gums

To Doze, et al.....

I see a sub-mode of all the plethora of laws that implies the jet tries to achieve an alpha, even with stick neutral. This could explain the continued pitch up and THS trim, especially if HAL was reacting to the overspeed warning and the reversion to control law "x".

As with Chris, PJ and other 'bus drivers state, this plane is sound, and robust. There is no reason for ambiguous cockpit indications of the current state or control law, and what I have to rely upon when I move the stick. The plane is well-designed. I realize that with an elevator-stab configuration ( versus an all moving stab) that the THS must be trimmed manually or by HAL. So I am confident that this feature of the FLCS will shall recieve some attention in the final report. Trim nose up due to constant back stick by the PF, trim nose up all by itself to maintain the alpha prot value, trim nose up due to decreasing "q" and requirement to have full elevator authority, and the beat goes on.

So bottomline from this old fossil and system engineer and pilot is we have to deal with too many "sub" modes and their associated "protections". Syseng has pointed out a few human factor aspects that the sfwe engineers must recognize.

I do not absolve the crew, hard is that to do being a pilot. But I agree with syseng that many of the 'bus documents I have been provided courtesy of this forum seem more like marketing brochures than tech orders.

I also do not believe all the pilots need to be engineers or Yeager types. 'nuff said.

DozyWannabe

@gums:

There was no overspeed warning*. As I understand it, Chris Scott's theory is predicated on a possible attempt by the computers to compensate for the initial slight back pressure on the stick - as a theory it makes sense, but like so many theories there's not enough evidence to go on right now to say one way or another. My suspicion is that the "how" in this case will be simpler than the "why" - so I'm waiting for the report with interest.

* - based on the information released so far. I'm pretty sure that if there was one they'd have mentioned it - it would have saved a lot of argy-bargy on here, that's for certain!

PJ2

RR_NDB;

Sorry, I guess I don't really understand what you have in mind. I think we're talking past one another. I'm not sure what you feel is missing which absence has the potential for misleading investigators. It isn't that complicated and the flight data analysis process works quite well in finding out what happened in an accident, whether technical, weather, or human error-related (and likely an inter-relation of all three, plus lots more factors, etc).

The thesis that the causes of aircraft accidents may primarily lie empirically and theoretically and possibly nefariously below the awareness and therefore the control of flight crews and where involved, the investigators, may or may not be viable but that has not been what I've read and seen. I have offered my views on flight data analysis and the investigative process, both of which, if I may offer the thought, you need to understand before you can reasonably substantiate your views on the FDR.

As ChristiaanJ has commented, data from the "black boxes" was being recorded on Concorde, and from what I know about the A320 and B777 boxes sufficient information, but not every "decision", is available for a good analysis. Again as ChristiaanJ has I think correctly observed, even PPRuNe is not really the place for a detailed discussion on FDRs, especially on the AF 447 thread.

PJ2

Hi Chris;

(Images of the PFD deleted here and updated in a later post).

Someone mentioned the THS Wheel and trim scale. Here's what it looks like from the Left Seat in a dark cockpit. Viewing from behind the pedestal standing up (as the captain likely would have been) would, I think, have been much less clear. Note that the THS indication is 4NU:

Mr Optimistic

'if HAL was reacting to the overspeed warning and the reversion to control law "x"'

From the report.......(edited down)

At 2 h 10 min 51 , the stall warning was triggered again. The thrust levers were positioned in the TO/GA detent and the PF maintained nose-up inputs. The recorded angle of attack, of around 6 degrees at the triggering of the stall warning, continued to increase. The trimmable horizontal stabilizer (THS) passed from 3 to 13 degrees nose-up in about 1 minute and remained in the latter position until the end of the flight. The PF continued to make nose-up inputs.

Is there any need to postulate a malign machine ?

Also, once in the descent with ROD constant, it would have felt like 1g through the seat of your pants. If the ROD increased with ND input, the sudden resurrection of the stall warner plus the feeling of lightness can't have helped convince that was the right thing to do.

