Air France accident

[Guest ozzie]

i assume most of us watched the program last night on the investigation into the loss of the Air France Airbus. I found it very interesting and informative. We have learnt about 'super cooled' water droplets and the affect they can have on icing ect. but that was the first time i have seen it demonstrated. As soon as the pure super cooled water was contaminated it froze instantly. what i also found interesting but not surprising was the investigators comments that when the proverbial hits the fan that airline pilots because of the automated systems of the aircraft they fly,lack the basic 'seat of the pants' sklls needed to recover from situations like this.

 

explains why CASA is in such a mess. no auto pilot fitted to the desk.

 

 

[pradeep]

I joined the show a bit later around 10.20, but able to figure out what happened.

 

The demo on supercooled water is a first time for me too.

 

I believe once we got used to something then it becomes very hard to change that habit - autopilot.

 

My understanding is they would have done the stall recoveries in their early flight trainings (like we do now) but unless they practice it every now and then it is very unlikely that they will recover from a stall that quick in reality. Most of the things we do are coming from practice, sometimes even without thinking we tend to do that we used to do. I used to press the brake when drive automatic gear cars.

 

I think it's not a bad idea to atleast re practice the critical events in a simulator every year or so.

 

Cheers,

 

 

[Lexman]

I caught most of it as well. It came as something of a surprise that the pilots aren't doing stall recovery in their simulator time - I just assumed they'd be doing all sorts of abnormal scenario training that is not practical to perform in an actual passenger plane. It was also a real eye opener that the simple procedure of increasing power was not done immediately in 10 of 13 similar pitot tube incidents. But then again, I'm not a commercial airline pilot so this is just me grandstanding, feel free to take my opinions with a grain of salt.

 

As for the supercooled liquids, I experienced a freezing rain storm when I was living in the US. The precipitation fell as rain but it was so cold it froze the moment it touched anything. Brought down all the power lines (we had no electricity for 7 days), trees and branches, etc. Got lots of awesome photos though.

 

You can supercool fluids at home, place a sealed container under pressure in the freezer. When you open it the contents will freeze almost as rapidly as the demonstration last night. Easiest example is cooling a stubby of beer in the freezer, only to have the contents freeze solid after one mouthful.

 

Cheers,

 

Lexman the verbose.

 

 

[Guest basscheffers]

what i also found interesting but not surprising was the investigators comments that when the proverbial hits the fan that airline pilots because of the automated systems of the aircraft they fly

Similar thing happened to American Eagle Flight 4184 - Wikipedia, the free encyclopedia, an ATR-72 with not nearly as much automation as a modern Airbus.

The main issue with autopilots is that there are incredibly stupid. Even on an A380. They will not trade altitude for airspeed! What happens is icing decreases lift, the a/p keeps increasing pitch to maintain altitude. When the inevitable happens the stick shakers comes on, the a/p disconnects and two very confused pilots are handed a stalled aircraft.

 

Yes, if they had been properly monitoring the flight, this wouldn't have happened. But a few extra lines of code would allow the airplane to descent instead of stalling, with alarm bells going off giving the crew plenty of time to figure out what's really happening.

 

 

[flying dog]

Bugga, I didn't watch it.

 

Sounds like I should have.

 

 

[Guest basscheffers]

Didn't see it either. Remember this is all speculation about an ongoing investigation. Super-cooled droplets is a real phenomenon, but here it is just a theory of why the aircraft might have stalled.

 

 

[Guest ozzie]

What got the pilots was that when they entered the turbulent air they dialled in a lower mach number down from i think .82 to .74 around those figures. the aircraft slowed up. when they started to have problems the autopilot disconnected because it lost airspeed information. revealed from the info the aircraft transmitted back to airbus in france. the aircraft would have been losing one knot per second and the response time from the pilot to realise, analize and respond to the situation was around 14 seconds more than enough time for the aircraft to reach its stall speed. As the investigator stated when auto throttle is selected the throttle levers in the airbus do not move they stay at the last position they were placed in. auto throttle stayed on. the pilot was so occupied with his primary flight instruments he failed to turn his head and read the engines power setting and by the position of the levers may have assumed that AT disconnected and engine power restored to the position of the throttle position, when he raised the nose the aircraft stalled. The correct procedure in this situation for this aircraft is to set the power at 85% and adopt a nose up attitude of 5 degrees. IE power + attitude = safe airspeed. this had been proven as the correct response as this model airbus had a large number of ASI problems earlier and the entire fleet was in the process of having the pitots replaced.

 

At some stage during the decent the cpt had managed to initiate the recovery but did not have enough remaining altitude for full recovery. from the parts recovered it was found that the aircraft had hit the water during the final stages of recovery just before pull up commenced. it hit the water in a level attitude but still at a highish rate of decent. The aircraft was still in one piece when it hit. another two hundred or so feet would have seen a successfull recovery. At no point did the investigater suggest airframe icing as a contributing factor.

