DozyWannabe

So how many "algorithm bugs" (aka logical errors) do you see manifesting in this accident? Because I still don't see any.

And it was quite possible for an application to take out other applications on home and business OSes until very recently (until Windows NT4/2000 and MacOS X to be precise), because the previous generation did not have adequate "siloing" of running tasks.

We're getting *way* off-topic here though - it was an analogy, not an exhaustive description - and your version lacks the main point I was trying to make, which is that real-time systems in aircraft are not "centralised" around an OS in the same way home and business computers are.

airtren

On #1, "Diagnostic" has pointed out well and sufficiently the issues with it.
How many more casualties are necessary? to consider everything that may be a weak point important, or a “big deal”?
On #2, You're simply making my point about the SS location and virtual secrecy problem, and that of the "yoke" supporters, which is that the F/O saw quickly and understood well what was wrong. Why he didn't intervene is a completely different matter.
On #3, So what? I recall that others on this Forum refuted this point a while back, and you still think it is a "reason". Furthermore, you should know this if you have the expertise you've advertised: the approval of a tester cannot make a product, which is tested within certain limits, bug free!!!

To conclude, these are non-reasons, i.e. zero (0) value, relative to the AF447 case...

You should here what system architects from various industries say, about the "lack of visibility/virtual secrecy" of the A330 cockpit, and how this becomes an example of a typical bad choice for the control center of a critical mission system.
So, you had your self assumed badge for about 9 years? I've joined in July 2011, and your ""anti-Airbus brigade" defense badge" is outshining anything else that I could notice of similar nature.

As, I said before, I think you should reflect on this: do you really think Airbus needs this type of help?

Organfreak

[OF's operating system has experienced a fatal error and will now shut down]

airtren

14 -15 years is "recent"? There are people that made a profession from looking for holes in the "virtual fence" between OS and applications to use that to do damage, and others to close, or fix these holes, and prevent such damage.

It's very far from an exhaustive description. Among other things, I think I've made that difference clear, between a Home Computer OS and applications, and a A/C's real-time computer OS, and application, which is why I wrote it.

Clandestino

They won't. So far no one has come with solid reason why they should. Perhaps I'm mistaken, but I don't think that powers that be consider statements preceeded by "I think", "I feel", "I find" and "I believe, made on anonymous forums worthy of their attention. Those who really believe they can contribute to improvement of certification standards should better send their signed opinions to relevant authorities instead of airing them on PPRuNe and similar fora.

Given current level of technology, it wasn't and it couldn't be designed to protect from stall when having no realistic airspeed measurement. Of course, if you have idea how to overcome it, I would be delighted to hear it.

They had aural indication of excessive AoA.

So you realize the aeroplane was stalled. Do you realize, that when stalled all bets regarding controls authority are off except that it should be sufficient to unstall the aeroplane if appropriate control inputs are applied timely? Alternatively, if such criteria can not be met, aeroplane has to be equipped with automatic stall prevention device, colloquially known as pusher. Aeroplane was pitching down even with full nose-up elevator, when power was reduced so there is no need for precise pitching moment diagrams to see that connecting AF 447 with horror stories of irrecoverable stalls and swept wing pitch-ups is not red but infrared herring.

If it is true, then both of you are unaware of lag associated with hydraulic powered controls.

So far there's no indication that any instrument on board of AF447 failed. ADRs correctly measured pressure in total line. That it wasn't total pressure is not instrument failure but probe clogging.

It's manageable. Same way it was on JN. Attitude + power.

I'm certain it's just me but I couldn't find reference to the occurrence mentioned in interim3, could you please direct me?

Might be that airworthiness requirements got relaxed but on older Airbi it's not ADIRU signal input, it's shared pressure lines on stby instruments and ADR3. For pilots & maintenance folks it is of utmost importance to be able to tell the difference between the two.

This is a very serious occurrence, sir. Could you please provide relevant NTSB reference (or local investigating entity's one, if it was international operation).


Not a single flight where analysis was possible was handled IAW procedure. Atmosphere doesn't care if you use QRH as crutch, as long as you keep the AoA in the band that assures that the aeroplane keeps flying.

Yup. One out of 37 did not. Thirty-six out of thirty-seven went into alternate law. Some got stall warning. So pushed. Not pulled.

Eh?

