP off, A/THR off, Alternate law (prot lost), etc. The voting system resulted in the ADR DISAGREE message that occurred much later.

AlphaZuluRomeo

26th Jun 2011, 12:44

Hi PA 18 151
AlphaZuluRomeo:

Consistent AND valid = Correct
My understanding of the ALT2 being latched is that as soon as you've got an ADR disagree, the system cannot be sure that the equation you write above is true.

Why ? Well, imagine an aircraft in an ash cloud :
- at first, pitots (front end) are clogged => speeds decreases, but not exactly at the same time => ALT law
- then, out of the ash cloud, the ashes move in the pitots. The front end became unclogged, but then the remaining ashes clogg the drain hole of, say, two of the three pitots => those two pitots give consistent and valid speed. But that speed is uncorrect (too high, because of the drain hole clogged).
If the system goes with this (incorrect value) to revert back to normal law, it's kind of dangerous, cause it may trigger the overspeed protection (climb order) when not needed/relevant.

Therefore I think the logic is to latch the ALT law, until the aircraft/system (probes, computers...) can be fully checked, on the ground.
The rule would be some kind of : ("you" being the computers)
"As soon as you've got a problem with the probes/ADR/speed calculation, you cannot be sure the speed you sense/vote/choose/know is indeed correct. Then you have to let the human crew in unrestricted control, via the ALT law being latched".

PA 18 151

26th Jun 2011, 12:55

Hi AlphaZuluRomeo,

Yes I think that is a good explanation for why ALT 2 should be latched. I suspect Airbus should take a look at this again and I am sure they are doing so. Icing conditions are more frequently encountered than ash cloud conditions and the ice didn't hang around for long at all.

There was an inconsistency between the speeds displayed on the left side and the integrated standby instrument system (ISIS). This lasted for less than one minute.

In this situation. The aircraft knew it was stalled, knew it's pitch angle, and had consistent and valid airspeeds. What more info do you want before you start to lower the nose?

And you are correct, the vast vast majority of airline pilots could correctly manage the pitots icing, unreliable airspeed, any subsequent change of flight law, and the safe conclusion of the flight (and recovering from a high altitude stall without thinking about it). I think those who say they would also be in trouble are just being melodramatic, if not they should disqualify themselves.

BOAC

26th Jun 2011, 14:17

the vast vast majority of airline pilots could correctly manage the pitots icing, unreliable airspeed, any subsequent change of flight law, and the safe conclusion of the flight (and recovering from a high altitude stall without thinking about it). - I feel that 'vast' is being overly optimistic, but whatever - what you are effectively saying then is that these two AF pilots were (surprisingly) NOT so able and that there was no further complication? Case solved, matter closed? Hmm. Maybe. Maybe not.

PA 18 151

26th Jun 2011, 14:42

BOAC,

My comment was to AlphaZuluRomeo wrt ALT 2 being latched and letting the pilots take over from there.

But if you don't think all crew could manage this event then why are you so convinced the aircraft is at fault? You demand evidence for CB penetration but are not so picky when looking for evidence the aircraft caused this accident.

Case is not closed. We don't know all the contributing factors.

HazelNuts39

26th Jun 2011, 14:49

Smilin_Ed

26th Jun 2011, 15:18

AZR: Then you have to let the human crew in unrestricted control, via the ALT law being latched"

Except, in this case, they didn't have unrestricted control. The flight control system kept changing the pitch trim. While this was result of an inexplicable nose-up command on the side stick, the pilots apparently didn't notice it. As I've said several times before, when the system gives up, it needs to turn off autotrim along with the autopilot. :ugh:

BOAC

26th Jun 2011, 15:40

Case is not closed. We don't know all the contributing factors. - then we agree on that! . I "demand evidence for CB penetration" simply because we have none although it is an oft-issued 'fact' on here. I am pretty certain "the aircraft is at fault" since I believe if the pitots had not failed the accident would not have happened, nor, I personally believe, would it with iced pitots with a 'conventional' FCS, but am keeping an open mind on the rest - and am yet unconvinced either way due to the paucity of information from BEA.

For Smilin Ed - I agree, and feel that Dozy's proposition a while back of a reversion to Direct Law in such situations would be a good idea, although an anathema to the FBW world. Assuming also, of course, that the crews are trained to....................etc etc.

Machinbird

26th Jun 2011, 16:57

Except, in this case, they didn't have unrestricted control. The flight control system kept changing the pitch trim. While this was result of an inexplicable nose-up command on the side stick, the pilots apparently didn't notice it. As I've said several times before, when the system gives up, it needs to turn off autotrim along with the autopilot. :ugh:
The accident (as we know it) would not have occurred if autotrim had frozen when it left Normal law.
Maybe Alt 2 law has some issues. Hopefully BEA will get to the actual bottom of the crew's control problems.
Gotta go with what Ed said.:ok:

RR_NDB

26th Jun 2011, 17:18

I am pretty certain "the aircraft is at fault" since I believe if the pitots had not failed the accident would not have happened, nor, I personally believe, would it with iced pitots with a 'conventional' FCS, (http://www.pprune.org/tech-log/454653-af-447-thread-no-4-a-21.html#post6537278)... :ok:

1) Pitot´s presented intermittent failure (a fact)
2) The implemented redundancy proved to be useless in this case (a fact)
3) The implemented redundancy is flawed? (when using these AS sensors)

And if other factors (a/c Systems) are also related to the LOC we would see another, more serious, design flaw(s) and the crew as "probable victims" of a K.I.C.S. System.

C.= Complex

We are realizing how serious was the first Leak (LF).

DozyWannabe

26th Jun 2011, 18:44

Because of the Airbus A/T design, the thrust would have gone to full power. A fundamental design flaw, imho, and one that will never be admitted to by Airbus.

Er, I'm pretty sure this was discussed on the previous thread - some time ago they not only "admitted" that it was a problem, they changed the behaviour so that when A/THR kicks out, the thrust remains at the last setting the A/THR commanded. The thrust setting does not change until the pilots touch the thrust levers.

As it is we seem to be discussing three scenarios here. Note that what follows are largely my opinions, for what they're worth.

Svarin postulates that some hitherto undiscovered software bug caused the FCU components to slip in and out of Normal Law, causing intermittent activation of protections forcing the aircraft nose-up. Personally I find this the least likely explanation, based on the specification and design of the systems as I understand them, coupled with the fact that the A330 has been flying for nearly two decades without such a scenario presenting itself, despite numerous documented failures of the pitot system. I'm not saying it's impossible, just pretty remote based on the information I have.

Chris Scott wonders if the "G-Loading" mode of the FCU would have ordered up elevator and consequent nose-up THS movement via the autotrim system. Personally I think this scenario slightly more credible than Svarin's, because it is more of an edge case in terms of specification and design. That said, I'd be very surprised if the engineers overlooked this consequential failure mode given how thorough they were with everything else.

Finally we have the scenario I consider the most likely, which is that the autotrim was responding directly to the pilot's consistent nose-up sidestick commands, but this in itself opens a can of worms because it is perceived in some quarters (incorrectly IMO) as an attempt to "blame the pilot" and get Airbus/AF off the hook. For a start, Airbus and AF are already on the hook to some extent because of the known pitot problem, and AF's response to the service bulletin not being expedited in the wake of the numerous cases where these failures led to near loss of control incidents. The old aerospace chestnut of a "failure of imagination" comes into play here, because most of the previous events occurred in daylight, where pilots had an external reference from which to aid their recovery of the aircraft. Prior to the accident, few seem to have taken into account how much more dangerous a failure of this nature would be in adverse weather conditions in the dark hours of night, which would suggest that the lessons of Birgenair and Aeroperu were not heeded as well as they should have been.

For my part, I agree with PA 18 151 in the sense that this case is far from closed and we should respect the abilities of the investigators to get on with it. To clarify my position as referred to by BOAC, I mentioned that another poster (I believe it was Smilin'_Ed) seemed to be proposing a drop to Direct Law in the case of air data failure, and bypassing Alt 2 entirely. Indeed, it would appear that is indeed what Smilin'_Ed is proposing ginven his recent posts. Personally I disagree and think that Alt 2 has a purpose in this kind of incident, although it can be argued that the outcome of this particular scenario doesn't reflect well on the design. As I've said many times before, the ability to manually control trim is available in any law, including Alt 2, provided via the trim wheels sitting right next to the inboard hands of both pilots. Indeed I think it was PJ2 who stated that as part of his training he was required to land the A320 simulator using rudder and pitch trim only.

BOAC, I find it interesting that you acknowledge that your background information on FBW airliners is limited, yet you feel qualified to state that a drop to Direct Law is "anathema to the FBW world", by which I presume you mean mentality. I think that this is a fundamental misunderstanding. Part of the FBW rationale was certainly to reduce the cost of operations by using lightweight componentry in aircraft controls, however another purpose of the design was to assist pilots - not hinder or eventually replace them, no matter what some of the more lurid scaremongering on this forum from time to time suggests. The designers and engineers asked pilots what they wanted when the requirements were gathered, and built a system that implemented the specification drawn up from those requirements. The whole idea was to build something that *worked*. If the decision is taken that a drop to Direct Law in this scenario would be preferable, then I'm sure they will make that change.

As I stated, I'm of the belief that Alt 2 serves a purpose, and that a lot of thinking will be done based on the evidence gathered in the investigation of this accident. I'm sure that scenarios were considered that make Alt 2 a much better fit than Direct Law in this set of technical circumstances, and eventually they will have to weigh up those hypothetical scenarios against this real one before they make that decision. Birgenair proved that a more "conventional" FCS is no protection against the "loss of air data" scenario, and just for the record on this thread I will state again that the Birgenair Captain was a *highly experienced ex-military pilot* and even he was thrown (even as his two F/Os were repeatedly feeding him suggestions that might have helped). He didn't seem aware that the situation was being made worse by the actions he took all the way down to the ocean.

There seems to be an undercurrent on here occasionally that some pilots are not only distrustful of technology, but also have a dim view of the engineers that built the aircraft they are flying - seemingly thinking that because the protections were implemented by engineers, therefore the engineers must in turn have a dim view of pilots' abilities. I can't speak for engineers in general, but I must say that I think this view is blinkered. It is in the interests of pilots and engineers to make aircraft as safe and as comfortable to fly as possible. Ultimately pilots are responsible for the lives of everyone on the aircraft with them and additionally pay the price if something goes wrong. But another way to look at it is that engineers are responsible for *every* person riding on the aircraft they design, *every single time* one of those aircraft takes to the skies. Think for a second of the Boeing engineers that carried out the faulty repair on the aircraft that became JAL 123. Think of the price that the JAL engineer who signed off that repair paid (I believe he took his own life).

Thinking in these adversarial terms is not only counter-productive in my book, it is also dangerous. We are all in this together in a very real sense - I may not agree with what Svarin, Chris Scott, BOAC and some others are saying, but it would be churlish and short-sighted of me to not take it on board and at least accept that there is a possibility they're right. I think any engineer worth their salt would feel the same way, even if only to provide the data that contradicts (or even backs up) the theories and ideas put forward. At this point I am out of data, so I'm back-seating this for a while and hoping that the report when it comes is thorough and well put together.

Let's be safe out there, people.

Machinbird

26th Jun 2011, 19:14

Indeed I think it was PJ2 who stated that as part of his training he was required to land the A320 simulator using rudder and pitch trim only.
That would be in Mechanical Law. The last ditch bring it back mode of control.

L337

26th Jun 2011, 19:21

Er, I'm pretty sure this was discussed on the previous thread - some time ago they not only "admitted" that it was a problem, they changed the behaviour so that when A/THR kicks out, the thrust remains at the last setting the A/THR commanded. The thrust setting does not change until the pilots touch the thrust levers.

I hope you are correct, and indeed if you are, I am more than willingly to retreat.

Looking at post #379 and that graphic, it seems to show that that thrust went to TOGA @ 2:10:51.

Then again the handling pilot may have selected TOGA rather than AT logic.

