Peter Fox

Very true Checkboard,

however, have a look at our QRH (A319/320), page 2.16:
"If remaining altitude indication is unreliable:
- Do not use FPV and/or V/S which are affected.
etc....

I read this as follows:
You can not rely on the FPV all the time.

In case of erroneous Air Data I would, personally, go for the Pitch / Power settings given/memorized.
Then GPS alt.
If the FPV matches all of those, good. I _might_ consider using it.

Cheers

mm43

Checkboard has shown you the display, but the crew selected the appropriate page(s) and a not available warning was displayed. This information became the subject of 2 x ACARS messages timestamped 0211 and received 2:12:10 and 2:12:16 respectively.

EDIT :: List of ACARS Messages

Alber Ratman

Thanks checkerboard.. Would the crew have changed screens in their situation if the flight vector had not been selected / knocked out?

True, the AOA data would have also been false due to lack of airspeed on the vane and may have been another inject to make a bad situation even worse.. However it might have done the opposite to confirm what state the aircraft really was in..

EDITED.. Other posters have stated that such infomation was knocked out with the first ACARS messages.

gums

I don't think the thing works like we expect, RetiredF4. It doesn't even work like the Viper or Shuttle FBW.

After going thru the manual once again, looks like the trim is not set for a gee command from the stick. It's set for 1 gee at bank angle zero and a bit more up to 30 +/- degrees of bank.. In other words, if you hold the stick back "x" degrees for "x" gees, you don't gradually move the stick to neutral and continue at the original "x" gees you commanded.

So for you 'bus drivers!! Would love you to try it for real, but let's use the sim. Command 1.5 gees with aft stick and let us know if you can gradually let off the stick and maintain 1.5 gees. I don't think so. From what I read, as soon as you let go of the stick the plane tries to get to 1 gee.

The Viper pitch trim was gee, and stick commanded gee like the .bus. We had a roller trim doofer and could trim for a gee or so negative up to a max of 3.5 gees positive. The stick added or subtracted from this. So we could roll it ( trim wheel) full aft and do a really neat hands off loop that started at 3.5 gees, then let off once AoA got above 15 degrees, then continued over the top at 25 deg AoA until back to 15 deg AoA ( due to increasing speed), then come out the bottom at 3,5 gees. kinda neat, huh?

So the so-called auto-trim means you don't have to crank a wheel or use a trim hat switch when speeding up or slowing down or in a turn at 30 deg of bank +/-. Then, you have the plane (Airbus) trying to maintain a speed/mach according to the AP mode and also trying to "protect" you from bad conditions. The Viper had the gee command for pitch ( body rates and AoA blended), and so we had pee poor speed stability, but we stayed at 1 gee or the trim setting. No auto throttle, ya see?

One of the laws in the 'bus will crank the THS nose up if the computers think you are overspeeding. So with all the sorry data being fed the AF447 computers, I can see the plane cranking the THS all the way up.

CONF iture

No Paul and Airbus thinks it is just fine ...

BarbiesBoyfriend

The Colgan crew were near the stall.....but pulled.

This crew seem to have had stall warnings and also pulled.

Surely to goodness, faced with unreliable speed, the LAST thing you'd do is pull?

DozyWannabe

Based on the information we've had over recent years, it's not that uncommon an accident type (now that more basic errors and systems failures have reduced in number). Night operations are the worst possible time and place to have unreliable instrument indications - being in the vicinity of convective activity only adds to the risk - certainly something that would weigh heavily on the mind of any pilot in that situation, regardless of experience, age, type rating or temperament.

The attitude indicator/"artificial horizon" would have been telling them exactly what was going on in that regard. However, as has been shown by accidents over the last 20 years, how pilots react when instruments become unreliable is heavily dependent on their aeronautical knowledge and temperament. In the case of the Birgenair 757, only one pitot tube (the Captain's) was blocked, and all other instruments including the F/O's ASI were indicating correctly. Despite this, the Captain seems to have almost shut down, focusing on his erroneous speed indications despite the F/O clearly warning him that his own instruments indicated that they were stalling.

