CONF iture
I will try to answer your points but this is not slugfest between you and me nor I am promoting A or B.
Perpignan, AF447 or 757 what ever I said were not my opinions but inquiry reports. Perpignan wrong maintenance procedure, unplanned last minute execution at a dangerously low altitude without sufficient preparation, too many holes in Swiss cheese too easy to line up.
757 case if you Google it you will be able to find it was concluded that it was possible not to notice the masking tape and they had to make some changes, I didn't demand it and it didn't help that it was not FBW.
AF 447 was crew action absolved by the inquiry? Again not my opinion.
I am not saying two wrongs make one right. EASA AD or Airbus does not find it necessary to switch to direct law but alternate law which allows the pilot to override protections. As an Airbus pilot I tend to agree with it. If you think that in the 757 case same actions as were taken in 447 would have saved the situation I have nothing more to say.

CONF iture
Posted from Wiki Aeroperu Flight603
In November 1996, Mike Eidson, a Miami attorney from Colson Hicks Eidson, said in an interview that many of the passengers survived the initial impact and drowned afterwards. Eidson represented 41 passengers and crew in a lawsuit contending that the aircraft's manufacturer, Boeing, bore responsibility for the disaster, as the company ought to have foreseen the misuse of its products.[1][11] The suit was filed against Boeing in federal court in Miami in May 1997. According to the complaint, the control panel errors were caused by careless maintenance by Aeroperú and negligence and defective design by Boeing. Boeing argued that it was not at fault, and that responsibility for the accident lay with the employee who did not take the tape off the static ports, and the aircraft's pilot for not finding the tape. Richard Rodriguez of the NTSB said that it was understandable that Schreiber did not find the tape because the maintenance worker used duct tape instead of the brightly colored tape that he was supposed to use. In addition, Rodriguez said that the pitot-static ports were high above the ground. Therefore Schreiber did not see the tape against the fuselage.[1] After extensive litigation, the parties agreed to transfer the case against Boeing and Aeroperú to an international arbitration in Santiago, Chile, for a determination of the damages. The defendants agreed not to contest liability in Chile.[11]
On December 13, 1999, family members of the flight's passengers received one of the largest cash awards stemming from an aviation accident outside the United States aboard a non-U.S carrier, averaging nearly $1 million per victim.[citation needed] The episode "Flying Blind" from Mayday (Air Crash Investigation, Air Emergency) stated that the manner of the crash resulting in the passengers' drowning was responsible for the large settlements.[citation needed]

Using a poor home made procedure when an easily accessible single red guarded switch should be installed on all types. And just fine if it sets direct law - why are you that concerned by direct law after all ?

Had it been a 757 on AF447, three elements could have helped saving the situation :

1. Coupled flight control commands
2. No auto trim under manual flight
3. Therefore the continuity of the stall warning

I am not against the idea of having a single switch which knocks out protections But the idea of no auto trim in manual flight goes against the concept of AB FBW. Flight without auto trim for substantial amount of time will require some tactile feed back in the side stick. It is almost changing airbus to Boeing FBW. I do not think it is going happen nor it required. Coming back to 447 what would have helped and has helped in some other such events is sensible piloting and following proper procedures. But some how that is not important to you. You sarcastically used the phrase pilot proof aircraft but you are actually demanding better pilot proof systems because you support pilot's lack of skill. FBW feels the same at 35000ft. or 10000ft. but a 747 or 707 doesn't. AF447 crew the way they handled A330 could flying manually very well stall a 747 at FL350 even with valid speed. Continuity of stall warning sure nothing against it, they ignored it 50 times may be 51st time they would have heard it but the problem was not the stall warning but not knowing what to do with it. Auto trim just trims what you asked. Should a pilot ask for upward trim in stalled condition?

I am a little mystified about this "big red button", especially related to Perpignan?

The "big red button" was precisely what caused Perpignan! The AoA probes froze at a sensible cruise reading, and despite clear indications as such to the crew (illogical Angle of Attack displays on PFDs), they proceeded to test AoA protections.

Due to the frozen AoA probes, AoA protection did not occur. The crew just carried on slowing down (PPL indication of approaching stall: 1), with a very nose high attitude (PPL indication of approaching stall: 2), to well below the speed clearly written in the test schedule on the Flt Deck at which the test should be "knocked off".

In effect the frozen probes acted as "the big red button", and enabled, unfortunately, the crew to kill themselves :{ It isn't a particularly good advert for the "big red button" concept to me?

Actually, that is pretty much what i was trying to suggest. No, direct law, although extremely easy to fly in, isn't really needed, alternate law without protections is enough if the hard protections decide to act up. Now, the downside is, that such an event is extremely rare but we still need training for it and there is of course the possibility to use such a switch in the wrong context which could lead to incidents as well.

