A330/A340 EAD (AoA PROBES)

[DozyWannabe]

Originally Posted by jcjeant

You have two probes .. three probes .. certified or modified (and certified again) .. when they will find it in the right environment (air freezing or ice particles) the greater the chance that they will all be put out of function
So .. 2 probes .. double failure ... 3 probes .. triple failure ....

It's a question of systems safety. The aircraft were originally certified with the Goodrich pitot tubes fitted - there has never been a triple failure with this setup. The Thales option was introduced later and was certified independently - maybe someone can confirm whether this did or did not involve being certified in situ as opposed to just in the lab.

Nevertheless, there turned out to be something inherent in the Thales AA design that made it more susceptible to precipitation blockage than the default Goodrich fit.

A question was asked regarding why these problems seem to be confined to a time period a decade or so after the introduction of the A320 and her sisters - I'm just supplying one potential reason as I've understood things.

[Lyman]

Bonjour jcj...

As I see it. The Thales were a serious problem, hence the AD. Air France was slow rolling the AD, and Thales killed AF 447.

A single Titanium piece killed Concorde, end of story.

But AF slow-rolling compliance with a direct order? The single cause of AF447?


Mais NON..... All of a sudden it's the airplane, the pilots, the weather, the.....

I get it....

[DozyWannabe]

As yet there have been no criminal or civil proceedings regarding AF447, and thus no attempt to distill the contents of the BEA report (which covers all the potential causes including the Thales AA pitot tubes) into a legal narrative. The BEA report into AF4590 was similarly exhaustive - it was the *legal actions and not the report* which isolated the titanium strip as the major causal factor.

Coincidentally, aside from a premature but arguably understandable engine fire drill action, the crew of AF4590 performed in a logical, consistent and understandable manner once the flight became abnormal, despite facing what was later determined to be an unsalvageable situation. The PF of AF447 was faced with a relatively minor systems failure and, for whatever reason, performed in a manner which was contrary not only to established procedure but also to basic airmanship (pulling up consistently and repeatedly in the face of AP disconnect followed by stall warning) and his colleagues failed to check his actions or communicate amongst themselves effectively.

This is why crew action is considered to be a more prominent factor in AF447 than it was with AF4590. That said, and repeating for clarification, the problems with the Thales AA pitot tubes are listed as a contributing factor to the accident in the BEA report.

[jcjeant]

That said, and repeating for clarification, the problems with the Thales AA pitot tubes are listed as a contributing factor to the accident in the BEA report.

I think they have a role more than contributing in the accident
In fact they are the trigger of the accident
If the probes were not blocked .. the accident not have occurred .. Bonin and other pilots of AF447 would have continued a quiet career at Air France .. . and the passengers will be there to celebrate the new year 2013

[captplaystation]

Sad to say, ain't that the truth . . . . . . whilst most of us are overwhelmed with incomprehension as to how these guys stalled in the cruise, and remained stalled all the way to the sea. . . it is incumbent upon us to be humble enough to acknowledge that maybe, just maybe, we could've screwed up in exactly the same way.

[Turbine D]

Dozy,
Your quote:

Jet airliners have had problems arising from blocked pitot tubes since at least the early '70s and probably earlier (they were central to the Stony Brook NWA 727 disaster, as well as Birgenair 301's B757).

I believe the subject is about Airbus 330/340 sensors and probes that apparently inadvertently fail due to ice/water accumulation or ice blockage at high altitudes. The examples you cite are failures caused by mistakes: Birgenair 301 - B-757 sphecid wasp pitot tube blockage on the ground - Stony Brook NWA B-727 - pilots forgot to activate pitot tube heaters. Hopefully these were not subtle digs at B, but if so, you forgot one: Aeroperu 603 B-757 - static ports blocked by tape that wasn't removed before T/O.
So back to the real thread topic:

Chris Scott Quote:

Reviewing the big picture, it does seem strange that Airbus aircraft have latterly been experiencing so many problems resulting from icing of pitot probes, and now AoA probes. After all, these aeroplanes are operating in a similar environment to other types, and (presumably) jet airliners generally since even I was wearing short trousers.
But I flew the A320 for the first 14 years of its operation, and probe icing didn't seem to be an issue. Were we simply living in blissful ignorance?

and,
Lyman Quote:

The alternative is to look elsewhere. I take note of Captain Scott's troublefree experience in the gen one 320. I have a friend who flew the 320 for ten years, nary a belch or hiccup. What is new that hasn't to do with sensors and heating?

