Air France 447 - On topic only!

[Evan]

A spring on the control stick to make it want to stay neutral and let the pilots know when they are theoretically forcing a control input away from a fat, dumb and happy trim setting.

The sidestick is already spring-loaded to neutral position, but it is a transducer, not a force-sensitive control column. You can't make a Boeing out of an Airbus. You have to learn to fly it like an Airbus.

AFAIK, if you make a manual pitch trim input with the mechanically linked pitch trim wheel, the automatic pitch trim will be frozen. Manual pitch trim always has priority over auto trim. At this point natural longitudinal static stability is restored.

[Theoddkiwi]

Surely simplified and reduce EICAS messages needs to be considered. I can't be that hard for these highly integrated aircraft systems to have a logic applied that acknowledges that if A occurs then don't display the EICAS warnings for D, E, and F, as they will be restored if A is rectified.

You wonder how well they would have performed if they just got

AIRSPEED DISAGREE
AUTOPILOT DISENGEGED
AUTOTHROTTLE DISANEGAGED

Anything else surely was irrelevant.

The QF engine failure was another where they had a huge number of EICAS messages and I think they crew here were lucky because they had extra pilots with them to help work through the messages. You wonder how many were not really needed on the screen and how they would have done if there was only two in the flight deck.

[EconomyClass]

I just read a headline saying "no major mechanical malfunction". I guess I don't understand aviation English at all. The plane lost air speed indication, it shut off autopilot. So these are "minor mechanical malfunctions"? And were those in the messages sent to the ground? Did they just shrug and say "Oh that, that happens all the time"? The other thing that I find logically confusing is why Air France proceeded to refit with different pitot tubes for something that is "minor". PR?

[Spectator]

You have to distinguish between 'incompetent' and insufficiently trained.

That's why I suggested that the word I used was not the best option, and said 'no offence implied'. I meant that. Not that the crew shouldn't have been flying. Thanks for your comments, particularly regarding crew experience. That basically rules out my question of whether the captains presence could had had any influence.

Who told you that the captain have done any better than the other two?

Thanks for a detailed response Gabriel. Again, I was asking a question, a question that was raised earlier in the thread, but only a question - and I think you and Evan have answered it.

At no time was I trying to imply that the two on the flight deck at the time of the incident should have rather been flying model aircraft. Thank you for your understanding.

[Evan]

Surely simplified and reduce EICAS messages needs to be considered. I can't be that hard for these highly integrated aircraft systems to have a logic applied that acknowledges that if A occurs then don't display the EICAS warnings for D, E, and F, as they will be restored if A is rectified.

You wonder how well they would have performed if they just got

AIRSPEED DISAGREE
AUTOPILOT DISENGEGED
AUTOTHROTTLE DISANEGAGED

Anything else surely was irrelevant.

I think this aspect has been overblown as well. Although there were (24) ACARS messages transmitted, only (12) were cockpit effect messages, and of those, only (9) were ECAM messages and (3) were PFD flags (A 13th one one, concerning cabin vertical speed, was a pressure indication warning on the SD pressure page, but by then, they were already in a steep descent).

So, of these (9) ECAM messages and (3) PFD flags, all are very important for the crew to be aware of. Furthermore, (7) of these are the 'fingerprint' sequence for UAS. If this had been taught to them in training, they would have likely recognized the situation they were in.

Those messages are (non-ECAM messages in RED):

 AUTO FLT AP OFF,
 AUTO FLT A/THR OFF,
 AUTO FLT REAC W/S DET FAULT
 F/CTL RUD TRV LIM FAULT,
 F/CTL ALTN LAW,
 FLAG ON CAPT (F/O) PFD SPD LIM (unreliable airspeed, loss of green dot and speed bugs including VLS),
 FLAG ON CAPT (F/O) PFD FD (loss of the flight director).


