One reason the A310 finally made it was banking to the left at top of climb.

Is roll command on A330 in ALTN2 the same as in NORMAL law (roll rate command)?

Thx

If you haven't already done so, take a look at this post by sadpole in the other thread. Some insight into what the Human Factors Group probably missed.

Sometimes those in conflict are both right...

I think / recall that the a/p-off latch depends on precisely which law the a/c gets into. That depends on how many ADRs fail and for how long and maybe in which order. That in turn depends on which pitots ice up, how badly, and maybe in which order - which will vary.

I recall that there has been at least one case where a/p was re-engaged soon after UAS and did the wrong thing due to speeds being in agreement but still erroneous.

The line in the procedure looks like it is to ensure that ap/fd are off (they might have dropped out but maybe not). I think there has been additional guidance (that's come up on these threads) about not re-engaging them too quickly (ensure speed info is back to normal first).

Hi,

Interesting EASA publication:
http://ad.easa.europa.eu/blob/easa_a...AD_2010-0271_1
So .. in 2010 .. they put emphasis on the FD ... (after the AF447 case)

henra, #259

The idea of combining > 1 independent, limited reliability
sources to improve overall performance is not new. For example,
GPS / inertial mixing has been in use for some time. A brief
description may help to illustrate why this is a good idea,
with of course apologies for those who know all this already.

An ins system (IRU in airbus speak) works by dead reckoning
and is subject to drift over time. By dead reckoning, I mean
calculated from the point of origin, or start position. The
accumulated position error could be as much as several
nautical miles per hour, though current state of the art may
be much better than this. GPS doesn't work by dead reckoning,
but by direct measurement of absolute position and has far
greater accuracy, to within a few feet over much of the earths
surface. However gps can suffer from signal dropout and loss of
accuracy in some regions and is susceptable to jamming.

With the gps / inertial mixing scheme, some very smart software
augments the ins data with that of the gps to provide better
long term accuracy, redundancy and improved error detection.
For example, if the margin between the ins and gps data exceeds
a given threshold for a number of samples, one or other can be
tagged as a degraded source, while still providing good data
over the short term. That is, we now have a holdover capability
in the event of a temporary fault from either source.

By now, you can probably see where i'm taking this in terms of
a baro / inertial mixing scheme. Ins data could be used to
augment and cross check air data information. From what i've read,
the current systems are independent and any results of cross checking
between the ins and air data speeds (baro) are not presented to the
flight deck. The problem of using ins data to correlate air speed
is that the ins measures ground speed. However, at any given point
in time, there is a historical timeline and ongoing relationship
between the two. This could be used in the short term to provide
an indication of air speed in the event of a temporary pitot tube
failure. If one assumes that the wind speed remains fairly constant
short term, such a baro inertial mixing scheme could be a valid
solution to the loss of air speed data, upon which so many other
subsystems depend.

There other ways to measure air speed, such as the airbus developed
laser measuring system and which is, iirc, available as an option
on the A380. Hopefully, it will become mandatory at some stage.

Feel free to hack at all this if you like :-)...

- I see repeated reference all over PPrune to this being the 'correct action'. Was this in fact so, i.e.a QRH item before 447?

Some clues page 98 periodic training check (unfortunately in french) in report N°2
http://www.bea.aero/docspa/2009/f-cp...90601e2.en.pdf

The UAS duration was not sufficient to latch Alternate 2 in that case. While it's true that it was possible to re-engage AP in that scenario, the re-engagement had to be manual. The AP will not re-engage itself automatically in any scenario, and because Alt2 was triggered and latched in the case of AF447 even a manual attempt to re-engage AP would have been denied.

Because of the digital nature of the equipment, the AP switch is not a type where AP status can be determined by switch position - AP status is determined by the presence of the Autopilot button light on the FCU and the PFD status instead.

Would need confirmation on the QRH, but "Flight Director : OFF" was definitely a step in the UAS procedure published by Airbus and disseminated to the airlines prior to AF447.

Good spot MM-43. I particularly liked his third point. What self-respecting pilot thinks autopilot time should be counted the same as actual handling time? You do learn Navigate and Communicate stuff and you do manage the systems, but are you really keeping the Aviate stuff up to speed?