Time will tell.

mm43

26th Jun 2011, 19:50

Looking at post #379 and that graphic, it seems to show that that thrust went to TOGA @ 2:10:51.

Then again the handling pilot may have selected TOGA rather than AT logic.At 2 h 10 min 51, the stall warning was triggered again. The thrust levers were positioned in the TO/GA detent and the PF maintained nose-up inputs.

Clearly PF induced.

SaturnV

26th Jun 2011, 19:53

BOAC,

Imagery from 02h07. Position (square box) is the 02h10 ACARS position.

(Source Annexe 1 of the French version of the first BEA interim report.)

Temperatures above -50C

http://i136.photobucket.com/albums/q199/tahitiplage/SNAG-0311.jpg

Temperatures above -75C

http://i136.photobucket.com/albums/q199/tahitiplage/SNAG-0312.jpg

Would appear to be rather close to a Cb.

From Tim Vasquez's June 1 2011 re-analysis, his worst case scenario, and general conclusions.

[p]arcel was constructed that just barely achieves the isolated -80 deg C overshoot temperature detected on METEOSAT imagery. This was readily accomplished with a surface temperature of 27 deg C and dewpoint of 23 deg C (thus it realistically accounts for a certain amount of boundary layer mixing). The CAPE value obtained is 1067 J/kg, which by textbook definition is considered marginal for severe weather and typical for the tropics. That is not to say it does not have severe weather risks, as the formula for typical maximum observed updraft velocity is: w=0.5*((2*CAPE)^0.5) which in this case gives 23 m/s (51 mph). It is probable that even this amount of instability was not observed, due to the potential for extensive mixing with an average dewpoint of 18C in the lowest 150 mb.

Furthermore, researcher Ed Zipser and others in their studies of oceanic equatorial cumulonimbus clouds emphasize the dilution of updraft strength in the clouds they sampled, though this mainly occurs below about FL200. This mid-level weakness probably contributes in some way to the lack of charge separation and electrification (i.e. lightning). Above that level, ice-filled updrafts are warmed by latent heat of sublimation, restrengthening the updraft relative to the surrounding environment and this allows the updraft to regain momentum and the cumulonimbus cloud to reach the stratosphere. Zipser states that updrafts are usually strongest in the upper troposphere compared to lower levels and updraft velocities of 20 to 40 kt do occur occasionally. The role of a strong updraft or turbulence within the storm cannot be completely ruled out, especially since METEOSAT measurement shows that cumulonimbus overshoots reached at least 6,000 ft above the tropopause.
....
(Conclusions)
Air France Flight 447 crossed through an area of tropical showers and/or weak thunderstorms with weak to moderate updrafts and a high likelihood of turbulence. The flight penetrated one cell at about 0150 UTC and then entered a cluster of cells beginning at 0158 UTC. The suspected zone of strongest cells was reached at 0208 UTC, which corresponds with the beginning of a track deviation, and another cell appeared to be reached at 0210 UTC, which corresponded with the time of autopilot disconnect.
.....
Tropical storm complexes identical to or stronger than this one have probably been crossed hundreds or thousands of times over the years by other flights without serious incident, including ascents and descents through critical icing zones in tropical showers.

Air France 447 - AFR447 - A detailed meteorological analysis - Satellite and weather data (http://www.weathergraphics.com/tim/af447/)

jcjeant

26th Jun 2011, 20:02

Hi,

1 Er, I'm pretty sure this was discussed on the previous thread - some time ago they not only "admitted" that it was a problem, they changed the behaviour so that when A/THR kicks out, the thrust remains at the last setting the A/THR commanded. The thrust setting does not change until the pilots touch the thrust levers.
Chris Scott wonders if the "G-Loading" mode of the FCU would have ordered up elevator and consequent nose-up THS movement via the autotrim system. Personally I think this scenario slightly more credible than Svarin's, because it is more of an edge case in terms of specification and design. That said, I'd be very surprised if the engineers overlooked this consequential failure mode given how thorough they were with everything else.Well if I refer to the 1 quote .. it's seems they already overlooked one problem .. so why not some others despite how tourough they were....

Finally we have the scenario I consider the most likely, which is that the autotrim was responding directly to the pilot's consistent nose-up sidestick commands, but this in itself opens a can of worms because it is perceived in some quarters (incorrectly IMO) as an attempt to "blame the pilot" and get Airbus/AF off the hook. For a start, Airbus and AF are already on the hook to some extent because of the known pitot problem, and AF's response to the service bulletin not being expedited in the wake of the numerous cases where these failures led to near loss of control incidents. The old aerospace chestnut of a "failure of imagination" comes into play here, because most of the previous events occurred in daylight, where pilots had an external reference from which to aid their recovery of the aircraft. Prior to the accident, few seem to have taken into account how much more dangerous a failure of this nature would be in adverse weather conditions in the dark hours of night, which would suggest that the lessons of Birgenair and Aeroperu were not heeded as well as they should have been.Due to the last BEA note from 27 May 2011 and how reported in the newspapers (after all ... the general public is also concerned and can have some opinions) the direction of pointing fingers his obvious ....
After all .. who was in command of the AF447 ? .. the pilots .. or (in France) the sleeping enginneers .. softwares dev of Airbus or AF management people that night ?
We have the scene of the crime (35.000 feet and icing environment) ... the perpetrators (the pilots) and the weapon (the plane)
It's just we have not yet a reason for why the crime was perpetrated ...
Very sad that Peter Falk just left us days ago .....

BOAC

26th Jun 2011, 20:31

Would appear to be rather close to a Cb. - re-phrase that to "Would appear to be rather close to a red blob" and I'll agree.

You have provided your own answer to your earlier question - "METEOSAT measurement shows that cumulonimbus overshoots reached at least 6,000 ft above the tropopause." - I'm sure if you were to Google the height of the trop in summer in the tropics you will be complete.

Note the conclusions:
"Air France Flight 447 crossed through an area of tropical showers and/or weak thunderstorms with weak to moderate updrafts and a high likelihood of turbulence.", and also the last paragraph in your quoted piece.

Yes, they MAY have flown too close to the active part of a CB or even into one. They MAY have not used the radar correctly. At this time we can only surmise. I expect the CVR will tell - I understand there was little evidence of pax being strapped in?.

GarageYears

26th Jun 2011, 20:40

DozyWannabe: +1:ok: well said

Anyway, the fact that a change to the A/T behavior WAS implemented should be a affirmation of a lack of arrogance on their part: "we got this wrong, we fixed it...". That does NOTHING to confirm or infer there are other alligators hidden in the lake.

Ultimately the piece of the jigsaw with the GREATEST variability and uncertainty with respect to predictable behavior IS the chap with his hands on the controls. Let's be brutal here - ANY aircraft can be driven into the ground with the wrong pilot input, FBW, flight control computers, PRIMs be damned. Clearly that is inciteful and I am NOT claiming that there was any intent related to AF447. But once the auto-everything lets go the PF needs to get on with the program pretty damn quick.

Unfortunately in this case, I have a great fear that the sudden delivery of the aircraft into the PF in this case was entirely unexpected and the actions in the first few seconds were, (how can put this?), less than optimal. The game was not over, but little of what followed appears destined to recover the aircraft.

A fairly benign UAS event became a fully developed stall in less than 60 seconds or so. If THAT is what happened, then all this Airbus bashing seems out of place. That is not to say Airbus and the BEA will not find recommendations to ASSIST the pilot in such a situation, but I'm betting a buck it won't be a drop to Direct Law or elimination of the THS trim function in Alternate.

Smilin_Ed

26th Jun 2011, 22:14

@Dozy: Finally we have the scenario I consider the most likely, which is that the autotrim was responding directly to the pilot's consistent nose-up sidestick commands, but this in itself opens a can of worms because it is perceived in some quarters (incorrectly IMO) as an attempt to "blame the pilot" and get Airbus/AF off the hook.As I have said before, there is not necessarily only one cause of this accident. It appears to me that both the pilots and the aircraft have shown some deficiencies. Ascribing some of the blame to the pilots will not get Airbus/AF off the hook.

@Dozy: To clarify my position as referred to by BOAC, I mentioned that another poster (I believe it was Smilin'_Ed) seemed to be proposing a drop to Direct Law in the case of air data failure, and bypassing Alt 2 entirely. Indeed, it would appear that is indeed what Smilin'_Ed is proposing ginven his recent posts.[QUOTE]

From a pilot's perspective, if someone hands me the controls and says "You have it." I want him to keep his hands off until I hand it back to him. I don't want him to touch the trim unless I ask him to do so. Maybe not all pilots agree with that but I was trained to evaluate the "Flying Qualities" of aircraft. I made my living doing just that and my opinion is that the autotrim needs to come out when the confusers get thoroughly confused and give up trying to fly the aircraft.

@Dozy: [QUOTE]As I've said many times before, the ability to manually control trim is available in any law, including Alt 2, provided via the trim wheels sitting right next to the inboard hands of both pilots.Yes, the ability to manually control the trim is there but they didn't use it. We don't yet know why but it is clear that they let the system trim them up into a stall. In the world of pilots, that is a big no no.

@Dozy: ..... another purpose of the design was to assist pilots - not hinder or eventually replace them, no matter what some of the more lurid scaremongering on this forum from time to time suggests.But, in this case, the system did hinder the pilots. The pilots were remiss in not catching the fact that trim had run full nose up, but the system put it there when it shouldn't have, reducing their ability to fly it out of the stall.

In every fixed wing aircraft that I have flown, directional stability and pitch stability are positive and only lateral stability is neutral. The Wright brothers initially thought that they wanted neutral pitch stability but after a couple of flights, they began to realize that pitch stability had to also be positive. If not, when they pulled the nose up, it would stay there until the aircraft stalled. That's when they changed their design to positive pitch stability which brought the nose back to the trim speed when they let go of the controls. Having the autotrim follow the sidestick commands essentially gives the aircraft neutral pitch stability. Neutral pitch stability is fine as long as the autopilot is functioning properly, but when it quits, you really need it to be positive when you are hand flying.

bubbers44

26th Jun 2011, 22:36

The Wright brothers were smart people that designed a stable aircraft after a few tries. Airbus found a way to make an airplane fly like their first one before they corrected it. Neutral pitch stability might make flying easier when things are working right but in this case it helped seal their fate. Some day in the future we might have all the data to see why a perfectly good airplane with a minor airspeed problem ended up 13,000 ft below the Atlantic.

wallybird7

26th Jun 2011, 22:40

BOAC
Quote:
Originally Posted by OC
BOAC - Apologies for the slow reply. Details of other aircraft deviating round the weather front can be found in already released BEA reports and in various posts in the threads on this subject. I am sure that if you look you will come across them.

- is it perhaps that you have missed the 12 deg deviation of AF447 in the report? As far as I know there is no evidence that they 'flew into a CB'.

There is nothing but evidence they flew into a CB.

But I want to add what we know and what we don't about this.

First the mission of the BEA, or any modern country’s investigative body’s is to assess the facts, try to make a determination of Probable Cause, and make recommendations for corrective action. Or lessons to prevent it from happening again.

It sometimes is implied that they “will leave no stone un-turned to arrive at a resolution.”
That is incorrect and is used when there are reasons for the outcome to be delayed.

In the Air Force where I served as an accident investigator for fighter squadrons, the mission was slightly different. And we had many more accidents to deal with. The AF did not have the luxury of waiting for the up to two year time lag waiting for results, as national security was at stake. Thus their mission was a Safety Investigation. All of the parties were immune from prosecution, legal suits did not apply, and the object was urgency, so that we could get back in the air again. Their goal is to make a determination of Probable Cause also and make recommendations to avoid or prevent.

The definition of probable cause is simply, more likely than not. Or technically 50.1% versus 49.9. A very low level of certitude, but considering all of the many unknowns very practical.