The question is - given that you know at least one instrument has failed, how much are you willing to trust the others? In this case you're in the middle of threading your way through some dicey weather conditions in the middle of the night, so you have no outside reference, and as has already been pointed out it's around 3 minutes from the onset of stall to impact with the ocean (it took me longer to write this paragraph).

Or possibly, you know, just releasing information that they can confirm completely at this time rather than releasing information that needs time to be double-checked and re-checked. In their position would you rather go with what you know and can prove, or go off half-cocked and possibly have to issue an embarrassing retraction at a later date?

That said, thanks for the link - this seems to have some relevance by my reading (emphasis mine):

If I've got this right - the system will detect the unreliable speed indications and simply give the pilot the authority requested (in this case full nose-up or thereabouts). Loss of airspeed indication basically implies stall protection is minimal, if not lost entirely in this failure mode.

[EDIT: Just checked - autothrust was disengaged early in the accident sequence. With autothrust disengaged, stall protection in this mode is indeed non-functional. At Habsheim, we saw a demonstration of what Normal Law will do to prevent stall in the event of autothrust disconnect/disable - i.e. command elevator inputs to maintain incidence even if the PF attempts to command nose-up. It would appear that Alternate Law in combination with autothrust disconnect defers to pilot input (as designed).]

Really, CONF?

Looks like he was perfectly aware from where I'm sitting...

Des Dimona

If both PFD's and the ISIS had correct ATTITUDE information, then application of significant forward S/S pressure to place the pitch attitude well below the horizon, irrespective of the IAS indications across the cockpit, would probably have changed the outcome.

Unfortunately, this comes with hindsight and a wider knowledge of the changed Airbus procedure for stall recovery. (which incidentally, is the same as the stall recovery I was taught in light aircraft in the late 1960's! - ie reduce the angle of attack).

Development of the Airbus flight control systems during the 1980's focused so much on the level of protections, that there was no real thought by Airbus engineers that a line crew would ever be confronted with the events that AF447 ultimately experienced.

Stall recovery at that time was based on TOGA thrust, perhaps along the lines of propeller aircraft that developed significant airflow over the wings due to prop wash when power was increased? This was not unique to Airbus.

Habsheim (Idle thrust into the trees) and Air INTER (incorrect FPA set) created the first clues that modifications needed to be made to the AB flight control and FCU systems - and it's been a steady stream of changes since then.

The latest incarnation of the UNRELIABLE AIRSPEED reinforces attitude flying + thrust setting = performance.

This works well at lower levels provided it's followed. Around the FL 350 area in a very heavy 320 / 321 / 330 / 340 , I don't think setting 5 degrees nose up and CLIMB thrust would be such a good idea ?? At these levels, there is virtually no margin between cruise and climb thrust and all that's going to happen is a speed reduction. At standard ECON speeds, it won't take long for the speed decay to reach VLS and below.

This checklist needs to be modified to look at higher flight level recovery.

Up until now, triplicated computer systems as installed in Airbus products can provide problems. If 2 of the three say one thing, the voting system will assume they are correct and "outvote" the third and possibly only correct system. This is one very important reason to get pitch attitude and thrust settings from the QRH to check what is really going on.

At heavy weights and high levels, I have the descent numbers from the QRH U/Airspeed checklist (IDLE thrust and the appropriate pitch attitude) handy and that's what I would be using (after recovering from any STALL warning) , until we can establish which instruments are correct.

Much more basic training needs to be provided by manufacturers during type ratings so that we have a much bigger awareness of the art of attitude flying.

Far too much reliance on automated systems is causing as many issues as these systems were designed to address.

In many years of Airbus experience, I have had two events that required manual flight and attitude intervention due to IAS irregularities. Both involved icing events.

I wonder what the real number of these occurrences has been over the last 20 years ?

Checkboard

I don't know why this would be, as the FPV and the VS are derived purely from the Inertial Reference System (IRS).