 

there was very little if any 'speculation' the investigation was based on the information the aircraft transmitted to airbus, sattelite images of the storm cells, and recovered parts of the aircraft. futher information was gleaned from recreating the entire scenario in the simulator. until the black boxes are recovered this will be as close as a conclusion as they will get to. Unlike the aircrash investigation shows there was no dramatisation in this program.

 

ozzie

 

 

[dazza 38]

Bugga, I didn't watch it.Sounds like I should have.

I didnt watch it either, i start at 5.30 am. Thanks for you guys imput.

 

 

[Guest basscheffers]

Which channel was it on? And the actual title of the show? (So we know where to look for repeats)

 

 

[Guest basscheffers]

Answering my own question. Seems it is called "Lost: The Mystery Of Flight 447" and it's available at the usual outlets. Downloading it now...

 

 

[PapaFox]

I just finished watching it.

 

It certainly raised my eyebrows to hear that ATPs don't practice stalls in the simulators. Just what are they doing apart from twirling knobs??? Just joking, but I would have thought they should be getting the aircraft into unusual attitudes and having to practice safe recoveries as part of their training, something that hopefully they would never need to use in real life.

 

Hmm, and I've just booked tickets for a trip to NY :ah_oh:

 

 

[Guest basscheffers]

As the docco showed, even for someone who spends most of his days tumbling through the sky, recovery is very hard. Suggesting that with more unusual attitude training these guys would have done much better recovering the aircraft in IMC is probably not very realistic.

 

Instead, focus training on not getting into that situation. Whenever any disconnect like this happens, HOTAS - hands on throttle and stick - should be the immediate response. Way too often in investigations it becomes clear that the crew just sits back and watches.

 

I hope they find the recorders, that would most likely give the full account of what happened. Plus it's 2010 and the acronym CVR should stand for "cockpit video recorder" so investigators can see what the pilots are doing, rather than infering it from voice.

 

As usual, the suggestion that too much automation makes flying less safe is complete and utter BS. Compare accidents rates pre- and post-automation. Compare Airbus 320 to 737-300. (only introduced a few years before 320, so same generation minus automation) Accident rates aren't even in the same league and not until introducing the extensively automated (but not FBW) 737NG have Boeing fatality rates dropped to Airbus levels.

 

Yes, there is the occasional accident where automation is to blame, but for every one of those you don't hear about the 9 other accidents, because those accidents simply didn't happen, thanks to automation.

 

But never let the truth get in the way of a good story!

 

 

[Vorticity]

One of my uni lecturers used to say that in the future you would have a pilot and a dog up front. The dog would be trained to bite the pilot if theyvtried to touch the controls!

 

 

[Guest ozzie]

Dittto on hands on flying. Scully proved that when he graced it onto the Hudson.

 

Back in the bad old days i lost count of how many commercial pilots who were put back into reality by the humble old Scout. The rule back then was never lend your plane to a "real" pilot.When you add up their real flying time were they are actually manipulating the aircraft you will find that the average RAAus pilot has more experience.

 

 

[Yenn]

Did Scully hand fly it into the Hudson or was he so competent that he knew how to gwt the computer to handle the situation. I used to be that airline pilots were not allowed to fly privately lest they exceeded their allowable hours.

 

 

[Guest gasdive]

I saw it too. I was disturbed by it... It reminded me very much of a similar flight disaster show. Another blocked port (static port). They took off with it partially blocked and ended up flying into the sea in confusion. Again they were unable to control their speed or height. Simply looking at the horizon, angle of attack indicator and power settings would have allowed them to fly perfectly well. Instead they asked for instructions from the ground, who read back their height as reported by their transponder, that was reading from the same blocked static port. Had they been passengers who'd taken over when the pilots ate the fish... you could understand.

 

When I did some PPL training back in the 1980's one of the first things we were taught was how to recognise blocked pitot and static ports. They have very clear symptoms on the instruments. It's as nearly as basic as seeing the park brake warning light showing on a car dash and knowing that the handbrake is left on.

 

Surely something so basic should be part of the training for airline pilots?

 

Cheers Jason =:)

 

 

[facthunter]

hands on and other.

 

Yenn you had to get permission to fly privately and I cannot remember when it was refused. It could compromise your hours. I know plenty of current airline pilots who fly smaller aircraft and I think it is encouraged by the more enlightened airlines. After Qantas had an "upset" with a 707 way back they put crews in the simulator and found that some responses were not optimal (to put it mildly) and I'm sure that some other airlines were much worse because their pilots were never taught EMT, let alone be current in it.