Here we know some things for sure, many many more we know literally nothing about.
1) We know: thunder storms along the track. No one knows how severe.
2) We know there are severe up and down drafts in them.
3) We know all 3 pitot tubes iced up. No one knows precisely why.
4) We know critical airpeed indicators went out.
5) Auto-pilots failed.
6) Auto-throttles failed.
7) Uncommanded 7000 fpm climb. Despite the plane being at it’s maximum cruising altitude. Evidence of 60-70 kt updrafts according to meteorological analysis.
8) Airspeed falling to below 60 kts.
9) Flight controls ineffective below 120 kts.
10) I know, you cannot control an airplane with trim alone.
11) No one knows for sure what a plane will do in a deep stall.
12) No one knows for sure whether a plane can recover from a deep stall especially with limited flight controls.

Questions I have:
Why was the flight dispatched into a known line of thunderstorms?
Why is there so little concern about the effects of flight into thunderstorms?
Despite all of the warnings on the subject?

To me there is no mystery.

GarageYears

26th Jun 2011, 22:51

wallybird7: The ITCZ is a well understood area, that routinely presents challenging weather conditions. However EVERY flight traveling North<>South in this region of the World will transit the ITCZ. So your question "why were they dispatched into a known line of thunderstorms?" is rather misrepresenting the situation. This area of weather is not a rare occurrence, more so a common situation, and in fact the conditions that night were NOT particularly severe, with the term being "moderate thunderstorms" being the one most often applied after skilled analysis.

There were many other flights that passed through the SAME weather system, however the majority applied some diversion to a much greater extent than anything AF447 attempted. THAT to me is the most problematical concern of mine - WHY didn't they divert around the system?

AlphaZuluRomeo

26th Jun 2011, 23:08

Hi Smilin_Ed
AZR:

Except, in this case, they didn't have unrestricted control. The flight control system kept changing the pitch trim. While this was result of an inexplicable nose-up command on the side stick, the pilots apparently didn't notice it. As I've said several times before, when the system gives up, it needs to turn off autotrim along with the autopilot. :ugh:

I must disagree with your first sentence. If the auto-trim followed the crew's orders (via the sidestick) then the crew had unrestricted control.

Perhaps you interpreted "unrestricted" as "full manual" ? That's not what I meant. For me "unrestricted" means just that : the planes follows the crew's inputs, and the computers don't prevent manoeuvers because it "thinks" they're of no good.

Maybe a full manual reversion (direct law, no auto-trim, as you promote it) is easier to understand. But IIRC, on the A320 which crashed near Perpignan, the trim was manual (only) ; the crew didn't notice it either, and the plane crashed.

-----------

@ DozyWannabe (post #406) : :ok: :D Sir.

wallybird7

26th Jun 2011, 23:13

GarageYears

Yes a slight misrepresentation -- and yes I know CB's are common. But every other flight deviated. Perhaps 447 did not deviate enough. But with all the glitches to me crystal clear the thunderstorm probably had "something to do" with the entire chain of events. The icing, the updrafts, the out of control climb. Something.

Every pilot I know says the same thing. Deviate, a lot.

I do not understand the casual dis-respect for the power of a thunderstorm.

SaturnV

26th Jun 2011, 23:14

BOAC,

From the BEA reports to date, it would appear they did not perceive the Wx ahead to be extraordinary.

While the BEA report does provide the number of rotations each of the pilots had flown on South American sectors, it does not indicate when these rotations were flown, and on what sectors. So their actual experience in transiting the ITCZ over various seasons is yet to be revealed, and may never be.

If the time had been daylight, and they had seen a Cb towering 20,000 feet above their FL ahead on the airway, I suspect they, like nearly every pilot, would have deviated off the track, and put their plane at a safe distance from that cell. What might be the appropriate, one adjective characterization of a pilot who would fly into a Cb whose top is 15 or 20 thousand feet above their FL in the cruise?

I don't know whether the BEA will ever provide more information on AF459 following on the same airway 35 minutes behind, and compare the reaction and response of the AF459 cockpit to that of AF447. It might be quite telling.
________________________

Given the relatively higher percentage of cabin crew bodies recovered floating, unless they were in crew rest modules, it would suggest that the cabin crew were not instructed to take their seats and tighten the straps. More about this will be known once the autopsies and identifications are completed on the 100+ bodies retrieved in their seats.

wallybird7

26th Jun 2011, 23:21

AlpaZulu

I must disagree with your first sentence. If the auto-trim followed the crew's orders (via the sidestick) then the crew had unrestricted control.

Auto Trim is not a primary flight control. Therefore the crew's control was restricted. You cannot recover an out of control plane with trim alone.

GarageYears

26th Jun 2011, 23:23

Ah, then wallybird7, you and I ARE on entirely the SAME page then. Because that is the root of the mystery here - why didn't they deviate? Everything that follows is a consequence of this fundamental issue. And we can postulate alternate trim functionality, this law or that, until we are blue in the face, but were it not for a simple 100nm East or West (name your distance/direction), we would not be having this discussion, which makes this all the more sobering.

wallybird7

26th Jun 2011, 23:30

GY

So very true!

Smilin_Ed

26th Jun 2011, 23:51

@AZR: Perhaps you interpreted "unrestricted" as "full manual" ?

OK, AZR, I yield to your semantics.

But I hope the pilots did not really intended for the trim to go full nose up. I don't like to use the word panic to describe the situation but things sure are pointing in that direction. That's what happened in Buffalo and it was 100% fatal there too.

DozyWannabe

26th Jun 2011, 23:56

That would be in Mechanical Law. The last ditch bring it back mode of control.

True, but it is possible to use the trim manually in any law. Manual Trim has priority, and when manual trim commands cease, autotrim will function again. I misinterpreted that earler, thinking that manual trim activation was a one-shot action which disabled autotrim for the duration. That said, if the pilot doesn't like what autotrim is doing all he or she has to do is keep their hand on that trim wheel.

Ascribing some of the blame to the pilots will not get Airbus/AF off the hook.

Agreed. I think we're on the same page

From a pilot's perspective, if someone hands me the controls and says "You have it." I want him to keep his hands off until I hand it back to him. I don't want him to touch the trim unless I ask him to do so. Maybe not all pilots agree with that but I was trained to evaluate the "Flying Qualities" of aircraft. I made my living doing just that and my opinion is that the autotrim needs to come out when the confusers get thoroughly confused and give up trying to fly the aircraft.

That's a good point, and I'm sure that will be taken into consideration. Having said that I think your use of "confusers", while amusing, is an example of the adversarial attitude I was talking about earlier and undermines the very salient information you provided above.

@Dozy: Yes, the ability to manually control the trim is there but they didn't use it. We don't yet know why but it is clear that they let the system trim them up into a stall. In the world of pilots, that is a big no no.

@Dozy: But, in this case, the system did hinder the pilots. The pilots were remiss in not catching the fact that trim had run full nose up, but the system put it there when it shouldn't have, reducing their ability to fly it out of the stall.

Now this is the point when things get tricky. What you perceive as "the system" trimming them into a stall could equally accurately be described as the PF inadvertently trimming them into the stall by his direct actions, if indeed it turns out that the THS movement was sidestick-induced.

This is why I try to be really careful with language here because I don't want to give anyone the impression that I'm disrespecting the piloting profession when nothing could be further from the truth. We all make mistakes in our day-to-day lives, some of which have more far-reaching consequences than others. Being in charge of a two hundred-ton metal tube moving through the sky just below the speed of sound with a couple of hundred people behind you means that for line pilots, those consequences tend to be more far-reaching on an almost constant basis. When I hear the phrases "I don't believe a pilot would do that", "No pilot in his right mind would do that" or "A pilot would never do that" I get a sinking feeling (with no instruments to reference to confirm my physical perception ;)). This is because we're all human, and pilots - some of whom were below average, but many of whom were experienced, skilled and respected - have nevertheless done things like attempting a take-off without clearance/in snow conditions with engine anti-ice off/with high-lift devices not extended, shut down a working engine leaving the aircraft to fly on the damaged one, pulled back on the control column turning a stall warning into a full stall... the list is a long and sad one.

To be clear, I'm not bashing pilots here - I'm simply stating that the consequences that the men and women of the piloting world face for the kind of momentary lapse in judgement that would be easily resolved in almost any other workplace are far more severe, and that's why I personally have a lot of respect for all of you. But being almost hair-trigger defensive in the way that I see sometimes on here does you a disservice, when what I'm sure engineers all want is to make your (and our) lives as easy and safe as we can.

Right now we're speculating on information that was barely more than a press release. The people that designed these systems weren't stupid, and I'm sure there are very logical reasons for the system being designed the way it is. Remember that this was designed to be the next generation of flight controls - doing things a certain way because that was the way they'd been done since WW2 (or even beforehand!) wasn't a valid design input. Being as friendly and logical to the pilot as possible certainly was, the only problem with that being that some pilots prefer different things.

In every fixed wing aircraft that I have flown, directional stability and pitch stability are positive and only lateral stability is neutral. The Wright brothers initially thought that they wanted neutral pitch stability but after a couple of flights, they began to realize that pitch stability had to also be positive. If not, when they pulled the nose up, it would stay there until the aircraft stalled. That's when they changed their design to positive pitch stability which brought the nose back to the trim speed when they let go of the controls. Having the autotrim follow the sidestick commands essentially gives the aircraft neutral pitch stability. Neutral pitch stability is fine as long as the autopilot is functioning properly, but when it quits, you really need it to be positive when you are hand flying.

I'd need someone like PJ2 or Chris Scott to provide the data, but I'd be very surprised if they didn't factor that basic aeronautical knowledge into the design somehow (I'm a logic guy, the complex maths isn't my forte). We're not going to know exactly what the inputs were until the report is released, so I think we're going to need to keep our powder dry until then.

bubbers44

27th Jun 2011, 00:09

The crew obviously didn't just fly through a CB. Every crew finds their own way around them. No evidence of any major turbulence is reported in the BEA report. They iced up as had many Airbuses prior to this event. All indications are they lost airspeed indications and for some reason pulled back on the side stick until they went into a deep stall. No reports of severe turbulence or vertical drafts. I think it best to wait for the report rather than add personal concepts of what might have happened. The BEA report has nothing to report of any significant turbulence.

jcjeant

27th Jun 2011, 00:33

Hi,

The BEA report has nothing to report of any significant turbulence.They don't report .. ? .. but the pilot report ...

BEA 27 May 2011 note

Between 1 h 59 min 32 and 2 h 01 min 46 , the Captain attended the briefing between the
two co-pilots, during which the PF said, in particular "the little bit of turbulence that you just saw
[…] we should find the same ahead […] we’re in the cloud layer unfortunately we can’t climb much
for the moment because the temperature is falling more slowly than forecast" and that "the logon
with Dakar failed". The Captain left the cockpit.And ..

At 2 h 06 min 04, the PF called the cabin crew, telling them that "in two minutes we should enter
an area where it’ll move about a bit more than at the moment, you should watch out" and he
added "I’ll call you back as soon as we’re out of it".Now of course .. are they warning CC of significant turbulences .. when they add "you should watch out" ?

Lonewolf_50

27th Jun 2011, 00:53

In this situation. The aircraft knew it was stalled, knew it's pitch angle, and had consistent and valid airspeeds. What more info do you want before you start to lower the nose?
Other than the inconsistent airspeeds that began this waltz ...

You have returned us to the issue of not knowing the AoA.

If the aircraft "knows it is stalled" but the pilots don't, what are your suggestions?

Follow on to that is: what were they trained to do in the case that they had stalled the aircraft?

There was posted either in this thread, or in the one at Rumors and News, a graphic depicting a 16 deg nose up on a display. You might see that on a departure climb, but how often in cruise?

This takes me to BOAC's question about a crew allowing their aircraft to head into orbit: what airline pilot, flying at altitude, would find a 16 deg nose up attitude something other than abnormal?

Why would either let that nose attitude sustain?

This goes back to what may not be answerable: what did each member of that cockpit crew see in front of him, and what was he paying most attention to?