Nigel makes actually an excellent point, although the big difference is that the perpignan crew was obviously unaware of the problem with their AoA vanes, whereas a crew disabling the protections should be aware of what they are doing.

Time to read the report one more time Nigel ...

Good

I suppose some protections taking over for wrong reasons is also against the concept of AB FBW ...

Why that ?

And the problem is ?

Quote ?

Certainly sarcastic as the FBW Airbus was here to correct the pilot's mistakes. Airbus just forgot to mention how the pilot could be required to protect the airplane against its own protections.

Quote ?

Surely the captain would have loved to hear it ...

Not in this case, the auto trim would have trimmed hands free from the stick.

Should a system ask for upward trim in stalled conditions ?

Coming back to 447 what would have helped and has helped in some other such events is sensible piloting and following proper procedures. But some how that is not important to you.
Because I don't see a word from you about the procedure 447 crew followed.
Not in this case, the auto trim would have trimmed hands free from the stick.
If 2.5 degrees pitch and something like 80% N1 was set why would the aircraft trim full up? Airbus trims for the flight path if you point the nose up and keep the stick back sure it will do what you asked for. The aircraft was not left hands free at all. TOGA was selected which is not vastly different at 350 but never the less FBW resists the pitch up it only trimmed back because pilot pulled the stick back and kept it there. Perpignan and AF447 are what not to do examples and if you support these operating styles surely you are demanding pilot proof aircrafts.

So what is the aim of the stall recovery ?

OK465
I am not sure you know what you are saying. Can you quote some document to support your argument? Why was the dynamic pressure decreasing and how did the angle of attack reach 40 degrees with pilot doing nothing? High level handling in alternate law including stall and recovery is part of type rating now and I have done it many time it doesn't do anything of that sort.

This is what the airplane is supposed to do. Why should a pilot try to achieve 10 degrees of FPA at 35000 ft in a normal flight ? :rolleyes:

OK465
In AF447 there was a failure of a component which has happened in non FBW aircraft also. The aircraft behaved the way it was designed to but the pilot not only did not handle the failure the way he should have but took the aircraft to the extremes of the flight envelope and kept it there without facing extremes of environment or incapacitation etc. In this situation the auto trim aspect of the aircraft which makes airbus such an easy aircraft to fly was found to have a negative role. Your suggestion is to redesign the aircraft for such a pilot. I am suggesting to put a better trained pilot in charge. After all we can passionately promote our views but the manufacturers and regulatory requirements and economics will govern the modifications and not what people like you and me demand. AB FBW is bête noire for some people they are entitled to it but then the discussion becomes a merry go round and not professionally stimulating.

I'm with vilas on this. FBW is an assistance tool, like the FADECs in the engines, and help prevent exceedences. (?spelling)

Problems with Airbus FBW are mostly down to pilot training, which companies are trying to reduce because it costs money - which reduces the profit they make because they refuse to charge the proper price for the tickets. That's not the pilot's fault.

(If I was an Airbus designer I would keep the system as it is but physically link the joysticks, so they both moved together, and have a disconnect function just like on the Dash 8, where the controls can be disconnected from each other in case of control problems).

Having said that, I think there needs to be some sort of review of how the voting system of three sensors is carried out. In the case of frozen AoA probes, I would think it would be relatively easy to add a few lines of software code to detect an AoA probe that had not moved at all (i.e. given out exactly the same measurement) for several minutes, while variables such as the THS, aircraft altitude, outside air temperature, IAS/Mach, and engine thrust settings had all changed. If this was found to be the case, then vote THAT probe out. If a second probe was also logged in this way as being 'frozen' or seized, then vote that one out as well and alert the pilots via ECAM and going to Alternate law.

CONF iturePlease expand...

Please could you also expand on this e.g. with an example or illustration of the point?

Where did you see "clear indications" ?
There was none.

The system decided to silently discard the only reliable AOA data. When you realize the importance of the AOA data for the Airbus and its protection system to work properly, the logic would be for the system to at least advise the crew as soon as a significant difference between the AOA readings is identified.
Knowing that something was wrong with the AOA data, never the crew would have proceeded with an alpha protection system test ...

The valid sensor was silently discarded and the other sensors were lying together with already the potential to wrongfully trigger a protection.
Two AOA vanes blocked at 4 deg which is pretty close to the angle at which the alpha protection is ready to take over in altitude. The BEA did not publish the indicated alpha prot value at FL410 during that flight, it would be of interest.
What happened to Eva Air and Lufthansa could have happened already in Perpignan.

CONF iture, Nigel On Draft
if you keep your prejudices out you will understand the accident better. I am correcting some of your assumptions.
1. Where did you see "clear indications" ?
There was none.