 

Gasdive I think you are being a bit hard. The sensors go to things called air data computers that give their own interpretation of what is happening and usually bring up a list of "faults" on an enunciator/ screen, that don't clearly lead you to understand the source of the problem. Those fault readings were all sent to Air France automatically and did not give people who had lots of time and no danger to themselves (as they are on the ground) a very clear indication of what was happening. The aircraft was in a meteorological situation called an inter-tropic front or convergence zone, and you don't get a nice ride through them. in fact if you don't get it right the aircraft can break up. This aircraft did not do that as it would have if the airspeed had built up.and had been handled roughly. It is pretty hard to have much idea of what is going on unless you have actually been in similar situations. Nev

 

 

[Guest ozzie]

Yenn, Scully is a high time glider pilot, he knows how to fly a aircraft without power.

 

If you wander through the EAA website you will find the episode where he gave a real interesting talk at last years airventure on his flying history and how it saved the day.

 

 

[Ferris]

I saw it too. I was disturbed by it... It reminded me very much of a similar flight disaster show. Another blocked port (static port). They took off with it partially blocked and ended up flying into the sea in confusion. Again they were unable to control their speed or height. Simply looking at the horizon, angle of attack indicator and power settings would have allowed them to fly perfectly well. Instead they asked for instructions from the ground, who read back their height as reported by their transponder, that was reading from the same blocked static port. Had they been passengers who'd taken over when the pilots ate the fish... you could understand.When I did some PPL training back in the 1980's one of the first things we were taught was how to recognise blocked pitot and static ports. They have very clear symptoms on the instruments. It's as nearly as basic as seeing the park brake warning light showing on a car dash and knowing that the handbrake is left on.

 

Surely something so basic should be part of the training for airline pilots?

 

Cheers Jason =:)

Gasdive, I think you are being a little harsh on the crew from that disaster, assuming we are talking about the same documentary. It was at night and they didn't have an horizon at all. The crew were overloaded with alarms going off all over the place and conflicting information from various instruments. IFR training is very big on 'trust your instruments, not your instincts.' Yes in hindsight they should have recognised the danger, but if you've got no way of visually determining where you are, then which instrument do you trust and which do you discard?

 

 

[Guest gasdive]

I'm not being hard on the pilots, I'm being hard on their training.

 

Blocked pitots happen. Recognising the symptoms of a blocked pitot is something so basic that it's taught to GA pilots before they're allowed to solo.

 

Surely part of the process of getting type endorsement in that aircraft is how to recognise a blocked pitot on that aircraft. GA pilots look at the instruments. These pilots should have been taught that if the Auto pilot hands back control and you get this raft of error messages, then you have a blocked pitot and will need to fly by artificial horizon (which still works with a blocked pitot), throttle setting and AoA indicator.

 

It would also have been nice if when designing the aircraft to have triple redundant pitot tubes there had been something that alerted the crew that the first two had failed... Triple redundant systems that just allow failures to accumulate un-noticed aren't redundant systems at all. There was no point at all in sticking three of them out in the airstream wasting fuel. One would have provided exactly the same level of redundancy. I'm simply gobsmacked that some engineer out there designed it that way and had the hide to cash his pay cheques. Had the pilots been alerted with a warning say "Number 2 pitot blocked" flashing on the panel, followed 1 minute later with a warning horn, flashing light and the screens blinking "Number 2 and Number 3 pitot blocked" do you think the outcome might have been different when the final pitot blocked? I certainly do.

 

Looks like human error to me.

 

Cheers Jason =:)

 

 

[Guest ozzie]

Woah hang on there. The pitots have a powerfull heater in them to prevent them from icing up. the super cooled water vaper was so cold that it overwellmed the heaters capability to keep them free, it happened almost instantley not a slow build up and it happened to all three in very quick succesion. The storm cell they flew into was hidden from their wx radar by a smaller one. thy were in a storm cell that the aircraft was not designed to be in. when the failures stared to pop up and the AP disconnected the crew started to go into WTF mode and wasted valuble time by trying to work out why instead of accepting the fault and going straight into fly the aircraft mode. they added to the problem by not doing what they were trained to do and you are trained to do exactly the same thing when you get your instrument rating. ASI failure you use your other insrtuments to cover the ASI. power, attitude.

 

they would have learned that before they even got into jets. also they would have known how to respond to this situation as other airbus pilots had experienced this exact same problem and would have been told about it.

 

 

[Guest gasdive]

Sorry, I meant human error, not of the pilots, but of the people who designed the aircraft and wrote the training for the endorsement and aircraft manuals.

 

They've obviously approached the design of the autopilot input system just as you would approach the design of an aircraft instrument system.

