PRIM 2 to NORMAL?
 

SVARIN:
Both NORMAL LAW as ALTERNATE LAW are Nz laws, to keep it ‘simple’ you mean PRIM 1 is NOT able to compute NORMAL while PRIM 2 is capable.
Then I agree with you PRIM 2 will be in control.

And actually this happens once in a while in normal flight, our crew reports in such a case: 'Alternate Law message was transient'.
F/CTL ALTERNATE LAW did appear on ECAM and after a while (when system reverted to NORMAL again) the message disappeared from ECAM.

Technically speaking ‘ALTERNATE LAW was triggered at the start of the monitoring window and at the end the monitoring window the system reverted to NORMAL again’
A correlated failure, which triggered the ALTERNATE LAW may be present in CMC, maintenance action however is not required when crew reported ‘transient’.

When the system later on triggers an ALTERNATE LAW again the F/CTL ALTERNATE LAW warning will be set again with the correlated fault message at that time.

Back to AF447,
If PRIM 2 reverted to NORMAL the NAV ADR DISAGREE would set ALTERNATE LAW a 2nd time (at the start of the monitoring window) and that did never occur because system was already in ALT 2 and PRIM 2 NOT in NORMAL!

What we know is that F/CTL ALTERNATE LAW was triggered after (PITOT ICING) and latched to ALT 2 (due missing speed information) at the time of F/CTL RUD TRV LIM FAULT and confirmed by frozen position of Rudder Travel Limiter.
This mode is latched – for the remainder of the flight - to prevent cycling between the modes.

From the BEA report:



Agree, but doesn’t necessarily mean this set gives a more reliable outcome to the median speed calculation. On the contrary 3 ADRs is more reliable, as long as you can speak of reliable in this case, than 2 sets of signals.

I can’t find it in the documents but it could be that the logics take the amount of available ADR signals in account.

Then for this Maintenance message:

The problem area:

http://i474.photobucket.com/albums/r.../ADIRU1WRG.jpg


As preface on my argumentation keep in mind, EFCS is the complete Electronic Flight Control System and consist of FCPC1, 2 & 3, FCSC1 & 2 and FCDC 1 & 2.
When a failure is detected, PCPCs and FCSCs take operational reconfigurations and sends failure information to FCDCs, FCDCs analyzes the failure and after confirmation generates a maintenance message. The message source will be EFCSx(FCDCx) as will be the identifier EFCSy(FCDCy).
If both FCDCs are available, FCDC1 sends external and internal (ATA 27 ex S/F) failures while FCDC2 sends all failures as external to avoid double storage within CMC.
ADIRU failures are considered as external failures, however because only FCPC2 reported this failure it is rated (ATA27) internal.
Furthermore FCPC 1, 2 & 3 are interchangeable units (as long as they have the same P/N and OBRM*) only their position in the racks determines if they act like FCPC 1,2 or 3.
*OBRM = On Board Replaceable Module

There are extensive BITE* tests available in the system, the logic however is not detailed.
(Wrap Around, SSM, parity and refresh rate tests may be expected within BITE)
*BITE = Build In Test Equipment

A is not B,
In A. a wiring failure is suspected only, if BITE analysis has revealed its fault. AMM states: “As soon as there is more than one component (more than one part) in the message, A/C wiring can be suspected but it is not indicated in the messages except if it is clearly identified as being the origin of the fault.”

The failure messages in EFCS are always declared as HARD, even when it was INTERMITTENT (t<=2.5 s) or HARD due to several INTERMITTENTS during flight.

Based on this it should be considered as wiring fault i.s.o software flaw(OBRM) but can't conclude if it was of any influence (HARD) or not (INTERMITTENT) in law reconfiguration.

electrical ghost faults
 

SVARIN:


If not already done in the last 2 years,
'IRON BIRD' facility, keep left on leaving the Toulouse training centre.

A33Zab.

