AF 447 Search to resume

[ChristiaanJ]

Originally Posted by MurphyWasRight

Seems to me that an "inner loop" driving the control cylinder rate and/or position to the pilot/autopilot requested values would have to exist.
This is similar to using feedback around an op-amp to precisely set gain even though the raw gain of the amp may vary 10:1 or more.

You're right.
The "demand" to the innner loop (from the pilot or autopilot) is in terms of control surface position (angle), the feedback comes from a control surface position sensor.

If the available raw "gain" (hydraulic pressure) is too low then the inner loop will fail

Your analogy is wrong.... the hydraulic pressure does not equate to gain. To use your op-amp analogy, too low a hydraulic pressure would be similar to the supply voltage collapsing under load or the op amp output stage saturating.

... but that would represent either a fundamental design flaw/or hydraulic system failure.

Exactly.
Since we have a simpler explanation than hydraulic problems, I tend to apply Occams razor....

I am not familiar with real world details (work in electronics not hydraulics) so welcome insight from those who do know.

The transfer function for a electro-hydraulic actuator is a bit more complicated than a simple low-pass filter, but the suggestion of oscillations in the system is somewhat too far-fetched... and would indeed imply a fundamental design flaw.... The technology has been around too long, and is too well understood, for this to be a plausible cause, IMO.

CJ

[Machinbird]

The transfer function for a electro-hydraulic actuator is a bit more complicated than a simple low-pass filter, but the suggestion of oscillations in the system is somewhat too far-fetched... and would indeed imply a fundamental design flaw.... The technology has been around too long, and is too well understood, for this to be a plausible cause, IMO.

Hi Christiaan,
In light of the many thousands hours of successful operation of the A330/340 on autopilot, it might not imply a design flaw, but instead the exceedance of an unpublished limitation.

Just like AA587 taught us to be careful with rudder inputs, perhaps the legacy of AF447 will be that there are other ways to 'break' the aircraft than causing structural damage. Depending on how the flight control laws are structured, it seems possible that extremely challenging weather might cause excessive use of the flight controls and hydraulic pressure depletion/interruption before actual structural failure could occur.

At present, everything I have read relating to PIO/APC events indicates that these events occur with cliff like suddenness. Usually there is a triggering event-a final straw that breaks the camel's back. Things like changing of flight control laws, changing pilot control strategies (e.g. rate based control technique rather than attitude), changes in aircraft configuration, changes in power,and changes in flight conditions are often culprits.

One cannot realistically deny that PIO events exist and they are not restricted to fighter aircraft. They have been experienced on well known transport aircraft such as: A320,A321, C-97, C-17, KC-135A, MD-11, B767, B777, and a number of bombers as well. Not all of these experiences have been in development, a number of them have occured during normal line flights.

Since we are talking about an aircraft (AF447) on autopilot not under pilot control in the moments leading up to its problem, we are no-longer talking about a strict PIO event possibility, but that is probably a weakness of the definition. When it comes to FBW aircraft, the control system is always in the loop except when you lose electric power or hydraulic effector power to the system.

My gut feeling is that Airbus engineers did a great job on their software design, but for an aircraft to suddenly lose control while on autopilot would imply a possible condition well outside of the norm-something like hydraulic supply induced rate limiting.

The A330 is not a naturally unstable aircraft, but it is a relaxed stability aircraft which is made to fly nicely by virtue of its flight control system. Anything that gets in the way of the flight control system's ability to control is bad, and anything that actually aggravates the control system's control has the potential to be downright tail over teacup dangerous. It has been said that you can make an unstable aircraft fly with fly by wire technology, and you can make a stable aircraft lose control using the same technology.

For the doubting Thomases, take a look at these two Youtube videos, and remember-it isn't the pilot's fault-it is an aircraft problem. PIO exists and it doesn't always happen with developmental aircraft.
YouTube - F22 Pilot Induced Oscillation (PIO)
YouTube - Saab JAS39 Gripen Crash 1993
On the second accident, note the wing rock before the departure.