DozyWannabe

27th Jun 2011, 01:15

This takes me to BOAC's question about a crew allowing their aircraft to head into orbit: what airline pilot, flying at altitude, would find a 16 deg nose up attitude something other than abnormal?

Why would either let that nose attitude sustain?

This goes back to what may not be answerable: what did each member of that cockpit crew see in front of him, and what was he paying most attention to?

This is where (and why) I keep going back to Birgenair - where a very experienced pilot stalled and span his 757 despite the fact that the only fault on the aircraft was a single blocked pitot tube. It is impossible to know what was going through his mind, but nevertheless - even with both his F/Os calling "ADI" and "Stall" repeatedly, he apparently did not process the information that the ADI was giving him - that he was excessively nose high for the phase of flight he was supposed to be in. Attempts to remedy the other factors in that accident have been included in pilot training and bulletins from the manufacturers (and indeed a design change to the 757) over the years, but the fact remains that psychological factors in an incident of this nature are possibly not as well understood as they could or should be.

Old Carthusian

27th Jun 2011, 01:28

BOAC
It may be losing sight of the wood for the trees but to dismiss the aircraft entering turbulent weather as not relevant is rather rash. The fact that the crew of AF447 did not deviate round the weather front is highly significant. The pitot tube failure whilst clearly a contributory factor is not the reason for the accident. The actions of the flight crew in responding to the situation and entering the thunderstorm when others didn't are. I am not assigning any value judgment here just noting an event.

jcjeant

27th Jun 2011, 03:24

Hi,

BOAC
It may be losing sight of the wood for the trees but to dismiss the aircraft entering turbulent weather as not relevant is rather rash. The fact that the crew of AF447 did not deviate round the weather front is highly significant. The pitot tube failure whilst clearly a contributory factor is not the reason for the accident. The actions of the flight crew in responding to the situation and entering the thunderstorm when others didn't are. I am not assigning any value judgment here just noting an event. I wonder if it's not a usual behavior of some AF pilots to take at least some risks on this route or in case of similar weather ..
It's to remind sometime after the AF447 disaster .. the AF445 "mayday" on same route and somewhat same conditions ...
It was "apparently" a non event (but passengers were strongly shacked for longtime .. big turbulences) and plane lost altitude (was it stalling also ??) .. but happy end ..... in this case .
We will never know what really happened as the recorders were erased or datas convienently missing ...
Another "cas d'école" .........

The BEA has launched an investigation on December 1, the day after the landing of the aircraft. Air France has meant that when the plane had already left for Bangalore in India and the data of the CVR black boxes, the registration of trade in the cockpit, and the FDR, the parameters of the flight had been "crushed". A plane is indeed equipped with two black boxes supposed to provide the data theft. The recording of conversations is valid only four hours while recording parameters covers 25 hours. After a return trip to India, there remained nothing more data.

The companies also have an additional record the QAR to the use of its maintenance crews. Unable to access both legal records, the BEA has requested that the QAR was not available. "Air France has said that the data were not recorded because of poor formatting," says spokesman BEA. For its part, Air France states that "the QAR was recovered on November 30 just before noon and the time to send it and realize that it was a virgin, the plane had left for Bangalore."

However, investigators have recently received a new report, more substantial than the first. "He has no objective value, says one close to the investigation. The company has just said it was a non-event and that the crew may have overreacted. " The side of the BEA, the investigators' regret not having the AF445 flight data that could shed new light on what occurred on Flight 447. "Go figure .......

Graybeard

27th Jun 2011, 03:29

DW: (and indeed a design change to the 757) over the years,

What design change? Are you still hung up with your misinformation that the Birgenair Capt didn't have an AIR DATA: NORM/ALT switch on the panel in front of his left knee? That switch was there from the beginning of production of the 757/767.

The Capt. cocked up, that's all. DW, why are you trying to blame the 757, and let the A330 off free?

As for CB, thousands or millions of flights have successfully negotiated the ICTZ at flight levels since the day of the 707, with Wx radars far more primitive than what AF447 had, yet how many crashed?

DozyWannabe

27th Jun 2011, 03:50

Graybeard:

I think you'll find that you've missed the point I was trying to make. This isn't about A v B, USA v EU, pilots v engineers or any of that rubbish.

There seems to be a point at which the human brain can only process so much information. In the case of Birgenair it seems that the PF was unable to determine from the ADI that he was nose-high and stalling because he was still focused on the initial false overspeed warning. In the case of AF447 it appears that the PF repeatedly pulled back on the stick despite this being the precise opposite action to what was required for recovery - his ADI was right in front of him and presumably working throughout. If this is indeed the case why does this happen?

(The information that the 757's design was changed to make it easier to switch air data after the Birgenair crash comes from the ACI/Mayday episode on the subject - it is possible they got it wrong...)

CogSim

27th Jun 2011, 04:09

Originally Posted by Lonewolf_50
This takes me to BOAC's question about a crew allowing their aircraft to head into orbit: what airline pilot, flying at altitude, would find a 16 deg nose up attitude something other than abnormal?

Why would either let that nose attitude sustain?

This goes back to what may not be answerable: what did each member of that cockpit crew see in front of him, and what was he paying most attention to?

Originally Posted by DozyWannabe

This is where (and why) I keep going back to Birgenair - where a very experienced pilot stalled and span his 757 despite the fact that the only fault on the aircraft was a single blocked pitot tube.

From a pilot's point of view, I can understand loosing time or even being fixated and not physically doing what I'm supposed to do. In the case of AF447, however, BEA report suggests a persistent positive action from the PF. An action that is bewildering given the circumstances.

I'm with Savrin here. The a/c systems need full scrutiny, if only to understand what made the pilots react the way they did. The problem with explaining away PF action is that it is just too persistent.

jcjeant

27th Jun 2011, 04:10

Hi,

(The information that the 757's design was changed to make it easier to switch air data after the Birgenair crash comes from the ACI/Mayday episode on the subject - it is possible they got it wrong...) I hope that after your explanation above .. you do not more critisize my informations sources .. because it seems that your sources can not be described as more serious than mine :ok:

gums

27th Jun 2011, 04:14

To Old Car. and others.......

There is no doubt that some weather started the sequence that resulted in many lives being lost. The stoopid air data sensors went into la la land. That started the sequence of events and human responses.

Anybody disagree?

So we have air data becoming unreliable, we have a system that keeps reverting to less and less "limits", we have a myriad of cautions and warnings for the crew to accept and act upon, and it is NIGHT!

I will gladly take any non-pilot system engineer or software engineer or..... and place them into the situation that the AF447 folks faced. What would they do?

Well, what's your point, Gums?

The point is to get from point "A" to "B", or drop bombs on the enema, or take recce pictures, or take some SLF's to see the Grand Canyon, or .....

BOTTOMLINE:

If we insist upon human crews in our commercial aircraft, then we have to design and implement systems that help them, but still demand some degree of basic airmanship and training.

I cannot judge the actions of the AF447 crew we see from the sparse reports from BEA, given the data we have now.

I can surely judge the sensors' failure and the control logic that causes warnings and cautions and does not take inton account a basic principle of aero - angle of attack.

I would hope we give the humans just a fighting chance to keep the plane flying when unexpected things happen, and we could point fingers at each other later.

I know that many here have flown thousands of hours and have delivered millions of SLF's. Makes me feel comfortable, to a point.

But how far are we gonna go with automation and systems that will "protect" you regardless of your basic airmanship and training?

respectfully.......... and maybe we need another forum/thread for these thots.

DozyWannabe

27th Jun 2011, 04:29

jcjeant : I have many sources of information, of which that was one (admittedly not a good one, but it stuck in my head). For example I don't have anything concrete on the Boeing 777 systems other than a rough outline, but rest assured, I'm not just a TV junkie getting my kicks from talking to pilots on here.

CogSim : The Colgan pilots pulled their aircraft straight into the ground - I'm not saying that's what happened here, but it does happen.

CogSim

27th Jun 2011, 04:36

Originally Posted by gums

drop bombs on the enema

I pity the pilot in charge of this unfortunate task. :\

Old Carthusian

27th Jun 2011, 05:50

Gums
I think you fail to understand the nature of the FBW system used on Airbus aircraft. I must admit I don't fully understand it but from what those who know have said it is more about placing limits on what you can do with a very stable aircraft. The comments on the various threads by those who fly the beast do not talk about an unstable monster kept in the air by computers but a stable platform which is easy to fly without the protections. As the aircraft encounters different situations the protections or limits drop away but the aircraft doesn't become suddenly unstable.
It may be that there is a problem with the training regime for these aircraft and that not enough attention is paid to flying without these protections but I am not qualified to comment about this and I haven't seen any comments from Air France pilots on this board about their training and whether there were deficiencies so I just don't know. It may also be that the flight crew were deficient in their knowledge but I would not like to make that judgment yet - I believe that it is far too premature to even form that conclusion. Certainly, the pilots actions need considerable more scrutiny but to go as you seem to for a theory that myriad system faults incapacitated the pilots is too reckless at the moment.

BOAC

27th Jun 2011, 08:11

Far too much noise and assumption here to comment on it all, but

gums #436:But how far are we gonna go with automation and systems that will "protect" you regardless of your basic airmanship and training?

respectfully.......... and maybe we need another forum/thread for these thoughts. - please join the thread on the 'Safety' forum?

All this comment on 'deviation'/lack of is based on NO KNOWLEDGE whatsoever! Cells do move around, flight paths differ, mostly we only seek around 20 miles clearance in normal ops. We do not know what they saw on the radar nor what they discussed between themselves apart from going a 'bit left'.

I still remain surprised that the 2001 near accident to the 340 which entered an un-commanded zoom climb to a very low speed remains dismissed by many? No-one has yet explained (simply please) why the system there decided it needed to pull up so violently. That sure as hell would have confused me in the dark of the Atlantic in the ITCZ - and I would have mentioned it to the other pilot........

Edited for my mis-read of Vls.

HazelNuts39

27th Jun 2011, 08:43

... the 2001 near accident to the 340 which entered an un-commanded zoom climb to below stall speed ... Are you sure? From the AAIB report:
The indicated airspeed dropped below VLS (the lowest selectable) as the aircraft climbed and the commander took manual controlIn cruise, VLS is a speed that provides a certain margin (0,3 g?) to buffet onset. The zoom climb occurred because the FCS entered into alpha-prot law and then maintains AoA=alphaprot until the pilot moves the sidestick. Alphaprot is less than alphamax and maintaining it stick-free prevents the airplane from stalling.

sensor_validation

27th Jun 2011, 09:11

below stall speed
Are you sure?
In cruise, VLS is a speed that provides a certain margin (0,3 g?) to buffet onset. The zoom climb occurred because the FCS entered into alpha-prot law and then maintains AoA=alphaprot until the pilot moves the sidestick. Maintaining alphaprot stick-free prevents the airplane from stalling...

As we all now know from earlier posts, no such thing as "stall speed" its all about AoA. The A340 clearly went into a 'ballistic trajectory" too slow to maintain level flight at that altitude even with full thrust, around 20 seconds of "less than 1g" as it went over the top with a sharp drop in pitch angle? Its not too clear to me whether it was the pilot or protections that successfully managed the flightpath to recover speed. No mention of stall warnings, and as previously commented AoA not shown, nor how how deep the nose down pitch during recovery. See also Sully's landing on the Hudson - pilot or protections managing pitch/AoA?

