Air France plane missing?

[Evan]

We need to do the following:

1) Replace the -AA pitot tubes with -BA. Why? Because it's the best we can do. They are state-of-the-art. Do the -BA solve the problem? Maybe, maybe they only make it slightly less likely. In either case, do it.

2) Require simulator training for unreliable airspeed recovery in nocturnal conditions with severe turbulence. Pilots will leave with a fresh understanding of the memory items and how to recognize and disregard an erroneous stall warning.

3) Review and possibly revise the QRH procedure for unreliable airspeed. There have been concerns raised as to what can be realistically achieved in such situations, and it has been mentioned that the QRH procedure recommends to respect stall warnings when they should absolutely be disregarded.

4) Review and revise flight restrictions into CB formations that may contain warm air updrafts and potential icing conditions at cruise altitude.

5) Continue the investigation.

6) End the discussion about seat belts. Pilots are well aware of the unexpected nature of turbulence and often preach this danger to pax and crew. They are strapped in at all times. A certain poster on this thread has a vivid imagination and little else to contribute. Please don't feed the troll.

[Evan]

And let me add:

7) Explore the possibility of adding a robust, non-pitot type of airspeed sensor as a backup to restore redundancy to the air data system.

[Tomtom]

I've heard two version from pros in forums:

• The single pilot (of a crew of two) has to wear the oxygen mask, if the other pilot leaves the flight deck. FAA Regulation.
• It's up to airlines / carriers to regulate

I believe only the first statement is correct:

For the US / FAA see:
$ 121.333 Paragraph (c)(3)

http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&sid=2dee898a74cd0155f632e5b1901e07c1&rgn=div5&view=text&node=14:3.0.1.1.4&idno=14#14:3.0.1.1.4.11.2.24

is relevant:
-----
(3) Notwithstanding paragraph (c)(2) of this section, if for any reason at any time it is necessary for one pilot to leave his station at the controls of the airplane when operating at flight altitudes above flight level 250, the remaining pilot at the controls shall put on and use his oxygen mask until the other pilot has returned to his duty station.
-----

Cheers
Tom

P.S. I'm sure Europe has similar thing...

[Tomtom]

Was just waiting for the synthetic cockpit voice:
"Whoop whoop - pull up - terrain - pull up - whoop whoop"

Have a good weekend.
Tom

[Leightman]

Evan: "7) Explore the possibility of adding a robust, non-pitot type of airspeed sensor as a backup to restore redundancy to the air data system."

This point is rather begging the question of why a system having multiple pitots is not already redundant. It should be. One answer, mentioned but glossed over so far, is that the computer system---in this case---effectively reduced and in fact eliminated the redundancy of the sytem. If this is true, replacing pitots that are correct 99% of the time with pitots that are correct 99.7% of the time does not solve the problem. It reduces the incidence of problem, at least until you get that unique set of conditions that exceed even the new pitots' abilities, but it does not address all the causes.

Put another way, if the pilots had been looking at three analog pitot readouts, rather than their computer's attempted interpretation of three pitots, would they have done a better job of computing--deductively or intuitionally--the right answer?

Pitots may be a major cause here. But the computer system as currently programmed may be more than an equal partner. And both of those may have been outweighed by turbulence so out of the norm that different pitots and computers might not have made much difference. It is possible to get so out of shape at that speed and altitude that completely perfect instruments won't save you.

The circumstantial evidence of other alleged airspeed anomolies appears to be growing and narrowing the list of suspects, but not all those reported anomolies will pan out as corroborative. Even if the pitots are found to be capable of error not previously forseen (99% correct rather than the assumed 99.8%, or pick a number), a percent of a percent applied to millions ofair miles flown still leaves some miles in certain jeopardy.

[Gabriel]

Evan: "7) Explore the possibility of adding a robust, non-pitot type of airspeed sensor as a backup to restore redundancy to the air data system."

This point is rather begging the question of why a system having multiple pitots is not already redundant.