No. I'm just suggesting that technical analysis clearly shows that most of the AF447 puzzle solution is in HF domain.


1. Their paperwork has shown no anomalies so in the eyes of the law, they were.

2. Once upon a time there was a certain senior training captain who was smiling from the airline advertisements. Once he made a beginner's mistake of taking off without clearance. So died. Took 582 people with him. Do we call him non-pilot for that?

DozyWannabe

What does that even mean? You're starting to sound like bearfoil again.

How much?

That the industry has a bad habit of "regulating by counting tombstones" is an uncomfortable truth, butthe point I was trying to make was that in the vast majority of those cases, the Airbus flight deck layout was more than enough to effect a recovery and arrive at their destination in one piece even if, as Diagnostic says, mistakes were made in the initial handling. That says to me that the design works at leas tas well as any alternative as far as the mission as a whole is concerned.

You'll be surprised to note that I disagree emphatically. If you compare the CVRs. both the Birgenair F/O and the AF447 PNF were well aware that the aircraft was not being handled correctly, but instead of taking control, kept making suggestions to the handling pilot. In the case of AF447, it would appear that the PNF was waiting for the Captain's approval to take control from the PF, and in the case of Birgenair the PF making a hash of it *was* the Captain.

No-one ever said it was bug-free, it simply passes the certification requirements on reliability that the non-digital predecessors of the instrumentation had to pass. I don't recall being "refuted" either, so if you'd care to furnish me with an example, I'll catch up.

What systems architects? Show me. I can cast-iron guarantee you that you'll find just as many - if not more - who say the system is fine. You keep using the phrase "virtual secrecy", and I do not think it means what you think it means.

Blow me down if I'm not being judged on 9 years of contributions based on 4 months of an occasionally heated discussion on one incident - and you accuse *me* of extrapolation!

In any case, the people I'm talking about materialised around 2004 and they blanketed any Airbus related thread with links to the website of one Norbert Jacquet, and later Henri Cornus - both former Air France Captains-turned-internet cranks who blame Airbus for the loss of their jobs and prestige. Some melted away over time, some are still around.

I'm not trying to help Airbus, I'm trying to get to the bottom of the issues behind the accident, and rehashing 20-year-old arguments about computers in the cockpit, yokes and feedback are getting in the way of that. The reason most of the more esteemd members of this board gave up on this subject months ago is because it always comes back to the same old same old. I only bother because I don't want to see Jacquet- and Cornus-sourced misinformation reprinted in the national press, whose journalists clearly know no better.

I'm not going to be CONF's monkey, and I'm certainly not going to be yours.

And, lest we forget, his fellow countrymen and pilots so categorically refused to believe that their premier pilot could make such an elementary mistake that they tried to blame the controllers (based on their assertion that they heard a word that sounded a bit like "futbol" on the ATC tape, which none of the other investigators heard), and the crew of the other aircraft involved (based on the fact that they did not turn off at the C3 exit, which was a practically impossible turn for a jumbo to execute, and elected to use C4 instead). To this day, the Dutch report still makes these assertions.

BOAC

- bottom of P90

Organfreak

Excuse me, but I fail to see how your response (to my comment to DW!) has anything to do with my simple suggestion that perhaps the authorities will reconsider what they certified, since I suggested nothing to them, nor would I. Only a complete fool would believe they could influence the authorities from here. You're changing what I said into something else! I really don't get where you're coming from.

OK465

Having once again learned something new here, in the future to avoid lag, I will plan on making all flight control inputs before I'm aware I need them.

Organfreak

Clandestino typed:
What does that mean??? Wind noise??? FAs falling base over apex???

airtren

So now what? you now realize what it means, and you're taking it back?

You went from saying that "design" and "software" are not perfect, to "systems" and "aircraft" are not perfect, and when I make a note of the progression, and progress, you're asking me what it means?

How does that sound? I would say just like yourself.

Have you reflected, thought, been aware what it means when you said what you've said?
.....

Can you clarify your statement of the Airbus "design" problem with the pitot tubes, per my earlier request?

Or is just a throw in the air, as you know well that the "pitot tubes" are already "done deal", and there is nothing to loose, or gain, by saying what you're saying?
You're answering with a question? You've mentioning betting, its yours, you want someone else to give your words their worth?

If there is anything wrong with the industry counting the tomb stones as an indication when there is time to get serious, is that it waited way too long, not that it takes actions, when there are fatalities.