That's right - the stick (usually) commands a G acceleration - pull back for 1.5G pitch up, and that's what you get as long as you hold the stick back. The nose raises - then when you return the stick to neutral, the nose stops rising, the G returns to 1G and the aircraft trims to that position, so the nose stays where you put it.

The AoA data from the vane is fed to the Air Data Units for stall calculation (and some other stuff). The PFD indications and the FPV are from the Inertial Reference Units - nothing to do with air sensing.

SandyYoung

I know nothing about flying but having spent most of my professional life writing software am well aware of the difficulty of the 'user interface' between man and machine.

One thing is crystal-clear here - the current system is far, far too complicated for any normal mortal to deal with in an emergency. If professionals can't agree on what works what, whilst sat at a comfortable desk with all the time in the world to think about it, pity the poor souls at the sharp end with two or three minutes to sort out what can only be described as a mess of meaningless abbreviations, dials, guages, bells and whistles. And in darkness.

If he or she doesn't know what speed the plane is travelling at and whether it's pointing up or down perhaps the time has come for a major re-think.

These systems are fine when they are working but if something goes adrift we are asking far too much of the pilots.

Shovelling in yet more software is not the answer. Less might be better.

Peter Fox

SandyYoung:

Lets have an analogy:
You walk along a straight road. At a constant pace. Suddenly you close your eyes.
Do you:
a) Try to keep walking straight. At a constant speed.
b) turn left and start running, then slowing down, then turn right, maybe even backwards?

In pilots terms:
Set a pitch attitude. Set Power. You get performance.

Then open your eyes again.

Read the QRH.

Cheers

Peter Fox

Checkboard,

I do not know either.

But it is there, black on white regarding the FPV and V/S.

What it also says is:

RESPECT STALL WARNING!

Something to remember!

Cheers.

Nekkie

It all started with an unreliable speed, so they didn't trust the speed indicators. In the turbulence they lost all sense of what is up or down. They thought they were not stalled because the stall warning did not sound. When they pushed the nose the stall warnign came up, so that must have made them think that could not be trusted either. Adrealine is rushing and you see the altimeters showing high rate of descent. You think you are diving and pull up. If that does not help panic brakes out and clear thinking stops...

DozyWannabe

@SandyYoung:

It's not really that complicated, it's just a case of applying common sense. The computers are driven by the same sensors that drive the flight deck displays in front of the pilots. If the pilots can see that that their airspeed indications have failed, then it's not a major logical jump to know that the computers have detected that airspeed indication has failed, and it can be reasonably assumed that any protections requiring airspeed information (chief among these being stall protection) will no longer function.

At the risk of sounding like a broken record myself, from this point onwards it doesn't matter if the aircraft you are flying has FBW or conventional controls, glass cockpit or "steam gauges", the onus is on the pilot to diagnose what *is* in fact working and then use that information with their knowledge and training to try to rectify the situation. Sadly, the odds are heavily stacked against even the most experienced and able pilots when they have no outside frame of reference and such a limited time to perform said diagnosis. It's the one situation where the knowledge that one has to do something, coupled with the knowledge that to do the wrong thing could doom you and everyone behind you would put an unbearable amount of mental pressure on even the most unflappable individual or crew.

@Nekkie:
You've also got an attitude indicator telling you you're nose-high. If you see nose-low in your AI and a high rate of descent then you can conclude you're in a dive and pull up. Nose-high with a high rate of descent and the only reasonable conclusion is that you're in a stall and falling. Once you've been able to work that out, you put the nose down and cram on thrust until your stick inputs start to make sense on the AI, you then level out and fly pitch and power until you're confident you're fully in control. The problem, as lots have pointed out, is that it's pitch black outside, so you have no confirmation that your AI is telling you the truth and you've got 3 minutes to make that call with a cacophony of lights, messages and warnings going off around you. Your boss has just entered the cockpit, maybe he can help? But the clock is already ticking...

