What Really Happened Aboard Air France 447

[raygun]

Popular Mechanics:

 

 

Gatwick-inbound-threshold by wxman1, on Flickr

[raygun]

Can we talk? I have to get this off of my chest or I'm going to explode. For some reason this incident really resonates in the core of my being.

 

I've been following this since day one, I've followed the technical discussions at AIRLINERS.NET through many several 1000's of posts and have an honorary graduate degree in aeronautics and avionics as a result (real life experience - albeit not entirely irrelevent - is not wholly germane concerning my technical credibility regarding this specific incident). In any case I'm gobsmacked at what I read in the cited article.

[raygun]

From the cited article here is a synopsis of what occurred during the course of the doomed airliner's final few minutes.

 

01:36, the flight enters the outer extremities of a tropical storm system...

 

01:51, the cockpit becomes illuminated by a strange electrical phenomenon [st.Elmo's Fire]...

 

~02:00, the [First Officer co-pilot], David Robert, returns to the cockpit after a rest break...The [acting PIC, i.e., captain] gets up and gives him the left-

hand seat [to assume PNF / PM duty, leaving Second Officer] Bonin in charge of the controls [as PF].

 

02:02 the flight captain leaves the flight deck [to to comply with mandatory rest requirements]

 

02:03:44 (Bonin) La convergence inter tropicale… voilà, là on est dedans, entre 'Salpu' et 'Tasil.' Et puis, voilà, on est en plein dedans…

The inter-tropical convergence... look, we're in it, between 'Salpu' and 'Tasil.' And then, look, we're right in it...

 

02:05:55 (Robert) Oui, on va les appeler derrière... pour leur dire quand même parce que...

Yes, let's call them in the back, to let them know...

 

Robert pushes the call button.

 

02:05:59 (flight attendant, heard on the intercom) Oui? Marilyn.

Yes? Marilyn.

 

02:06:04 (Bonin) Oui, Marilyn, c'est Pierre devant... Dis-moi, dans deux minutes, on devrait attaquer une zone où ça devrait bouger un peu plus que maintenant. Il faudrait vous méfier là.

Yes, Marilyn, it's Pierre up front... Listen, in 2 minutes, we're going to be getting into an area where things are going to be moving around a little bit more than now. You'll want to take care.

 

02:06:13 (flight attendant) D'accord, on s'assoit alors?

Okay, we should sit down then?

 

02:06:15 (Bonin) Bon, je pense que ce serait pas mal… tu préviens les copains!

Well, I think that's not a bad idea. Give your friends a heads-up.

 

02:06:18 (flight attendant) Ouais, OK, j'appelle les autres derrière. Merci beaucoup.

Yeah, okay, I'll tell the others in the back. Thanks a lot.

 

02:06:19 (Bonin) Mais je te rappelle dès qu'on est sorti de là.

I'll call you back as soon as we're out of it.

 

02:06:20 (flight attendant) OK.

Okay.

 

The two copilots discuss the unusually elevated external temperature, which has prevented them from climbing to their desired altitude, and express happiness that they are flying an Airbus 330, which has better performance at altitude than an Airbus 340.

 

02:06:50 (Bonin) Va pour les anti-ice. C'est toujours ça de pris.

Let's go for the anti-icing system. It's better than nothing.

 

02:07:00 (Bonin) On est apparemment à la limite de la couche, ça devrait aller.

We seem to be at the end of the cloud layer, it might be okay.

 

In the meantime Robert has been examining the radar system and has found that it has not been set up in the correct mode [WHAT? What does that mean? As an USAF ex-wxman I can speculate. I do NOT understand the conjecture]...

 

02:08:03 (Robert) Tu peux éventuellement le tirer un peu à gauche.

You can possibly pull it a little to the left.

 

02:08:05 (Bonin) Excuse-moi?

Sorry, what?

 

02:08:07 (Robert) Tu peux éventuellement prendre un peu à gauche. On est d'accord qu'on est en manuel, hein?

You can possibly pull it a little to the left. We're agreed that we're in manual, yeah?

 

Bonin wordlessly banks the plane to the left. Suddenly, a strange aroma, like an electrical transformer, floods the cockpit, and the temperature suddenly increases [which temperature: external or internal?]. At first, [apparently Bonin] thinks that something is wrong with the air-conditioning system, but Robert assures him that the effect is from the severe weather in the vicinity. [This is wild! That happens?] Bonin seems ill at ease [There's some CVR not being disclosed here]. Then the sound of slipstream suddenly becomes louder...Bonin announces that he is going to reduce the speed of the aircraft, and asks Robert if he should turn on a feature that will prevent the jet engines from flaming out in the event of severe icing.

 

Just then an alarm sounds for 2.2 seconds, indicating that the autopilot is disconnecting...

 

02:10:06 (Bonin) J'ai les commandes.

I have the controls.

 

02:10:07 (Robert) D'accord.

Okay.

 

...Bonin...pulls back on the side stick to put the airplane into a steep climb, despite having recently discussed the fact that the plane could not safely ascend due to the unusually high external temperature.

 

...[virtually immediately a] warning chime alerts the cockpit to the fact that they are leaving their programmed altitude. Then the stall warning sounds. This is a synthesized human voice that repeatedly calls out, "Stall!" in English, followed by a loud and intentionally annoying sound called a "cricket." ...

 

The Airbus's stall alarm is designed to be impossible to ignore...even though the word "Stall!" will blare through the cockpit 75 times. ...

 

02:10:07 (Robert) Qu'est-ce que c'est que ça?

What's this?

