AF 447 Search to resume (part2)

[rudderrudderrat]

Hi Machinbird,

Thanks for the very interesting article.
That's the first time I've read and understood that the flight control Law on A320 is pitch rate below 210 Kts and delta g above.

I wish AI had fitted a big red switch to turn off the Flight Control computers and place it into Direct Law. I am led to believe that B777 has one fitted?

[bearfoil]

snowfalcon2


"Another potentially usable technology would be the hot wire mass flow sensor, where the air flowing past cools down an electrically heated wire and the airspeed can be calculated from the wire's electrical resistance which changes according to temperature."

Kinda like the Pitot/HEAT combo, but without the Pitot?

Shows promise. That will save expensing for three pitots.

cheers

[Svarin]

FBW article

Machinbird posted a link to an article by F/O Stowe from Delta.

I cannot resist quoting this :

If loss of control or aircraft handling qualities are suspected in an FBW accident, first assume that the FCS--and not the pilot--induced it until proven otherwise (it might be "designer error").

Thank you, Officer Stowe. I feel suddenly very much less alone.

[sensor_validation]

Originally Posted by snowfalcon2

Another potentially usable technology would be the hot wire mass flow sensor, where the air flowing past cools down an electrically heated wire and the airspeed can be calculated from the wire's electrical resistance which changes according to temperature. But this is not seen on airliners either. Anyone knowing if this is due to inherent drawbacks compared to pitot tubes, or just an aversion to try new technology?

Hot wire anemometers are used a lot in wind tunnels, I am only familiar with the type that run at constant temperature/resistance - then the input power is direct measure of the heat loss via conduction to the air mass passing, you also don't have to worry too much about the wire changing in length/tension due to expansion. You would still need good measurement of static pressure and temperature for air density and calibration. The hot wires in the lab are pretty delicate, but I suspect they wouldn't work well at all in rain or ice because the heat loss due to latent heat of melting or evaporation would be confused with high flow...

I suggest it is impossible to stop pitot tubes from ever blocking when snowballs thrown at them, but it must be possible by design to ensure the drain hole stays clear of ice. The ability to generate a false reading, which is 'live' with altitude changes when blocked, has been the killer in the past.

Perhaps could use microwave heating of the pitot cavities so not rely on conduction from metal surface to sharp ice crystals? Currently most heat will be lost by the 'wind-chill factor' on the outside of the tube. But even just upping the applied heating voltage by say 20% (power by 40%) without any mechanical/electrical pitot design change would take years to introduce even if feasible...

[fireflybob]

Why not give the pilots angle of attack information?

[DType]

Hot wire mass flow sensors

The first wet motor race using hot wire mass flow sensors to determine fuel flow rate was an interesting disaster. Don't know if they overcame the problem, or changed the sensor type!

[infrequentflyer789]

Originally Posted by Machinbird

Maybe we will learn something Friday regarding how different FBW is.
Here is some "homework" for those who wish to get their minds ready to understand a bit more about what makes FBW different.
Fly-By-Wire A Primer for Aviation Accident Investigators
The quiz question is: How does the pitch feedback in the A320 at 180 knots differ from that at 230 knots?

Trick question ? Is that 180 indicated and 180 actual, or 180 indicated and 230 actual ? The latter would be different again if only because the aerodynamic response would change, no ?

There is also the question of what the FBW uses to calculate gain in the event of unrelaible airspeed - last-known-good value (which might be wrong...) or fixed mid-value or some other calculated value ? I doubt it uses known-bad data, so if you do have 180-indicated at 230-real, that doesn't mean you'll get the gain set to the normal value used at 180. Am I on the right track ?

A page or so back in the thread, someone posted on an airline investigation showing pitot issues -> unreliable airspeed on one in 80k flights (!) - by my reckoning that's a lot of issues over the years worldwide (even if only Thales equipped buses) , far more than just the other events listed in the reports, yet without planes falling out of the sky.

So on that track, the answer to "How does the pitch feedback differ" would be: not by enough to cause a serious problem if the speed indication is wrong. Until 447. Something different to all the other cases happened on this flight, what, we don't know yet (maybe the VS really did fall off ). Tomorrow we may know.

[sensor_validation]

Originally Posted by DType

The first wet motor race using hot wire mass flow sensors to determine fuel flow rate was an interesting disaster. Don't know if they overcame the problem, or changed the sensor type!

Good point, most cars these days use thermal massflow sensor to measure air flow to calculate fuel injection times. There's normally a flap valve on inlet to take in warm air on start-up to speed up engine heat up, maybe there's also a dewpoint sensor to ensure air always above dewpoint, or its just mechanical design to not draw in water droplets. Racing cars use ram air effect and want coldest possible air to maximize inlet air density to maximize available power - and most have clearly solved the problem.

[mitrosft]

Pitot tube failure protection

I believe that Airbus software is probably missing simple protection in airspeed data readouts. At least manuals in previous posts do not describe any such measures.

If ALL Pitot tubes freezes and IAS deviates by 1-50% then computer before admitting that airspeed data is correct should check the acceleration/decelaration rate from inertial sensors. This simple cross check would protect from any type of tubes failure (freezing, blockage etc)

[Gibon2]

SLF here. Forgive me for butting in, but what I find very puzzling about all the discussion on pitots, icing, FBW, human-machine interface, etc, is that none if it seems to consider why all this is coming up now. The A330, whatever its faults, was not introduced yesterday. It has been in commercial service since 1994. More than 700 of them are plying the world's airways. It flew in commercial service for 15 years without a fatal accident. Countless gazillions of miles have been flown by A330s, surely in all conceivable combinations of weather, crew experience, captain-in-cockpit-or-not, etc etc.

So what has changed? Why are icing pitots now a concern? Why is FBW now a concern? Why is lack of an AoA indicator now a concern? If there was something awry with the design philosophy of the A330, wouldn't it have shown up years ago? The A330 is, I presume, pretty much the same today as it was in 1994. So is the weather, and the way that pitots ice or don't ice. What does that leave? Is it the pilots that have changed over the past decade?

[Svarin]

What has changed ?

Gibon2,

you are absolutely right.

Did the aircraft change over the years ? Yes and No. No it did not go through any kind of major re-design, and its various versions are quite stable. Yes, some things change in this aircraft, like in any other. What is specific to FBW aircraft is the changing of Flight Controls Computers, through successive software versions. This is done very discreetly. Some mistakes get corrected before they have a chance to do damage. Some are corrected after a fact (or not). But more than that, the very multiplicity of successive versions of such a critically critical piece of software and equipment will introduce a whole new set of potential problems. Specialists call these Byzantine faults, in reference to an ancient war involving traitorous generals. You can add to the can of worms the parallel evolution of other components software versions, like Air Data Computers for example. All these computers and their brand new updated versions do communicate together all the time. Extremely well, usually. Unfortunately, the public will not be educated on this subject by the upcoming inquiry, I would wager.

Of course, such faults as I hint to in the previous paragraph happen very rarely, and that is a blessing. But they do happen, and those who know what they are talking about in IT knew about the potential for it for years, too. Statistically speaking, it would be very difficult to say that such aircraft is inherently safer or more dangerous than this one in the field of modern commercial aviation. However, it is a certainty that Airbus is on the side of "the computers are always right and will have the last word". Boeing would say "the computers are very good, use them, and if you feel like you are better, you are free to give it a try, but dont come back to us crying". A difference in philosophy, not in numerical safety.

Did the pilots change over the years ? Certainly. Nowadays, at some airlines, an instructor or examiner will slap your hand if you choose to fly manually during some parts of a sim check. It is forbidden to touch the manual pitch trim of any Airbus if it is not flying in Direct Law, which never happens in the sim, except for one minute and a half upon initial training so the appropriate box can be ticked. Yes, airline pilots had to go through major rethinking of their role, function, skillset, attitude, etc... It is called "progress". Those who resist this are called "Luddites" or "dinosaurs", regardless of age, by the way.

So, dear Mr Passenger, here was a short answer to your very relevant questions.

Best regards

Svarin

May 26th 2011 at 1205UTC - This post has been edited by parties unknown to me. Profanity was removed. I can accept that. However, Airbus "philosophy sentence" has been modified. I rest my case that a vast majority of professionals -including myself- perceive this particular manufacturer as always trying to deflect blame for an incident or accident from its own design towards so-called "pilot error". This would not be a responsible attitude.

[john_tullamarine]

So what has changed?

It's not quite as simple as that -

(a) certification processes are very comprehensive and address a generalised set of requirements held to provide a very high probability of successful in-service operation.

(b) the aircraft as it comes through the certification process will have shown compliance with the set of certification requirements pertinent to the design

(c) however, the certification standards don't provide an absolute guarantee that the aircraft will be able to weather every conceivable set of circumstances with which it might be tested in service

(d) sometimes (and this may take quite some time to materialise) a set of circumstances will arise which conspire to defeat the capabilities of the aircraft and the presumptions which went into the design and certification processes. It may turn out that this sort of situation confronted the crew of the mishap aircraft which is the subject of this thread.

(e) sometimes a comparatively simple problem within the state of the art knowledge combined with significant design advances will present a problem. The early Comet fatigue problems are a useful instance of this.

(f) sometimes the man-machine relationship may not quite work as well as was presumed and intended. This sort of consideration may turn out to be material in the present case under discussion.

It is common to see progressive minor changes to an aircraft Type as in-service knowledge is accumulated.

Sometimes such development is subtle in that it is not evident to the wider Industry. Instances include routine engineering design and maintenance practices changes. All Types experience this sort of development throughout the life of Type.

Sometimes changes may need to be effected quickly and these usually end up as Airworthiness Directives. I can't bring to mind any aircraft which has not been the subject of ADs.

Very occasionally, a Type may have problems arising sufficient to warrant a revisit of the Type Certification process. Not many Types are subject to this re-examination.

At the end of the day, do I worry about flying on either a Boeing or Airbus (or any other reputable) aircraft ? Of course not.

Having been involved in the design and certification processes for just about all of my working life, I am content to accept the low risks inherent in flying in certificated aircraft and equally content to accept that they are not perfect and come with flaws.

If the flaws are minor, such are worked around by engineering, maintenance and operational standard practices - if major, by modifications, as appropriate, to aircraft or procedures. All part of normal aeronautical processes.

[infrequentflyer789]

@Gibon2

Good question, I've seen raised elsewhere too (more below)

@Svarin

Good points, especially the piloting changes - I don't think any of the a/c designers, A or B or other, intended the result of improving the plane/automatics side of pilot+plane to be that the airlines then dumb down the pilot side to compensate

I would venture to add:

Unique circumstances is possible - even after all those years. BA038 fell out of the sky after almost the same length of exemplary 777 service. The design failing blamed has been there from the start - it just took that long to show up. The investigation went through probably millions of hours (175k flights) of past 777 flight data and found that the BA038 flight was unique. No other flight in all that time went through the same environmental conditions.

Selective reporting is also possible - maybe the pitot events have always been happening but not reported. Usually the events last only seconds and cause few or no problems. After one or two incidents raise the profile (before 447), maybe you start to get more events acutally reported. After BA038 I think there were some other brief transient rollbacks reported (at altitude where didn't cause a problem) that may well be the same cause, but were just never reported before.

[Svarin]

infrequentflyer789 wrote :

I don't think any of the a/c designers, A or B or other, intended the result of improving the plane/automatics side of pilot+plane to be that the airlines then dumb down the pilot side to compensate

Then why the aircraft that can be flown by "concierges" ? If not to recruit, train, pay, and respect pilots like "concierges" ? Remember the late eighties. Refusing to see an intent there is naive.

[Graybeard]

Windshield Heat

OK, I apologize for the wrong way detour, comparing pitot icing to windshield icing. At some point I knew better.

Should I remove the errant posts, or just leave them?

[jcjeant]

Hi,

maybe the pitot events have always been happening but not reported

Methink it was a know problem .....

In December 1995, Airbus was the finding of a lack of certification of pitot probes: Ice crystals clog the probe which causes severe degradation of calculating flight parameters. This is not a failure, it is a defect of the Pitot probes. According to the regulations in force on the day of the accident, Airbus had an obligation to correct this defect.



Instead of eliminating this defect, Airbus decided to ask the drivers to ensure accountability through the application of the procedure: Following the amendment of the Aircraft Flight Manual for the A330 Airbus, the DGAC imposed in February 2001 a new procedure for pilots titled "Unreliable airspeed conditions" in case of loss or inconsistent speeds measured [AD 2001-069 (B)]. The FAA took over the DGAC AD in June 2001, but noting that this initiative was in response to an "unsafe condition" that could lead to the A330 outside its flight envelope [AD 2001-13-13].



The regulations in force at the time of the accident did not allow a manufacturer to remedy a default by the application of a procedure. In addition, this procedure will be difficult to apply when two precursor events of the accident of Flight 447. Airbus will admit eight months before the crash on 1 June 2009, but nothing will change:



At the end of August and early September 2008, two A330s for Air Caraïbes Atlantique (ACA) encounter severe icing conditions that cause the cruise blocked pitot probes Thales SA and inconsistent measured velocities. During the following October, the Directorate of ACA initiates a meeting at the premises of Airbus in Toulouse. According to the report of the Flight Safety Officer, Airbus engineers have understood at that meeting "the difficulty encountered by the crew for a rapid implementation and effective procedure SPEED INDICATION unreliable and" thinking therefore a modification of checklists.



This procedure made available to drivers to compensate for the lack of pitot probes and "unsafe condition" that resulted was not only inappropriate but also ineffective.



But after the crash of Flight 447, Airbus that did not stop to remind drivers that this procedure should be applied in case of inconsistency of measured velocities (Accident Information Telex No. 2 dated 4 June 2009)

1995/Novembre December 1996: TFU 34.13.00.005 (see document). Airbus made the finding of a lack of certification on pitot probes and Launches Development of the probe Goodrich P / N 0851HL.



"STRONG cumulonimbus (Cb) A HIGH DENSITY OF Containing ICE CRYSTALS CAN BEEN COUNTERED, PARTICULARLY IN THE Intertropical Convergence Zone (ITCZ). IN AN ICY SUCHA AND TURBULENT ATMOSPHERE, THE A / C AIR DATA PARAMETERS (PRESSURE DEPENDENT) MAY BE DEGRADED Severely, Even Though THE PROBE HEATERS WORK Properly.

IT HAS THE CHARACTERISTICS OF THAT Appeared SUCHA AN ENVIRONMENT COULD EXCEED THE WEATHER SPECIFICATIONS FOR THE PITOT PROBES Which ARE CURRENTLY CERTIFIED.

THE WEATHER SPECIFICATIONS (ICING / LIQUID WATER CONTENT / GUTLET SIZE) TO THE PITOT PROBES Which RESIST SHALL HAVE BEEN UPDATED WITH MORE Therefor Stringent REQUIREMENTS ON THE BASIS OF THE FIELD EXPERIENCE AND RECENT EXTENSIVE FLIGHT TESTING.

AIRBUS HAS LAUNCHED THE DEVELOPMENT OF THE modificiation followin:

1. DEVELOPMENT OF A NEW PITOT PROBE ABLE TO MATCH THE NEW REQUIREMENTS. ALL FLIGHT AND WIND TUNNEL TESTS TESTS ARE COMPLETED AND NOW SUCCESSFULL: THE CERTIFICATION OF A NEW PITOT PROBE HAS BEEN IN EARLY NOVEMBER Obtained 1996 (NEW PITOT PROBE: P / N 44836 851HL MOD). "(See document)



November 1996: The probe Rosemount P / N 0851GR is replaced by the probe Goodrich P / N 0851HL, (Service Bulletin A330-34-3038 for Model A330-301, -321, -322, -341, and -342 Series Airplanes) (ref. FAA states that this replacement is made necessary because the inconsistency of measured velocities can cause the A330 outside its flight envelope). This new probe is duly certified by Airbus.



December 1998: Emergence of the probe Sextant P / N C16195AA who replaces her as the probe Rosemount P / N 0851GR but for a limited number of A330 (Service Bulletin A330-34-3071 for Model A330-301 Series Airplanes) (ref.FAA). How the new probe has it been certified by the DGCA considering the experience Rosemount? For more demonstrates its inefficiency!



August 2001: The DGAC mandated these two replacements by AD 2001-354 (B) (see document):



"The following measures are rendered mandatory from the date of entry into force of this AD: Before December 31, 2003, unless already done, remove the pitot probe type ROSEMOUNT P / N 0851GR and replace them either by probes BF GOODRICH AEROSPACE type P / N 0851HL, according to the instructions of SB A330-34-3038, or by type probes SEXTANT P / N C16195AA accordance with instructions of SB A330-34-3071. "



July 2002: In the ILO 999.0068/02/VHR SE (see document), Airbus made the observation of defects of the probe Thales (formerly Sextant) P / N C16195AA



THE AIM OF THIS IS TO INFORM THE ILO OPERATORS THAT SEVERAL OPERATORS HAVE REPORTED SINGLE AISLE AIRSPEED ON AIRCRAFT FITTED WITH Discrepancy THALES PITOT PROBES PN C16195AA.

.



