Machinbird

Simple.
0200 mindfog, automation overdependence and atrophied/inadequate emergency skills resulting in failure to see the forest for the trees.

A competent pilot, faced with an emergency, should be looking for the big picture. You have to throw out the chaff to form the big picture. If you live with years of routine operations, it is too easy to end up just staring at an indication that is lying or unhelpful. You need to scan, scan, scan until you build a sensible big picture, and until you do, it is very easy to form a faulty picture. This is a demanding mental activity and fatigue can cripple your mind.

When the Fit hits the Shan, you have to rev up your brain first. The normal inflight slog does not work. A little adrenaline can be helpful. An excess of adrenaline can greatly interfere. The difference between these two states results from your learned response to emergencies. You have to learn how to control your own body.

I remember a 4 plane formation flight when I was a student that inter-meshed with a 2 plane flight going at a 90 degree heading to ours. An adrenaline kick resulted of course, but I just told myself-"The emergency is over, no need to get excited." and it worked. Managing/controlling the adrenaline response is one of the skills you have to develop, but I think you get precious little opportunity in the majority of airline flying.

I would imagine that the Abidjan A310 accident lessons have factored into the stall warning design on the later 'Busses. ASN Aircraft accident Airbus A310-304 5Y-BEN Abidjan-Felix Houphouet Boigny Airport (ABJ) although It still seems possible to have a similar incorrect stall warning on the current machines.
I see no reason for stall warning to be inhibited at any airspeed with weight off the wheels. That has to be a mistake. As I have said before, AOA is primary flight information, and should not be inhibited by another type of primary flight information.
Similarly, autotrim must not trim into a stall. Even the test pilots avoid doing that if they can-it is too hazardous.

rudderrudderrat

Hi DozyWannabe,

The two co-pilots didn't hear / recognise / believe / admit (any of those) the stall and insisted on applying TOGA 15 degs pitch throughout the stall warning.
When the Captain arrived on the flight deck, the stall warning ceased because IAS<60 kts. If it had continued - then maybe he would have diagnosed the problem correctly.

To prevent a similar accident, is your solution to simply change the crew?
I think BEA will arrive at a different conclusion.

Edit. Please explain how you think it is possible for a heavy aircraft to be airborne, yet travel through the air with a speed <60 kts.

@machinbird.
I agree.
Here is an example where the crew acted correctly.
BA 747 crew commended for escaping near-stall on take-off

cwatters

Perhaps it does use the squat switch to disable the alarm on the ground? It could do that and still disable it at <60kts in the air for another reason.

jcjeant

Hi,

Of course it was for another reason
The engineers knew very well that an actual speed below 60 knots was impossible (or almost improbable) .. but it could come from a false indication given by the pitot tube
The engineers knew very well that, pitot tubes were not reliable in some flight areas (giving false information)
And even it is not the reason ...for me .. the failure of the engineers is not in the design of the global Airbus flight control system .. but their failure is that not fixing one of the most important measuring device (pitot tube) who collect very important information for feed their sophisticated system
A reliable speed measuring device will never indicate 60 knots or less .. provided you are not in a certain flight condition (a stall is one )

DozyWannabe

That would appear to be the case based on what we know so far - though it certainly doesn't look like the PNF agreed with the PF's decision based on the CVR traces.

Well, it was sounding for a few seconds after he arrived and it's probable that he heard it through the flight deck door for some time before he arrived - so while your point is valid, I don't think that deriving "woulda-coulda-shoulda" points is helpful in this case. It's definitely not a positive factor in the stall warning design logic, but you have to ask yourself whether the logic was reasonable given the knowledge and state-of-the-art at the time. This was, after all, the first time that anything of this nature had happened. As it is, the Captain was summoned from trying to get to sleep, so it's probably fair to say that his faculties weren't at their best.

Not at all - frankly I find it quite saddening when people say that I'm trying to "blame the crew" and leave it at that.

I don't think it'd be easy or desirable - and I think that's probably why the systems were designed the way they were - for the very reason that it is so unlikely.

And ironically that was due to a software logic error in the 744's systems that had never reared its head until that moment.

Lyman

With a descent rate up to ~10000+ fpm, and its attendant airstream howl, STALLWARN is not a good candidate for a conclusion of airframe STALL. They are not consistent, and in fact, the PF remarks re: the "crazy speed", something not generally associated with STALL.

One might assume it was this airmass din that caused all three PILOTS to "miss" the aerodynamic STALL? It is the likeliest of possibilities, imo.

With "good" ROLL control, more evidence still the airframe was "flying".

Further, the ROD could be thought to be indicative of a dive, given these other cues, and eventually, they acted on it too: "Tire, Tire, Tire...."

Captain's suggestion earlier of "Pull" was met with "But I have had Full back for some time..." A defensive statement, to mean perhaps, 'but I have been trying to exit this dive....' (a conjecture) etc.

So in sum, not a complete mystery why the crew didn't believe she was STALLed?

I think far too much is made of the lack of STALL recovery attempts on the way down.

I also believe far too little attention is paid to the reasons the a/c climbed into the STALL. It is this climb that killed her.

jcjeant

Hi,

DW
2H 01min 46 Captain leave flight deck
2H 11min 42 Captain again on flight deck

Lost of faculties in 10 minutes .. cause out of ... a deep sleep
I'm sure he never hit the sack
Think again and repost about ....

Lyman
I'm not so sure that the roll was so much controled by the PF or PNF(see the mayonnaise resulting of the "control" .... )

Lyman
Indeed if in the first place the PF had paid more little attention .. maybe he had not put the a/c into the stall

rudderrudderrat
Better was not this crew in the first place (not trained)
Anyways AF had not better crew (all the AF crew were not trained for this event)
Waiting 228 loss of life for make change (better training) .. is way too much cost IMHO
BTW .. AF shares are also in a "deep stall" and seem's that AF stay also pulling on the stick ..... as they do not understand what is happening ..
French taxpayers will have to open their wallet ..

rudderrudderrat

Hi DozyWannabe,

Thanks for the reply - I think we are talking at crossed tortoises.
Do we agree that it is impossible for a passenger airliner to be at FL 350 with an airflow <60kts passing over the Alpha probes (from whatever direction)?

The A330 stall warning logic has an error (similar to the B744 slat retract & hence stall warning on take off, which I mentioned earlier). The 744's stowing the inboard leading edge devices due to a spurious REV signal when airborne, should also have had on ground logic to prevent it. AB stall warning inhibit below 60Kt should apply only on the ground.

Lyman

jcjeant

My reference was to ROLL response of the a/c (seen in the traces), a positive feedback to the pilots of controlled flight, and not STALL.

HazelNuts39

No, I don't agree. In dynamic maneuvers the airspeed can attain any value, including negative values.
Let's be clear about this. The stall warning is not inhibited, but the AoA signal becomes invalid (no computed data) below 60 kt. It is logical that this occurs at a certain low airspeed, because as the air speed reduces, the friction in the vane mechanism becomes more significant compared to the aerodynamic force that points the vane in the right direction, and the output value becomes increasingly inaccurate. However, IMHO when stall warning is active it should not stop when the AoA becomes invalid but should continue to sound until a valid AoA signal indicates an AoA value less than the stall warning threshold value.

Machinbird

Heck no! All you need is a bit of ballistic trajectory and any value is possible.
Any AOA sensor that requires 60 knots to read local airflow direction should be trashed. That criterea is way too high. I tested several former airline and military AOA transmitters a while ago by sticking them out the car window and noting my 'ground speed'. They were alive by 15 to 20 mph.

HN39
I agree fully. Just have a procedure so that you can kill an AOA sensor in case you learn while airborne that someone rammed it with a baggage cart or that it is frozen. With multiple sensors onboard, you do have redundancy. It is quite possible to detect and report sticky AOA motion with an arrangement such as the Airbus has. That is a design feature that Airbus needs to look at. How long was AF447's #1 AOA sensor sticky? A day? A month? A year? Who knows?

My biggest beef with the Airbus ADR design is very fundamental. Airspeed indications should not influence AOA indications in any way. They are fully independent parameters. Why allow one defective parameter to silence a good one?

Lyman

Hazelnuts 39

To the extent that "inhibit" certainly means "by design", in your reply, let's look at the problem.

"By Default only", the STALL system is inop. Due other problems, in other words.