 

02:10:15 (Bonin) On n'a pas une bonne… On n'a pas une bonne annonce de vitesse.

There's no good... there's no good speed indication.

 

02:10:16 (Robert) On a perdu les, les, les vitesses alors?

We've lost the, the, the speeds, then?

 

The plane [climbs] ... 7000 feet per minute....until...93 knots...

 

02:10:27 (Robert) Faites attention à ta vitesse. Faites attention à ta vitesse.

Pay attention to your speed. Pay attention to your speed...

 

[editorial omitted]

 

02:10:28 (Bonin) OK, OK, je redescends.

Okay, okay, I'm descending.

 

02:10:30 (Robert) Tu stabilises...

Stabilize…

 

02:10:31 (Bonin) Ouais.

Yeah.

 

02:10:31 (Robert) Tu redescends... On est en train de monter selon lui… Selon lui, tu montes, donc tu redescends.

Descend... It says we're going up... It says we're going up, so descend.

 

02:10:35 (Bonin) D'accord.

Okay.

 

Thanks to the effects of the anti-icing system, one of the pitot tubes begins to work again. The cockpit displays once again show valid speed information.

 

02:10:36 (Robert) Redescends!

Descend!

 

02:10:37 (Bonin) C'est parti, on redescend.

Here we go, we're descending.

 

02:10:38 (Robert) Doucement!

Gently!

 

Bonin eases the back pressure on the stick, and the plane gains speed as its climb becomes more shallow. It accelerates to 223 knots. The stall warning falls silent. For a moment, the co-pilots are in control of the airplane.

 

02:10:41(Bonin) On est en… ouais, on est en "climb."

We're... yeah, we're in a climb.

 

...Robert pushes a button to summon the captain.

 

02:10:49 (Robert) Putain, il est où... euh?

Damn it, where is he?

 

as cited by the article:

 

The plane has climbed to 2512 feet above its initial altitude

, and though it is still ascending at a dangerously high rate, it is flying within its acceptable envelope. But for reasons unknown, Bonin once again increases his back pressure on the stick, raising the nose of the plane and bleeding off speed. Again, the stall alarm begins to sound.

 

02:10:55 (Robert) Putain!

Damn it!

 

Another of the pitot tubes begins to function once more. The cockpit's avionics [apparently] are now all functioning normally....

 

02:11:03 (Bonin) Je suis en TOGA, hein?

I'm in TOGA, huh?

 

editorial deleted

 

02:11:06 (Robert) Putain, il vient ou il vient pas?

Damn it, is he coming or not?

 

editorial: deleted

 

02:11:21 (Robert) On a pourtant les moteurs! Qu'est-ce qui se passe bordel? Je ne comprends pas ce que se passe.

We still have the engines! What the hell is happening? I don't understand what's happening.

 

editorial deleted

 

02:11:32 (Bonin) Putain, j'ai plus le contrôle de l'avion, là! J'ai plus le contrôle de l'avion!

Damn it, I don't have control of the plane, I don't have control of the plane at all!

 

02:11:37 (Robert) Commandes à gauche!

Left seat taking control!

 

editorial deleted

 

02:11:43 (Captain) Eh… Qu'est-ce que vous foutez?

What the hell are you doing?

 

02:11:45 (Bonin) On perd le contrôle de l'avion, là!

We've lost control of the plane!

 

02:11:47 (Robert) On a totalement perdu le contrôle de l'avion... On comprend rien... On a tout tenté...

We've totally lost control of the plane. We don't understand at all... We've tried everything.

 

By now the plane has returned to its initial altitude...nose pitched 15 degrees up, and a forward speed of 100 knots, it is descending at a rate of 10,000 feet per minute, [FPV] 41.5 degrees...forward airspeed is [<] 60 knots—that the angle-of-attack inputs are no longer accepted as valid, and the stall-warning horn temporarily stops....

 

02:12:14 (Robert) Qu'est-ce que tu en penses? Qu'est-ce que tu en penses? Qu'est-ce qu'il faut faire?

What do you think? What do you think? What should we do?

 

02:12:15 (Captain) Alors, là, je ne sais pas!

Well, I don't know!

 

As the stall warning continues to blare, the three pilots discuss the situation... No one mentions the word "stall." As the plane is buffeted by turbulence, the captain urges Bonin to level the wings—advice that does nothing to address their main problem. The men briefly discuss, incredibly, whether they are in fact climbing or descending, before agreeing that they are indeed descending. As the plane approaches 10,000 feet, Robert tries to take back the controls, and pushes forward on the stick...Bonin...continues to pull back. The nose remains high.

 

02:13:40 (Robert) Remonte... remonte... remonte... remonte...

Climb... climb... climb... climb..

 

[These guys were smoking dope.].

 

02:13:40 (Bonin) Mais je suis à fond à cabrer depuis tout à l'heure!

But I've had the stick back the whole time!

 

02:13:42 (Captain) Non, non, non... Ne remonte pas... non, non.

No, no, no... Don't climb... no, no.

 

02:13:43 (Robert) Alors descends... Alors, donne-moi les commandes... À moi les commandes!

Descend, then... Give me the controls... Give me the controls!

 

Bonin yields the controls, and Robert finally puts the nose down. The plane begins to regain speed. But it is still descending at a precipitous angle. As they near 2000 feet, the aircraft's sensors detect the fast-approaching surface and trigger a new alarm....Bonin...pulls his side stick all the way back [w/out saying ANYTHING].

 

02:14:23 (Robert) Putain, on va taper... C'est pas vrai!

