@RR_NDB:
 

Unfortunately ADR 2 (RH PFD) is not recorded.

As mentioned in PAR 1.11.3 Interim report #3 the non-volatile memory in the salvaged computers
could give some more information.

From the FD engagement FDR traces and the information mentioned by HN39 (Page 44),
a little information about the status of ADR2 can be extracted.
(as far as I understand the sytems)

Before that one should know that a FMGEC needs at leats 2 valid ADR inputs to engage the FD.
-besides other AP/FD Common conditions -

Before @02:10:05 AP2 was engaged, this means (by engament logic)
FMGEC #2 was master, #1 was slave.
@02:10:05 AP drops off, Air speed of ADR 1 and ISIS(#3) are normal; FMGEC switchover is visible at the peak in FDR trace (FD2).
Suspect ADR 2 was the median speed at this time and lost (also due to other events at this time)
~02:10:10: Both FD (FMGEC) not available, also ADR#1 60Kts and ISIS(#3) 140Kts are to far apart.
~02:10:20: FD's available because ADR#1 and ISIS(#3) are nearly the same (but wrong) value 90Kts.
~02:10:25: FD's for a brief moment unavailable (although ADR#1 and ISIS(#3) are nearly equal (but wrong) at 110/100 Kts.
~02:10:30: FD's available, ADR#1 and ISIS(#3) in agreement (still wrong). Status ADR#2 (RH PFD unknown untill:
@02:10:40: There's a peak in both FD FDR traces, meaning they both switch over to
the other FMGEC, ADR#1 and ISIS(#3) are far apart, this means ADR(#2) must have been available again and its value in agreement with ADR(#1) = 215 Kts OR ISIS(#3) 120 Kts,
to become the 2 valid sources for FMGEC.
Unfortunally at that time they switch over to ADR#3 as faulty source for RH PFD!

From 02:10:47 untill 02:11:35 ADR#2 must have been available but not displayed on the RH PFD.

~02:11:45 the captain is entering the cockpit and would have seen 35 Kts on the LH PFD, 0 Kts on ISIS and SPEED FLAG on RH PFD.

After that all the speed indications where going up and down, FLAGS etc.

BEA testing software
 

@ChristiaanJ
I understand your argumentation, and I don't want to worry anybody.:hmm: But today our forum wants to understand what was wrong in the AF447, and the Crew actions seem so crazy, that we must get sure that nothing wrong stays in the first levels inside of inside ... and that the BEA will be able to search the solution (if exists :rolleyes:) there too .

Re: RHS not recorded
 

Yes, before switching to ADR3 the speed information displayed on the RH PFD will be 'unknown'. thereafter the information could be extracted from ISIS (share the same Pitot and static lines).
Was he following -wrong- FD orders, when this was available?

No, LH and (ISIS or Standby) are recorded.*

*Edit: BEA#3

Quote:

---

 Speed parameters

The calibrated airspeed recorded in the FDR is that displayed on the left-hand PFD, unless it is invalid
(if the speed is less than 30 kt, in which case the SPD flag replaces the speed
scale).
In this case, the airspeed recorded on the FDR is then that displayed on the righthand PFD.

---

Yes. PAR 4.3 of BEA Interim report #3

See previous post, I guess somebody can derive - possible FD orders-,
out of information from FDR traces.

I don't know.

"Flying the FD" (FD commands are computed in exactly the same way as the AP commands) just after the AP has disconnected seems, to me, the height of folly.
I hope pilots are aware of that.... several posters here seem to not understand that.....

Actually the 'FD commands' immediately available after an A/P disconnect under normal circumstances are intended to be valid. That is how you would normally transition to hand flying the aircraft.

A/P disconnect was not the cause of any erroneous or misleading FD commands. When the A/P disconnects as a result of 2 or more ADR's going on the 'fritz', the FD's are automatically removed, but the buttons NOT automatically deselected (even the light in the button stays on).

It's the intermittent default FD commands that that 'pop up' in a UAS situation like this that are not to be blindly trusted. That is why, in the interest of avoiding this source of confusion, the FD's are to be deselected manually in an UAS situation.

There are other situations, e.g. PRM breakouts, where the FD's are deselected, because the existing or default vertical guidance may not be compatible with the PRM breakout procedural requirements. Has nothing to do with the A/P being disconnected. Has to do with being a pilot.

This is not your "grandfather's" FD-109.

Oke, howdy.