Because an external factor affecting one pitot would possibly affect all three pitots (or as many pitots as you have installed). Violent icing beyond the pitot heat capability, for example.

[seahawk]

Thank you for continuing the discusion in a much nicer manner.

[Evan]

Evan: "7) Explore the possibility of adding a robust, non-pitot type of airspeed sensor as a backup to restore redundancy to the air data system."

This point is rather begging the question of why a system having multiple pitots is not already redundant.

Put another way, if the pilots had been looking at three analog pitot readouts, rather than their computer's attempted interpretation of three pitots, would they have done a better job of computing--deductively or intuitionally--the right answer?

If you look at it this way: FBW has a redundant philosophy that uses fully autonomous systems to prevent any single condition from effecting all systems (or minimize that possibility). The air data part of the system relies on three autonomous but identical probes, so if a condition (icing) is present, you have to expect each probe to fail by the same weakness. Therefore, you have a flaw in your redundancy.

For example, on the older A330, you have analog back up instruments. You have a back-up probe on the Capt side with no ADM feeding the instruments. It feeds to the back up instruments mechanically. Because the back-up system is not of identical design to the others, it approaches real redundancy. Of course, to be truly redundant, the back-up probe would be of a design that does not share the same vulnerabilities as the primary sensors.

The current A330 has three autonomous but identical air data circuits. Each is vulnerable to the same environmental failure, hence no real redundancy in such conditions.

I don't really understand what you are proposing as an improvement to the system architecture itself. If two ADRs disagree, the system has to hand control over to the pilot, including degrading control law it can no longer accurately enforce. That end of things seems to work pretty well. With a functional, truly redundant source for airspeed data (the back-up instrument), any qualified pilot should be able to stay within a safe airspeed envelope until the problem clears up and continue the flight in alternate law with ADIRU3 functioning.

This is the schematic for the older A330 design:

[Leightman]

Thanks Gabriel and Evan for your clear and concise replies. So yes, I concede regarding the advantage of having multiple pitot/airspeed sensor models; that's not hard to do. I may not have a leg to stand on, but I want to take this a step farther and try to make three points. Whether I am right or not is not the issue; the issue is if there is sufficient reserve defense in your argument/information to render my argument virtually unsupportable, in which case I can stop beating that particular dead horse.

If you have two identical pitots and one dissimilar airpseed sensor, and the two identicals fail with the same readings, a choice must be made between two identical readouts and a third that differs. As Evan notes the older A330 gives this choice to the pilot, whereas the new 330 gives it to the computer. The older 330 still presents a dilemma: what info is correct?

One answer for this is pragmatic, ie, if an SOP is in place and you don't have planes falling from the sky like clockwork, the SOP is sufficient. So the first point is that the SOP may, like the pitot that is correct 99.8% of the time, not be 100% effective, and the AF447 crash may be in part linked to this 0.2%. As you note, the SOP provides a temporary workaround that hopefully allows the plane to remain controllable until the instrument problem clears up. But its effectiveness is somewhat limited by time and by flying conditions; one would not wish to fly the rest of a 6 hour flight at night through multiple storm lines on alternate law for example, with a continuing major airspeed disagreement, and with one's gut instinct relying on a single airspeed probe which, unbeknownst to you, is just about to run smack into it's own unique 0.1% error.

The second point is that when the 'which pitot is correct' decision is given to the computer, the answer is not a slam dunk, cannot be an absolutely 100% correct answer. The computer can only use its programmed logic to make a decision, and that decision is correctly to kick back to alternate law. This would differ from a system that had all analog readouts, a warning for airspeed disagree, and a less capable and integrated autopilot. The plane would be flying identically whether it was a new A330 or an old one. But in the new 330 the pilots would suddenly have to take over and hand fly the plane under the airspeed disagree memory and written SOPs, while at the same time comprehend and interpret a computer warning. In other words, it appears that in the new A330 system the instantaneous workload of this scenario jumps at the same time a computer warning (requiring attention) appears. So the qecond question would be, is this true? Under a scenario of airspeed disagree (possibly of extended duration) would the pilots' instantaneous workload be greater or lower in the new A330?

