Algy;

Thanks for the link. I think the accident is relevant to the present discussion in the sense that taking over manually and flying the airplane was then and remains today a prime, professional requirement.

If a pilot can't do that with his or her airplane, that is a serious training and standards matter. The A330 (and all the rest) are eminently, easily flyable in manual flight. It wasn't an emergency and the "safe conduct of flight" was not at risk.

The problems only occur when one out-thinks the design and that is again an understanding/training matter, not an automation matter.

The Bangalore accident was not an "automation" accident though mode confusion contributed. All that was necessary was to push the thrust levers fully forward and actually fly the airplane which is their job. All that was necessary in the AF447 accident was to maintain pitch and power settings. The airplane was fine moments before the loss of airspeed indication, and such loss means nothing to the actual airplane itself...it was still flying, still had power and was in stable flight.

The "Idle, Open Descent" issue here was fixed twenty years ago. I used to teach it and the "mode reversion" process during line-indoc training on the A320.

PJ2

Transient in Feedback Systems II and F-GZCP Stability (part A)
 

Hi,

PJ2

Means nothing? Sir, respectfully i disagree; here is (the beginning of) WHY:

With the Synergy of a highly motivated group we can touch some "sensitives points" in our effort to understand what occurred with F-GZCP that night.

The diversity of the posts show the agenda of the posters is diversified. I think the more constructive one is to allow us to be prepared to avoid problems when dealing with similar equipment.

This can be important not just to pilots.

A Feedback System is EXACTLY what his name implies:

Something that receives "feed" back (to itself).

Tacoma narrows bridge received energy (from wind turbulence), OSCILLATED to the structural limits and was destroyed.

This was a typical POSITIVE feedback (the one that presents GROWING oscillations)

Positive feedback can be dangerous. But when controlled (by lossy components) are very useful and common in our lives.

Example: HF radio equipment used during Titanic accident. (A coiled wire, a capacitor, a switch, a spark gap and an antenna and a power source)

Another positive Feedback System: An A/C subject to an UNDAMPED oscillation when PF apply larger inputs (larger than a given threshold). This may led to the destruction of the equipment. The loss of the F4 posted by Machinbird perhaps is a good example.

During some initial discussion on the (clearly obsolete) AS probes still today used by the aviation industry we had the opportunity to understand the advantage to have a better one using a closed loop. The feedback WOULD REDUCE the time required to the Pitot to "recover" from the "cold" it frequently suffer. :) In the 30+ cases of UAS they briefly (seconds) failed to work properly.

In F-GZCP last flight the System (A/C + crew) received an "input" (heard in CVR) so important that affected the stability of the System.

The ice crystals WERE NOT ADEQUATELY PROCESSED BY AN IMPORTANT SENSOR (so important is MULTIPLE) that as per A33Zab diagram has not a TEMPERATURE CONTROL. It seems (the heater) "less intelligent" than the appliance we use to press our clothes. The pressing iron has a thermostat, i.e. a feedback system to control it's temperature.

This kind of NEGATIVE FEEDBACK improves the operation of the equipment and allows a high quality work. Our clothes are preserved, the pressing iron can operate IN THE BEST range, etc.

Another example of a feedback system is the yaw damper. "With the help" of the rudder the A/C has the directional stability greatly improved.

At that night the System (A/C) put the crew (PF) in the "feedback loop". The pilot had to act immediately. Doing so he corrected the roll. A roll we may understand started by LARGE AMPLITUDE STIMULI from the environment. A harsh one they had to do a "last minute" deviation. PF started to apply LARGE AMPLITUDE stimuli to the new System (A/C + PF) and this could led to UNSTABILITY.Machinbird and others suspect of PIO (roll) after this PF action.

Up to this point the System received 'inputs" in some degree affecting the Stability of the entire System (System+PF):

1) Ice crystals.
2) Loss of important feedback loops: A/P and A/THR
3) Turbulence
4) Large PF inputs

This facts generated almost immediately 10 other facts:

1) System was automatically reconfigured (NL to ALTN)
2) System degraded (to "another" A/C with less available resources)
3) ISIS "suffered"
4) A/C broadcasted anomalies (ACARS)
5) Crew not was informed on reason of A/P and A/THR quit
6) Turbulence became POTENTIALLY more relevant
7) HF "surfaced" (by lack of training, etc.)
8) Not use of SOPs and adequate CRM
9) Lack of understanding ("uncharted waters") by PF AND PNF
10) A persistent climb with high rate

Clearly after this facts the System was less robust than before.

A safe (and stable) System MUST BE:

FAULT TOLERANT

And show:

GRACEFUL DEGRADATION.

