Lyman

I'm sure the logic was well looked at, and proposing that it need be scrutinized now, is misleading the herd. Perhaps another look, then?

Once STALLED, allowing the cessation of the WARNING is inexcusable, by any stretch. Perhaps disabling all but the few critical prompts (and certainly the ECAM) might be a start.

DozyWannabe

Me too (along with most rational people, one would hope!). What I'm saying is that until we know the reasoning behind the logic tree, we need to be careful about making snap decisions over the changes we'd like to see applied. Right now we're talking about a single accident among tens if not hundreds of thousands of safe flights made by the A330 over its service life and the risk is that making a change based on a single incident without properly identifying the potential consquences of that change could make the type less safe rather than more.

20/20 hindsight is a wonderful thing, but the problem here is that the aircraft was so far outside of the flight envelope by the time the stall warning stopped that the very devices used to calculate the data used for stall warning were considered to be unable to generate reliable data.

Look at the response on here when the initial flight recorder data was released - most pilots were in a state of stunned disbelief that a professional crew could have put the aircraft in that state - it's not a major leap of imagination to suggest that the engineers and designers were equally incredulous both before and after the incident.

But that's the very reason the systems are designed the way they are - i.e. to logically separate out any spurious warnings. The ECAM tells the pilots what is wrong with the aircraft - what good would disabling that do?

We're in danger of losing sight of the fact that the stall warning operated correctly for some time after the aircraft had departed from it's certified envelope. No amount of fiddling with the logic at the extreme level of the envelope excursion concerned can alter the fact that the warning was not heeded, and right now there's no evidence that any of the crew were distracted by any other noises or displays.

Lyman

A (very) large red Herring. The critical data involves the total of UAS incidents (accident) and the HSP altitude excursions, plus other identified anomalous unsafe conditions. If we start to add in the degradation of flying skills at altitude and other locales, we have a distressing snapshot of the status quo, to include other manufacturers, to be sure.

Beware the statistical distraction. Its purpose is not to emphasize safety, but to disguise the lack thereof, imho.

Mad (Flt) Scientist

I'll just comment that there's no easy way to flag data as reliable enough for some purposes, while unreliable for others.

A FBW system using alpha as part of the control laws is rather more sensitive to AOA accuracy than a conventional type 9which frankly hardly cares until you get to low speeds where the AOA should be doing stuff). i *suspect* - and I confess its nothing more than a semi-educated guess - that one of the reasons for declaring AOA invalid at low airspeed was that the AOA vane could not be stated to provide the required accuracy at such low speeds, and that this accuracy was specified in the context of normal law operations. Gross AOA, good enough to fire the shaker, wouldn';t be good enough to drive the FBW laws.

Now, you could say "ah, but you can't be in normal law at such low speeds" - and normally that'd be correct. But the design was probably trying to cover all bases, but with the assumption that defending the normal law scenario against erroneous and dangerous AOA data was the more important thing to do.

Now, with hindsight, we might try to provide for discarding the AOA data for the control loop closure, while retaining it for the warning. But that's also complexity - and the golden rule in designing complex systems is to not make them any more complex than they need be. Judging the point of "need be" is the trick, of course.

Lyman

Dozy is correct, in that the discussion is at the tail end of a long sequence of remarkably disintegrating cruise flight.

At STALL, there is no reason to suspect the a/c format of anything untoward; save the fact that two, and eventually three pilots disregarded what should have been a butt puckering cacophony rather than a demure SyntheticVoice in concert with a child's click toy.

Harsh? What is it to be, then, for a lack of recognition of the death rattle of a two hundred million dollar a/c with 228 sob? No comment? Nuttin?

Incredulity remains. There is more to this than meets the eyes. Perhaps the clamor for better pilots is a response to what may be something that is utterly unbelievable on its face.

None of what is offered as explanation or redress is acceptable. None.

Will this come clear? Will the record be complete, and be made public?

