The same way the AF447 thread got into its 12th incarnation - by liberal application of wishful thinking.

Because, in a regulatory sense, the Thales AA pitot tube was still technically fit for purpose. Have a look at this article from 2009:

Airbus backs overhaul of pitot icing certification standards - 12/13/2009 - Flight Global

So while EASA's certification criteria were less up-to-date than the FAA's, it would appear that even the later FAA standard does not take this form of icing into account, and consequently the Thales AA pitot probe would have passed certification in the US too.

Closer to 30, and not all of them involved the Thales probes, the Goodrich models could still have issues if the conditions were severe enough. Avoiding bad weather in an aircraft is not just for the sake of not wanting a bumpy ride!

Ultimately, prior to this accident the aviation industry did not consider temporary loss of airspeed indication to be a significant threat - just set pitch and power if necessary and the aircraft will take care of itself until the blockage clears.

In a purely technical sense, this aircraft did not crash because of the blocked pitot probes, it crashed because the instinctive reaction of the pilot flying was inappropriate - and this was not caught and corrected by the rest of the flight crew.

PS: Winnerhofer, you seem to have an intense personal animosity towards the French authorities - how come?

Folks, I appreciate that feelings can run strong and that this topic, in particular, is of great interest to us all.

However, it is not our place here to have discussion extending to an aggressive and, potentially, legally risky level.

Please consider posts carefully lest I be forced to wield a sword.

It'd be nice to have a bit of a summary in English, I must say.

Correct me if I'm wrong, but as far as I can make out, the author of the slide set seems to be arguing that prior incidents warranted more action from the DGAC earlier, that the BEA should have made a public report on the issue and that AF and Airbus should have forced the pitot tube replacement earlier.

All these things are definitely worthy of consideration with the benefit of 20/20 hindsight, but it doesn't take into account the point I repeated earlier, namely:

The slide set itself quotes the FSF as saying there were 300 accidents and incidents involving flight instrumentation issues from 1989-1999. The Thales AA probes were only offered as an optional fit to the A330/340 from 1999 onwards I believe, so the author is misrepresenting a more general statement as something specific to this case - i.e. none of those 300-odd incidents involved the Thales AA probe.

Actually I don't remember the specifics. Could you dig the references up for me?

What I'm pretty sure of is that this is the only commercial accident in the last 25 years involving loss of/faulty instrument indications where airspeed was the only thing lost. Others involved additional factors such as false overspeed warnings (and consequent AP pitch-up), or faulty altimeter readings.

The regulators are *part of* the industry.

[EDIT : Winnerhofer:

First, I'd recommend that you don't post links directly to MS Office documents (such as PowerPoint files), as they have been known to contain malware - see if you can find a web-enabled link in future if you can.

I did upload it to my Google Drive and had a look, and as far as I can tell it's yet more SNPL nonsense. The author of the PowerPoint is basically arguing that the crew were handed what he calls "latent conditions" specifically by Airbus, AF and the French authorities. He links an unrelated 2002 piece in which the aircraft is expected to leave the flight envelope to the AF447 conditions in which it was not. It left the flight envelope because of the actions of the pilot flying.

He also infers that:
- The BEA should have investigated earlier incidents because the AF crew called a Mayday in one of them. As far as I'm aware a Mayday call does not automatically trigger an investigation by any investigation agency I know of.
- The BFU and NTSB recommendations applied to the Thales AA pitot probes alone, when they did not.
- The ETSO C16 standard was expected to be replaced with one which included mixed conditions and ice crystals, which it was not (see my post #232)

It's a bit hard to follow you if you just post links without commentary of your own. I'm wondering why you've stopped using your own words.

The "approach to stall" focus as opposed to "stall recovery" prior to AF447 was a global issue, not just one restricted to France.

Actually I don't remember the specifics. Could you dig the references up for me?

As far as I can tell, project ADELINE was actually a joint commercial/academic research programme to find possible *successors* to the existing pitot-static/vane technology. The fact that the online references to the project seem to have disappeared over the last few years seems to indicate that they couldn't find one that was practical at this stage.