The other five are:

 NAV TCAS FAULT
 NAV ADR DISAGREE
 F/CTL SEC 1 FAULT
 F/CTL PRIM 1 FAULT
 FLAG ON CAPT PFD FPV and FLAG ON F/O PFD FPV (loss of the FPV 'bird')

None of those are irrelevant, and all are very important for crew awareness in my opinion.

[Gabriel]

The sidestick is already spring-loaded to neutral position, but it is a transducer, not a force-sensitive control column. Neutral sidestick does not translate to neutral static stability.

In a Boeing you have positive speed stability in any yoke position.
In an Airbus you have an unknown speed stability (it can be positive, neutral or negative) in any sidestick position.

AFAIK, if you make a manual pitch trim input with the mechanically linked pitch trim wheel, the automatic pitch trim will be frozen. Manual pitch trim always has priority over auto trim. At this point natural longitudinal static stability is restored.

I really don't know for fact, but I think that that has to be wrong.

I guess that yes, manual pitch input overrides auto trim, but I also guess that autotrim will resume his job when the manual input is removed (more or less like the autothrust in a Boeing, you can move the thrust levers overriding the AT, but when you release the levers the AT will keep moving them.

Also, the load factor demand of the normal law is not a matter of autotrim only. It's also a matter of the elevator. I guess that if, for whatever reason, the trim stops working (for example because you grab the trim wheel and hold it there), the FCCs in normal or alternate law will keep commanding elevator as needed to keep the load factor.

If it wasn't like that, a manual trim input would mean that the FCCs would immediately revert to pitch direct law (i.e. would stop working as load factor demand), and I very much doubt that this is the case.

[Gabriel]

 AUTO FLT AP OFF,
 AUTO FLT A/THR OFF,
 AUTO FLT REAC W/S DET FAULT
 F/CTL RUD TRV LIM FAULT,
 F/CTL ALTN LAW,
 FLAG ON CAPT (F/O) PFD SPD LIM (unreliable airspeed, loss of green dot and speed bugs including VLS),
 FLAG ON CAPT (F/O) PFD FD (loss of the flight director).


The other five are:

 NAV TCAS FAULT
 NAV ADR DISAGREE
 F/CTL SEC 1 FAULT
 F/CTL PRIM 1 FAULT
 FLAG ON CAPT PFD FPV and FLAG ON F/O PFD FPV (loss of the FPV 'bird')

None of those are irrelevant, and all are very important for crew awareness in my opinion.

I have some questions (I think that some of them were discussed before):

Do we know that these were all the ECAM messages?
Aren't there any ECAM messages that don't trigger an ACARS message?
Could there have been more ACARS messages that either didn't have time to make it through the queue or that were sent but never received?
Do we know if there where any other "messages"? Flashing lights, warning lights, warning sounds (chimes, horns, sirens...)?

In particular with the messages:
In what order (in place, not in time) would they be displayed in the ECAM screen? I know the order is not "first to show goes up", there is some prioritizing logic so as the most urgent go up.
What's the "AUTO FLT REAC W/S DET FAULT" message about?
With a working and reliable static pressure and a working transponder, why would the TCAS fail and to what extent?
Why would the loose the flight path vector cue? It only takes pitch and AoA to compute it, and it could have ben a very good cue for the non-existent AoA information (the angle that the bird is below the plane cue gives you the AoA).
Do you really think that it was vital to have the following information available at the first moments?

F/CTL RUD TRV LIM FAULT
F/CTL ALTN LAW
NAV TCAS FAULT
NAV ADR DISAGREE
F/CTL SEC 1 FAULT
F/CTL PRIM 1 FAULT

You've written:
 FLAG ON CAPT (F/O) PFD SPD LIM (unreliable airspeed, loss of green dot and speed bugs including VLS)
Was a clear "unreliable airspeed" indication really displayed? Or they had to figure it out from the combination of symptoms?

My vote is for something like:
UNRELIABLE AIRSPEED
AP FAULT
AT FAULT
THRUST LOCK
STALL & SLW SPD PROT LOST

As a bonus, why kill the FD? If I have the memory item PITCH ATTIUDE 5º ANU, then the FD could show just that.