You're clearly wrong, as based on your badge, you're not willing to admit that an airplane full of passenger casualties didn't happen earlier by pure luck, or science of statistics, and that there is a very simple and obvious factor in the cockpit that made it more difficult to isolate immediately the mistakes and correct them, as to prevent the loss of 228 lives, a factor that is recognized by other airline manufacturers, and by other industries.

No, the PNF had a suspicion, a guess, a hunch, but never knew, couldn't know for sure, with 100% confidence, which is why he could not tell the Captain, when the Captain rejoined the cockpit what's going on, why, and how things got there.

We have the PF's SS actions on the FDR traces, and we are in such a comfortable spot to be able to say what is wrong with those SS actions, as the traces clearly tell us.

But you're not willing to admit, that one of the reasons the Captain failed until the end, like the PNF, to see exactly what those actions were, is what is so obvious to many - the lack of visual contact, the lack of ability to see the positioning of the stick, and the actions on the SS, which yes, is "a virtual secrecy" created for the direct PF actions on the SS, for those that are in the cockpit.

You would be your monkey, as your input queue is yours, and the responsibility to manage it properly is yours.
Really?

Per your own posts, you're trying hard to influence and control this Forum, as to guide it into the belief that the only problem with the airplane is the problem known well before the accident - the pitot tubes - and that the ample data provided by this accident show no problem with it.

You would have to do a lot to change the credibility perception for statements like the one I just made.

I have no idea what was the discussion or problems pointed out were years ago. I looked at the AF 447, case and data, with no dog on the track, and what's obvious is there obvious. The fact that similar discussions existed before, is just an indication that the problem existed from day one.

gums

Salute!

- As mentioned, there can be lag in control surface position versus control stick/yoke/wheel position and rate of application ( hereafter referred to as "stick").

"lag" can be implemented to get a better handling jet or to keep you from ripping the wings off, and it can be modified by pure mechanical doofers in the actuators, feedback of surface forces in the actuator, or firmware/software.

For example, observe the Viper or Typhoon at your next airshow ( two FBW jets). Note how quickly the jet stops rolling. Lag? Yep. The roll command implements a lag filter when rolling into a bank, and a reduced lag filter when relaxing the stick. So simply relaxing pressure, or deflection of the stick, gets you back to the trimmed roll command or "protected" bank angle that the 'bus has in some laws.

- We must distinguish between "instruments", displays and sensors. Granted, the actual pneumatic sensors on the 'bus may have accurately measured AND displayed the poor data, but many folks call that "instrument failure". The AF crew even calls out " we have no indications". So what does that mean? Is it the sensor or the actual display?

With known unreliable speed at the outset of the story, when did the system ( input device, sensor, display) become reliable again? Is the pneumatic vertical velocity valid? Is an inertial vertical velocity display available to use as a crosscheck? Hmmm....

- AoA, one more time.

Why ignore the AoA sensor inputs for stall prevention/ stall indications/displays? Is the 60 knot speed doofer a poor design implementation versus a simple weight-on-wheels "switch"?

Speed ain't a good thing to use for a stall indication. You can stall at almost any speed in many planes ( high performance jets usually cannot stall when flying at the speed of stink, heh heh, as you hit structural limits before AoA limits). You stall because you exceeded some AoA.

You don't need a full time AoA indication. In the Viper, we only had an AoA "bracket" in the HUD when gear was down, and used it for best approach speed. Lots more accurate than a "speed" we got using our gross weight and configuration. Easier, too, for we single-seat types. Ask 'bird, Retired, Smilin', et al. The U.S. Navy jets had a full time AoA display called an "indexer" that told you to lower the nose or raise the nose. The A-7, F-4 and F-18 of my era when the Earth was still cooling, but aerodynamic principles were well-established, had a full time AoA indication in the HUD.

Stick and/or rudder pedal shakers are neat, as are aural warnings. But we saw the AF crew seemingly ignore the aural indication. Not much re-design effort/testing required to add a "vibrator" to the stick. But would it be valid?

"we have no indications"........
++++++++++++++++++++++++
I always wonder why the new airliners don't have a HUD.

After all, they have only been around since the late 60's.

