Go Back  PPRuNe Forums > Flight Deck Forums > Tech Log
Reload this Page >

AF 447 Thread no. 4

Tech Log The very best in practical technical discussion on the web

AF 447 Thread no. 4

Old 2nd Jul 2011, 11:29
  #641 (permalink)  
 
Join Date: Jan 2008
Location: Blighty (Nth. Downs)
Age: 73
Posts: 2,091
Quote from Linktrained:
The PF on AF447 may have seldom hand flown at cruising level. If, and just if, he had gripped the SS too firmly with his fingers, would this, could this, induce a NU, which in turn would be taken as an order by the trimmer, slowly to wind on full NU ?

I think a number of us are of that opinion, and the PF had lateral-control issues to cope with. These might have distracted him from pitch control, as well as causing him to tighten his grip.

Quote:
A gradual change of whatever indication there may be of the amount of trim might have been overlooked - there was a lot going on. ( I might have a light flash on when more than 75% has been used, just to remind me.)

Many aircraft have aural warnings, such as the "whooler", whenever the THS is in motion. I quickly learned to prefer Airbus's philosophy of a "quiet, dark cockpit". But in the case of an abnormality such as Alternate Law, perhaps something like the whooler should be provided.

IIRC, THS position is not normally displayed on the centre panel en-route, so the PF has to avert his gaze to the trim wheel if he wants to check its position or movement
Chris Scott is offline  
Old 2nd Jul 2011, 12:05
  #642 (permalink)  
 
Join Date: Jun 2011
Location: Devonshire
Age: 92
Posts: 300
Retired F4's flight deck sounds ideal, just red, yellow and green actions to worry about. ("simples !") Even I might cope...

AF447's PF was for the time Acting Captain. They had not been able to contact Dakar. I do not know who they might have been able to contact. There were drills for loss of airspeed. ( From NWA and TAM we now know that this may have been of relatively short duration. Jetstar's was a few months later. All four were over water- although that may not be relevant. Different makes of Pitot appear to have been used.)
If one could reasonably anticipate the loss of Pitots leading to the need for hand flying for,say, half an hour, ought one to try to reduce ones flight level by say 4000 ft. This should give a greater speed range within which to fly, not too slow and not too Mach.

Earlier aircraft had a Penetration Speed for going through Cbs, without any radar, day or night. For me, this was until the 60s.

Last edited by Jetdriver; 2nd Jul 2011 at 14:45.
Linktrained is offline  
Old 2nd Jul 2011, 12:16
  #643 (permalink)  
 
Join Date: Apr 2011
Location: NottNum
Posts: 25
Originally Posted by A33Zab View Post
Remarkable, Engines have only 2 channels for control, 2 sensors for each parameter; B777 has only 2 AOA vanes fitted.
And usually two pilots.

What happened with redundancy here? even more 'ridiculous' design or clever engineering?
Clever engineering, risk assessment and mitigation.

Pitot tubes are here for the foreseeable future and the public demand for air travel requires flight into known icing conditions. The failure modes for pitot tubes are well understood but cannot with current technology be 100% engineered away.

Part of the risk mitigation is having two pilots (who have regular medicals etc etc), and a computer which recognises problems with the pitots and hands control over to these humans at an appropriate point. That recognition/handover appears to have been done properly.

Arguing about redundancy in pitots appears to be missing the point. The drama was turned into a crisis elsewhere.
PA 18 151 is offline  
Old 2nd Jul 2011, 13:05
  #644 (permalink)  
 
Join Date: Feb 2011
Location: Nearby SBBR and SDAM
Posts: 873
Diversity of methods and Pattern Recognition

MachinbirdIn dealing with the product limitation of current Pitot´s, Diversity could be implemented (for "brief" AS fluctuactions) and probably could be better than the use of a "memory mode" band aid. In this aspect Turbine D approach could be one method.

Pattern recognition techniques are powerful in preventing and after the (possible and improbable) UAS events.

This can be done and the on board redundant processing power allow the implementation. The required R&D could optimize defining the extra required hardware.

Ideally diversity could perhaps help in some (extreme) cases (Birgenair and perhaps even Guam B2) providing less precise data but avoiding abrupt a/c config changes.