Probably won't happen unless the regulators wake up. Too many sacred cows.:}

BOAC, jcjeant, Dozy & Infrequentflyer789,

I am thinking that perhaps (maybe) the AD 2010-2071 resulted from the TAM incident (perhaps others?). In the TAM incident the NTSB investigated and noted:
In this instance TAM never got to the Alternate 2 state where the AP couldn't be re-engaged (latched) as Dozy pointed out, but nevertheless, felt emphasis was required on not re-engaging the AP so quickly.
Just a thought....

@TD - Good catch. I think it was recognised as a general industry-wide issue before then though - I'm thinking in particular of the Flash Airlines 737 where the Captain repeatedly called for re-engagement of autopilot as he unwittingly manually took it outside of the envelope.

FWIW, while some of what sadpole said is true, some of the prejudice he showed in that post really rubbed me up the wrong way.

- is really in another arena. What I am trying to establish is whether the UAS QRH action PROMULGATED BY AF at the time of 447 was as described.

Apparently so [Page 2]:

http://www.bea.aero/docspa/2009/f-cp...nexe.06.en.pdf

There was some debate over the "safe conduct" clause preceding it, but nevertheless, the first two memory items are AP/FD and A/THR to "OFF".

AoA and FMGEC:
 

@HN39:

Accuracy of the vane sensor = +/- 0.3° at 100kts.


---

About the FMGEC voting logics:

The FMGEC uses different logic to compare the inputparameters.
The logics used are by voting, passivating or two by two comparision and/or a combination of those.

For the airspeed (considered as slow changing parameter) the two by two comparision is made on the (ADR) monitoring side of all 3 sources (ADR OWN, O3 and ADR OPP-osite), the result of this is passivated to the command side which only receives parameters of ADR OWN and ADR #3.
(the command parameters are following the selection of the ADR source selector however will revert to the good source if the selected source is considered not to be good, as it was in AF447 between 02:10:46 and ~02:11:07.

Already said before it is rather complicated, one parameter may pass the logic while an other parameter could 'reject' the ADR as being unreliable.

The two by two comparision example:

http://i474.photobucket.com/albums/r...9/TwobyTwo.jpg

Thanks, DW - my French was not up to the other link! I think it is fair to say, however, that the AD is much clearer in both layout and explanation. As you say, the 'Safe conduct' bit could well have caused problems, in particular if the 447 crew did not, for some reason, feel it was relevant, and they never got to the 'level off' bit where the FD OFF was heavily emphasised..

There's your one teeny weeny problem right there. Wind speed might usually be fairly constant short term, but then pitots (properly heated) don't usually ice up either. Pitot icing is often in the vicinity of thunderstorms, and rapid changes in wind speed can be found... guess where.

In short, I think your scheme still has the common mode failure that the 3 redundant pitots have - the same external conditions may mess up the pitots and your inertial backup.

Additionally, you've now added another failure mode - if the pitot airspeeds vary wildly (but accurately) due to rapid air mass changes, is your inertial mixing going to vote out the correct data ?

Do not forget that for three years on, the topic has been discussed ad nauseum; in that focus is lost the emergent conditions 447 experienced 2:10:04.6 instant. Safe conduct of the flight is the underlying parameter of any pilot; they do not need to begin differentiating and splitting hairs
the instant Speeds are lost. That is the emergency, and I defy any one here to state they would be available instantly to gauge coldly if the flight became endangered with the unexpected loss of a/p.

Assume one of sadpole's aces were flying? Does he coolly hold steady, to assess, knowing the flight is not in jeopardy? He does nothing with the stick as the airplane bounces and descends, rolls? Or does he make inputs to correct? The airplane was left maneuvering at a/p drop, and the initial corrections applied were correct. So the correct action has placed the handling pilot in harm's way: He is handling, and the response is not being assessed correctly by the ASI, his one true ally has quit. His reactions to the first eleven seconds are in the record, and it is these inputs that set the stage for disaster. the accident was born in these first eleven seconds, the cart had been upset. There is no going back, the crew was committed, by virtue of the unexpected change in instrumentation. With PNF's remonstrations to "go back down", we see the possibility for salvation. The PF rejected this verbiage, his instruments had just revolted, does he trust the second in command? Or does he buy time by placating him, and continuing his incorrect path? We know the answer.