Damn it, we're going to crash... This can't be happening!

 

02:14:25 (Bonin) Mais qu'est-ce que se passe?

But what's happening?

 

02:14:27 (Captain) 10 degrès d'assiette...

Ten degrees of pitch...

 

The CVR ceases recording 1.4 seconds later.

[raygun]

I'm over it and can deal with it now. Thanx for allowing me this forum...

 

What are the THREE things that caused the plane to go down?

 

There is ALWAYS a chain that results in aeronautical disaster. If but for ALL three...

 

WHAT three things caused the disaster?

[raygun]

From the Wiki:

 

58-year-old flight captain Marc Dubois had joined Air France in 1988 and had approximately 11,000 flight hours, including 1,700 hours on the Airbus A330; the two first officers, 37-year-old David Robert and 32-year-old Pierre-Cedric Bonin, had over 9,000 flight hours between them.

 

Robert was a veteran in his own right with respect to F-GZCP route, i.e., AF447, having been designated by AF as acting PIC - despite his official AF First Officer rank - several times previously. Not only did Robert log double Bonin's total flight time, he had very near Dubois' total logged flight time in A330 as either PIC or FO on the F-GZCP route. I believe he refused the rating to become an AF Captain. He was eligble for it though.

 

Despite officially holding AF Captain rank, this particular ill-fated F-GZCP run was Dubois' first as acting PIC (I'm uncertain how much flight time he may have logged previously either as PIC or as PNF / PM). If he logged time as PIC on the F-GZCP route - captain rank notwithstanding - inference yields he flew with another AF Captain as acting PIC. Inference also would yield that a FO would've also been present - possibly even Roberts - it'd be absurd to think three AF Captains would fly on the same F-GZCP flight.

 

Quite frankly, the transcript seems to describe a bunch of guys not familiar with being stoned.

[righteousmomma]

I'm over it and can deal with it now. Thanx for allowing me this forum...

 

What are the THREE things that caused the plane to go down?

 

There is ALWAYS a chain that results in aeronautical disaster. If but for ALL three...

 

WHAT three things caused the disaster?

 

 

So what 3 things do you suspect?

[NCTexan]

Very interesting and the transcripts give a lot of insight into the confusion.

 

Still, the pilots continue to ignore it, and the reason may be that they believe it is impossible for them to stall the airplane. It's not an entirely unreasonable idea: The Airbus is a fly-by-wire plane; the control inputs are not fed directly to the control surfaces, but to a computer, which then in turn commands actuators that move the ailerons, rudder, elevator, and flaps. The vast majority of the time, the computer operates within what's known as normal law, which means that the computer will not enact any control movements that would cause the plane to leave its flight envelope. The flight control computer under normal law will not allow an aircraft to stall, aviation experts say.

 

But once the computer lost its airspeed data, it disconnected the autopilot and switched from normal law to "alternate law," a regime with far fewer restrictions on what a pilot can do. In alternate law, pilots can stall an airplane.

 

It's quite possible that Bonin had never flown an airplane in alternate law, or understood its lack of restrictions. Therefore, Bonin may have assumed that the stall warning was spurious because he didn't realize that the plane could remove its own restrictions against stalling and, indeed, had done so.

 

 

This begs the question... If the fly-by-wire computer makes it impossible to stall the AC, why the heck bother with a screaming STALL WARNING? Even if one thought that the computer would prevent an actual stall, why would anyone pull back on the yoke anyway? Sounds like the Three Stooges were flying for AirFrance.

[raygun]

#1 error:

 

 

 

the PNF / PM did not implement the unreliable airspeed check list as soon as the ADIRU horked up a bit-ball and FCS disconnected auto-throttle / pilot.

 

I'm not certain what the memory items are specifically, but I believe that specific pitch / power settings for A/C load at altitude should be immediately applied. First fly the plane, then diagnose the problem. 0 Points awarded for not providing a correct answer for error #1. Points still available for errors #2 & #3 though.

 

NTSB INVESTIGATING TWO RECENT INCIDENTS INVOLVING POSSIBLE A-330 SPEED AND ALTITUDE INDICATION ANOMALIES http://news.airwise....1246011377.html

http://www.ntsb.gov/...09/090625a.html

 

Here's an eMail sent by one of the crewmembers on the latter flight:

"Yesterday while coming up from Hong Kong to Tokyo, a 1700nm 4hr. flight, we experienced the same problems Air France had while flying thru bad weather.

 

I have a link to the failures that occurred on AF 447. My list is almost the same.

 

The problem I suspect is the pitot tubes ice over and you loose your airspeed indication along with the auto pilot, auto throttles and rudder limit protection. The rudder limit protection keeps you from over stressing the rudder at high speed.

 

Synopsis; Tuesday 23, 2009 10am enroute HKG to NRT. Entering Nara Japan airspace.

FL390 mostly clear with occasional isolated areas of rain, clouds tops about FL410. Outside air temperature was -50C TAT -21C (your not supposed to get liquid water at these temps). We did.

 

As we were following other aircraft along our route. We approached a large area of rain below us. Tilting the weather radar down we could see the heavy rain below, displayed in red. At our altitude the radar indicated green or light precipitation, most likely ice crystals we thought.

 

Entering the cloud tops we experienced just light to moderate turbulence. (The winds were around 30kts at altitude.) After about 15 sec. we encountered moderate rain. We thought it odd to have rain streaming up the windshield at this altitude and the sound of the plane getting pelted like an aluminum garage door. It got very warm and humid in the cockpit all of a sudden. Five seconds later the Captains, First Officers, and standby airspeed indicators rolled back to 60kts. The auto pilot and auto throttles disengaged. The Master Warning and Master Caution flashed, and the sounds of chirps and clicks letting us know these things were happening.