Even further, maybe it would be better to keep the AP and AT on and following an "Unreliable speed" mode where it commands pitch and thrust to the memory item values, or even better to the look-up table values, until the pilot manually disengage them.

And if you wan to go even further, why does the stall protection need to be lost? Ok, the stall AoA changes with the Mach number, and the Mach number is not available with an unreliable airspeed. But I guess that taking a conservative low "worst case" AoA can't do any harm, except preventing you from flying a bit slower than what you safely could.

[EconomyClass]

I don't work in aviation, but in IT, there are periods where the staffing level and expertise level were maximized by management due to the strong possibility of a sudden workload spike. This makes me wonder if Air France has a policy about when the pilots can take breaks and when breaks are forbidden. My fellow workers were trained and experienced. But I've been through lots of situations where the NUMBER of brains and bodies mattered too. Our phone lines would fill up and the brass, when they called in, did not like to be queued. More than that, there were things to monitor and respond to, and quite often a person has to UNI-task with things that are very critical.

So I can see if they have a policy that says all hands on deck till you clear the convergence zone, and all hands were not on deck, then fingers are rightly gonna be pointed.

[Gabriel]

I don't work in aviation, but in IT, there are periods where the staffing level and expertise level were maximized by management due to the strong possibility of a sudden workload spike. This makes me wonder if Air France has a policy about when the pilots can take breaks and when breaks are forbidden. My fellow workers were trained and experienced. But I've been through lots of situations where the NUMBER of brains and bodies mattered too. Our phone lines would fill up and the brass, when they called in, did not like to be queued. More than that, there were things to monitor and respond to, and quite often a person has to UNI-task with things that are very critical.

So I can see if they have a policy that says all hands on deck till you clear the convergence zone, and all hands were not on deck, then fingers are rightly gonna be pointed.

I don't think so. This plane can be flown by one pilot. The second pilot is there precisely to help handle periods of high workload like an emergency (where one flies the plane and the other troubleshoots), and as a back-up for the first pilot.

The third crewmember is not even a required crewmember, except to provide for the rest periods. If the flight had departed from Natal (the Eastern "tip" of Brazil) and had Lisbon for destination, the flight would have been 2 to 3 hours shorter and would have departed with only two pilots. The route, though across the Atlantic ocean, would have been virtually the same, including crossing the ITCZ.

[Evan]

What's the "AUTO FLT REAC W/S DET FAULT" message about?

This message indicates unavailability of the reaction to wind shear detection function. Come on Gabriel, you have the interim reports.

With a working and reliable static pressure and a working transponder, why would the TCAS fail and to what extent?

ADR (1) and (2) are 'fail'. This is a monitoring process internal to the TCAS which applies to the standard altitude parameter (it can thus be the altitude elaborated from ADR (1) or (2)) and is submitted to a “credibility” test. In actual fact the TCAS elaborates an altitude prediction that it compares permanently with the altitude received. When these two parameters move too far apart, it stops operating and generates this ECAM message. Once the altitude becomes “credible” again, normal operation resumes and the message disappears.

Why would the loose the flight path vector cue?

This message indicates that the flight path vector (FPV) function is selected but unavailable. In order to lose completely this function, which is elaborated by the three IRs, in a way that is compatible with the CFR, one of the following three conditions must be met for each ADR:

 barometric vertical speed higher, as an absolute value, than 20,000 ft/min,
 true air speed higher than 599 kt,
 measured calibrated airspeed lower than 60 kt.

Once the operating conditions are satisfied again, the FPVs reappear on the PFD (if TRK/FPA mode is still selected).

Do you really think that it was vital to have the following information available at the first moments?

F/CTL RUD TRV LIM FAULT
F/CTL ALTN LAW
NAV TCAS FAULT
NAV ADR DISAGREE
F/CTL SEC 1 FAULT
F/CTL PRIM 1 FAULT

Definitely. This is situational awareness. Would you rather the computer broke the news to them over time? This is becoming surreal.