 

It's not that at all. Once you start using it as the input for the autopilot it becomes the sensor system of an automated life support system. Like a cargo cult they've designed it to "look" like the real thing, with three sensors. But like a cargo cult airfield, it just doesn't *work* like the real thing.

 

Here's how I would design it for triple redundancy and why I would do it differently. Three sensors in the system. (this is the cargo cult aspect, they knew enough to know that you need three). Make each sensor as reliable as you cost effectively can. They did that bit right too, no point in building sensors that can withstand conditions no-one had any idea that they would encounter. Then they depart from sensible life support design. Each sensor should be completely independent in every way from every other sensor. From the report on TV it appears they just feed the air from all three into one pressure sensor. The output from each sensor should be compared. You need to decide a level of agreement. If one sensor disagrees with the other two by more than a certain amount then it should be voted down and it's output ignored. Moreover as soon as that happens, you have to *tell the humans*. Additionally it's good practice to include some sort of time dependent check system on *each* sensor. A typical failure mode of any sensor is to freeze up. In this case it's literally frozen, but in many cases it's because the sensor has jambed up. It may be that it's a mechanical sensor and something's fallen off or it may be that an electrical short has locked the output to a particular level. Could be anything. In the lifesupport design field I come from it's condensation over the membrane of an Oxygen sensor. Good software will check regularly for slight and constant variations in the readings. If they're not there, then vote that sensor out and *tell the humans*. It should also check for response. When the system makes a change (in my case injects oxgyen, but in this case perhaps alters power setting or elevators) then the computers should look for a corresponding change in sensor output. If it's not there, then *tell the humans*.

 

The final aspect of designing a life support system is that you need to train the humans to respond correctly when the system has a problem and defaults to the "tell the humans". There needs to be some sort of manual backup mode that the humans then go to when the auto system is having problems. In the systems I've designed it is that you need to start flushing a known gas through the system to keep it in the life support range while you get out of the place where you needed lifesupport. In this case it's that the humans need to take over manual control of the throttle, and pitch controls and be guided by independent sensors (AoA, Throttle setting, Artificial Horizon).

 

I'd like to say "it's not rocket science" but it is really. It all came out of research in the 60's into what makes a man rated system actually "man rated". It is however deeply simple stuff. If you can point to any one single thing and say "if this breaks we all die" then you need to either make it redundant (properly redundant not fake redundant) or beef it up to some crazy level such that if it breaks then everyone would have been long dead from whatever it was that broke it.

 

Cheers Jason =:)

 

 

[Guest basscheffers]

Each sensor should be completely independent in every way from every other sensor. From the report on TV it appears they just feed the air from all three into one pressure sensor. The output from each sensor should be compared.

That's exactly how it works, independent sensors. In the displays of the ACARS data you can see it independently talking about the CAP and FO pitot failing. You can only do that if you have seperate sensors.

The crash of Birgenair Flight 301 - Wikipedia, the free encyclopedia highlighted that the 757's A/P could only take it's readings from the captain's pitot. Boeing retro-fitted a switch to all 757s to allow the crew to switch.

 

Airbus has 3 independent ones. That's better than two, why? if two are dissagreeing, which one is right? If two are the same and one dissagrees, you know which one is broken!

 

I don't think there is too much to blame on the engineers here. The computer gave the correct warning messages (multiple pitot failures), and while the pitots on the 330 had been know to fail, if the theory in the programme was right, then the better pitots would have been unlikely to cope with the super cooled droplets either.

 

Two things that stand out for me: one about the pilots, one about the system:

 

• Like in so many aircrashes this could be a CRM issue: two pilots trying to figure out the problem with nobody actually flying the aircraft.
   
   
  
• On a multiple pitot failure, instead of disconnecting, the A/P itself should have selected 85% power and 5% nose up.
   
   
  

 

 

 

 

[Guest gasdive]

Ok, sorry,

 

I went from the info in the TV documentary. I should know better that that. I agree that the system should have been designed to switch to a default "limp home" mode before handing over to the humans.

 

I still think that the people who wrote the training for type should have trained them to recognise blocked pitot on that type of aircraft and take the right action.

 

I also wonder about designing a commercial (non military) aircraft that's not inherently stable. They said on the doco that rough air cruise is only 10 knts above stall at that altitude. If a stall means everyone dies, surely that's a funny way to design an aircraft. Constantly flying around only jogging speed above the "now we die" speed.

 

Cheers Jason =:)

 

 

[Guest basscheffers]

The aircraft are quite stable, usually in cases like these (and Birginair comes to mind), the pilots do not believe the airspeed is low and they are about to stall, even when the stick shaker comes on!

 

They keep pulling back on the stick and the violent stall happens eventually and even then they keep pulling, overpowering the stick pusher as well! (Colgan Air Flight 3407 - Wikipedia, the free encyclopedia)