 

Jerry Staab, the Capt. hand flew the plane on the shortest vector out of the rain. The airspeed indicators briefly came back but failed again. The failure lasted for THREE minutes. We flew the recommended 83%N1 power setting. When the airspeed indicators came back. we were within 5 knots of our desired speed.

 

Everything returned to normal except for the computer logic controlling the plane. (We were in alternate law for the rest of the flight.)

 

We had good conditions for the failure; daylight, we were rested, relatively small area, and light turbulence. I think it could have been much worse. Jerry did a great job fly and staying cool. We did our procedures called dispatch and maintenance on the SAT COM and landed in Narita. That's it."

 

This youtube training video shows you what happens on an A320 when you have ADR1+2 fault: you will hear the "Calvary charge" that goes with master warning, you will also hear the "bing" which goes with the master caution. You will notice these stop straight away after the crew has pushed either the master caution or warning as appropriate. Also have a good look at the standby instruments which are in view during the ECAM sequence, you will see that aircraft is perfectly controllable, if act the way these guys fly it, the pax would not even know that had a problem.

 

Why is the unreliable airspeed checklist SO important? The following is somewhat technical discussion concerning the ADIRU's, failures, and what the pilots would've faced:

 

Try: http://www.atsb.gov....070_interim.pdf

 

The above link is to the interim factual #1 for: In-flight upset - Airbus A330-303, VH-QPA, 154 km west of Learmonth, WA, 7 October 2008

 

On 7 October 2008, an Airbus A330-303 aircraft, registered VH-QPA and operated as Qantas flight 72, departed Singapore on a scheduled passenger transport service to Perth, Western Australia. While the aircraft was in cruise at 37,000 ft, one of the aircraft's three air data inertial reference units (ADIRUs) started outputting intermittent, incorrect values (spikes) on all flight parameters to other aircraft systems. Two minutes later, in response to spikes in angle of attack (AOA) data, the aircraft's flight control primary computers (FCPCs) commanded the aircraft to pitch down. At least 110 of the 303 passengers and nine of the 12 crew members were injured; 12 of the occupants were seriously injured and another 39 received hospital medical treatment.pp 28,29 of the above document discusses algorithms used by the PRIMs to detect abnormal data. Figure 5 in the pdf indicates that data from the ADM is also internally sent to the IR part of the ADIRU. Why? In the same document it is mentioned that not only the ADM but also the IR-switch has to be set to the OFF position to get the OFF lights on.

 

Sources to ADIRU: http://www.globalsim...PitotStatic.jpg

 

Each ADIRU has its own monitoring function and can self reject it's own data (alias it can commit suicide to prevent a genocide), that then splits into 3 data streams:

1. Into the what air data the crew uses for their respctive displays:

http://www.globalsim...rDataSwitch.jpg

2. Into what the system uses:

http://www.globalsim...SElecRudder.jpg

 

ADR Rejections:

• If one goes bonkers and goes astray on ANY variable for enough time, it gets shot by the FCS and dies... this is the conformance/democracy measure.
  
• If any one of the ADRs does a sprinter on the CAS, the FCS will shot that ADR dead... This is the Prison Measure.
  
• If two of them goes nuts and tries to run faster than the moving average, then the FCS shoots those 2 preserving the remaining one (unless that one commits suicide). This is the anti-riot measure.
  
• If 1 is shot dead, and the remaining 2 decides to break their coalition, the FCS will ask you which one do you want to shoot at...
  
• The rudder travel will follow what the FCS uses for the speed... ie: average of 3, if one gets shot, average of 2, if the 2 can't agree, it'll wait for which one you choose.
  

Now, remember, the ADRs can commit suicide themselves too, by comparing static data (each ADR has 2 static sources and ADR 3 doesn't do this self check)... and the FCS does check on them to check they're alive and valid... AoA Estimation is one method... All the checks done by the FCS is designed to pick up errors early enough to prevent genocide or fraticide between AFS... So what do you do with the dead/rejected/erroneous ADR? What if it tries to come back as a zombie and affect the system? Well, follow the ECAM and QRH... which is... BURY THE DAMN THING! Switch it OFF.

 

What happens with the rudder limiter? (ALTN Law = Damper goes to 4deg limit)...

• 3 ADR valid = It'll use the mean.
  
• 2 ADR valid = It'll use the mean.
  
• 2 ADR alive in disagreement = It'll take the last valid mean as RUD TRV LIM will appear on ECAM when ADR DISAGREE comes up.
  
• 1 ADR valid = If ADR DISAGREE condition occurs see above, otherwise use that ADR's speed.
  

However, for F-GZCP, we just don't know at what speed it was locked at... It depends on when the RUD TRV LIM appeared. If it occured at the same time as the A/P OFF and A/T off, then it can be deduced that it lost all valid speed (FCS killed all ADRs)... so probably around 270KCAS as well... but we don't know that for sure...

 

Anyways, given all of the foregoing, and with a healthy dose of insight on just the ACARS messages, what can be reasonably be translated into plausible flight-deck environment and the piloting issues that would manifest themselves?

