AF 447 Thread No. 7
Join Date: Jul 2009
Location: France - mostly
Age: 83
Posts: 1,688
Likes: 0
Received 0 Likes
on
0 Posts
Originally Posted by CONFiture
I think that is the post ?
AF 447 No.5 post#1729
Originally Posted by A33Zab
- The stall warning is processed in FWCs not FCPCs
- It's the ADR itself which sets AOA to 0° (SSM=NCD) if CAS is below 60 Kts.
(A. did already changed that with 'BUSS' option, AOA is always available [only SSM will be NCD if CAS <60Kts])
- It's the ADR itself which sets AOA to 0° (SSM=NCD) if CAS is below 60 Kts.
(A. did already changed that with 'BUSS' option, AOA is always available [only SSM will be NCD if CAS <60Kts])
...that with 'BUSS' option, AOA is always available...
BUSS 'appears' to be an 'on demand' EFIS displayed AOA indexer, the first 'S' in BUSS being a misnomer.
In any case this is not full time AOA.
I think the idea there was that they'd bring the FD back once the data was good, it would then be up to the crew to either use, disregard or disable them.
The 'disregard', as a matter of intent to operate that way, is just not done by any carriers west of Atlantis these days. 'Good' data can translate to inappropriate lateral, & particularly inappropriate default vertical steering commands. In the wild west, they're either 'on' providing pilot selected steering guidance in the 'appropriate' mode as confirmed by the FMA or 'OFF'.
PRM breakout procedures are a another prime example of the validity this requirement in order to preclude unintended vertical guidance commands. (This is not to say that an inappropriate steering command should not be recognized for whatever reason it should occur.)
He has stated very compactly the state of general airline pilot knowledge in the period leading up to AF447.
EDIT: I guess semantically with BUSS, AOA is always 'available' just not always viewable.
Join Date: Jul 2009
Location: Not far from a big Lake
Age: 81
Posts: 1,461
Likes: 0
Received 0 Likes
on
0 Posts
Originally Posted by Dozy
The problem (as you state below regarding another point, and as I think I said in my original reply) is with false positives. If a sensor jam or genuine technical error causes the stall warning to sound when the aircraft is neither at or near the stall, that solution would prevent the pilot from trimming up when he wanted or needed to. You're then faced with the option of holding attitude with the primary controls and thrust (which would be fatiguing) - or if the limit applied to autotrim only, forcing pilots who are not used to trimming manually to do so at altitude with an abnormal situation on their hands.
What happens when the trim stops is you have to hold a pressure. If you don't want to hold the pressure, you can still reach down with your free hand and turn the trim wheel. No big deal, but it will have to be a conscious decision.
The protections are a separate subsystem entirely from the annunciation/warning subsystem. There is no overarching logic connecting them, which makes implementing such a change considerably harder. I can see where you're coming from, I just think that a hard limit on autotrim under certain flight control circumstances would make more sense.
Last edited by Machinbird; 15th Nov 2011 at 18:42. Reason: Address second comment.
Join Date: Feb 2005
Location: Correr es mi destino por no llevar papel
Posts: 1,435
Received 0 Likes
on
0 Posts
On a related subject, I have been in a 319 that failed to respond to SS input asking for nose down. I was maneuvering, avoiding one buildup and flew into another which was a substantial updraft. I had already pitched for green dot trying to climb above the first buildup and when I flew into the second updraft the aircraft failed to respond to my nose down, fwd, SS input for a couple of seconds. I assumed at the time that the updraft caused a "g" loading that fooled the ELAC. The buildup was small and we flew out of it in a few short seconds.
Regarding my mentioned experience where a A319 did not respond to a nose down SS input: for the brief moment I was in an updraft, the nose did not follow the input - once I flew out of the updraft the nose came down and we continued as if nothing had happened......... Knowing that pitch is load factor demand, and being in a updraft/downdraft/updraft/downdraft situation, and considering that the nose came down as soon as I passed the building cumulus, and considering that the Bus behaved normally the rest of the flight, I chalked it up to being in an Airbus. To me, it was no different than waiting for the MCDU to finish "updating" the page. Airbus pilots will know what I'm talking about.