A HUD is invaluable when landing in poor weather, and it ain't too shabby for basic climb, cruise, descent. Using inertial data for a flight path doofer ( FPM), it's an excellent thing for crosscheck with the steam gauges or cosmic flatscreen displays such as the 'bus and others utilize. Seeing the FPM caged at the bottom of the HUD is a great indication that you are descending, regardless of your pneumatic system displays. Then there's the pitch lines to show the actual angle your jet is flying and pitch attitude if you have a body reference symbol ( like your basic attitude indicator). Sheesh, that HUD will spoil your crosscheck in a hurry, and it takes lottsa discipline to include the steam gauges.

Lastly, I do not go with the yoke/wheel crowd. For some, the visual or tactile feedback might help. But mostly you see what's happening on the displays or outside the windshield and ask the other guy what he's doing if you don't understand what's happening. BTW, I am not a true dinosaur, I evolved into a bird.

jcjeant

Hi,

Clandestino
Pilot handling was not exactly my point ...
For the JN when Pitot tube clogged you loss airspeed indication (visual) and no more
For the Airbus when pitot tubes clogged you loss airspeed indication (visual) and also a important data needed for the automation system .. and that is the most important point (design of the automation system)

Methink .. such incident will not show in any investigating entity's unless pilot made a report to airline .. and this airline send it to investigating branch office
I think (by what I read about reports and experience backup) that this event no deserve to be in a investigating entity archive
I can be wrong ... if it's the case the OP will certainly correct me in his answer

This particular day and time .. yes .. he was no more a pilot .. he forget he was a pilot .. and he was just a man trying to return as soon as possible at home

OK465

Clandestino

Thanks, I missed that Seems that someone at BEA messed up by providing ADR switching traces twice, instead of ADR and IR switching. They have time to fix it in final. As there were no IR failures or disagreements recorded, seems that switching of RH IR source from IR2 to IR3 wouldn't make a difference to displayed attitude.

Did just that this summer at Zeltweg. Couldn't help but notice that both of them are combat airplanes, implying that they're on the opposite side of stability/maneuverability spectrum compared to passenger transports. If maneuverability is primary design concern, it's easy to reduce control lag by installing powerful hydraulic actuator. If not - weaker one will do just fine, it will be lighter, will strain hydro system less and require less beefing up of the structure it is attached to. That's why AF447 elevator traces shows gradual reduction from full nose down when forward stick was applied and not instant stop-to-stop wham.

Stall prevention - with pitot clogged there is no way for ADC to discern whether AoA or airspeed is faulty so it proclaims itself unreliable. With all three ADRs out, to reduce the risk of wrong protection kicking in, air data based protections shut off and leave the problem for intelligent beings to solve. That's basically what is meant by very technical term "Flight control laws"

Stall indications - it wasn't ignored. It worked properly.

Displays - no legal requirement for AoA displays to be fitted. With thousands of airliners flying safely every day without them and dozens of crews solving UAS just by reference to attitude and power, I don't find the logic behind not requiring AoA gauge in cockpit faulty.

Not quite. Since you have to introduce ADR input into stall warning system to cope with Mach effect on critical AoA, having 60kt cutout is actually simpler than adding WoW input and with it another possible failure point.


Thanks for the info. On PC-9 indexer comes alive only when gear is lowered, I assumed it is just for landing on every military airplane.

I am afraid that we get new equipment only if it makes economical sense to someone in charge. I have Head-up Guidance System in my Q400 because it was cheaper to graft IRS and HGS on her to make her CAT3A capable than to develop autotorque and autoland-capable autopilot.

Not to mention your landings will become more precise and softer with the help of the little birdie and then one day you'll be all f-ed up when your HGS gets MELed and it's back to switching between head down and up on landing again.

Why? Pilot handling is exactly what put AF447 into trouble.

It would be important if A330 is impossible to fly without automatics. Well, it was designed to fly with computers and sensors badly shot up. It's not heuristics but many thousands of hours spent on carefully designing and testing the plane.

Reading the description, it could be either hitting the low G protection at -1G and that makes absolute hell of cabin even with everyone strapped in or serious failure of flight controls system. Where I live either option is heavy incident, will leave massive traces on QAR that would be picked up by the FDM so non-reporting would result in tea without biscuits and it has to be investigated by government appointed investigation commission.

Since you say so, is this applicable to the case we're discussing, too?