 

Cockpit Environment

 

AUTO FLIGHT AP OFF : Red Master Warning light / Cavalry Charge

REAC W/S DET FAULT : Red Flag on PFDs

F/CTL ALTN LAW : Amber Master Caution / Chime Flags on PFDs : Red “FD” Flags on PFDs

AUTO FLIGHT ATHR OFF : Amber Master Caution / Chime *

NAV TCAS FAULT : Red Flags on PFDs / NDs Flags on PFDs : Red “SPD LIM” Flags on PFDs

F/CTL RUD TRV LIM FAULT : Amber Master Caution / Chime Flags on PFDs : Red “FPV” Flags on PFDs

NAV ADR DISAGREE : Amber Master Caution / Chime

ISIS SPD/MACH Flags : Red Flags on ISIS SPD /Mach IR2 FAULT : Amber Master Caution / Chime

(s/b read with extreme caution: It was only a “Maintenance Status at 0211Z, If an ECAM fault was announced later, it would mean the loss of HDG and ATT for the F/Os PFD and ND.)

F/CTL PRIM1 FAULT : Amber Master Caution / Chime

F/CTL SEC1 FAULT : Amber Master Caution / Chime

 

NOTE: there is only one red warning : The Auto-pilot disconnect. All of the rest of the ECAM or PFD/ND messages are at a lower level and present no real urgency. On the other hand, the annunciations, both aural and visual coming at a very high rate couldn’t have helped the crew to keep or regain any SA they had. (*) See the A/THR issue below

 

FLIGHT MANAGEMENT AND PILOTING SITUATION

 

Task attributions in an abnormal situation are generally well defined in a modern flight-deck: One flies and communicates, the other manages the systems and the check-lists.

 

Originally there was some uncertainty as to who the “Pilot Flying” was. With the Captain in the LH seat, any one of the pilots could have been it. During the Captain’s rest though, often times the most experienced co-pilot is designated as PF - and usually from the RH seat - the second co-pilot being in charge of the systems, radio-com and navigation from LH seat. This however is at captains discretion, moreover, which pilot is sitting where will dictate what flight time each particular pilot can log, e.g., FO in RH seat wouild only log PF time, SO in LH seat would log PNF / PM time (neither logging PIC time). In this particular case, FO was LH seat and most likely logging both PIC & PNF / PM time, while SO in RH merely logs PF time. If the captain as acting PIC and PF, he'd be in LF seat, and either FO or SO would've been RH seat as PNF / PM. Despite Roberts being only FO rank, he was designated by AF as captain, i.e., acting PIC for many AF447 flights previously. So he sitting LH seat on this particular flight during captains rest would not in and of itself be unusual.

 

In any case its up to the PNF / PM to keep an update of the weather at alternates, keep a sharp eye on the PETs between the alternates in an ETOPS environment, help with the radar… It’s also his job to compute at every reporting waypoint engine and speed parameters for turbulence penetration, altitude capability and possible step climb…etc.,..

 

What piloting instruments were available? It appears based on the messages that they, quite early in the chain of events, lost SPEED and Mach information, both on the PFDs and the ISIS, and the FPV, flight path vector. They, of course were without Flight Directors and auto thrust. The A/THR disconnect, apart from the amber caution light would have triggered a “Thrust lock” indication on the ECAM, indicating the need to use manual throttle.

 

Nothing else was lost…….until the possibility after 0211Z of an IR #2 failure, causing the loss of attitude and heading indications on the RH side. A “switching” to the IR #3 would have been needed to recover these indications on the S/O’s side.

 

The ISIS, also minus speed indication could have been used...but from the RHS? Not easy and vertigo-inducing.

 

So, we’re left with the necessity of an “UNRELIABLE AIRSPEED INDICATION” check-list, in and of itself a non-event (in most conditions). In this case, they had the speed, they had the thrust..just match the T/Ls with the present N1 and they would have been very close to the needed parameters for level flying at the same speed.

 

Alternate Law handling issues.

 

With the “ADR DISAGREE” situation the flight control laws would have reverted to “ALTERNATE LAW 2”, with most of the envelope protections unavailable except the load factor in pitch.

 

Roll Direct : there is a direct stick-to-surface relationship. All ailerons are available and spoilers 2, 3 and 6 are used for roll augmentation (until 0213Z that is, as the loss (?) of SEC1 would render spoiler #6 on both sides unavailable). But there is enough surfaces to guarantee a minimum of 20°/s roll rate if needed. Testiment of professional pilot's who would know state that alternate law flying is hardly noticeable: the ailerons feel a bit heavier and slower to respond but that’s about it.

 

The BEA Interim Report of Dec 2009 describes 32 similar icing pitot probe events which occured before AF447. 26 aircraft had the Thales C16195AA probes, two with the Thales C16195BA probes and one with the Goodrich 0851HL probes.

 

Nine of these A330/A340 events were identified by Air France before 1 June 2009, and their additional review of records located another six events that occured in 2008.

 

So 15 Air France flight crews experienced the same failures, the same warnings, the same cockpit confusion as AF447, and survived. Across the multiple airlines which provided analysis data to BEA and Airbus - at least 10 of the icing incidents with at least two pitot probe failures apparently occured in the ITCZ between South America and Europe.

 

The aforementioned would appear to kind of shoot the lack of training theory out the window. You'd think wouldn't you? That notwithstanding, these pilots went on to commit two additional egregious sins.

[raygun]

Report of detailed investigation into ACARS messages

(Overlayed with recovered CVR transcript)

 

-many thanx to that unknown individual at AIRLINERS.NET who spent all those heartbeats digging through the mountain of reference material.

 

Subsequent to in-depth research of technical drawings, wirings, fault isolation possibilities of the CMC messages - already some 153 pages (with many more pages still to print and scour through) - from the A330 manuals and other sources, the meaning of the ACARS messages can be established with a certain measure of confidence.