For the thick and the less than quick, like me, what do you have to describe as to the initial PF inputs post a/p? Bonin 'saw' (via BEA) ND and RR, to which he responded per report. PJ2 early on initiated a very important discussion that weeded out most here as to what the manual response should have been, eg, do nothing, maneuver, or deselect FD, and call the book. Arrest any poor trend? Attitude, Airspeed?? Pitch/Power?

I think, imo, Bonin did the right thing, which evolved, for reasons as yet undetermined, into a "climb" into the sea. There is a beginning to everything, where do you sense this point to be? For instance, the VS was "selected" by the a/c, at 5000fpm down. Since the a/c was rolling to the right, I assume the a/c was commanded so by the a/p, or the airmass was insinuating itself into the flight path. What gives?

Howdy Lyman,

I'm only speaking to the way the system works.

I have no idea what motivated the PF.

(The FMA is your friend. :))

Transient in Feedback Systems (I)
 

Hi,

Feedback loops are designed (and potentially capable) to improve a System.

For example, the AS probes in auto mode receives just the required electric power.

Feedback loops are designed with "time constants" and eventually with techniques like hysteresis. The engineering takes into account essential aspects like stability, etc.

I posted some comments assertively saying the AS probes the industry is still using, are "subheated".

I am based in several facts and i can discuss each one when necessary.

I have six questions to the Pilots (daily facing UAS threaths) and to the Technicians here:

1) Is the power being applied to the AS probes enough in order to their proper operation?
2) The delay between a sudden atmospheric temperature drop and the "reheating" of the probes could explain the "failures" leading to UAS?
3) The differences between US and FR probes may be explained by "different" time constants?
4) Is the max power sufficient to provide a safe operation in most environments?


5) Is there "recording capability" in current Systems in order to analyze the UAS incidents more precisely?

6) Could be better to enter WX using MAX instead of AUTO? (Operating "open loop")?


This content i posted first in another thread related to AF447.

Subheated AS probes
 

Hi,

One may ask:

What is the importance of this issue?

AS data affects the Stability of the System.


The importance is clearly recognized by the Designers in applying triple redundancy.

IMHO is unacceptable the FACT they are "failing" almost SIMUTANEOUSLY.

Redundancy is not the solution to elements that "fail together"

IMO this configures a SERIOUS and PERSISTENT "DESIGN FLAW" or even, ERROR

AND VERY PROBABLY WILL BE CONSIDERED THE TRIGGER OF AF447 CASE.

The industry was receiving persistent warnings on this and the crew of the previous incidents were capable to deal with and landed.

Murphy Law in this case used the "industry failure" and put other slices of the cheese in the "proper alignement" :sad:

I do not agree

Redundancy is more than duplicating a single system (even though there are multiple similar components). It also considers multiple systems which can take over and mitigate the failure condition and still provide safe flight and landing.

Redundancy
 

Hi,

Quote:

---

Redundancy is more than duplicating a single system (even though there are multiple similar components). It also considers multiple systems which can take over and mitigate the failure condition and still provide safe flight and landing.

---

I fully agree with your comment above!

Please, clarify where is the discordance. Component level redundancy? Module level? System level?

F-GZCP last flight
 

Hi,

Quote:

---

Redundancy is more than duplicating a single system (even though there are multiple similar components). It also considers multiple systems which can take over and mitigate the failure condition and still provide safe flight and landing.

---

Did F-GZCP provide the resources to?
.
.

Did the man-machine interface provide the tools to allow the crew to even understand TIMELY the first priorities?

RR NDB

ans. System level

That is the most important part of the investigation's report to provide comparitive prevention strategies (in any aircraft) via system design and/or training against a repeat accident where airpseed is temporarily lost for any reason.

If the redundance is at system level, and the three sensors are identical, redundancy is absent.

Thales had corrosion problems at the drain, I do not recall if they rose to the level of AD. Regardless, the probes performed sufficient to satisfy the certifications protocol, and that is acceptable. After the fact does not obtain to this crash.

Redundancy had thorough airing in BA038, where BOTH engines failed, within seconds of eachother. The Heat exchangers were found to be of insufficient design. Instead of changing engine manufacturers, the Heat Exchangers were modded. An AirSpeed sensing SYSTEM that relies on three identical probes is a single system. IF there are mitigating procedures that can provide AS in a transient system failure, well and good. However, focussing on the probes only is missing the point at large, eg: system FAIL.

Probes as the trigger factor
 

Hi,

Quote:

---

However, focussing on the probes only is missing the point at large, eg: system FAIL.

---

Your comment and the one from lomapaseo motivates me to say:

A probe "failure" exposed a much more serious issue at System level.

:}

HHi RR NDB.
 

I would suggest further, that in this particular case, had only ONE Pitot tube been installed, the outcome may have been different.

One only need review the computers trail, the Pilots' confusion, and the lack of a co-ordinated plan to conclude that in this case, had the system failed completely, directly, (and REJECTED, with prejudice) in transient fashion, a single probe would have come back alive and been correct, no "voting", no indecision?

The AS system here seems over-reliant on decision making made at the electronic level, excluding the handling pilots, and causing delay.

At the least, had a separate "system" been installed, one that had a shrouded probe that came alive when the first failed, a new and reliable sense of AS would be available.

The focus on redundancy is a fool's errand, when a "sequential system(s)" is a separate and independent source. Even BUSS fills this need, a separate system, one that can replace indefinitely a system that causes problems whilst one waits for it to become reliable.

The longer these UAS events pertain, the more foolish the authority appears.

Lyman sayeth:
All I have to say is that it's a damned good thing there are two wings!

Bureaucracy
 

Hi,

Quote:

---

The longer these UAS events pertain, the more foolish the authority appears.

---

Bureaucrats are prone to be lazy. Their "time constant" are much bigger than the good Technicians SELF MOTIVATED. :}

PS

Kelly Johnson put an angel to fly in 60 days. Yet taxiing:

The sailplane-like wings were so efficient that the aircraft jumped into the air at 70 knots (81 mph)

Hi Organfreak

At some point, system utilization must merge, or we end up with something, you know, Rutanesque.

Some would have said (and still say) "Thank GOD for two TRENT700s. (BEA038)." Where the neck narrows, there is the executioner's blade.

RR NDB. (re Kelly Johnson). Where are these giants today? Gone. What we have left are committees, ffs. risk/benefit. Over-reliance on the ability to disappear and blame others. COMMAND? gone.

Captain Hank, on his Stratocruiser, "This is not a god damn Democracy!"

Shrouded probe
 

Hi,

LOL,

I am sure the issue can be fixed without this...,

LOL

Anyway i maintain what i did write earlier:The design (in respect to AS) seems ridiculous

And maintaining this during many years was the trigger for System stability issues at that night *

(*)

K.I.C.S. Keep It Complex Stupid

M.I.C.S. Maintain It Complex Stupid

@RR_NDB:
 

Let's assume there is another - more reliable - system available.
wouldn't it be a great idea to have 3 or more of them iso 2 or 1 less reliable, just because they should not be identical?
They are still operating in 1 and the same environment.

Don't want to suggest the probe was reliable but there have been several modifications and upgrade options available before and since.

I agree with PJ2, just sit and wait (30 sec.) is proven to be the best strategy in case of UAS.

Even better would be no UAS at all. It probably is achievable.

Hysteresis
 

Hi,

A33Zab

PF applied large stimuli to the plane.

Quote:

---

I agree with PJ2, just sit and wait (30 sec.) is proven to be the best strategy in case of UAS.

---

We may say this "technique" is an "hysteresis like" one. No reaction (in the loop) until a given threshold. In absence of other solution I AGREE this is WISE.

Quote:

---

Even better would be no UAS at all. It probably is achievable.

---

As a researcher i have to remove the "probably" in the phrase.

And i am not not focusing on the probes. I look to the System.

The whole "processing" of the probes data IMO should be reviewed.

As i understand the a/c operation degrades EXACTLY when you need most.

Who knows what PF saw in the transitory, just after AP quit?

But this is to be covered in another post i am preparing:

Transient in Feedback Systems (II)

System, PIO, Transient
 

Hi to all the pilots and engineers,

I feel a great progress has been made with the help of these forums.

Despite existence of FBW, automation was still missing in the closed loop system "Pilot AND Aircraft":{. We pilots were not really ALLOWED to use these words "system", "PIO", "transient", "unstability", and we were not allowed to think them, to fly them... :\

Despite the best place in the armchair (on the ground) is on Lieman airlines (with 2 or 1 pitot tubes and no redundancy :* ) a great step [correction : flight] has been done to a new aviation with Machinbird and RR_NDB.

Thank you to both, the first as pilot, the second as system engineer
who have overcome the taboos, without falling into dreams.

While RR_NDB is working on his next concept, let me throw out one of my own.
There is no doubt that the best course of action with UAS in cruise is to do nothing while you size the situation up. With a little more smarts in programming, the flight control system could do the same thing.
Process runs like this:

• Oh Oh, lost the airspeeds!
• Wait, we are in cruise, instructions say do nothing and warn the crew that they may have to take over.
• Power table lookup says cruise power for current flight environment is X, set power to X, maintain Normal law.
• Monitor airspeeds to see if we can get a valid airspeed.
• Airspeeds agree on 90 knots? Not in the acceptable range-disregard.
• Airspeeds now say 271 knots. In acceptable range. Advise crew that we are resuming normal control.
• End of allowable dead reckoning period (where control would then pass to the crew).

