Re: Not seeing the wood for the trees.
 

PickyPerkins
It might be interesting, and possibly useful, to examine these ten accident reports and compare the situations at the start of each of these events, e.g. how many of them STARTED with a disconnect of the AP?

Would you object to "apparently started with a disconnect of the AP"?
In the period leading up to the AP disconnect the automation might have adjusted trim, throttle etc away from those usual/appropriate for the phase of the flight. Which would complicate the machine -> human takeover.

For example, the problems facing the turkish crew at Schiphol seem to have been greatly compounded by the heavy trim applied before the AP finally disconnected.

@GB:

85 to -35 degrees.

Not sure I'd call it 'stable', but it is 'flying' below 'stall speed'.

Note 'they' is not pilot input, elevator input may be from Normal law controlling 1g, but is also almost coincident with the second MMO exceed event, so could be "High speed protection" pitch up?

The report states that "the corrected or phase-advanced angle of attack excursion beyond alpha prot caused a change in the pitch flight control law from normal law (NZ law) to angle of attack protection law (AoA law)."

Which suggests it wasn't the real AoA, but it is what the instrumentation reported, and if the signal is noisy you do not want to "phase advance" it by differentiation and extrapolation. If the AoA sensor suffers friction and moves in 'stick-slip' steps this sensor processing would give AoA spikes!

But does that explain the pitch response before the pilot inputs knocked it out of the protection mode? To control to alpha prot with falling airspeed why would it pitch up 10 to 16 degrees? Perhaps that's just what happens when it tries to AoA with very noisy AoA sensor inputs due to the turbulence? As the speed falls does the target alpha prot increase?

- small print noted :O

It is perhaps pertinent to point out that all the pilots (whose bodies have been recovered from the Med and the Atlantic from the two accidents) had done so, so I'm not too sure what I would have benefited from, apart from the 'enjoyment'?

Ridiculous design (AS issue)
 

RR_NDB:

Before calling this a ridiculous design.....

What are your suggestions how it ought to be?
Maybe AIB (or any other airplane manufacturer) can learn from you?

Sensor validation;

Does the report say that airspeed fell below stall speed? IIRC it only stated that airspeed fell below VLS (lowest selectable speed).

The report explicitly states that overspeed protection was not invoked.

Capture of alpha-prot means that the FCS maintains an AoA greater than required for level flight, hence loadfactor>1, hence vertical acceleration, increasing v/s and FPA. Since pitch = FPA + AoA, increasing FPA at constant AoA=alphaprot means increasing pitch. Agree that turbulence 'noise' gets into the act too.

EDIT:: I suppose alpha-prot is tied to alpha-max which decreases with increasing Mach. So yes, I would expect that alpha-prot increases with decreasing airspeed, but consider that is a second-order effect. The protection will still keep the airplane a comfortable AoA margin away from the stall, because stall AoA increases also.

The wings still work the same on your airbus and your spamcan.Disproportionately high, or disproportionately low?

work the Mr." high speed protector" over the elevator or the trim ???

hope I understand the algebraic sign of the elevatorline right? + =pull , - = push

my little feeling is that all this "MR. protectors" work each beside the many "others", normal they work very good, but they are not team players. there is no "Mr. cross-controller" who says: keep cool wait, first cross- look to bank, altitude, attitude, speed and AoA and after you ask them all what happens, then go slow to a saver place.
no Mr. protector say: "I am out of my range, I stop at this place, over and out!"

and the PF has to wait for this moments and then he need a good portion of adrenaline.....

why did not exist a paralell energie calculation to sort a lot of possible faults out?

Maybe so, but high AoA protection has priority over all others.

Cognitive Issues
 

From an earlier post by DozyWannabe

As a little exercise try to recite a nursery rhyme that you know well and at the same time read the text from DozyWannabe above and if you have a friend have them tell you a message that you need to write down.

You will find that you cannot do all these actions. You are overloading your brain's cognitive channel for verbal analysis. This is one of the reasons that using cell phones while driving reduces the ability of the driver - cognitive overload.

I have observed overworked controllers 'not see' aircraft fly past their tower due to overload like this.

