AoA is key?
 

Is the Qantas parallel now more compelling than other theories?
Erroneous AoA values are fed to ADIRU(s) leading computer to mandate unwanted and dangerous flight control maneuver.The vulnerability of the computer's "voting" system when faced with conflicting air data was highlighted by the ATSB.Spike values and hysteresis(lag) confuse the computer and it may de-select a good ADR and respond to a faulty one.Autopilot ON or OFF,doesnt matter.

aguadalte - an even more confusing post! It has got gyros - it hasn't got gyros - it has got gyros.....

If I may divert momentarily, it is important here to differentiate between a gyroscope, which is a rate sensor, and a rate sensor (eg QRS or LRG), which is NOT a gyroscope. A gyroscope will maintain its attitude in a space frame and thus enable 'attitude' to be directly physically determined. A rate sensor, as in ISIS, can only offer displacement information FROM a known attitude, and requires a lot of software to produce the new 'attitude'. It lacks the vital 'rigidity' which the gyroscope has.

Back to 447 - I'm still not clear if we have an answer to what the software would have shut down or permitted in the way of information to the crew. Have we established BEYOND DOUBT that loss of pressure inputs to an ADIRU render that ADIRU unusable for attitude, either because it lacks some feed or because the system determines it to be 'unusable'? If the answer is yes, then we move on the the John Wayne scenario where the good captain is holding a torch in his clenched teeth and shining it on his only remaining attitude indicator. Does this definitely still function, or has HAL decided it too should be shut down because it has either faulty attitude inputs from the ADIRUs or faulty pressure inputs? I've been searching for info on the Qantas and Air Caribe 'upsets' to see what they 'lost' on the panel - anyone point me please?

Even with a better understanding of the systems, we are still basically in the dark as to what the software programmes are doing.

If breakup of the airframe did indeed occur, we really should be going BACK to how it got to that position in the first place, rather than discussing flat spins, VS failure modes etc. We need those recorders!

my mistake was their mistake?
 

Dear Colleagues,
I have committed here a HUGE error! And I would like to apologize for that.
In the above said statement I said ALL ADIRU's are switched OFF and I meant to say ALL ADR's! (post #1907, now corrected to prevent others to be misinformed).

I studied the system again and noticed my mistake.
This led me to think that it is a common mistake in recurrent flight simulator sessions, to see flight crews, switching off one system, when they're actually thinking on another. (That is why we have the "confirmation" philosophy of asking for PF to visually confirm PNF actions, before switching of guarded or important systems when handling an emergency procedure)
I wouldn't like to speculate on that, (for the sake and honor to our fellow death colleagues) but, it now poses a reasonable doubt to me and a reasonable explanation for their lost of control of the aircraft.

Till now, I was strongly convinced that the failure of all IR's were responsible for the crash. Now I have a stronger and stronger (seasick) sensation that Human Factor was.

I'm sorry for being (as far as I remember) the first one to bring this speculative "explanation" for this accident. I do know that accidents have multi-causes. But, what if, instead of switching off the ADR part of the ADIRUS, they have inadvertently switched off the ADIRUS (or the IR part of the ADIRU's), in response to a Unreliable Speed Indication Check-List?

We all know how disturbing is to fly in turbulence.
Was the junior FO seated on the left seat?
Would the ISIS still give them attitude indication?

h3dxb, thanks for the technical description - ISIS.
Can you establish what the purpose of the temperature sensors is, and if these are internal to ISIS or require an external temperature input.
Is there a difference / switching routine between a failed input – e.g. ADIRS off, ARINC 429, and a working bus (but with corrupt data) i.e. a triple sensor might vote out a system by comparison (IAS) – a 'failed' system, but a dual sensor might pass erroneous data (TAT).

SAFETYPEE

Gents:
there is no description for the temp sensors in any manual. It looks like its for health monitoring of the sensors.
as there is also no CAS or TAT indicated no need for a temp input. the IAS is taken direct from the standby system.