Diversity (inside the Redundancy concept) should be applied to reduce surprising and dangerous abrupt transitions from "Normal Law" to "Murphy Law scenarios" with unpredictable consequences. All this for creating degraded, but administrable situations. Obviously always we will face limitations. There are some possible but improbable issues that could be considered in the System (a/c+operation) R&D without incurring in initial prohibitive costs. The 737 rudder (PCU) issue is an example of this "costs" (without mention the lost lives in FLT´s 585, 201 and 427). Competent designers in good R&D teams know well this matter.

Drifting a little bit:

L1011-500 superb characteristics may be could be mentioned in this aspect. The challenges they faced were very "high" And they also put an angel to fly (high } at FL600 in 80 days
RR_NDB is offline  
Old 2nd Jul 2011, 13:36
  #645 (permalink)  
 
Join Date: Feb 2011
Location: Nearby SBBR and SDAM
Posts: 873
Adequate redundancy (always under K.I.S.S. constraints)

A33Zab, the point is: We must consider in the System design (a/c+crew operation) everything to avoid going straight from "Normal Law" to "Murphy´s Law"

And remember, i am against the (ridiculous) redundancy (wrongly applied) when critical System elements are prone to fail simultaneously. Your examples doesn´t fit in this category. And even if this occur, you can save the day in most of cases. (Looking to your question, BA 38 and FLT 1549 came to my mind)

PA 18 151 mostly in here and here

Last edited by RR_NDB; 2nd Jul 2011 at 13:52.
RR_NDB is offline  
Old 2nd Jul 2011, 14:10
  #646 (permalink)  
 
Join Date: Feb 2011
Location: Nearby SBBR and SDAM
Posts: 873
Causality

PA 18 151, Technically speaking (from an instrumentation point of view) this figure can be negative. I.e. you receive the information on UAS before you lost AP, etc. I commented something related here and in earlier post(s).

Contributing factors are not yet known but may include other man/machine interfaces. Re:
RR_NDB is offline  
Old 2nd Jul 2011, 14:23
  #647 (permalink)  
The Analog Kid
 
Join Date: Aug 2004
Location: Brecon Beacons National Park
Age: 53
Posts: 239
Originally Posted by PA 18 151
Absolutely. And the evidence released by the BEA says the time between autopilot disconnect and recognition by the crew ("lost the speeds/alternate law") was 9 seconds.

9 seconds is pretty quick, hard to see how that can be improved. This suggests that specific interface between man/machine was working and the PNF was on the ball.
You're conflating UAS, AP disconnect and the law change. But, hey, you're not the first, and you probably won't be the last
fyrefli is offline  
Old 2nd Jul 2011, 14:26
  #648 (permalink)  
 
Join Date: Feb 2011
Location: Nearby SBBR and SDAM
Posts: 873
Causality

Linktrained, Technically speaking we perhaps could anticipate just in the "seconds range" (before System degradation). Allowing the PF to prior known the reason for Law change. The rationale is that he could be better prepared to cope with the event knowing in advance the probable reason of a subsequent Law change. That could occur or not.

Last edited by Jetdriver; 2nd Jul 2011 at 14:43.
RR_NDB is offline  
Old 2nd Jul 2011, 14:40
  #649 (permalink)  
 
Join Date: Jan 2005
Location: W of 30W
Posts: 1,939
Originally Posted by AZR
My understanding of the ALT2 being latched is that as soon as you've got an ADR disagree, the system cannot be sure that the equation you write above is true.
If the ADR disagreement disappears, ALT2 is still latched, but in my understanding, AoA protection can be back.
Could you confirm that A33Zab ?

Originally Posted by PA 18 151
Consistent AND valid = Correct
Not necessarily ... can be incorrect as well.

Originally Posted by PA 18 151
Computers solve these engineering problems very well, better than humans, and it is clear that automation of the nature used by Airbus has saved many lives.
The nature of the automation by Airbus is about protection. How is it clear that it has saved many lives ?
CONF iture is offline  
Old 2nd Jul 2011, 14:58
  #650 (permalink)  
Per Ardua ad Astraeus
 
Join Date: Mar 2000
Location: UK
Posts: 18,583
All this discussion of 'forewarning' is to my mind a waste of time. The thing to do is to PREVENT HAL doing something stupid when things do 'off schedule' as he did in the 2001 A340 case. Providing his sticky little electrons can be kept AWAY from any flight controls all will be well. Airliners generally fly in a stable manoeuvre environment and the 'Oh my god' need to pull/push immediately on a control is unnecessary. There will normally be time to pause and assess - no need to 'forewarn' - yet another ECAM/chime'/flashing light to confuse the poor human?