Yes there were. AOA sensors 1 and 2 were blocked at earlier values when they froze and got jammed. Same values are shown on PFD1 and PFD 2 as V alpha prot and V alpha Max after converting them to speed and that display was wrong. Below I quote BEA report.
"However, the blockage of angle of attack sensors 1 and 2 at identical values had inhibited the functioning of these protections and led to an erroneous display of the characteristic speeds of these protections."
2. The system decided to silently discard the only reliable AOA data. When you realize the importance of the AOA data for the Airbus and its protection system to work properly, the logic would be for the system to at least advise the crew as soon as a significant difference between the AOA readings is identified.
Nothing gets silently discarded. This is known as self detected failure and is intimated to the crew as ADR3 fail on ECAM . However in this case it discarded ADR3 in preference to the erroneous ADRs 1 and 2 in accordance with two versus one principle and since it treated it as a single failure normal law was maintained. Such a possibility is explained in FCTM. It defies logic that when there is evidence that some thing is fishy about the ADRs(speed display and rejection of the 3rd) from which the protection arise ,the crew proceeds with protection tests at a low altitude of 4000ft without any preparation. That deprived them of the crucial time they needed to analyse indication of USE MANUAL PITCH TRIM which indicates direct law and its implications.However this is not going to change your dis Confiture about the Airbus and you are habitually going to say "it doesn't matter". That is your privilege I am just presenting the facts.

vilas

Thank you for that response.

CONF iture:

1. CHECK GW message is a clear indication there is an AoA "discrepency"
2. 
   http://www.aghsoftware.com/p1.jpg
3. 
   http://www.aghsoftware.com/p2.jpg

We cannot get away form the fact that this crew:

• Were conducting a briefed Test Flight
• The Test Schedule called for a Minimum FL100 (crew caried it out at 3000')
• Test Schedule indicated Absolute Min spped at their weight of 107K. The crew caried on until 99K, when the Stall Warning (from the correct AoA sounded) - the VLS indication was correct to the schedule
• The Alpha displays were clearly significantly different than they crew should have expected (pic above)
• The ISATM schedule called for the (Test) crew to record the 3 AoA values prior starting the test. This would have shown the AoA problem
• The Test was to check the functioning of the AoA protections. If you are to Test this, you must assume it will fail, and protect against it - betting your (and others') lives on it is a pretty high stakes gamble :{

I am not criticising in isolation the crew on the day. How and why they found themselves in that situation is discussed n the report. Management and Training and Supervision are clear factors. However, these are separate from the design characteristics.

Maybe the right time then for you to correct your own assumptions and to reevaluate your facts presentation as no such ECAM MSG was presented to the crew.
The crew was not aware of the ADR 3 rejection.
During the 40 minutes period before the crash an unambiguous AOA DISCREPANCY ECAM MSG could have been presented to the crew.

A CHECK GW MCDU MSG is certainly NOT a CLEAR indication of AOA DISCREPANCY especially when it was not possible to determine if this message was really presented to the crew.
However, an unambiguous AOA DISCREPANCY ECAM MSG would be a clear indication.

The crew has rushed and was clearly poorly prepared, but how would you want them to check those 3 AOA values when only 2 are available and so only indirectly through the third MCDU ... ?

I have no idea, I am a mere Line Pilot who flies A320s. If I was undertaking a formal test schedule requiring these 3 values to be recorded, I am sure my preparatory material would inform me how.

It should be to a crew doing a test Flight about to bet their lives on the AoA protections. For a Line Crew, I might partially agree with your comment.

I am not sure a Line Crew really needs this - all it could really say is "don't stall" which they really should not be doing anyway :{ That said, I suspect some form of additional internal AoA cross-checking will be incorporated to address the latest OEB - if only to detect "frozen" values when systems calculate the value should change more than x?

Except that there is no way to do it ... but good luck.

Did you get that it was not possible to determine if this message was really presented to the crew ... ?

Then I am sure the mere 320 line pilot you are would like to know something is wrong with its AOA data before he blindly and religiously follows his Airbus GPWS procedure ...

CONF iture: When I flew A330 it was possible to access the individual AOA values via the CMS using the applicable codes. I assume the A320 has similar functions?

Yup, those values are actually shown without the need to call them up by code, but that might be just a preset on our busses.

Are you supposed to access this kind of data during a flight ?

sonicbum: Yes, easily done in flight.

Read the question again : are you supposed to ?

For a test flight like that, yes, of course. In normal line operation? No, not really, just used to check on some facts or for curiosities sake.

This is the point. The thread veered from its original meaning.

Posts above appear to disagree with that? I appreciate you appear to have a grudge against Airbus and it's products, but does it really extend to accusing Airbus of writing Test Schedules asking the impossible :confused:

I do, but the likelihood is it was, and anyway, there was other, more compelling evidence.

I am not sure I would? The QF A380 incident, IIRC, is tending towards reducing "ECAM Messages" for everything? I spend enough of my time on the A320 dealing with spurious, unnecessary, and transitory ECAM messages. There needs to be a balance in life, some level of trust in designers and certification procedures re "fault tree analysis". To have an AoA problem such as Perpignan, ignore the signs there was such an issue, and then require a Max Perf GPWS warning I consider "improbable".

Is the Airbus FBW perfect? Of course not. Has it stood the test of time well, for the first mass market FBW commercial airliner? Yes. It has been improved, minor faults ironed out. I think we are now past the stage where the machine is the target of "blame" and "fault" - indeed for the A320 series I do not think it ever was. The FBW is well in the mature "refinement" phase.

The training and oversight / management of the operators would be a more productive target - IMHO. Perpignan an unfortunate, but clear, example - despite Airbus' efforts, man proved it is not uncrashable :{

Zee pushbutton is optional and labelled "EVAC". At least, last part of your statement is correct.

Exact same reply stands :
The crew has rushed and was clearly poorly prepared, but how would you want them to check those 3 AOA values when only 2 are available and so only indirectly through the third MCDU ... ?
But what about you actually link the document you mention ... ?

As improbable as 2 AOA vanes would lie together to trigger a protection that a crew could do nothing about it ... except by shutting down some computers ... or how to have to publish an improbable red OEB.

BEA Report:

NigelOnDraft
Once we leave the ground we are in a hostile territory because since it is not a human habitat we have no instincts whatsoever. Only birds have that and that is why we have procedures. Any deviation from them and you are like a blind man who has missed a cue. There are any number of accidents/incidents which show that whenever a pilot has surprised the airplane by change of plan the aircraft has sprung up a fatal surprise. But you won't prove a point to Conf.

Blame the crew for not doing the test above 10000ft and not recalling the characteristic speeds during the briefing, but not for not applying a procedure they didn't have.
In the meantime I do maintain that ISATM procedure is erroneous as there is no way to read the data for AOA #3

Conf wouldn't keep his job much longer if he was not following the procedures.
The system knew something was wrong with the data, all it needed was to advise the crew by a straightforward ECAM MSG :
NAV AOA DISAGREE

As Airbus gave so much priority to the AOA data in its system, it would be logical to at least advise a crew when one single reading differs from the 2 others.

Why wouldn't be there any way? You can read all AoA values from every MCDU as has been explained above. It's easy enough to do, and i would expect it to be detailed in the relevant procedure.

I do agree however that an AoA disagree advisory would be a nice clue about whats up.

One problem is that this was a 1 vs 2 disagree. So the system used the "2" that agreed. (Just like a pilot would I suspect, given three sources of data where 2 agreed). The most likely scenario for such a case is the "1" is bad, so ignoring it and doing nothing else is a good plan EXCEPT if you are doing flight tests. So if there was a message which just said "take no action" I'm not surprised they decided not to bother line crews with it.

A lot of this comes down to the big topic from this accident - the way such flight tests are (were, rather) conducted.

Conf
I said in post 46 the following
"All these protections are triggered from data derived from one sensor or the other but the present system of sifting the data to ensure it's genuineness is being proved inadequate and is the cause of all these incidents. The answer to this will come from better sensors, better system of confirmation of data or even quantum leap of technology in measurement of airspeed,"
So I had already said AB needs to change the method of identifying the faulty ADR/component. That includes change in ECAM messages or even giving the job to the crew to identify it for themselves until a new method of air speed measurement is discovered. I agree that crew was not warned of the ADR3 rejection in some cases it does which can be easily included in the ECAM and the crew advised to confirm it if it was correct.

The 1v2 disagree can be fixed quite simply by introducing monitoring over time. The Perpignan a/c had two probes at fixed values for a long period, including speed, altitude, and config changes... if a flight test engineer had monitored them he would have noticed the fault; all we need now is software as competent as humans.

Every single parameter is not necessarily available through the ACMS (or is it called AIDS on the 320 ?)
AOA1 and 2 are there but #3 is nowhere to be seen ...

All three AOA are available on AIDS and test flight requires write down value for all of them in clean configuration,green dot speed and croscheck/comparation with "angle" obtained from differenece btwn. pitch and flight path angle. Maximum allowable difference is 0,5 degree. Don't know if this procedure was valid at the time when Perpignan happend..:confused:

One thing which I did not understand is why did the aircraft go in direct law. First the rejection of the third is no different than ADR3 fault should have come on ECAM and the second is any combination of ADR malfunctions is not suppose to trigger direct law. Nobody else also has noticed it.