You've written:
 FLAG ON CAPT (F/O) PFD SPD LIM (unreliable airspeed, loss of green dot and speed bugs including VLS)
Was a clear "unreliable airspeed" indication really displayed? Or they had to figure it out from the combination of symptoms?

Think about it. You lose green dot. That's your guide, and it's gone. The speed bugs are gone. Add to that a flag on the PFD. And you've got NAV ADR DISAGREE on the ECAM. If you don't recognize UAS at that point, what are you doing in the left seat?!

Even further, maybe it would be better to keep the AP and AT on and following an "Unreliable speed" mode where it commands pitch and thrust to the memory item values, or even better to the look-up table values, until the pilot manually disengage them.

You want the A/P to remain engaged without redundant air data?! The A/P in not AI. It is a tool for autoflight in normative conditions. It cannot come close to the human mind in dealing with anomalous situations.

And if you wan to go even further, why does the stall protection need to be lost?

Ditto. Without redundant air data, you can't have systems authority. This is where the pilot must assume his role as the top of the command hierarchy.

[MCM]

Without redundant air data, you can't have systems authority. This is where the pilot must assume his role as the top of the command hierarchy.

Correct.

Yet, the Airbus system does everything prior to this stage to keep him out of that loop.

You can't expect a pilot to be the master of all if the system is designed to not encourage that during normal operations.

I'm not saying that is a bad thing - I'm not against Airbus philosophy, as I think it has saved more aircraft than it has lost - but we have to realise the limitations of a system that is extremely complex, that relies on just visual cues and removes many of the natural piloting instincts.

[Gabriel]

This message indicates unavailability of the reaction to wind shear detection function.

Non-critical information. Your "well trained pilots" will know every line after the "UNRELIABLE AIRSPEED" one, if there was such a line.

Come on Gabriel, you have the interim reports.

It's faster to ask you . No, seriously, I've red it from cover to cover back then, I don't feel like doing it again these days. Lazy, me? Maybe.

ADR (1) and (2) are 'fail'.

Yes, I understand that. But the TCAS needs only altitude information. Why "fail" the whole ADR? I mean, the altitude was still displayed and in the PDFs and ISIS and was considered reliable, wasn't it? I know that a speed disagree con come both from a total pressure disagree or a static pressure disagree, but if the altitude info is consistent then the static pressure (and hence the altitude) is Ok.

I also asked how much the TCAS failed. It just turned itself off? I guess that at least it could have kept giving TA alerts, even with the RA inhibited (no need to predict the altitude or to elaborate an evasive solution).

This message indicates that the flight path vector (FPV) function is selected but unavailable. In order to lose completely this function, which is elaborated by the three IRs, in a way that is compatible with the CFR, one of the following three conditions must be met for each ADR:

 barometric vertical speed higher, as an absolute value, than 20,000 ft/min,
 true air speed higher than 599 kt,
 measured calibrated airspeed lower than 60 kt.

Once the operating conditions are satisfied again, the FPVs reappear on the PFD (if TRK/FPA mode is still selected).

So this means that the FPV flag was due one or more of to those parameters being exceeded, not due to the unreliable speed itself. Correct?

Definitely. This is situational awareness. Would you rather the computer broke the news to them over time? This is becoming surreal.

There is already a definition of which failures are communicated to the crew, when and in what order.

Some failures are not communicated until after landing. Some failures are not communicated, period, and are recorder in a log that is downloaded by maint. Among the messages being communicated at one given time, there is a prescribed priority with those with higher priority being shown at the top of the queue, even if they were triggered after other messages.

So somebody already defined what info NOT to display. Too much info can go AGAINST the situational awareness, because the more important pieces of info can get lost in the haystack.

Think about it. You lose green dot. That's your guide, and it's gone. The speed bugs are gone. Add to that a flag on the PFD. And you've got NAV ADR DISAGREE on the ECAM. If you don't recognize UAS at that point, what are you doing in the left seat?!

