chrisN

A question from a glider pilot, if you professionals would be kind enough to inform me:

In the A330/A340 incident, there was a sudden increase in what glider pilots call total energy - the sum of kinetic (speed) and potential energy (altitude). Presumably this was caused by windshear, or rising air (wave or whatever) caused by the nearby jetstream or front. In gliding, if the energy increase is not wanted, we counteract the increase by spilling it – with increased drag (e.g. airbrakes) or letting the speed bleed off gradually should circumstances permit.

It sounds as if they had only two quick choices, since power reduction would be slow – climb, or go into overspeed. Is that right? If climb is too dangerous leading to a level bust, can overspeed temporarily be tolerated? Or could drag be increased (airbrakes?)?

A33Zab

Bubbers:
Bloggs:
BOAC:
" or a B777/B787. "

BARKINGMAD

OH DEAR OH DEAR OH DEAR ! ! ! !

Now Mr Boeing has done down the zoom-climb route to solve a kinetic energy problem.

The inmates really are running the asylum and having the keys to the pharmacy as well they've gone on one helluva trip?!!

Gawd help us airframe drivers and the hapless SLF!

HazelNuts39

chrisN,

From another glider pilot, also an ex-professional though not as a pilot,

Yes, there was an overspeed condition that caused a warning an disconnection of the A/P. However, that overspeed condition was very brief and not really a problem. Shortly after that the airplane encountered a vertical gust that increased the AoA to alpha-prot and put the FCS in high-AoA protection mode which caused the zoom climb.

chrisN

HN39, Thanks.

DonH

Yes, agree, the Airbus UAS drill, as still published, can be confusing. However, numerous Airbus publications available on the web indicate how the UAS drill and QRH checklist were, and are to be handled and the FCTM notes do reflect this although they could be much clearer still.

Earlier in this thread I pointed out where in the original (now closed) threads that this discussion began taking place. However, if some comments here are an indication of the broader piloting community, then, without blaming anyone as to why this may be so, there remains a great deal of misunderstanding on when and how to apply the memorized drill and when not to and instead proceed directly to the QRH checklist items. In fact, the memorized drill and the checklist are NOT sequential, they are an "if/then" decision point.

First, when loss of airspeed information occurrs, the qualifying condition, "If the safe conduct the flight is affected" is not clearly defined in the drill-checklist, nor is it defined in the Boeing checklist, (there are no memorized items or initial pitch-thrust memorized combinations in the B767/B777 UAS responses). The drill-checklist is not a sequential drill - rather, the "safe conduct of the flight affected" is a primary "if-then" decision point in the UAS response - the safety of the flight IS affected at takeoff, initial climb or descent/approach/landing.

Loss of airspeed information at cruise altitude is not an emergency and because the airplane is, for all intents, stable in pitch and power, then "nothing" needs to be done (except keep the airplane stable), because the safe conduct of the flight is not affected, (in comparison to the takeoff/landing case). The crew, (PF) assumes control of the airplane to maintain aircraft stability by maintaining thrust and pitch at current settings, (Aviate), maintains/alters heading as required, (Navigate) and calls for the ECAM actions, (Communicate), to be done followed by getting out the QRH Checklist to set pitch and power for the remainder of the cruise.

The graphic below illustrates this and I think this is the source of much of the confusion:



The "Pitch/Thrust settings for initial level off" are just below this point in the drill. The balance of the QRH provides pitch and thrust settings for varying weights in cruise, descent, approach, landing and go-around. However, in all cases of a UAS event in cruise, airspeed indications returned within about one minute, including AF447's airspeed indications, but the stall had been entered by that time.
Yes. This is the way the drill & checklist were always intended to be done. Airbus stated as much in its December, 2007 "Safety First" magazine (pg 14): in the oft-quoted-in-original-threads Joelle Barthes article entitled, "Unreliable Speed":
followed by the a graphic, describing what is intended by the above:



- Safety First magazine, December, 2007, Joella Barthes

In fact, in an Airbus presentation in September 2006, it is clearly stated that what constitutes "safe conduct affected" is defined in training:


Airbus OLM FBW 2006, (Unreliable Speed) - Toulouse - 23-28 September 2006

In my opinion and from what I have researched for a long time now, the UAS response is NOT a sequential drill-checklist - never was.

What is confusing about this is not entirely nor necessarily the Airbus UAS drill and checklist. The large black dot is a decision-point, not a "start here and follow all items" point. Buy down below, the "Level Off..." action item has the same black dot, making the drill-checklist appear "sequential". It is not.