And i will add:

A safe System must show RESILIENCE (System + crew). The transient (perhaps up to the apogee) dominated the scene. And After "inflexion point" put the plane in a "steady state" condition lasting roughly 4 minutes falling (and circling) at near terminal speed.

For me it is clear the System at this moment (PF starting to act IN THE NEW LOOP) was showing less capability to "resist" to the initial "input" and subsequent consequences: tiny ice crystals.

(to be continued in part B)


In the meantime we must think looking to the factual information we have so far.

PS

Questions to think and take into account in our analysis:

The man machine interface became essential at this critical moments?

We will know what PF saw? (RH was not recorded and ISIS also had "impairment")



Some remarks related to AS probes: Open loop (no feedback): LONGER RECOVERY TIME (to recover from the "cold")


A33Zab

Thanks for the diagram. Amazingly the probes are just heated and their temperature is not controlled*. This fact alone may explain part of the observed problems related to air speed measurement.

As Machinbird pointed there is room for improvement. With a closed loop temperature control the time to reheat the critical internal regions of the probe would be reduced.

Anyway i am deeply surprised (negatively) with the approach used. Sensors capable to "disable" important functions of the A/C more simple than the necessary.

Much of my rationale in some posts were based in a better (closed loop) approach. when in AUTO mode. In both AUTO and ON (what i called MANUAL) the power applied IS THE SAME.

(*) And we really don't know if a ballast wire is used.

Bottom line:

The thermal "recovery" of probes takes too long (in ~20 seconds after hitting ice crystals A/P and A/THR quit). The recovery time WAS NOT COMPATIBLE with System requirements of GIGO.

The recovery time MUST BE REDUCED and i'm sure can be reduced.

The different probe characteristics of FR (now obsolete) and US (with limitations) may be explained by thermal inertia plus the factors mentioned by Owain Glyndwr

Also the materials used certainly are important like mentioned by Lyman

Up to this point (in this sensitive issue and related posts) thanks for comments/questions from: HN39, PJ2, Lyman, roulishollandais, and contributions from Machinbird, A33Zab, Owain Glyndwr and others including PM channels.

I will try to comment and answer questions made before, when possible. (asap)

Pitot tubes
 

Hi,

Mr Optimistic,

When i understood the heating approach used in the TRIPLE sensors (failing near SIMULTANEOUSLY), i tend to be,

Pessimistic,

:}

I agree with PJ2 - anyone who has flown even model airplanes can tell you that a stable aircraft does not need airspeed information to continue safe flight,

All the evidence from other similar incidents is that doing nothing was a viable (and arguably the best) option. Even in alternate law the aircraft is pitch stable - the system does not use, or need, airspeed information to achieve this. This law is in fact 'graceful degradation'. Freezing the throttles also maintains the equilibrium state.

The system was never given the opportunity to show stability in roll as it was continually perturbed by pilot input. Incidentally there was no PIO - the roll oscillations are damped not divergent and the motions and stick movements are not out of phase. What we are seeing there is a pilot struggling to come to terms with a new set of unfamiliar dynamics. He got the hang of it in about 30 secs which is not a shabby performance by any standard.

As for the probes, it it clear that the amount of heat being applied was not enough to handle the rate of ice accumulation, which is a random variable. [The proposed new icing requirements show that ice concentration can be greater over short distances than long. The heating rate would have been set up to cover conditions which were less onerous than those possible. Now that a higher limit of ice particle concentration has been identified it should be simple enough to up the heating rate to cope. no need for fancy feedback systems - KISS is still a good principle]

Obsolete AS probes
 

Hi,

Machinbird

Those guys designing aircraft pitot tubes really have been stuck in the dark ages.

Henri Pitot would not like his name being associated to dark ages. :}

Now on i will change from SUBHEATED AS PROBES to

OBSOLETE sensors,

(controlling SOPHISTICATED Systems)

PS

The pressing iron i carry in my motor home has a thermostat. :}

The ones i have in my house are SUPER ADVANCED.

PS2

1930?

When i visited the Gold mine museum in Joburg i did see ADVANCED devices. And the mine operated well before that year.

Graceful degradation of the entire System (A/C + crew)
 

Hi,

Owain Glyndwr,

Sure! :ok:

As a researcher i would prefer to deliver to pilots a better System than one that you need to "wait and see" every time. Wait and see (some kind of hysteresis) is wise, for sure.

In this case the brief failure of obsolete sensors (sub heated, high thermal inertia, etc.) contributed to a chain of events.

I am not talking about this law. I am talking about the System (A/C + PF) during the transient. And i not mentioned yet the man machine interface.

A fact.

Struggling to understand by hand "testing the plane"? :{

To control the (important) probe temperature is VERY EASY, RELIABLE and K.I.S.S. TO THE EXTREME. Einstein commented about how K.i.S.S. you can go. There are limits.