It is my opinion, what Chris and Lyman mention is where the probe and sensor problem rests. The commonality shared with the A330/A-340 is the fuselage that it is different compared to the A-320. If one recalls the aftermath of the AF447 incident, the European certification authorities proposed an update to the pitot probe certification requirements. They asked for comments from manufacturers and users for their proposed requirements. Airbus responded by basically saying the proposed certification standards were not stringent enough and did not reflect what was being experienced relative to high altitude icing conditions. They cited various reasons for this, volume of ice, size of ice crystals, etc. Then curiously they mentioned something important in my mind. The location of the sensor or probe relative to the aerodynamics of the area surrounding these devises was important and was not being considered as part of the certification process. Could it be that the location selected for the probes and sensors on the A-330/A-340 be such that it is more sensitive to ice crystals or water being directed into these devises verses the unshared A-320 fuselage shape or other aircraft where the location may not be as sensitive? Did Thales get a raw deal and bad publicity because their probes happened to be slightly more sensitive than Goodrich probes, both meeting the certification requirements in force at the time because of this? Was the change in the AoA sensor base plate an attempt to fix problems without the need to relocate the sensor location? I am not an aerodynamic or a probe/sensor expert, but as an engineer, I wonder about the relationships here. While it is implied the A-320 has not had the experiences of the A-330/A-340, I wonder what the experiences of Boeing aircraft and pilots has been relative to icing of pitot tubes. Also, the original bill of materials for pitot tubes on the A-330 (perhaps the A-340 as well) were Goodrich pitot tubes, replaced by Thales which were believed better at the time.

[Microburst2002]

Dozy

Who knows what the ELAC will command if suddenly it finds its AoA to be well above alpha prot? The system is designed to avoid excursions into high AoAs, but if the AoA happens to be too high without he system being able to avoid it, because it is just a fake input, the system will not question how is that possible. It will just pitch down to regain alpha prot. But if the AoA remains fixed (because of the faulty probe) then it will keep pitching down, at eitherhigh or low mach number until it reaches alpha prot, which will not occur because it is corrupted. The ELAC is silly and will do its job as designed, believing it is in a stall.

In my opinion the system will command constant pitch down, and while in normal law, pilots cannot override it. I don't know, however, the intensity of that pitching down input.

[heavy.airbourne]

I don't know, however, the intensity of that pitching down input.

...until crash - see XL.

[Chris Scott]

Dozy,
Thanks for the useful gen on the Thales probes, and the conic plate mods.

Inconveniently, neither of the accidents you mention were caused by icing of a heated pitot probe, as Lyman and Turbine_D have pointed out.

LIke them, I wonder if the location of the probes needs to be reviewed, and if the slimmer nose of the A320 may be a factor. Also, I sometimes used to ponder, during my walkrounds, on the pros and cons of locating Pitots 1 & 2 at precisely symmetrically-opposite positions on the fuselage (Pitot 3 being the odd one out). Then I would remind myself that the same applied to the AoA probes. It seemed to me that this might be a recipe for (roughly) simultaneous ice accretion of numbers 1 & 2.

Can anyone cite an accident prior to AF447 that was related to the icing of a properly-heated pitot probe or AoA probe? Right now, I can't think of one, nor of a type that regularly experienced UAS problems in any flight-phase.

Happy New Year everyone and, for those who practise, safe landings!

[DozyWannabe]

Originally Posted by heavy.airbourne

...until crash - see XL.

I'm pretty sure the XL (Perpignan) A320 went into Direct Law before it crashed.

Originally Posted by Chris Scott

]Inconveniently, neither of the accidents you mention were caused by icing of a heated pitot probe, as Lyman and Turbine_D have pointed out.

As I said, I wasn't making a direct comparison in terms of the scenario, I was simply enumerating incidents and accidents with blocked pitot probes as a central factor.

LIke them, I wonder if the location of the probes needs to be reviewed, and if the slimmer nose of the A320 may be a factor.
...
It seemed to me that this might be a recipe for (roughly) simultaneous ice accretion of numbers 1 & 2.

Possibly - but nevertheless I don't believe there has been a UAS incident on an A330 or A340 recently - specifically since the Thales model pitot probes were phased out.

[jcjeant]

There is still an important issue about the accident and it is to Airbus to respond
How is that Airbus have not been able to predict what would happen at the level of flight automation when the AOA probes are blocked by icing or other phenomenon?
That is blocking AOA probes has never been considered .. or tested ?
This test would have shown the consequences on the flight automation .. and so be able to provide a procedure before any accident ....
In the EVA Air case .. that's the pilots who have tested ... and found a procedure ..
Weird ..

[Lyman]

jcjeant

That is the issue, not dissembling and lame attempts to minimize rhe hazard.

