AF447 wreckage found

[thcrozier]

Just so I understand correctly, then there is no way to take direct control of the aircraft unless the computer itself decides to let you, or perhaps more correctly stated, decides you should. Sounds like Skynet in "The Terminator".

[MountainBear]

it is more difficult to accept that the Captain joined his fellow pilots' erroneous view of the situation without there being some pretty compelling, but ultimately wrong, data as to what the aircraft was doing.

I don't agree. Hindsight is 20/20. The issue facing the captain when he came to the flight deck was simply who was in the best position to fly the plane. That's a judgement call, and a bit of a coin flip. To me, it says that he trusted in the professionalism of his fellow pilots. In hindsight, that judgement may have been wrong. But I won't second guess that decision.

It's like his decision to take his rest break when he did. In hindsight, maybe it wasn't the safest course of action. But he had no more of a crystal ball than anyone else on that flight.

I think there is a temptation to expect the captain to ride on his white steed from the bunk onto the flight deck, manfully throw the stupid PF out the door, and heroically wrestle the plane to safety. That would make for a thrilling movie plot but it doesn't reflect the way CRM actually works.

[Yipoyan]

thcrozier, it is not quite like that. Normal Law in a FBW Airbus is a very well thought out system, and allows the pilot to directly control the aircraft very well, maneuvering it almost like a fighter... but provided it is within the flight envelope. Attempts to go outside of the flight envelope (like over speed, under speed, over bank, over pitch) will not only be resisted, but will be corrected. So, if you are in an over speed situation, and you push the side stick forward, the aircraft will not only not pitch down further, but will actually pitch up to slow the aircraft down. The logic is simple... the flight computer would rather disobey you than let the aircraft become unflyable because its wings had broken off!

Reversion occurs only when there are faults found in the flight control computers, knocking them out (usually automatically through a voting system); and depending on the severity, reverting to either Alternate Laws 1 or 2, or to Direct Law. The best of non FBW aircraft is only equal to an Airbus in Alternate Law, with Direct Law being exactly the same as manual flying.

[SoaringTheSkies]

do we have a good explanation for the elevator trim setting?
would it have been obvious to the pilots (prominent / highlighted display?)

I'm still very confused about this.

From reading what is available, I believe that "Pilot error" will very likely be declared the accident cause. I'm not sure I'll necessarily agree, albeit "perfect pilot" would probably have saved the day.

Correct me if I'm wrong, but it seems to me that with greater automation comes an ever larger pile of sh*t that the automation systems place on the pilots hands if they decide to give up trying to be smarter than a human.

Automation systems basically handle pre-defined situations very well. Whatever scenario the engineers, flight test crews and probably even accident reports came up with goes into the system and becomes then part of what the system can handle. So far so good, but at the fringe of this, the resulting situations become increasingly complex to understand and manage.

There are a few things that need to be questioned:

Why is the stall warning silenced at indicated airspeeds below 60knots? Surely because whoever designed the system decided that, at an airspeed below 60knots, something is so terribly wrong that you would have noticed, possibly the airspeed being unreliable. However, as we all know, a stall has absolutely nothing to do with speed but is a function of AoA only. Why gate the warning with anything if you have consensus of the AoA sensors?

Is there no stall protection outside of normal (alternate 1/2?) law on an AB? Stick pushers have been around for many many decades, they are simple technology and rather effective. They need one input (AoA) and do one thing (make you pitch down). I know the AB have a much fancier system when the protections are effective, but do they really leave you entirely on your own when you drop out to alternate or direct?

[edit] and one more thing:

MountainBear

I think there is a temptation to expect the captain to ride on his white steed from the bunk onto the flight deck, manfully throw the stupid PF out the door, and heroically wrestle the plane to safety. That would make for a thrilling movie plot but it doesn't reflect the way CRM actually works.

the public expectation is trained by Hollywood movies, so this seems to be EXACTLY what they would have expected to happen. After all, some German media STILL report that the PILOT was not on the flight deck!!!
Utter BS! And as we see, when the CPT came back to the flight deck, he was just as confused as his two FOs. That's why I got rather annoyed about those fellows who claimed that they'd be in their left seat in every critical phase of the flight. It's a judgement call and this crew decided that the phase ahead was not going to be critical. Little they knew, but that's a general fact about what we call "future".

