BOAC;

Re, "Whether the 'automatics' brigade like it or not, some of the programmed features of the AB system contributed to both 447 and the 330/340 events. Note I say 'contributed to' and not 'caused'. "

In the sense that all complex systems are capable of inciting inappropriate interactions with users, yes, I agree with you BOAC. "What's it doing now?" isn't a state of mind limited to Airbus aircraft. And when one encounters such moments, one quietly and calmly disconnects everything (including thrust levers) and flies the raw airplane - and as has been observed, the Airbus, as does the Boeing, fly beautifully, manually from takeoff to cruise altitudes, descent & landing - one just has to know a bit about high altitude, high Mach number, swept-wing aerodynamics.

But given this, what do we do with the Tripoli A330 (and for that matter, the Gulfair A320) accidents? Both aircraft were perfectly serviceable. What kind of automation would be able to "decide" in time, that the pilot was suffering from somatogravic effects? If the assumption is that automation can be designed/created to serve any ends, then how do such solutions differ from the present "zoom climb" issue, (extremely rare though both "contributions" may make in a fatal accident)?

If I may be permitted to wander slightly, the "possibility-potential", (possibilistic thinking, according to Lee Clarke), is what facilitates this thinking. To me anyway, the difficulty for the designers and the engineers becomes making an assessment between two polar opposites - What's probable?, vice What's possible? The question goes beyond "excusing or blaming" - it's just trying to find out what the causal pathway (to which you referred) was; in the case of AF447 I think we have it.

It seems to me as a retired pilot, that in terms of the designer/engineer's work (speaking specifically of Airbus), we can only say that the approach was(is) sufficiently cognizant to consider and expect that an airline pilot would be trained against, and would avoid-like-the-plague, stalling his/her aircraft and would understand those circumstances which would lead to stall entry.

On the question of "NCD" and the cessation of the stall warning, such circumstances may be imagined as "possible", but (at the time) reasonably concluded as "improbable". We now have the one single outlier (in tens of millions of flight hours), that, we might say disproves the thinking, (and inadvertently led to confusion in circumstances so far from normal as to be beyond test-pilot territory), so now, what do do but find a way to keep the stall warning on at all times if the airplane is indeed stalled. I believe (but do not know) that this is more complex and difficult than those who may liken such "obvious" solutions as the C-150 or other mechanical devices, etc) to present day computer/software systems but no doubt it will be done and certified; I believe the B777 system behaves the same way, (not sure about the B787) - perhaps someone here can confirm either way?).

The present call by some for "more automation" is, to me, folly, however the perhaps-two-dozen stall accidents, most fatal, over the past dozen years or so means there is a trend and not just an anomaly.

The discussion of why and in what condition the airplane (B or A) is "handed back" to the crew precisely at the moment when they could use "automation" is a very complex question having to do with "decidability" in computing systems and has, I truly believe, been exhausted in the ten AF447 threads, (for those new to the discussion, you can use the AF447 Search Index tool and look up "Byzantine fault"!),

When a complex system like a transport aircraft is taken into areas beyond its operational limits, the risk and possibility of confusion, particularly if one does not know one's aircraft well, compounds and heightens, quietly at first, and rapidly if one has been building/maintaining only a "surface" situational awareness.

The other aspect is the continued operation of the THS while the stall warning was active. As we know well,, the THS reached about 12°NU by about FL350 on the way down after almost continuous nose-up stick inputs. (it should be noted that with continued ND stick inputs, the THS would have returned to its normal position of about 2° NU).

What is to be done in terms of "automation" design under such rare and inappropriate circumstances, that won't cause other, unimagined and perhaps more serious circumstances when someone else wanders well off the beaten track? How are such scenarios imagined and "protected" against? As others have observed, if/when changes highlighted by AF447 are installed and certified, the "automatics brigade" and the hand-bombers could still ask your question with equal reasonableness.

So, not disagreeing with you...just pondering where your (and others') comments on the two primary observations on this accident, (stall warning quits; THS continues to trim), do take us in terms of solutions.