AB have built an a/c that is virtually completely dependent on processed data, the exclusion of mitigating procedures, or even a plan to anticipate failure.

The recent workaraound for disabled AoA vanes was ad hoc

It became policy only after it succeeded. That is called Flight Test.

Disabling the AirData system by switching off ADRs qualifies as an UAS event.

I have no patience with anyone who tries to smooth over a genuine risk.

Especially if it is transparently partisan to the airframer, rather than objective discussion.

My bias is safety in aviation. Let the feelings and sensibilities pound sand.

[RR_NDB]

Scare design(s)? (A good design must operate adequately with failing parts)

Hi,

During the rich discussions in AF447 threads i emphasized the essential characteristics of a good design: Fault Tolerance and Graceful Degradation.

FBW opened the possibility to introduce new features like Protections. We may view that as "sophisticated interlocks" designed to help, to protect.

In AF447 case we found engineering problems like lack of redundancy, Garbage In Garbage Out (GIGO) contamination and in some posts i commented on the perception of "accelerated degradation". Actually made an analogy to the "threshold effect" of FM radio reception (below a given threshold degrades abruptly) compared to AM radio.

My point here is:

Airbus SAS is leading the industry with it´s advanced automated design. Is the design adequately capable to cope with existing sensors limitations that for whatever reason are not providing sometimes reliable data to the System?

It´s reasonable to delegate to PF (and subsequently to PM) complex scenarios that even for a designer could be very difficult to understand timely?

IMHO the basic characteristics of a good design may be under threat with the paraphernalia of features introduced with the argument of easier operation, etc.

Multiple unreliable sensors (simultaneous in F-GZCP) are sometimes promoting "accelerated degradation" of the A/C (System+crew)?

This is being adequately tested? Safety is under an special kind of threat? A more complex one?

[RR_NDB]

Unreliable probes

Hi,

jcjeant:

I think they have a role more than contributing in the accident
In fact they are the trigger of the accident

A trigger with involvement of Design, Authorities and Operator (carrier).

That put a complex scenario in the hands of a crew simply not capable to deal with.

Just training is enough? Even a designer could no be able to timely solve some similar (or more complex) issues.

captplaystation:

Sad to say, ain't that the truth . . . . . . whilst most of us are overwhelmed with incomprehension as to how these guys stalled in the cruise, and remained stalled all the way to the sea. . . it is incumbent upon us to be humble enough to acknowledge that maybe, just maybe, we could've screwed up in exactly the same way.

[RR_NDB]

HF in processing abnormal situations

Hi,

Reading again on Thiels NWA 722 (Stony Point) in that bad day for 727´s (TWA Flight 514) we can remember how difficult can be the diagnosis of certain failures. A simple interface was capable to mislead the Flight 6231 crew probably creating to them a "high speed mental model".

A complex System under multiple failures (bad data, etc.) processing this garbage and presenting it could easily transform a simple and brief failure into an unsolvable problem. This is due HF or a "scare design"?

Obviously HF would be present. But, IMHO this is an engineering problem.

We may say the simple 727 interface was not adequately redundant (lacking AoA, important when air data was unreliable).

But when you fed a complex System (with authority of "hard limits", protections, etc) with e.g. unreliable AoA probes, obsolete AS probes, etc.

[Turbine D]

Symmetrical Located Probes

Hi Lyman,

In regards to the symmetrical located AoA sensors, 1 & 2, if they simultaneously lock up then #3 (the odd man out) is disregarded by the system logic, correct? The same would be true of the pitot probes 1 & 2, again, correct? It seems to me there was a photo of the sensors and probes on the A330 in the AF447 thread that depicted their location near the nose and before the nose blending into the fuselage shape. But, on the A320, the AoA sensors, 1 & 2 are located much farther back, rearward of the forward doors.

If you recall the A320 Perpignan accident, the AoA sensors, 1 & 2 locked up simultaneously at high altitude at a cruise angle. However, the cause was the sensors not being covered during a high pressure water cleaning operation (a procedural error) and they took on water internally (bearing area) prior to the final detail painting step. The plane sat for three days prior to the test flight and during the flight they did simultaneously freeze at altitude unbeknownst to the pilots. The AoA sensors are not designed to be waterproof, neither the Goodrich or the Thales. The certification details are given in the BEA final report.

IMO, the location of the AoA symmetrically located sensors on the A320 would not be subject to as much pounding water as would the A330 AoA sensors because of their location. In other words, the problem with the AOA sensors on the A330/A340 may be associated with water intake based on location and the new conical added plate, not ice crystal formation at altitude.