Lonewolf_50

Mister O
FWIW, from the perspective of one who has now and again been behind an aircraft (luckily without fatal result ...)

If you are stalled, and in that stalled state the stall warning is not sounding, HAL would seem to be a part of the problem, not part of the solution. (The core problem remains ... "What, you stalled this airplane in cruise flight?" but bear with me.)

If you've lost confidence in X (in this case airspeed), what confidence have you in
a stall warning
or
what you might perceive as a spurious stall warning while you attempt to catch back up to the aircraft?

At what point did any member of the cockpit crew first determine "We are stalled, we must unstall this airplane?"

I'll offer a guess. It was the Captain, when he came back in and at the moment before he ordered the throttle reduction. Hopefully that guess will be confirmed or buried when a more detailed report is issued.

I confess a bias: having learned how to use an AoA guage in my dim and distant past, my opinion is that being able to see AoA, and use it as a cross check, might well have alerted the flying crew to what was going on a while before the great descent began, and acted as a trigger to a more prompt recovery.

RR_NDB

PJ2 With the growing complexity of Systems, intended to a safe, reliable and efficient operation of the airplane and with this inexorable trend to spread even to smaller planes, my feeling is: Despite we can "reconstruct the facts" with not all data (i agree), considering the System is acting progressively like an extra crew, considering it can fail (or induce crew errors) i think more and more insight to itīs working is very probably necessary to fully understand some cases. The reason why i raised the (probable) need for more data is because this could be related to AF447. And relates to redundancy, because amoing other reasons, degraded Systems could present extra issues. (this point relates to the redundancy method used in F-GZCP) QAR, non volatile memories, etc. could be destroyed so is better to preserve something more important info in the SSFDR. Specially if what the pilots "sees" is not all recorded. But as you and ChristiaanJ think the same (or very similar) may be i am exaggerating and concerned too much.

I agree. I was preparing something conceptual, not detailed. I will just think about it. Thanks for CAP 731 link.

There is any bias against automation, protections, etc. But i donīt feel comfortable when we learn on "strange behavior" of the Systems that can be related to hidden faults. You know how difficult was for NTSB to understand the Colo. Spgs. 737 crash(a completely different "part" and non redundant). Why not, much more complex Systems could fail (or make difficult to be understood timely by the crew) at critical moments. And like you posted (Possible x Probable) despite being low probability (near zero, i agree) failures they are possible and the only one capable in certain situations, to save the day is a well prepared pilot who normally performs very well at the edge. Even when Systems "try" to fool him.

So, going back to, Why the mysterious climb?

RR_NDB

Is there any indication if the PF (and PNF) understood the cause of the Law change was the simultaneous failure of AS sensors? (considered as of negligible probability in the a/c System design) I.e. they realized that (if) the start of the events were caused by "just" the "icing limitation" of the (inadequate) AS sensors? Or also they never understood the reason of AP/AT disengagement and subsequent "steps"?

(*) Important that could be considered critical?

PJ2

When the autopilot and autothrust disconnect in cruise, one takes over and manually flies the aircraft. With no speed information, the last thing one should do is change anything...pitch or power. The airplane was stable just before the loss of airspeed data.

While there are indications on the PFD that the aircraft is in Alternate Law, they don't need to know what law the aircraft is in to take over and fly manually, and they don't need to know the reasons for the speed failure. They must fly the airplane, period, with tiny, steady inputs, and wait...and get the QRH out for pitch and power settings while selecting the GPS page on the MCDUs, to watch altitude and groundspeed. That's a short-term solution, while they settle down and maintain control. No computers are going to prevent that.

The notion may have been proposed but it has not been demonstrated that either "automation" or "the computers" were preventing them from doing just that.

For emphasis, the absolute first thing to do is stabilize the aircraft and keep it there. Stabilizing the airplane may even mean doing nothing except ensuring that the pitch and power stay the same. Then one watches the trend very carefully to see if slight adjustments are required.

I cannot emphasize enough that this is not an emergency but an abnormality which has a specific and straightforward response, (which was executed in all other UAS events).