Sorry Clandestino, but you're being overly dramatic. No report was made because none was necessary.
Sorry Clandestino, but you're being overly dramatic. No report was made because none was necessary.
Congratulations on your coolness but I fail to understand source of it. Why would you think it is normal to loose downward pitch authority? Was it something in your training? Did you experience it many times? Why do you assume that what's valid for navigation system is also valid for flight controls system? Could you please explain how updraft can fool ELAC into robbing you of nosedown authority?
Originally Posted by NARVAL
Maybe this message is not exactly « technical » enough for the Tech log
Originally Posted by NARVAL
They told me that they learnt from that accident a lot of things they certainly did not know at the time.
Originally Posted by NARVAL
Facts that are well known to test pilots or military fighter pilots, but which you have no way to learn in a career where you start at nearly zero experience on the A320 and end on the A380.
Originally Posted by NARVAL
you move the controls to a position that you think useful…or that the airplane manufacturer recommends
For example, when in an unusual position, a stall, a spin, you move the controls to a position that you think useful…or that the airplane manufacturer recommends,and you wait. You wait for long seconds, until the new position of the flight controls gives a result. Then, eventually, you wait some more…Many airline pilots have never practised that, and have no knowledge of it.
Personally, I am more than little amused by all the exaltations about airline pilots needing full stall recovery training. Ones pleading for it might be correct but let it remain type specific, please. I have just passed 4000 hours mark on aeroplanes that would simply kill me if I ever stall them. Don't see anyone being too excited about it, though.
Originally Posted by NARVAL
forget it, nobody knew anything about it
Originally Posted by NARVAL
experts are now considering a pitch-up into the deep stall never encountered in flight testing
Originally Posted by NARVAL
I think that we should keep in mind the very scant knowledge and training of the pilots at the time in the aerodynamics, stall recovery techniques, stall recognition…It was NEVER thought at the time that those planes could fly beyond the « approach to stall ». It was never thought either that the plane could « fly » with 40 degrees AOA and only 8 or 10 degrees of nose up.
So, of course the crew might have done better, but they certainly were not seriously prepared for what happened. May they rest in peace.
So, of course the crew might have done better, but they certainly were not seriously prepared for what happened. May they rest in peace.
Last edited by Clandestino; 15th Nov 2011 at 18:20.
Join Date: Oct 2011
Location: Lower Skunk Cabbageland, WA
Age: 73
Posts: 360
Likes: 0
Received 0 Likes
on
0 Posts
Clandestino wrote:
What, to gun it and pull up? Ha!
No, not at high altitude, there wasn't. Stall training, as I read it, was only for low-altitude problems such as wind-shear. This was one of the shockers
to come out of the reports, so far. Somebody please set me straight if I have misunderstood.
Yikes! OK, type-specific: I will never, ever, fly in a 'Bus again until I am sure that everybody holding my life in their hands is properly trained for such rare and unusual attitudes. Passengers do not expect to gamble on such things. In fact, I'm sure there are 228 souls who would emphatically disagree. 
There was procedure for approach to stall. None was followed.
No, not at high altitude, there wasn't. Stall training, as I read it, was only for low-altitude problems such as wind-shear. This was one of the shockers
to come out of the reports, so far. Somebody please set me straight if I have misunderstood.
Personally, I am more than little amused by all the exaltations about airline pilots needing full stall recovery training. Ones pleading for it might be correct but let it remain type specific, please.
Join Date: Nov 2010
Location: FR
Posts: 478
Likes: 0
Received 0 Likes
on
0 Posts
Pilots, do you prefer:
a] an aircraft that may (auto)trim nose up when it's (near) stalled
b] an aircraft that may not (auto)trim nose up when such trim is good, because the said aircraft suffers a "failure" with AoA measurement?
My (unqualified) answer is that 'a' seems more dangerous than 'b'. Then I choose 'b'.
So basically, I was agreeing to what you said: yes, one more "test" to do before allowing the autotrim to do its job is adding complexity to the system.
Having by no mean done any of a serious study (from a manufacturer perspective) on such an implementation, I won't comment on the "how much more complexity".
- inhibiting NU autotrim when a protection is ON
is far more simple than
- inhibiting NU autotrim when a warning is ON
??
I don't understand. Protection and warning share a source: The actual AoA. I don't see where is the "more complex/difficult" thing.
By the way, IIRC (*) on the A310 (older system), there is no "hard" protection. But when the aircraft "senses" a too large AoA, I believe it enters a specific mode which "unwind" the trim by x degrees.
(*) Ref is an east-european A310 (TAROM?) incident on approach to ORY, years back.
With an eager and switched-on crew, sure that'd work. But this crew in the wee hours appeared not to notice a Stall Warning that was blaring in their ears for nearly a minute. By the time the AoA values became invalid, the situation was pretty grim - what chance they'd notice the warning you suggest?
I think that design decision is a compromise - i.e. after an abnormal situation like that, would the crew notice that FDs were available and switch them back on again? I think the idea there was that they'd bring the FD back once the data was good, it would then be up to the crew to either use, disregard or disable them.
Join Date: Nov 2010
Location: FR
Posts: 478
Likes: 0
Received 0 Likes
on
0 Posts
Clandestino wrote:
What, to gun it and pull up? Ha!
No, not at high altitude, there wasn't. Stall training, as I read it, was only for low-altitude problems such as wind-shear. This was one of the shockers to come out of the reports, so far. Somebody please set me straight if I have misunderstood.
There was procedure for approach to stall. None was followed.
No, not at high altitude, there wasn't. Stall training, as I read it, was only for low-altitude problems such as wind-shear. This was one of the shockers
to come out of the reports, so far. Somebody please set me straight if I have misunderstood.Ref to interim report #2, where the AF procedure "stall warning" (at the time of the accident) is reproduced.
Abstract:
During any other flight phases after lift-off:
- TOGA
- Reduce pitch attitude
- Wings level
- Retract speed brakes.
Is that really "to gun it and pull up"?
I agree with you on the "no-training" part (high altitude), but Clandestino wrote "There was procedure", not "There was training".
Per Ardua ad Astraeus
Join Date: Mar 2000
Location: UK
Posts: 18,579
Likes: 0
Received 0 Likes
on
0 Posts
Personally I would like to be handed a basic aeroplane, but that is probably because I am so old I can fly one.
Way back I attributed to DW (but he said 'not me') the concept of the AB software reverting to Direct Law on such a failure as 447 had. IF then crews know this, they can be (hopefully) given the training to actually fly a real aeroplane. If they were, for example, to need trim, as long as there is some way they can INPUT it themselves - as required - that's fine. I would not wish some *** (censored for DW's peace of mind) to decide to put it in for me. I would, after all, know I need it, because I am a pilot. I should then know I have done it (because I am a pilot) if it becomes troublesome, whereas it is more than possible that the unfortunate 447 PF had NO idea he had full nose up HS - as I think the PGF PF also did not. KISS?
I just cannot see the problem- computers go tits up - pilots get given a machine that will fly the old fashioned way - all the bells and whistles are absent - who cares? It's an emergency. We don't need them.
Way back I attributed to DW (but he said 'not me') the concept of the AB software reverting to Direct Law on such a failure as 447 had. IF then crews know this, they can be (hopefully) given the training to actually fly a real aeroplane. If they were, for example, to need trim, as long as there is some way they can INPUT it themselves - as required - that's fine. I would not wish some *** (censored for DW's peace of mind) to decide to put it in for me. I would, after all, know I need it, because I am a pilot. I should then know I have done it (because I am a pilot) if it becomes troublesome, whereas it is more than possible that the unfortunate 447 PF had NO idea he had full nose up HS - as I think the PGF PF also did not. KISS?
I just cannot see the problem- computers go tits up - pilots get given a machine that will fly the old fashioned way - all the bells and whistles are absent - who cares? It's an emergency. We don't need them.
Join Date: Jan 2005
Location: W of 30W
Posts: 1,939
Likes: 0
Received 0 Likes
on
0 Posts
Originally Posted by DozyWannabe
or if the limit applied to autotrim only, forcing pilots who are not used to trimming manually to do so at altitude with an abnormal situation on their hands.
But I would like to hear you about that one first :
Originally Posted by Machinbird
So Dozy, how do you explain the AOA inhibit of nose up trim in Normal Law? Why did the engineers decide that was sensible?
Join Date: Aug 2009
Location: Germany
Age: 66
Posts: 1,810
Likes: 0
Received 0 Likes
on
0 Posts
Hi,
Those kind of consequences (atrophy of basic skills by a concept) is coming common in the industry
I see that in marine industry (unable to control manually water level and pressure of a high press steam boiler)
Again ..training .. training .. it's must be trained .. as the marine engineers who have the experience to manually control a boiler are a endangered specie !!
Even manually coupling on the electrical bus bars one diesel generator is for someone a unknow task !
When a concept atrophies a pilot's basic ability such as trimming, there are very serious questions to be asked regarding that design, especially as that pilot could be requested to instantaneously master that art again following a malfunction of that very same wonder concept.
I see that in marine industry (unable to control manually water level and pressure of a high press steam boiler)
Again ..training .. training .. it's must be trained .. as the marine engineers who have the experience to manually control a boiler are a endangered specie !!
Even manually coupling on the electrical bus bars one diesel generator is for someone a unknow task !
Join Date: Jul 2011
Location: Northern Hemisphere
Posts: 195
Likes: 0
Received 0 Likes
on
0 Posts
Originally Posted by Dozywanabe
See airtren's post - it's a lot more involved than that, going right back to the specification and trying to define potential knock-on effects of the change.
Originally Posted by Dozywanabe
The algorithm change is minimal - adding one test - and brings the Alternate Law "autotrim" behavior to be similar to the Normal Law "autotrim" behavior, so it's NOT something completely new.
The additional test in the algorithm requires a version upgrade in a number of internal specifications, that are documenting that algorithm, and in the user documents. The algorithm change is followed by a change of the software implementation, which depending of programming language goes from a line or two - the additional test - in high level language, to perhaps about 6-10 instructions, in machine language.
Is that a lot? That's about as minimal as one would get in terms of a software fix/upgrade.
A software upgrade is the easiest change, a lot easier than changing hardware, mechanical, hydraulic, etc.. components
Dozy:
Both.
But for me "on line" was flying in the Navy, not hauling hundreds of folks about the skies to Rio and Venice and Bali and other nice places. A half dozen souls at a time were all who were at risk were I to cock it all up.
Lyman:
You misunderstand my "how CRM is supposed to work" scenario. As we have noted previously (three or four threads ago), is was not how the cockpit discussion went based on what BEA has released to us. I was using a general conversation, not trying to repeat verbatim what was actuall recorded.
OK?
CRM in that cockpit: from the evidence provided, it was not up to scratch beginning about ten to fifteen seconds after the UAS incident began ...
On the line or when training?
But for me "on line" was flying in the Navy, not hauling hundreds of folks about the skies to Rio and Venice and Bali and other nice places. A half dozen souls at a time were all who were at risk were I to cock it all up.
Lyman:
You misunderstand my "how CRM is supposed to work" scenario. As we have noted previously (three or four threads ago), is was not how the cockpit discussion went based on what BEA has released to us. I was using a general conversation, not trying to repeat verbatim what was actuall recorded.
OK?
CRM in that cockpit: from the evidence provided, it was not up to scratch beginning about ten to fifteen seconds after the UAS incident began ...
Last edited by Lonewolf_50; 15th Nov 2011 at 21:29.
Join Date: Jun 2009
Location: Germany
Age: 70
Posts: 782
Likes: 0
Received 0 Likes
on
0 Posts
Notice of stall warning, instruments, audio
All bolding by me
Was the stall warning not noticed, noticed but not formally announced, noticed and not formally announced and not successfully reacted upon?
Let´s look at BEA Interim report 3: (bolding by me)
.
BEA assumes, that both stall warnings had been recognized and honoured by an action (although not successfull ones), and the PF admitted twice and the PF and PNF stated to the captain, that they had lost control of the aircraft, which could be a term to describe the fallout of the stalled situation.
We have to consider that BEA had made up its mind concerning this issue. The crew probably reacted to the stall warnings and admitted to have lost control, but did not formally announce stall to each other and also not to the captain.
I could not find your claim, that the captain was pointing to the ISIS, but i might have overlooked it in the report. Can you point me to it?
Edit: Thank you DW, found it with your help!
The following two quotes are for the one / ones, who still think(s) that instruments tell it all.
Some say, he would have understood better without asking, if he would have been able to observe a full NU control input together with the instruments.
And that one for the audio channel:
franzl
DozyWannabe
But this crew in the wee hours appeared not to notice a Stall Warning that was blaring in their ears for nearly a minute. By the time the AoA values became invalid, the situation was pretty grim - what chance they'd notice the warning you suggest?
But this crew in the wee hours appeared not to notice a Stall Warning that was blaring in their ears for nearly a minute. By the time the AoA values became invalid, the situation was pretty grim - what chance they'd notice the warning you suggest?
Let´s look at BEA Interim report 3: (bolding by me)
BEA IR3 Page 74 3rd para
At 2 h 10 min 10, the PF’s nose-up inputs increased the angle of attack and the stall warning triggered twice transitorily. Probably in reaction to this warning, the PNF exclaimed “what is that?”
At 2 h 10 min 10, the PF’s nose-up inputs increased the angle of attack and the stall warning triggered twice transitorily. Probably in reaction to this warning, the PNF exclaimed “what is that?”
BEA IR3 P75 6th para
At 2 h 10 min 51, ........... Five seconds later, probably in reaction to the stall warning, the PF pushed the thrust levers towards the TO/GA detent and called it out. It was at about that time that the airplane exited its flight envelope.
At 2 h 10 min 51, ........... Five seconds later, probably in reaction to the stall warning, the PF pushed the thrust levers towards the TO/GA detent and called it out. It was at about that time that the airplane exited its flight envelope.
BEA IR3 P 76 1st para
A little after 2 h 11 min 30, the PF said twice that he had lost control of the airplane.
A little after 2 h 11 min 30, the PF said twice that he had lost control of the airplane.
BEA IR3 page 76 3rd para
At around 2 h 11 min 42, the Captain came back into the cockpit, a very short time before the stall warning stopped. ........ Neither of the two copilots gave him a precise summary of the problems encountered nor of the actions undertaken, except that they had lost control of the airplane and that they had tried everything.
At around 2 h 11 min 42, the Captain came back into the cockpit, a very short time before the stall warning stopped. ........ Neither of the two copilots gave him a precise summary of the problems encountered nor of the actions undertaken, except that they had lost control of the airplane and that they had tried everything.
BEA IR3 page 76 7th para
At around 2 h 11 min 42, the Captain came back into the cockpit, a very short time before the stall warning stopped...................Neither of the two copilots formally identified the stall situation that the airplane was in, either via the aural warning, or by recognising the buffet, or by interpreting the high vertical speed and pitch attitude values. It should be noted that buffet is the only indication of the approach to stall at high altitude on other airplanes whose stall warning threshold does not vary with the Mach.
At around 2 h 11 min 42, the Captain came back into the cockpit, a very short time before the stall warning stopped...................Neither of the two copilots formally identified the stall situation that the airplane was in, either via the aural warning, or by recognising the buffet, or by interpreting the high vertical speed and pitch attitude values. It should be noted that buffet is the only indication of the approach to stall at high altitude on other airplanes whose stall warning threshold does not vary with the Mach.
DozyWannabe (bolding by me for reference)
We know the ADI on the LHS was OK from the DFDR, and the ISIS seems to have been OK too, otherwise the Captain would not have pointed it out.
We know the ADI on the LHS was OK from the DFDR, and the ISIS seems to have been OK too, otherwise the Captain would not have pointed it out.
BEA IR3 P76 3rd para
Neither of the two copilots gave him a precise summary of the problems encountered nor of the actions undertaken, except that they had lost control of the airplane and that they had tried everything. In reaction, the Captain said several times “take that”, doubtless speaking of the FPV (time 02:12:52
Neither of the two copilots gave him a precise summary of the problems encountered nor of the actions undertaken, except that they had lost control of the airplane and that they had tried everything. In reaction, the Captain said several times “take that”, doubtless speaking of the FPV (time 02:12:52
Edit: Thank you DW, found it with your help!
The following two quotes are for the one / ones, who still think(s) that instruments tell it all.
BEA IR3 P 76 8th para
In the absence of relevant information from the copilots, reading the information available on the screens (pitch attitude, roll, thrust, vertical speed, altitude, etc…) was not sufficient in itself for the Captain to become rapidly aware of the airplane’s situation. He did not then ask questions that could have helped him to understand the sequence of events.
In the absence of relevant information from the copilots, reading the information available on the screens (pitch attitude, roll, thrust, vertical speed, altitude, etc…) was not sufficient in itself for the Captain to become rapidly aware of the airplane’s situation. He did not then ask questions that could have helped him to understand the sequence of events.
BEA IR3 P 76 last para
Despite several references to the altitude, which was falling, none of the three crew members seemed to be able to determine which information to rely on: for them, the pitch attitude, rolland thrust values could seem inconsistent with the vertical speed and altitude values.
Despite several references to the altitude, which was falling, none of the three crew members seemed to be able to determine which information to rely on: for them, the pitch attitude, rolland thrust values could seem inconsistent with the vertical speed and altitude values.
BEA IR3 P76 9th para
The stall warning lasted 54 seconds continuously, during which time neither of the copilots made any reference to it. It is likely that the Captain heard this warning a few moments before coming back into the cockpit, but it is also likely that the multiple starts and stops added to the confusion and disturbed his diagnosis of the situation.
The stall warning lasted 54 seconds continuously, during which time neither of the copilots made any reference to it. It is likely that the Captain heard this warning a few moments before coming back into the cockpit, but it is also likely that the multiple starts and stops added to the confusion and disturbed his diagnosis of the situation.
Last edited by RetiredF4; 15th Nov 2011 at 23:16.
Join Date: Jul 2002
Location: UK
Posts: 3,182
Likes: 0
Received 0 Likes
on
0 Posts
If you don't believe me, let my late Prof. explain:
Report on visit to Airbus Industrie - 28-29th Jan. 1993
Originally Posted by BEA IR3 English P95 (May be different in other versions)
02:12:19 - 02:12:45:
PF : That’s good we should be wings level, no it won’t (not)
CDB : The wings to flat horizon the standby horizon
PNF : The horizon (second)
PF : That’s good we should be wings level, no it won’t (not)
CDB : The wings to flat horizon the standby horizon
PNF : The horizon (second)
Last edited by DozyWannabe; 15th Nov 2011 at 22:45.
Join Date: Jan 2005
Location: W of 30W
Posts: 1,939
Likes: 0
Received 0 Likes
on
0 Posts
Originally Posted by DW
I don't know why the A320 sim limits the nose-up trim and the A330 didn't in this case. Someone suggested that the limit might be airspeed-dependent, but the TRE had failed both ADCs.
Join Date: Jul 2011
Location: Northern Hemisphere
Posts: 195
Likes: 0
Received 0 Likes
on
0 Posts
You don't know that - the change itself may be minor, but the surrounding modules must all be tested to make sure there are no adverse effects. The development process is considerably different to any other software development methodology - even other real-time systems.
Last edited by airtren; 16th Nov 2011 at 12:30.
Join Date: Jan 2005
Location: W of 30W
Posts: 1,939
Likes: 0
Received 0 Likes
on
0 Posts
STALL WARNING
Something is not clear with the STALL WARNING :
For the 330 the FCOM mentions there is no FLT PHASE INHIB.
In the meantime there is an EMERGENCY PROCEDURE called STALL WARNING AT LIFT-OFF when such warning may sound if an AoA probe is damaged. I would then think there is actually an inhibit as long as there is still WOW ...
For the 320 the FCOM (not updated) clearly mentions that the STALL WRN in inhibited on GND.