TO/GA input
 

From Wikipedia I find: "On Airbus planes pushing throttles to TOGA detent does all regarding flight path and speed", and in Thread 3, post # 16, I find from jcjeant the English translation from French: "At 2H10.51 this is again a stall alarm.the power levers are put on the position TO/GA and the PF keep the command to climb. Incidence angle of 6° when sounded the stall alarm continue to rise.
The adjustable horizontal stabilizer go from 3° to 13° (climb position) in about 1 minute.
He will stay in this position to the end of the flight."

I assume the reference to "incidence angle" is what Americans call "Flight Path Angle"; so my question is: "did the TO/GA selection command a FPA of 6 degrees and drive the elevator trim to full nose up to attempt to accomplish that?

I think you're a victim of Google translatese.... it almost certainly refers to AoA, and not FPA.
My apologies, but I really can no longer be bothered to spend twenty minutes to go through the French original to find the text in question AND the misleading translation, every time one of these issues crops up, unless somebody pays me.
Most professional translators will give you the same answer.....


No insult to Google translation meant... they have become a lot better the last couple of years!

ChristiaanJ:

As a fluent speaker of German I can state that Google translations, although somewhat better in recent years as you wrote, still leaves an awful lot to be desired. There are just certain nuances and ideas in other languages that suffer in translation to English.
I'm sure you know that as well.

I think I remember an avionic bay was recovered (coded name, on the wreckage map), and the QAR was (hoped to be?) part of it (or did I assume that? Anyone who know better, please correct me if I'm wrong with this assumption).
Didn't hear about the QAR since, though...

@BOAC

Quote:

---

This is so irrelevant as to be unbelievable! Please continue on the Flying Instructors' thread? What ON EARTH has this to do with AF447? http://images.ibsrv.net/ibsrv/res/sr...s/censored.gif

---

Based on two years of reading PPRuNe threads on the mishap ... pitch and power. But I get your point on maintaining focus. :O So I deleted it.

A33Zab
Lonewolf_50 again :

Quote:

---

If not already done in the last 2 years,
'IRON BIRD' facility, keep left on leaving the Toulouse training centre.

---

The post you qouted for that reply was not written by me. Perhaps Svarin?

TO/GA
 

Although the Wright brothers used angle of incidence for what we now call AOA, my question still stands; Does the GA mode also command a flight path? If so, can it use elevator trim to accomplish this? The original French is in Thread 3, post 16.

wmelvin;
Be careful when reading material which is not in context. The control law being used by AF447 at the time you refer to was not Normal Law. It was Alternate Law No.2 and pitch protections available in Normal Law had been lost.

The elevator NU command was initiated and maintained by the PF and the Trimmable Horizontal Stabilizer moved accordingly to preserve the elevators commanded effectiveness. Thrust was also PF controlled.

Check this summary of A330/A340 Flight control laws for further info.

Dassaults Lexique bilingue of aeronautical terms gives these translations:
angle d'incidence = angle of attack/incidence
angle d'incidence critique = stall angle
angle de pente = flight path angle

At 2:10:51 AoA was increasing, FPA was passing through a minimum of about 1.5 degrees up.

For what it's worth, wmelvin's question reminds me that at that point the stall warning computer (the computer exercising that function) must consider its polled airspeed to be valid, to calculate a stall warning threshold of 6 degrees. Iow the ADR DISAGREE condition occurred later.

HazelNuts39
Does this mean that all three computer must agree (closely enough) at the threshold value to get a stall warning ...
or
If two of three are polled and agree at the threshold value, you get the warning
or
If any one of the three is polled, and the value hits the threshold value, you get the stall warning?

The last seems least likely from a system's design perspective, in terms of avoiding spurious warnings.

I am trying to understand clearly the point you are making.

HazelNuts39;

I seem to remember that A33Zab had determined that it was the mean of the polled values - be it from whatever number of sources.

EDIT :: Not correct ... see posts below.

Mean & Median
 

mm43 wrote regarding redundant ADR airspeed data used by PRIMs :

Respectfully disagreeing here, the information I have says :

When THREE sources are available, median value is used. That is, for 3 values, it is always possible to order them in such a fashion : lowest <= median <= highest

When TWO sources are available, mean value is used. That is mean = (valueA + valueB) / 2.