Examining computer behaviour through detailed parameters in this case, is, I think, going to be all after the fact, that they had nothing to do with the pitch-up. Further, if the initial causes of this accident actually lie in the electrons and decision gates, we're all doomed because compiling software or building chips without mistakes is something no one doing that work can or will claim as possible.

That does not mean that confusion about the aircraft's situation is improbable. I think it is quite possible and very probable, and the sources of are long before and well beyond the cockpit.

What we should expect is that the computers do not prevent the pilot from doing his or her job. I know of no case in transport flying where the computers prevented the pilot from flying the airplane and doing what he or she needed to do to maintain control and prevent an accident.

OK465

Just for info...

With a simple, constrained dual ADR failure, the FPV is still available, but the FD is removed.

DozyWannabe

When it was designed yes, but at the time of the AF447 accident there were known issues with the Thales pitot probes - in fact there was a service bulletin in effect and operators communications from Airbus giving guidance on what to do should the fault arise.

As has been stated, it's not like the aircraft is a joy to fly in Normal Law and becomes squirrelly and unpredictable in any other regime - the whole point of the law degradation design is to keep control of the aircraft as transparent to the pilot as possible. The only major thing to bear in mind outside Normal Law operations is that the hard-limiting protections are no longer there, other than that it's largely business as usual.

So are you saying that had they known about it, AoA information was available?

OK465

My apologies, I was only commenting on one of the PFD images presented, and its relation to a particular failure(s), nothing further.

I have no idea if what they were dealing with was a "simple" dual ADR failure.

PJ2

OK465, I corrected that right after I posted it as I knew it was in error. But there was an FPV flag and the FPV was not available on AF 447. Someone has posited that perhaps the captain pressed the Hdg-V/S - Trk/FPA button on the FCU to verify the descent path.

infrequentflyer789

Whilst appreciating and agreeing with practically all of your well written posts, I might just have to call you on that one.

The A320 crash at Bilbao I think does meet that criteria (Accident of an Iberian Airbus A320 in Bilbao) - alpha protection activating in windshear and dumping the plane onto the runway as the pilots attempted GA. Maybe the GA was too late, ill advised, and would have crashed anway, I'm not sure - but alpha prot activation logic was changed by Airbus as a result.

Also there's the "locked" controls (A/P incorrectly on - computer changes control feel) at VR issue on a certain type. Now, the mfr's argument was that you could, and should, pull through the resistance and rotate normally, so maybe the computer didn't "prevent" the pilots flying... but fact is that several crews felt the controls were "locked" to the extent that they aborted at VR. Luckily on long runways...

The software was changed to fix that one too. [by Boeing, not Airbus, of course in this case - but for some folks that necessarily makes the incidents fiction since B-FBW is perfect ].

CONF iture

More probably, the T/L had to be moved to a position aft of the CLB detent in order to match a usual requested N1 for FL350 at M.80
Then, in this saturated environment, it is also very possible that the T/L were simply forgotten and remained in the CLB detent for 45 seconds until they were moved directly to TOGA.

But BEA knows ...

Enough to say that the PNF did not touch his sidestick before 10000 feet ... BEA told us.

PJ2

infrequentflyer789, thanks very much. I'll take a look at it to understand more, but it appears to be the case and the software was changed. Without wriggling loose from the exception, the notion of mode confusion may be a distant cousin of this type of accident in a kind of psychological way, where one isn't "prevented" by the airplane from acting but by oneself, (human factors), though the material effects may be similar. Thanks again...

RR_NDB

PJ2,

The reason of my question was because i always considered useful, we could say, important and in extreme cases, crucial to know what triggered a change in normal conditions. In at least two opportunities this was very important to me. In one, i suspected, made a quick test and proceeded immediately (and perfectly) after clearly understanding the "threat" in the very beginning. In another opportunity i had a no consequences, incident. After trying to understand the reasons (equipment failure) unsuccessfully, i tested the equipment to figure out why it led me to the incident. After the test i finally found the problem, a serious one. And saved my life because if i didnīt test i would not understand what was going on and would be more vulnerable or even involved in a very serious accident. So the idea is: ASAP the pilot understand precisely whatīs happening, better. Why? Because his mind would proceed much better (and faster) to correctly "manage" the situation, that departed from normal.