Now what happened in the cockpit of AF447 appears to be a cacophony of emergency aural and visual messages from the ECAM. Many of the instruments that the pilots would rely on became invalid and others were showing totally unexpected outputs.
Saying the PF should have seen this or done that is easy when all these messages are teased out on a nice timeline - but when they are all at once nobody's brain can process them all. The response in the human under this pressure can often be 'cognitive or attentional tunneling' where everything except a small portion of the inputs to the brain are just not seen/heard.

Has anyone actually carried out a cognitive assessment of the PF workload when the AF447 series of failures actually occurred?

It seems to me that the aircraft didn't just say - 'You have the aircraft' - every system on the aircraft had to say something plus many of the instruments. The cockpit displays are not analogue gauges which use the spatial analysis cognitive channel, but are textual requiring the same verbal analysis channel as the aural verbal messages and the ECAM text messages.

If there is a design area that needs assessment it is the way the aircraft can rapidly induce cognitive overload. It may be that the lack of discussion on the flight deck was caused by verbal channel overload. To go back to the start of my post: try holding a conversation with someone while carefully reading something different.

Perhaps this is the reason for the repeated 'set power and pitch' effectively saying disregard all those messages they aren't important - fly the aircraft. The implication of this though is perhaps those messages that the designers and systems engineers thought were important are not really important at all. They can actually lead to a worse outcome by overloading a flight crew that tries to listen.

What other a/c does it any other way ?

The 777 has exactly the same number of identical pitots, also feeding an airdata and FBW system that can go wrong in exactly the same way (pitch-up in cruise - uncommanded in this case - losing speed to point of stall) when fed bad air data.

There's been a lot of discussion about alternatives to pitots, but none of them are ready for production or without engineering problems.

When A and B and every other mfr are doing it exactly the same way, it is probably becuase there is (as yet) no other credible alternative.

Cognitive Issues
 

Well said.

Back then when flying i would tell my WSO to shut up. Today with my wife continously talking on the right seat in the car (we drive here on the left one) i better don´t tell her to shut up. But lately we missed an highway exit.....

Talked with someone at Air France that heard the tape : the aerodynamic noise (due to the stall) was so loud in the cockpit that the pilots thought apparently almost till the end that their speed was incredibly high.

:(

Elevator deflection conventions
 

I don't know what the standard convention is, but in Fig. 6 of this NASA report a + elevator movement results in an increased pitch down moment, i.e. the opposite of your assumption.

The negative slope of the curves in Fig. 6 indicates a stable aircraft, i.e. any disturbance which increases the AoA leads to an increased pitch down moment.

Hi,

That's what I call "a scoop leak" ... :eek:
I don't already read any of this in the press

Stall aerodynamic noise
 

We can imagine how many dB higher for the PAX near the wings. I posted earlier on the feelings of the POB. :{


Lacking reliable (and clear, direct and simple to immediately) info to understand what was going on and after hearing this noise (typical of high air speed) i ask: This may explain some NU from PF? (probably not questioned by PNF)

Excellent post, Ian. Due to the Ecam alerts and warnings, I doubt the PNF was watching what the PF was doing. There was no possible peripheral perception of a yoke moving, unlike non-AB aircraft.

Maybe the A330 shuts off the Stall Warning below 60 kt to reduce the cacophony?

Since the A330 AOA vanes can move to +80 degrees, and the output must indicate actual AOA, why wasn't any AOA greater than +30 degrees (IIRC) enumerated by the BEA?

Assertivity
 

We are here for many reasons. One of the main is for express ASAP our (professional) intuition, feelings, perception, etc. based in what we learned up today. To go direct to the "solutions phase" i prefer (decision making risk taking) first to say "there is a problem". Simply because solutions only can be found AFTER you identify and accept the existence of the problem. Before that, no motivation, no reasons to even think on the issue.

The technical discussion will be made on that. Before going into conceptual and technicalities i suggest before that, to think and answer to the posted question: "Who can tell me why they implemented this redundancy in respect to AS measurements? "

May be (we are technicians here are not with the "tools" to do that) can learn (something) from us, because the Synergy with hundreds of dedicated and good will professionals tend to generate good results by questioning, filtering, "condensing", etc. We are here in a very interesting T.E.A.M. work: Together Everyone Accomplishes More (IIRC M. Favish)

Not seeing the wood for the trees
 

No objection. I agree with you. Human factors and the "startle effect" is exactly what I am getting at.