An expression seems to be used that covers both cases, and that is voted value, which could be either mean or median, depending on the number of available sources.

Lonewolf and mm43;

From BEA's no.2, para. 1.6.11.4 (again): Here the stall warning was 6°, not 10° or 4°, corresponding to the actual Mach number of about 0.68. So one of the Mach values was valid. The 'polled' speed is what the PRIM's select to use. If all three values are valid, it is the middle (median) of the three values. If one ADR has been rejected, it is the average (mean) of the two remaining values. If the difference between the two remaining values exceeds a tolerance for a certain time, you get ADR DISAGREE. That's about the limit of my knowledge.

Furthermore it is noteworthy, since stall warning and stall do not occur in normal law, that the master PRIM was functioning in Alternate (2) law.

Svarin;

You are right. I realized after I posted "mean" that "median" also came into the equation".:)

mm43,

no worries, I thought a clear summary of that particular bit might help all readers. Hope it was clear enough. Best regards.

Svarin:

Why are you pushing so hard for a software failure above all else in the face of the evidence we have so far?

For pitot redesign folks:

Shaved bat wings show sensory hairs help manage flight

Edit: I have'nt gotten hold of the paper yet, but from the abstract: "This finding suggests that the hairs act as an array of sensors to monitor flight speed and/or airflow conditions that indicate stall."

Interesting! But although that would tell the bat it was flying near stall, it wouldn't give it airspeed. A similar technique (wool tufts taped to the upper surface) is sometimes used full scale to check the airflow over the wing in stall tests to see at which bit the airflow first breaks down.

Those who cannot remember the past ........
 

Svarin;

Thank you for the clear explanations and responses.

I think I have a better feel for what you are saying.

First, you say, "It is however unfortunate that ADR2 data and associated RHS airspeed was not recorded on FDR..." We cannot say beyond what the BEA has said, what is and is not recorded but we cannot conclude that because the Airspeed to PFD2 is not recorded that the balance of ADR2's output parameters are not recorded. We may optimistically wait and see. The QAR was on the large electronics bay called "800VU" which was brought to the surface. Among the FCPCs, FCSCs, FMGECs and so on is the DFDAU/FDIMU and QAR recording unit. We can hope for the best. Also, there may be some information which can be retrieved from the EEPROMs of these various units - we just don't know yet.

On your theory, please allow me to re-phrase to see if I get it: - You are claiming that one PRIM remained in Normal Law due to a rare timing and rogue programming issue while two others reverted to Alternate Law, ("All three PRIMs are 99.9999% of the time in full agreement. Not this time."), and that PRIM2 which "remained in Normal Law", ("At 02:10:16, the pitch-up sequence and "zoom-climb" happened with (according to my research and "flimsy theory") PRIM1 & PRIM3 in Alternate 2 and PRIM2 in Normal."), was "in control", (do you claim it was the "Master FCPC"?), and pitched the aircraft up in a response to a false high speed, (High Speed Law) and it is this, not the side stick being pulled back, which led to the stall?

I understand that you are claiming this even though a different PRIM which was in Alternate Law, was also sending orders to the flight controls, ("Occam's try on these hypotheses is the triggering of an undesired normal law (full authority) overspeed protection by PRIM2 only which uses erroneous airspeed data after having unexpectedly returned to Normal law.

Further, might you be claiming that the reason that the Stall warning functioned "as designed" is because at least one PRIM was in Alternate Law?

I welcome a correction to my understanding but there are problems with the theory.

Much of this is beyond the limits of my own knowledge of the airplane but I can't imagine a flight crew permitting such autoflight behaviour without resisting it by pushing against the pitch-up because anyone who flies these aircraft knows what's about to occur next if the pitch up is permitted to continue. In Alternate Law the pilot can resist the pitch up due to high speed protection; in Normal Law this is resisted until the overspeed no longer exists.

The BEA states that the pitch-up was caused by a side-stick being pulled back. We have good reason to take that at face value until the next Interim Report because at some point we're going to have some actual data to examine and the BEA know it.