Yes indeed but the important point in regard of this:
is this (bold)
And
So in fact the aviation industry (and regulators .. part of it) considered the temporary loss of airspeed like a threat IMHO

@jcj:

I think the qualifying words are "The loss of *these* data" - meaning more than one of them [EDIT : and as if789 correctly points out below - permanently], an example of which was the Aeroperu 603 accident. Or a situation where loss of one has knock-on effects (like Birgenair 301). As long as you're (relatively) straight and level, temporary loss of airspeed data can be easily overcome by using pitch-and-power, which is the reason smaller aircraft which don't have any redundancy in the pitot-static system can still pass airworthiness requirements.

In short - the temporary loss of airspeed indication *alone* was not considered a threat because there were long tried-and-tested workarounds.

Regarding the FAA's point on replacing the Rosemount units, I'd like to see the original document if anyone has a link handy. They may have been thinking along the lines of Birgenair, where a blocked pitot tube on one side caused the automation to pitch the aircraft up to the AP pitch/AoA limit due to a false overspeed condition. Even in that case the aircraft only departed controlled flight when the PF (Captain) pulled the throttles back to further reduce speed and immediately put the AoA into the stall regime.

The Airbus systems automatically disengage autoflight if the data from the three pitot sensors disagree, so a similar situation would not happen there.

{ been away for while, come back and found there is still a 447 thread -
but, unexpectedly, with interesting and new information }

There is a key difference in the statements: "temporary loss" and "loss" (not temporary).

Taped-over static ports, wasp nests in pitot tubes, and in fact probe icing due to inadequate or failed heating (for example) are not temporary - and had caused crashes prior to AF447.

Incidents where working pitot heaters were overwhelmed for a few seconds, 447 and similar previous, were clearly temporary and could legitimately have been regarded very differently in terms of risk/threat.


Except in 2008/2009 EASA responded to DGAC that there was not an unsafe condition that warranted mandatory probe replacement. See the slides linked to further up the thread, Présentation "Accident AF 447 228 victimes Comment fut traité le. RETOUR DEXPERIENCE. par : 1AF447-REX." - slide 42, for one reference. Note: strictly, they did not say there was not an unsafe condition, only that there was not one that was significant enough to warrant mandatory action.

Since EASA is part of the industry, clearly the industry was at least not-unanimous on whether or not temporary loss of airspeed was a threat.

Dozy,
Here is a link:

AIRBUS INDUSTRIE Model A300 Series Airplanes

The AD didn't mandate replacement of the Rosemount pitot tubes, just modification of the pitot probe heater within 1800 flight hours. This applied to the A-300 aircraft.

Thanks TD, but this seems to be a different case - jcj was taking about A330/340 aircraft in 2002 rather than A300s in 1983.

Cheers for looking that up though - it's interesting nonetheless!

Dozy,
I went through all 2002 FAA Airworthiness Directives (AD's) on the FAA site and there were none regarding Rosemount pitot tubes and/or replacements on A-330s, A-340s or any other Airbus aircraft.

Sorry about the first search, I did it by appliance, not year, and that was the only one that came up…

Right - I think there are definitely some crossed wires going on somewhere...

Cheers again for having a look!

Misunderstanding of the report, of PF vs PM, of position of pilots vs seats, of Crew hierarchy vs seats, of seats pictures in the report. Perhaps Hospital has more to learn from normal aviation uses than from controversary crash CVR.
But exchanging and taking time for reflexion is always difficult but positive.

Yeah, that write-up gets quite a few things wrong - and says other things which are at best debatable. Safety processes used in aviation making their way into healthcare is nothing new, mind.

This may be a dumb query, I fly small stuff for my daily crust, but, 447 and I think it was Condor Air accident Blocked (static ports) interest me. I can understand at alt airspeed in terms of Mach No is important, due to overspeed with Mach crit causing buffet etc. However why does the computer air data program attach quite so much importance to pitot static airspeed? If you have an AOA reading, it just seems to me if the system was programmed to follow the age old Golden Rule of Power+ Attitude=Performance, surely both of those accidents may not have occurred? Again power setting coupled to an AOA readout, would that not be a pretty reliable system as a backup?