The materials used to date the manuals must be examined closely, some of the dates and alterations are in disagreement, and some were "updated" without notation. I would direct anyone's attention also to a photograph in the final report, showing "Arm 36G" in the Rudder. It is completely different from the one supplied by BEA initially, the one that began the discussion of the Arm attachment discrepancies in the image with the text of their analysis. Closely inspect this photograph, please.

Dozy, are you sure the Stick shaker/pusher has been abandoned in favor of FBW? 50's technology? The 330 cannot fly with the best Stall Warn available? The Warn that trumps even the speed/AoA aural that was dismissed/ignore by the crew?

And the finest Stall recovery tool, the Pusher? Are you saying that Airbus will improve the aural qualities of its SW, and that will be sufficient?

So again, would 447 have benefitted from the Shaker/Pusher? I say yes, and I would question your position that she would not have possibly even entered the Stall with this equipment?

I would admit that furnishing the Shaker to a side stick might be problematic, and the Pusher to an electronic controls system as well.

@BOAC

This is pure speculation, but sadly it seems just as likely that the startle response was so complete that any thoughts of procedure never even got a look-in.

By saying this, I am absolutely not denigrating the unfortunate crew - as I said in the other thread, even the best have bad days.

It could be argued that in those weather conditions, at that time of night, any deviation from normal operation has the potential to endanger the flight!

A pull to 15 degrees nose-up is certainly *not* correct, no matter which way you slice it.

History has shown that even with a stick shaker, crews can and will disregard a stall warning if it does not fit their mental model of how the flight is proceeding.

Aural *and* visual - it can't do any worse than the shaker and pusher have done historically.

The stick pusher is not the "finest" anything - it was a product of its time. If you read HTBJ you'll find anecdotes from DP Davies about how many contemporary line pilots hated the thing and didn't trust it. Whether that enmity was justified or not, the fact is that stick pushers were only ever compulsory on G-registered aircraft of a certain vintage.

It can be argued that the pusher was really only necessary on T-tail aircraft, as the conventional empennage layout is not susceptible to the "deep stall" condition - and in fact aeronautical engineers design airframes to develop a nose-down tendency at the stall without requiring control input. The A330 is no exception - in this case the natural tendency was defeated by the PF who held the primary flight controls in a nose-up position for the majority of the sequence.

Modern aircraft with yoke controls retain the shaker (which can be - and has been - ignored with fatal results), but the pusher has moved into history across the industry. The FBW designs from both major manufacturers, rather than providing automatic stall recovery, instead try to prevent the aircraft from approaching stall in the first place, whether via hard protections in the case of Airbus, or by increasing opposing yoke force in the case of Boeing - and as I said above, the aircraft are designed to naturally nose-down at the stall. Sadly, no amount of design can prevent human interaction from defeating the failsafes.

Thanks, A33Zab.

Let's assume that the accuracy varies as the inverse of dynamic pressure, then it would be +/- 0.8 at 60 kts, and +/- 3.3 at 30 kts. Perhaps the stall warning computer could take those tolerances into account?

It may also be possible with the data from wind tunnel tests and AF447 to expand the airspeed indicating PEC (pressure error correction) table to higher AoA's, to reduce the IAS error at high AoA.

I agree with the sentiment but not the fact. It would be very easy to design a system that totally ignores the human. However conventional wisdom dictates that this should not be the case. The human must have the final say, that is what the regulations say, and so there will always be scope for human error as well as system failure. All these designs have been through massive amounts of scrutiny against these aims.

But to get this to work then the two systems must be 100% correctly characterised otherwise the potential for one to mislead both is always one step away. In fact a modern airliner has systems that can perform a sense - effect loop many 100 times faster and more accurately than a human whilst the human can take decisions that without some very exotic AI the computers can't get close to. Unfortunately the interaction of the two is never perfect and that is what system designers strive for. In this instance I'm not sure the combination of sensors would have made any difference. With the loss of all primary air data, the system would still have to hand control back to the human. The airworthiness authorities basically demand it. In reference to the example, how many combined GPS/Inertial sensors are certified by a civil air authority for navigation?

