Go Back  PPRuNe Forums > Flight Deck Forums > Tech Log
Reload this Page >

AF 447 Thread No. 7

Tech Log The very best in practical technical discussion on the web

AF 447 Thread No. 7

Old 16th Nov 2011, 13:46
  #301 (permalink)  
 
Join Date: Jan 2005
Location: W of 30W
Posts: 1,916
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by IF789
WOW switches not sufficiently reliable on their own (not a great history of reliability, and they regularly take a beating in use).
Then why is it good enough for the 320 ?

Last edited by CONF iture; 16th Nov 2011 at 17:34.
CONF iture is offline  
Old 16th Nov 2011, 14:46
  #302 (permalink)  
 
Join Date: Nov 2010
Location: FR
Posts: 477
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by CONF iture
IF789,
I think you put things far more complicated that they need to be :

When there is a known problem on the data or one is suspected, just stop the Magic and reverse to the conventional aircraft in Direct Law.

Did you say KISS BOAC ?
That would be far more simple, indeed:
- for the engineering team to implement
- for the pilots to "understand"

Now, Airbus made a different "philosophical" choice. "Why" is a good question.
A guess: Alternate law retains "parts of" automation. What would we say if there was an accident and we found out that the accident could have been prevented by a protection/automation that was made inop because of a reversion to direct law, while the input data needed for this protection were available & reliable.
Exemple : Let's imagine AF447, the aircraft stalls but then the crew engage a recovery : nose down, AoA is lessened, speed come back. At this point, the PF pulls on his stick to go back to level flight but he pulls too hard.
If reversion to direct law => overstressed the plane => structural failure => irrecoverrable => crash.
If reversion to alternate law => g protection still available => no overstress => plane recovers => continue flight => lands with all souls onboard alive.

See the point? That's about "graceful degradation" if I understand the concept correctly.
AlphaZuluRomeo is offline  
Old 16th Nov 2011, 15:38
  #303 (permalink)  
 
Join Date: Jul 2011
Location: Northern Hemisphere
Posts: 195
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by infrequentflyer789
We are talking about taking a single protection active in one law/mode and making it available in another mode. In the other mode that protection is part of a set, and the algortihms and code may well be interdependent, so you have to first split out the logic for that one protection and that might not be simple. Setting up the testing etc. won't be as simple either, for the same reason.
I read your "may" as your making a cautious assumption, which is always welcome at the outset. A closer perspective can clarify if the more distant perspective caution is justified.

With the risk of repeating the considerations mentioned by AlphaZuluRomeo, with my own closer perspective and words:

As far as I can remember from when I looked closely at Normal Law protections, in an up-down sequential flow, the elements of the set are parallel, and independent.

Please note, dependency of more than one algorithm on a certain parameter, which, if I recall correctly is the case, does not make the elements of the set of algorithms dependent on each other, or interspersed.

An additional factor is that the Alternate Law is a subset of Normal Law, in fact a minimal subset, which means that the number of parallel algorithms in the set is minimal.

These are both elements that speak about simplicity.

...
However, I think there may be an even bigger problem that is much more fundamental. Looking across the civilian FBW implementations, there is a clear and consistent decision that protections/limits based on airdata are dropped when airdata is not valid/trusted. Either that is an independent engineering decision across teams/types and mfrs (yes, it's the same on B), or it's a regulatory / certification decision.

You need to overturn that decision to put trim protections into Alt2.
It's good to remind us the philosophical and general principles, if there is a suspicion that the "higher" perspective was lost.

But I don't think it was the case, the perspective was/is there.

In the same time let's not loose the close perspective - while we look at the Forest, let's keep looking at the Tree we're concerned about.

The function of the Autotrim is an automation factor to "the Trimmed Stabilizer".

When Autotrim didn't exist, pilots did the trimming Manually - if the "trimmed stabilizer" was present - if there was no "trimmed stabilizer" on a plane, the pilot did NO trimming at all

So, the intention of the "automation" was/is to do the "autotrim", on behalf of the pilot, in those conditions in which the pilot would have done the "manual trimming". This is very important and should be remembered by everyone, pilots, engineers, system architects, managers,etc.... !