A large part of the problem is knowing the way checklists are written in terms of these "decision points" and the meaning of correct indentations, (which this drill-checklist appears to not have). The decision point regarding safe-conduct-of-the-flight-affected permits/requires that the crew either execute the memorized items OR, (in cruise for example), they do the QRH checklist after stabilizing the aircraft in level flight.

This has all been reviewed and discussed in the original threads (part of which has been pointed out but, I assume, not viewed or referenced by some in the present thread.

DonH

Hi BOAC;
No worries BOAC - I think we're all clapping in unison!

Yes, agree with you entirely - this goes to the "giving in to automation / not understanding one's airplane / maintaining situational awareness" discussion though. Solutions, offered in the AAIB Report, suggest that among a few, offsets may be routinely considered. Here's one reason why - he's 2000ft above. And I've been hit by wake turbulence from a B744 1000ft above, opposite direction as we passed right under him - very sharp, 20deg roll, then nothing.

bubbers44

Thanks DonH, that was what I trying to tell him but not as clearly as you put it. I'm not going to bring the subject up with him again because I will just be the idiot again.

DonH

Hi Bubbers;
, Yes, probably best to let it be. There will always be, 'yeah, but's...'

These are Airbus' own documents, available on the web - I just did a lot of research over time because I remember being confused about the drill myself when doing the initial training from Boeing to Airbus equipment.

And, I like to keep the tech topic on topic!

BOAC

DonH - "And, I like to keep the tech topic on topic! " - agreed, but unfortunately 447 opens a large can of worms. Whether the 'automatics' brigade like it or not, some of the programmed features of the AB system contributed to both 447 and the 330/340 events. Note I say 'contributed to' and not 'caused'. Autotrim and the 'software' decision to abandon the stall warning did not help 447 or the 330/340 - why? These features are good features and have useful functions in many situations BUT they can cause problems where they should not, and the training is inadequate in 'teaching' crews to defer to the automatics. There were, after all, two hopefully sentient beings in the cockpit who could have decided how to handle an overspeed without having HAL do it for them. Now apparently Boeing are going the same way (with overspeed) - again why?

On the topic of the UAS checklist, we have unfortunately 'lost' the on-going most valuable inputs from PJ2 due to bizarre modding, but it is well worth searching his posts on the topic on the 447 threads. Again, in both 'events', we have crews without the 'big picture' and mesmerised like the proverbial rabbit by the systems.

I have, along with others, for a long time advocated a major change in training for the 'glass/auto' environment. BA recognised it years ago (late 20th century) with their short 'don't get mesmerised' ('EOI') course. The increasing lack of real experience in cockpits plus the over reliance on highly seductive systems is taking us down a clearly defined one-way street. There are some side street exits, but we are running out of them.

vilas

DonH
I have the documents you have quoted and I am in agreement. However the real problem was I think UAS was not considered seriously as a possibilty as let's say an engine failure. During type rating it is conducted only as a DEMO in after takeoff scenario. I am not sure if it is ever practiced threafter. It is not in regulatory tick boxes. Recognition of UAS can be quite confusing and if you are confused or ignorant of the procedure then anything can happen. Even 757 has crashed before.

john_tullamarine

During type rating it is conducted only as a DEMO in after takeoff scenario

I'm a tad out of touch with the training game these days but some of us used to make it a private requirement using spare time during an endorsement to ensure that pilots could handle several of the unlikely but very high risk scenarios.

For me and several of my colleagues in a previous life that included a total (or as close as we could make it in the particular sim) loss of pressure readouts - low vis takeoff with a single pilot no help recovery via an ILS to minimums.

It goes without saying that included no FMS, FD, etc. Realish sim flying.

Allowed us to sleep well at night.

gums

Gotta go with BOAC.

I also wonder how AoA protection laws could have caused a climb as 'nuts suggests.

The various factors resulting in the crash are all worthy of discussion and some "learning", IMHO. CRM, flight control laws, aircraft performance, instrument/sensor failures, basic piloting skills, and the beat goes on.

I can tell you that 34 years ago we all learned a lot that wasn't in the "books" and had not been exposed to us in the sim ( we didn't have a sim for 3 years after becoming operational, heh heh). Our control laws were primitive compared to the 'bus, mainly due to only two autopilot modes that worked with the FLCS. And of course, our operational requirements demanded flying to the limits, personal and aircraft. Nevertheless, we all learned a lot and we passed on lessons to the next generation and the one after that. Now, I am here trying to contribute something for you heavy dudes to think about. And you must realize that CRM is foreign to me. Only crewed jet I flew only had one set of controls and the guy in the back seat was a "systems operator".