Why don't you spend the few minutes it takes to read the BEA update rather than repeat your incorrect recollections?

There's enough people doing that as it is.

IAN-W, excellent post. It fits well with the aerodynamic noise.
Alcorfr, very sad and totally believable. With warnings all over the place and funky airspeed indications, you grab for cues wherever you can, but your interpretation of what you are perceiving, although intuitive, can be very incorrect.

The source of noise is probably the air rushing by the fuselage itself and becoming turbulent around the crown of the aircraft.

But that does not explain, the initial nose up leading to a stall.

Alpha prot law
 

Saw a post from A33Z about this:
Nuts cracked the "nut" with this:

Why does the system, not the pilot, try to maintain an AoA that is not necessary?

If the "protection" limit is "x", no problem. But the system should strive to achieve the trimmed gee ( one gee for the 'bus", as the pilots can't trim for a gee as in the other FBW system that has over 4,000 jets flying in dozens of countries) ? Pilots input commands other than one gee, to the limits, but the jet should not insist upon flying at the alpha-prot value, which is higher than necessary for most flight conditions. In that "other" jet, if you relaxed stick pressure, then it tried to achieve the commanded gee, not the alpha.

The alpha-prot should be a "limit", and not a "command" from the system.

I continually bring up "that other jet", as there are thousands more than the Airbus flying and thousands more pilots flying it. The number of LOC incidents due to sensor failures and system failures is down in the noise level considering the thousands of flights each day for the last 30 years.

just more thots .....

thank you very much PP, it needs only quite a few weaks for me, since I tried to understand the zoom climb of the AB 340, to found my question for the elevator deflection convention...... every time wondering why a pull generates lower G, and a push ends in a climb..... every thing is opposite!

http://www.aaib.gov.uk/cms_resources...%2006-2001.pdf

Redundancy concept
 

infrequentflyer789, Please refer first to my post here made when answering to A33Zab

Why not to have before (Laser AS meters*) hotter Pitot´s?

Not necessarily as i am sure you know. IMHO A and B are wrong in this important design aspect.

I will provide a hint: Redundancy works when you have elements failure. AFAIK the Pitot´s in all registered UAS cases didn´t fail. The parts (P/N#) were used in the subsequent legs/flights.

(*) Airbus SAS filed patent(s) on that as showed and posted earlier.

I am not against A or B. IMHO there is a wrong application of the Redundancy Concept for a very important parameter, the AS.

On the Airbus what are the indications to pilots that the cg has moved aft? What would be the normal for the routine fuel balancing during flight,is it on a time/distance basis .Would/could this have contributed to the extreme nose up if 'tail heavy'- I believe 29% was mentioned in long ago posts.
How would this be indicated.

Thank you.

Scoop
 

Assuming they thought is was an overspeed situation. Why select TOGA thrust? :confused:

Rhetorical question I guess but altitude also rose above 'the maximum cruising level displayed on the Flight Management and Guidance System (FMGS)' = FL360+1000ft. So I believe the aircraft was below a speed where it could maintain steady level flight which is one definition of 'stall speed', recovery required 'flying the ballistic trajectory' keeping the nose pointing the right direction to avoid an aerodynamic stall, which was successfully received in the A340.

My calcs give peak FPA around 8 degrees, so it does all add up. Interesting thought exercise - what would have happened if pilot didn't recover Normal control?

Redundancy concept
 

The answer might be in your question...........Heating ~120° C, selfregulating heater, 115V AC.

How much hotter should it be? +1 or red hot, temperature just below pitot meltdown?
What about surrounding Alu. skin if it gets heated on and off?
If you're a technician so should now. Buckling in RVSM clean area? Skinfailure due increased aging?

Not only A and B are using Pitots as measuring equipment, C thru Z are using the same, in general simple but effective system, operating flawlessly 99% of the time.

C of G
 

Hand flying Yorks, only 60 years ago, when the Captain went aft to where the toilets were situated, as the F/O hand-flying, I found that it was easier to get the aircraft to fly "on the step" with an increase of perhaps 1 or even 2 kts. IAS. When the Captain returned, the speed reverted.
Our A/Ps seldom worked and when they did they would often pump the elevator about 30 to 40 times a minute, causing our SLF to use a paper bag, while they enjoyed (?) the PURR of four Merlins.