BOAC

27th Jun 2011, 10:09

No - you are right, HN, my mistake and I have edited my post - not stall speed, but pretty slow whatever you call it.
In cruise, VLS is a speed that provides a certain margin (0,3 g?) to buffet onset. The zoom climb occurred because the FCS entered into alpha-prot law and then maintains AoA=alphaprot until the pilot moves the sidestick. Alphaprot is less than alphamax and maintaining it stick-free prevents the airplane from stalling. - please explain the logic here - the a/c was now here near 'stalling' when it all started and was then placed near it by the software??? So why? This defeats me. Suppose for a moment that this happened to 447. Desirable - no. Helpful - no. On a dark night in the ITCZ, confusing - yes. We know that the alpha-prot 'inhibit' would probably have been disabled by the IAS readings.

rudderrudderrat

27th Jun 2011, 10:30

Hi DozyWannabe,
That said, if the pilot doesn't like what autotrim is doing all he or she has to do is keep their hand on that trim wheel.
True, but that is not in any QRH / FCOM procedure. Additionally, in all laws (except Direct Law) the elevators will attempt to maintain the last requested pitch attitude (1g value) even when stick free. So there would still be no "feel" in pitch that the aircraft was slowing down. Deprived of reliable airspeed indications and pitch feel, I believe the crew would have had a more difficult task to avoid a stall than if they had been in a conventional aircraft.

AlphaZuluRomeo

27th Jun 2011, 11:40

Hi wallybird7
Auto Trim is not a primary flight control. Therefore the crew's control was restricted. You cannot recover an out of control plane with trim alone.
Never did I say that one can recover an out of control plane with trim alone.
And I do agree that the (auto) trim seems weird, based on the may 27th note : why did it go (almost) full NU, but didn't go less NU (or ND) when the crew pushed the sidestick ? Many answers come to mind, I choose to wait for more data on that.
That said, and it's all about semantics :
- the alpha prot/alpha floor protection in normal law does restrict the crew's control
- the bank angle protection (67° max) in normal law does restrict the crew's control
- the overspeed protection (inducing a NU command) does restrict the crew's control
- OTOH, the Auto Trim doesn't restrict the crew's control (until proven there was a mechanical and/or logical/software failure). It is designed AFAIK to follow the crew's commands (and to maintain 1g without crew's command).
And as DW stated : if the pilot doesn't like what autotrim is doing all he or she has to do is keep their hand on that trim wheel.
That's the difference I make between restricted and not restricted. And it certainly doesn't mean that I try to say the plane is "perfect" and the blame must "go to the crew". That's not what I think ;)

HazelNuts39

27th Jun 2011, 12:47

... - please explain the logic here - the a/c was now here near 'stalling' when it all started ... Turbulence caused a momentary excursion of "phase advanced" AoA beyond alpha-prot, and that put the FCS into alphaprot law (High AoA protection). That protection is lost in Alternate Law 2. I believe I have read on this thread that this particular logic has been changed as a result of the A340 AirProx incident.

DJ77

27th Jun 2011, 12:56

The people that designed these systems weren't stupid, and I'm sure there are very logical reasons for the system being designed the way it is. Remember that this was designed to be the next generation of flight controls - doing things a certain way because that was the way they'd been done since WW2 (or even beforehand!) wasn't a valid design input. Being as friendly and logical to the pilot as possible certainly was, the only problem with that being that some pilots prefer different things.

The way we flew airplanes before FBW had been refined over decades and was satisfying almost everyone. Why change? Why did Airbus needed to invent a new way of flying airplanes? Until now, I fail to be convinced the reason was for the pilot’s better.

It is my opinion that, after going FBW was decided, the governing specification was to extract the highest possible performance and reliability benefits off the new technology, a respectable challenge for designers, I must say. You can easily trace the major changes that took place and see where the focus was.

In the team that overview specs, the engineer/pilot balance favored the former. Of course, the engineers made a very good job. They reached their goals. Then, they managed to make the design acceptable by certification authorities and by line pilots, a not-so-easy task.

The Airbus FBW provides an elaborate high AoA protection in normal law. Is it just because it was not required by regulations that unless you trip the auto-trim it does not even provide classical low speed longitudinal stability in ALT law?

jcjeant

27th Jun 2011, 13:04

Hi,

BOAC
I still remain surprised that the 2001 near accident to the 340 which entered an un-commanded zoom climb to a very low speed remains dismissed by many?
And I still remain surprised that the AF445 event remain dismissed by many
Even the BEA was forced to remain dismissed
However, investigators have recently received a new report, more substantial than the first. "He has no objective value, says one close to the investigation. The company has just said it was a non-event and that the crew may have overreacted. " The side of the BEA, the investigators' regret not having the AF445 flight data that could shed new light on what occurred on Flight 447. " On Dec 17th the French BEA reported, that according to the air safety report (ASR) filed by the captain immediately after arrival in Paris the airplane was at FL380 about 60nm ahead of DEKON on airway UN866, when weather forced the crew to divert from the airway and descend to FL360 employing oceanic contingency procedures after being unable to obtain clearance from ATC. Air France however did not forward the ASR to the BEA within 72 hours as required by law. Instead, the airplane was dispatched again without downloading the flight data recorder, according to the airline the airplane flew to Bangalore (India) and back (flight AF-192 and AF-191), after which both cockpit voice recorder and flight data recorder were overwritten. The quick access recorders had a formatting error and were not useable according to the airline.
Incident: Air France A332 over Atlantic on Nov 30th 2009, Mayday call due to severe turbulence (http://www.avherald.com/h?article=42380873&opt=0)

BOAC

27th Jun 2011, 13:04

Turbulence caused a momentary excursion of "phase advanced" AoA beyond alpha-prot, and that put the FCS into alphaprot law (High AoA protection). That protection is lost in Alternate Law 2. I believe I have read on this thread that this particular logic has been changed as a result of the A340 AirProx incident. - yes, but that does not explain the logic, merely the mechanism. Why is it so designed that it operated in cruise? Why did the a/c need "High AoA protection" whilst in a high altitude cruise, and such that it would pitch the a/c up into a ...........High AoA environment? I understand the 'change' was an inhibit related to a certain Mach - not particularly useful, I feel, in an a/c without ADC data?

JC - on the face of it, 445 looks quite different. The primary need for investigation is in the handling by AF of the report and data, I think.

DozyWannabe

27th Jun 2011, 13:49

The way we flew airplanes before FBW had been refined over decades and was satisfying almost everyone. Why change? Why did Airbus needed to invent a new way of flying airplanes? Until now, I fail to be convinced the reason was for the pilot’s better.

*Part* of the reason was, otherwise, why would they have bothered including pilots in the requirements capture phase? Also, what you're saying is just not accurate. The fact is that the "refinements" you're talking about were inexorably leading up to the point where FBW would be introduced in airliners, it was just a question of when and how. The aircraft on the drawing board in the mid-60s (B747, DC-10, L-1011) simply weren't capable of being controlled by the mechanical linkages that had been used in the past, and so the decision was made to go all-hydraulic. This led to it's own set of problems, but that's a subject for another time. FBW technology had been around since the '60s and there were a lot of advantages to it's use. It had also undergone many refinements since its introduction, making it a logical choice for fighter jets in the '70s and - as had always been the case before, what was good for the military found its way into civil aviation a few years later.

I still believe Airbus missed a trick by not instituting a pilot outreach programme at the same time it was courting airlines with the economy and safety aspects. All they had to do was say to pilots "Look, our aircraft fly like spacecraft - want to know how Neil Armstrong felt in the Eagle?", and I suspect it may have been looked on a lot more favourably. Much is made by Airbus detractors of the involvement of Bernard Ziegler in the early days of the Airbus FBW programme, which is fair enough - he's a controversial individual who said some less-than-clever things. However not so much is made of the presence of Gordon Corps at the same time - I don't think he could be described as anything other than a "pilot's pilot", and he was *very* comfortable with the design. There's a thread kicking round here somewhere from someone who was suspicious of the A320's ability to get out of extreme situations and Captain Corps took him up on the challenge - in every case the A320 in Normal Law fared better than the conventional aircraft, albeit in the simulator.

When I first read HTBJ, I was struck by D.P. Davies mentioning that some in the piloting fraternity kicked up an almighty stink about the presence of the "stick pusher" in CAA-certified aircraft - the arguments used then were much the same as those made against the Airbus FBW system today - claims of "encroachment on a pilot's authority" etc. The "stick pusher", as many will know, was a simple hydraulic ram system designed to force an aircraft which did not have good stall characteristics (particularly rear-engined T-tail designs, but a "stick nudger" was fitted to all G-registered B707s as well) into a nose-down attitude, and yet pilots of the time still claimed that it was a technological step too far. In other words, the bunfight that always occurs when the subject of automation comes up is nothing new.

The truth is that while Airbus marketed their FBW designs as a quantum leap forward, in fact it was very much an evolutionary rather than revolutionary step in terms of aeronautics - the only thing radical about it was that it was the first time it had been applied to an airliner. Boeing knew this too, and that's why the B777, when it arrived, was basically a FBW airliner with a computer-controlled force-feedback system, kind of like how a nicotine inhaler is compared to a cigarette - the old feelings are all there, but it's artificial - under the hood it's a very similar computer-driven system to that of the FBW Airbii.

Is it just because it was not required by regulations that unless you trip the auto-trim it does not even provide classical low speed longitudinal stability in ALT law?

Whether it has "classical low speed longitudinal stability in ALT law" has yet to be confirmed - I'd need someone who's more familiar with the systems to answer that question.

HazelNuts39

27th Jun 2011, 15:23

The way we flew airplanes before FBW had been refined over decades and was satisfying almost everyone. Why change? Why did Airbus needed to invent a new way of flying airplanes? Until now, I fail to be convinced the reason was for the pilot’s better.DozyWannabe's #451 describes very well my own thinking on the matter. I've had no professinal involvement with FBW but witnessed that evolution from the sidelines. I saw the evolution from fully mechanical controls, through mechanical with hydraulic boost, to hydraulic with mechanical backup plus AFCAS (Auto Flight Control and Augmentation System, IIRC) plus FMS. If I had to reply to this kind of question from a fellow-layman across the street, I would say that Direct Law gives you an airplane pretty much as a conventional airplane, but gets rid of the weight, maintenance burden and vulnerability of cables and pulleys. Alternate Law uses the opportunity that FBW offers to make the airplane easier to fly by ironing out the 'imperfections' that conventional airplanes have: it provides stability in roll and pitch, adds turn coördination and dutch roll damping. Normal Law then adds the envelope protection, and with it the age-old debate about "encroachment on a pilot's authority", expertly discussed in DW's post.
I believe that envelope protection enhances safety, even if it turns out to have features that can be improved in the light of service experience.

The question of when auto-trim should be on or off is not limited to FBW in my view, and I must admit that I don't understand the drama that some make of it. As I view it, when it operates, autotrim obeys the pitch-orders from sidestick or AP by following the elevator. If the order is nose-up, THS trims nose-up. If the order is nose-down, THS trims nose-down. At FL350 there was plenty of time for that to take effect. Maybe I got that all wrong.

A33Zab

27th Jun 2011, 15:35

A33Zab;

Your "Chronology of events @ 5 sec interval." has a column headed "STALL AoA". I presume that is 'alpha-max', which is not stall AoA but somewhat less. Alphamax varies with Mach number as shown on a graph posted a few days ago. For the Mach numbers in your table:

Mach ... alphamax

0.8 ......... 5.2
0.68 ........ 7.1
0.64 ........ 7.7
0.59 ........ 8.1

Actually, I used the AOA Stall warning trigger values.

Mach threshold ... AOAsw (I did edit this in the chronlogy diagram)
0.82 .................... 3.8
0.75 .................... 5.2
0.53 .................... 7.6
0.35 .................... 9.9
<=0.28............... 10.8

BEA Report 2:

In alternate or direct law, the angle-of-attack protections are no longer available
but a stall warning is triggered when the greatest of the valid angle-of-attack values exceeds a certain threshold.
In clean configuration, this threshold depends,in particular, on the Mach
value in such a way that it decreases when the Mach increases.
It is the highest of the valid Mach values that is used to determine the threshold.
If none of the three Mach values is valid, a Mach value close to zero is
used.
For example, it is of the order of 10° at Mach 0.3 and of 4° at Mach 0.8.

I've added your values in a separate Alpha max column.

OK465

27th Jun 2011, 17:12

As I view it, when it operates, autotrim obeys the pitch-orders from sidestick or AP by following the elevator. If the order is nose-up, THS trims nose-up. If the order is nose-down, THS trims nose-down.