[Graybeard]

The A330 Autopilot can't handle varying erroneous airspeed from 3 sources, so it disconnects and hands the task to the pilot. That shows a lack of forethought.

Juneau, the capitol, is reached from the rest of Alaska only by sea or by air, so a lot of gold has been spent perfecting low IFR approaches. The GPS approach and go around are hairy enough on a good day, but if the mountains block the signal on go around, the A/P reverts to IRU guidance to give a precious 30 seconds flywheel effect. That is true for the 737 A/P as well as the HUD.

Why is there no flywheel in the A330 A/P to provide reversion and stability, and continue flying when sensors fail?

[Capn Bloggs]

The best of non FBW aircraft is only equal to an Airbus in Alternate Law, with Direct Law being exactly the same as manual flying.

... with a stick shaker and pusher (which probably would have saved 447's day).

[wafelbolletjes]

I have over 3000 hours as PIC on the md11 (at fsairlines) and i can say with confidence i have more flying ability than the pilots who yanked back at the sidestick all the way down to the ocean.

[gatbusdriver]

The people I feel truly sorry for in this tragic situation are the poor moderators. When you read some of the rubbish that is posted here it makes you wonder what they actually remove.

At this tragic time spare a thought for your mods.

My favourite to date......"Nigel get the standby horizon out"
"......errrrr......sorry sir I've drunk mine"
"....bugger....finished mine too. Don't worry I'll get my torch out and look at red and yellow ribbon fluttering outside the window"

[Bienville]

Says Graybeard:

The A330 Autopilot can't handle varying erroneous airspeed from 3 sources, so it disconnects and hands the task to the pilot. That shows a lack of forethought.

Tell me... if the computer knows it is getting "varying erroneous airspeed from 3 sources" and does not know which one to believe, what should the computer do... keep flying the plane itself basing its judgments on known bad data or hand the job to a human?

Did ya even think that comment through before you made it?

[jcjeant]

Hi,

Tell me... if the computer knows it is getting "varying erroneous airspeed from 3 sources" and does not know which one to believe, what should the computer do... keep flying the plane itself basing it's judgments on known bad data or hand the job to a human?

Did ya even think that comment through before you made it?

Methink .. if I understand the idea of the poster....
The autopilot can't rely on bad datas of course ... but it's possible to have another law for the autopilot in this case:
Immediately .. when bad data detected .. autopilot keep speed and altitude attitude (freeze settings) and warn the pilot for check what is wrong .....
The plane continue to fly with same settings as before all go bad ....
It's almost what AF ask in their procedure ......
Actually .. seem's that the autopilot is used as a alarm (by disconnecting) for warn something is wrong ......

[captplaystation]

Yipoyan post#626, to that accident you can add 2 VERY near misses with the A310 involving Tarom at Orly & Interflug somewhere in the former E Germany ?

If you look them up in Aviation Safety Net you will be gobsmacked that they got away with it.

I too am gobsmacked, that in this day and age Airbus have managed to design another generation of machine that doesn't do what you could reasonably& logically expect.
Just as illogical as the trim system on the earlier generation, I cannot fathom any logic in a system that will trim back if YOU are pushing forward to unstall the aircraft.

As THY & Thomson proved in 737's, a dispute between the stab & the elevator will always be won by the big guy in an underwing engine configured jet transport.
I am also gobsmacked, given the history of previous pitot problems & indeed the need to design & fit uprated ones, why the crew were not taught & made comfortable with this scenario during their recurrent (if not initial ) training.
Surely this should have loomed LARGE in the recurrent sim syllabus as soon as the possibility was identified some time before.
Anyone familiar with Airbus ops in AF care to tell us if they were made sufficiently aware, & or trained , to cope with this scenario ?

[bubbers44]

For anybody else that couldn't download the report yesterday.

