hetfield

One reason the A310 finally made it was banking to the left at top of climb.

Is roll command on A330 in ALTN2 the same as in NORMAL law (roll rate command)?

Thx

mm43

If you haven't already done so, take a look at this post by sadpole in the other thread. Some insight into what the Human Factors Group probably missed.

infrequentflyer789

Sometimes those in conflict are both right...

I think / recall that the a/p-off latch depends on precisely which law the a/c gets into. That depends on how many ADRs fail and for how long and maybe in which order. That in turn depends on which pitots ice up, how badly, and maybe in which order - which will vary.

I recall that there has been at least one case where a/p was re-engaged soon after UAS and did the wrong thing due to speeds being in agreement but still erroneous.

The line in the procedure looks like it is to ensure that ap/fd are off (they might have dropped out but maybe not). I think there has been additional guidance (that's come up on these threads) about not re-engaging them too quickly (ensure speed info is back to normal first).

jcjeant

Hi,

Interesting EASA publication:
http://ad.easa.europa.eu/blob/easa_a...AD_2010-0271_1
So .. in 2010 .. they put emphasis on the FD ... (after the AF447 case)

syseng68k

henra, #259

The idea of combining > 1 independent, limited reliability
sources to improve overall performance is not new. For example,
GPS / inertial mixing has been in use for some time. A brief
description may help to illustrate why this is a good idea,
with of course apologies for those who know all this already.

An ins system (IRU in airbus speak) works by dead reckoning
and is subject to drift over time. By dead reckoning, I mean
calculated from the point of origin, or start position. The
accumulated position error could be as much as several
nautical miles per hour, though current state of the art may
be much better than this. GPS doesn't work by dead reckoning,
but by direct measurement of absolute position and has far
greater accuracy, to within a few feet over much of the earths
surface. However gps can suffer from signal dropout and loss of
accuracy in some regions and is susceptable to jamming.

With the gps / inertial mixing scheme, some very smart software
augments the ins data with that of the gps to provide better
long term accuracy, redundancy and improved error detection.
For example, if the margin between the ins and gps data exceeds
a given threshold for a number of samples, one or other can be
tagged as a degraded source, while still providing good data
over the short term. That is, we now have a holdover capability
in the event of a temporary fault from either source.

By now, you can probably see where i'm taking this in terms of
a baro / inertial mixing scheme. Ins data could be used to
augment and cross check air data information. From what i've read,
the current systems are independent and any results of cross checking
between the ins and air data speeds (baro) are not presented to the
flight deck. The problem of using ins data to correlate air speed
is that the ins measures ground speed. However, at any given point
in time, there is a historical timeline and ongoing relationship
between the two. This could be used in the short term to provide
an indication of air speed in the event of a temporary pitot tube
failure. If one assumes that the wind speed remains fairly constant
short term, such a baro inertial mixing scheme could be a valid
solution to the loss of air speed data, upon which so many other
subsystems depend.

There other ways to measure air speed, such as the airbus developed
laser measuring system and which is, iirc, available as an option
on the A380. Hopefully, it will become mandatory at some stage.

Feel free to hack at all this if you like :-)...

BOAC

- I see repeated reference all over PPrune to this being the 'correct action'. Was this in fact so, i.e.a QRH item before 447?

jcjeant

Some clues page 98 periodic training check (unfortunately in french) in report N°2
http://www.bea.aero/docspa/2009/f-cp...90601e2.en.pdf

DozyWannabe

The UAS duration was not sufficient to latch Alternate 2 in that case. While it's true that it was possible to re-engage AP in that scenario, the re-engagement had to be manual. The AP will not re-engage itself automatically in any scenario, and because Alt2 was triggered and latched in the case of AF447 even a manual attempt to re-engage AP would have been denied.

Because of the digital nature of the equipment, the AP switch is not a type where AP status can be determined by switch position - AP status is determined by the presence of the Autopilot button light on the FCU and the PFD status instead.

Would need confirmation on the QRH, but "Flight Director : OFF" was definitely a step in the UAS procedure published by Airbus and disseminated to the airlines prior to AF447.

Machinbird

Good spot MM-43. I particularly liked his third point. What self-respecting pilot thinks autopilot time should be counted the same as actual handling time? You do learn Navigate and Communicate stuff and you do manage the systems, but are you really keeping the Aviate stuff up to speed?

Probably won't happen unless the regulators wake up. Too many sacred cows.

Turbine D

BOAC, jcjeant, Dozy & Infrequentflyer789,

I am thinking that perhaps (maybe) the AD 2010-2071 resulted from the TAM incident (perhaps others?). In the TAM incident the NTSB investigated and noted:
In this instance TAM never got to the Alternate 2 state where the AP couldn't be re-engaged (latched) as Dozy pointed out, but nevertheless, felt emphasis was required on not re-engaging the AP so quickly.
Just a thought....