DonH - to try to answer your questions:

The stall warning 'quit' due to airspeed and not AoA reading, I believe? Simple solution - keep it functioning whatever the speed without WoW. Unless the AoA readings are 'borked' due to failure/icing/whatever, at least there will be a 'nudge' to the crew (did they really need it!!??) to see if alpha might be a touch on the silly side.

THS - moons ago on one of the interminable threads, I flippantly suggested a spring loaded boxing glove in the dash, but then offered a more serious proposition that 'we' derive a suitable boundary for 'reasonable' nose up THS (surely not difficult?) and then insist on a physical over-ride to exceed it - such as a 'cancel the limit' button.

bubbers44
 

A friend who flies a 7X (he calls it a 7 Edsel) hand flies it as much as possible. I do the same raw data, even in the sim. Preventing automation dependency can be a self-regulating endeavor. Obviously, some departures and arrivals require automation, but outside that there are opportunities if one has the stomach and professional integrity for it.

Its a start...

That is correct, I'm not so sure about the rest. The report doesn't say that alpha-floor was activated. It should have activated somewhere between alpha-prot and alpha-max, but maybe that threshold wasn't reached?

Quotes from rudderrudderrat:

"I believe Alpha Floor was triggered (at a certain Alpha threshold)."
Yes, the AAIB thinks it probable because the captain saw a PFD message starting with "Alpha...". They also said that Alpha Prot was (briefly?) exceeded, which - as HN39 says - would be necessary for Alpha Floor.

"With no side stick input, the aircraft will then maintain Alpha Prot angle of attack."
Quite. Re my question in a previous post, I've recently "gone to specsavers" and found the criteria for Alpha Prot disengagement on the A340 clearly stated :ouch: in the AAIB Bulletin:
Sidestick forward more than 1 second
OR
Sidestick more than half forward.

Hi BOAC,

You are correct. Normally the stall warning is tied to AoA, but because the sensed valid airspeed dropped to below 60 knots, the aircraft believed it was no longer flying and the stall warning ceased. At least that is my interpretation of this.

Re: 330/340 o'speed near miss not AF447
 

In the 330/340, alpha floor is inhibited above 0.53 IMN, which at 37000 feet is 166 KCAL. Doubt they got that slow.

According to the report, the message was 'alpha lock', which in the 330/340 is slat/flap related.

Desert185,

NG autopilot also disconnects with an ADR module discrepancy(s). And it has no fallback to fixed gains and flight path stability, just piloting.

If you recall the early 727, both the block 50 (and later 150) A/P would not disconnect in a situation where it really would have been desirable for it to do so. With a complete hydraulic failure the A/P remained engaged (electrically) when it in fact could exercise no control over the flight control surfaces.

A little red light with both A & B system bulbs was added right below the 'stab out of trim' amber light to warn that the A/P was engaged and either the selected A, B, or AB function was not available.

You takes your chances.

Turbine D,

Slightly more accurate would be to say that the ADIRU which processes the data it receives from the AoA sensor (and other air data sensors) considered the AoA value invalid and sent the code NCD to the other airplane systems.

To my knowledge, the ADIRU doesn't know and doesn't care whether the airplane is flying or not.

DonH,

Thanks for your reply on the memory list. In the early days of the AF447 Technical threads and the R&N threads, we went through this a few times. Although the information was made available in Airbus presentations several years prior to the AF447 incident, some of us questioned whether or not this was really made available to all airline line pilots through initial training or reoccurring training. If you look at the thirty some incidents of UAS involving Airbus aircraft, responses to UAS at cruise speed and altitude varied considerably, but no end results duplicated AF447, somehow they figured it all out successfully. I think you would agree, far more time in training and subsequent examination has been spent on critical low level UAS memory list possibilities, than on high altitude high speed UAS possibilities. Hopefully that has changed, AF447 being a lesson learned.

some of us used to make it a private requirement using spare time during an endorsement to ensure that pilots could handle several of the unlikely but very high risk scenarios

Yes, we could ask to, after check ride was over to do something not required with time left over to see how it worked out in the sim. I was flying into Caribbean islands with a lot of birds in a B727 at the time so asked to have two engines fail at 500 ft at V2+15 and the check airman said it wouldn't fly. I asked to try it anyway so he did and guess what, if flew. We had to descend about 200 ft to get to clean climb speed and climbed on one engine. We are usually over water so ground effect wasn't even needed to not have to ditch.