Just for information...

Under many conditions, there are times in both Alternate and Normal laws when the auto-trim will briefly operate opposite the pilot SS input when the SS input causes the aircraft to experience "G" noticeably above or below 1 "G" as displayed in amber on the lower display.

The same thing occurs in terms of elevator surfaces movement (SD F/CTL page) if the manual trim wheel is rolled briskly in one direction or the other with hands off the SS, i.e. the elevator will briefly deflect opposite during the manual trim wheel input.

Lonewolf_50

27th Jun 2011, 17:32

OK, what you describe strikes me as a design "feature" that is aimed at mitigating over control, or enhancing a stability function.

But I may misunderstand you.

Is the "opposite" input driven after the initial response following SS input, or it is made if the SS input exceeds a certain rate? :confused:

OK465

27th Jun 2011, 17:51

LW 50:

My impression is that it's rate driven. It is most noticeable with more aggressive SS inputs creating "G" excursions, and does not occur while making the slower smooth SS inputs associated with normal flying technique.

Only my impression though, I don't know what all the computers are "discussing" at this point. I do know it has no impact on aircraft control and doesn't bother me.

A33Zab

27th Jun 2011, 17:59

Quote:

Er, I'm pretty sure this was discussed on the previous thread - some time ago they not only "admitted" that it was a problem, they changed the behaviour so that when A/THR kicks out, the thrust remains at the last setting the A/THR commanded. The thrust setting does not change until the pilots touch the thrust levers.
I hope you are correct, and indeed if you are, I am more than willingly to retreat.

Looking at post #379 and that graphic, it seems to show that that thrust went to TOGA @ 2:10:51.

Then again the handling pilot may have selected TOGA rather than AT logic.

Time will tell.

This is correct,
thrust(N1) will be locked untill PF move T/L out of climb detent.
The cyan "Predicted N1(TLA position)" indicator is visible at the outer edge of the N1 scale.
To make the T/L setting in agreement with N1, PF needs to move T/L, as indicated by TLA position indicator, towards the N1 pointer (locked).
This must be done in 1 continuous movement otherwise N1 will travel towards this TLA pos 'bug' once TLA is out of Climb detent.

Forget the transient and trend indications these are only available in A/ Thrust.

http://i474.photobucket.com/albums/rr101/Zab999/N1Indic.jpg

henra

27th Jun 2011, 19:56

7) Uncommanded 7000 fpm climb. Despite the plane being at it’s maximum cruising altitude. Evidence of 60-70 kt updrafts according to meteorological analysis.
8) Airspeed falling to below 60 kts.
9) Flight controls ineffective below 120 kts.

Although I don't disagree with much of what you wrote these items warrant some comments.

- Uncommanded climb:
Unsure what you consider uncommanded. BEA note stating that PF commanded NU on the stick prior to this climb points to the fact that it was at least not completely uncommanded although we don't know if it was deliberate (potentially not).
- Evidence of 60-70kts updraft:
I'm not aware of any indication/confirmation that the plane encountered significant updraft.
- Aispeed falling to 60kts:
Almost surely only the measured speed in the pitot due to stall of the airflow into the pitot. AoA during descent + descent rate points towards a horizontal airspeed >120kts until very shortly prior to impact where it decreased to 107kts.
- Flight Control ineffective below 120kts: Im not aware we have any positive confirmation for this although it is reasonable to assume that their effectiveness will be reduced below that speed.

wallybird7

28th Jun 2011, 00:28

Hi Henra

All Valid questions.

“Uncommanded 7000 fpm rate of climb”. Why I think that it was uncommanded.

When a plane is at max cruising altitude (35,000) which the crew noted because the temps were higher than forecast, and therefore unable to maintain a higher altitude, why would they intentionally try to do it? Why would they climb to a higher altitude when they knew they could not maintain it?

In weather a normal climb should not exceed 1000 fpm. Beyond that you are out of normal control. Without access to the performance charts I can’t believe it would be possible to execute a climb at a higher rate than that.

There was never any indication that the pilot requested a climb nor received clearance for one.

At the same time, all hell broke loose and everything turned off.

What would cause all of these events?

Would entering a severe thunderstorm have anything to do with it?

The meteorological analysis showed evidence of strong up and down drafts of up to 60-70 knots. Which translates into 6000-7000 fpm rates of climb approximately.

Is it possible that the plane encountered a severe updraft that carried or pushed it up to a rate of 7000 fpm? Is it possible that the updraft or severe turbulence pushed the nose down at the same time the plane was gaining altitude? And if so, is it not possible that the trim reacted in the opposite direction?

And with the pitots icing up is it possible that the sensors were providing false info to the computers? Some indicate overspeed, some indicated > 60 kts. Which is which?

Was it the pilot commanding nose up or the trim system itself? Which?

And at the top of the zoom what was the state of the plane? To me in a stall that they never recovered from.

Check the charts to determine minimum control speed. I know if you’re anywhere near 120 kts you better be on the ground. Not at 35,000 feet.

Do we really “know” any of this? Of course not. Nobody does or ever will.

wallybird7

28th Jun 2011, 00:38

bubbers44

28th Jun 2011, 01:00

WB, yes we agree no normal pilot would pull the side stick up at that altitude for loss of airspeed indication but according to the BEA report they did. No pilots I know would do it so why did they? The BEA report said they pulled full back, I would like to hear the CVR for why they thought that was necessary. Some day we will hear it. Probably well after the Paris air show.

JD-EE

28th Jun 2011, 04:03

jcjeant, I have been on a plane when the pilot ordered the cabin crew to their seats and said there will be some heavy turbulence. So a simple "watch out" is not even severe turbulence as I've ridden through going from the ONT to ORL or MSP. I'd not read too much into that warning to the cabin crew.

Now, there is a theory that they saw the storm ahead, thought they had a clear path, and discovered it was blocked at the far end by the grand-daddy storm. This supposes misuse of the radar due to, you guessed it, lack of training.

JD-EE

28th Jun 2011, 04:06

Lonewolf 50, "If the aircraft "knows it is stalled" but the pilots don't, what are your suggestions?"

If the aircraft is well enough instrumented to detect a stall (an AoS sensor we know it has) then why in the seven circles of Hell is that data not on the pilots displays?

JD-EE

28th Jun 2011, 04:11

jcjeant, regarding short data recorders it'd be nice if the plane was also wired with a 256 gigabyte auxiliary solid state disk on the FDR and CVR that recorded simultaneously with the survivable disk. That should be moderately recoverable in some crashes and would also have upset (and normal) data virtually for the full life of the plane.

jcjeant

28th Jun 2011, 05:10

Hi,

jcjeant, regarding short data recorders it'd be nice if the plane was also wired with a 256 gigabyte auxiliary solid state disk on the FDR and CVR that recorded simultaneously with the survivable disk. That should be moderately recoverable in some crashes and would also have upset (and normal) data virtually for the full life of the plane.

You forget to open the "sarcastic mode" ... this can help some who don't clever follow this thread :)
I suppose it's lesson learned for AF and they are presently installing the system you advocate ... :sad:
How do they not have thought of earlier ? ... it is a mystery that adds to all those already mentioned in this thread :8

sensor_validation

28th Jun 2011, 08:59

Hi Sensor

As we all now know from earlier posts, no such thing as "stall speed" its all about AoA.

In all my years in aviation there were no AoA indicators flying mostly all the A/C made in the US. It was/is all about Stall Speed.

Take-off speed, V1, Vr, V2, climb speed, and approach speed -- all based on STALL SPEED.
Fighters, Transports, DC-4, L-188, B-737,27,57,67. A-310, L-1011, DC-10 etc

So the A-310 didn't use this same AoA stall definition philosophy?

Technically a stall is about airfoils and peak lift AoA, and in a complex wing shape as the A330 this will not be a sudden transition.

There is a definition of "stall speed" which is the "speed below which the airplane cannot create enough lift to sustain its weight in steady 1g flight", and it is clear to me that the A340 in the airprox event went below this. The AF447 must have been close when almost levelling off @37,500 hence I have previously questioned the timing of stall warnings.

HazelNuts39

28th Jun 2011, 09:44

Uncommanded 7000 fpm rate of climb”. Why I think that it was uncommanded.
When a plane is at max cruising altitude (35,000) which the crew noted because the temps were higher than forecast, and therefore unable to maintain a higher altitude, why would they intentionally try to do it? Why would they climb to a higher altitude when they knew they could not maintain it? In weather a normal climb should not exceed 1000 fpm. Beyond that you are out of normal control. Without access to the performance charts I can’t believe it would be possible to execute a climb at a higher rate than that.
The DFDR data released in the BEA Update point in the direction of an initial climb that was commanded but unintentional and unnoticed. The performance charts you refer to show the rate of climb obtainable at constant Mach and CLB power setting. The 7000 fpm was not sustainable, it was obtained at the expense of airspeed.

The meteorological analysis showed evidence of strong up and down drafts of up to 60-70 knots. Which translates into 6000-7000 fpm rates of climb approximately. Is it possible that the plane encountered a severe updraft that carried or pushed it up to a rate of 7000 fpm? Is it possible that the updraft or severe turbulence pushed the nose down at the same time the plane was gaining altitude? And if so, is it not possible that the trim reacted in the opposite direction?The Meteo France analysis in Appendix 1 of BEA's Interim report no.1 states (values in knots added by me):
The strongest vertical movements are observed in the "tower" of the cumulonimbus in its phase of rapid growth, that is to say before the top reaches the tropopause and the anvil is formed. The upward speeds can then reach 110 km/h (60 kt) and the downward speeds 50 km/h (27 kt). The vertical speed can thus vary very rapidly inside of the cumulonimbus while crossing its "tower": variations of more than 70 km/h (38 kt) in the space of 2 km have sometimes been observed.
(and somewhat later):
Analysis of infrared imagery does not make it possible to draw a conclusion on the presence of extremely powerful vertical movements, associated with of the "overshoot" phenomena.Tim Vasquez' analysis mentions that "updraft velocities of 20 to 40 kt occur occasionally" in oceanic equatorial cumulonimbus clouds.

There is no evidence at all that these updraft velocities existed in the CBs that AF447 was trying to avoid, nor that they were actually encountered.

In all my years in aviation there were no AoA indicators flying mostly all the A/C made in the US. It was/is all about Stall Speed.The 1 g stall speed is obtained at 1 g at the stall AoA. It serves as a reference for operational minimum speeds such as take-off speeds, V1, Vr, V2, climb speed, and approach speed.

The stall itself occurs at the stall AoA, not at a particular speed, but at particular combinations of airspeed and "gee".

DJ77

28th Jun 2011, 09:49

Hi HN39, re # 452

I too started my career with mechanical controls and I have really nothing against FBW or automation: I enjoyed it during my last 10 years on the 777. Perhaps it is not necessary to call Darwin :).

I think you missed my point about what I called “a new way of flying aircrafts”. It’s a way you don’t learn at flight school (at least not yet). I meant the throttle system, the sidestick controller with the mechanical link replaced by a priority pushbutton, the auto-trim and perhaps other minor systems. I understand these choices and see that they were, justified from an engineering POV. Airbus knew they were removing some feedbacks the pilots were used to. They admittedly tried to mitigate the drawbacks but pilots had to adapt. These changes were not introduced to please the pilots. Pilots don’t buy airliners anyway, airlines do.

About the auto-trim, when AoA protection is active, further nose up trim cannot be applied. You must move the sidestick backward to fly at a greater AoA. With neutral stick, speed will return to alpha prot speed. This provides stability. In ALT law, when AoA protection is not available, auto-trim is always active. Chris Scott explained that the THS would move to full nose up when unable to satisfy positive g demand in a stall. Is he wrong?
I am sure you know flight dynamics enough to understand why preventing the THS to trim up as soon as stall warning is triggered could achieve.