Machinbird

Dozy, you are overthinking this.

Dozy, we are not flying with the first design of Airbus 330 control laws nor even the second.

The software design is a work in process.

Airbus has an extensive protocol and infrastructure for maintaining flight control software. At this point, it is an engineering problem and capable of being handled without more than the usual superhuman effort.

Mad Scientist.
Doesn't C* use 'g' for control loop closure at high speeds and body angle at low speed?

CONF iture

Airbus documentation is simply false.

What a ridiculous pseudo reason really !

Those AoA vanes move at nothing. I took the opportunity to manipulate them the other day and 15kt of relative wind is probably already in excess to place them in the wind on. No wind on them, they also stay in the position you place them, like absolutely not affected by gravity.

jcjeant

Some documentations ....

AirbusPapers.pdf

BOAC

- Whoa! Isn't that going to deny any AoA 'protection' unless you inhibit it only in normal law?

glad rag

Good read that.

Remembering the title is Operational Philosophy, the devil will be in the detail, or more precisely, lack of knowledge/practice off, which is becoming more and more obvious in the case of AF447.

Clandestino

I agree. I couldn't find crew's operating history on days prior to accident. If capt and senior F/O had 24 hours layover in Rio, their clock would be still on CET and that would put the time of the accident at just past the middle of the circadian low, at 4AM. What effect on the junior F/Os body clock had the alleged R&R in Rio, remains to be seen.

Stall warnings gave unwarranted warnings on older types too, like L1011 at KJFK in '92. Fortunately, outcome was less messy. Try hard as we might, we'll never make perfect and infallible stall warning system. Best we can hope for is good enough system combined with good enough crew and hope that system's and crew's low don't overlap. EK Gann understood it very well and to say that much has changed from his times would be displaying very shallow understanding of the aviation.

Hmmm.... inhibiting autotrim when stall warning is present, like it's inhibited in high speed protection? Interesting idea which might have some merit. While I currently can't think of any reason why it shouldn't be so, so far AF447 investigation has not uncovered a single reason why autotrim wouldn't work with pilots input. If pilots pushed forward, which is universally accepted as good idea when faced with upright stall, THS would follow.

Parbleu, monsieur! You have managed to invalidate calculations of Airbus engineurs which were accepted by certifying authorities on your own by conducting a simple manual experiment. I assume you've done it single-handedly. Congratulations... not! Do you have any idea what's the difference between dynamic pressure at 60 KEAS and 330 KEAS, everything else being identical? Only when you calculate it, we can discuss about precision and reliability of AoA vanes under all conceivable operational circumstances and whether would be too much of designers to come with those working under inconceivable ones.

Lyman

Minor point re: STALL WARNING. There was nothing whatever wrong with it, it functioned correctly. What failed happened later, and focusing on the lack of a Horn when one minute into LOC is like nibbling on the plastic garnish in your sushi.

Without comment, BEA does not address BUFFET. The entry into STALL was not 'conventional', and lacked a true break. That left the crew to rely on a System (SW) that was at best 50 percent dependable in the identified problem, (UAS)). That it was correct meant nothing to the crew, how were they to know?

PF was obsessed with Overspeed, and the ROD was not completely non-indicative of HS? The climb was similar in nature to an HSP ascent, and NOSE DOWN 'not responsive'?

Each time the guff gets to this point, someone needs to remind us of the conditions, the failures, and the not well understood UAS problems.

Not even BEA has condemned the crew as yet. Have they cynically relied on the public to convict?

AlphaZuluRomeo

This topic was already discussed a few pages back. From the FCOM:
When angle of attack protection is active, THS is limited between setting at entry in protection and 2° nose down (i.e. further nose up trim cannot be applied).
Basically, the idea was: why not do the same in Alt Law? (with the AoA protection remplaced by the Stall Warning, of course).