An earlier thread suggested that S/S were very sensitive controls. Do pilots ever hand fly at cruising level? Another thread implied, if I read it correctly, that "our company forbids this."

There have been a number of references to other sources of information, like Davies' HTBJ. There may be some help to be found in D.Beaty's "The Human Factor in Aircraft Accidents." ( Published in 1969 - aircraft may have changed but not humans !)

Ian W. says #565
"... fly the aircraft..." Just as true today as it was 60 years ago, when we learned that someone had tried to do something else in bad weather...

Not rhetorical at all. Stall speeds are determined power off. The ability to maintain level flight is not part of the definition. Nothing in the report indicates the airplane went below Vs1g.
Interesting indeed. I think a simulator exercise or computer simulation is needed to answer that question. EDIT:: The airplane ultimately probably ends up in 1g flight at a speed corresponding to alpha-prot, descending or climbing depending on the thrust that has been set. It will probably do that in a phugoid (oscillatory) motion. How it does that can be established in a simulation. The important thing is: it won't stall before the pilots have finished their coffee, IMO.

What we need for airspeed measurement is a diversity of methods. Even if new technology is less robust than the pitot concept for measuring, you will be less likely to get common mode failure which is the real Achilles heel for the pitot tube systems.

Turbine D indicated that you can also get data from the engines that will be useful to infer airspeed. (The engines need to know their operating dynamic pressure too).
Since the engines have fans at the front end that may sling ice and in any case will have a different environment than a naked pitot tube, this may provide part of that airspeed diversity.

The laser airspeed systems seem to be on the verge of availability for operational use. Someone just needs to decide to build a design using them. Then we will have at least 3 levels of diversity.

Having one pitot running hot may also provide some diversity, but this may have some problems with pressurization of the system through vaporization of moisture.

These approaches all take engineering study and imagination in implementation.

Since the problem may be caused (in part) by heating (ice particles clinging to heated surfaces), maybe cycling the heat (as ice detectors do) is an option to consider?

Ian_W;

While I don't disagree that cognitive overload can and does occur (we can experience it in a demanding simulator exercise just as it may be experienced in the aircraft under a series of cascading failures resulting from a primary system failure), I want to offer a slightly different POV.

My bolding in your quoted passage:
Not just "perhaps", but without doubt, that is the key requirement in an unreliable airspeed event.

Rather than saying "disregard all those messages as they aren't important", let me put it another way: "Look through", all those messages while establishing stable flight. "Note and absorb", but do not be distracted by all those messages.

It is not that they are not important. It is that they are far less important than establishing and maintaining stable flight.

This is what I have always meant by stating that, "doing nothing" while taking over and flying manually to wait for the situation to stabilize, is an appropriate response. Such a calm response gives oneself a chance to absorb what's happening.

To emphasize as strongy as possible, stabilizing the situation to ensure the continued safety of flight is primary - the ECAM messages, (none of which required a memory drill) can wait.

Executing the UAS drill memory items as written in the UAS drill and checklist is the way to maintaining the primary goal of stable flight. That kind of crew response is NOT stated in any ECAM message or aural warning. It is (hopefully) trained for just as other memory responses are trained and checked for.

I will not say that the checklist is without its problems. It has been modified a number of times since its appearance in ~2002. I have said before and will say it again here: The UAS drill and memory items are confusing and that is a "support" factor, ('support' meaning well-written drills, checklists and procedures), which may even be relevant to this accident.

The aircraft was under control before the UAS event, pitch and power set for stable flight, notwithstanding some turbulence and a possible change in TAT.

A loss of airspeed information does not change that state. Without airspeed information the aircraft is still under control.

It will remain under control so long as that stable relationship between pitch and power and the resulting stable AoA, is not substantially altered.

Again, to emphasize, providing this stable state of affairs is maintained by the crew the series of ECAM messages, aural warnings, autopilot/autothrust disconnections does and will not change this state of affairs.

Putting it another way, stable flight is not affected by the ECAM and aural series of messages and warnings, provided pitch and power settings are set, by all means available and necessary, to maintain stable flight.

An unreliable airspeed event would be no time to make large changes in pitch or power.

The Airbus and Air France memory drill and checklist for UAS, (reproduced below for reference) which was in force at the time is cited in the First BEA Interim Report.