Rather than exonerate a failure of the STALL WARNING SYSTEM to continue, does it not instead point to the lack of a design consideration for a demonstrably critical potential FAULT?

Not only does it cast a suspicion of inattention at the design level, it shows a fundamental flaw in the understanding of the consideration itself.

DozyWannabe

I'm sure that is the idea that will underpin the eventual logic change requested by the BEA. However, as a logic guy I feel compelled to point out why it isn't necessarily that simple. Changing any logic path will have various side-effects that were not previously considered, and factors that will need to be taken into account include the mean-time-to-failure of the components, including the AoA vanes themselves (because theoretically you could have a mechanically-failed AoA vane causing a false stall warning to remain sounding even if the remaining pair are experiencing only a transitory failure). Ultimately it's a question of probabilities and statistcs that I freely admit is a weak point in my mathematical understanding.

Lyman

Likewise a consideration of the effects of ill considered, or even well addressed, changes. As in, PITOT PROBE fail. What is the logic behind a UAS recovery being well addressed, and an AoA Vane which causes false STALL being not addressed?

To some of us, closing the corral gates after the Horses have bolted is not good practice, though compelled by the "Logic Failure"?

"If it breaks, we'll fix it"? "If it fails, we'll replace it?"

These are not complicated shortcomings; their simplicity does not meld well with the complexity used to address them.

Without taking a side, the HSP profile seems to be rather congruent with the initial 447's climb. All Nose Up, no down, and a crazy climb.

Mr Optimistic

As I understand it the underlying reason isn't to inhibit the stall warning below 60 it's to prevent spurious data when the airflow is outside the vanes spec. Stalled or not stalled, a warning that airspeed is less than 60 knots when there is no weight on the wheels would be equivalent. If that situation can only arise when stalled, then fair enough allow a warning. Seems quixotic to cancel an existing warning when the speed goes out of range and it is likely that that very same stall caused the speed to go out of range.

Machinbird

Dozy, You are overthinking this. The engineers are going to have to get involved and chase down all the new logic branches and implications.

They started with a bad premise the first time. That AOA was a function of Airspeed and other parameters. It is really an independent variable.

DozyWannabe

This is true, but...

I can assure you I am not. Part of the reason my old Prof was so leery of computer controlled and managed aircraft in the first place was the sheer amount of complexity required to cover, if not all eventualities, then at least a significant majority of them - and then regression-test the software and hardware to prove reliability to a level required by aviation regulations. Remember this was the '80s - when every line of code had to count, and the hardware specifications called for technology that was obsolete even by the standards of the time.

His visit to Toulouse left him impressed with the lengths that they had gone to to do so, and he worked that into the things he taught us, but even with all that he remained neutral on the subject. I'm slightly more sanguine than he was, but that does not mean that I'm naive to the possibility of problems.

But we do not know they started with that premise - all we know is how the eventual design ended up. Given what I was taught, the design is likely to be the way it is probably for a very good reason. What we have here is an edge case where that design decision may not have helped matters. What we don't know is the number of times where that design decision may have helped in a situation where the flight envelope was not compromised in such an extreme manner.

rudderrudderrat

That will be all the false stall warnings received at 59 kts and below.

DozyWannabe

Check HazelNuts39's very important point above. Stall warning inhibition is not a direct outcome of the logic, it is a side-effect of the logic that says AoA data is unreliable. Put simply, the logic does not say "if airspeed < 60kts, inhibit stall warning", it says "if airspeed < 60kts then AoA data is unreliable". So already the scope for positive effects from the logic has increased (whenever AoA vanes have headed south due to contamination/mechanical failure in the past, for example).

Up until this incident happened, I think most would agree that the chances of an airliner stalling so comprehensively from cruise that it did actually reach the point where AoA data could become invalid were suitably remote, and that this logical side-effect would pose no threat to flight safety. Now it has been proven that it *is* possible, the logic needs looking at.

jcjeant

Hi,

Personnaly I prefer work with what I know ... instead with what I don't know..
What I know is that the AF447 ended in the sea and it's possibly an (minor) design implication to add to the fact (major) of the incapacity of the pilots to fly the plane in a professional way ... (pilot error or unconscious action)