[Svarin]

Machinbird posted :

Now assuming AF447 somehow departed controlled flight while in Normal Law while cruising on autopilot

Interesting but when ? Certainly not initially at 02:10. But maybe at 02:13, when the FMGEC1 failure appeared, as determined by the AFS in a class 1 message. The AFS would only detect a fault if it was active. So by 02:13, the pilots thought it was over and the aircraft showed them the F/D bars, and they reengaged A/P with unintended consequences...

Loss of autopilot and autothrottle would be due to the ADR failures which would be caused by the departure from controlled flight.

Strongly disagree, these auto-thingies losses are due to the Probe-Pitot failure at 02:10 which put the PRIMs in a special alternate law with ADR monitoring.

Read again the BEA report : a failure message will not appear twice. If A/P was lost at 02:10, reengaged at 02:13 and lost again, its subsequent disconnection will not show a second time on ACARS (since they are maintenance messages and not flight data monitoring messages)

Remember, the basic situation is faulty probes to scattered ADRs to alternate law. This UAS is routinely handled by all pilots in the sim and in reality. Nobody crashes from cruise level because of this alone.

However, voting logic, ADR selection, PRIM behaviour under manual alternate law as compared to their behaviour under A/P, all these are of the utmost relevance. The AD put forward by a poster a few days ago reveals a possible hazardous misbehaving of the A/P itself under certain ADR failures conditions. These conditions are such that the system as a whole deems appropriate to show F/D bars and allow A/P reengagement when it is unsafe to do so. This is extremely serious and so very close to our mystery here.

[Machinbird]

Svarin

Interesting but when ? Certainly not initially at 02:10.

Other than the BEA reports proposing pitot problems as a cause, what do you see in the ACARS sequence to confirm this. Have you considered that maybe BEA, careful and methodical as they are, didn't get it quite right?

Shoot down the concept of the entire ACARS sequence being caused by a departure at the beginning if you can, but do it with data. I am attempting to broaden the possibilities of how this accident happened. Why couldn't the ADR problems be a result of a departure from controlled flight?

[HazelNuts39]

Gust loads

Originally Posted by Machinbird

Quote:
(Henra): Besides that also the RTLU setting would mean it had to stall/spin at M0,8.

So if this type of stall entry would break the airframe, we could pretty well conclude that that the two above scenarios couldn't happen since the aircraft appears to have impacted in an essentially intact condition.

I too find this scenario intriguing. It wouldn't break the airplane though, as shown in this graph.

BEA's second interim report mentions one UAS incident where peak loadfactor excursions of 0.2 and 1.9 g were recorded:

Turbulence was always recorded and reported. The levels felt by the crew varied form slight to strong. The recorded amplitude in recorded normal went from [0.75/1.2g] to [0.2/1.9g].

What mainly speaks against this scenario is that nothing in the available meteorological data suggests an extremely violent gust: the cb was already decaying, its tops were descending and it was spreading out horizontally below tropopause.

[Svarin]

Machinbird posted

Why couldn't the ADR problems be a result of a departure from controlled flight?

Everything is possible but you will need a root cause for upset, for which there is no proof nor evidence. That is a gratuitous hypothesis, not Occam compliant at all.

Shoot down the concept of the entire ACARS sequence being caused by a departure at the beginning if you can, but do it with data.

Both FPVs got flagged early in the sequence, and that means both guys at the front just switched their FPVs on and found them flagged. FPV is pretty useless in an upset and is definitely not the first thing you will do then. Beginning of sequence is stable flight, only condition when FPV is useful.

FMGEC1 gets faulted by AFS late in the sequence, and that means AFS is active. Which means it got reengaged, because it dropped early in the sequence due to UAS. This again says 'stable flight'. Flight was stable until this fault at least.

Last but not least, the whole ADR clusterphukk is due to Probe-Pitot faults early in the sequence. There is enough evidence of these particular probes icing in cruise to make this a reasonable root cause. Of course, there is something else to turn a manageable UAS into a crash from FL350.

By differentiating these faults specific to our mystery from those where no crash occurred, one will have a clue as to this additionnal problem. May I humbly suggest this : WRG : ADIRU1 BUS ADR1-2 TO FCPC2, HARD. Yes, hard indeed...

