bubbers44

Our airliners and all other 70+ types of AC I flew had at most an aural warning when the automation failed if we had automation. The worst that could happen is you would have to put your coffee cup down and handfly the rest of the flight or until you could get the automation working again.

We never knew if they were going to work or not so when they worked we felt blessed. I felt the same in the Lear Jets and the Boeings. They are handy but not at all required for flight. My airline dispatched us in a new, to us, 737 from LAS to MSP and back with no autopilot and we took it because the MEL said it was legal when I was a new captain with a 1st time FO. Hand flying for 3 hrs each way isn't much fun but remember "Fate is the Hunter?"

A stick or a wheel should suffice for any airliner with a competent crew to get you to your destination no matter what fails.

Depending on automation to get you there is a recipe for disaster.

Mr Optimistic

HN39, thanks. So in a known UAS condition the system took what it knew to be unreliable airspeed data to inhibit the warning ?

Machinbird

BOAC, What was suggested would allow the 'Bus to soldier on without getting worse than Alt1 law, without the need to seize the stick firmly, without any great excitement except quieting all the bells and whistles.
It is not a complex thing to generate once the basic calibrations are done in the design phase.

There is much to be said for allowing sleeping dogs to lie quietly. If the aircraft was out of balance laterally, the computer would handle it just the way it had moments before the AP disconnect. If turbulent, the wings would be stabilized. The only difference is that the PF would have to tell the machine where to go and to set the power since the Flight management system wouldn't be doing that for a while.
The next reversion down from Alt 1 would then be Direct law.

Mr Optimistic

Didn't they have everything they needed; reliable attitude, altimeter and engine settings - why would any more help ? The problem may have been the knowledge that it is a complex system and therefore may fail in complex ways. All the imagined failure paths, fault trees and so on may just have prevented timely focus on what really mattered. So the automation failed them but itself wasn't at fault. Make sense ?

HazelNuts39

BEA's 275 kCAS at FL350 equates to M=0.808. Yes, pitching up results in an increase of AoA and vertical acceleration, and FPA, for example AoA=4.5, FPA=5.5, Pitch =10 degrees at about 1.33 g.

All of them: max 7000 fpm, min 700 fpm, 215 kt at FL375 at 2:10:50, maximum altitude FL350 at 2:11:06, just to name a few.
I don't know how that has been derived, I would put it closer to 2:10:53. I don't think the difference between CLB and TOGA at FL375 is that significant.
Between 2:10:15 and 2:10:35 pitch was reduced to about 5 degrees in order to reduce RoC from 7000 to 700 fpm.

I hope that explains the flight mechanics.

HazelNuts39

At that point the original UAS condition was no longer present, the pitots had returned to normal. But there was anew ADR DISAGREE condition due to high AoA, that also caused the low IAS value.

OK465

Dozy:

I’ll steer clear of the ongoing “Why can’t I have Chocolate?” discussion, but…

I’ll offer an analogy to the inertial sensors, which may or may not address this adequately.

In non-FBW fighter-type aircraft, for a given stick position (i.e. constant pitch control surface position) my body was an adequate sensor to determine commanded G was changing as a result of airspeed changing…without ever looking at the airspeed or knowing specifically what it was.

If G was dropping off I pulled harder (importantly only to a point). If G was building I relaxed the pull. Absolutely no direct reference to airspeed required, but directly a function of airspeed changing. I was a veritable human auto-trim system.

Don’t let them re-design me…

Relax; I agree, pilots are notoriously difficult to deal with.

A33Zab

Stick left or right will do it for A. or like any other brand let AP handle this. Already in the 70's you were flying 'Fooled' by Wire and once they remove your 'beloved' yoke and the cable loop which drives it and suddenly it is not worth to call it an airplane?

The brand with the yoke uses the same philosophy on FBW, they fitted some other stuff to keep you guys satisfied and used different naming but have also mode degradation, ADIRU's and Flight Control Computers and a lot of warnings and bells.

Because only AP or P(N)F can do that, if a remote! Failure in a FCPC would do that it would be rewarded with an outvoting and an ECAM message.

BEA:
"The thrust levers were positioned in the TO/GA detent and the PF maintained nose-up inputs."

On the T/L and SS only multiple resolvers (which can't drive the T/L or SS), the only input is by hand (or other object)

If automation can bring one to outer space and back, automation can bring you also from A. to B. and (for the skeptic) from B. to A.