Accident to the Airbus A330-203
flight AF 447 on 1st June 2009
Update on Investigation
Bienvenue sur le site du Bureau d'Enqutes et d'Analyses
27 May 2011
SPECIAL FOREWORD TO ENGLISH NOTE
This note has been translated and published by the BEA to make its reading easier for Englishspeaking
people. As accurate as the translation may be, the original text in French should be
considered as the work of reference.
History of Flight
On Sunday 31 May 2009, the Airbus A330-203 registered F-GZCP operated by Air France was
programmed to perform scheduled flight AF447 between Rio de Janeiro Galeão and Paris
Charles de Gaulle. Twelve crew members (3 flight crew, 9 cabin crew) and 216 passengers
were on board. Departure was planned for 22 h 00(1).
At around 22 h 10, the crew was cleared to start the engines and to leave the parking space.
Take-off took place at 22 h 29. The Captain was PNF, one of the co-pilots was PF.
The take-off weight was 232.8 t (for a MTOW of 233t), including 70.4 t of fuel.
At 1 h 35 min 15 , the crew informed the ATLANTICO controller that they had passed the
INTOL point then announced the following estimated times: SALPU at 1 h 48 then ORARO at
2 h 00. They also transmitted the SELCAL code and a test was undertaken successfully.
At 1 h 35 min 46, the controller asked the crew to maintain FL350 and to give their estimated
time at TASIL.
At 1 h 55, the Captain woke the second co-pilot and said "[…] he’s going to take my place".
Between 1 h 59 min 32 and 2 h 01 min 46 , the Captain attended the briefing between the
two co-pilots, during which the PF said, in particular "the little bit of turbulence that you just saw
[…] we should find the same ahead […] we’re in the cloud layer unfortunately we can’t climb much
for the moment because the temperature is falling more slowly than forecast" and that "the logon
with Dakar failed". The Captain left the cockpit.
The airplane approached the ORARO point. It was flying at flight level 350 and at Mach 0.82
and the pitch attitude was about 2.5 degrees. The weight and balance of the airplane were
around 205 tonnes and 29% respectively. Autopilot 2 and auto-thrust were engaged.
At 2 h 06 min 04, the PF called the cabin crew, telling them that "in two minutes we should enter
an area where it’ll move about a bit more than at the moment, you should watch out" and he
added "I’ll call you back as soon as we’re out of it".
(1)All times
are UTC.
At 2 h 08 min 07 , the PNF said "you can maybe go a little to the left […]". The airplane began a
slight turn to the left, the change in relation to the initial route being about 12 degrees. The level
of turbulence increased slightly and the crew decided to reduce the speed to about Mach 0.8.
From 2 h 10 min 05 , the autopilot then auto-thrust disengaged and the PF said "I have the
controls". The airplane began to roll to the right and the PF made a left nose-up input. The stall
warning sounded twice in a row. The recorded parameters show a sharp fall from about 275 kt
to 60 kt in the speed displayed on the left primary flight display (PFD), then a few moments
later in the speed displayed on the integrated standby instrument system (ISIS).
Note 1: Only the speeds displayed on the left PFD and the ISIS are recorded on the FDR; the speed
displayed on the right side is not recorded.
Note 2: Autopilot and auto-thrust remained disengaged for the rest of the flight.
At 2 h 10 min 16, the PNF said "so, we’ve lost the speeds" then "alternate law […]".
Note 1: The angle of attack is the angle between the airflow and longitudinal axis of the airplane.
This information is not presented to pilots.
Note 2 : In alternate or direct law, the angle-of-attack protections are no longer available but a
stall warning is triggered when the greatest of the valid angle-of-attack values exceeds a certain
threshold.
The airplane’s pitch attitude increased progressively beyond 10 degrees and the plane started
to climb. The PF made nose-down control inputs and alternately left and right roll inputs. The
vertical speed, which had reached 7,000 ft/min, dropped to 700 ft/min and the roll varied
between 12 degrees right and 10 degrees left. The speed displayed on the left side increased
sharply to 215 kt (Mach 0.68). The airplane was then at an altitude of about 37,500 ft and the
recorded angle of attack was around 4 degrees.
From 2 h 10 min 50, the PNF tried several times to call the Captain back.
At 2 h 10 min 51 , the stall warning was triggered again. The thrust levers were positioned
in the TO/GA detent and the PF maintained nose-up inputs. The recorded angle of attack, of
around 6 degrees at the triggering of the stall warning, continued to increase. The trimmable
horizontal stabilizer (THS) passed from 3 to 13 degrees nose-up in about 1 minute and
remained in the latter position until the end of the flight.
Around fifteen seconds later, the speed displayed on the ISIS increased sharply towards 185 kt;
it was then consistent with the other recorded speed. The PF continued to make nose-up
inputs. The airplane’s altitude reached its maximum of about 38,000 ft, its pitch attitude and
angle of attack being 16 degrees.
Note: The inconsistency between the speeds displayed on the left side and on the ISIS lasted a little less
than one minute.
At around 2 h 11 min 40 , the Captain re-entered the cockpit. During the following seconds,
all of the recorded speeds became invalid and the stall warning stopped.
Note: When the measured speeds are below 60 kt, the measured angle of attack values are considered
invalid and are not taken into account by the systems. When they are below 30 kt, the speed values
themselves are considered invalid.
The altitude was then about 35,000 ft, the angle of attack exceeded 40 degrees and the vertical
speed was about -10,000 ft/min. The airplane’s pitch attitude did not exceed 15 degrees
and the engines’ N1’s were close to 100%. The airplane was subject to roll oscillations that
sometimes reached 40 degrees. The PF made an input on the sidestick to the left and nose-up
stops, which lasted about 30 seconds.
At 2 h 12 min 02, the PF said "I don’t have any more indications", and the PNF said "we have
no valid indications". At that moment, the thrust levers were in the IDLE detent and the
engines’ N1’s were at 55%. Around fifteen seconds later, the PF made pitch-down inputs. In
the following moments, the angle of attack decreased, the speeds became valid again and the
stall warning sounded again.
At 2 h 13 min 32, the PF said "we’re going to arrive at level one hundred". About fifteen seconds
later, simultaneous inputs by both pilots on the sidesticks were recorded and the PF said "go
ahead you have the controls".
The angle of attack, when it was valid, always remained above 35 degrees.
The recordings stopped at 2 h 14 min 28. The last recorded values were a vertical speed of
-10,912 ft/min, a ground speed of 107 kt, pitch attitude of 16.2 degrees nose-up, roll angle of
5.3 degrees left and a magnetic heading of 270 degrees.
New findings
At this stage of the investigation, as an addition to the BEA interim reports of 2 July and 17
December 2009, the following new facts have been established:
ˆˆ The composition of the crew was in accordance with the operator’s procedures.
ˆˆ At the time of the event, the weight and balance of the airplane were within the operational
limits.
ˆˆ At the time of the event, the two co-pilots were seated in the cockpit and the Captain was
resting. The latter returned to the cockpit about 1 min 30 after the disengagement of the
autopilot.
ˆˆ There was an inconsistency between the speeds displayed on the left side and the integrated
standby instrument system (ISIS). This lasted for less than one minute.
ˆˆ After the autopilot disengagement:
„„the airplane climbed to 38,000 ft,
„„the stall warning was triggered and the airplane stalled,
„„the inputs made by the PF were mainly nose-up,
„„the descent lasted 3 min 30, during which the airplane remained stalled. The angle of
attack increased and remained above 35 degrees,
„„the engines were operating and always responded to crew commands.
ˆˆ The last recorded values were a pitch attitude of 16.2 degrees nose-up, a roll angle of
5.3 degrees left and a vertical speed of -10,912 ft/min.