I know in 447's case it was complicated by the flight mode it defaulted to, trimming the stab fully nose up, best chance for recovery was at incipient stage, just release back pressure, if only they had known, once in a fully developed deep stall, it would have taken some radical pitch attitudes to recover, at night IMC, not understanding what was happening, that would be a big ask of any crew.

Well, to be fair the trim was only increased to full nose-up because that's what the pilot was demanding of it through the sidestick.

I was wondering if you could clarify a bit what you meant by "...why does the computer air data program attach quite so much importance to pitot static airspeed?".

If you're talking about in terms of the autopilot, it makes sense to automatically disengage it in the event of UAS condition because bad data can cause the AP to pitch the aircraft inappropriately (as in the case of Birgenair 301).

If you're talking about the FBW systems, the only thing they really lose in terms of protection is the hard protections - this is because the pilots should have full authority - introducing bad data to the systems could have unintended negative consequences.

"Another AF447"? Not even slightly.

In that case the aircraft pitched up as a result of the turbulence itself - the crew correctly tried to counter the pitch with nose down and control the airspeed (the indications remaining OK in this case). The temporary "loss of control" was due to external factors, unlike AF447 where the pilot flying stalled the aircraft and subsequently lost control.

I was wondering if you could clarify a bit what you meant by "...why does the computer air data program attach quite so much importance to pitot static airspeed?".

What I meant here was as I recall when the airspeed data corrupted, the aircraft went into alternate law mode, which seems to have added to the crew confusion, yes you are right about the stab trimming nose up due to the sidestick input, but I understood this trimming happened automatically under the "alternate law", recovering from a stall with full up stab trim would vastly confuse things.

This is what I meant by "so much importance to IAS", to me it seems there should be more parameters measured, before he system reverts to alternate law? For example shock stall and crit alpha stall cause the same symptoms as such (buffet), and with a falty IAS reading in IMC, the only sure way to tell the difference is AoA? If the crew had had this, would they have realised they were at low speed, not overspeed?

This may have been discussed earlier, but this was a very interesting accident (very tragic too), as it touches on the clash between classic stick and rudder skills, and modern aircraft AP systems.

(By the way, how do you do a quote on a forum post? I looked in FAQ but no luck? I am anashamedly a very pre computer ager, when I joined the air force, the most odern piece of kit on the Sqn was a hand cranked copier!)

This has all been covered in the mega-threads, so I'll go over this once only for the sake of my sanity... :ok:

Going by the report, the only reference made on the flight deck was the PNF making the callout from the ECAM. The PF never acknowledged the callout.

Alternate Law should be neither confusing nor a big deal - in a pinch all you need to remember is that the "hard" protections are no longer there - i.e. it's possible to stall or spiral dive the aircraft if you overcontrol (just like a conventional aircraft), and that depending on the mode you're in, the aircraft will be slightly more sensitive in roll. In short, all it means is fly normally but be careful with the controls.

Autotrim is active in Normal Law as well. I was lucky enough to be able to perform some experiments with a friend in an A320 sim, and what we discovered was that it was possible to roll the trim forward again with sidestick on its own as long as it was caught early enough (link to summary below).

http://www.pprune.org/tech-log/46062...ml#post6793521

The drop to Alternate Law had nothing to do with the buffet or any other stall-related phenomena. As I said above, Alternate Law takes away the hard protections (i.e. limits) because the design rightly assumes that the pilots should have the final say if the data being fed to the computers stops the system from working effectively. The control laws are really just the equivalent of what the Flight Engineer used to do in the event of a technical problem - i.e. reconfigure the aircraft's systems in a way that provides the greatest degree of controllability and safety.

AP wasn't really involved here, as it disconnected right at the start of the sequence. FBW is *not* automation in that sense.

Check your PMs.