I see no logic behind the logic as described on page 20 in report #3 :
For the 330 the FCOM mentions there is no FLT PHASE INHIB.
In the meantime there is an EMERGENCY PROCEDURE called STALL WARNING AT LIFT-OFF when such warning may sound if an AoA probe is damaged. I would then think there is actually an inhibit as long as there is still WOW ...
For the 320 the FCOM (not updated) clearly mentions that the STALL WRN in inhibited on GND.
I see no logic behind the logic as described on page 20 in report #3 :
If the CAS measurements for the three ADR are lower than 60 kt, the angle of attack values of the three ADR are invalid (NCD status) and the stall warning is then inoperative. This results from a logic stating that the airflow must be sufficient to ensure a valid measurement by the angle of attack sensors, especially to prevent spurious warnings on the ground.
Join Date: Jan 2008
Location: uk
Posts: 861
Likes: 0
Received 0 Likes
on
0 Posts
It was implied that testing is done, and it is proportional in all aspects to the type of system, and the type of manufacturer. Please don't make assumptions what I know or don't, and let's keep things at their real scale and proportions. I think it is expected that Airbus is not bellow - actually it could be very well above - the level that is considered norm in such type of critical systems, and the testing is sophisticated, with extensive automation/simulation.
We are talking about taking a single protection active in one law/mode and making it available in another mode. In the other mode that protection is part of a set, and the algortihms and code may well be interdependent, so you have to first split out the logic for that one protection and that might not be simple. Setting up the testing etc. won't be as simple either, for the same reason.
Further, it's entirely possible that the air data you need for the protection is simply not available at the flight control computers (prim or sec) in the event of airdata failure. I'm basing that on two things - the non-switch to abnormal-attitute law in 447 (which should have tripped on AOA, but didn't because of triple AD failure) and the reports that the BUSS option requires new airdata units in order to route raw AOA data around the ADIRU. Even if you could base your new code off the BUSS option, that still makes it a non-trivial hardware change rather than just a software patch, and you've also probably got to get an additional input ("raw" AOA) into the flight computers - maybe more hardware change and definitely much more testing.
However, I think there may be an even bigger problem that is much more fundamental. Looking across the civilian FBW implementations, there is a clear and consistent decision that protections/limits based on airdata are dropped when airdata is not valid/trusted. Either that is an independent engineering decision across teams/types and mfrs (yes, it's the same on B), or it's a regulatory / certification decision.
You need to overturn that decision to put trim protections into Alt2.
Bear in mind that if/when you do, a line has been crossed. Currently with UAS or other airdata failure, a good crew that can
a) work out which instruments they can trust
b) fly the plane within the safe envelope based on (a)
will survive. Throw in protections based on partial/incomplete/known-bad airdata and sooner or later you will kill a good crew that's doing the right thing. [There is still a chance of that in normal law, but it's much lower and much easier to quantify and try to design out. You couldn't even simulate all the failure modes for the input data for the bad airdata case].
So, who do you want to kill ? - because that is what it boils down to. It's normally the engineers faced with the dilema, maybe it should be answered by the pilots ?
Join Date: Jan 2008
Location: uk
Posts: 861
Likes: 0
Received 0 Likes
on
0 Posts
There may be more behind it than just SW as well. Active protections have consequences requiring greater data certainty than mere warnings. SW on taxiway is one thing, alpha-floor on taxiway likely to end less well...
For what it's worth, I think we may see this logic changed - if it's in software and is an easy update. If it's hardware and needs 3xADIRU replaced I think it's somewhat less likely....
Join Date: Jan 2005
Location: W of 30W
Posts: 1,939
Likes: 0
Received 0 Likes
on
0 Posts
IF789,
I think you put things far more complicated that they need to be :
When there is a known problem on the data or one is suspected, just stop the Magic and reverse to the conventional aircraft in Direct Law.
Did you say KISS BOAC ?
I think you put things far more complicated that they need to be :
When there is a known problem on the data or one is suspected, just stop the Magic and reverse to the conventional aircraft in Direct Law.
Did you say KISS BOAC ?