DozyWannabe

@TD - Good catch. I think it was recognised as a general industry-wide issue before then though - I'm thinking in particular of the Flash Airlines 737 where the Captain repeatedly called for re-engagement of autopilot as he unwittingly manually took it outside of the envelope.

FWIW, while some of what sadpole said is true, some of the prejudice he showed in that post really rubbed me up the wrong way.

BOAC

- is really in another arena. What I am trying to establish is whether the UAS QRH action PROMULGATED BY AF at the time of 447 was as described.

DozyWannabe

Apparently so [Page 2]:

http://www.bea.aero/docspa/2009/f-cp...nexe.06.en.pdf

There was some debate over the "safe conduct" clause preceding it, but nevertheless, the first two memory items are AP/FD and A/THR to "OFF".

A33Zab

@HN39:

Accuracy of the vane sensor = +/- 0.3° at 100kts.


---

About the FMGEC voting logics:

The FMGEC uses different logic to compare the inputparameters.
The logics used are by voting, passivating or two by two comparision and/or a combination of those.

For the airspeed (considered as slow changing parameter) the two by two comparision is made on the (ADR) monitoring side of all 3 sources (ADR OWN, O3 and ADR OPP-osite), the result of this is passivated to the command side which only receives parameters of ADR OWN and ADR #3.
(the command parameters are following the selection of the ADR source selector however will revert to the good source if the selected source is considered not to be good, as it was in AF447 between 02:10:46 and ~02:11:07.

Already said before it is rather complicated, one parameter may pass the logic while an other parameter could 'reject' the ADR as being unreliable.

The two by two comparision example:

BOAC

Thanks, DW - my French was not up to the other link! I think it is fair to say, however, that the AD is much clearer in both layout and explanation. As you say, the 'Safe conduct' bit could well have caused problems, in particular if the 447 crew did not, for some reason, feel it was relevant, and they never got to the 'level off' bit where the FD OFF was heavily emphasised..

infrequentflyer789

There's your one teeny weeny problem right there. Wind speed might usually be fairly constant short term, but then pitots (properly heated) don't usually ice up either. Pitot icing is often in the vicinity of thunderstorms, and rapid changes in wind speed can be found... guess where.

In short, I think your scheme still has the common mode failure that the 3 redundant pitots have - the same external conditions may mess up the pitots and your inertial backup.

Additionally, you've now added another failure mode - if the pitot airspeeds vary wildly (but accurately) due to rapid air mass changes, is your inertial mixing going to vote out the correct data ?

Lyman

Do not forget that for three years on, the topic has been discussed ad nauseum; in that focus is lost the emergent conditions 447 experienced 2:10:04.6 instant. Safe conduct of the flight is the underlying parameter of any pilot; they do not need to begin differentiating and splitting hairs
the instant Speeds are lost. That is the emergency, and I defy any one here to state they would be available instantly to gauge coldly if the flight became endangered with the unexpected loss of a/p.

Assume one of sadpole's aces were flying? Does he coolly hold steady, to assess, knowing the flight is not in jeopardy? He does nothing with the stick as the airplane bounces and descends, rolls? Or does he make inputs to correct? The airplane was left maneuvering at a/p drop, and the initial corrections applied were correct. So the correct action has placed the handling pilot in harm's way: He is handling, and the response is not being assessed correctly by the ASI, his one true ally has quit. His reactions to the first eleven seconds are in the record, and it is these inputs that set the stage for disaster. the accident was born in these first eleven seconds, the cart had been upset. There is no going back, the crew was committed, by virtue of the unexpected change in instrumentation. With PNF's remonstrations to "go back down", we see the possibility for salvation. The PF rejected this verbiage, his instruments had just revolted, does he trust the second in command? Or does he buy time by placating him, and continuing his incorrect path? We know the answer.

The materials used to date the manuals must be examined closely, some of the dates and alterations are in disagreement, and some were "updated" without notation. I would direct anyone's attention also to a photograph in the final report, showing "Arm 36G" in the Rudder. It is completely different from the one supplied by BEA initially, the one that began the discussion of the Arm attachment discrepancies in the image with the text of their analysis. Closely inspect this photograph, please.

Dozy, are you sure the Stick shaker/pusher has been abandoned in favor of FBW? 50's technology? The 330 cannot fly with the best Stall Warn available? The Warn that trumps even the speed/AoA aural that was dismissed/ignore by the crew?

And the finest Stall recovery tool, the Pusher? Are you saying that Airbus will improve the aural qualities of its SW, and that will be sufficient?