This was my first feeling: SUB HEATED.

Still k.I.S.S.

And will be forever. Leonardo da Vinci stated: Simplicity is the ultimate sophistication.

But this is to be covered when commenting on the man machine interface.:E

Important sensors and crew operating "out of specs"
 

Hi,

PJ2,

Actually before encountering ice crystal the A/C was working fine, i agree.

After increase of CVR noise and fit with OBSOLETE FR probes we may say she was no longer fine.

The clogging started and eventually affected the Stability of the System.

The bureaucracy (and other factors) was allowing the operation of hundreds of flights with obsolete sensors.

And the pilots being instructed to use "State of the art" band aids. *

I would prefer "State of the art" Systems.

:mad:

PS

With insufficient crew training (lack of) for the worst case scenario.

(*) I like duct tape, swiss army knife, band aid, and all this emergency stuff.

But i love a good design. When possible, why not to have it?

RR_NDB;

Thank you for your responses.

Hi,

Owain Glyndwr

Why? What led him to do that? No reasons?

PF was operating as "part of the feedback loop". He acted doing the opposite. What he received from the System?

He acted without any influence from the System? Doing exactly the contrary?

:suspect:

Hi,

Owain Glyndwr
I agree .. and I want to add (for be intellectually honest) that this phenomena was identified years before the AF447 accident ... and it WAS simple ... blah .. blah ...

Hi All,

I am not a pilot but an engineer. I find the pitot discussion very interesting. There have been many suggestions on how to make this speed detection devise better as it appeared to be the first thing to fail in terms of proper operation in the AF447 flight. I am going to confine my thought only to the pitot itself, not the system of the aircraft to which it is connected that interprets and responds to the signals from the pitot tube or multiple tubes.

In designing a devise of any sort, the design engineer has to know as much about the parameters the devise is going to experience and operate within. Given this information, he/she can then go about designing the devise based on this information and perhaps a data base built on prior experience. Once the devise is designed and manufactured it is then tested to parameters across the envelope it will experience in operation. If these tests are successful, then it can be placed in service with some degree of confidence that it will perform the intended function it was intended to perform. So what could go wrong? What could go wrong with a pitot tube where the basic physics and general design has been known dating back to the late 1700s? And why is it that one manufacturer's design seemingly has less problems than another manufacturer's product when both met mandatory testing and certification requirements? Why is it that when the devise is used on one aircraft, it is more susceptible to non-performance than on another aircraft?

I would postulate to you all, there is nothing wrong with the basic concept of the current day pitot tubes, they will and can work successfully across the total flight envelope without any new bells and whistles. The reason they may not is because the parameters used in the design and testing did not and for that matter, do not match what is experienced across the total operating envelope, particularly at high altitudes and high speed in icing conditions. I have thought about this for some time and wondered in the instance of Airbus aircraft, could there be a difference in pitot tube performance verses that of Boeing aircraft? Could it have something to do with installation or location or shape of the fuselage forward of the mounting point or how the air passes into it or the actual testing and certification requirements? Was Boeing lucky and Airbus unlucky?

I think it has a lot to do with everything mentioned above and some other thing not thought of. Here is some interesting information that has been developed out of the studies resulting from AF447 and commented on by Airbus regarding changes to testing and certification:

Airbus' comments go on to observe:

And,

So I think with proper design parameters, proper mating with the aircraft and proper testing requirements pitot probes from any manufacturer can be designed that work throughout the flight envelope. We are not there yet in full understanding, but it is not hard to imagine the icing problems can and will be solved very soon.

Passion for aviation due the multidisciplinary aspects
 

Hi,

PJ2,

The Synergy and motivation we can exercise here with you and other aces is great.

We must use when possible the opportunities to explore new ways to look to the issues.

The concepts and ideas i present are conceived carefully and based on memorable experiences since 1968 when i first was introduced to birds of all sizes (and it's anatomy) in a "War Surplus like" shop. i was student of Electronics avid to understand "everything". I had the opportunity to learn the basics in several areas at this time. Later on i had the privilege to fly some venerable birds like the C47 and ride in C46, Connie, etc. etc. etc.

My motivation in PPRuNe is through a minimum of understanding ultimately, try to contribute to our safety. My 3rd son is a professional pilot and may be can learn something reading our effort. :)

AS probes
 

Hi,

Turbine D,

I think so.

PS

Did you hear about a patent filed by Airbus SAS using L(alpha)ser?

(i write Lima Alpha Sierra echo Romeo and the final result is Lima @ Sierra Echo Romeo)

Anyone could explain this glitch? :*:mad:

Hi RR_NDB,

I can't explain the glitch but, I did see that Airbus file for the patent. I also think there will be some changes in the A-320neo to address the pitot icing situation and maybe in the A-350 given enough time. I don't think the technology will be radically different but will be an attempt to incorporate what they have learned since AF447.