If safe conduct of the flight is not impacted, the UAS memory drill items do not require any immediate action by the crew when the aircraft is in stable cruise flight. The checklist requires that the aircraft be "leveled off for troubleshooting". That troubleshooting is to set pitch and power to initial settings and, under "Flying technique to stabilize speed" in the UAS checklist section, watch the results for deteriorating trends and adjust either/both accordingly.

Any departure from stabilized flight immediately takes the crew away from "known, stable circumstances". Eliminating the "knowns" makes returning to stable flight a difficult but not impossible task but one must set pitch and power according to the QRH very quickly to avoid true disorientation not in pitch attitudes or power settings but in terms of the energy state of the aircraft and returning the aircraft to pre-event values.
I address this point above, but it requires elaboration. It is not as though the designers and engineers didn't think these messages were not important, because of course they were/are.

Let us consider that there are other ways of seeing this and not just an "either/or", (as in, "either they were important or they were not"). The ARE important. But flying the airplane is THE most important priority and no designer or engineer would disagree. The airplane is not on fire, it is not depressurizing, it has not had an engine fire or failure and at the start of the event it is stable, with lots of energy. There is no "emergency" here.

So I don't think the implication (that the messages were 'unimportant'), applies in this accident.
It is not as though we dismiss the difficulties faced by this crew by setting the events they faced on timelines from which we then "armchair" our views.

I don't think any of us here doubt that these factors will indeed have been "at work" to some degree in this cockpit. But it is slowly being forgotten in this line of thought in the thread that aircrews are heavily trained, checked and otherwise supported by a very large infrastructure and are not "on their own" when it comes to dealing with such events.

Attending to surprise is not an unaddressed, foreign cognitive phenomenon in this industry. Intense training is the way a form of cognitive dissonance is addressed. This doesn't deny the normal, immediate human reaction to an emergency but when such circumstances occur, the crew is not on their own and that level of response is precisely the intended outcome of training and checking.

In other words, a crew's response to an emergency does not "begin in the cockpit" - it starts a long way upstream, the entire goal being the reduction of cognitive surprise and distraction.

The UAS drill and checklist cited earlier is reproduced below. I and others have discussed this checklist at length, mainly on the previous AF447 threads.

The first memory item is a requirement to assess the safety risk to the aircraft. This is a "bifurcation point", an if-then point which bifurcates to two different course of action. The two courses of action available are the listed items under MEMORY ITEMS in the box and the dot-pointed item, "To level off for troubleshooting".

The Memory Items in the box require that the autoflight system (including flight directors and autothrust) be turned off and then pitch and power settings be established depending upon at which point the aircraft is in the takeoff/climbout sequence. These are emergency settings which are intended to keep the aircraft out of immediate danger close to the ground.

If the safe conduct of the flight is not impacted then the other memory item is "To level off for troubleshooting". The memory items there require that the GPS Altitude be displayed on the MCDU, and that the autoflight system and autothrust be disconnected. The pitch and power settings are then listed for initial level off.

The appropriate settings indicated in this checklist for the "CLEAN configuration are: FL 200 - FL 360" > 260kts > 3.5deg pitch and 71.9% N1 in this A333 checklist. The A332 checklist (in French in the BEA Report) states "FL 250 - FL 370 > 260kts > 2deg pitch & 83.9%N1). The processes are the same regardless of individual aircraft settings.

Once the aircraft is stabilized in level cruise flight, the ECAM items would be dealt with.

The time frame under examination here is between the initial UAS event and the pitch-up event. Once the aircraft was at the apogee and in a partially-ballistic trajectory, with the aircraft pitched up at 16deg, the AoA rapidly increased as the aircraft started down establishing the stall, the aircraft was essentially doomed. There are discussions about stall warnings, THS positions and so on but at what point do we demand that the designers and engineers "protect" against such operations, without creating a host of further, unanticipated, possibly serious problems in different circumstances?

There are arguments which claim that "the computers" pitched the aircraft up, beyond the control and intentions of the crew. Despite some very interesting arguments which have demonstrated the possibility, I doubt if automated flight (the EFCS) per se, was involved in the initiating event.