Third point is a continuation of the second point. As has been pointed out (and I am taking this as true), multiple computers in the A330 talk to each other, and in out-of-the-ordinary scenarios, it is quite possible that a burst of warnings can cascade through the system and up onto the main display based on just a few causes. To a dispassionate computer these are just warnings, to be listed as a pilot and maintenance reference, but each requiring differing degrees of pilot attention. In other words, the pilot needs to comprehend and assess the potential implications of each warmning, especially when thinga are going awry. So these warnings are added to the pilots' work load, at an instant when the fundamental issue is to aviate, not troubleshoot the computer. As has been previously described, such a cascade might be airspeed disagree, AP off, AOA deviation (turbulence), rudder limiter off (out-of-spec yaw due to airspeed disagree due to turbulence), and probably more I can't think of. And these warnings might well come at a time when the actual attitude of the plane in both AOA and yaw has changed due to turbulence.

It is important that this be seen in relation to time: two seconds ago you and I as pilots were sitting here as we had been for the last 45 minutes, AP on, studying and continually recalibrating the weather radar (it wasn't working very well) to figure out the best way through the line of storms up ahead. There had been some very light and intermittent turbulence but nothing yet to suggest turning on the pax seat belt signs. Now two seconds later the plane had slammed into severe turbulence, AP off, a too-slow cascade of warnings on the display, loss of basic flight data on the display, immediate concern for pax safety, a command to turn on and announce the seat belt use, disagrees between airspeed, AOA and yaw, and so on.

(Where this heads, and I'm into conjecture here: As much as ACARS may be suspect, I think it IS useful to note that 14 (I think, virtually the system's maximum, and perhaps more that never got out) of the ACARS warnings happened during 0210, which were followed by only 2 or 3 per minute. I haven't seen any reasons yet why those 14 warnings could not have been generated by a single, sudden turbulence event that may or may not have caused airframe damage (but not yet failure), but definitely caused an upset in aircraft attitude which in combination with flight data display confusion or failure led to an unrecoverable attitude and speed.

In other words, point 1 is about airspeed sensor confidence which is Evan's primary point, and points 2 and 3 that are questions about the degree to which the computer flight data system actually reduces or increases pilot instantaneous workload, and may have been contributory to the crash.

OK, leading with my chin here.

[Gabriel]

A slightly different ange on this...

It looks like the archeticture now is pitot1, static1, RAT1 and AoA1 feed ADR1; pitot2, staic2 etc feed ADR2, and so on.

A failure or disagree of ONE of these sensors render the ADR faulty?

Why not to have all sensors feed all ADRs, and if there is an odd indication in one sensor let each ADR decide which one is wrong, and vote on the final decision only? (the decision could be "here is as far as I can get, now let the pilot decide").

The pilot could have individual readings for each sensor. For example in an unreliable speed situation, the failure can be related with the pitot or the static port. If the failure is with the static port, also the altitude and vertical speed would be unreliable. Comparing the readins of each sensor would enable to tell which one is failing and take appropiate means.

In this way, for example, with a failure of pitot1, static2 and AoA3, all three ADRs would remain operative.

[Evan]

If you have two identical pitots and one dissimilar airpseed sensor, and the two identicals fail with the same readings, a choice must be made between two identical readouts and a third that differs. As Evan notes the older A330 gives this choice to the pilot, whereas the new 330 gives it to the computer. The older 330 still presents a dilemma: what info is correct?

I might have confused you with that. The schematic I posted only refers to the nature of the back-up instruments. The older A330s are analog i.e. no ADR involved and the newer A330s have an ADR driven digital instrumentation with an autonomous (battery) power source. I only posted that to advocate dissimilar systems. The logic regarding the ADIRUs remain the same in both.