How you handle loss of airspeeds in climb and descent could probably be handled pretty well with a lookup table as well. That only leaves Approach and the transition right after takeoff to climb speed.
Can they build this reasoning into the computers? Can they certify it? If so, most of the problem is solved.

Hi Machinbird,
Yes & yes they did.
It's called QRH Unreliable Airspeed tables and the central processors are organic.

Yes, but you have to wake up the organic central processors. Sometimes they use the wrong programming, sometimes they are slow. sometimes they jump to the wrong spot in the instructions. Lets keep the organic computers in the situational loop, but give them a chance to come up to speed before they are put on the line.:}

@Machinebird:
 

Do you advocate to remove all organic material from cockpit?:O

Good sense of humor A33Zab.:ok:

At the rate they crash drones, that is not going to happen any time soon.

Very attractive at first sight. We just have to settle on a few details of implementation:
(1) Oh Oh, lost the airspeeds! >>> Based on a single speed (the median)?
(2) Wait, we are in cruise, instructions say do nothing and warn the crew that they may have to take over. >>> Do you mean what the system currently does - maintain current pitch and power and sound 'cavalry charge' - or keep A/P and A/THR engaged, so that A/THR will increase power to Max CLB?
(3) Power table lookup says cruise power for current flight environment is X, set power to X, maintain Normal law. >>> Maintain Normal law means maintaining protection for high AoA and overspeed. Both will not function when IAS drops to low value. High AoA thresholds at low IAS are too high for protection at cruise Mach. There will be no stall warning.
(4) Monitor airspeeds to see if we can get a valid airspeed. Airspeeds agree on 90 knots? Not in the acceptable range-disregard. Airspeeds now say 271 knots. In acceptable range. Advise crew that we are resuming normal control. >>> What is the 'acceptable range' ?
(5) End of allowable dead reckoning period (where control would then pass to the crew). >>> What happens here? Isn't the crew always in control within the flight envelope?

P.S.
What I agree with: When the system drops A/P and A/THR, it could initially set pitch and power corresponding to level flight in still air, and maintain wings level.

As soon as the system cannot figure out which one of the speeds, if any, is "telling the truth."
Keep A/P and A/THR engaged so that A/THR will be able to set the lookup table power.
Maintain Normal law means just that. Plug in last valid airspeed and Mach number. Live and die by that. This is a dead reckoning exercise. How long you feel you can safely fly while dead reckoning the airspeed determines the period before you dump control to the pilots. This is likely the key certification issue. 3 seconds sure, no big deal. 20 seconds yeah, why not. 60 seconds, I'm beginning to get uncomfortable. How did we fly in the old days before autothrottles anyway? I can tell you I was not jockeying the throttles in cruise.
To be determined by test flights or using existing criterion if deemed acceptable.
This is where you play the cavalry charge if no valid airspeed is found. A/P and A/THR drop.

Ref. Post Mar 4 @ 13:07 by Machinbird
 

Hi,

Sounds as an evolution:

1) The "wait and see" ("hysteresis") has a time out.
2) The "Organic processors" would have some time to prepare carefully to enter (and act) when "inside the loop"
3) The "graceful degradation" of System + crew is improved during the transient (when the System is being affected by the disturbance)

Fine biz!

Machinbird;

Re, "As soon as the system cannot figure out which one of the speeds, if any, is "telling the truth." "

It doesn't need to. A power setting and pitch attitude is all you need and as someone suggested here, a recent history if the automation is to do it, (but no thanks!). Speed indication is now irrelevant. An AoA would help but it isn't necessary.

As discussed by Owain Glyndwr and to HN39's point regarding autoflight system programming when the AP and AT drops offline, the A330 fails/failed 'gracefully'. When disconnected by the airplane and by the instinctive disconnect buttons on the thrust levers, the autothrust reverts to the thrust-lock mode, maintaining the power setting at disconnect.

Almost all the time the thrust is appropriate. Here, the thrust had dropped slightly but to no short-term effect.

The checklist requires that the autothrust be disconnected, (press the AT button on the FCU or the instinctive buttons and THR LK is removed), then move the thrust levers out of the CLB detent and set thrust according to the tables. About 88% N1 or 1.2 EPR would be a good start, if I recall.