 

To be succinct ACARS messages represent two of the functions of the airplane's Central Maintenance Computer (CMC):

 

 

1) reports from the flight warning computer on what is showing on the instrument panels : PFDs, ECAM...etc...

2) report from the different BITEs that are present in each system, comparators...etc...that are totally transparent to the flight crew.

 

This report was compiled with care taken to assess whether or not the ACARS messages where actually genuine failures or merely transients. Prior to recovery of the CVR, it was believed that all faults / failures listed are genuine and, furthermore, there was neither any indication, nor logical explanation, of a return to normal functions. I have no idea how much analysis of the recovered 'black boxes' alters any of the following comprehensively researched information.

 

The very FIRST conclusion gleaned from this investigation - quite glaring - no way could the ACARS have been transmitted in the order shown in the leaked ACARS Headers summary.

 

Firstly because a 0212z event is reported in the middle of the 0211 messages, and 0213Z messages between 0214z messages. And, secondly, it seems obvious that the ADR DISAGREE message/warning is significatnly late in view of all the happenings that should have been its consequences. But looking at the system, we can see in fact the trouble-shooting "reasoning" of the system facing multiple incoherent data at the same time.

 

One reason for the misordered transmissions are that the "WRN" - warning - messages come from the FWC flight warning computer straight to the CMC to report to base via the ATSU and SatCom - or VHF 3, as applicable. They have priority over the maintenance messages that come from the built-in test equipments from each component and the various comparators.

 

Another explanation for the "tardiness" of some messages is that Flight 447 wasn't the only airplane in the air. Some 120 other long-haulers could transmit their own abnormal messages at the same time.

 

Certain parts of the ACARS Header summary are puzzling with significant befuddlement, e.g., why did the NAV DISAGREE come out so late, and why was there an IR problem when we're suspecting an ADR problem... etc, etc, etc. The clues lie much deeper than originally thought, and again, the Air Caraibes internal technical note provided one of the best assistance with respect to understanding the AF447 ACARS messages...

 

The investigation and research is far from complete. Still further cross checking is required to ascertain various issues, e.g., how does the Air Data Module work with respect to air data sampling rates, self data storage, how it starts and reboots when needed, data filtering functions, and what functions it carries in each probe (certain documents reveal multiple functions), etc, etc.... And then how come an ADR affect the IR functions of the ADIRUs, etc etc, denergizing ADIRU after ADR switch off doesn't give the OFF light, etc etc... and many many more things...

 

All of this must then be additionally cross checked with the background systems information and general logic (from the FCOMs) to cross check further interrelationships between components and modules, where the data is pooled and channeled to downstream users and via which processors etc. It most certainly is a daunting task, one that certainly would test one's systems engineering knowledge to the limit. But that's what I do as a IT systems analyst. Given my experiences in a previous life, and my fondness for all things aviation, I'm totally captured.

 

0210 34-11-15-0 FLR EFCS2

EFCS1, AFS - PROBE PITOT 1+2/2+3/1+3 (9DA)

9DA=HEATING ELEMENT PITOT 1 (6DA1/PHC1)

Heating Element Pitot 1 suspected failed.

 

0210 27-93-34-0 FLR EFCS1

EFCS2-FCPC2(2CE2) WRG:ADIRU1 BUS ADR1-2 TO FCPC2

No Data from ADIRU 1, ADR 1 & 2 no sending signal to FCPC2

No ADR Data from ADIRU 1 to PRIM2.

 

0210 27-90-45-5 WRN MXSTAT

EFCS1

ERROR NOTICED - Air Data Fluctuation/Inconsistency

 

0210 27-90-45-0 WRN MXSTAT

EFCS2

ERROR NOTICED - Air Data Fluctuation/Inconsistency

 

0210 22-10-00-0 WRN AUTO FLT

AP OFF

 

Autopilot Shut off for safety, result loss of 2 Valid Air Data Channels.

This prevents faulty Air Data from affecting autopilot into making the wrong actions.

Commence AP/FD FAULT ISOLATION PROCEDURE

System Filter & Check:

- DISAGREE AOA Sensor Data in FCPCs

- DISAGREE PITOT PROBE Data in FCPCs

- FAIL ADIRU 1 and 2

- FAIL ADIRU 1 and 3

- FAIL ADIRU 2 and 3

- FAIL ADIRUs

***alarm sounds for 2.2 seconds, indicating that the autopilot is disconnecting...

 

0210 22-62-01-0 WRN AUTO FLT

REAC W/S DET FAULT

Loss of 2 ADRs, autopilot cannot provide Windshear Protection.

 

0210 27-91-00-5 WRN F/CTL

ALTN LAW

2 ADR REJECTED, NAV DISAGREE NOT YET CONCLUDED - FAULT ISOLATION IN PROGRESS

 

0210 22-83-00-2 WRN FLAG

LEFT PFD LIMIT

Rejected ADR still feeding data to PFD

If there is valid ADR, it's not being selected for LEFT seat.

 

0210 22-83-01-2 WRN FLAG

RIGHT PFD SPD LIMIT

Rejected ADR still feeding data to PFD

If there is valid ADR, it's not being selected for RIGHT seat.

 

0210 22-30-02-5 WRN AUTO FLT

A/THR OFF

 

Autothrust Shut off for safety, result loss of 2 Valid Air Data Channels.

This prevents faulty Air Data from affecting Autothrust into making the wrong actions.

