HazelNuts39

That is correct as far as the voting system goes. Once voted, the "polled" value is used by the PRIMs in performing their function. The voted value triggered the monitoring process described in BEA's discussion of the PROBE PITOT fault message, and its downstream conditions such as AP off, A/THR off, Alternate law (prot lost), etc. The voting system resulted in the ADR DISAGREE message that occurred much later.

AlphaZuluRomeo

Hi PA 18 151
My understanding of the ALT2 being latched is that as soon as you've got an ADR disagree, the system cannot be sure that the equation you write above is true.

Why ? Well, imagine an aircraft in an ash cloud :
- at first, pitots (front end) are clogged => speeds decreases, but not exactly at the same time => ALT law
- then, out of the ash cloud, the ashes move in the pitots. The front end became unclogged, but then the remaining ashes clogg the drain hole of, say, two of the three pitots => those two pitots give consistent and valid speed. But that speed is uncorrect (too high, because of the drain hole clogged).
If the system goes with this (incorrect value) to revert back to normal law, it's kind of dangerous, cause it may trigger the overspeed protection (climb order) when not needed/relevant.

Therefore I think the logic is to latch the ALT law, until the aircraft/system (probes, computers...) can be fully checked, on the ground.
The rule would be some kind of : ("you" being the computers)
"As soon as you've got a problem with the probes/ADR/speed calculation, you cannot be sure the speed you sense/vote/choose/know is indeed correct. Then you have to let the human crew in unrestricted control, via the ALT law being latched".

PA 18 151

Hi AlphaZuluRomeo,

Yes I think that is a good explanation for why ALT 2 should be latched. I suspect Airbus should take a look at this again and I am sure they are doing so. Icing conditions are more frequently encountered than ash cloud conditions and the ice didn't hang around for long at all.

There was an inconsistency between the speeds displayed on the left side and the integrated standby instrument system (ISIS). This lasted for less than one minute.

In this situation. The aircraft knew it was stalled, knew it's pitch angle, and had consistent and valid airspeeds. What more info do you want before you start to lower the nose?

And you are correct, the vast vast majority of airline pilots could correctly manage the pitots icing, unreliable airspeed, any subsequent change of flight law, and the safe conclusion of the flight (and recovering from a high altitude stall without thinking about it). I think those who say they would also be in trouble are just being melodramatic, if not they should disqualify themselves.

BOAC

- I feel that 'vast' is being overly optimistic, but whatever - what you are effectively saying then is that these two AF pilots were (surprisingly) NOT so able and that there was no further complication? Case solved, matter closed? Hmm. Maybe. Maybe not.

PA 18 151

BOAC,

My comment was to AlphaZuluRomeo wrt ALT 2 being latched and letting the pilots take over from there.

But if you don't think all crew could manage this event then why are you so convinced the aircraft is at fault? You demand evidence for CB penetration but are not so picky when looking for evidence the aircraft caused this accident.

Case is not closed. We don't know all the contributing factors.

HazelNuts39

A33Zab;

Your "Chronology of events @ 5 sec interval." has a column headed "STALL AoA". I presume that is 'alpha-max', which is not stall AoA but somewhat less. Alphamax varies with Mach number as shown on a graph posted a few days ago. For the Mach numbers in your table:

Mach ... alphamax

0.8 ......... 5.2
0.68 ........ 7.1
0.64 ........ 7.7
0.59 ........ 8.1

Smilin_Ed

AZR: Except, in this case, they didn't have unrestricted control. The flight control system kept changing the pitch trim. While this was result of an inexplicable nose-up command on the side stick, the pilots apparently didn't notice it. As I've said several times before, when the system gives up, it needs to turn off autotrim along with the autopilot.

BOAC

- then we agree on that! . I "demand evidence for CB penetration" simply because we have none although it is an oft-issued 'fact' on here. I am pretty certain "the aircraft is at fault" since I believe if the pitots had not failed the accident would not have happened, nor, I personally believe, would it with iced pitots with a 'conventional' FCS, but am keeping an open mind on the rest - and am yet unconvinced either way due to the paucity of information from BEA.