You bring up a good point though, that if two ADRs report the same erroneous speed data, the current system will favor them over the remaining accurate one, and that is where the pilot needs to intervene. This is a theoretical weakness in the Airbus design but the odds of this happening, where two pitots ice up at the same rate and report the exact same erroneous speed has to be very low, and if there is a three way discrepancy, the system assumes failure of all three. If the pilot had a dependable, truly redundant back-up reference, and you had readings of 60kts, 50kts and 280kts, it would be obvious as to which reading to trust. FBW doesn't have that kind of AI yet.

One answer for this is pragmatic, ie, if an SOP is in place and you don't have planes falling from the sky like clockwork, the SOP is sufficient. So the first point is that the SOP may, like the pitot that is correct 99.8% of the time, not be 100% effective, and the AF447 crash may be in part linked to this 0.2%. As you note, the SOP provides a temporary workaround that hopefully allows the plane to remain controllable until the instrument problem clears up. But its effectiveness is somewhat limited by time and by flying conditions; one would not wish to fly the rest of a 6 hour flight at night through multiple storm lines on alternate law for example, with a continuing major airspeed disagreement, and with one's gut instinct relying on a single airspeed probe which, unbeknownst to you, is just about to run smack into it's own unique 0.1% error.

From what I can tell, these icing related failures usually clear up over a matter of minutes, so the issue is only related to the critical nature of those few minutes. Also, once the system has degraded to alternate law, it cannot be reset to normal until the a/c is on the ground (and it goes to direct when the gear are extended to give feel for flare).

The second point is that when the 'which pitot is correct' decision is given to the computer, the answer is not a slam dunk, cannot be an absolutely 100% correct answer. The computer can only use its programmed logic to make a decision, and that decision is correctly to kick back to alternate law. This would differ from a system that had all analog readouts, a warning for airspeed disagree, and a less capable and integrated autopilot. The plane would be flying identically whether it was a new A330 or an old one. But in the new 330 the pilots would suddenly have to take over and hand fly the plane under the airspeed disagree memory and written SOPs, while at the same time comprehend and interpret a computer warning. In other words, it appears that in the new A330 system the instantaneous workload of this scenario jumps at the same time a computer warning (requiring attention) appears. So the qecond question would be, is this true? Under a scenario of airspeed disagree (possibly of extended duration) would the pilots' instantaneous workload be greater or lower in the new A330?

The pilots do have a visual reference of all three speed indications. ADIRU1 goes to the Capt's PFD, ADIRU2 goes to the F/O's PFD, and ADIRU3 is shown on the backup instruments. There is no cross-channel redundancy between ADIRU1 and ADIRU2. ADIRU3 is the only redundant module. Again, the computer will not decide for a single speed indication, only against one in favor of two matching speed indications.

The pilot workload would be the same for both versions, and it is a handful to deal with. That's why I am so adamant about working to prevent it in the first place.

Third point is a continuation of the second point. As has been pointed out (and I am taking this as true), multiple computers in the A330 talk to each other, and in out-of-the-ordinary scenarios, it is quite possible that a burst of warnings can cascade through the system and up onto the main display based on just a few causes. To a dispassionate computer these are just warnings, to be listed as a pilot and maintenance reference, but each requiring differing degrees of pilot attention. In other words, the pilot needs to comprehend and assess the potential implications of each warmning, especially when thinga are going awry. So these warnings are added to the pilots' work load, at an instant when the fundamental issue is to aviate, not troubleshoot the computer. As has been previously described, such a cascade might be airspeed disagree, AP off, AOA deviation (turbulence), rudder limiter off (out-of-spec yaw due to airspeed disagree due to turbulence), and probably more I can't think of. And these warnings might well come at a time when the actual attitude of the plane in both AOA and yaw has changed due to turbulence.

The reason I also advocate simulator training for unreliable airspeed under difficult conditions is that the nature and sequence of the messages are indicative of the failure. Together, they are symptomatic of the problem and with practice, pilots should be able to recognize the pattern and have proper situational awareness to take corrective action.