Unless something has fallen off or the a/c is wildly out of trim for some reason, sit on your hands, think about it, leave everything where it was for a few moments and THEN do something - as I say, thisi is fine as long as Hal is not doing something else..

Link - "If one could reasonably anticipate the loss of Pitots leading to the need for hand flying for,say, half an hour, ought one to try to reduce ones flight level by say 4000 ft." - no! No-one is going to do that. In which world did you fly? I suspect most pilots would be thinking hard about "doing a 360 and getting out of there" as a navigator once said..
BOAC is offline  
Old 2nd Jul 2011, 15:11
  #651 (permalink)  
 
Join Date: Jun 2009
Location: Bedford, UK
Age: 66
Posts: 1,245
That navigator wouldn't have got there in the first place so no harm done.
Mr Optimistic is offline  
Old 2nd Jul 2011, 15:27
  #652 (permalink)  
Per Ardua ad Astraeus
 
Join Date: Mar 2000
Location: UK
Posts: 18,583
T'was brave pilote de chasse wot got him there.
BOAC is offline  
Old 2nd Jul 2011, 15:47
  #653 (permalink)  
 
Join Date: Jan 2008
Location: Blighty (Nth. Downs)
Age: 73
Posts: 2,091
Warnings, hierarchy and ECAM

RetiredF4,
The warnings and their hierarchy are not so different from yours in principle. On current Airbuses, there is no WLDP (warning-lights display panel), but the system PBs (push-button switches) have an amber "FAULT" W/L built-in. (If a PB's normal position is on, it will show a white "OFF" warning when off. The handful that are normally in the off position, like wing anti-ice, have a blue "ON" light.

There are 3 levels of warnings and, below them, advisories.
Level 3 gives a Master W/L (red) to each pilot plus CRC (continuous repetitive chime).
Level 2 gives a Master-Caution W/L (amber) to each pilot plus SC (single chime).
Level 1 gives only a local (PB) amber FAULT light.
ADV (advisory) triggers the relevant system page on an ECAM display, highlighting a system parameter that needs monitoring in flashing green.

Master and Master-Caution W/Ls are cancelled (and hence re-armed) after agreement between the pilots, prior to any drill. This action also stops and re-arms the chimes.

On the upper ECAM DU (display unit), level 3 faults are written in red; levels 2 and 1 in amber; advisories in green. The lower DU shows the system schematic, when necessary. ECAM provides the drills and recognises the completion of each step. There is a recall button if you are uncertain that something was properly actioned. Some of the drills are inevitably long-winded, and must be cross-monitored...

The first Airbuses without flight-engineers, the A310 and A300-600, pioneered ECAM but retained a WLDP. With the next generation, the A320, this was deleted.

Hope this helps, and that any errors will be corrected by others.
Chris Scott is offline  
Old 2nd Jul 2011, 15:57
  #654 (permalink)  
 
Join Date: Mar 2008
Location: San Diego
Posts: 60
As a humble ASEL-I all of this is far too recondite for the likes of me. All's I can say is, I'd rather be sitting in back with the fellow who posted #645 at the controls than some jumped-up jockey looking to grab the reins and FIX THE PROBLEM RIGHT NOW.

<sigh>
SDFlyer is offline  
Old 2nd Jul 2011, 16:06
  #655 (permalink)  
 
Join Date: Jan 2008
Location: Blighty (Nth. Downs)
Age: 73
Posts: 2,091
BOAC,
Never knew a navigator demand a 360...

Quote:
The thing to do is to PREVENT HAL doing something stupid when things do 'off schedule' as he did in the 2001 A340 case. Providing his sticky little electrons can be kept AWAY from any flight controls all will be well. Agreed, but you evidently think like I do that "Hal" did not put AF447 into its climb.

Quote:
There will normally be time to pause and assess - no need to 'forewarn' - yet another ECAM/chime'/flashing light to confuse the poor human?

There has to be a warning to the crew. What I've in mind is a warning that flight controls have degraded to ALT 2, that speed/AoA protections have also been lost, and that flight controls will degrade to Direct Law in 20 seconds, 19, 18, 17, 16....