So again, would 447 have benefitted from the Shaker/Pusher? I say yes, and I would question your position that she would not have possibly even entered the Stall with this equipment?

I would admit that furnishing the Shaker to a side stick might be problematic, and the Pusher to an electronic controls system as well.

DozyWannabe

@BOAC

This is pure speculation, but sadly it seems just as likely that the startle response was so complete that any thoughts of procedure never even got a look-in.

By saying this, I am absolutely not denigrating the unfortunate crew - as I said in the other thread, even the best have bad days.

It could be argued that in those weather conditions, at that time of night, any deviation from normal operation has the potential to endanger the flight!

A pull to 15 degrees nose-up is certainly *not* correct, no matter which way you slice it.

History has shown that even with a stick shaker, crews can and will disregard a stall warning if it does not fit their mental model of how the flight is proceeding.

Aural *and* visual - it can't do any worse than the shaker and pusher have done historically.

The stick pusher is not the "finest" anything - it was a product of its time. If you read HTBJ you'll find anecdotes from DP Davies about how many contemporary line pilots hated the thing and didn't trust it. Whether that enmity was justified or not, the fact is that stick pushers were only ever compulsory on G-registered aircraft of a certain vintage.

It can be argued that the pusher was really only necessary on T-tail aircraft, as the conventional empennage layout is not susceptible to the "deep stall" condition - and in fact aeronautical engineers design airframes to develop a nose-down tendency at the stall without requiring control input. The A330 is no exception - in this case the natural tendency was defeated by the PF who held the primary flight controls in a nose-up position for the majority of the sequence.

Modern aircraft with yoke controls retain the shaker (which can be - and has been - ignored with fatal results), but the pusher has moved into history across the industry. The FBW designs from both major manufacturers, rather than providing automatic stall recovery, instead try to prevent the aircraft from approaching stall in the first place, whether via hard protections in the case of Airbus, or by increasing opposing yoke force in the case of Boeing - and as I said above, the aircraft are designed to naturally nose-down at the stall. Sadly, no amount of design can prevent human interaction from defeating the failsafes.

HazelNuts39

Thanks, A33Zab.

Let's assume that the accuracy varies as the inverse of dynamic pressure, then it would be +/- 0.8 at 60 kts, and +/- 3.3 at 30 kts. Perhaps the stall warning computer could take those tolerances into account?

It may also be possible with the data from wind tunnel tests and AF447 to expand the airspeed indicating PEC (pressure error correction) table to higher AoA's, to reduce the IAS error at high AoA.

dClbydalpha

I agree with the sentiment but not the fact. It would be very easy to design a system that totally ignores the human. However conventional wisdom dictates that this should not be the case. The human must have the final say, that is what the regulations say, and so there will always be scope for human error as well as system failure. All these designs have been through massive amounts of scrutiny against these aims.

But to get this to work then the two systems must be 100% correctly characterised otherwise the potential for one to mislead both is always one step away. In fact a modern airliner has systems that can perform a sense - effect loop many 100 times faster and more accurately than a human whilst the human can take decisions that without some very exotic AI the computers can't get close to. Unfortunately the interaction of the two is never perfect and that is what system designers strive for. In this instance I'm not sure the combination of sensors would have made any difference. With the loss of all primary air data, the system would still have to hand control back to the human. The airworthiness authorities basically demand it. In reference to the example, how many combined GPS/Inertial sensors are certified by a civil air authority for navigation?

Please tell me how. Can a purely laser based system provide a calibrated airspeed? From what I understand, it can tell you how fast the air is moving, but at 37,000ft that is pretty meaningless to the aerodynamics, how does it sense the air density?

Placement of the pitot tubes is determined by the need to achieve the most consistent and correct airspeed. The separation is sufficient to ensure they are independent from the point of view physical damage. However icing is and always has been a problem. That is why they have heaters in them. But it is possible for nature to throw something at you that is beyond that capability. No matter how you separate them they will always be subject to icing.

To me there are many lessons to be learnt. Perhaps in the event of unreliable airspeed the AoA indication should become more prominent. Perhaps the stall warner inhibition should only be below a certain radio altitude. Perhaps, perhaps, perhaps. There are perhaps 100s of improvements that can be made, but each one must be considered and the impact on all phases of flight and all types of operation must be analysed before implementing them. I can't subscribe to the idea that the current design is somehow "incomprehensible" or "technically flawed" it is fairly standard from what I see, and follows well established principles. We shouldn't look at one small sub-set of operation and criticise it in isolation, or try to correct it without considering the effect on the whole system. In my opinion, the overall system failed catastrophically because of poor interaction and breakdown of communication between the aircraft and the pilot, the causes need to be established and corrected without introducing more dangerous failure modes.