What do we have in the AF447 case?

We have the STALL condition being announced loudly - and after so much analysis, very clear in its meaning to us - and throughout the duration of that announcement, we have an "automation" decision/action of employing the "autotrim" to max NU, which obviously if it did anything, it helped the STALL.

So, who do you want to kill ? - because that is what it boils down to. It's normally the engineers faced with the dilema, maybe it should be answered by the pilots ?
The analysis work of last 2 years, performed by appropriate organizations, and the very clear and loud resulting recommendations for the required actions from pilots at High Altitude Stall Approach, or Stall is to bring the ND, which implies the strong recommendation of NO Manual Trimming NU during such conditions!

When remembering the few lines above, that the "automation"s role is to only do what the pilot would do manually if automation was not present, the answer to anyone's dilemma seems simple....extend the "don't do manual trim NU", with "don't do manual/automated trim NU"...

IMO, the recommendations for what "automation" is supposed to do during the conditions of the new recommendations for pilots are just one step behind. The lag seems to be normal, although the current dichotomy
present in some systems will need be resolved regardless of recommendations or not.

Last edited by airtren; 16th Nov 2011 at 20:04.
airtren is offline  
Old 16th Nov 2011, 15:40
  #304 (permalink)  
 
Join Date: Aug 2002
Location: Switzerland, Singapore
Posts: 1,309
Received 0 Likes on 0 Posts
It's a big misconception that there is alternate law in Airbus fbw software. Of course we call it alternate, but what it basically is is a degradation of normal law. There is only normal and direct law, and the intermediate position where one degree of freedom still is in normal and the other not anymore is called alternate.

The more protection you lose, the closer you get to direct law. You could now design three dozens of different laws, a gradual sinking into direct law. To make it more easily, they invented 3 positions, which makes absolutely sense to me.

I said it and I say it once more: You as a pilot don't have to know in which law you are. There is no ECAM message "YOU ARE IN XXX LAW". You can fly the aircraft in any law. Just where the amber x's are, that's where you lost your protections.

Now you laugh at me and say "if they (AF447) would have been in normal law, the aircraft never fell into stall". This might be right. But as a wise pilot you just don't pull these maneuvers, even if you can (in normal law). "It is possible in normal law" is no excuse for behaving like an imbecile.

Last edited by Dani; 16th Nov 2011 at 16:30.
Dani is offline  
Old 16th Nov 2011, 15:53
  #305 (permalink)  
 
Join Date: Jul 2011
Location: Northern Hemisphere
Posts: 195
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by Dani
It's a big misconception that there is alternate law in Airbus fbw software. Of course we call it alternate, but what it basically is is a degradation of normal law. There is only normal and alternate law, and the intermediate position where one degree of freedom still is in normal and the other not anymore is called alternate.
A common main path, versus different main paths is not really relevant. That's because a common path implies branching separate ways into separate sub-paths depending on Law, when decisions and outputs are specific and different for each Law, which ultimately is sort of equivalent. This type of sub-path, which be then the object of the considerations made in this discussion, is still technically a different path, even if a short one. In cases when outputs are similar, the branching/separation may be followed by a rejoining a common path.

The more protection you lose, the closer you get to normal law.
Huh? Do I misread this, or is a typo?

The more protections you lose the closer you are to direct law.

Last edited by airtren; 16th Nov 2011 at 16:25.
airtren is offline  
Old 16th Nov 2011, 16:29
  #306 (permalink)  
 
Join Date: Aug 2002
Location: Switzerland, Singapore
Posts: 1,309
Received 0 Likes on 0 Posts
Sorry, wrote it in a hurry, but you are right. Of course these are new branches, and software engineers think like that. I have nothing against it. I just want to help non software engineers to think correctly. Pilots get confused when showing too much complexity. They like it simple (anyone said KISS? ), because in the air and under stress you lose your ability to think in details.

When an outstander, which most of the contributers here are, hears about all this laws, he thinks: How could they have made it so complicated. It isn't complicated. Just think straight, think KISS, and Airbus is KISS.
Dani is offline  
Old 16th Nov 2011, 16:54
  #307 (permalink)  
 
Join Date: Jul 2011
Location: Northern Hemisphere
Posts: 195
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by Dani
....