Svarin

DozyW wrote :

You need to realize that each successive software version, for the FCPCs, for example, would have a lifespan of around a year. Version 19 was out last time I checked. What is the age of this type ? So, a software "bug" (a very small oversight as I see it in detail) could have been introduced, less than a year before. This could perhaps help you realize it is much more likely than one would like to see. Especially as this gets mixed with a similar potential problem regarding ADRs from a different manufacturer ! But these things communicate together. All in all, quite a feat. There are bound to be some minor stuff from time to time, dont you think ?

By the way, if someone could please enlighten yours truly regarding the certification process applied to flight controls computers software versions released after the initial certification process, I would be extremely grateful.

The WRG message CMC time-stamp is 02:10.
The ADR DISAGREE message CMC time-stamp is 02:12.
Two minutes.
If you can provide a consistent theory to explain this gap, I for one will be happy to read it.

I do have a theory myself, of course. I explained it in multiple ways already. It is solidly based upon facts : ACARS messages content and timing, AMM, FCOM, BEA reports, schematics, design principles, multiple accident reports. When your theory relies on similarly solid background, we will have the opportunity for a fascinating discussion

glad rag

BOAC,oh come on; it's a bunch of peeps, with no access to the official, pertinent data, making it up as they go along.

Some have a clue, some more than others, some not.

Some have an axe [large/fictional] to grind, some not.

Evidence? the only evidence you'll get on here is advertising revenue.

Roll on the final report!

wallybird7

Note: NASA does not take off or land when there clouds in the sky.

Automation is great -- IF it is working. When it is all iced up it does not.

Something iced it up. Why was Weather Avoidance Radar ignored?

DozyWannabe

@Svarin

Mate, your theory is no more grounded in fact than anything I can come up with. All we can do at this point is wait for the report. I do however expect that if such a transitory software bug was introduced it would have manifested itself many more times than once by now. In any case the "bug" you're talking about could only have affected the displays. By the time they were in Alternate Law, the AP was off and the FCUs could not command a significant change in flight path. On top of that it is down in black-and-white that the elevator and trim movements can largely be explained by the PF's inputs based on what we have so far.

Having said that, like the "wear down fluid channels with contaminated hydraulic fluid -> freeze it -> pump with hot hydraulic fluid" process that finally unmasked the 737 PCU failure mode, this aircraft accident reverse engineering lark is a tricky business.

Svarin

A33Zab wrote :

I agree that it can be done. But is it desirable, from a human perspective ? After flying, what else would you latch automation upon ? How many human endeavours will end up robotized ? What do we do while the machines do all the work and the rest ? Watch TV ?

Possibly, although you know I disagree. At the very least, I am greatly interested in the time it takes for the system to sift through the Byzantine generals lies, or power struggle, as I see it in the "PRIM2 reverted to Normal Law" theory.

DozyWannabe

Write books? Make music? Paint pictures? Solve complex mathematical/physics theorems? Design and build spacecraft to explore beyond our little world?

I jest, but the whole point of human endeavour is that it is supposed to progress. Being knee-jerk against something just because it might in several generations make one's job obsolete is a pretty dismal place to be. Do you think the night-soilmen of centuries past wanted their great-great-grandkids to be doing the same thing?

I think you underestimate how strict the development and deployment process of real-time safety-critical systems is. I'm not saying it's perfect by any stretch of the imagination*, but I think you do the people on the engineering side of the fence a great disservice by saying that it would be easy to introduce such a failure.

* - Just in case I haven't made it clear enough in the past...

bubbers44

HZ39, when their high pitch reduced to 5 degrees after their 7,000 fpm climb bringing it down to 5 degrees doesn't that seem like what would happen after their zoom energy had been used up? At that point they were in a deep stall and about to fall like a rock. Too bad the captain wasn't there to help them out when they lost their airspeed indications. By the time he got there he must have been as confused as the copilots.

gums

Salute!

After private posts with members of this august group.......

Make no mistake, I do not advocate an instant reversion to direct commands of the control surfaces using an RC model logic. The FBW implementation allows many "tweaks" that we did not have in the fully-hydraulic systems that we lites flew 50 years ago. Even into the 90's, the heavies had actual mechanical connections to some things - imagine that?

My philosophy is a bottom-up control law that the humans can depend upon regardless of all the bells and whistles and so-called "protections" provided in the higher-tier modes.

It appears to this old fossil that the 'bus has really fine aero characteristic. Otherwise, I would have expected a spin or some weird maneuver. So I question all the bank angle "protections", the seeming multiple AoA "protection" modes, and the beat goes on.

With autopilot engaged, all of the neat features seem logical for reducing workload and making things nice for the SLF's. But when things turn to worms, there has to be a basic, core control law that utilizes all the benefits of FBW and yet exploits the aero design/characteristics of the jet.