Please tell me how. Can a purely laser based system provide a calibrated airspeed? From what I understand, it can tell you how fast the air is moving, but at 37,000ft that is pretty meaningless to the aerodynamics, how does it sense the air density?

Placement of the pitot tubes is determined by the need to achieve the most consistent and correct airspeed. The separation is sufficient to ensure they are independent from the point of view physical damage. However icing is and always has been a problem. That is why they have heaters in them. But it is possible for nature to throw something at you that is beyond that capability. No matter how you separate them they will always be subject to icing.

To me there are many lessons to be learnt. Perhaps in the event of unreliable airspeed the AoA indication should become more prominent. Perhaps the stall warner inhibition should only be below a certain radio altitude. Perhaps, perhaps, perhaps. There are perhaps 100s of improvements that can be made, but each one must be considered and the impact on all phases of flight and all types of operation must be analysed before implementing them. I can't subscribe to the idea that the current design is somehow "incomprehensible" or "technically flawed" it is fairly standard from what I see, and follows well established principles. We shouldn't look at one small sub-set of operation and criticise it in isolation, or try to correct it without considering the effect on the whole system. In my opinion, the overall system failed catastrophically because of poor interaction and breakdown of communication between the aircraft and the pilot, the causes need to be established and corrected without introducing more dangerous failure modes.

@henra

Conditions of "validity" are unclear, here, what is "valid" (two ADR and two IR FMGEC), when is it "valid", aso.
Which max difference is acceptable from one ADR to another ADR, from on IR to another IR, aso. A33Zab's shematic is unclear too, "compare" is unprecise, as there are difference which are acceptable, and in + or in -, so the shematic is much more complicated

infrequentflyer789, #288

Agreed, but in the existing system, pitot data will be subject to filtering
and may already include historical data to provide some sort of predictive
capability. The processing will reject out of range transient data. When a
storm is entered, things get more dynamic, but again the software will adapt
to this, changing it's filter parameters if required, to optimise the
measurements. If this were not already the case, flight deck values would be
unreadable.

It depends on how the data is processed and it's not a case of one data source
or the other in competition, rather a synthesis of the two, where the error
characteristics of both are given less weight in the calculations and the
strengths given more weight. The idea is to model the characteristics of all
the sources under all conditions of operation. The filters and processing can
then be matched to provide a more accurate and consistent result than from either
source alone. A more robust system in terms of transient events and redundancy...

dClbydalpha, #292

Sorry, missed this:

No idea, but have seen examples of gps in lrg ins units
(Ferranti) that date back to the early nineties, so it's not exactly a
new idea. If it's not used in civil aviation, it's not because of the lack
of well proven technology.

The first result from plugging:

"airbus laser based air speed measurement" into google:

Airspeed measured by laser | NRL Annual Report 2009

It will come, not a matter of if, but when :-)...

@syseng68k
HN39, IF789 seem to have the same frustrations as iself with the final report's unsuffisant precision : all that is litterature, "communication" for commercial use, not science, not proofs...:(

Airspeed - Optical Doppler Shift Measurement
 

A March 2012 comprehensive update on the NLR Daniela Project - a PDF file.

Not completely pointless.

I posit for you three different crews, A, B, and C.

I sit as master torturer running the sim, and proceed to add task loading (via failures and malfuncitons) to the point where the crews fail. As we have discovered, we can usually find a way to task saturate nearly anyone, and nearly any crew.

For the sake of illustration:
After cascading seven failure tasks, Crew A are done for.
Cascading of 9 failure tasks does in Crew B.
Cascading of 13 failure task finally does in Crew C, and the sim torture master only had one more trick up his sleeve. :E

As each crew ultimately fails at a different level, I as training department, or as chief pilot, or whomever, have some information upon which to help inform who needs work on what, in terms of the training and proficiency requirements and systems knowledge.

Likewise, the crews may, after giving me the occasional dirty look, be aware on their own of some limits or holes in their knowledge of systems that they were not previously aware of. <== That is crucial to most pilots I have ever met, all of whom like to be good at what they do and tend to correct or improve areas where they find themselves not up to scratch.

For What It's Worth, not without value.
In the commercial world, however, there is a fine decision to be made due to cost of sim time, in terms of how often and how brutal, and what to emphasize. There are not infinite training funds.

Dozy, I agree with what you are saying. If they hadn't pulled the nose up to 15 degrees none of this would have happened.

Software isn't going to prevent a repeat of this event, competent pilots who know how to fly without an autopilot will. Unfortunately this breed is going away and Airbus convinced everybody that stall recovery is not required in training because the bus won't stall in normal law.

UAS checklists are in all airliners and would have prevented this crash if used. The PF thought he was protected when he pulled back the SS. They were not in normal law so they stalled. Both pilots in the cockpit needed the autopilot to fly with no airspeed.

Well, hold on just a minute. Airbus said you can't stall the aircraft in Normal Law - but it doesn't follow that such a statement should convince anyone that stalls won't happen. To my mind, airlines didn't ask the important question of what happens if the aircraft *isn't* in Normal Law before making decisions on training. The same thing happened 40 years ago when Douglas assured the industry that losing all three hydraulic systems on the DC-10 was impossible. Thankfully the captain on the flight where Douglas was proved wrong didn't buy it for a second and used his seniority to train himself how to fly the thing on asymmetric thrust.

With all due respect, that's conjecture - there's not enough evidence to say why he pulled up the way he did.

Airbus have had their problems over the years, for sure - but to say they're largely responsible for the decline in hand-flying skills is like arbitrarily blaming Ford for the fact that so few Americans can drive a stickshift - the industry and customers moved in a certain direction, and Airbus (and Boeing, MD etc.) supplied products to fit that demand.

The truth is that with ever more crowded skies, automation is going to be more necessary than it has been in the past (with the advent of GPS and RVSM airspace) in order to maintain a degree of safety in traffic. This is a distinct issue from the lack of training for situations where the system fails however - PJ2 did a rapier-sharp dissection of industry attitudes on the previous thread, but what it boils down to is the trend whereby more and more senior airline management have never developed specialist skills relating to the industry, instead being purely business-orientated.

Dozy

Your "15" degrees PITCH UP I believe came from the DFDR, via ins and archive. You know the Pitch attained was not nearly that high, in the initial command post a/p loss. Once maneuvered, there ceased to be a comfortable baseline, and his PITCH was not available via INS, and you have no idea whatever what the cockpit was like, you just don't....No PITCH was ever spoken in the CVR, only "you go up....so go down..." "Am I in climb?" So your reference to a specific PITCH value from the DFDR is completely "out of your seat cushion"....I submit PF's grok of PITCH was never accurate, and from the evidence, there is NO way to know what they saw, or believed......via their instruments....

He yanked the sidestick halfway back the second AP disconnected Lyman - there's no getting round that.

Yeah, the instruments were clearly lying or absent and the aircraft tricked him into crashing. Truly, denial is not just a river in Egypt and I don't see the point in continuing this debate.

Re this post .. sideline philosophical consideration ..

As each crew ultimately fails at a different level, I .. have some information upon which to help inform who needs work on what....

Likewise, the crews may .. be aware on their own of some limits or holes in their knowledge of systems that they were not previously aware of.

My original comment was directed at routine sim work and I stand by the philosophy for routine (training value emphasis with a lower case "c" checking strategy) sim work.

In the specific circumstances you cite, I am with you .. indeed, I would be in the line to participate for the reason you consider .. just where is my personal brick wall ? The underlying research value for training strategies is valid .. but the participants must be willing and not at jeopardy.

Perhaps we should have a beer or ten to debate the pros and cons ?

727 2-engine out, manual reversion, NDB approach to NDB minimums was essentially a one maneuver check-ride.

What was most interesting, was not who succeeded or failed at the maneuver, but who would be enthusiastically willing to attempt it.

With all due respect, that's conjecture - there's not enough evidence to say why he pulled up the way he did.

Then why did he pull up into an impossible climb that all of us know would end up in a stall? No airliner can go into a 15 degree climb at FL350 and not stall. He either trusted Airbus protections in normal law or was incredibly stupid. I think somewhere in his training he was told you can't stall in normal law so pull it up and let the automation handle it. These two spent most of their careers monitoring autopilots so probably depended on them a lot more than us old timers to fly the airplane.