There is always the possibility of other explanations but the burden of coherence rests upon the proposer. If I understand what I have read, the EFCS Priority Logic ensures the operation of a Master PRIM by rejecting FCPCs/FCSCs which have failed their BITE test.

Any "partial input/control" by other than the Master FCPC is prevented "by design". And if "shared control" actually occurs between PRIMs, (one in Normal, two in Alternate), then there is a second problem beyond the fault in one of the PRIMs which returned it to Normal Law and that is the Priority Law which is permitting one PRIM in Normal Law and one or two PRIM(s) in Alternate Law to in some way, both send orders to the flight controls.

I think such a twin failure is highly improbable, especially in the face of the available information.


The theory must reconcile the comment from the PNF about "Alternate Law", (but not the AP disconnection), and the Stall warning which would not have occurred in Normal Law (as observed by HN39). As stated, while the pilots cannot counter a pitch-up order in an overspeed response in Normal Law, they can in Alternate (VMO2) Law. Instead, the side stick was almost always pulled back.

I think we need to re-focus on why the side stick was pulled back after a stall warning and why it was held fully back for thirty seconds while the aircraft was on the way down at >10,000fpm.

A shift in thinking is not intended to focus on the crew. Most here on the thread know by now that such events do not occur in a vacuum and instead have antecedents long before the actual event. It is up to the investigative body to determine how and why these pathways and factors came together.

The point has been made many times and has again recently...how are we to deal with the #1 cause of transport accidents including fatal accidents: Loss of Control?

What is it about the thousands of crews who fly these aircraft, wracking up millions upon millions of hours and miles uneventfully, that is absent in a few, extremely rare accident?

Leaving aside formal accident reports, (where accident reports have been done and made available...), what do we intuitively know for example about the Airblue A321 CFIT accident at Islamabad, the Afrikiyah A330 LOC accident at Tripoli, the Gulfair A320 LOC accident at Bahrain, the Armavia A320 LOC go-around accident at Sochi and the XL Airways A320 at Perpignan, that can help us place the causes of LOC into perspective and decide what way to go, even if "on the way to somewhere else"? Is it really merely the loss of flying skills or a psychological passiveness, a "non-involvement" with the machine, or is this just a training issue?

There are a number of papers available in this discussion. Some use mathematics which are beyond all readers except specialists but some authors such as Perrow, Reason, Dekker, Helmreich, are very accessible as most here will know.

My suggestion is a broadening of focus in the face of the signficant breadth of expertise on this and the previous threads. I do not believe that the answers to our questions about this accident lie in a detailed comprehension and tracing of the EFCS even though such may be involved in understanding what the crew saw and how they responded. The question is how and why so many transport aircraft accidents have resulted from a LOC followed by stalling the aircraft.

It is my understanding that a "Stall Warning" can occur in Normal Law i.e. it is not "inhibited". It should not be triggered, since the high Alpha protections should keep Alpha short of it, but should they not be able to, then the Stall Warning will occur (as it did in Perpignon).

i.e. I don't think one can read that a "Stall Warning" = "Not in Normal Law". One can read that for a "Stall Warning" (at least) one AoA probe is seeing an AoA that should not be achiveable if Normal Law is functioning and able to control AoA.

From the final report on Perpignan:

Snap ;) From the final report on Perpignan (p97):
Specifically:i.e. the Stall Warning started in Normal Law, ~10s prior to the change to Direct law...

Thanks NoD for that clarification. Sorry for not reading the whole report before posting.

HN39...

No problems... I just recall when I first read it my eyebrows raising, since my training had led me to believe it was an Altn Law thing.

Of course, this is an A330 (PRIM), which might differ from the A320 (ELAC), but I doubt it does in "concept"?

Shaved bat wings show sensory hairs help manage flight
 

Cogsim,
Free downloadable version of this paper at:
http://www.eurekalert.org/jrnls/pnas....201018740.pdf

Quote from wmelvin:
Does the GA mode also command a flight path? If so, can it use elevator trim to accomplish this?