NARVAL

Lymanach time the guff gets to this point, someone needs to remind us of the conditions, the failures, and the not well understood UAS problems.
Exactly!
Let us try to be fair:
Simulators (Airbus test pilots have sais so) do not simulate in a useful way for training crews, piloting sensations at high altitude: that means the fact that a small stick input will give much more important nose up or down effect than at a lower altitude. How do you train then as airlines do not encourage hand flying in high altitude cruise?
Protections (although here, as we do not know exactly when the alternate law came in, this may be out of the subject) kick in with the same enthusiasm at 2000 ft and at 35000 ft in a heavy, rear centered airplane, with no regard at all for the flight envelope: see the Caracas A340 incident.Unbeliavable to me: you may have a 1,75 positive g "protection" at 39000 ft!
Speed indications coming back but not trusted. Understandable.
No AOA indicator. (I flew with one in the A300 for years, and, believe me, it is useful).
Nose up from 0 to max 10 degrees, variable, with an angle of attack (unknown to the pilots) of 40 degrees! Difficult to guess for them that their AOA is so high.
Trim wheel: never looked at, never used manually in thousands of hours..
Variometer unreadable in those planes, when leaving "normal values" and probably not read in the chaos.
Only the altimeters unwinding at full speed were an indication of what was really happening to them. I do not say they did very well. I say, without doubt, that they were not test pilots and that the situation was totally out of reach of the training they were provided.
Their experience was onlyA320 A340 A320...Where would they have learnt unuasual positions ?
I have a lot of hours, and have learnt to be really modest. Let us all give a thought to the very many, distressing missing informations in the BEA report. I hope the next one will be a little more complete.

Mr Optimistic

As I understand it the underlying reason isn't to inhibit the stall warning below 60 it's to prevent spurious data when the airflow is outside the vanes spec. Stalled or not stalled, a warning that airspeed is less than 60 knots when there is no weight on the wheels would be equivalent. If that situation can only arise when stalled, then fair enough allow a warning. Seems quixotic to cancel an existing warning when the speed goes out of range and it is likely that that very same stall caused the speed to go out of range.

Hope it's allowed to quote myself when I subsequently disagree. After a bit more thought I would give the designers some slack on this. Reasonable (and correct in this instance) to think that the stall warner would have done its job as best it could, well before speed decayed to 60knots. Can't blame the messenger if no-one gives it credence. My supposition is that it was discounted when it was real the first time round but believed when it reactivated on ND.

OK465

The approved flight data package that is used by the simulator manufacturers comes from Airbus. It includes automated tests utilized to periodically check & assure that the simulator is performing consistent with the actual data accumulated from flight testing within the aircraft operating envelope, at any altitude.

Why would company test pilots make a statement like this?

xcitation

Does anyone have a comment on the fact the PF (right seat) was found with lap belt undone and his audio channel sounding like he hit his mic on a wall? This correlates with the maxima of the acceleration graph on page 43 (+ 1.15g up).
Anyone know if AF pilots always fly with restraints attached or treat them in a casual manner? I could not find the AF policy for pilot seat belts.

Mad (Flt) Scientist

Because the simulator "matches where it touches" - it reproduces the manoeuvres specified by the data provided, and not necessarily any other manoeuvre. In practice, sims do better than that minimum, because the manoeuvres matched do cover reasonable variety of manoeuvres and across a fair bit of the envelope.

But go far outside the envelope of the specific manoeuvres and you are on your own. I suspect that is what the test pilot statement likely alludes to.

infrequentflyer789

No, just too simple. Possibly lost something in translation also. It should be perfectly obvious, with only a small amount of thought, that the warning cannot possibly be permanent if AOA is not recovered.

infrequentflyer789

Possibly (guessing a bit) because in Alt Law you're there because things are broken, and therefore airdata (for one) may not be assumed to be as reliable.

There is a difference between giving pilots a warning (which may be ignored...) and taking affirmative action to limit or override the pilot. The latter should requrie a higher degree of confidence in the data you are acting on - and that may not be available in Alt-Law.