We always "sit on our hands" while reading ECAM warnings (except the hand on the stick).
Chris Scott is offline  
Old 2nd Jul 2011, 16:10
  #656 (permalink)  
 
Join Date: Jul 2002
Location: UK
Posts: 3,182
Apologies for delay - helluva busy week!

Originally Posted by galaxy flyer View Post
The pilots clearly did not grasp what the computers were trying to do
How many times is it possible to say that the computers were not "trying" to do anything other than that which they were told to do by the stick inputs from the flight deck? "NO PROT" means just that. There's no released evidence whatsoever that indicates the pilots were "confused" by anything the aircraft was doing.

probably did not understand what the THS was doing and how that might have impacted their recovery attempts, and how they may have reacted properly.
I may be contradicted by the report when it finally arrives, but it would not surprise me in the least to discover that what the trim system was doing didn't even factor into the troubleshooting mode (by which I mean mental model) they were in. Again, witness the Birgenair case where, despite the escalating warnings that went on to include stick shaker, stall call-out and eventually the dreaded "WHOOP WHOOP PULL UP", the pilot spent most of his time continuing to troubleshoot the initial explicit warning he got, which was the erroneous overspeed.

Unfortunately, pilots learn to fly on planes that fly like all the planes built since the Wright Flyer, version 1908, not like Airbuses.
We all (or most of us) learn to ride a bicycle on stabilisers/training wheels, learn to drive in low powered "city" cars and learn to read with basic picture books. We can't rely on those forever, because they all limit the ability to master the thing you're trying to learn. The same is true of learning in a Cessna and piloting an airliner - the former is designed to have forgiving characteristics and be easy to fly using the simplest technology, whereas the latter is designed to get as many people from one place to another as quickly, efficiently and as economically as possible using the best technology available for the job.

There have been a disproportionate number of LOC accidents/incidents in Airbus aircraft. Since the A320 Habeshiem accident, there was the NAT incident, the Australian incident, the Perpignan crash, amongst others.
Not true. Every aircraft has its fair share - notwithstanding the fact that Habsheim was down to pilot error (with, IMO, significant corporate negligence on the part of Air France) and the Perpignan crash was largely attributed to failure of the pitot-static system due to improper cleaning/maintenance.

Originally Posted by RR_NDB View Post
I.e. BADLY! This redundancy implementation is USELESS specially at "cruise FL". Or worse, creating a CRTICAL design.

The use of a "voting scheme" capable to "major a/c reconfig" using identical (sub heated) not adequate Pitot´s is a direct path to PROBLEMS!

...

1) Ridiculous AS sensors redundancy (useless)*
2) The use of this voting scheme to not adequate AS sensors (sub heated)

Note: IMO this design EXACERBATES Pitot´s icing susceptibility
I disagree strongly. The system was designed down to a worst-case scenario where one pitot had failed. The thought of two or more failing was thought to be exceptionally remote. Until Birgenair and Aeroperu, the concept of air data failure wasn't even headline news to the aviation industry and by then the A330 had been in service for over two years. The combination of the less-than-stellar performance of the Thales AA pitot probes in foul weather conditions with the voting logic of the FCU and FMC didn't raise its head until a decade later, and they've been trying to fix it since.

Now, regarding the traditional method of redundancy where the pitot data is directly fed to one of three instrument clusters (CPT/FO/STBY), I'm not sure if the Airbus design reverts to this behaviour in the event of ADR DISAGREE - or indeed if that's how it works anyway and the filtered data only applies to the automatics - and I will try to find out ASAP. However I'd like to throw in that even if this method is used, it still takes time to diagnose which of the pitots has failed (Birgenair F/O : "Mine [ASI] is broken too" [it wasn't]), have the presence of mind to fly pitch and power while doing so (no mean feat at night in turbulence with warnings blaring at you) and resist any attempt to re-engage FMS until you're absolutely sure the failure has been isolated. Birgenair's FMS did actually try to fly the aircraft with the bad data, causing a pitch-up to the AP's limit of authority due to erroneous overspeed indication - which Airbus's design would not have allowed to happen, so in that aspect it is actually a "better" design.

Originally Posted by BOAC View Post
JD-EE, I disagree - it was the 'system' that trimmed the tail at AMS, PGF and with 447 (and several other cases), not the 'pilots'. In all cases they made no deliberate attempt to trim that far.
With respect, we have no idea what they did or did not attempt - let's wait for the report before we start blaming the system, the pilots or a combination of the two, eh?