Following is a series of conflicting decisions that demonstrate the inability of Airbus to get rid of one type of probe that meet standards dating from 1947, unsuited to the reality of the environment in which the aircraft ( see previous notes). The observation made for the probe Rosemount in 1996 has obviously not been used for the probe C16195AA!



September 2007: In a Service Bulletin (see document), Airbus recommends replacing the probe Thales P / N C16195AA by sondeThalès P / N C16195BA following further serious incidents.



September / October 2008: defects of the probe C16195BA Thales, "which was not designed to address the problems of icing, are recognized by Airbus and Air France (see the document Info TFN No. 5).



June 9, 2009: One week after the accident of Flight 447, the A330-F GZCP probe was equipped with Thales C16195-AA, Airbus launched an investigation into the case of inconsistency between the measured speeds reported by operators on Airbus A330/340 and took in early August decision to focus the probe Pitot Goodrich P / N 0851HL. EASA followed of course ...





One issue on which the DGCA must be answered is "How the Sextant pitot probe (later Thales) C16195-AA she was certified in 1998 given the experience Rosemount? "

[sensor_validation]

Originally Posted by mitrosft

I believe that Airbus software is probably missing simple protection in airspeed data readouts. At least manuals in previous posts do not describe any such measures.

If ALL Pitot tubes freezes and IAS deviates by 1-50% then computer before admitting that airspeed data is correct should check the acceleration/decelaration rate from inertial sensors. This simple cross check would protect from any type of tubes failure (freezing, blockage etc)

Don't under-estimate Airbus engineers, 3 sensors, median filters, time delays are all included to minimize false alarms, but what is left is the remote possibility that any 2 may fail in exactly the same way at the same time - so check out the following, especially the 'foreign filing date Sep 23, 2009' :-

United States Patent Application 20110071710 Kind Code A1 Puig; Stephane ; et al. March 24, 2011
METHOD AND DEVICE FOR DETECTING AN ERRONEOUS SPEED GENERATED BY AN AIR DATA INERTIAL REFERENCE SYSTEM

Full text is available on uspto.gov, the "BACKGROUND" section is very clear why such a new idea would be useful.

[Svarin]

Philosophy

It must be stressed here, mostly to attention of the potential reading public, that safety, especially safety as a statistic, is not at stake when discussing the various merits or failings of this or that design. Another simpler way of putting it is, as a passenger, it doesnt matter which type of aircraft one flies in. In the modern day, all recent aircraft types have a very excellent safety record.

As a pilot, it becomes very different. At one end of manual, old-school, dinosaur-like thinking, the pilot has all authority and all responsibility. At the other end of fully automated drone-like transportation system, the system itself, its computers, have all authority and all responsibilty.

The real philosophical question faced today by passengers is whether they would entrust their lives to a (very well-trained) human pilot (who will share their fate), or to a (very well-designed) computer.

In our subject matter, the problem is the aircraft and its designers claim full authority in the name of "envelope protections", which could allow a "concierge" to fly the airplane, but then when things go wrong, some fault is always found with the pilots which somehow shadows that of the design.

Ultimate authority cannot be separated from ultimate responsibilty.

The only difference is not in numbers but in philosophy. As a passenger, I can entrust my life to someone who puts his own life on the line with mine. I can accept responsibilty and pay the ultimate price if I fail to deliver that promise as a pilot. But I will not accept to play scapegoat for a system that claims to be safer than I am when it is easy, and that evades responsibility when things go wrong.

[davionics]

Dependability of a system is that property of a system which allows reliance to be justifiably placed on the service it delivers.

Models and meta-models can never account for all the situations and unplanned events in the real world. Dependance on services provided by systems (be they mechanical, electrical, meteorological, organisational, biological, hardware or software) is what every pilot must contend with to operate within safe limits.

It would make sense to use multiple air data sensors (N-version redundancy), of multiple designs (diversity of design), using various watchdogs (error detection) to monitor the health of each sensor and provide the pilots with pure go-no-go data. Technology exists such that a pilot should never be in a position where he or she has to question the quality of primary air data. Air data systems on passenger A/C without the aforementioned should be rated VFR only IMHO.

[forget]

sensor-validation, Interesting find on the Airbus Patent Application. You won't mind if I post a direct link?

METHOD AND DEVICE FOR DETECTING AN ERRONEOUS SPEED GENERATED BY AN AIR DATA INERTIAL REFERENCE SYSTEM - AIRBUS OPERATIONS