I think you are somehow arbitrary and even contradictory at times.
I agree, but I also think that a pilot that has an unreliable airspeed and doesn't know that this means that the rudder limiter freezes in the last place, or that the windshear reaction function is lost, etc. don't belong to the left seat. Also that the AP and AT are lost, and that one pilot MUST fly the plane, and that that means initially 5° pitch and CLB thrust, and that this last mart means taking the TL out of and back to CLB, don't belong to the left seat.

You sure want a "RUD TRV LIM FAULT", which could be immediately deduced after learning that you have an unreliable speed situation, and that a cleartext "UNRELIABLE AIRSPEED" message is not so important because it can be derived from the rest of the info? I think the "unreliable speed" message has a better chance of immediately tuning the pilot's mind in the "unreliable speed" channel and to trigger quickly the proper response from him: unreliable speed memory items.

You want the A/P to remain engaged without redundant air data?! The A/P in not AI. It is a tool for autoflight in normative conditions. It cannot come close to the human mind in dealing with anomalous situations.

Without redundant air data, you can't have systems authority. This is where the pilot must assume his role as the top of the command hierarchy.

You have redundant air data. Except airspeed.

Anyway, I think there is a thin line between an autopilot and a flight law that will still actively and with no pilot intervention fly the plane to meet given parameters even with the AP off.

If the computer can safely hold 1G regardless with no pilot input, it equally could hold 5° pitch instead. No airspeed data is needed.

Holding 5deg and CLB thrust is an easy straightforward mechanical task that could be perfectly delegated to the AP or FCC law, while the pilot do things that are more important and where the brain is more difficult to replace with a computer: Managing the situation as a whole, which involves assessing information, troubleshooting, monitoring the AP, making decisions and, why not, switching off the AP and taking flight control by himself if he judges it convenient.

[Evan]

Correct.

Yet, the Airbus system does everything prior to this stage to keep him out of that loop.

MCM, I need you to explain to me EXACTLY what you mean by this.

[Evan]

Holding 5deg and CLB thrust is an easy straightforward mechanical task that could be perfectly delegated to the AP or FCC law, while the pilot do things that are more important and where the brain is more difficult to replace with a computer: Managing the situation as a whole, which involves assessing information, troubleshooting, monitoring the AP, making decisions and, why not, switching off the AP and taking flight control by himself if he judges it convenient.

Gabriel. I don't believe what I'm hearing from you of all people. Nothing is more important than flying the plane, The AP or the FGMC cannot be trusted without the required levels of redundancy and we have two ADR's in disagreement. That means only IR can be trusted, and the procedures for recognizing and dealing with UAS are neither overwhelming nor unreasonably difficult if properly defined and trained. The question is, were they?

[MCM]

Its none of the big things Evan, its all of the small little things that add up.

Things like the thrust levers, sidestick - all these things subtlely remove the cues available to a pilot, and his "integration" with the machine.

Take something as simple as an engine failure.

A Boeing pilot will know about the engine failure by a few sources - engine indications, engine failure message. But the first one will probably be the control column rotating (as aileron is added by the a/p, or by himself) and the thrust levers moving forward. He will know something is wrong by the fact he is "connected" to the basic machine before any message or indication arrives.

The Airbus pilot will also know about the failure, but those two vital "aerodynamic" cues (for want of a better word) are missing. He is reliant on observing the thrust indication, or the message.

It isn't so much that he is totally out of the loop, but just that he hasn't been designed to be a part of the machine.

So, when it comes to having to, in the heat of battle, take over from the systems, it is easy to see why it would be difficult to be directly in tune.

For example - manual thrust. How many Airbus pilots have flown the aircraft around in manual thrust in cruise, and would know where the thrust levers should sit in manual? Conversely, the Boeing pilot knows approximately where they sit in normal cruise, and should be able to return them to the ballpark (which is all that is needed) very quickly.

Its not saying the Airbus is bad, its different. It makes up for these shortcomings in other ways. But it must be far harder for the pilot, when required, to assume the role of master, particularly when he does not get the experience of doing it the "old fashioned way" in normal operations.