[xcitation]

Try the water bottle next time you are up to see.
clearly any acceleration will impart a distortion from the g vector. however at constant velocity the water surface will remain parallel with the surface of the earth.
obviously the water bottle is not a substitute for the avionics. but it does make a quick and dirty sanity check for which way up you are.
do you have any better suggestions?
thats why 3 orthogonal gyros are used to overcome any acceleration from movement.
if you want a more advanced solution you could have multiple gps receivers at extremities of the plane to compare timing pulses on the gps signal to figure out attitude to a v high precision.

[jcjeant]

Hi,

Water bottle ... (2min05)

YouTube - ‪Stopped engine aerobatics‬‏

[opherben]

a. Based on BEA factual report, that wasn't the case with AF447.
b. In such case, a few system design options to consider for autothrottle logic:
1. Use FMGC last known flight phase (climb, cruise, descent) as autothrottle reference to maintain optimal AOA, or
2. Set engine thrust used before the onset of airspeed indication error, or
3. Set CONT thrust.

The accident, onset by airspeed erratic readings (which lasted for one minute) and autoflight disconnect, the problem was lack of stall recovery by the pilot, for which he had 3:30 minutes and a mostly functional aircraft. A pilot descending 10,000 FPM with 107 KT indicated, should not expect a pitot system to generate correct dynamic pressure readings. He should get the aircraft under proper control firsdt, and only then carry out non-normal checklists.


As military flight academy commander, to me this case clearly shows the lack of proper selection (for personality and psycho-motoric skills) and training of pilots (complete flight envelope mastering in aerobatic trainers including deep stalls and spins, for better understanding of flight mechanics and human impact. Not necessarily to be used, but rather avoided. In case they are encountered, a pilot at any level should recognize and counteract out-of-controlled flight. It could also help him understand as captain, why full repeated pedal deflections in A300 might shear the vertical tail, what entering an aircraft wake feels like and how to avoid it. All is basic flying stuff). AF447 is just one of many such cases, including B737-800 in automatic ILS approach, throttles in idle, stalling before touchdown in Schipol, or a captain woken-up around FAF to watch his A320 demolish. Everything I wrote in this paragraph is 100% applicable to transports, even if many never thought about it.

[Bienville]

jcjeant say:

Methink .. if I understand the idea of the poster....
The autopilot can't rely on bad datas of course ... but it's possible to have another law for the autopilot in this case:
Immediately .. when bad data detected .. autopilot keep speed and altitude attitude (freeze settings) and warn the pilot for check what is wrong .....

OK so... rather than hand the plane back to the pilot, you want the computer to keep flying the plane but to not even try to respond to inputs, just freeze itself at the last setting.

I'm REAL glad you don't design autopilots for a living.

As I asked the last guy... Did you even think that comment through before you made it?

[Capn Bloggs]

Originally Posted by xcitation

however at constant velocity the water surface will remain parallel with the surface of the earth.

No it won't. In a steady-state turn, for example, it'll be parallel with the wings, just like the iphone "AH"... Are you seriously suggesting that these guys, in the dark of night with all hell breaking loose, should have pulled a waterbottle out of their bag and held it up to see whihc way was up?

do you have any better suggestions?

Yes, an aeroplane that presents attitude, angle of attack and has controls that do what the pilot wants and tells him what he needs to know eg if AoA indicates a stall, keep the stall warning going, not stop when the speed drops off the clock.

[jcjeant]

Hi,

OK so... rather than hand the plane back to the pilot, you want the computer to keep flying the plane but to not even try to respond to inputs, just freeze itself at the last setting.

I'm REAL glad you don't design autopilots for a living.

As I asked the last guy... Did you even think that comment through before you made it?

The pilot can disengage the autopilot when he want ... at least he is warned of something wrong instead a brutal disconnection.

[kwat]

When I read the Accident Update (27th May) two things jump out at me.

At around 2 h 11 min 40, the Captain re-entered the cockpit. During the following seconds, all of the recorded speeds became invalid and the stall warning stopped.

At 2 h 12 min 02, the PF said "I don’t have any more indications", and the PNF said "we have no valid indications". At that moment, the thrust levers were in the IDLE detent and the engines’ N1’s were at 55%. Around fifteen seconds later, the PF made pitch-down inputs. In the following moments, the angle of attack decreased, the speeds became valid again and the stall warning sounded again.

So the system is such that entering extremely high angle of attack invalidates the speeds, which in turn silences the stall warnings. Conversely, reducing the angle of attack causes the stall warning to reactivate. The crew are in a situation where they are getting the exact wrong feedback. Couple this with possible mind-sets about turbulence, overspeed and structural damage – just my thoughts.

[captainflame]

BUSS

The BUSS is only displayed once ALL ADRs are switched off iaw QRH.