Airbus crash/training flight
Guest
Posts: n/a
olster
The picture I have from the report is that trim automatically went nose up, to the stop.
The pilots were used to depending on auto trim, and didn't think to consider the antagonistic Pitch force thus provided against their wish to drop the nose.
A general concern might be that in slow flight, autotrim (Auto Pilot?) might be unnecessary. The Bus has powered controls, and has a fine "touch" relative to Pitch, at any speed, so why not set Trim at the neutral set, and rely only on elevator, or elevator plus an "articulating" HS? Trim used to be simply a setting that lessened a pilot's effort at the stick, instead of a fully integrated "Variable Incident HS". Whatever the concern, here the trim was in what used to be called "runaway", relative to the pilot's baseline Pitch awareness. As BOAC has said, automatic flight is a boon, an enhancement (great word), but if something gets pear, the pilot needs to know the "mood" of the a/c, and immediately. Any hesitation in alert may cause an unproductive "solution set" in the FP, and want "unwinding" as The Pilot "finally" "gets" the situation. My sense of the AirBus is that it is finely tuned and capable, and resists rapid and large movements, that it is "uncomfortable" in the "unusual". Why wouldn't it be, it is designed for the normal flight. If flightcrew are not well trained in its behaviour at the edge, perhaps the "edge" in a commercial turnover should be explored by the Manufacturer's test flight personnel. The focus of this airframe is docility, and efficiency, and Safety. If it is trained to these goals, and unusual Attitudes and Stall are not "possible" such that these are not trained, a casual decision to test slow flight and protections at very low altitude would be (should be) non existent? I think BOAC has the upshot of this accident fully nailed down, aerodynamically, mechanically, electronically, and even politically.
bear
The picture I have from the report is that trim automatically went nose up, to the stop.
The pilots were used to depending on auto trim, and didn't think to consider the antagonistic Pitch force thus provided against their wish to drop the nose.
A general concern might be that in slow flight, autotrim (Auto Pilot?) might be unnecessary. The Bus has powered controls, and has a fine "touch" relative to Pitch, at any speed, so why not set Trim at the neutral set, and rely only on elevator, or elevator plus an "articulating" HS? Trim used to be simply a setting that lessened a pilot's effort at the stick, instead of a fully integrated "Variable Incident HS". Whatever the concern, here the trim was in what used to be called "runaway", relative to the pilot's baseline Pitch awareness. As BOAC has said, automatic flight is a boon, an enhancement (great word), but if something gets pear, the pilot needs to know the "mood" of the a/c, and immediately. Any hesitation in alert may cause an unproductive "solution set" in the FP, and want "unwinding" as The Pilot "finally" "gets" the situation. My sense of the AirBus is that it is finely tuned and capable, and resists rapid and large movements, that it is "uncomfortable" in the "unusual". Why wouldn't it be, it is designed for the normal flight. If flightcrew are not well trained in its behaviour at the edge, perhaps the "edge" in a commercial turnover should be explored by the Manufacturer's test flight personnel. The focus of this airframe is docility, and efficiency, and Safety. If it is trained to these goals, and unusual Attitudes and Stall are not "possible" such that these are not trained, a casual decision to test slow flight and protections at very low altitude would be (should be) non existent? I think BOAC has the upshot of this accident fully nailed down, aerodynamically, mechanically, electronically, and even politically.
bear
Join Date: Jun 2009
Location: US
Posts: 497
Likes: 0
Received 0 Likes
on
0 Posts
More simply put if your aircraft is stalling, add a bit of forward pitch and add power so you don't pitch up. Guess that is too simple. Sorry. It always worked for me instructing in C 150's. Also works in B757's.
Join Date: May 2010
Location: UK
Age: 79
Posts: 1,086
Likes: 0
Received 0 Likes
on
0 Posts
Grrrrrrrr.......
Increasing power is a VERY foolish move in a jet with engines under the wing. This causes a pitch-up moment which increases AOA, making the stall worse.
This has been a contributing cause in several fatal accidents.
Increasing power is a VERY foolish move in a jet with engines under the wing. This causes a pitch-up moment which increases AOA, making the stall worse.