When a part of the ISIS failed than this partial function is inop (degraded) not the whole ISIS.

except Powerloss >200ms this instrument is working.

BOAC

The answer is NO. ADIRU= AD+IRU
Actually 2 boxes in one. The IRU part works seperately from the ADR Part. U can switch off the ADR part , but when U switch off the IRU, the box is switched off.

Once more ISIS is an Instrument which stands alone. And yes there is a lot of Software inside and ****ty expensive as well.

Have a good one, in 12 hrs I'm back on duty, and when it's a smooth day like today, I'll have time for yr questions :ok:

I notice that many posters tend to peel the onion way too deep in discussing how and why planes are designed to break apart.

The investigation is still wide open to a myriad of possible causes some remote and some more probable. As debris is found and analyized by the Airbus structural experts the probability increases or decreases for the various theories. But they will remain as theories (using up all kinds of thread pages in this forum) until/(unless the main wreckage on the bottom of the sea is found and photographed.

Thus most of the effort in examining the recovered pieces is to get clues as to where the big stuff lies on the seabed. So I would suggest to devote more speculation, if any, to that end since we really need more hard data or we are just filling these pages with the same old rehash.

let's see how long this post lasts

GreatBear (post 1881), I think the June 16 position of the ships is centered on where the floating wreckage has drifted, which may be some distance from the area of impact.

The plot of the wreckage recovered June 6.

http://i136.photobucket.com/albums/q.../SNAG-0288.jpg

The plot of the wreckage recovered on June 7.

http://i136.photobucket.com/albums/q.../SNAG-0289.jpg

The plot of the recovery of the bodies, the last recovery (the 50th body I believe) being on June 16th, which is where the Brazilian Navy now has most of its recovery flotilla.

http://i136.photobucket.com/albums/q.../SNAG-0287.jpg

The plots appear to show a north and then a west drift. The center of the search (as of June 16) is about where 145 [km] appears on the third chart.

Without an identifying coda or index, the numbering system lacks obvious coherence. Of note are items 9 and 11 near the bottom of the June 7 chart. Did these drift south or do these represent the first pieces of the plane to come off? (The square at the bottom of the frame in the charts for June 6 and 7 is the last reported position.)

I certainly appreciate the focus on data, especially as it relates to Box/Pilot interface. My understanding of ACARS suggests to me a system that is designed not specifically to do what most folks here would like to see it do. It is not a streaming super computer. Its computing and tx formats are designed for a non-critical logging and storage of mx demands to be addressed later, at arrival.

Given the grand exposure to very limited evidence, the number and span if hypotheses is narrow. ACARS, pieces of debris, and an interesting record of possible precedent failures. Other than a short term at medical school, I am wholly unprepared and incompetent to consider the humanity as evidence.

A precedent record of pitot issues is a start, and what remains of the air data might be foundation for considering a high altitude high speed upset occurring at or near a/p disconnect. The parameters for reversion to hand control seem rather wide at M.80, (see PJ2 description of AltLaw), even with healthy pitots, the amount of control available to a surprised Command Pilot seems large. It is apparent with the evidence that at a/p disconnect, the roll control was a range of 60 degrees, albeit applied at a rate that wouldn't disagree with a/p limits, (load). This rate and range is what presents to me a potential for a very quick disconnect by an a/p that might have been doing a grand job, conveying no issues to the crew, but at a/s cue loss could be an enormous challenge to format change, autos to hand. Any roll or turbulence induced yaw or pitch excursions, without cues in a dark and flickering cockpit suddenly requiring hand control inputs may have begun a rapid upset. The VS was found virtually unblemished. The Rudder has a severe tear at its proximal swing with the aft fuselage, but remained fully and consistently attached to its mate.