Thanks Dozy, you seem anything but! Interesting stuff the 447 case. One last question, the sidestick, is it programmed to give a stick force feel, (I think it is?), and will it show sloppiness at low speed, tightening up at high speed as such? Why the need to autotrim the stab with sidestick input? It seems to me a better option to let the FP choose the option surely?

Hahahaha - quite a few folks on here would say otherwise!

No - it's passive spring feel. Breakout from centre position and you know you're doing it, it's a chunky piece of kit! Very well balanced though - check out the summary

Easier for the PF, bearing in mind there's no force-feedback. The autotrim system works just fine, though it means that the Airbus FBW series is a little different from a conventional setup there. Interestingly in the A320 sim we found that the trim would stop at a certain point, and had to wind it back manually to simulate AF447's condition - this is apparently different from the A330 which will autotrim all the way if the pilot appears to be demanding it.

This one was similar -

West Caribbean Airways Flight 708 - Wikipedia, the free encyclopedia

Captain flying this time.

@Oakape: Yup - we covered that on the megathread. What's interesting there is that WCA708 provides an instance of rebuttal to the "connected controls" argument, as that aircraft (an MD-80) had connected yokes, and the PNF still didn't see (or respond to the evidence) that his Captain was in fact pulling harder into the stall. Also that the MD-80's automation was not sophisticated enough to detect that it could not maintain the requested altitude with the engine thrust reduced by the anti-ice system.

The issue is that we're not given any context as to what that sim session was about. That series was broadcast in 1996.

In general, Black Box was an excellent series, and I still have it kicking around on VHS somewhere - however in this episode it does make the mistake of assuming the technology of the time was a first step in removing the pilot, which was never true.

Incidents like the one cited argue for better training on stall, incipient stall, stall recognition, and recovery regardless of make and model.

Not a technical point, this being Tech Log, other than the matter of technical training associated with operating complex machines.

Winnerhofer:

Stall warning is set to occur before natural (aerodynamic) buffet starts. The stall warning threshold is approximately 1 deg less than the buffet onset AoA. At 7 - 8 degrees the airplane would be well into buffet:


http://i.imgur.com/Qe96igD.jpg?1
P.S.
Although the EICAS is for system failures rather than pilot errors, perhaps a message like: "STALL: RELEASE STICK OR PUSH" would help a disoriented pilot?

Where are you getting this info from? Unless you have a triple ADR failure, Stall Warning is calculated differently depending on the current Mach value. Are you thinking of the FL250 limit with the BUSS due to fixed SW value (not relevant to AF447)?

Hullo sir - as far as the latter point goes, I think it's fairly wide-ranging. I agree totally with your first point, however I also find that incidents like WCA708 and Birgen301 provide a useful counterpoint to those who reflexively claimed that AF447 would not have happened on a Boeing/MD with linked yokes. To be frank, I'd rather such commentary didn't come up - as it is a distraction from the matter at hand - but alas it has done fairly frequently.

3 accidents with many other contributory factors is too smaller sample base to draw any definate conclusions

No one is seriously saying AF447 would not have happened in a Boeing. However, many experienced pilots here have explained how a yoke may have helped the pilots achieve a better outcome. Let them have their opinion – jeez

Sorry for a non-pilot making a statement here. The father in law of a good friend of mine was an airline pilot with 25+ years of experience. He started originally on Tu-154 then transferred to B-737 for many years. Then he was supposed to be retrained to Airbus due to changes in the fleet of the carrier he worked for.

He expressed many times his disappointment with FBW environment with sidestick without feedback from control surfaces and said that this is not old school flying anymore and the joy of flying is gone.

Making the long story short the pilot ended his life by suicide. It would be very inappropriate to claim that the old guy decided to leave the world just because of necessity to change to new type of a/c with SS but as the family says he was very bitter with the fact. It is known that suicide cases have (like accidents) more contributing factors. Also this is not an attempt to make a flame war regarding Boeing and Airbus proponents.

What I can say as a consultant which is partly involved with safety in various industries - if the operator on any machine or vehicle doesn't like the controls of it then he is more prone to accidents.