Sometimes you need a new approach when you understand the real problem.

It find it very significant that 19 seconds of exposure to the ice crystals/pellets was sufficient to shut down the 3 airspeed sensors. The fact that a loaded up pitot tube can begin to clear itself in 30+ seconds after the blockage is not really good news.

While blocked, a pitot essentially stops collecting new ice inside, so it would appear that what takes 19 seconds to collect requires up to 49 seconds or more inside a pitot tube to begin to melt and clear. This tells me that the pitot heating system is seriously outmatched by the environment.

I think, as some of the posters earlier have mentioned, that the key problem is coupling the melting energy to the collected ice. Conduction alone just cannot do the job and maintain an open pitot tube-at least, not at realistic pitot tube temperatures.. Settling for intermittent blockages is not really an acceptable course. What is needed is a better means of coupling energy to the ice when it is collected and a wider dynamic range of energy modulation.

This is very good corroboration that the pitot heaters behaved like ballast resistors.

I would like to offer the thought that using pitot tubes with different means of heating begins to create diversity in the airspeed sensing system sources. Dinking around with more of the same (higher wattage) in pitot heaters is likely to be unsuccessful and will likely retain the cyclic clearing/clogging characteristic under worst case mixed ice conditions. Sometimes KISS is an inappropriate solution if it involves undesirable adverse characteristics. Time to move on.

At least that is how I analyze this.:(

Hi,
Turbine D
Are you sure the pitot tube failed ?
When I read the BEA report N°3 it's indicated that the plane was working as per design
The pitot tube worked also as per design
The plane and all parts of it were certified to work under certain limits
The accident of the AF447 show that the plane was put (or go .. make your choice) over the limits of certifications (and he stalled) .. as was the pitot tube (and he iced)
So the plane and the pitot tube never failed .. as .. when the pitot tube returned under the certification limits he worked fine again (nobody go outside the plane for fix it .. as he never failed)
Unfortunately the plane required some extra actions for return in the certification limits ... and those actions were no performed ...
Finally .. who failed ?

Not a glitch. Just if you write the proper acronym for the coherent light device, ads appear selling the devices to any scrote who fancies trying to blind a pilot on approach.

Turbine D

Me too, and I find myself in complete agreement with what you say.

Yep!
Or that one manufacturer’s product will work, but another’s won’t, both at the same location on the same aircraft? Or that the one that didn’t work was OK for seven years?

I completely agree!
Again I agree completely
I have wondered about that also, and it is interesting that Airbus themselves, when commenting on the proposed TSO, say:

And


But the newly proposed Appendix P to CS25 gives the TWC at -30oC to be 4.5 g/m3 BEFORE any installation effects are included. So the requirements against which the A330 was designed are miles too low against the possible ice particle exposures now envisaged.

[I should have added that Airbus say they test to their own internal requirements that exceed the JAR 25 variety, so we don't really know what theA330 probe capability was]

Worth noting also that the research and analysis work that led to this conclusion was not started until 1998, four years after the A330 went into service.
I agree with you there, with one proviso, and that is there has to be a suitable facility for testing the probes.



In AIAA 2006-206 they point out that:




Let us hope so

RR_NDB,
While your focus on the pitots as the initiating cause of the AF447 disaster is understandable, it is really irrelevant in the wider picture. Improving the pitots is necessary in the general drive for safer flying, but not as a specific outcome of this accident.

Sensors can fail for a million reasons. CB's trip, autopilots drop out, likewise. The aircraft should be flyable in this case with the proper backup systems/crew procedures. Surprise surprise, it is!

Ice was the issue in this case, but may not be in another. Your brand of hindsight may have saved AF447, but will not save the next one. The issue here is not the pitot icing, but the subsequent mismanagement of the problem, whether by the crew or the remaining aircraft systems (the stall-warning cutout comes to mind).

A couple of questions...
 

1> I know that prior to AF447 the pitot-icing had already been identified and there were steps in place to change the sensors, but was any action taken to introduce this scenario into sim. flights so that we could assess what proportion of pilots would get it right?
2> Has anyone looked at (ACARS?) data to see whether
a> Icing is rare but when it happens all sensors will ice ; or
b> Icing is fairly common but the sensor offer effective redundancy and it is rare to lose two.
I think someone mentioned before that HAL can clearly ‘see this coming’, and it would not seem impossible to add some logic along the lines of;
“Hey guys, I have just had to arbitrate a whole series of mismatched speed indications, it is becoming increasingly difficult to pick the right one with any degree of certainty so any time soon I might be handing you the plane”.