Desert185

Don't discount the fact that the autopilot is still available with a loss of IAS. There is a selected Pitch Damp mode that the pilot can select to maintain attitude if desired. Options are nice.

I maintain that if AF447 were flying an aircraft with an operable autopilot during a loss of IAS, the airplane would still be flying today and all the folks would be alive. Another nice option.

The question of why such a sophisticated airplane could trip the autopilot with a loss of IAS and abandon the automation dependent crew has yet to be answered.

bubbers44

Or from the other side of looking at this how about we make the crews not automation dependent?

rudderrudderrat

Hi Gums,
I believe Alpha Floor was triggered (at a certain Alpha threshold). The thrust goes to TOGA power despite the TLs being somewhere else. With no side stick input, the aircraft will then maintain Alpha Prot angle of attack.

All that was required was a side stick input to maintain current FL and disengage Auto Thrust.

To protect against over speed, L1011 - 500 had RSB (recovery speed brake). Full speed brakes were automatically deployed and had to be manually stowed.
PFM.

Chris Scott

Quote from HN39:
Yes, there was an overspeed condition that caused a warning an disconnection of the A/P. However, that overspeed condition was very brief and not really a problem. Shortly after that the airplane encountered a vertical gust that increased the AoA to alpha-prot and put the FCS in high-AoA protection mode which caused the zoom climb.

Yes, and I've always been curious about the implementation (in pitch) of AoA Protection Law ("Alpha Prot"), which can only happen if the AP is off (caused here by the windshear-induced overspeed). Clearly it is advantageous to stop the AoA increasing unless the pilot commands such by "pulling" the sidestick (aft of neutral). The bit I don't understand is why the FBW is programmed to maintain Alpha Prot even if normal-G exceeds 1 (I'm referring to the situation at cruise speeds; not low speeds). To put it another way: on the face of it, it seems bizarre for the FBW to "grab" a transient, higher-than-normal AoA even if it results in more than 1G with a neutral sidestick (assuming wings level). No doubt there are good reasons for doing so - perhaps the likes of OwainGlyndwr may explain?

In this case, the AAIB and AI decided that a "phase advanced" value of AoA - caused by a vertical gust - triggered Alpha Prot Law (mode). "Phase advanced" means that the AoA was rising rapidly, and going into Alpha Prot Law was a pre-emptive move (as-per stall protection systems, including stick-shakers, on old a/c like the BAC 1-11 and VC10). Once the FBW system has engaged in Alpha Prot, the AoA presumably rises further to the stable value of Alpha Prot. If so, that would further exacerbate the situation in this particular scenario. Forward (down) sidestick is ncessary to restore Pitch-Normal Law. (Does anyone know how much?)

There is no message to inform the crew of the change of the Pitch Law (mode). In this case, attempts to re-engage the AP seem to have caused the delay in sidestick intervention by the PF.

BTW, in the AAIB's DFDR trace, the sidestick parameter seems to give negative values for "up" inputs, i.e., stick back.

The common factor this incident had with the much later AF447 accident is that of the unexpected transition from automatics to "manual": specifically from AP to FBW, in a pitch law other than Normal. In this AIRPROX case, the FBW system forced the a/c into an undesired zoom-climb which needed positive crew intervention to counter. In AF447, the FBW made no such input; the PF forcing the a/c into a zoom-climb by inappropriate sidestick inputs.

Chris Scott

Desert185,
Don't discount the fact that the autopilot is still available with a loss of IAS. There is a selected Pitch Damp mode that the pilot can select to maintain attitude if desired. Options are nice.

We had APs with pitch wheels a bit like that on the B707 and other types of the 1960s and 70s, used to select pitch in climb and descent, plus a "height" (ALT) lock. Not sure if the ALT lock tripped with loss of IAS - probably not. On Airbus FBW, tripping the AP is normally a non-event, because the FBW effectively holds the current attitude at least as well (initially).

bubbers44,

Are you saying the Tristar airbrakes do not retract themselves automatically after the aoverspeed? And does the lever move to reflect their extension?