As with OK, don't take my seat-of-the-pants sensors away from me. I shall overcome the "leans" in prolonged IMC with no autopilot engaged and maintaining 10 or 15 feet from my flight lead. Some glances at the ADI and other gauges shall save me from my belief that I had been flying inverted for the last 3 minutes, heh heh.

In my second career ( afer hanging up the g-suit), I worked mostly on the crew-vehicle interfaces for the more advanced jets. Working with the end-users, we always had a straightforward means of going to a well-understood, basic display or mode. One of my "laws" was "if you don't like what you see, hit another button". our sfwe engineers implemented extremely rigid state machines that simply would not do weird things based upon weird inputs. If an input was not defined, the machine just sat there waiting for another switch or aero condition or seeker acquisition or ..... If you wanted to start over, then we had the 'start over"button, heh heh.

later,

HazelNuts39

At that point they had about 215 kCAS and were not stalled. If they had maintained that nose-down push a few seconds longer they would have avoided the stall altogether. Instead they pulled nose-up, increasing pitch, AoA and rate of climb, using the remaining zoom energy to reach FL380, and stalled.

P.S. Fourth update on TE-plots Fig1v4, Fig2v4, and Fig3v4.

PA 18 151

I'm not sure you can say that (and this one of the very few things you have said that I disagree with).

From the evidence:

The PNF at least very quickly realised what was going on, a matter of seconds after autopilot disengaged

• At 2 h 10 min 16, the PNF said "so, we’ve lost the speeds" then "alternate law […]".

No confusion there whatsoever, in fact the BEA are telling us that the FD acknowledged that they pretty much realised what the critical information was within seconds of the aircraft handing over control..

But later:

• At 2 h 12 min 02, the PF said "I don’t have any more indications", and the PNF said "we have no valid indications".

That, to me at least, indicates confusion. Either

1) There were no valid indications
or
2) They misunderstood, or were confused by, what they were being shown

My money is on 2)

Confusion of that nature can possibly be caused by
1) Aircraft limitations
2) Pilot limitations
3) Combination of the above

We don't know which of those it was, and the answer (if it can be found) is probably key to the reason why the pilot input was mainly nose up (fact) and the aircraft subsequently stalled into the ocean (fact)

auraflyer

Gums, you've neatly summarised one thought of mine that I have not had time to elaborate fully (and don't at the moment either, but will raise in summary form).

From a human interface standpoint, the idea of multiple "laws" does not seem to me to be the optimum way of structuring things, trying to remember what is or is not in each law. My own intuition is that it would be more intuitive to have a clear indication of what "protections" have been lost that you formerly relied on.*

It would therefore seem that the better way would be:
(a) to know through training what "protections" you have when things are "normal";
(b) when things go wrong, errors are expressed in terms of each "protection" that is lost -- one indication for each protection lost (or, where there are multiple levels of degradation, what degree has been lost and what is left).

So that where one or more protections may be lost depending on the fault, your attention is specifically directed to what you no longer have - (eg simplistically: no rudder travel limiter, no abnormal attitude protection, or something like "no autotrim available - check trim and trim manually" etc). You wouldn't have to think in terms of "law", but rather in terms of dealing with the indication of what has been lost and what you might have to do in response.

This might assist where there is some obscure or not easily remembered (or easily overlooked) protection that is or is not lost when in some sub-law -- to try to avoid the situation where you don't realise you have or haven't lost something.

I realise that since I am not directly qualified to comment, and I am working off what I have gleaned here about laws and sub-laws, with permutations of outcomes. I have not had time to sit down to check this objectively, though, which I would normally do before posting, and won't for quite a long time due to work. so I apologise for that. If I am wrong, and this is effectively what happens now, then what I suggest may at best be a distinction without a difference.

* In CS terms, the point is sort of that laws are effectively "modes", which is what computers are good at but humans aren't as much. In my experience, people are better equipped to deal in terms of the contents/specifics/characteristics associated with a mode, not the fact itself of being in a mode.

A33Zab

Finally found it, it is in BEA report #1 page 122
It is in french so I skipped it in previous reading:

"Procedures anormales"
Urgence / secours

CONFIGURATION LISSE

Au dessus de 190T; FL 250 a FL 370
Vitesse 260Kts: Assiete (Pitch) 3.5 / POUSSEE (Thrust?) N1 90%

In comparision to my Hi power ground run tables
90% N1 ~ 80% thrust (temp effects taken in account)

Another 20% is a considerable amount of thrust (and pitch-up) they put in when moving T/L to TOGA. (=100% thrust).

IMO was the first action of capt. to retard to idle, and demanding a ND command. He did realized what was going on.
Unfortunately he couldn't see the position of THS (if F/CTL SD page not selected) and if not already too late to recover.