Using the sim is a great way to try not normally trained methods of surviving.

Since stall AOA varies with Mach No., and the ADRs requires >60 knots dynamic pressure to have a valid (i.e. 'acceptable' airspeed value), the aircraft had no way to calculate the stall AOA using the available data when the AOA got so high that the pitot tubes could not work. It could calculate the AOA, just not what the stall AOA was and thus, it could not provide a warning.

The programming was inadequate for this condition of being airborne with very high AOA.

There are a number of things that could have been done to determine how much stall AOA correction for Mach was necessary, but since it wasn't written into the code, it didn't happen.

If, for example, the aircraft could compare g to measured AOA, it should then have been possible to estimate IAS with sufficient accuracy to set flight control gains as well as estimating Mach number based on OAT and altitude.

In any case, when NCD was encountered while airborne, the stall warning AOA should have at least been set to the backup value of 8.6 degrees and not just turned off simply because the airspeed didn't make sense. See Hazlenut's post for additional data. http://www.pprune.org/7210355-post943.html

I'll imagine that we will hear from Dozy on this.:}

C'mon, 'bird.

As you and I and Retired have said, the AoA vanes/cones should be taken as gospel unless they are all in disagreement or some other criteria is applied, and CAS isn't one of them.

The simple fact is that the 'bus control law reversion logic is complicated and has a plethora of modes and sub-modes and......... Sheesh.

AoA should be the primary "protection" according to the jet's aero capabilities. I have no problem with the 'bus "gee" implementation due to its mission. The fact is that planes fly using lift by wings that can produce whatever at whatever AoA. So the 'bus might use a law resembling ours that limited commanded gee versus AoA. Take our law and divide by 8 gees and you have it.

Make no mistake, I do not like a "direct" control law for the heavies due to many technical and aero reasons. If you have a FBW system, then you use whatever still works to fly the plane as the old ones used to fly. You don't have force feedback, but you can sense rates and gees. The planes since the mid-50's had hydraulics and a few direct mechanical connects to the control surfaces. They have not been like an Aeronica or Chipmunk since then, so enough of this macho direct control stuff. My ilk flew most of the time in pure "manual" with hydraulic valves at the base of the stick. No mechanical connections of any kind to flaps or spoilers or anything. We done just fine. And then came along fly-by-wire, and I was one of the initial cadre.

Glad to have a "final" few posts to get some things off our chests.

Hi Gums,
Just 'cause there isn't an AOA gauge for the pilots doesn't mean that the aircraft doesn't know what value it is. All we need to do is instruct the aircraft properly what to do with the AOA data when it's usual stuff like airspeed starts to drop off the line.

The problem seems to be that the engineers have been thinking in terms of airspeed and not in terms of it's alter ego, AOA.

You know how to fly an aircraft using just AOA and so do I, but for some reason they didn't tell F-GZCP how to do it.:{

Perhaps a Dumb Question
 

Apologies if this has been covered previously - I really have little to add to the discussion that isn't rather biased - but I'm curious.

How does Airbus enunciate stall warning? I'm thinking a 'stick shaker' type alert isn't consistent with the side stick controller, so is some sort of verbal "STALL"? :uhoh:
I know there have been accidents in the past where the flight crew - when confronted with a stick shaker combined with UAS - apparently concluded it was Mach buffet and continued to do the wrong thing. I'm trying to understand how this flight crew could have dismissed a stall warning (even if it subsequently went away). Hence am curious on how that warning gets enunciated.

tdracer,

the stall warning is a synthetic voice shouting "STALL","STALL","STALL" followed by an irritating "cricket" noise. It 'goes away' whenever the AoA is greater than 42.5 degrees.

IMHO one has to be unrealistically optimistic to believe that this crew would have been able to recover from an AoA greater than 42.5 degrees, even if the controllability of the airplane would theoretically have allowed it.