This has been a contributing cause in several fatal accidents.
Per Ardua ad Astraeus
Join Date: Mar 2000
Location: UK
Posts: 18,579
Likes: 0
Received 0 Likes
on
0 Posts
Increasing power is a VERY foolish move in a jet with engines under the wing.
Join Date: Feb 2008
Location: Belgium
Posts: 58
Likes: 0
Received 0 Likes
on
0 Posts
More simply put if your aircraft is stalling, add a bit of forward pitch and add power so you don't pitch up. Guess that is too simple. Sorry. It always worked for me instructing in C 150's. Also works in B757's.
- close to the ground
- loosing speed due to windshear
- developping high sink rate
This is, I think, the most common stall context in line operation.
C150 or Boeings.
Full power/thrust is then required to recover energy asap.
Lowering the nose being a very limited option.
So the "standard" recovery practice : full (TOGA) thrust, while keeping the aircraft at the edge of the stall or, most commonly at the stick shaker limit. It works ... (Except on ww2 fighters where full throttle at the stall would snap roll the aircraft ...)
Trim is not mentionned here, because :
- the aircraft is normaly on trim for a speed higher than stall speed
- the aircraft would remain at max lift CL for a while ...
- it is normal flying skill to trim as necessary, isn't it?
Basic flying skills ... rehearsed again during type rating and recurrent training so as to be aware of and familiar with special - type related - idiosyncracies.
Is it too much to require from a type rating program to discuss and train in all aspects of stall on type? Including of course malfunctions of automation?
Join Date: Jan 2005
Location: W of 30W
Posts: 1,916
Likes: 0
Received 0 Likes
on
0 Posts
Originally Posted by Mad Flt Scientist
That may be true. But airliner annunciations are not, in general, designed for test flights; they are designed for normal operations, and to minimize workload by masking messages which are not expected to be critical - so called "nuisance" or "status" messages. In this case the system thought it was rejecting the one bad value and still had dual redundancy - plenty of margin of safety for a flight where stall approach is an unlikely event. But in this case such a manoeuvre was probability=1. Which throws all the usual risk calculations out the window.
Full back stick is the Airbus procedure for GPWS warning … How would you justify the system did not deem as necessary to advise the pilot it was not the best idea on that day to blind fully trust its system ?
Join Date: Sep 2002
Location: La Belle Province
Posts: 2,179
Likes: 0
Received 0 Likes
on
0 Posts
Simply put, probability.
The likelihood of circumstances requiring the protection function to work is less than P=1. Therefore some failure rate of the protection system is acceptable. But for circumstances where you are deliberately testing a protection function, you can't take credit for the probability of the circumstances, because they are certain.
Its the difference between potential and certainty.
To take a different example - any takeoff can become a high energy RTO. The risk is known and managed. But a deliberate high energy RTO for test purposes is managed rather differently - fire trucks on hand, crews with protective gear, specifically briefed, and so on. Because now that the RTO is certain, the normal safety measures - having a fire truck somewhere on the airfield, for example - doesn't cut it. We need it right there.
Same for protection systems. Their normal reliability requirements are a function of the probability they will be required.
Bear in mind, too, that the design was operating believing it had one failed sensor (of 3) and with two remaining, that should be enough redundancy to complete a flight, since the chance of the next sensor failing combined with a "required protection" condition is acceptably low. In service.
The likelihood of circumstances requiring the protection function to work is less than P=1. Therefore some failure rate of the protection system is acceptable. But for circumstances where you are deliberately testing a protection function, you can't take credit for the probability of the circumstances, because they are certain.
Its the difference between potential and certainty.
To take a different example - any takeoff can become a high energy RTO. The risk is known and managed. But a deliberate high energy RTO for test purposes is managed rather differently - fire trucks on hand, crews with protective gear, specifically briefed, and so on. Because now that the RTO is certain, the normal safety measures - having a fire truck somewhere on the airfield, for example - doesn't cut it. We need it right there.
Same for protection systems. Their normal reliability requirements are a function of the probability they will be required.
Bear in mind, too, that the design was operating believing it had one failed sensor (of 3) and with two remaining, that should be enough redundancy to complete a flight, since the chance of the next sensor failing combined with a "required protection" condition is acceptably low. In service.
Join Date: Jan 2005
Location: W of 30W
Posts: 1,916
Likes: 0
Received 0 Likes
on
0 Posts
MFS,
My position is that everybody has to learn something from an accident, and the Manufacturer is not to be excluded.
It takes absolutely nothing to trigger an AOA DISCREPANCY ECAM MSG meaning :
"Eh guys, our AoA probes disagree, the probabilities are on our side, we believe the faulty probe has been identified and you can resume normal operation. In the meantime, as we have been proved wrong a few times already ... if your intention was to test the system today, don’t do it, and if by adventure you was unlucky to need maximum performance of the system, don’t rely too much on our protections today, but simply use your own abilities a bit like if you were flying a 737"
Don’t you agree such message could positively influence a crew and therefore improve the level of awareness and safety ?
My position is that everybody has to learn something from an accident, and the Manufacturer is not to be excluded.
It takes absolutely nothing to trigger an AOA DISCREPANCY ECAM MSG meaning :
"Eh guys, our AoA probes disagree, the probabilities are on our side, we believe the faulty probe has been identified and you can resume normal operation. In the meantime, as we have been proved wrong a few times already ... if your intention was to test the system today, don’t do it, and if by adventure you was unlucky to need maximum performance of the system, don’t rely too much on our protections today, but simply use your own abilities a bit like if you were flying a 737"
Don’t you agree such message could positively influence a crew and therefore improve the level of awareness and safety ?
Join Date: Sep 2002
Location: La Belle Province
Posts: 2,179
Likes: 0
Received 0 Likes
on
0 Posts
MFS,
My position is that everybody has to learn something from an accident, and the Manufacturer is not to be excluded.
It takes absolutely nothing to trigger an AOA DISCREPANCY ECAM MSG meaning :
"Eh guys, our AoA probes disagree, the probabilities are on our side, we believe the faulty probe has been identified and you can resume normal operation. In the meantime, as we have been proved wrong a few times already ... if your intention was to test the system today, don’t do it, and if by adventure you was unlucky to need maximum performance of the system, don’t rely too much on our protections today, but simply use your own abilities a bit like if you were flying a 737"
Don’t you agree such message could positively influence a crew and therefore improve the level of awareness and safety ?
My position is that everybody has to learn something from an accident, and the Manufacturer is not to be excluded.
It takes absolutely nothing to trigger an AOA DISCREPANCY ECAM MSG meaning :
"Eh guys, our AoA probes disagree, the probabilities are on our side, we believe the faulty probe has been identified and you can resume normal operation. In the meantime, as we have been proved wrong a few times already ... if your intention was to test the system today, don’t do it, and if by adventure you was unlucky to need maximum performance of the system, don’t rely too much on our protections today, but simply use your own abilities a bit like if you were flying a 737"
Don’t you agree such message could positively influence a crew and therefore improve the level of awareness and safety ?
I agree 100% that the manufacturer needs to learn from every action; none of us take accidents or incidents to our products lightly. In this case, though, and as I alluded earlier, its unfortunate that Ab don't appear to have a scheme to determine that a probe value is valid - in the sense that there is no known fault with that sensor - but still likely erroneous. In this case, anyone looking at the DFDR trace sees those completely static AOA values with changes in speed and configuration and a big red light goes off in your mind. The system monitoring the AOA data could have done the same thing. "Before I vote out bad data, let's see if any of the data hasn't moved in, say, the last minute. hmm. zero change, at the hundredths of a degree level, in a minute. AOAs don't do that. Lets discard those ones instead ..."
With the amount of redundancy in modern systems, posting a message every time you lose redundancy would overwhelm the crew. Its only merited, in my opinion, if it brings you to a point where you are a single failure away from trouble. In this case, they were not supposed to be that close to trouble.
To address the issue of a message stopping a test - that's why some aircraft have test-specific configurations and strappings, to ensure that stuff you need for test is available, but does not clutter up the normal displays.
Guest
Posts: n/a
MFS
With respect, and it may be just an error in understanding, your reference to the crew being "overwhelmed" is precisely the problem: trained crew don't get overwhelmed, it's in the T/C's. Seriously, if the capability exists to alert to a potentially dangerous condition, especially when the crew should be sensitive to it ( "Test" ), and it isn't forthcoming, that is a 100 percent FAIL in the machine/man interface, No?
With respect, and it may be just an error in understanding, your reference to the crew being "overwhelmed" is precisely the problem: trained crew don't get overwhelmed, it's in the T/C's. Seriously, if the capability exists to alert to a potentially dangerous condition, especially when the crew should be sensitive to it ( "Test" ), and it isn't forthcoming, that is a 100 percent FAIL in the machine/man interface, No?
Join Date: Jul 2009
Location: France - mostly
Age: 84
Posts: 1,682
Likes: 0
Received 0 Likes
on
0 Posts
Originally Posted by MFS
its unfortunate that Ab don't appear to have a scheme to determine that a probe value is valid
a. the method apparently used by BEA to calculate AoA: from vertical speed, TAS and attitudes in pitch and roll;
b. the algorithm that presumably produces the "CHECK GW" message: from the GW calculated in the FMS, airspeed and accelerations.
regards,
HN39
P.S. Perhaps the 'monitoring system' should not be trusted to say which parameter is at fault, but at least it can indicate that there is an inconsistency between the parameters involved.
Last edited by HazelNuts39; 5th Nov 2010 at 18:24. Reason: P.S.
Join Date: Sep 2002
Location: La Belle Province
Posts: 2,179
Likes: 0
Received 0 Likes
on
0 Posts
@ bearfoil
Perhaps overwhelmed is an emotive term, but the fact remains that the messaging and alerting system is designed with very definite constraints on what it can post and when, because overloading a crew with extraneous information is a hazard in and of itself.
Many "advisory" type messages - typically white, or status, or some other term is also used - are not posted AT ALL in flight. Yet they are an indication of reduced system redundancy, and maybe, just maybe, are symptoms of something greater, though they are not supposed to be. (This accident would be an example of this).
There are even phases of flight where caution messages - which ordinarily would be a very big deal indeed - are suppressed or masked in order to avoid crew distraction. I'm 100% sure there have been cases where aircraft have been lost due to masking of a message.
My point is, its accepted practice, for some good reasons, not to let every system on the aircraft post status messages where they are supposed to be having no effect at the cockpit level. To change that policy would require a very great shift in cockpit human factors thinking.
@HN39
It doesn't even need to be that complex to catch this case. An algorithm looking for a "stuck" - or in this case frozen - vane is rather simple. And I know at least one manufacturer has just such an algorithm on its products, which works quite nicely. I think the vanes are even from the same supplier. As I said a few posts ago, "unfortunate" that AB don't have the same logic. Perhaps they will soon, now ...
Perhaps overwhelmed is an emotive term, but the fact remains that the messaging and alerting system is designed with very definite constraints on what it can post and when, because overloading a crew with extraneous information is a hazard in and of itself.
Many "advisory" type messages - typically white, or status, or some other term is also used - are not posted AT ALL in flight. Yet they are an indication of reduced system redundancy, and maybe, just maybe, are symptoms of something greater, though they are not supposed to be. (This accident would be an example of this).
There are even phases of flight where caution messages - which ordinarily would be a very big deal indeed - are suppressed or masked in order to avoid crew distraction. I'm 100% sure there have been cases where aircraft have been lost due to masking of a message.
My point is, its accepted practice, for some good reasons, not to let every system on the aircraft post status messages where they are supposed to be having no effect at the cockpit level. To change that policy would require a very great shift in cockpit human factors thinking.
@HN39
It doesn't even need to be that complex to catch this case. An algorithm looking for a "stuck" - or in this case frozen - vane is rather simple. And I know at least one manufacturer has just such an algorithm on its products, which works quite nicely. I think the vanes are even from the same supplier. As I said a few posts ago, "unfortunate" that AB don't have the same logic. Perhaps they will soon, now ...
Join Date: Jan 2005
Location: W of 30W
Posts: 1,916
Likes: 0
Received 0 Likes
on
0 Posts
MFS
Amber color seems appropriate in the Airbus philosophy :
"The flight crew should be aware of the configuration or failure, but needs not take immediate action"
Such message could be assigned only a level 1 priority which is the lowest level of caution.
But whatever the color you like as long as the message is clearly transmitted to the crew.
It is not much about what the crew will do but more what he will not.
Overloaded ?
If such a message overloads me, maybe it’s time for me to quit the job.
I would probably be more prone to overload by simultaneous STALL and OVERSPEED warnings …
Maybe you’re not too familiar with the Airbus, but we have already a fair number of AMBER ECAM MSG that only require crew awareness nothing more.
Amber color seems appropriate in the Airbus philosophy :
"The flight crew should be aware of the configuration or failure, but needs not take immediate action"
Such message could be assigned only a level 1 priority which is the lowest level of caution.
But whatever the color you like as long as the message is clearly transmitted to the crew.
It is not much about what the crew will do but more what he will not.
Overloaded ?
If such a message overloads me, maybe it’s time for me to quit the job.
I would probably be more prone to overload by simultaneous STALL and OVERSPEED warnings …
Maybe you’re not too familiar with the Airbus, but we have already a fair number of AMBER ECAM MSG that only require crew awareness nothing more.
Guest
Posts: n/a
MFS
Thanks for your patient reply. I do understand that the system has alert constraints. My point is that how expensive or complicated could it be that in and around the attitudes and flight aspect that flirt with Alpha Protection (to include both inadvertant and volitional), it would seem the computer could excuse the constraint program to ennable AoA alert, eg: AoA #1 Fail. This would (Could) be facilitated by a Pilot command that directed pertinent alerts relative to the manouver being tested? I still think that an AH would be nice, and so on, but one can dream. Crumbs, Crumbs, Sir! Viable? Wouldn't it generate an ACARS? How silly is it to inform the ground, but not the Pilot!!
bear
Thanks for your patient reply. I do understand that the system has alert constraints. My point is that how expensive or complicated could it be that in and around the attitudes and flight aspect that flirt with Alpha Protection (to include both inadvertant and volitional), it would seem the computer could excuse the constraint program to ennable AoA alert, eg: AoA #1 Fail. This would (Could) be facilitated by a Pilot command that directed pertinent alerts relative to the manouver being tested? I still think that an AH would be nice, and so on, but one can dream. Crumbs, Crumbs, Sir! Viable? Wouldn't it generate an ACARS? How silly is it to inform the ground, but not the Pilot!!
bear
Join Date: Sep 2002
Location: La Belle Province
Posts: 2,179
Likes: 0
Received 0 Likes
on
0 Posts
... how expensive or complicated could it be that in and around the attitudes and flight aspect that flirt with Alpha Protection (to include both inadvertant and volitional), it would seem the computer could excuse the constraint program to ennable AoA alert, eg: AoA #1 Fail. This would (Could) be facilitated by a Pilot command that directed pertinent alerts relative to the manouver being tested?
Having a different system configuration for a test certainly is possible, but usually would be for the duration of the flight. We do something similar to activate certain displays and parameters during production flight test. But it's not pilot selected. Anything that is selectable means having to deal with failure conditions for the selection, which adds complexity to the overall failure case analysis.
Having the system know to not mask certain messages as a function of flight manoeuvre is not trivial. Indeed, the suggested criteria implicit in your suggestion - use proximity to High Alpha protect mode thresholds to post alpha-related failures - wouldn't have worked at all in this case, because the failure is preventing the system realising it should be in alpha-protection mode, so it also would leave the message masked.
Typically phase of flight is used to control messaging and masking - air/ground is one criteria often used, and "during takeoff" is another, for examples. In this case I can't think of any simple criteria other than to post all the time or not at all, because alpha-protection is active in all phases of flight, and could be encountered under virtually any conditions. So once you've decided "this must be posted if alpha-protection may be activated" then you're pretty much posting it all the time.