Old Carthusian

Diagnostic
I am a private person and I value my privacy very much. That is why you will not see any information about my flying experience on my private page. It is also why I have not checked up on yours or anyone else's. I take everyone by what they write and that means the occasional mistake that they may post. But just this once I will make an exception - I received my instrument rating back in 1985.
I joined this board to learn about this particular incident but what I am learning disturbs me greatly. This doesn't seem to be about aircraft but about cultures of neglect and arrogance that develop in the professional piloting world and that scares me. We have Pan Am back in the 1970s, Korean Airlines in the 1980s, Air France now. The implications are very disturbing - almost as if there is a disease that can infect any airline. Arguments about automation and greater computing taking away flying skills may have some bearing but not really. Pan Am's culture happened in the yoke/mechanical linkage era. So did Korean's. There are thousands of Aibuses flying around the world - probably at least 50 of them are in the air as I write. All of them using sidesticks. There are thousands of Boeings - they use yokes don't they? Both input methods are equally valid and both have their adherents. However, the yoke would not have saved the aircraft in this incident because the issue is cultural not mechanical.

AlphaZuluRomeo

For the record, and despite I doubt it would have changed the outcome in the light of the crew actions, I see two of them:
1/ the non-inhibition of the nose-up autotrim when stall warning is active
2/ the inhibition of the stall warning under 60kt IAS (even if I understand the logic behind the inhibition, I still think it may be worth reworking that bit of logic)

And perhaps a 3rd and 4th, but as I don't know the logic behind I'm not qualified to fully comment:
3/ the V/S switching source from air data to inertial (and back); it occured in AF447 and its consequence was a non-readable/unreliable/unrealistic displayed (air data sourced) V/S, while at the same time a reliable/realistic V/S value (aka inertial sourced V/S) was available (for the system).
4/ the non-inhibition of the F/Ds (by the system) when an UAS situation is detected: why? A/P & A/THR may (and have) been dropped, why not the F/Ds as they may give unreliable directions in such a situation?


Nonetheless, I still fully agree with Clandestino here (my bold):
-----------

Yes I agree. And because of data missing, when tubes get clogged you have reversions in various systems.
But what do you make of that statement? Are you advocating that, because "automation" (which part(s) ? flight controls? A/P? A/THR? all of those? more?) uses air data, and air data is not 100% reliable, the industry should renounce "automation"??
I'm sure I must have misunderstood your point. Would you be kind enough to elaborate?

-----------

Now, on a more general topic, is it possible going back to the ball, i.e. leaving the players alone?

infrequentflyer789

[Regarding aural indication of excessive AOA]

I would think it's fairly obvious he means the a/c shouting "stall" at them continuously for almost a minute - but then it seems it wasn't obvious to those there on the night...

Where I differ from Clandestino and others is that I am not sure the binary on/off stick shaker or stall warning is an adequate subsititue for an AOA gauge once you've managed to get yourself stalled. Shaker / warning won't tell you any different between "you're nearly stalled", "you're stalling", "you're well stalled" and "you're more stalled than any test pilot ever went...".

Maybe the warning should get louder, shout different things, shake stick harder... or maybe it should be a cue to look at the instrument that tells you exactly how far you are from flying.

That said, I have a suspicion it would have made little difference on 447 - the AOA would quickly have been pegged at max (25) and then disbelieved.

AlphaZuluRomeo

At least! Just now, 221 FBW/SS equipped Airbii are broadcasting (ADS-B) in zones covered by private receipters of the FlightRadar24 network (which is most implanted on Europe, and it's night over it at present). And to compare: 293 B7xx at the same time.

/off topic

airtren

So, you've echoed repeatedly publicly an idiotic statement sent to you via a PM - I have no idea who the "same person" you're mentioning is - and offer a conditional apology?

The Moderator deleted your first post, after you refused to do it at my respectful request, but then you keep repeating it, as soon as I start posting, as a tool of intimidation.

You need to do a lot better than this post.

You can start with your own computer expertise - as an advertised software engineer, you should do a lot better - as you seem to have no clue on detecting network applications impersonations, continue with your interaction with the Moderator, continue with a better management of your tactical arsenal devices and finally improving your apology section.

airtren

Here is a post on the topic, which tangentially points out the 3 different Stall states, and possibility to have an error message for each.

http://www.pprune.org/tech-log/45687...ml#post6598193