[Lyman]

I think the probes discussion is very important. However the immediate problem is what the system will do with corrupt, but stable data.

Since we have evidences of problems that are superior to probe failure, i am hanging out on the other thread.....there are safety issues that supersede performance data?

I am at a loss how threads can for so long a time focus on the sizzle, not the steak. The EVA experienced a LOC. not a UAS, a loss of control

I agree the 320 appears to have the superior layout,

So my conclusion in the interim is, probe failures happen to all aircraft. Some are less capable in this regime than others.

That may not prove out, statistics for en masse and generalised reported failures are not available?

[flash2002]

Dozy wrote in post 67:

@CONF - I'm not in denial - the alpha protections follow pilot input up until the point safety boundaries are reached and will maintain that, in much the same manner as the T7 will progressively counter input through the force-feedback. Of course, as the Mach number increases, the pitch down will also increase, but it's not going to suddenly force the aircraft into a significant dive, in fact it won't descend at all if corrective action is taken.

Well dozy, you are wrong. Some information regarding the incident from my company:

In the recent event, all three probes became frozen and the aircraft erroneously detected an ‘incorrect angle of attack’ scenario which triggers Alpha Prot. As the AOA probes are frozen Alpha Floor will not be activated as the triggering AOA limit is not reached . As designed, the aircraft protection activated and a nose down input was introduced. Unfortunately, as the probes were frozen (and continually sensing the incorrect alpha), the AOA did not reduce and the flight controls continued to demand a pitch nose down. Within 10 seconds, the aircraft had achieved 12 degrees nose down pitch and a rate of descent of 9400 fpm.
Aft sidestick input had no effect and the aircraft continued to pitch nose down.

Turns out it WILL put the aircraft in a sudden and significant dive that will only become worse. 10 seconds is about 1600ft at that rate, a dive!!!

Turning off 3 ADR's might have saved them but it could have made their day significantly worse:

Back Up Speed Scale (BUSS), which is fitted onto newer aircraft relies upon AoA inputs. It must not be used, so DO NOT switch off more than 2 ADR’s.

[flash2002]

Yeah sorry we crossed I missed your post while searching for dozy's and quoting it.

[Chris Scott]

Symmetric positioning of PROBES

I wrote this here a few days ago, and repeated it yesterday on the “How safe is (airbus) fly by wire? Airbus A330/340 and A320 family emergency AD” thread (on Tech Log):

“...sometimes used to ponder, during my walk-rounds, on the pros and cons of locating Pitots 1 & 2 at precisely symmetrically-opposite positions on the fuselage (Pitot 3 being the odd one out). Then I would remind myself that the same applied to the AoA probes. It seemed to me that this might be a recipe for (roughly) simultaneous ice accretion of numbers 1 & 2."

Later, in answer to Lyman, I wrote:

“I think we are looking at this from different perspectives. You make some interesting points, but you may have read too much into my simplistic observation. I well remember getting very seriously iced-up in strato-cumulus on an (empty) C-47 in my misspent youth. We ended up with ice about an inch thick over the whole of both unheated windshields, and - when that had later melted enough for us to see through a hole in same - there was a stalagmite-like horn sticking forward about 6 inches from the frame between the two. The ice seemed to have propagated gradually backwards along both sides of the nose (I don’t recall noticing any ASI problems). When we eventually landed, there was still a circular area of glaze ice about 3 ft in diameter below the centre of the nose.

“Now the characteristics of ice in strato-cumulus at an IAS of 120kts and TAT of just below freezing may be very different from those in cirrus or Cb at, say, IAS 280kts and TAT MS30C. And I don’t know how much research has been done into how much accretion there is on the nose in the latter circumstances. Although the heated windshields usually remain fairly clear (in my experience), except in heavy precipitation, you can see very little of the fuselage skin from the cockpit. It may be that the heated pitots and, usually further back, the AoA vanes can ice up before the unheated nose skin. But I doubt it.

“When I ask if it’s a good idea for numbers 1 and 2 in each case to be positioned exactly symmetrically on the left and right sides respectively, I’m assuming that aircraft are normally flown with zero sideslip. Therefore, if both installations are serviceable and identical, they are likely to accumulate any ice in unison (unless the sun is shining from the side). You say that turbulence is required, but I presume that would even out in zero sideslip?

“You suggest that the positioning of probes is arbitrary, which I doubt. But I’m sure you have noticed that the positions of numbers 1 and 2 mirror one another? And, when I ask about pre-AF447 accidents related to probes (heated as designed, and not damaged or blocked by any foreign object), I’m not limiting the question to Airbuses.”