 

0210 34-43-00-5 WRN NAV

TCAS FAULT

Loss of ADR1 to Transponder 1 (if selected) or Loss of ADR2 to Transponder2 (if selected)

Loss of Mode C.

This is downstream of loss of ADR.

 

0210 22-83-00-1 WRN FLAG

LEFT PFD NO F/D

Automatic Flight System (AFS/FMGC) loss of 2 ADR sources.

Safety mechanism, prevents erroneous F/D for pilot to follow

 

0210 22-83-01-1 WRN FLAG

RIGHT PFD NO F/D

Automatic Flight System (AFS/FMGC) loss of 2 ADR sources.

Safety mechanism, prevents erroneous F/D for pilot to follow

 

0210 27-23-02-0 WRN F/CTL

RUD TRV LIM FAULT

Loss valid of ADR Data (require 2 ADRs) for FMGC/AFS

FMGC Flight Envelope Module locks in Rudder Travel for safety.

 

***02:10:06 (Bonin) I have the controls.

***02:10:07 (Robert) Okay.

...Bonin...pulls back on the side stick to put the airplane into a steep climb, despite having recently discussed the fact that the plane could not safely ascend due to the unusually high external temperature.

...[virtually immediately a] warning chime alerts the cockpit to the fact that they are leaving their programmed altitude. Then the stall warning sounds...

***02:10:07 (Robert) What's this?

***02:10:15 (Bonin) There's no good... there's no good speed indication.

***02:10:16 (Robert) We've lost the, the, the speeds, then?

The plane [climbs] ... 7000 feet per minute....until...93 knots...

***02:10:27 (Robert) Pay attention to your speed. Pay attention to your speed...

***02:10:28 (Bonin) Okay, okay, I'm descending.

***02:10:30 (Robert) Stabilize…

***02:10:31 (Bonin) Yeah.

***02:10:31 (Robert) Descend... It says we're going up... It says we're going up, so descend.

***02:10:35 (Bonin) Okay.

The cockpit displays [apparently] once again show valid speed information.

***02:10:36 (Robert) Descend!

***02:10:37 (Bonin) Here we go, we're descending.

***02:10:38 (Robert) Gently!

the plane gains speed to 223 knots and the stall warning falls silent. The PF is in control of the A/C

***02:10:41(Bonin) We're... yeah, we're in a climb.

...Robert pushes a button to summon the captain.

***02:10:49 (Robert) Damn it, where is he?

at this time the A/c is flying within its acceptable envelope, although PF increases back pressure on the stide-stick and the stall alarm sounds again.

***02:10:55 (Robert) Damn it!

Another of the pitot tubes begins to function once more. The cockpit's avionics [apparently] are now all functioning normally....

 

0211 34-12-34-0 FLR IR2

EFCS1X,IR1,IR3, ADIRU2 (1FP2)

ADIRU2(1FP2) - ADR2 self monitoring & PHC rejects own data

Loss of discrete data from ADR2 = PITOT 2, STATIC 2L, STATIC 2R, TAT 2, AOA 2.

NAV DISAGREE CONCLUSION DELAYED - ADDITIONAL FAILURES - RECOMMENCE FAULT ISOL

 

0211 34-12-00-0 FLR ISIS

ISIS (22FN-10FC) SPEED OR MACH FUNCTION

SUSPECT LOSS OF ADIRU1 AND/OR ADIRU3 FOR ISIS MACH

Suspect Loss of ADIRU3

NAV DISAGREE CONCLUSION DELAYED - ADDITIONAL FAILURES - RECOMMENCE FAULT ISOL

 

0211 34-12-00-1 WRN FLAG

LEFT PFD NO FPV

 

0211 34-12-01-1 WRN FLAG

RIGHT PFD NO FPV

 

***02:11:03 (Bonin) I'm in TOGA, huh?

***02:11:06 (Robert) Damn it, is he coming or not?

***02:11:21 (Robert) We still have the engines! What the hell is happening? I don't understand what's happening.

***02:11:32 (Bonin) Damn it, I don't have control of the plane, I don't have control of the plane at all!

***02:11:37 (Robert) Left seat taking control!

***02:11:43 (Captain) What the hell are you doing?

***02:11:45 (Bonin) We've lost control of the plane!

***02:11:47 (Robert) We've totally lost control of the plane. We don't understand at all... We've tried everything.

At this time the A/C nose is pitched up 15 degrees, forward speed 100 knots, descending at 10,000 feet per minute, [FPV] -41.5 degrees. Once groundspeed <60 knots, angle-of-attack inputs are no longer considered valid by FCS and the stall-warning horn ceases.

 

0212 34-10-40-0 WRN NAV

ADR DISAGREE

NAV DISAGREE DISCOVERED - FAULT ISOLATION COMPLETED

Due to no further ADR faults occuring.

 

***02:12:14 (Robert) What do you think? What do you think? What should we do?

***02:12:15 (Captain) Well, I don't know!

the stall warning begins again. The plane is buffeted by turbulence, and PF is urged by the captain to level the wings. The men briefly discuss whether they are climbing or descending. They agree that they are indeed descending. The LH seat pilot pushes forward on the stick. The RH pilot continues to pull back; nose attitude remains high.

 

0213 27-90-02-5 WRN F/CTL

PRIM1 FAULT

 

0213 27-90-04-0 WRN F/CTL

SEC1 FAULT

 

0213 22-83-34-9 FLR AFS

FMGEC1(1CA1)

 

***02:13:40 (Robert) Climb... climb... climb... climb..

***02:13:40 (Bonin) But I've had the stick back the whole time!

***02:13:42 (Captain) No, no, no... Don't climb... no, no.

***02:13:43 (Robert) Descend, then... Give me the controls... Give me the controls!

S/O yields the controls and F/O decreases pitch. Despite TAS increasing FPV is still precipitously negative; near FL20 terrain avoidance sensors begin issuing an alarm. The RH seat S/O pulls his side stick all the way back.