Svarin

Gentlemen,

after this one, I will take an extended leave from pprune. The hairy troll gets hungry and will go out to pick mushrooms. I have worked way too hard on this, and my life (yes I do have one) is calling me.

For those who are ready to read and try to understand with an open mind, please bear with me.

I have come to study very carefully the flight control system mounted on this type of aircraft. Whatever modest findings I came up with do not exclude any other factor added to the accident sequence. Yes, I may even be wrong ! At this stage, however, findings provide material for crucial questions.

What prompts me to question the Flight Controls System in this instance has two aspects :

- a philosophical aspect, as I explained in earlier posts : since the system is built in such a way as to claim final authority (under certain circumstances) over the aircraft control surfaces, it should be questioned first, regardless of pilot actions, and regardless of which law it is supposed to have been working in, or what the aircraft FBW system advertised capabilities are. Its central position in the design and its criticality in a Loss Of Control accident should make it the subject of extremely careful scrutiny as a matter of principle.

- a technical aspect, the core substance of which I will now address.

As an introduction, it must be stressed that "protections" are provided in many forms for this aircraft, and the really assertive forms of protection do not come from the autopilot but directly from the main Flight Control Computers, the PRIMs, even in manual flight, and even in alternate 2 law, albeit in a less severe version. Only Direct law and worse remove all protection.

Three out of five components of the Flight Controls System have suffered anomalies :

- PRIM2 suffered a connectivity problem with ADR1, such problem is deemed HARD, which means permanent, not transient.
- PRIM1 stopped operating.
- SEC1 stopped operating.

These anomalies have consequences which can be verified using the Flight Controls Reconfiguration Schematics from FCOM chapter 27 :

- PRIM2 is tasked with THS motor because PRIM1 quit.
- PRIM2 is tasked with both elevator halves because both PRIM1 & SEC1 quit.

Additionally, PRIM2 operation is polluted because it lost connectivity with ADR1, thus reducing its discriminating capability while simultaneously getting fed multiple erroneous ADR data.

This simultaneous double failure condition : connectivity + erroneous data, is an extremely serious issue. I very much doubt that such apparently unrelated, simultaneous, totally different failures (external cause -> icing + internal cause -> wiring) were ever considered together during the design phase of the Flight Control System.

This extraordinary combination precisely affected the one computer which ended up being tasked with :
- interpreting sidestick commands on the pitch axis.
- sending orders to the hydraulic servo jacks located on the elevator moving parts.
- sending orders to the electric THS motor.
- providing whatever "protection" it deemed necessary to provide while in its undefined state (unreliable ADR data + lost connectivity with one ADR)

The lethal question exists in either of these modes :

- the researcher will ask : what is the exact state of PRIM2 throughout the whole event and what is its exact role in its unfolding ?
- the pilot will ask : what the heck is happening ?

It took me two years to simply get an adequate understanding of the core issues. They had two minutes before it was doomed.

Rest In Peace.

Svarin

PS : Post Scriptum / Pure Speculation

PURE SPECULATION BEGINS
"Je ne comprends rien."
Total confusion. Unimaginable betrayal. Such as Flight Controls twisting on you.

I have been asked to describe the protections I thought interfered with the pilot's actions. Contrary to all that I have posted before, what follows is pure speculation. The relationship with any real accident would be coincidental. This does not mention any aircraft-specific data. We, I do not know what happened yet. This is provided only as a thought-provoking element, which, although speculative, is not contrary to such kind of system's description under the condition of erroneous data being fed to a computer which did not correctly assess its degraded state. In other words, an example of a Byzantine fault made manifest :

-imagine two concurrent protections triggering alternatively upon erroneous indications. Imagine the Flight Controls System erroneously believing itself deep into coffin corner, overspeed and low stall at the same time.
-Stall protection has first priority and pushes the nose down without the pilot knowing why, and when the pilot pushes the control down, stall protection deactivates (the pilot did the right thing).
-Then overspeed protection undesiredly kicks in (second on protection priority list) which pulls the nose up, again without the pilot knowing why.
-The time lag between the two is such that, as the pilot pushes and waits for a result, the protections switch to overspeed and the aircraft noses up, and as the pilot pulls up, the protections again switch to anti-stall and the aircraft noses down until stall protection deactivates.
-And the cycle continues. One way to try and break it is to deliberately apply one clear, full deflection control command for a significant amount of time, and see what happens.
-Both protections acting undesiredly in this kind of deadly ballet would maintain AoA more or less near its maximum until real stall occurs from total energy depletion. Deep stall follows.