[bearfoil]

The Autopilot's Autonomous disconnect has some instructive considerations. Long ago, in a discussion with PJ2 and Will Fraser, it was determined that excursion limits AP had programmed into it would cause a potentially unexpected disconnect, and a degradation of Flight Law.

Now this is known. Let us add to that possibility the existence of severe turbulence, with its downside of allowing "Out of Phase" reactions of the airframe to rapid excursions in Pitch, Roll and Yaw. The AP program allows 45 degrees in Roll and 13u, 9d in Pitch. At this point, there should be a discussion of whether it is wise to continue into turbulence in Autoflight. Not now.

How in essence shall we differentiate between out of synch airframe response and controls position? The AutoPilot is programmed by control position and airframe aspect. So is it correct to eliminate the possibility of Upset whilst in AutoPilot? No. Assume the 330 was close to upset, or at least Unusual attitude at drop out of AP.

Instead of poor stability with the AP engaged, the Pilots are confronted with no stability when it quits. Law is Alternate, and hand flying in turbulence with an airframe that is aerodynamically, busy, is the handful of Enchilada Will Fraser posted. Getting the "Feel" under such conditions is not duplicable in the sim. Whilst attempting to regain stable and level flight, sufficient disturbance of airflow about the sensors is certainly possible to create duff reads.

Perhaps the "Upset" was not an identifiable moment, but an in and out thing that was mitigated for a time by the pilots, until perhaps air loads passed the ultimates for a control load, or for aero flight. "Out of Phase" has an interesting relationship to AA587.

[Machinbird]

Hazelnuts39
I appreciate your efforts in answering the max g available question.
It certainly helps if one opens the graphic to see the whole thing.

Regarding the weather conditions:

The initial BEA report stated:

Though the analysis of the imagery leads one to think that, towards 2 h 00, the cumulonimbi forming this cluster had mostly already reached their stage of maturity, it is highly probable that some were the site of notable turbulence at FL350. There is a possibility of significant electrical activity at the flight level, but the presence of super cooled water at FL350 is not very probable and would necessarily have been limited to small quantities.

The second BEA report stated:

1.7.3 Meteorological Analyses
The additional analyses on the meteorological situation in the accident zone, based on the study of the observations made at 2 h 30 UTC by the Tropical Rain Measuring Mission (TRMM) satellite, are included in appendix 3. Though the TRMM lightning imager indicates an absence of lightning in the accident zone at 2 h 30 UTC, the infrared image taken at the same time is consistent with those of Meteosat 9: taken together, this information does not make it possible to conclude that there was a sudden and exceptionally intense development of the convective activity between 2 h 07 and 2 h 30 UTC. Analysis of the observations by the TRMM TMI instrument, the only one operating in the microwave area, indicates the presence of strong condensation around 10,000 metres altitude, lower than the altitude of the cumulonimbus tops. This strong condensation would correspond to convective towers active at this altitude, which confirms the strong probability of notable turbulence within the convective cluster that was crossed by planned flight path of flight AF447.

I am not sure we can make reliable conclusions about the level of turbulence AF447 may have encountered. It is probably highly relevant that AF447 was lost in an active area along the ITCZ, but whether the relevance is pitot icing or turbulence or both or even some other factor is unknown at this time. We can only wonder why they did not see the necessity of altering course as aircraft in front of and behind them did in the ITCZ portion of their routes.

Svarin, It may be a day or two before I get back to your response, but I appreciate the effort you have made to be explicit.

[henra]

svarin

Read again the BEA report : a failure message will not appear twice.

Hmmm, interesting. Maybe I was too quick to dismiss the idea of an attempted re- connection of the A/P

Still it would have to be rather late in the chain of events, but then I'm not sure we can really conclude that they didn't re- engage it.

@jcjeant:
Are there elements in the ACARS which allow us to draw a definite conclusion that it didn't happen ?

[NeoFit]

Hello

We can only wonder why they did not see the necessity of altering course

Why? That the question.

Why the vessel had not altered her course and crossed convective zone at Salpu WP ?

Was there anybody alive in the aircraft before 02:00z ?
(I am sorry, but I don't remember exactly if ACARS messages proved that human actions had been done).

Why autopsies report is classified?

[mm43]

Machinbird;

It is probably highly relevant that AF447 was lost in an active area along the ITCZ, but whether the relevance is pitot icing or turbulence or both or even some other factor is unknown at this time. We can only wonder why they did not see the necessity of altering course as aircraft in front of and behind them did in the ITCZ portion of their routes.

The above is a good précis of the conundrum we are left with.

We know that AF447 tried 3 times to log on to DAKAR ADS-CPDLC but was rejected due to DAKAR not holding a flight plan - only a virtual one. The last time was at 0200z (DAKAR recorded 0201z) and I suspect that some discussion then took place between both pilots as to how to sort the problem. This distraction (by both) could well have resulted in failure to see anything significant on the WX radar right ahead. At this stage the radar tilt would need to be max down for them to see the Cb cell that was rising at 4,000ft/min right ahead. A few seconds at the most was all that it took for the latent heat of the super-cooled water vapour in the Cb the a/c penetrated at about 0209z, to condense and freeze over the pitot tube ports.

The GS over the period from 0200z to 0210z was 463KT, a reduction of only 1KT from the previous 10 minute period, and I suspect that the a/c had been proceeding in light to moderate chop. However, penetration into an active Cb cell took place shortly before 02:09:30z and the a/c probably pitched up violently and rolled to port as all hell started to break out in the cockpit.

I would go as far as stating that M0.82 was being maintained, though CAS dropped slightly in the chop, and was effectively recorded at M0.80 (272 +/-2 KCAS) by the RTLU as ADRs disagree, reversion to Alternate Law and both A/P and A/THR disconnecting. The 3NM deviation west of track occurred after the reversion to Alternate Law.

Distraction is not a great way to commence recovery from an upset.

A problem I have with the above scenario, is a "chicken & egg" one. Did the ADRs disagree due to Pitot induced UAS due to icing, or side-slip/yaw errors from an external physically induced upset?

No, I doubt if control loop oscillations, PIO or otherwise played any part in what took place. But why and how an otherwise undamaged aircraft (to the best of our knowledge) was delivered to the sea surface is the real conundrum.

NeoFit;

Was there anybody alive in the aircraft before 02:00z ?

The following ACARS messages are relevant:-

2:11:00 WRN/WN0906010210 228300106FLAG ON CAPT PFD FD
2:11:15 WRN/WN0906010210 228301106FLAG ON F/O PFD FD

- which indicate that those pages were selected by the crew.

The reason for the outcome lies deep below the Equatorial North Atlantic.

[HazelNuts39]

Yet another hypothesis?

From BEA's Second Interim Report on AF447:

... as the ATSB mentions in its second interim report(3) on the incident to the A330-300 that was performing flight QF72, in relation to problems with ADIRU’s, the maintenance messages relating to the events on flight AF447 and flight QF72 show significant differences, both in their sequence and in their content.

The accident during flight QF72 was caused by an as yet unidentified fault in one ADIRU, which produced 'spikes' in multiple parameter output signals, in particular that of angle of attack. There is indeed no basis for assuming a similar fault in flight AF447.

On the other hand, there was no anomaly in the way the flight control computers reacted to the faulty AoA signal: the response to a 'high AoA' signal was apparently 'as designed'. As described in the ATSB report, that response was the simultaneous activation of two effects: the high AoA protection (alpha prot) nose-down elevator command of 4 degrees and the high Mach anti pitch-up compensation of 6 degrees. The 10 degrees of elevator movement resulted in the airplane pitching to 8.4 degrees nose-down and a negative normal acceleration of 0.8 g. From the ATSB first Interim Report:

If the PRIMs detected that the aircraft’s AOA exceeded a predefined threshold, the computers would command a nose-down elevator movement to reduce the AOA. (...) Anti pitch-up was a pre-command included in the control laws to compensate for a pitch-up at high Mach due to aerodynamic effect. The compensation was available above Mach 0.65 and when the aircraft was in a ‘clean’ configuration (that is, with the landing gear and flaps retracted).