Haven't been following this thread for some days, so have a lot of catching up to do. But, in case it helps, I think you are referring to an AP/FD function, not an FBW function. On a normal go-around, when the FD is available or already selected, the FD mode changes to "SRS" (speed reference system) as soon as the pilot selects TOGA thrust. (This is announced to both pilots by the FMA-indicators at the top of their PFDs, which show "TOGA/SRS/GA TRK".) SRS uses pitch commands to achieve the IAS appropriate to the configuration. When either the PF (using sidestick) or the AP respond to the pitch commands, the FBW system will control elevator, backed up by autotrim, as required.

Guess I don't have to remind you that the FDs/APs were no longer available on AF447 at the stage when the PF selected TOGA.

But the FDs may have automatically re-engage a dozen seconds later when ADR3 came on line again with coherent airspeed. In what mode would they re-engage then (the throttles being in the TOGA gate) ?

NigelOnDraft;

Found another tidbit in BEA's 2nd report, where it discusses thirteen reported events of UAS. What do you make of this:

HN39 It can be interpreted in a number of ways.

A Stall Warning in Normal Law "needs" some explanation. The Warning is available IMHO (see above), but it should not be triggered due Normal Law's protections - so if it is triggered in Normal Law, a further malfunction or control problem would appear present. The "explanation" at Perpignon was frozen AoA probes. These 13 other cases did not need further "explanation" since the aircraft was in Alternate Law - and as it goes on to say, it is sensitive to control inputs - the 'Stall' trigger AoA is low at high M number.

NoD, HN39;

It is difficult to be definitive with the available information, but according to those tables that A33Zab posted here, (table reproduced below) for the A330, the stall warning will occur in Normal Law but not until the Maximum AoA = 23°.

So it is indeed possible to have a stall warning in Normal Law but not until a maximum of 23°, is the way I read the statement beside the "IN NORMAL LAW" qualifier. Perhaps these tables represent the "phase-advanced AoA's" referenced in the AIRPROX AAIB Report.

I don't know whether the A320 stall warning system behaves same way but there is some reason to believe there would be similarities.


http://www.smugmug.com/photos/i-Qr5x...Qr5xMMw-X3.jpg


I could not determine what the numeric values in the table below Table A meant but in discussion they likely are entry points into Table B. That said, anything "> 200" has no correction from Table B.

Quote from PJ2:
"The BEA states that the pitch-up was caused by a side-stick being pulled back. We have good reason to take that at face value until the next Interim Report because at some point we're going to have some actual data to examine and the BEA know it."
[my emphasis]

Quote from PJ2:
"I think we need to re-focus on why the side stick was pulled back after a stall warning and why it was held fully back for thirty seconds while the aircraft was on the way down at >10,000fpm."

Quote from BEA Update (2011-05-27):
"The altitude was then about 35000ft, the angle of attack exceeded 40 degrees... [...] The aeroplane's pitch attitude did not exceed 15 degrees... [...] The airplane was subject to roll oscillations that sometimes reached 40 degrees. The PF made an input on the sidestick to the left and nose-up stops, which lasted about 30 seconds."
[my emphasis]

That last sentence, taken at face value (noting PJ2's first comment quoted above) is almost incredible. The beginning of the 30-second period seems roughly to coincide with the THS reaching full-travel (13NU).

It will be interesting to see what change in AoA took place during the 30 seconds, and what change(s) of bank. One would expect both to be considerable, yet there is little to suggest that is what happened.

My proposal is that the EFCS (FBW system) had already applied considerable up-elevator to try and regain 1G (in Pitch-Alternate Law without protections).

However, full aileron and roll-spoilers being required (in Roll-Direct Law) for 30 seconds, to level the wing, is a different matter.

Peter H
 

Thanks for the link. Downloading it now.

Airbus Presentation
 

Somewhat old news, but this appeared in the Flightglobal Paris Airshow site.

http://xa.yimg.com/kq/groups/1048360...0Procedure.pdf
From the Floght global article:
P.S. Note the AOA display on the A-380:ok:

Loss of control and AF447
 

A previous contributor brought up “loss of control” as a major cause of crashes. Hell, it's the only cause - act of God ( microburst on short approach or a mountain wave rotor), pilot unable to handle the aircraft's capabilities ( e.g. gee-loc as we saw in the Blue Angel crash awhile back), poor airmanship (e.g. CFIT or poorly executed approaches in bad weather or worse, the Buffalo crash), etc.