 

0214 34-10-36-0 WRN MXSTAT

ADR2

RESULT OF 32-12-34-0

 

0214 21-31-00-2 WRN ADVSRY

CABIN VERTICAL SPEED

LOSS OF ADR DATA

 

***02:14:23 (Robert) Damn it, we're going to crash... This can't be happening!

***02:14:25 (Bonin) But what's happening?

***02:14:27 (Captain) Ten degrees of pitch...

 

The CVR ceases recording 1.4 seconds later

[RandyM]

I'm over it and can deal with it now.

 

 

okie dokie

[raygun]

Aurora by wxman1, on Flickr

[raygun]

ERR #3:

 

When Captain showed up, he did not kick the S/O out of the RH seat. It is my belief that this is symptom of a complete lack or CRM with respect to that particular cockpit crew.

[raygun]

AF447_debris_spoiler3 by wxman1, on Flickr

[raygun]

AF447_VS_foto_6 by wxman1, on Flickr

[Rokke]

I'm over it and can deal with it now. Thanx for allowing me this forum...

 

What are the THREE things that caused the plane to go down?

 

There is ALWAYS a chain that results in aeronautical disaster. If but for ALL three...

 

WHAT three things caused the disaster?

 

I can name one...lack of pilot familiarity with actually flying airplanes. This is a problem that is going to become more and more prevalent. Most new commercial aircraft are flown almost entirely on autopilot. You literally use three small knobs to make all the flying inputs from just after take off to just before landing. I've flown 16 hour flights where I actually "flew" the airplane a total of about 4 minutes. Many of our commercial pilots have spent 90% of their flying career flying airplanes with really effective autopilots. The net result is they never really learn how to fly. If the aircraft slips into an unusual attitude they don't have any experience to fall back on to tell them how to get out of it. An appropriate analogy would be to put someone who has only driven a car on dry roads onto a frozen lakebed and tell them to drive a figure eight. The result would be comical.

Unfortunately, when that analogy is transfered to a commercial aircraft cockpit the result is tragic. Take a look at Colgan Air flight 3407 for a similar situation. When all else fails, a pilot needs to be able to turn off all the computer stuff and just fly the airplane. Unfortunately, too many pilots these days never really learn how to fly the airplane.

[nickydog]

Well, that's comforting.

[Rokke]

Well, if it helps, keep in mind that the young crew flying your regional jet is working 14 hours a day, 6 days a week, and making roughly minimum wage for the effort. Brutal.

On the flip side...the safety rate is getting better and better in commercial aviation. Something to be said for automation. Just hope it doesn't break.

[nickydog]

That didn't help. What about that pilot that carefully flew the plane into the river? Didn't they say it was one of those things pilots practice? What about simulator time? I thought that was a law. Or something.

[Rokke]

One thing commercial pilots do practice a lot is actually landing their airplanes. And really, that is all he did. He just landed on water instead of a runway. And that is a much different situation than having the aircraft roll into an unusual attitude at altitude. That isn't a situation that gets much training emphasis because it just doesn't happen that often in a commercial airliner. The military does introduce unusual attitude training very early because it wants to evaluate how trainees handle that kind of situation. Some handle it well. Some don't. And as training progresses they are vectored toward aircraft that match their particular skill set.

[Rokke]

What was ERR #2?

[raygun]

Published by Liberation (17 mai 2011 à 19h59) with respect to SNPL / Air France ALPA outrage:

 

It is too early to mention the theory of a pilot error in the RIO-Paris Airbus crash on 1st June 2009, the SNPL has strongly reacted, refusing that the pilots who died in that catastrophe could be thrown to the lions.

 

The pilot’s ire has been triggered by two articles on the Fig’s internet site. In the unions crosshairs , there is the information that the first analysed sections of the recorders seem to exonerate Airbus.

 

To support for this information, the article relied on a telex Airbus sent their clients, reassuring them that at this stage of the first analyses of the DFDR, Airbus has no immediate recommendation to the airplane operators.

 

Hasty conclusion

Thus was relaunched the speculative track of « a crew error » as the Fig title implied., which was, to the outraged SNPL a rather hasty conclusion, (as) the link between the telex and the conclusion of a possible blame put on the crew is an astonishing shortcut, said Jean-Louis Barber, president of SNPL / Air France ALPA.

“The accident results from a chain of events and one cannot isolate one without replacing it in the chain”.

 

The BEA which is in the process of analysing both boxes and has confirmed that the recordings could be extracted has promised a report for this summer.

 

That timing seems, to the SNPL coherent with the task at hand. There was the same cautious reaction from Airbus, the spokesperson of which declared to have been shocked by the shortcut that points at the pilots as probable culprits.

 

“We have just informed the operators of our airplanes that they could go on flying the airplane –an Airbus A330- without any new recommendation, and in all safety;

[raygun]

What was ERR #2?

 

The flight deck crew never recognized: STALL.

 

discriminattion against ERR #2 would've allowed ERR #1 to be mitigated.

 

That notwithstanding, ERR #3 - as understood to exist - was not repentable (no way they could resolve the matter).

[raygun]

Err #3 is so related to Err #1 & Err #2 that it's not even funny.

 

Its called:

 

total lack of CRM.