Join Date: May 2000
Location: Glorious West Sussex
Age: 76
Posts: 1,020
Likes: 0
Received 0 Likes
on
0 Posts
All airliners have good and "not quite so good" features. All airlines have good and "not quite so good" SOP's.
If you read the CVR transcript you will not find one FMA call, not one ECAM caution read out loud when failures were introduced.
I believe that if "FLIGHT CONTROLS DIRECT LAW" and "USE MANUAL PITCH TRIM" had been spoken in that cockpit on that day they would almost certainly have survived.
That is the way Airbus expect their aircraft to be operated in a malfunction situation.
If you read the CVR transcript you will not find one FMA call, not one ECAM caution read out loud when failures were introduced.
I believe that if "FLIGHT CONTROLS DIRECT LAW" and "USE MANUAL PITCH TRIM" had been spoken in that cockpit on that day they would almost certainly have survived.
That is the way Airbus expect their aircraft to be operated in a malfunction situation.
Join Date: Jan 2005
Location: W of 30W
Posts: 1,916
Likes: 0
Received 0 Likes
on
0 Posts
I believe that if "FLIGHT CONTROLS DIRECT LAW" and "USE MANUAL PITCH TRIM" had been spoken in that cockpit on that day they would almost certainly have survived.
10 minutes earlier, as the aircraft was approaching VMO, a golden opportunity existed to positively advise the crew that the AoA probes were in disagreement …
TyroPicard, I don’t think it is necessary to kill the crew a second time as we all agree the flight was really not performed as it should have been, but could we grab that sad event to learn something on the manufacturer side as well in order to improve safety ?
The Airbus is a very complex machine when you want to look inside, and in the doubt, it should not hide its possible status. Nothing can justify that the protections may bring any additional level of difficulty for a crew.
Join Date: May 2000
Location: Glorious West Sussex
Age: 76
Posts: 1,020
Likes: 0
Received 0 Likes
on
0 Posts
CONF
I think you are an engineer? Therefore you see a technical problem and a technical solution.
I am a (retired) pilot who teaches A320 Type Conversions - I try to train pilots to cope with the kit that Airbus give them.
I am not killing the crew a second time, but trying to use this accident to reinforce the need for clear communication under adverse conditions. Just because it is a human factors/technical accident does not mean we cannot discuss the HF side...
Someone should have.... And USE MANUAL PITCH TRIM appears on the PFD so is easy to see and read...
I think you are an engineer? Therefore you see a technical problem and a technical solution.
I am a (retired) pilot who teaches A320 Type Conversions - I try to train pilots to cope with the kit that Airbus give them.
I am not killing the crew a second time, but trying to use this accident to reinforce the need for clear communication under adverse conditions. Just because it is a human factors/technical accident does not mean we cannot discuss the HF side...
Those messages came up only as the emergency situation was already well developed. The aircraft had 50 degrees of bank, the stall warning was all over the place, possibly some additional ECAM MSG for the FACs, who would have seen and read those messages … ?
Join Date: Jan 2005
Location: W of 30W
Posts: 1,916
Likes: 0
Received 0 Likes
on
0 Posts
Someone should have.... And USE MANUAL PITCH TRIM appears on the PFD so is easy to see and read...
We can discuss HF of course and we HAVE to, but the BEA report is all about it already, but a lot evasive on the technical side : Where are the acceleration data ? They played a crucial role in the absence of forward auto trim when the captain was pushing on his sidestick, they played a crucial role too on the way the airplane was limited in the final maneuver.
Have you seen those data ?
Give me a reason why they’re not published ?
I’d like to see also the FO sidestick inputs … don’t tell me he was brave enough not to touch it …
To be honest, I’m getting tired of that constant attitude from the BEA to protect Airbus :
Page 16 of its report, the BEA dares to write:
Between 15 h 04 and 15 h 06, angle of attack sensors 1 and 2 stopped moving and remained blocked until the end of the flight at almost identical local angles of attack and consistent with the cruise angle of attack, without the crew noticing it.
It is obvious that this expression aims to release Airbus responsibilities where we should read :
without the crew being informed
That is intellectual dishonesty ! henrimarnetcornus.20minutes-blogs.fr