In Alternate Law pitch must be manually controlled so there is perhaps room for some form of "maintaining pitch" but I think this is taking automation precisely where we don't want to take it..."more", to cater to reduced thinking and skill levels.

The airplane is eminently flyable at cruise altitudes even in heavy turbulence, (done it...it's like any other airplane including the DC8)...tiny movements on the stick, (or control column), wait..., set the thrust, wait..., read the checklist, wait for the airspeed to return, as it did within 30 seconds in all previous events. And if it doesn't then complete the checklists, ECAMs, STATUS pages and secure the aircraft for manual flight, call the captain and decide whether to return to RIO (or..?) or continue.

RR_NDB, this response isn't "the academice ideal", this is what crews are trained to do and is absolutely middle-of-the-road SOPs. That it isn't done sometimes is not a counter-example argument for a sense that this is "expecting a lot", nor is it an argument for further-reduced standards and more automation.

In climb/descent and except for close in approach (when dirty), one levels off, and does the same thing. The powerpoint presentation to which Turbine D provided us the link is a superb explanation of the "new" (2006) process. The powerpoint referenced by Turbine D is at http://www.iag-inc.com/premium/Airbu...ableSpeeds.pdf

BTW, I quite appreciate that typing this stuff out is SO much easier. Like others here I'm sure, I've had a few "events" and they are never straightforward and the adrenaline always comes.

Artificial Intelligence is not KISS
 

oh I have severe turbulence... :uhoh:

Oups ! I was just turning to avoid the mountains in the clouds...:{

vocabulary
 

Thank you to allow us to speek non-linear systems, transitory stages during the flight, closed-loop systems, normality of oscillations, pluridisciplinarity knowledge, etc.

Could we generalize the use of "effective :) aircraft" or "effective :)system" to refer to the system (pilot & aircraft) ? I find it very clear to the mind, without excessive simplification.

Congratulations for your next speed sensor. Did Pprune already found a manufacturer for your many inventions : I am impatient to see the advert !

Monsieur Henri Pitot will soon be allowed to sleep... :suspect:

Yes, it is a leap from armchair to RHS in Bonin's shoes. Since BEA have not issued their Final, it is disconcerting to see so many verdicts of guilty. For that matter, BEA will issue data, and will not condemn. The data may, but BEA is not charged to place blame.

My over arching beef with the investigation is the length of time they take. Also the slim releases of data. To me, it is not for science, but for politics. Time not only heals, it shelters. When the stage has been arranged so completely with damning evidence, one wonders if it is a true picture, or merely a cynical attempt to protect some survivng interests.

PJ2, I am not sure you understood the intent of the procedure I posted. Its purpose was to basically outline the key functional elements of a computer program that would ease the transition between Normal law autopilot controlled flight and Alternate Law, pilot controlled flight. Rather than drop the aircraft into the pilots lap all at once, the transition could be spread over some time.

I know that pilots worry about their job security when computers are performing things that pilots consider their turf (such as emergency procedures.) I also know that sleepy pilots in cruise in the middle of the night can be slow to come up to speed. Best move is to provide all possible assistance to make the transition as painless as possible. If you get a little help doing your job, it isn't a bad thing, as long as the automatic help does not make things worse. 9 times out of 10, you will be alert and the help won't matter. It is that other time at 2:05 in the morning that you might appreciate the help.

The key thing to recognize is that the aircraft could probably handle the complete UAS procedure by itself for a period of time, assuming proper computer programming. The A330 is a fairly early version of Fly By Wire and despite its great success, does not mean it could not be made better. We need to pick out rough spots in the man-machine interface and improve them. This may be one of those.

That suggestion raises a deep sense of distrust in pilots that believe that when the automatics "fail", their own ability to take-over should not be questioned.:{

I'm not disputing that point, but when you are the air-frame manufacturer, your profit margin goes down the "big white telephone" every time someone stuffs up in that department. In that respect, I'm pretty sure that Airbus Industries will be moving (limited only by the time taken for regulatory approval) to do just as you suggest.

Perhaps I could refresh your memory to something posted eons ago in AF447- Thread No.4. The wording might be different, but the intention is just the same.:ok:

Yep, it was a good idea then and is still a good idea. :ok: This type adaptation of the FBW system is appropriate to improving the human interface.

The idea of the system suddenly shrieking, "I don't know how to compute this, YOU have it." rubs the flight instructor in me the wrong way.:*

Looking back at an earlier post makes me wonder whether 20 seconds or so of dead reckoning to delay the cavalry charge would have made much difference in this case.