The cockpit voice recorder shows how confused both pilots were when AS and AP went away. It didn't happen like that years ago before full automation took over.

That's two possible conclusions. Other conjecture has included the ideas that he tried to chase the intermittent FD bars and/or that the pull up was a panic reaction - and through a possible combination of body-clock offset, having just come off of holiday (and still getting used to being back in the saddle) - or even just that the shock completely threw him, all training went out the window.

Unfortunately there'll never be any irrefutable proof which of these theories, or any combination of them, caused him to react the way he did.

I've said this before, but it's very important to draw a distinction between FBW/protections and automation (in the autoflight sense). The ColganAir Q400 did not have FBW or protections and yet the captain still pulled the aircraft into a stall when the warning startled him.

The distinction is important because (for better or worse) a pilot expects to be using the automation on almost every flight, whereas in an ideal world the pilot would never have to rely on the protections (and in the real world, most never have). The protections are there primarily to help the pilot stay within the load limits of the airframe when aggressive maneouvres are required - but in this case there was no requirement for an aggressive maneouvre and hence no need to bring the protections into play.

The "old timers" didn't have to deal with RVSM airspace. :)

More seriously though, the industry needs to have a serious look at maintaining basic aeronautical knowledge, now that automation has become a necessity.

It did on Dynasty 006 in 1985 and Eastern 401 way back in 1972. We need to be careful when generalising.

Yes, pilots have made stupid mistakes in the past and will in the future. We have made wonderful improvements in GPWS and TCAS so flight safety is better than ever before. We just need to not let the pilots become monitors of autopilots instead of pilots in my opinion.

In my career I had to continually improve my basic skills because the airline didn't. You don't have to rent a Cessna, just disconect the autopilot and fly on raw instuments when it is appropriate. Why would you want your basic piloting skills going away because the airline you fly for doesn't care?

You should care.

The problem is that the number of appropriate points where this is possible is dwindling.

I do - otherwise I wouldn't be here! :)

Manual flying .. illegal ? .. outlaw ?
 

This is the kind of recurring comment
I wonder why fly in manual seems to be a problem for pilots who always invoke some of their company regulations
In fact is that these regulations have the force of law ?
Is there a law that prohibits pilots fly manually ?
Is that pilot can legally be put out of work for this action?

Unfortunately, some of the large but unenlightened airlines do hold to a punitive view of what pilots should do and should not. I recall a recent post in the Rumors section where a Captain was quite certain that he would receive an invitation to "tea and dates" with the chief pilot should he choose to practice his manual flying skills outside the narrowly constrained takeoff and landing portions of the flight. Apparently the statisticians at his airline had built some sort of case that to do so increased the risks.

To my mind, this is the short term risk avoidance getting out of balance with the long term consequences of such a strategy. Of course, if they bring in highly trained crew continually into their operation and flush them out of the system after ~4 years or so, then the consequences of their short sightedness could well fall to someone else.:*

Hi Mach.

From above... "Apparently the statisticians at his airline had built some sort of case that to do so increased the risks."

The statistician is correct of course, at any given time, manual flight is more risky than autoflight. Clearly, the case can be made that it is "Training", a more demanding regime than auto cruise. In my view, the ball is in the regulator's court, and it would take a pro-active reg to cause the lines to upgrade hand skills.

Besides nil, zip, and no chance, what do you think?

True. But pilot and aircraft are inter-dependent. The aircraft design is clearly to revert to the pilot in the event of a problem.

An inherent assumption in this design is that the pilot is capable to manually fly the aircraft - without warning, at cruise altitudes, and with degraded systems or data. Increasingly, this assumption may not be entirely valid. What training is required by the operator? What is covered in the sim? Is regular maintenance of manual flying skills permitted by the operator?

Truth is often the first casualty of war. And it may be hear with the lawyers circling and large sums at stake.

However we need to ask ourselves if something has fallen into a crack somewhere between the designer / manufacturer, and the pilots. If there is such a crack, it is only a matter of time before someone else falls into it.