For Smilin Ed - I agree, and feel that Dozy's proposition a while back of a reversion to Direct Law in such situations would be a good idea, although an anathema to the FBW world. Assuming also, of course, that the crews are trained to....................etc etc.

Machinbird

The accident (as we know it) would not have occurred if autotrim had frozen when it left Normal law.
Maybe Alt 2 law has some issues. Hopefully BEA will get to the actual bottom of the crew's control problems.
Gotta go with what Ed said.

RR_NDB

1) Pitot´s presented intermittent failure (a fact)
2) The implemented redundancy proved to be useless in this case (a fact)
3) The implemented redundancy is flawed? (when using these AS sensors)

And if other factors (a/c Systems) are also related to the LOC we would see another, more serious, design flaw(s) and the crew as "probable victims" of a K.I.C.S. System.


C.= Complex


We are realizing how serious was the first Leak (LF).

DozyWannabe

Er, I'm pretty sure this was discussed on the previous thread - some time ago they not only "admitted" that it was a problem, they changed the behaviour so that when A/THR kicks out, the thrust remains at the last setting the A/THR commanded. The thrust setting does not change until the pilots touch the thrust levers.

As it is we seem to be discussing three scenarios here. Note that what follows are largely my opinions, for what they're worth.

Svarin postulates that some hitherto undiscovered software bug caused the FCU components to slip in and out of Normal Law, causing intermittent activation of protections forcing the aircraft nose-up. Personally I find this the least likely explanation, based on the specification and design of the systems as I understand them, coupled with the fact that the A330 has been flying for nearly two decades without such a scenario presenting itself, despite numerous documented failures of the pitot system. I'm not saying it's impossible, just pretty remote based on the information I have.

Chris Scott wonders if the "G-Loading" mode of the FCU would have ordered up elevator and consequent nose-up THS movement via the autotrim system. Personally I think this scenario slightly more credible than Svarin's, because it is more of an edge case in terms of specification and design. That said, I'd be very surprised if the engineers overlooked this consequential failure mode given how thorough they were with everything else.

Finally we have the scenario I consider the most likely, which is that the autotrim was responding directly to the pilot's consistent nose-up sidestick commands, but this in itself opens a can of worms because it is perceived in some quarters (incorrectly IMO) as an attempt to "blame the pilot" and get Airbus/AF off the hook. For a start, Airbus and AF are already on the hook to some extent because of the known pitot problem, and AF's response to the service bulletin not being expedited in the wake of the numerous cases where these failures led to near loss of control incidents. The old aerospace chestnut of a "failure of imagination" comes into play here, because most of the previous events occurred in daylight, where pilots had an external reference from which to aid their recovery of the aircraft. Prior to the accident, few seem to have taken into account how much more dangerous a failure of this nature would be in adverse weather conditions in the dark hours of night, which would suggest that the lessons of Birgenair and Aeroperu were not heeded as well as they should have been.

For my part, I agree with PA 18 151 in the sense that this case is far from closed and we should respect the abilities of the investigators to get on with it. To clarify my position as referred to by BOAC, I mentioned that another poster (I believe it was Smilin'_Ed) seemed to be proposing a drop to Direct Law in the case of air data failure, and bypassing Alt 2 entirely. Indeed, it would appear that is indeed what Smilin'_Ed is proposing ginven his recent posts. Personally I disagree and think that Alt 2 has a purpose in this kind of incident, although it can be argued that the outcome of this particular scenario doesn't reflect well on the design. As I've said many times before, the ability to manually control trim is available in any law, including Alt 2, provided via the trim wheels sitting right next to the inboard hands of both pilots. Indeed I think it was PJ2 who stated that as part of his training he was required to land the A320 simulator using rudder and pitch trim only.

BOAC, I find it interesting that you acknowledge that your background information on FBW airliners is limited, yet you feel qualified to state that a drop to Direct Law is "anathema to the FBW world", by which I presume you mean mentality. I think that this is a fundamental misunderstanding. Part of the FBW rationale was certainly to reduce the cost of operations by using lightweight componentry in aircraft controls, however another purpose of the design was to assist pilots - not hinder or eventually replace them, no matter what some of the more lurid scaremongering on this forum from time to time suggests. The designers and engineers asked pilots what they wanted when the requirements were gathered, and built a system that implemented the specification drawn up from those requirements. The whole idea was to build something that *worked*. If the decision is taken that a drop to Direct Law in this scenario would be preferable, then I'm sure they will make that change.