[Evan]

Third point is a continuation of the second point. As has been pointed out (and I am taking this as true), multiple computers in the A330 talk to each other, and in out-of-the-ordinary scenarios, it is quite possible that a burst of warnings can cascade through the system and up onto the main display based on just a few causes. To a dispassionate computer these are just warnings, to be listed as a pilot and maintenance reference, but each requiring differing degrees of pilot attention. In other words, the pilot needs to comprehend and assess the potential implications of each warmning, especially when thinga are going awry. So these warnings are added to the pilots' work load, at an instant when the fundamental issue is to aviate, not troubleshoot the computer. As has been previously described, such a cascade might be airspeed disagree, AP off, AOA deviation (turbulence), rudder limiter off (out-of-spec yaw due to airspeed disagree due to turbulence), and probably more I can't think of. And these warnings might well come at a time when the actual attitude of the plane in both AOA and yaw has changed due to turbulence.

An alternate possibility in preventing unreliable airspeed from ending in disaster is to require all Airbus a/c to be equipped with the BUSS system I posted a page or two ago. It is now standard issue on the A380 and optional on the A330/340. In the event of unreliable airspeed, it compiles AoA data and replaces the speed tape on the PFD with a green/amber/red zone scale. As I understand it, the computer calculates AoA data with current weight and configuration and the pilot uses thrust to stay within the central green zone until the problem clears up. It would seem to make airspeed data loss far more manageable in extreme conditions, and might be as good a solution as any. I need to learn more about it and how reliable it is, but it also would seem to be merely a logic upgrade, so reasonably cheap and easy to accomplish. This, in conjunction with improved sim training, might make the pitot issue less critical.

[seahawk]

A slightly different ange on this...

It looks like the archeticture now is pitot1, static1, RAT1 and AoA1 feed ADR1; pitot2, staic2 etc feed ADR2, and so on.

A failure or disagree of ONE of these sensors render the ADR faulty?

Why not to have all sensors feed all ADRs, and if there is an odd indication in one sensor let each ADR decide which one is wrong, and vote on the final decision only? (the decision could be "here is as far as I can get, now let the pilot decide").

The pilot could have individual readings for each sensor. For example in an unreliable speed situation, the failure can be related with the pitot or the static port. If the failure is with the static port, also the altitude and vertical speed would be unreliable. Comparing the readins of each sensor would enable to tell which one is failing and take appropiate means.

In this way, for example, with a failure of pitot1, static2 and AoA3, all three ADRs would remain operative.

No, it is must be up to the human crew to determine which sensor is correct. If the computer detects that the system data does no longer match, it must disconnect and hand control to the crew. Imagine one would go with the 2:1 rule and 2 probes would be faulty.
Maybe if the system would store the previous data and compare that for each system to the current data under consideration of the control inputs, it could point out which system most likely is wrong. But then the crew should be able to do this quicker.

[P3_Super_Bee]

We need to do the following:

1) Replace the -AA pitot tubes with -BA. Why? Because it's the best we can do. They are state-of-the-art. Do the -BA solve the problem? Maybe, maybe they only make it slightly less likely. In either case, do it.

TAM Already changed their probes and have STILL HAVE the problem.

Its also quite possible Northwest changed their probes prior to the 23rd of June incident...

So what did changing them do???? NOTHING. Because they ARE NOT the problem.

I don't understand this idiocy...

Its no wonder ITS goes off so easy. Geeesh...

[Evan]

Why not to have all sensors feed all ADRs, and if there is an odd indication in one sensor let each ADR decide which one is wrong, and vote on the final decision only? (the decision could be "here is as far as I can get, now let the pilot decide").

The ADIRUs do not contain decision-making logic. They feed data to PRIM1, the primary flight computer that can discriminate amongst them and rule out the single anomalous reading. But only if the other two are in agreement. This is designed to deal with isolated failure in one of the three systems. The idea is to have three completely autonomous air data sources from probe to instrument panel.

Probe icing is not an isolated failure, it is a global one. With the current design it affects all three systems similarly and simultaneously. Three discreet ADIRUs and two (or three) PRIM computers cannot compensate for total airspeed data loss, and you end up hand-flying a lot of disabled hardware. This is the flaw that I am addressing.