Absolutely very similar to what i learned in smaller (piston) planes, 35 years ago. Keep flying. Donīt add other issues to the first problem.

But before continuing to your other 3 paragraphs, Did they realize (first) were starting to face an UAS event? I mean, in the very beginning? It seems to me this is a philosophical point. Option #1 The System acts, the PF "start to fly" the a/c and proceed doing the required. Option#2 The crew receives the UAS warning, the System acts and the PF "start... IMHO for an important parameter (AS) after the simultaneous loss of "redundant" sensors it would be safer and better have this information (technically absolutely feasible) immediately. Or iīm exaggerating?

Just important or critical? If in the design they put 3 may be was considered a critical element.

RR_NDB

If the crew realized, in the very beginning there was a serious AS measurement failure this would help the PF to act "better"? As per BEA he executed "persistent NU..."


The important "transparency" is IMHO much better preserved (attained) if you understand why there was a degradation. In this case (by inadequate sensors) easily manageable as PJ2 commented. My point is: An important parameter (AS is so important, the design put 3 elements to measure it) should be reported immediately to the crew. Or i am exaggerating? And the System can take care without "disturbing" the crew?

bearfoil

RR-NDB

Transparency to the pilot is not evident in this particular accident. The first reported condition was a/p loss. Why did it drop? Ordinarily, if for reasons of control limits, the a/c remains in NORMAL LAW after a/p loss. It was eleven seconds later that the pilots together noted, "So, lost Speeds".... and "Alternate Law".

And if for reasons of a/p unable, why would a PF NOT input immediate stability corrections?

"The aircraft was stable just before loss of AS data"....PJ2

How do we know that?

We don't. And since the PF was present, and he input left, NU, I'll defer to the record, and the PF's attempt to correct a roll right, and either a descent or ND, even Overspeed.

Elsewhere, a "New" timetable has appeared which pegs the UAS (sic), at 2:10:06, ONE SECOND after loss of Autopilot. Where did that come from?

If 15 seconds of Data before and after a/p loss were available, in its entirety, I believe that "done" could be put to the deal.

RR_NDB

When working in maintenance (since i was 15) i learned we canīt be biased because can led you to fail. In one case i considered impossible a fault to be caused by a certain part. After several days fighting to understand the reason of a "glitch" in an engine and after "intense parts swapping" i realized the culprit was a brand new item, with a manufacturing defect. The only one i considered "certainly good". On "the initial causes" i would like to know what was PF "seeing" during his "persistent NU". "we're all doomed " makes me remember a training on EMI/EMC i had when the instructor told us about EMP. (the electromagnetic pulse from a nuclear blast). This is really serious. The "decision gates" could be transformed instantaneously in "diodes" and the data buses in "DC bars" For a plane, not so near to the blast. (the real "butterfly" sensation, butterflies in stomach)

I prefer to wait some few weeks. We must be prepared. The first (LF) leak was very clear, assertive and very fast. Letīs wait.

I have a different perception on that. And will comment some cases IMHO directly related to the System (the highly reliable redundant "computer"). But first we must define what is the computer? A non optimal interface can be considered "part of the computer"? IMO, Yes. For us, designers itīs very easy to implement a very reliable computer. Specially for simple tasks. The art, IMHO in the Aviation industry is on "how it work together" as a reliable partner (i fired the "crew member" ) specially during unexpected, critical, urgent and complex situations. In the a/c, the computer is just an element. As you said, one that is prone to fail. So much that you need 3 or for certain functions, 5. Therefore a non reliable element. What the crew need is a reliable partner. It came to my mind Albert Schweitzerīs phrase: "Confidence is the greatest asset of any successful enterprise. Nothing useful can survive without it"