DonH

BOAC;

Re, "Whether the 'automatics' brigade like it or not, some of the programmed features of the AB system contributed to both 447 and the 330/340 events. Note I say 'contributed to' and not 'caused'. "

In the sense that all complex systems are capable of inciting inappropriate interactions with users, yes, I agree with you BOAC. "What's it doing now?" isn't a state of mind limited to Airbus aircraft. And when one encounters such moments, one quietly and calmly disconnects everything (including thrust levers) and flies the raw airplane - and as has been observed, the Airbus, as does the Boeing, fly beautifully, manually from takeoff to cruise altitudes, descent & landing - one just has to know a bit about high altitude, high Mach number, swept-wing aerodynamics.

But given this, what do we do with the Tripoli A330 (and for that matter, the Gulfair A320) accidents? Both aircraft were perfectly serviceable. What kind of automation would be able to "decide" in time, that the pilot was suffering from somatogravic effects? If the assumption is that automation can be designed/created to serve any ends, then how do such solutions differ from the present "zoom climb" issue, (extremely rare though both "contributions" may make in a fatal accident)?

If I may be permitted to wander slightly, the "possibility-potential", (possibilistic thinking, according to Lee Clarke), is what facilitates this thinking. To me anyway, the difficulty for the designers and the engineers becomes making an assessment between two polar opposites - What's probable?, vice What's possible? The question goes beyond "excusing or blaming" - it's just trying to find out what the causal pathway (to which you referred) was; in the case of AF447 I think we have it.

It seems to me as a retired pilot, that in terms of the designer/engineer's work (speaking specifically of Airbus), we can only say that the approach was(is) sufficiently cognizant to consider and expect that an airline pilot would be trained against, and would avoid-like-the-plague, stalling his/her aircraft and would understand those circumstances which would lead to stall entry.

On the question of "NCD" and the cessation of the stall warning, such circumstances may be imagined as "possible", but (at the time) reasonably concluded as "improbable". We now have the one single outlier (in tens of millions of flight hours), that, we might say disproves the thinking, (and inadvertently led to confusion in circumstances so far from normal as to be beyond test-pilot territory), so now, what do do but find a way to keep the stall warning on at all times if the airplane is indeed stalled. I believe (but do not know) that this is more complex and difficult than those who may liken such "obvious" solutions as the C-150 or other mechanical devices, etc) to present day computer/software systems but no doubt it will be done and certified; I believe the B777 system behaves the same way, (not sure about the B787) - perhaps someone here can confirm either way?).

The present call by some for "more automation" is, to me, folly, however the perhaps-two-dozen stall accidents, most fatal, over the past dozen years or so means there is a trend and not just an anomaly.

The discussion of why and in what condition the airplane (B or A) is "handed back" to the crew precisely at the moment when they could use "automation" is a very complex question having to do with "decidability" in computing systems and has, I truly believe, been exhausted in the ten AF447 threads, (for those new to the discussion, you can use the AF447 Search Index tool and look up "Byzantine fault"!),

When a complex system like a transport aircraft is taken into areas beyond its operational limits, the risk and possibility of confusion, particularly if one does not know one's aircraft well, compounds and heightens, quietly at first, and rapidly if one has been building/maintaining only a "surface" situational awareness.

The other aspect is the continued operation of the THS while the stall warning was active. As we know well,, the THS reached about 12°NU by about FL350 on the way down after almost continuous nose-up stick inputs. (it should be noted that with continued ND stick inputs, the THS would have returned to its normal position of about 2° NU).

What is to be done in terms of "automation" design under such rare and inappropriate circumstances, that won't cause other, unimagined and perhaps more serious circumstances when someone else wanders well off the beaten track? How are such scenarios imagined and "protected" against? As others have observed, if/when changes highlighted by AF447 are installed and certified, the "automatics brigade" and the hand-bombers could still ask your question with equal reasonableness.

So, not disagreeing with you...just pondering where your (and others') comments on the two primary observations on this accident, (stall warning quits; THS continues to trim), do take us in terms of solutions.

BOAC

DonH - to try to answer your questions:

The stall warning 'quit' due to airspeed and not AoA reading, I believe? Simple solution - keep it functioning whatever the speed without WoW. Unless the AoA readings are 'borked' due to failure/icing/whatever, at least there will be a 'nudge' to the crew (did they really need it!!??) to see if alpha might be a touch on the silly side.

THS - moons ago on one of the interminable threads, I flippantly suggested a spring loaded boxing glove in the dash, but then offered a more serious proposition that 'we' derive a suitable boundary for 'reasonable' nose up THS (surely not difficult?) and then insist on a physical over-ride to exceed it - such as a 'cancel the limit' button.