Now back to pro pilots :O

You say that, but in the "dark" days of the old AF447 mega-thread, I remember seeing that opinion advanced - usually in complete seriousness - at least once every two or three pages.

I'm not stopping anyone from having an opinion! Though I would question how many of the experienced pilots advancing that opinion have actually flown a FBW Airbus. As you state, three or four incidents aren't really enough to draw a scientifically significant conclusion from. What is noteworthy in an anecdotal sense is that in the time since the Airbus FBW types were introduced and became widespread, there have been more LOC accidents of this type on airliners with yokes than those with sidesticks.

In theory, the connected yokes should provide an extra cue in the visual and tactile channels, but in practice it doesn't seem to make a great deal of difference.

What this means is that no matter what anyone's personal feelings are on the matter, both designs are - as near as we can tell - pretty damned safe, and that the various pros and cons of each are immaterial in real terms.

yeah, Ive read the "mega" thread. There are many interesting and valid opinions from some smart and experienced people.

Because the sample base is very small, a comparison based on statistical evidence has minimal value.

@Cool Guys - Right - and I remember your posts on the subject and others. If I recall correctly, you're an engineer with an interest, like me.

Experience and intelligence are definitely good things - however the best kind of experience also comes with a continued desire to learn and evaluate changing circumstances. An experienced person who reflexively dismisses a different paradigm as inferior without properly evaluating it is as potentially dangerous as a less experienced person who blindly accepts each change as inherently better.

@Winnerhofer - The MD-80's pitot-static system does not automatically cross-check for data validity in the same way as the FBW Airbus system does. I don't think the author of your linked article is aware of that fact.

I haven't got all the facts at my fingertips as I sit here now, will go over the info I have when I get the chance but 447 seems to tie in with the A320 LOC when carrying out an acceptance test flight for the return of the aircraft to service with Air to New Zealand. As I recall, an unplanned approach to the stall was carried out, as IAS was reduced, the aircaft systems trimmed the tailplane full nose up, just before the stall, the engines were powered up, but due to the up trim and the nose up pitch caused by the engine thrust lines on pod engines, the aircraft did not respond to recovery nose down side stick input as was expected. This caused confusion resulting in a relaxing of the nose down input. The aircraft subsequenty stalled and crashed into the ocean.

It seems to me the synthetic feel of the sidestick was an issue, can't help but feel a good old Boeing style yolk would have removed all doubt of what control input and to what extent, was being made? Would like to have a go at a sidestick if I got the chance, as I do regard them with some suspicion...along the lines of, it's all good as long as things are ops normal :hmm:...but when things are going wrong...:uhoh:

Hi Dozy,
In industries that produce equipment that can kill people if it goes wrong, those who are careful about adopting new non validated technologies pose far fewer risks than those who accept new technologies without proper evaluation.

@Cool Guys - Correct, but I'd say a decade of development and testing (from the Concorde "minimanche" experiments in the mid-'70s onwards) constitutes a very rigorous evaluation process, even by aviation standards.

26 years since the A320 went into service and the number of hull-losses attributable to the FBW system and the flight deck design on all Airbus FBW types remains at zero. The Airbus FBW types have a safety record that compares very respectably with other types and thousands of the things fly daily.

So I'd say that the worst fears of the more reactionary "experienced" pilots back when the A320 was launched haven't come to pass, and on this occasion they were wrong about a lot of things.

PerAAA #275


" aircraft trimmed nose up..."
" thrust lines on pod engines..."


How often does one include a visual check of the current state of the trim whilst in normal flight, when it is all done automatically for you ?


How often do you have the opportunity to alter the power from cruising power to flight idle and then back to climb power - whilst in level flight, to see what happens ?


One of the many performance graphs for AF447 appeared to show that power was reduced to Flight Idle - and the nose dropped for a few seconds (as it must). Then TOGA was restored. IIRC this was a few second prior to the final stall. ( I think that nothing was said at the time on the CVR by PF or PNF. The Captain was called at about this time.)

We could hope much better records than AF447 and such wonderful flights.