As I stated, I'm of the belief that Alt 2 serves a purpose, and that a lot of thinking will be done based on the evidence gathered in the investigation of this accident. I'm sure that scenarios were considered that make Alt 2 a much better fit than Direct Law in this set of technical circumstances, and eventually they will have to weigh up those hypothetical scenarios against this real one before they make that decision. Birgenair proved that a more "conventional" FCS is no protection against the "loss of air data" scenario, and just for the record on this thread I will state again that the Birgenair Captain was a *highly experienced ex-military pilot* and even he was thrown (even as his two F/Os were repeatedly feeding him suggestions that might have helped). He didn't seem aware that the situation was being made worse by the actions he took all the way down to the ocean.

There seems to be an undercurrent on here occasionally that some pilots are not only distrustful of technology, but also have a dim view of the engineers that built the aircraft they are flying - seemingly thinking that because the protections were implemented by engineers, therefore the engineers must in turn have a dim view of pilots' abilities. I can't speak for engineers in general, but I must say that I think this view is blinkered. It is in the interests of pilots and engineers to make aircraft as safe and as comfortable to fly as possible. Ultimately pilots are responsible for the lives of everyone on the aircraft with them and additionally pay the price if something goes wrong. But another way to look at it is that engineers are responsible for *every* person riding on the aircraft they design, *every single time* one of those aircraft takes to the skies. Think for a second of the Boeing engineers that carried out the faulty repair on the aircraft that became JAL 123. Think of the price that the JAL engineer who signed off that repair paid (I believe he took his own life).

Thinking in these adversarial terms is not only counter-productive in my book, it is also dangerous. We are all in this together in a very real sense - I may not agree with what Svarin, Chris Scott, BOAC and some others are saying, but it would be churlish and short-sighted of me to not take it on board and at least accept that there is a possibility they're right. I think any engineer worth their salt would feel the same way, even if only to provide the data that contradicts (or even backs up) the theories and ideas put forward. At this point I am out of data, so I'm back-seating this for a while and hoping that the report when it comes is thorough and well put together.

Let's be safe out there, people.

Machinbird

That would be in Mechanical Law. The last ditch bring it back mode of control.

L337

I hope you are correct, and indeed if you are, I am more than willingly to retreat.

Looking at post #379 and that graphic, it seems to show that that thrust went to TOGA @ 2:10:51.

Then again the handling pilot may have selected TOGA rather than AT logic.

Time will tell.

mm43

At 2 h 10 min 51, the stall warning was triggered again. The thrust levers were positioned in the TO/GA detent and the PF maintained nose-up inputs.

Clearly PF induced.

SaturnV

BOAC,

Imagery from 02h07. Position (square box) is the 02h10 ACARS position.

(Source Annexe 1 of the French version of the first BEA interim report.)

Temperatures above -50C



Temperatures above -75C



Would appear to be rather close to a Cb.

From Tim Vasquez's June 1 2011 re-analysis, his worst case scenario, and general conclusions.

Air France 447 - AFR447 - A detailed meteorological analysis - Satellite and weather data

jcjeant

Hi,

1 Well if I refer to the 1 quote .. it's seems they already overlooked one problem .. so why not some others despite how tourough they were....


Due to the last BEA note from 27 May 2011 and how reported in the newspapers (after all ... the general public is also concerned and can have some opinions) the direction of pointing fingers his obvious ....
After all .. who was in command of the AF447 ? .. the pilots .. or (in France) the sleeping enginneers .. softwares dev of Airbus or AF management people that night ?
We have the scene of the crime (35.000 feet and icing environment) ... the perpetrators (the pilots) and the weapon (the plane)
It's just we have not yet a reason for why the crime was perpetrated ...
Very sad that Peter Falk just left us days ago .....

BOAC

- re-phrase that to "Would appear to be rather close to a red blob" and I'll agree.