A loss of the VS and Rudder as a result of the initial upset, some combination of yaw, pitch, and roll either coordinated or not may have begun the out of control descent. As the a/c would have been decelerating from its max. speed after upset, the remaining airframe would have been giving up its structure (in some unknown sequence) and created a cone of ballistic dependent debris on the Ocean's surface below. Deployed or not, the spoiler panel shows severe damage that suggests to me extreme aerodynamic loading, flutter and separation. The suggestion from its appearance is that similar loads occurred elsewhere on the a/c, enhancing the theory of an aerodynamically destructive descent. The debris collected is light and flat, with high area to mass ratio. It travelled more slowly through the air than heavier material, and most likely further.

Without a functional tail, the only other over water accident I am familiar with had the fuselage and wing structures descend immediately into the water in virtually a vertical and inverted entry, an MD-80.

I appreciate the technical nature of this thread. It is an extremely informative and enlightening enterprise.

Will Fraser

Some contributions state that the ADR and the IRU parts of the ADIRU are independant from each other, that you can switch off one of them to let the other operate in a normal way. This lead some contributors to say that a complete anemometric failure does not account for an IRU failure as reported by the ACARS messages.

But what do we learn from the Qantas incident ?

"An A330 aircraft experienced a sudden nose down order while in cruise. This order was preceded by an automatic autopilot disconnection and triggering of the “NAV IR1 FAULT” Electronic Centralised Aircraft Monitor (ECAM) Caution. Investigations highlighted that at time of the event the Air Data Reference 1 (ADR) part of ADIRU1 was providing erroneous and temporary wrong parameters in a random manner. This abnormal behaviour of the ADR1 led to several consequences such as unjustified stall and over speed warnings, loss of attitude information on Captain Primary Flight Display (PFD) and several ECAM warnings."
(source: http://atis.casa.go.kr/ASMS_AD/file/...008-0203-E.pdf )

is that to say that a faulty ADR can generate a "NAV IR1 FAULT" ?

in such a case, what is the procedure ? :

"Turn off the affected IR.
Turn off the corresponding ADR.
Use AIR DATA switching as appropriate.

Use ATT HDG switching as appropriate."

is that to say that when an ADR is faulty, the corresponding IR should be switched off ? (another directive acknowledges that a faling ADIRU can be difficult to switch off)

can we truely say that the ADR and the IRU parts are independant ?

And the ISIS can fail through its mach meter function.

Given these facts, a failure chain starting from a severe icing of the Pitots probes, statics ports and possibly barometric pressure sensors would seem relevant to explain the sequence of fault reports ?
Jeff

Aguadalte, what makes you still strongly believe all IR's have either failed or been switched off ?

Ranamin...Quote:

http://www.atsb.gov.au/publications/...70_interim.pdf


In-flight upset
154 km west of Learmonth, WA
7 October 2008
VH-QPA
Airbus A330-303



Thanks for the pointer Ranamin. I found that report most interesting and was rather disturbed by the following statements in it:-


Scenario where AOA spikes could influence flight controls.

The aircraft manufacturer advised that the AOA processing algorithms would prevent most types of erroneous AOA inputs provided by the ADIRUs having an influence on flight control commands. This included situations such as an AOA ‘runaway’ (or a continuous divergence from the correct value), single AOA spikes and most situations where there were multiple AOA spikes. However, the manufacturer identified that, in a very specific situation, the PRIMs could generate an undesired nose-down elevator command. This specific situation involved multiple AOA data spikes with the following properties:
• there were at least two short duration, high amplitude spikes
• the first spike was shorter than 1 second
• the second spike occurred and was still present 1.2 seconds after the detection of the first spike.


Simulation studies.

As part of the investigation, the manufacturer reported that it had performed simulation studies concerning the filtering of AOA spikes by a PRIM. The simulation studies confirmed that the input of two AOA spikes which met the conditions listed above, were not effectively filtered by the PRIM, and could lead to undesired nose-down elevator commands. The aircraft manufacturer advised that the 10-degree elevator command associated with the first in-flight upset, was the result of 4 degrees of alpha prot and the 6 degree authority of the anti pitch-up compensation. The 10-degree command was close to the worst possible scenario that could arise from the design limitation in the AOA processing algorithm.


Relevance to other aircraft types.