Too complex, eh ? No way this can be true, of course. But it sure makes one think twice about "protections", especially multiple, contradictory ones.
PURE SPECULATION ENDS

PPS :

Can any protection backfire on you ?
Mother said you would be safe from harm
A child can dream of becoming a pilot
But a pilot is not a child anymore

takata

Hi gums,
You should read again what flight envelope protections are left under ALTERNATE LAW 2, also displayed as ALTERNATE LAW (PROT LOST).
Difference between ALT1 and ALT2 is due to loss of Air Data, it just can't work with unreliable Air Data (at least 2 reliable ADRs needed).
ALT2= no high speed protection, no high angle-of-attack protection, because no valid airspeed can be computed by the PRIMs to display VMO/MMO or Valpha-prot and Valpha-max = Loss of the function enabling calculation of limit and characteristic speeds.
In fact, this may explain why the PF was pitching up before realising that it was not working. He was not stable due to oscillations (turbulences?) and wanted to slow down to better manoeuvering speed and to catch up Alpha-prot... which was never triggered.

BarbiesBoyfriend

Surely to Goodness, if it all goes to hell, fly attitude.

The EADI will (most) always tell trhe truth.

In a big ol' Cb, you cant hold height or speed anyway, but you CAN hold attitude.....and as long as you do so you're in with a good chance.

I think these guys may have been poorly served by their (A/P loving) training.

john_tullamarine

I don't think I've ever seen a thread put on 12 pages of posts overnight.

For those who wish to review the earlier threads, a link to thread #2 can be found in post #1 of this thread and similarly in thread #2 to get back to thread #1. Both of the earlier threads will be deep in the archives so the links are the convenient means to step between threads.

I have to agree with several posters - BEA has added to the confusion by giving up so little to mull over in its latest release.

DozyWannabe

OK, once more and then I'm signing off for a bit - I've noticed my handle cropping up far too often in the last few pages for it to be healthy.

And you can bet it is, right now, the subject of lab tests and simulator runs that will take months to perform and collate the data from.

Their design, however, is very clear on the fact that loss of speed information -> no more autothrust -> practically no stall protection.

Actually, what you're describing would be relatively trivial to set up on the test bench, and is the very epitome of what software engineers refer to as an "edge case"

A series of tasks for which it is eminently capable

But it knows that no speed information -> no stall/overspeed protection.

It is a "baked in" assumption in the design of the system that if it is ever incapable of making a judgment, then ultimate control authority is given to the pilot, who has an array of instruments and, in daylight, can see outside and use external references if necessary, something the system cannot do.


Problem being, there is no speed indication - the flight management computer knows this, and is therefore unable to command either overspeed or stall protection. It's all there in Alternate 2 (aka Alternate "NO PROT" - is it becoming clear yet?).

The question is, how can a protection that has been disabled by design cause the scenario you describe to unfold?

Instinctively I'm inclined to agree with you. On the other hand my mind goes back to the Birgenair 757 incident, where a long-serving pilot who came out of the Turkish military was just as flummoxed by a similar situation. Which leads me to wonder - regardless of whether training turns out to be a factor, what part does temperament have to play?

Graybeard

From series II: (last night)

We don't know by how much margin they passed the tests, or whether deterioration of either the probes or the power supply or wiring have been a factor. We do know the pitot on the A330 have not always been robust enough for real life icing.

We also know that the computers were not robust enough to accommodate erroneous airspeed.

GB