When an outstander, which most of the contributers here are, hears about all this laws, he thinks: How could they have made it so complicated. It isn't complicated. Just think straight, think KISS, and Airbus is KISS.
For one understanding them well, they're simple - you're right

Interestingly, that applies also to algorithms and their implementation

Pilots get confused when showing too much complexity. They like it simple (anyone said KISS? ), because in the air and under stress you lose your ability to think in details
This is a very good additional argument of why the SS (under PF control) should be placed so that it can be seen - under stress, the visual contact with the SS, is the easiest way to know what's going on with it.

Last edited by airtren; 16th Nov 2011 at 20:27.
airtren is offline  
Old 16th Nov 2011, 17:03
  #308 (permalink)  
 
Join Date: Jan 2005
Location: W of 30W
Posts: 1,916
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by Dani
There is no ECAM message "YOU ARE IN XXX LAW"
Of course there are :
  • F/CTL ALTN LAW
  • F/CTL DIRECT LAW

Airbus is so KISS when manually flying that he trims for you ... but sometimes he does not. When he does not he supposed to advise you but it appears he may forget as well.

"It is possible in normal law" is no excuse for behaving like an imbecile.
Don't rush your judgement as you rush your writing.
CONF iture is offline  
Old 16th Nov 2011, 18:25
  #309 (permalink)  
 
Join Date: Jul 2002
Location: UK
Posts: 3,093
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by CONF iture
Airbus is so KISS when manually flying that he trims for you ... but sometimes he does not. When he does not he supposed to advise you but it appears he may forget as well.
Doesn't a drop to Direct Law have an amber "USE MAN PITCH TRIM" annunciation?
DozyWannabe is offline  
Old 16th Nov 2011, 18:31
  #310 (permalink)  
 
Join Date: Oct 2011
Location: Lower Skunk Cabbageland, WA
Age: 74
Posts: 354
Likes: 0
Received 0 Likes on 0 Posts
I know, I know! [waves hand in air]

Dozy:
Doesn't a drop to Direct Law have an amber "USE MAN PITCH TRIM" annunciation?
Yup.
Organfreak is offline  
Old 16th Nov 2011, 21:30
  #311 (permalink)  
 
Join Date: Jan 2005
Location: W of 30W
Posts: 1,916
Likes: 0
Received 0 Likes on 0 Posts
  • But disappears in Abnormal Attitudes Law
  • BEA pretends Altn Law was the active Law all the way

What I can report from my own experiment in the sim :
  • I could not get a fwd autotrim
  • But USE MAN PITCH TRIM FLAG was NOT displayed on the PFD
CONF iture is offline  
Old 16th Nov 2011, 21:40
  #312 (permalink)  
 
Join Date: Aug 2002
Location: Switzerland, Singapore
Posts: 1,309
Received 0 Likes on 0 Posts
CONFiture:

But disappears in Abnormal Attitudes Law
it doesn't disappear, it never appears.

BEA pretends Altn Law was the active Law all the way
I do not doubt this. Imagine: No valid speed, therefor several fault messages from/through ADR.

I could not get a fwd autotrim
Which is confirmed by FCOM. The aircraft behaves like they say it does.

But USE MAN PITCH TRIM FLAG was NOT displayed on the PFD
This message appears in direct law, not in alternate law.

The only way you can tell that you are in alternate law is (apart from ECAM messages, thanks for the correction) are the amber crosses on PFD.

Dani
Dani is offline  
Old 16th Nov 2011, 22:38
  #313 (permalink)  
 
Join Date: Aug 2011
Location: Grassy Valley
Posts: 2,074
Likes: 0
Received 0 Likes on 0 Posts
What you seem to be missing, perhaps, philosophically, is the aircraft is mimicking the actual degradation of the suite of cues, displays, and controls that are the very genesis of the LAW degrade in the first place.