Originally Posted by Chris Scott View Post
That is why Dozy Wanabee and I are suggesting that, in the UAS case, the reversion should be all the way to Pitch-Direct, requiring the PF to do the pitch-trimming.
Chris, again with all due respect I *never* suggested that. I asked Smilin'_Ed if that's what *he* was suggesting, but my position is that the designers had a very good reason for implementing Alt 2 in this scenario and I intend to find out at some point. I'm still not convinced by the "G-loading causes nose-up trim" argument and I'm trying to find the info that will confirm or disprove it.
DozyWannabe is online now  
Old 2nd Jul 2011, 16:28
  #657 (permalink)  
 
Join Date: Jun 2011
Location: Devonshire
Age: 92
Posts: 300
Obeisance

I bow to BOAC's response... I was only asking, due to my own inexperience of operating much above M .5 and F/L 25.0. I usually had fans on the wings, which I could see rotate at a reasonable speed and quietly.
My world was flat, when I was acting as a Navigator. I understood that it was said to be an oblate spheroid - but I never really believed them. Why didn't they give me a Globe ?
Linktrained is offline  
Old 2nd Jul 2011, 16:34
  #658 (permalink)  
 
Join Date: Apr 2011
Location: NottNum
Posts: 25
Originally Posted by fyrefli View Post
You're conflating UAS, AP disconnect and the law change. But, hey, you're not the first, and you probably won't be the last
No I'm not. I'm giving an example of two milestone events and the time between. My intention was to demonstrate that the crew were quickly aware of the critical 'need to know' information within seconds of the aircraft passing over control i.e. the aircraft was efficient at providing this information in a format which could be understood. Within seconds.
PA 18 151 is offline  
Old 2nd Jul 2011, 16:43
  #659 (permalink)  
 
Join Date: Feb 2011
Location: Nearby SBBR and SDAM
Posts: 873
Human machine interface issues and redundancy

BOACCertainly the System must be predictable to not add extra issues specially when we are facing extreme conditions. And this "predictability" is intrinsically related to "testability" and in complex (feedback Systems) machines this will be ever an concern. (Naturally a concern for the designer and something that should be told to the operator).

A "forewarning" (perhaps technically feasible on AS issues) was just mentioned because could provide a faster understanding to the PF. Actually N805NW (A330-323) was equipped with an optional to "help" in this.

DW
The system was designed down to a worst-case scenario where one pitot had failed. The thought of two or more failing was thought to be exceptionally remote.
1) Current Pitot´s are just, sometimes, inadequate with a known limitation.
2) The simultaneously "failing" is because the mentioned, limitation.

The worst case scenario is just one failing?

Redundancy is "powerful" when critical elements do not fail simultaneously. And UAS cases show clearly simultaneous "failing" (due product limitation)

Question (yet posted earlier): Why they put this redundancy? For what reason? What benefit?

Simultaneous "failure" of critical elements should be reported immediately.
RR_NDB is offline  
Old 2nd Jul 2011, 16:52
  #660 (permalink)  
 
Join Date: May 2011
Location: BOQ
Age: 75
Posts: 489
I recall a post in the previous thread from someone who had hand-flown one of the above AB models in alternate law, and who reported the actual a/c was significantly more sensitive than the simulator.
Previously, one of the most often heard complaints about simulators during training was that they were generally more "sensitive" than the real aircraft while hand flying. (The workman blaming his tools.)

Even from aircraft to aircraft of the same type there are minor differences in feel and sensitivity, though less so in FBW aircraft I would guess. Depends on how bent the aircraft is from firm landings.

Line pilot critiques of simulator performance and fidelity these days are consistently pretty complimentary.

I'm still not convinced by the "G-loading causes nose-up trim" argument and I'm trying to find the info that will confirm or disprove it.
Would my confirmation be of any value? CS is entirely correct from what I can tell.

Last edited by OK465; 2nd Jul 2011 at 18:58. Reason: of the same type
OK465 is offline  

Thread Tools
Search this Thread

Contact Us - Archive - Advertising - Cookie Policy - Privacy Statement - Terms of Service - Do Not Sell My Personal Information

Copyright © 2018 MH Sub I, LLC dba Internet Brands. All rights reserved. Use of this site indicates your consent to the Terms of Use.