You have provided your own answer to your earlier question - "METEOSAT measurement shows that cumulonimbus overshoots reached at least 6,000 ft above the tropopause." - I'm sure if you were to Google the height of the trop in summer in the tropics you will be complete.

Note the conclusions:
"Air France Flight 447 crossed through an area of tropical showers and/or weak thunderstorms with weak to moderate updrafts and a high likelihood of turbulence.", and also the last paragraph in your quoted piece.

Yes, they MAY have flown too close to the active part of a CB or even into one. They MAY have not used the radar correctly. At this time we can only surmise. I expect the CVR will tell - I understand there was little evidence of pax being strapped in?.

GarageYears

DozyWannabe: +1 well said

Anyway, the fact that a change to the A/T behavior WAS implemented should be a affirmation of a lack of arrogance on their part: "we got this wrong, we fixed it...". That does NOTHING to confirm or infer there are other alligators hidden in the lake.

Ultimately the piece of the jigsaw with the GREATEST variability and uncertainty with respect to predictable behavior IS the chap with his hands on the controls. Let's be brutal here - ANY aircraft can be driven into the ground with the wrong pilot input, FBW, flight control computers, PRIMs be damned. Clearly that is inciteful and I am NOT claiming that there was any intent related to AF447. But once the auto-everything lets go the PF needs to get on with the program pretty damn quick.

Unfortunately in this case, I have a great fear that the sudden delivery of the aircraft into the PF in this case was entirely unexpected and the actions in the first few seconds were, (how can put this?), less than optimal. The game was not over, but little of what followed appears destined to recover the aircraft.

A fairly benign UAS event became a fully developed stall in less than 60 seconds or so. If THAT is what happened, then all this Airbus bashing seems out of place. That is not to say Airbus and the BEA will not find recommendations to ASSIST the pilot in such a situation, but I'm betting a buck it won't be a drop to Direct Law or elimination of the THS trim function in Alternate.

Smilin_Ed

@Dozy: As I have said before, there is not necessarily only one cause of this accident. It appears to me that both the pilots and the aircraft have shown some deficiencies. Ascribing some of the blame to the pilots will not get Airbus/AF off the hook.

@Dozy: [quote] To clarify my position as referred to by BOAC, I mentioned that another poster (I believe it was Smilin'_Ed) seemed to be proposing a drop to Direct Law in the case of air data failure, and bypassing Alt 2 entirely. Indeed, it would appear that is indeed what Smilin'_Ed is proposing ginven his recent posts.[QUOTE]

From a pilot's perspective, if someone hands me the controls and says "You have it." I want him to keep his hands off until I hand it back to him. I don't want him to touch the trim unless I ask him to do so. Maybe not all pilots agree with that but I was trained to evaluate the "Flying Qualities" of aircraft. I made my living doing just that and my opinion is that the autotrim needs to come out when the confusers get thoroughly confused and give up trying to fly the aircraft.

@Dozy: Yes, the ability to manually control the trim is there but they didn't use it. We don't yet know why but it is clear that they let the system trim them up into a stall. In the world of pilots, that is a big no no.

@Dozy: But, in this case, the system did hinder the pilots. The pilots were remiss in not catching the fact that trim had run full nose up, but the system put it there when it shouldn't have, reducing their ability to fly it out of the stall.

In every fixed wing aircraft that I have flown, directional stability and pitch stability are positive and only lateral stability is neutral. The Wright brothers initially thought that they wanted neutral pitch stability but after a couple of flights, they began to realize that pitch stability had to also be positive. If not, when they pulled the nose up, it would stay there until the aircraft stalled. That's when they changed their design to positive pitch stability which brought the nose back to the trim speed when they let go of the controls. Having the autotrim follow the sidestick commands essentially gives the aircraft neutral pitch stability. Neutral pitch stability is fine as long as the autopilot is functioning properly, but when it quits, you really need it to be positive when you are hand flying.

bubbers44

The Wright brothers were smart people that designed a stable aircraft after a few tries. Airbus found a way to make an airplane fly like their first one before they corrected it. Neutral pitch stability might make flying easier when things are working right but in this case it helped seal their fate. Some day in the future we might have all the data to see why a perfectly good airplane with a minor airspeed problem ended up 13,000 ft below the Atlantic.