The manufacturer advised that the AOA processing algorithms used by A330 aircraft were also used by A340 aircraft. However, different algorithms were in use on other Airbus types, which were reported to be more robust to AOA spikes. The manufacturer advised that AOA spikes matching the above scenario would not have caused a pitch-down event on Airbus aircraft other than an A330 or A340.

Investigators Determine Air France Disaster Caused By Plane Crash
 

Once again, The Onion, in its tasteless and irreverent style, comments on the media bloviators covering this accident:

Investigators Determine Air France Disaster Caused By Plane Crash | The Onion - America's Finest News Source

Hardly cleanly, having pulled major structure out of the rear fuselage!


Seems its a matter of damned if you do & damned if you don't with some people - what do you really want a structure to do, play strip-poker or Russian roulette?

The Onion - quite tasteless reallly :rolleyes:

Do we have proof the A/C lost ALT indications? Or just the Speed? Because Speed ind loss will not afect Alt indication. On the other hand, Alt ind loss would alter the speed. Plus, the Speed (pitot) sensor is more prone to weather influence (dynamics) than Static (vacuum actuation and flushed) sensors. Any problem in any of these sensors would fail the ADR part of ADIRU. And in fact ALL we know is that an ADIRU reported faulty in the IR part (#2), as well as an ADR DYSAGREE, which can be due to Alt, Spd, or both.Just because we discuss many scenarios does not necessarily make it true, unless YOU'RE THERE!Looks like an established fact that speed sensors caused it (by reading most of the threads in this Forum), and what is most strange is the lack of self-defense from AIRBUS part on the subject.We should all show a bit more respect for the families involved, the professionals involved, and WAIT FOR THE INVESTIGATION TO FINISH!But I have to keep stopping myself to come here, this was just a reminder!

p51guy reply from capeverde2008
 

Quote - "NO COMMERCIAL AIRCRAFT SHOULD GO WITHIN 100nm LATERALLY of CB - ICTZ (Tropical Cumulo-Nimbus clouds) activity.....for any reason...FULL STOP. NEVER, EVER, don't even think about it.... or trying to overfly it. That is from MANY years experience and many grey hairs of wisdom!!"

"I guess you never fly through Texas with thunderstorms as big then. You would have to deviate over Oklahoma with those parameters." p51guy quote

Yes, T-storms big enough to power Africa for a few days!
Yes, deviate over Oklahoma, whole of Central Africa if necessary! Fuel divertion, turn back....it really is 'lives' at stake. Plan well, be cautious and arrive alive....

Rgds, capeverde2008 :ugh: :}

ir + tcas
 

I suppose it means that the ADR part of ADIRU needs the corresponding IRU but the corresponding IRU wouldn't need the ADR, which could prove my point that faulty ADR (airspeed) data would not generate IR related faults.

In the qantas flight maybe the IR1 problems led to erroneous ADR1 "conclusions", including AOA (please correct me if wrong).

Another question:

Could someone already "decipher" the TCAS fault... How does it relate to "doppler", if it really does ? Is it related to the "antenna" or to distance/speed calculation (then it would need at least ground speed, I suppose).

Editing: Someone already stated that in the AI docs the TCAS is indeed 34-43 and not "doppler"

Alaskan 261 lost trim control of the horizontal stab not the vertical fin causing a severe and unrecoverable nose-down pitch.:(

24V

Harry Mann - "pulled structure out!!"

No, it failed cleanly and very suddenly - this is shown by the damage to the lower rudder which nevertheless remained attached to the VS implying it was levered backward against the tail cone and shattered under sudden longitudinal compression. This in turn implies that the forward attachment failed very suddenly and explosively, the way composites do, and you can see this in the exposed cross-hatch "brushy" damage in the VS internal structure (seen from below).

I still believe that either the VS failed on its own in turbulence, or as a result of a lightning strike traveling down the aluminum fuselage and exiting at the VS front root, destroying structure there. The latter is more consistent with subsequent computer systems failures.

-drl