HazelNuts39

28th Jun 2011, 10:46

- yes, but that does not explain the logic, merely the mechanism. Why is it so designed that it operated in cruise? Why did the a/c need "High AoA protection" whilst in a high altitude cruise, and such that it would pitch the a/c up into a ...........High AoA environment? The function of the High AoA protection is to keep the airplane out of the stall. So it is entirely logical that this function is activated at an AoA that is sufficiently close to alpha-max so as not to hinder normal operations, yet far enough below it to ensure correct operation in all reasonably expected operating conditions. These considerations govern the selection of alpha-prot.

What might be considered illogical are certain aspects of its implementation. The AoA vanes obviously cannot distinguish between the 'mean AoA' and the short-period fluctuation caused by turbulence. These fluctuations can be mitigated by suitably filtering the AoA signal, but that would make it less sensitive and hence increase the necessary margin between alpha-prot and alpha-max. Obviously you wouldn't want to filter out the 'real' increase of AoA that occurs when the airplane flies into the powerful updraft that some posters on this thread theorize about. The designers have made the opposite choice by applying "phase advance", which amplifies the sensitivity to turbulence. I guess you need to ask the designers to elaborate the pros and cons of their choice.

The other illogical element in my view is that alpha-prot law is not cancelled when AoA decreases below alpha-prot. Again I suspect that that choice has been made after intensive investigation of all the "what if"-s, but you have to ask the designers.

Every design involves compromises between conflicting requirements ...

BOAC

28th Jun 2011, 11:05

The function of the High AoA protection is to keep the airplane out of the stall. So it is entirely logical that this function is activated at an AoA that is sufficiently close to alpha-max so as not to hinder normal operations, yet far enough below it to ensure correct operation in all reasonably expected operating conditions. These considerations govern the selection of alpha-prot. - I am aware of all that, but it does NOT explain why the a/c was pitched by the system towards alpha max from level cruising flight - that is the explanation I am seeking. I can see absolutely no logic in this function.

Can anyone?

HazelNuts39

28th Jun 2011, 11:28

- I am aware of all that, but it does NOT explain why the a/c was pitched by the system towards alpha max Maybe you haven't fully digested my sentence: The other illogical element in my view is that alpha-prot law is not cancelled when AoA decreases below alpha-prot. Otherwise, what would you propose for the protection to do once it has been activated?

BOAC

28th Jun 2011, 12:01

The other illogical element in my view is that alpha-prot law is not cancelled when AoA decreases below alpha-prot. - do I take it that you are saying that the 2001 incident was caused by alpha reaching alpha-prot during an over-speed event, then?Otherwise, what would you propose for the protection to do once it has been activated? - I would suggest that a far better solution would have been to have it NOT activate in the first place?

HazelNuts39

28th Jun 2011, 12:06

BOAC;

I resign.

Lonewolf_50

28th Jun 2011, 12:31

There is no evidence at all that these updraft velocities existed in the CBs that AF447 was trying to avoid, nor that they were actually encountered.
If I may be pedantic for a moment, the absence of evidence is not evidence of absence.

The range of potential updraft and downdraft magnitudes you present, (28 kt to 60kt, depending) bounds the issue wally is pointing to well enough.

There is no reason to believe there wasn't some vertical movement in the vicinity. The questions are:
a. Did they hit a patch of it at some point during the event?
b. What was the magnitude?

Vertical air column velocity, were it encountered, would vary from about 2800 fpm to 6000 fpm based on the numbers you offer in your response to wally. That cannot account for the 7000 fpm climb by itself. It seems pretty obvious that the "big climb" was an energy tradeoff, if not in whole than at least to a substantial degree. There may still have been some vertical airmass aiding and abetting this excursion.

Take the smaller magnitude, for example. Assume for a moment that the plane encounters a 2800 fpm up draft as the pilot has begun to operate in alternate law. To get the 7000 fpm vertical rate, the pilot contributes about 4200 fpm to that via trading energy for altitude ... that's a hell of a change from level flight.

If the magnitude of air column movement is at the higher end, 6000 fpm, then the pilot (or the pilot and the plane, if that's how one sees this event) contribute about 1000 fpm to that dramatic initial climb toward 37,000 plus.

That climb input fits wally's 1000 fpm standard, doesn't it? Sure, but one still needs to consider the pitch attitude. As I was trained, when penetrating turbulent air in instrumnt conditions, you set a pitch attitude (wings level) and do your very best to maintain that pitch attitude as you get bounced around, until you get to the other side of the turbulent patch of air. The FDR data points to attitude increasing, not remaining at a particular value.

Given that data, it is unreasonable to assert (wally) that an updraft is the sole, or even primary, cause of that initial rapid climb.

That doesn't mean that vertical air movement necessarily had no input. It's an unknown, but there may be some indirect evidence that BEA can analyze to get a better grasp on that.

A gust load of that magnitude from outside would, I think, leave a trace in the g sensed by the flight control system. Whether or not this is a parameter captured by FDR is another matter. I don't understand the FDR well enough to say. I also don't grasp how the flight control system filters such external loads in the various laws.

OK's point on rate and dampening suggests to me that the system does filter of such external inputs, perhaps as part of the stability features.

sensor_validation

28th Jun 2011, 12:33

- I am aware of all that, but it does NOT explain why the a/c was pitched by the system towards alpha max from level cruising flight - that is the explanation I am seeking. I can see absolutely no logic in this function.

Can anyone?

If we are still discussing the A340 airprox the only explanation I have is that with A/P off due to overspeed, so flight control in Normal mode, engines put to idle by pilot action to stop the engine cycling. Turbulence caused a predicted AoA measurement above alpha prot and the High alpha protection triggered to keep the AoA down to alpha prot. Also possible the initial pitch up triggered "alpha floor" and the subsequent pitch up was in response to the sudden throttle increase?

Further references - first is by mm43?
A340 - A330 Control: Flight & Laws (http://countjustonce.com/a330/a330-flight-laws.html)
Aerospace/Aviation: Airbus, thrust levers, thrust system (http://en.allexperts.com/q/Aerospace-Aviation-2437/Airbus.htm)

Only direct relevance to AF447 is that if the pitch up can be caused by an AoA spike we have possibility of a QF72 style (pitch down) uncommanded pitch up if there was a period on Normal before Alt2? I do not believe QF72 event ever explained - two faults one the generation of spurious spiky AoA data, the second the incorrect use of the bad data - they were waiting for further info from AF447 before finalizing report - hardware not identical, but maybe control philosophy?

DJ77

28th Jun 2011, 13:14

the absence of evidence is not evidence of absence.

There is evidence of absence. You can do the energy calculation yourself or look at http://www.pprune.org/tech-log/454653-af-447-thread-no-4-a-10.html#post6523817

fyrefli

28th Jun 2011, 13:37

Zipser states that updrafts are usually strongest in the upper troposphere compared to lower levels

(is the bit immediately before...)

Tim Vasquez' analysis mentions that "updraft velocities of 20 to 40 kt occur occasionally" in oceanic equatorial cumulonimbus clouds.

There is no evidence at all that these updraft velocities existed in the CBs that AF447 was trying to avoid, nor that they were actually encountered.

This was discussed in the first thread very shortly after the accident.

As was pointed out at the time, 20kt is only 10m/s. I say "only", as many glider pilots will be familiar with benign - if somewhat exciting under a paraglider! - climbs of this type at low levels. On a decent, post-cold frontal day in the UK - not exactly known for the relative strength of its thermals - it would be disappointing not to get climbs of 5m/s under small, perfectly benign, 10 minutes later they're gone, fluffy little white cumulus clouds. If "updrafts are usually strongest in the upper troposphere compared to lower levels", then 20 to 40kt seems quite a conservative estimate.

It would surprise me - and I suspect most glider pilots - if you could find any self-respecting cumulonimbus that *didn't* contain updrafts of at least 20kt.

EDIT: Note that I am *not* arguing that a strong updraft caused the zoom climb or had any other bearing on AF447, merely re-iterating, for the benefit of latecomers, comments made a long, long time ago on the above analysis.

HazelNuts39

28th Jun 2011, 13:58

the absence of evidence is not evidence of absence. There is evidence of turbulence - I think it caused the "stall warning twice in a row" shortly after 2:10:05. There is evidence of the absence of a strong, sustained updraft that "pushed" the airplane up to FL380 before 2:11:06 - see below.
Vertical air column velocity, were it encountered, would vary from about 2800 fpm to 6000 fpm based on the numbers you offer in your response to wally. That cannot account for the 7000 fpm climb by itself. It seems pretty obvious that the "big climb" was an energy tradeoff, if not in whole than at least to a substantial degree.Precisely. A strong, sustained updraft would have been evident as an increase of the total energy of the airplane. On the contrary, there was a slight decay of total energy up to the point where the airplane stalled. Another poster on this thread has correctly explained that decay as the result of thrust reducing with altitude and increased drag due to manoeuvering airloads.
Assume for a moment that the plane encounters a 2800 fpm up draft as the pilot has begun to operate in alternate law. To get the 7000 fpm vertical rate, the pilot contributes about 4200 fpm to that via trading energy for altitude ...Not so. The gain in altitude is entirely consistent with the loss in airspeed, except for the decay discussed above.
A gust load of that magnitude from outside would, I think, leave a trace in the g sensed by the flight control system. Agreed, and on the AoA trace, and also small-scale turbulence would appear as "grass" on those traces, provided the sampling rate is high enough. These can be separated from changes due to control inputs by looking at the traces of elevator and THS position, and sidestick positions.
I also don't grasp how the flight control system filters such external loads in the various laws. If you are referring to my reply to BOAC, I didn't say that the FCS filters loads. I was referring to signal conditioning that suppresses high-frequency content of, e.g., the AoA signal, before it is passed on to the consumers.

Lonewolf_50

28th Jun 2011, 14:25

If you are referring to my reply to BOAC, I didn't say that the FCS filters loads. I was referring to signal conditioning that suppresses high-frequency content of, e.g., the AoA signal, before it is passed on to the consumers.
Thanks for your reply.

I wasn't referencing your reply to BOAC on the matter of filtering out the loads imposed on the airfoils by factors outside the flight control system (Turbulence, etectera).

I was more of less "thinking aloud" based on some of the block diagrams of the flight control system, and considering how the installed stability functions (In normal or alt laws) would first sense, and then account for inputs to the system from outside the aircraft, as opposed to adjusting for inputs from within the control system.

DJ77: thank you. :) Re-reading that got the point across.

Caveat: the assumption that the air mass data (airspeed/Mach) were not already beginning to degrade by that point, but it seems a safe assumption based on when alerts and miscompares show up on the record.

SDFlyer

28th Jun 2011, 14:52

HN39: "The other illogical element in my view is that alpha-prot law is not cancelled when AoA decreases below alpha-prot. Again I suspect that that choice has been made after intensive investigation of all the "what if"-s, but you have to ask the designers."

Perhaps it is a naive question, but why is there not more information available (public domain) about the choices made by the system designers, so that certain excellent questions raised by HN39 and others can be better addressed? I understand that there may be proprietary matters at stake but in other industries, such as my own, critical safety-related matters are fairly openly disclosed/discussed. The regulators enforce it, for one thing. Is there no technical journal in which such matters can be presented and discussed? If there is such a journal, is it serving this purpose to the full?

Anyway, I'd like to thank HN39 and others for so patiently and clearly explaining their thoughts on the matter - I speak for many who are learning a lot about Airbus detection and control systems in this thread.

Please carry on.

grity

28th Jun 2011, 14:57

BOAC - I am aware of all that, but it does NOT explain why the a/c was pitched by the system towards alpha max from level cruising flight - that is the explanation I am seeking. I can see absolutely no logic in this function.