What bothers this ol' pilot is the situation where the aircraft itself becomes the problem facing an airman. I specifically refer to the concerns several of us have with respect to the Airbus control laws and “protections”. And BTW, I really dislike the term “protections”, and prefer “limits” when characterizing an aircraft's capabilities to perform the mission, or most importantly, “limits” imposed by FBW systems that seem to me to be more appropriate for autopilot assistance than basic airmanship. If we're too poorly trained to do the approach or cruise or climb without an autopilot, then what in the hell are we doing hauling the SLF's about?


Make no mistake, I flew mostly by myself and used the autopilot a lot ( when I even had one, heh heh) to reduce workload and “assist”. I did not use it as the primary means of flying the mission. I also did not completely depend upon the “limits” designed for the aircraft, and kept my OODA loop very active.


So I joined this discussion when initial findings were made public two years ago that AF447 did not auger in as we usually see with a “death spiral” or loss of control surfaces or even a spin. The impact description reminded me of the situation we encountered 30 years ago with my little FBW jet once discovering that all the “limits” to “protect” us could be overcome by doing things the designers never anticipated. When the AF447 wreckage was discovered, and the latest findings were made public, I became more convinced that the aerodynamic characteristics that likely existed at impact and for some time before were the same as our pilots faced long ago.


So what's the point, Gums?


I see a design that appears more like that of a drone then a plane with a crew onboard to fly the thing when sierra happens. I see a design that provides conflicting warnings to the humans and invokes a myriad of control law reversions due to a relatively well-understood sensor failure. I see a design that continues to “protect” the humans trying to pilot the thing when “normal” flight conditions do not exist. I see a design that has not considered the possibility of the aircraft to reach an aerodynamic condition from which recovery is almost impossible, especially with all the “control laws” I seem to understand a bit better after reading all the stuff here.


I shall not understand the crew actions we have been made aware of, but in the end, I shall ascribe a significant portion of the “cause” to the aircraft design.


Respectfully,

Gums, Sire,

I note your considerable contribution and experience.

Many, many years ago I flew F4s and other stuff before discovering the amazing Airbus aircraft.

I have about (320 and 330) sixteen years' time and have not been killed so far. Many pond-crossings and visits to the Caribbean/Canada/Far East have failed to down us.

Don't you think we should have fallen victim to the 'design faults' by now? Or, was I living on borrowed time?

fantom - perhaps you should consider how long the AF447 Captain had been flying AB and with your obvious statistical view of accidents, whether you will retire before the reaper gets you too?

Design
 

Gums:

Maybe that's the wrong point of view?
The design is not different than any other design, it's in basic a design like any other and has to be flown like that. Forget about the laws and protections they do not fly this design, the Pilot (assisted by AP) is in control just like any other design.
This tragedy could happen due to sensor failure, which are used on any other design too.
The failure of these sensors fooled AP, Protections AND human.

gums,

Here I respectfully disagree.
What I see is an aircraft that has stopped protecting the humans and sadly with the known consequences. In protected law (read Normal Law) this would likely not have happened. Unfortunately there was no Plan B for the protections and so they quit subsequently putting all eggs in the basket of the Pilots.
Reading the bits n'pieces we have it appears this handover of the eggs didn't work well. The pilots occur to have been surprised when they found the eggs in their basket. This is where I think closer investigation is warranted.

I'm still not convinced of this. We do not have sufficent information to be safely able to deduct this from my PoV.
But even if it would finally turn out that the condition was unrecoverable at AoA = 60° it has to be noted that the Aircraft shouldn't have been at this AoA in the first place. Once your 200t Airliner is at Aoa =60° all bets are off anyway. And that statement I would make for all makes and types of Heavies.
These are neither Christen Eagles nor F-16 which are designed for extreme maneuvering. Try this even in a simple piston twin and chances are you're equally dead.