I doubt if an updraft would cause the airplane to pitch up. The immediate effect of an updraft is to increase the AoA, as shown in the graph I posted in #2664. Since the airplane is aerodynamically stable, it tends to return to the AoA for which it is trimmed, i.e. pitch down. Perhaps more important is how the systems respond in an updraft. The A/P, if engaged, will command pitch down to regain the commanded altitude. Stall warning occurs at an AoA of about 4 degrees (in alternate law). I wonder at what AoA the two effects observed in QF72 would occur. The yellow triangle in my graph at about 5 deg indicates 'buffet onset', which is also 'alpha max', corresponding to Vs1g at 1 g. Is this where 'alpha prot' attains it maximum authority? Should BEA look more closely than ATSB has done into the AoA that triggers the 'anti pitch-up' command?

Suppose that all this happened just prior to the loss of airspeed data, how would the pilot(s) react?

[mm43]

HN39;

Your excellent LF + AOA + Gust Velocity graph has got me thinking about the potential density/temperature of the contents of a rapidy rising Cb cell. I included the hypothetical figure of 4,000 ft/min (67fps) in my previous post, knowing that there is evidence that this rate can even be exceeded. Add in the "brick-wall effect" of the different air-mass and there is something worth considering. Is there not?

I am of the opinion (right or wrong) that evidence of a highly convective air-mass in the ITCZ, during the period in question, can't be completely ruled out. Satellite imagery for 0215z was actually scanned at 0208z over the area we are looking at, and the likelihood of a Cb burst can't be totally dismissed.

[Machinbird]

Machinbird-Why couldn't the ADR problems be a result of a departure from controlled flight?

Svarin-Everything is possible but you will need a root cause for upset, for which there is no proof nor evidence. That is a gratuitous hypothesis, not Occam compliant at all.

I’m sorry. A potential root cause was proposed-a dynamic departure from controlled flight with two potential pathways for that to happen. I would not have suggested that the ADR problems might have resulted from a departure at the beginning of the ACARS sequence otherwise. There is also no absolute proof for the older BEA hypothesis either. I will say that the dynamic departure fits some of the observed facts better: The RTLU position, and the fact that on at least 3 cabin crew seats, no one was occupying them at impact. A dynamic departure would be rather violent-probably 3 half cycles.

Svarin-Both FPVs got flagged early in the sequence, and that means both guys at the front just switched their FPVs on and found them flagged. FPV is pretty useless in an upset and is definitely not the first thing you will do then. Beginning of sequence is stable flight, only condition when FPV is useful.

Bear with me, lets see what BEA says with reference to these. (I’m a steam gage guy, so I’ve not had an opportunity to use this type equipment.)

Lets look at messages relating to the PFDs (courtesy of MM43)

2:10:29
WRN/WN090601 0210 228300206FLAG ON CAPT PFD SPD LIMIT
2:10:41
WRN/WN090601 0210[228301206FLAG ON F/O PFD SPD LIMIT

Meaning: This message indicates the unavailability of the FMGEC’s
characteristic speed calculation function

2:11:00
WRN/WN090601]0210 28300106FLAG ON CAPT PFD FD
2:11:15
WRN/WN090601 0210 228301106FLAG ON F/O PFD FD

Meaning: This message indicates the Flight Director function is selected and unavailable.

2:12:10
WRN/WN090601 0211 341200106FLAG ON CAPT PFD FPV
2:12:16
WRN/WN090601 0211 341201106FLAG ON F/O PFD FPV

This message indicates that the flight path vector FPV) function is selected but unavailable. In order to lose completely this function, which is elaborated by IRs in a way that is compatible with the CFR, one of the following three conditions must be met for each ADR:
barometric vertical speed higher, as an absolute value, than 20,000 ft/min,
true air speed higher than 599 kt,
measured calibrated airspeed lower than 60 kt.
Once the operating conditions are satisfied again, the FPVs reappear on the PFD (if TRK/FPA mode is still selected).

Looks like the Flight director was already engaged at the beginning of the sequence. Do you guys use the FPV(bird) enroute too? If so, it could have been engaged at the beginning of the sequence but wasn't 'squawked' until the rejection criterea were met in the second correlation window. Maybe AF447 started down like a safe at that point? Then again maybe it was just airspeed effects caused by the departure.