Can anyone?
"AAIB Bulletin No: 6/2001: Consequently, in turbulence the speed scale will probably be oscillating, the aircraft pitch angle could also be oscillating..."

if the bird flow for sume time nearly in a balistic curve, the AoA vane is in a stable normal position... no AoA protection will start working

AoA protection alone seems not very good for stable flight

the climb-input is interesting, after the stopp of the autopilot they moved the elevator up to +4 for ten sec. but in the following seconds the G falls to 0.5 and the pitch drops a little down (!) IMO this needs good downwind. then they hold the elevator between 0 and -3 and pushed the 4 engines this must be the climb-input, mayby together with the autotrim

ar you shure AoA reached alpha max? nighter the trim nor the AoA is shown in the diagram. the climb after the startinput could also happen with a lower AoA....

DozyWannabe

28th Jun 2011, 15:02

@SDFlyer - There are plenty of links in this thread and the previous ones to Airbus documents that describe the various systems and mode reversions, along with the logic that triggers the latter.

Am at work now, so can't hunt them down myself, but they're there. I think the one you're looking for would be called "Airbus Control Laws".

HarryMann

28th Jun 2011, 15:07

What might be considered illogical are certain aspects of its implementation. The AoA vanes obviously cannot distinguish between the 'mean AoA' and the short-period fluctuation caused by turbulence. These fluctuations can be mitigated by suitably filtering the AoA signal, but that would make it less sensitive and hence increase the necessary margin between alpha-prot and alpha-max. Obviously you wouldn't want to filter out the 'real' increase of AoA that occurs when the airplane flies into the powerful updraft that some posters on this thread theorize about. The designers have made the opposite choice by applying "phase advance", which amplifies the sensitivity to turbulence. I guess you need to ask the designers to elaborate the pros and cons of their choice.

That whole statement seems to imply a much wider bandwidth and shorter time constant for a mechanical AoA sensor than ever likely. Also implies that anyone would be interested in small scale high frequency turbulence... that would be for a hot-wire anemometric device if we're into the business of looking at 'gustiness', which I'm pretty sure we aren't

infrequentflyer789

28th Jun 2011, 17:35

- do I take it that you are saying that the 2001 incident was caused by alpha reaching alpha-prot during an over-speed event, then?

I don't think anyone is suggesting that.

Transient overspeed in turbulence prompted the crew to close the throttles.

As speed reduced, turbulence then caused transient increase of alpha to exceed alpha-prot (or the predicted trend to exceed it), this engaged the alpha flight mode such that the neutral sidestick would command alpha-prot (and fully back, alpha-max).

If this is activated by a transient high alpha value, then when that transient effect goes away, you will get a climb. Alpha-floor then probably kicks in to increase the thrust after the pitch up.

- I would suggest that a far better solution would have been to have it NOT activate in the first place?

Ah, but under what circumstances ? Like all safety engineering, in some situations this feature will do the wrong thing (in others it can save you). Sometimes the only survivors are those thrown clear, sometimes it's only those who are belted in - so should we have seatbelts or not ?

Maybe this law should never activate in turbulence in cruise, but on the other hand if it had activated on 447 (which it didn't because normal law had been lost) then it would probably have avoided the stall. Or consider if the A340 crew in this case had been the ones to get "climb climb..." from TCAS

Graybeard

28th Jun 2011, 17:38

At the weekly Old Bold Pilots breakfast this morning, I asked the guy who was cognizant engineer on the stall warning computers for the DC-9 and MD-80. He was incredulous that the A330 Stall Warning would shut off below 60 knots airspeed. He said the AOA vanes on his planes would measure to about 50 degrees AOA.

I suspect the A330 vane mechanical limit is about 30 degrees, as I don't recall any greater AOA mentioned by BEA. Does anybody know?

henra

28th Jun 2011, 18:11

If I may be pedantic for a moment, the absence of evidence is not evidence of absence.

There is a much stronger argument against updraft and that is energy conservation.

Decreasing speed from 275kts to 215kts IAS at the apogee equals roughly 4100 feet altitude gain from an equal energy perspective.
Taking into account that there are some drag losses due to g load and roll the 3000 ft climb match excellently to the altitude gain to be expected by trading speed for energy based on the given data points.

Had there been an updraft the energy level at the apogee would have been higher.

BOAC

28th Jun 2011, 18:15

Originally Posted by BOAC http://images.ibsrv.net/ibsrv/res/src:www.pprune.org/get/images/buttons/viewpost.gif (http://www.pprune.org/tech-log/454653-af-447-thread-no-4-a-post6540637.html#post6540637)
- do I take it that you are saying that the 2001 incident was caused by alpha reaching alpha-prot during an over-speed event, then?

I don't think anyone is suggesting that.

Transient overspeed in turbulence prompted the crew to close the throttles.

As speed reduced, turbulence then caused transient increase of alpha to exceed alpha-prot (or the predicted trend to exceed it), this engaged the alpha flight mode such that the neutral sidestick would command alpha-prot (and fully back, alpha-max).

Ah well. You see what you see, I guess.

"If this is activated by a transient high alpha value, then when that transient effect goes away, you will get a climb. Alpha-floor then probably kicks in to increase the thrust after the pitch up." - That's really clever - when you inadvertently pitch too much, the system ensures you stay pitched too much. A climb no-one wants or needs - thanks AB!:mad:

God help us all.

Lonewolf_50

28th Jun 2011, 19:28

Decreasing speed from 275kts to 215kts IAS at the apogee equals roughly 4100 feet altitude gain from an equal energy perspective.

Taking into account that there are some drag losses due to g load and roll the 3000 ft climb match excellently to the altitude gain to be expected by trading speed for energy based on the given data points.

As noted above, it's a compelling argument providing the IAS information we are working with is accurate. Given "ordered" airspeed and "what it takes to stall" the measurement anomalies seem to wash out.

@BOAC, in re God help us all ...

Doesn't this take us back to why you must have humans on the flight deck and in command? The PIC must be in a position to override discrepant subsystems.

Systems will go squirrely.

That said, I agree with you that this particular feature might profit from some rethinking. Having read what you responded to, it makes no sense to me for this feature to be enabled at high altitude cruise. The feature appears to be primarily designed for flight regimes near to the ground.

galaxy flyer

28th Jun 2011, 19:48

Now, I am all in favor of FBW; it simplifies systems; saves weight, and increases efficiency. But, why did the engineers not just make it fly last the last 100 years of aviation. Speed stable (trim for a speed), back-driven so the pilots know what is happening with the stick and rudder, no obscure modes that are confusing in an emergency.

Oh, Boeing did that!

RR_NDB

28th Jun 2011, 20:17

GF, Hi

...in favor of FBW (http://www.pprune.org/tech-log/454653-af-447-thread-no-4-a-25.html#post6541465)

:ok:

...modes that are confusing in an emergency. (http://www.pprune.org/tech-log/454653-af-447-thread-no-4-a-25.html#post6541465)

:D

The "features" sometimes creates problems. Who will change that?

The "problems embedded in the features" could be eliminated?

It´s possible to identify it in the design? Could be testable?

A33Zab

28th Jun 2011, 20:23

More AOA sensor info!
- Operating Range 120º, limited by fixed stops.
- Balanced (= static it could take any position).
- Contains a dual purpose damping motor, damping the rotor in opposite direction of movement
created by Eddy Currents with a torque proportional to the speed of rotor movement, with a breakout force of 0.04 Nm.
- Damping motor can also be used on GND for test purposes (positions AOA sensor in a pre-determined test position)
- Internal heating element 115 VAC, 400 Hz; operating temp. 120ºC.

LINK (http://www.pprune.org/tech-log/452836-af447-thread-no-3-a-84.html#post6503491)

fantom

28th Jun 2011, 20:29

God help us all.

BOAC is a really good chap but, unfortunately, has not enjoyed an Airbus type rating course.

He will soon I'm sure but, in the meantime, let us forgive his neandethal mutterings.

sorry mate.

jcjeant

28th Jun 2011, 22:10

Hi,

BOAC is a really good chap but, unfortunately, has not enjoyed an Airbus type rating course.

He will soon I'm sure but, in the meantime, let us forgive his neandethal mutterings.

sorry mate.It's no doubt (for pilots and general public) that the Airbus airliners are very sophisticated aircrafts stuffed with modern technology materials
Now .. the question is ..
Sophistication = simplification ?
If the answer is NO
Why it's seem's that many airlines have not very sophisticated programs of formations (schooling) and high training for their pilots ?
How it can be that a general opinion is that in general the training and formation are on the down slide .. and in the same time .. the aircrafts are on the up slide of sophistication ?
And what is the response of the officials bodies for this ? (regulators .. laws makers ... etc ..)
It is now the aircraft industry corporates and banks who are regulating the air transport ?

CONF iture

28th Jun 2011, 22:27

BOAC is a really good chap but, unfortunately, has not enjoyed an Airbus type rating course.
Sorry but, in that perspective, a type rating course won't teach much. Only regular, repetitive, and studious incident/accident report readings can help to realize that nothing is that simple in the Airbus world. Every report brings its part of discovery ...
This is not only true for the pilot, but probably also for the designer himself ...

Operating Range 120º, limited by fixed stops
Do you know how the 120 deg are distributed, is it +90 -30 ?

CogSim

28th Jun 2011, 22:38

Originally Posted by jcjeant
It's no doubt (for pilots and general public) that the Airbus airliners are very sophisticated aircrafts stuffed with modern technology materials
Now .. the question is ..
Sophistication = simplification ?
If the answer is NO
Why it's seem's that many airlines have not very sophisticated programs of formations (schooling) and high training for their pilots
How it can be that a general opinion is that in general the training and formation are on the down slide .. and in the same time .. the aircrafts are on the slide up of sophistication ?
And what is the response of the officials bodies for this ? (regulators .. laws makers ... etc ..)
It is now the aircraft industry corporates and banks who are regulating the air transport ?

Software Engineers will tell you its Abstraction. You don't need to know how the transmission works to drive to work everyday.

The bean counters will tell you its statistics. How many times have you trained for brakes in you car giving out at 60+ mph on the highway?

Ironically, "Simplicity is the ultimate sophistication" was an early slogan for Apple Computers.

DozyWannabe

28th Jun 2011, 22:59

Now, I am all in favor of FBW; it simplifies systems; saves weight, and increases efficiency. But, why did the engineers not just make it fly last the last 100 years of aviation.

Because at some point the training wheels have to come off. If everything was made to work "just like the old days" this board would be a complete pig to use!

Put another way, Boeing made the 777 to simulate a feel similar to that which Tex Johnson had in the Dash-38. Airbus made the A320 FBW series to feel similar to the equipment the Apollo astronauts used to land on the moon. The methods are *different*. Not better, not worse, but *different*.

I don't understand what's so confusing about "if in Normal Law rely on the protections, otherwise do not and apply more caution when making control inputs". We don't even know if all this round-the-houses about what does what in which law applies in this case anyway. We know the pilots were aware they were in Alternate Law and we know that the PF made some control inputs that on the face of it make no sense. All we don't know is why - but it seems a select group have already decided it must be the computers' fault, despite the fact that they have no more information than those who are advising "wait and see".

Software Engineers will tell you its Abstraction. You don't need to know how the transmission works to drive to work everyday.

What has Software Engineering got to do with whether someone knows how the transmission/gearbox (for us Brits) on their car works? I guarantee you that the majority of drivers wouldn't have a clue (and I only know in general terms). Furthermore, abstraction is something that has happened in aviation ever since someone hooked a pitot up to a pneumatically-driven dial. That dial was abstracting the raw information from the pitot tube via a mechanism that translated that into human-readable form. Some of those mechanisms were very much better than others!

Ironically, "Simplicity is the ultimate sophistication" was an early slogan for Apple Computers.

Aside from the fact that, as I've said countless times, the software that runs on aircraft is only a gnat's chuff comparable to what you and I use on our PCs every day, personally I've always considered Apple guilty of what the naysayers here are saying about Airbus - i.e. deliberately obfuscating the workings of the system - in their case to enforce dependency on their retail chain to fix problems.

The difference is that it takes a far lower grade of technician/systems administrator/software engineer (i.e. me) to understand what's going on in a PC or server (which - let's face it - these days is usually a PC) than it does a safety-critical real-time system like those plumbed into aircraft.