When, for any reason, cues and behaviour of airframe are lost to the holes in the cheese, how beneficial is it for the a/c to do the same? Fair enough, this is true for Direct DIRECT also. However, once in DIRECT, the skillset is less chsallenged, the a/c becomes a simple machine, not an automatic one. The interface is straightforward, and quickly acquired. At this point, airmanship is the key, not the interface that mimics it.

To change the response and controls automatically, requires an additional workload, and from my perspective, a most unwelcome one. Looking out the telescope frrom the small end, (what we are doing here), is easy, and without stress or penalty.

Looking through the telescope in reverse, (what the crew were doing), does not form a large enough background for global view. When the flying gets complex, why add additional changes that may cause consternation to a hyperfocused crew, looking for the ONE thing that needs the most attention? Simplification is the driving force, or should be.

The bottom line is the additional workload. Unwelcome, says I.

Right, Wrong, or Indifferent, the crew were unable to isolate the simplest move, get the Nose Down.

The confusion came from somewhere, I say a fair portion of it came from the platform. Fair?
Lyman is offline  
Old 16th Nov 2011, 22:56
  #314 (permalink)  
 
Join Date: Jan 2005
Location: W of 30W
Posts: 1,916
Likes: 0
Received 0 Likes on 0 Posts
Perpignan told a different story as the USE MAN PITCH TRIM FLAG was initially displayed but disappeared when the flight switched into Abnormal Attitudes Law.

Dani, what is that FCOM reference that could explain I was not able to get a forward autotrim ?
CONF iture is offline  
Old 16th Nov 2011, 23:03
  #315 (permalink)  
 
Join Date: Jul 2009
Location: The land of the Rising Sun
Posts: 187
Likes: 0
Received 0 Likes on 0 Posts
I rather think that it would not be a fair attribution to suspect the platform. The factor that might best describe what you're driving at would be 'Know your machine' which is a training and cultural issue. We have no evidence of a chain of command, CRM or use of standard procedures. Given that all of these seem lacking any platform is going to produce a similar result in similar circumstances.
Old Carthusian is offline  
Old 16th Nov 2011, 23:04
  #316 (permalink)  
 
Join Date: Jul 2002
Location: UK
Posts: 3,093
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by CONF iture
Dani, what is that FCOM reference that could explain I was not able to get a forward autotrim ?
And yet on the A320 sim I did. Have you tried talking to the sim engineers about that one?

Thus far there have been no emergency fixes released for the A330 in terms of hardware or software, but there has been a new stall recovery procedure which instructs use of the sidestick to push the nose down. This suggests to me that Airbus and the BEA got positive autotrim response when they tried it on their A330 sim.
DozyWannabe is offline  
Old 16th Nov 2011, 23:20
  #317 (permalink)  
 
Join Date: Aug 2011
Location: Grassy Valley
Posts: 2,074
Likes: 0
Received 0 Likes on 0 Posts
Not only that, but the MEMO, when released by BEA, provided no NEW MECHANICAL issues that hadn't been addressed....We don't go there....

OC... It isn't that black and white. There are four degradations that can obtain post UAS. ALT1, ALT2, DIRECT, and ABNORMAL. PITCH and POWER are nothing if not offspring of MANUAL, why present one or more of these different concepts when ostensibly, P/P is always the Drill? P/P is successful, or it is not, and if not, protection memory accomplishes what? Protections obtain when the pilot has lost control anyway? Why bother with stops along the way to DIRECT (PITCH AND POWER)? Did the a/c linger in NORMAL whilst P/P could be applied? If not, why not? And if inertials were such the hot ticket, why not blacken both PFDS in favor of an ISIS with reads in RED?

Complexity for the sake of......?

Another thought. Why leave NORMAL LAW at all? It is possible for NORMAL to retain, even with a/p loss. Just not with unreliable speeds.

Last edited by Lyman; 16th Nov 2011 at 23:34.
Lyman is offline  
Old 16th Nov 2011, 23:43
  #318 (permalink)  
 
Join Date: Jul 2009
Location: The land of the Rising Sun
Posts: 187
Likes: 0
Received 0 Likes on 0 Posts
OC... It isn't that black and white. There are four degradations that can obtain post UAS. ALT1, ALT2, DIRECT, and ABNORMAL. PITCH and POWER are nothing if not offspring of MANUAL, why present one or more of these different concepts when ostensibly, P/P is always the Drill?
It would still come down to training wouldn't it? Me, I'm no Airbus pilot but those who post on this board seem to have no problems with the system as configured. One can legitimately argue that it can be improved but then so can everything. It's logical and it works so I would be very leery of attributing any causal factors to it. The issue is really the inability to analyse the UAS correctly and the unexplained stick movements by the PF (we all have our suspicions but we can't be certain). I would agree that P/P is the drill but if you don't get your initial analysis right then it becomes rather moot.
Old Carthusian is offline  
Old 16th Nov 2011, 23:51
  #319 (permalink)  
 
Join Date: Jan 2008
Location: uk
Posts: 857
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by airtren
I read your "may" as your making a cautious assumption, which is always welcome at the outset. A closer perspective can clarify if the more distant perspective caution is justified.
You're right, but it's also a general statement of the need to be cautious about what is or is not "simple" in software without detailed knowledge. A fair few years in software development has taught me that it's very easy for someone to believe they know enough about the internals of a system to assess the impact of a change request, when in fact they don't. Dependencies can be very subtle. Often the CR will eventually (sometimes only after the test start failing or the user bug reports start landing) hit the desk of the person that does understand the impact and result in an expletive laden exclamation about how that change could obviously never be done without a major redesign...

Unless you've actually worked with and modified (not just read) the actual code, I would always advise that caution. Sometimes I might even follow that advice myself [I have, I admit, been on both sides of this issue...].


With the risk of repeating the considerations mentioned by AlphaZuluRomeo, with my own closer perspective and words:
Be interested if you know whether or not there would be a change required for getting AOA into the FCPC around the ADIRU in the event of ADIRU going "failed".

We have the STALL condition being announced loudly
Stall warning.

at High Altitude Stall Approach, or Stall is to bring the ND, which implies the strong recommendation of NO Manual Trimming NU during such conditions!
And therein lies the dillema - warning vs actual conditions. Maybe I didn't expalin well.

If the 'bus flight control is in a mode where it is confident that stall condition is anywhere near, it will take action to prevent it (over and above trim limits). Normal law.

If it has lost confidence (e.g. airdata fail) about its condition but has indication that it might be stalling, it will warn the real pilots, but not take overriding action. The pilots can then use actual intelligence (of which the machine has none) to assess the warning and the condition of the a/c and take action. Worth looking at Perpignan report for another example of the difference (dual aoa failure, outlier aoa not trusted for protection but used for warning).

In this case, 447, the warning was actually right, and the pilots assessment fatally wrong.

Change it so the FCC will act and "protect" in the warning scenario based on known-bad data, then you might save 447. At the same time, you risk the warning being wrong (due to bad data), the pilot assessment and actions being correct, and the a/c "protecting" them into the ground...

I think the risks either way are going to be very very difficult to quantify which is why this is a tough call.
infrequentflyer789 is offline  
Old 17th Nov 2011, 00:14
  #320 (permalink)  
 
Join Date: Jan 2005
Location: W of 30W
Posts: 1,916
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by DozyWannabe
And yet on the A320 sim I did. Have you tried talking to the sim engineers about that one?
Your A320 sim didn't trim up under STALL WRN, and yet my A330 sim did ... as also AF447.

Thus far there have been no emergency fixes released for the A330 in terms of hardware or software, but there has been a new stall recovery procedure which instructs use of the sidestick to push the nose down. This suggests to me that Airbus and the BEA got positive autotrim response when they tried it on their A330 sim.
And we have Jacques Rosay, Airbus VP Chief Test Pilot, who states :
In certain cases, an action in the same direction on the longitudinal trim may be needed.
CONF iture is offline  

Thread Tools
Search this Thread

Contact Us - Archive - Advertising - Cookie Policy - Privacy Statement - Terms of Service

Copyright © 2024 MH Sub I, LLC dba Internet Brands. All rights reserved. Use of this site indicates your consent to the Terms of Use.