Svarin-FMGEC1 gets faulted by AFS late in the sequence, and that means AFS is active. Which means it got reengaged, because it dropped early in the sequence due to UAS. This again says 'stable flight'. Flight was stable until this fault at least.

2:14:20
FLR/FR090601 0213 22833406AFS 1,,,,,,,FMGEC1(1CA1),INTERMITTENT

This message cannot be the trace of a reset which, in particular, excludes the possibility of a manual shutdown. This message could be the consequence of inconsistency between the two channels in the FMGEC (COM and MON). Such an inconsistency could be the consequence of erratic input parameter values.
In any event, the effects of such a message could only be the disengagement of automatic systems, whose associated cockpit effect messages had already been transmitted at 2 h 10. The “INTERMITTENT” nature of the message means that the problem lasted for less than 2.5 seconds.

Svarin-Last but not least, the whole ADR clusterphukk is due to Probe-Pitot faults early in the sequence. There is enough evidence of these particular probes icing in cruise to make this a reasonable root cause. Of course, there is something else to turn a manageable UAS into a crash from FL350.[/font]

Like MM43-I too wonder, is the ADR problem the chicken or the egg? We will need the black boxes to figure this one out reliably.

[Bobman84]

Any chance that we can discuss more about the search now that it will resume this month?

I'm hopeful that they find something now. They have to!

[HazelNuts39]

mm43;

... thinking about the potential density/temperature of the contents of a rapidly rising Cb cell.

The buoyancy of rising air is due to it being lighter (less dense) than its surroundings. It is about 3 degrees C warmer than the atmosphere at FL350 (based on figure 11 of Tim Vasques' analysis), but the pressure is the same. For one cell to develop significantly higher gust velocity than its neighbors, I think it must either get its air from a hotter source on the surface, or the surrounding atmosphere must be cooler than elswhere. The higher velocity would result in more 'overshoot', which would show up as lower temperature of the cloud tops in satellite IR imagery.

regards,
HN39

[mm43]

Bobman84;

The French Secretary of State for Transport, Thierry Mariani, and the Director of the Office of Investigations and Analysis (BEA), Jean-Paul Troadec, will meet tomorrow with the families of victims of the Air France flight AF447 disaster. They are expected to give the families a presentation on details of the new Phase 4 search location, according to a statement by the Department of Ecology.

The "Alucia" is the support vessel to be used by the REMUS AUV team from the Woods Hole Oceanographic Institution for the deployment of two AUVs provided by the Waitt Institute. The vessel has been moored in Seattle and recently (2011-01-30) undertook a short sea trial on Puget Sound, and is currently moored near the sea-plane base on the SE side of Lake Union. She is expected to depart Seattle in a few days time to proceed into the Gulf of Mexico via the Panama Canal.

[auv-ee]

Le Figaro has reported some details of the Phase 4 search. The Google translation is so bad I'll just link the original and hope that it is more accurate:

Le Figaro - France : Une ultime campagne fin mars pour retrouver l'AF*447*

[bia botal]

gentlemen, with ref. the QF72 event and the ADIRU induced decent, and having experienced a similar fault in 738 and witnessed a AP induced roll as a result that was explained to me to be the fo's ADIRU going into test mode! Is it possible for a pitot blockage on AF447 to induce a similar fault at the commencement of the event.? Could it induce a failure to both ADIRU that may have presented to the pilots a extremely violent maneuver.?

[Hyperveloce]

BEA presentation (in French, 02/04/2011)

Hi gentlemen,
Some newly released documents in relation to the new search campain (phase IV):
La nouvelle campagne de recherches /
The New Undersea Search Campaign

http://www.bea.aero/fr/enquetes/vol....04.02.2011.pdf
too bad this document is not self-explanatory: would be interested to know how these (probability ?) maps are built, and which data are "integrated" ?

http://www.bea.aero/fr/enquetes/vol....ation.whoi.pdf
http://www.bea.aero/fr/enquetes/vol.af.447/remus3d.mp4
Nouvelle phase de localisation de l?épave du vol AF447 Rio?Paris de mars à juillet 2011 - Ministère du Développement durable
Jeff
http://www.bea.aero/fr/enquetes/vol....h.analysis.pdf
Ok, this last report by Metron provides all the answers.