If the sidestick was unintentionally moved so as to strongly pitch the aircraft up and it was permitted to exceed a pitch of 10deg and a rate of climb of 7000fpm without added thrust, and with only a few mild ND sidestick inputs, as has been observed by others who know their stuff, the swiftly approaching outcome would be blindingly obvious to any aircrew - a huge loss of energy and an inevitable rapid descent in some way or another, (stalled or high speed and a lot of altitude lost).


http://www.smugmug.com/photos/i-QrGL...-QrGLTM7-L.jpg


The notion and activity of "blame" is irrelevant at the level of this discussion intends.

In this accident we simply cannot look to the crew alone, (if at all). As we all know too well, they did not set out to "have an accident" yet an accident occurred.

A form of cognitive dissonance in heavily demanding and distracting circumstances may be one of many (initial) human factors involved in this accident but the investigation will certainly not be stopping there.

@ Gums:
 

Why does the system, not the pilot, try to maintain an AoA that is not necessary?



HIGH ANGLE-OF-ATTACK (AOA) PROTECTION
High AOA protection enables the PF to pull the sidestick full aft in dangerous situations, and thus consistently achieve the best possible aircraft lift. This action on the sidestick is instinctive, and the
high AOA protection minimizes the risk of stalls or control loss.
High AOA protection is an aerodynamic protection:
• The PF will notice if the normal flight envelope is exceeded for any reason, because the autopitch trim will stop, the aircraft will sink to maintain its current AOA (alpha PROT, strong static stability), and a significant change in aircraft behavior will occur.
• If the PF then pulls the sidestick full aft, a maximum AOA (approximately corresponding to CL Max) is commanded. In addition, the speedbrakes will automatically retract, if extended.

PJ2 - you have been rather quiet here of late but your post above was well worth the wait. Well said sir!
IT

Redundancy concept
 

A33Zab
Not only A and B are using Pitots as measuring equipment, C thru Z are using the same, in general simple but effective system, operating flawlessly 99% of the time.

Agreed, but occasionally liable to common-mode failures.

Besides working (or not), a pitot could provide an indication of its operating temperature. [Earlier posts have stated that the heating element has thermistor-like properties.]

It would seem sensible for the temperature to be monitored, and a severe-weather warning issued when it goes outside normal limits. Indicating the increased likelihood of common-mode pitot failures.

Note that does not require a new pitot design, simply monitoring the voltage and current. Obviously trials would be needed to see how far the temperature of a pitot experiencing high-altitude icing differs from that during extremes of normal operation.

Pitch and power and coffin corner
 

Ian_w and PJ2;

With all due respect to you both, I cannot fully agree with your views. In my view, disregarding ECAM messages has to do with setting priorities and the different roles that PF and PNF have at times of crisis.

I believe the prime motivation for "pitch and power" does not lie there but in flight dynamics. A string of incidents and accidents in the early years of jet transport operations led to the insight that chasing airspeed and altitude in turbulence very quickly leads to combinations of pitch and power (e.g. high pitch, low power) at which the airplane is very vulnerable to the next gust, frequently leading to loss of control. It was quickly realized that the better strategy is to concentrate on maintaining a safe combination of pitch and power, while allowing airspeed and altitude to float (within limits, of course). Since that became standard practice, the frequency of those events dropped dramatically. In my perception, the often abused term 'coffin corner' really belongs to those early years.

A33Zab,
Reading the Perpignan report, I have learned that for the 320, electric stop and mechanical stop for the THS were different.
Does it also apply to the 330 ?
Could it be that the electric stop is at 13 degrees UP ?

@ Peter H:
 

Described monitoring is task of the installed Probe Heat Computer (3x)

I realize these probes failed (iced up) more on A. than other A/C recently, while there only few suppliers (also GOODRICH had problems on these A/C).
The same design was used from launch to let say 10 years of operation without -major- problems.

So what is changed? Environmental issues, seeking the limits due operational demand, lack of training or taking more risk because sophisticated weather radar is installed nowadays?

@ Conf:
 

No, not that I am aware of.
It's nowhere mentioned in the manuals.

On ground Autotrim is disabled (Ground Direct Law) so we are unable to simulate.

IMO the THS was arriving @ 13 Up when all the speeds went off (02:11:50) due hi AOA (40) and (15 Pitch) = (60* degrees on pitot mouth) and therefore PRIMS cancelled any further THS command. (DIRECT monitoring??)

* Even a few degrees more because pitot is pointed some degrees above horizontal.