But then I hasten to add that I'm not a pilot.

I guess if you are at 38,000 feet and keep hearing stall, stall, stall and you keep pulling back on the stick on any airplane and fall into the ocean with the controls full back all aircraft will do what AF447 did and all will die.

HazelNuts39, Having diligently piloted the aircraft to this unrealistic attitude, I doubt even that particular crew (if they could) would argue that point.:\;)

@machinbird

Yes that must be true. It is a case where the "requisite imagination" failed to envisage such a case as a necessary condition. But if some engineer had dared to suggest before publication of the AF447 DFDR traces that the aircraft might be driven into a 42 deg plus AoA situation and held there by pilot action they would have been howled down with scornful cries of "You are not a pilot" and "No pilot would do such a thing". I find it difficult to accept that the designers and their test pilot colleagues acting ten years earlier would have any reason to conclude differently.

As you say, it wasn't written into the code so it didn't happen, but it is not obvious that it needs to happen. If you are at 45 deg AoA or more it hardly matters whether the threshold for warning is 8.6 deg or 17.2 deg. The warning should be sounding.

I think you are missing a point however. If the warning were to be latched until safe conditions were restored (as suggested by BOAC and myself) the airspeed indications would necessarily be restored to normal and the proper stall warning threshold for the Mach number computed before the warning would be cancelled. You will remember that when the AoA was reduced temporarily the airspeed came back on line and the stall warning with it. That is why I think your next suggestion -
is an unnecessary complication.


Yes I agree with you there.

Sorry Chris, but the likes of Owain Glyndwr have no explanation other than the obvious; that the logic designed to protect against stall at low Mach numbers had unexpected side effects when applied at high Mach numbers.

The low speed logic is not stupid. If the system has reason to expect that stall AoA might be reached in a short time if current trends continue then it puts the aircraft into a temporary protection mode. If the pilot genuinely wants more AoA then it is available by moving the sidestick back. Otherwise the protection can be removed and the aircraft returned to "normal" behaviour by moving the stick forward. [Looking carefully at a digitised version of the traces it looks as if the "short time" is about 1.5 seconds]

In this particular case the autopilot dropped out because of a strong temperature shear (not the windshear you suggest). I personally suspect that designers do not currently give enough attention to temperature shifts, perhaps because they are not specified in FARs or CS25. On Concorde, which was designed against its own special (and generally more severe) rule book, we had to consider temperature changes of up to 21 deg C in one mile. This A340 incident was only 10 deg C in that distance.

Just after the A/P dropped out the aircraft met some reasonably strong turbulence. Again not extreme; working from the normal acceleration record one might deduce gusts of up to 15 fps (EAS) which is just under half the design gust for those altitudes. However, some of those gusts were sharp edged, so the rate of change of AoA was high. The actual AoA remained well below the deterrent buffet stall level - round about 2 deg below the Vs1g level, but the predicted AoA for 1.5 secs later went over the stall limit and triggered the alphaprotect mode.

Accepting that the subsequent motion was unexpected, it was not IMHO intrinsically unsafe. This was not an embryo AF447. The EFCS was, after all, acting to prevent a stall. There were no injuries and no aircraft damage. Dare I say that were it not for the proximity of the A330 and consequent possibility of a midair collision this incident would not have received the attention it has had. That seems to me an ATC problem and I note that the AIB made two ATC recommendations but nothing on the airplane.

DonH

As a retired designer, I have to agree with your assessment here. In order to design an aircraft one has to make certain assumptions. One of those is that the pilots will fly like - errr well like pilots actually ;)

One assumes that flying to respect the techniques and limits prescribed for the airplane will be the norm, but one must also recognise that techniques will not be followed exactly and limits not strictly respected. The problem is to know, or guess, the magnitude of these deviations that must be safely available.

Would you, for example, have predicted the AF447 actions? Or would you have imagined, when designing the autobrake logic that an aircraft might be landed on a flooded runway, with worn tyres, 29 kts above Vref in a 15 kt tailwind and put down with a long flare?

It is always easier to make these flights of imagination with hindsight :ouch: