New Wreckage found in AF447 crash

There is some conflicting information by posters on whether the crew was getting overspeed warnings and stall warning at the same time. Here the official preliminary report so everyone can be on the same page when thoughts are discussed.

http://www.bea.aero/fr/enquetes/vol.af.447/point.enquete.af447.27mai2011.en.pdf

speciAl foreWord to english note
This note has been translated and published by the BEA to make its reading easier for Englishspeaking people. As accurate as the translation may be, the original text in French should be
considered as the work of reference.
history of flight
On Sunday 31 May 2009, the Airbus A330-203 registered F-GZCP operated by Air France was
programmed to perform scheduled flight AF447 between Rio de Janeiro Galeão and Paris
Charles de Gaulle. Twelve crew members (3 flight crew, 9 cabin crew) and 216 passengers
were on board. Departure was planned for 22 h 00
(1)
.
At around 22 h 10, the crew was cleared to start the engines and to leave the parking space.
Take-off took place at 22 h 29. The Captain was PNF, one of the co-pilots wasPF.
The take-off weight was 232.8 t (for a MTOW of 233t), including 70.4 t of fuel.
At 1 h 35 min 15 , the crew informed the ATLANTICO controller that they had passed the
INTOL point then announced the following estimated times: SALPU at 1 h 48 then ORARO at
2h00. They also transmitted the SELCAL code and a test was undertaken successfully.
At 1 h 35 min 46, the controller asked the crew to maintain FL350 and to give their estimated
time at TASIL.
At 1 h 55, the Captain woke the second co-pilot and said "[…] he’s going to take my place".
Between 1 h 59 min 32 and 2 h 01 min 46 , the Captain attended the briefing between the
two co-pilots, during which the PF said, in particular "the little bit of turbulence that you just saw
[…] we should find the same ahead […] we’re in the cloud layer unfortunately we can’t climb much
for the moment because the temperature is falling more slowly than forecast" and that "the logon
with Dakar failed". The Captain left the cockpit.
The airplane approached the ORARO point. It was flying at flight level 350 and at Mach 0.82
and the pitch attitude was about 2.5 degrees. The weight and balance of the airplane were
around 205 tonnes and 29% respectively. Autopilot 2 and auto-thrust were engaged.
At 2 h 06 min 04, the PF called the cabin crew, telling them that "in two minutes we should enter
an area where it’ll move about a bit more than at the moment, you should watch out" and he
added "I’ll call you back as soon as we’re out of it".
(1)
All times
areUTC.At 2 h 08 min 07 , the PNF said "you can maybe go a little to the left […]". The airplane began a
slight turn to the left, the change in relation to the initial route being about 12 degrees. The level
of turbulence increased slightly and the crew decided to reduce the speed to about Mach 0.8.
From 2 h 10 min 05 , the autopilot then auto-thrust disengaged and the PF said "I have the
controls". The airplane began to roll to the right and the PF made a left nose-up input. The stall
warning sounded twice in a row. The recorded parameters show a sharp fall from about 275kt
to 60 kt in the speed displayed on the left primary flight display (PFD), then a few moments
later in the speed displayed on the integrated standby instrument system (ISIS).
Note 1: Only the speeds displayed on the left PFD and the ISIS are recorded on the FDR; the speed
displayed on the right side is not recorded.
Note 2: Autopilot and auto-thrust remained disengaged for the rest of the flight.
At 2 h 10 min 16, the PNF said "so, we’ve lost the speeds" then "alternate law […]".
Note 1: The angle of attack is the angle between the airflow and longitudinal axis of the airplane.
This information is not presented to pilots.
Note 2 : In alternate or direct law, the angle-of-attack protections are no longer available but a
stall warning is triggered when the greatest of the valid angle-of-attack values exceeds a certain
threshold.
 
Con't

The airplane’s pitch attitude increased progressively beyond 10 degrees and the plane started
to climb. The PF made nose-down control inputs and alternately left and right roll inputs. The
vertical speed, which had reached 7,000 ft/min, dropped to 700 ft/min and the roll varied
between 12 degrees right and 10 degrees left. The speed displayed on the left side increased
sharply to 215 kt (Mach 0.68). The airplane was then at an altitude of about 37,500 ft and the
recorded angle of attack was around 4 degrees.
From 2 h 10 min 50, the PNF tried several times to call the Captain back.
At 2 h 10 min 51 , the stall warning was triggered again. The thrust levers were positioned
in the TO/GA detent and the PF maintained nose-up inputs. The recorded angle of attack, of
around 6 degrees at the triggering of the stall warning, continued to increase. The trimmable
horizontal stabilizer (THS) passed from 3 to 13 degrees nose-up in about 1 minute and
remained in the latter position until the end of the flight.
Around fifteen seconds later, the speed displayed on the ISIS increased sharply towards 185kt;
it was then consistent with the other recorded speed. The PF continued to make nose-up
inputs. The airplane’s altitude reached its maximum of about 38,000 ft, its pitch attitude and
angle of attack being 16 degrees.
Note: The inconsistency between the speeds displayed on the left side and on the ISIS lasted a little less
than one minute.
At around 2 h 11 min 40 , the Captain re-entered the cockpit. During the following seconds,
all of the recorded speeds became invalid and the stall warning stopped.
Note: When the measured speeds are below 60 kt, the measured angle of attack values are considered
invalid and are not taken into account by the systems. When they are below 30 kt, the speed values
themselves are considered invalid.The altitude was then about 35,000 ft, the angle of attack exceeded 40 degrees and the vertical
speed was about -10,000 ft/min. The airplane’s pitch attitude did not exceed 15 degrees
and the engines’ N1’s were close to 100%. The airplane was subject to roll oscillations that
sometimes reached 40 degrees. The PF made an input on the sidestick to the left and nose-up
stops, which lasted about 30 seconds.
At 2 h 12 min 02, the PF said "I don’t have any more indications", and the PNF said "we have
no valid indications". At that moment, the thrust levers were in the IDLE detent and the
engines’N1’s were at 55%. Around fifteen seconds later, the PF made pitch-down inputs. In
the following moments, the angle of attack decreased, the speeds became valid again and the
stall warning sounded again.
At 2 h 13 min 32, the PF said "we’re going to arrive at level one hundred". About fifteen seconds
later, simultaneous inputs by both pilots on the sidesticks were recorded and the PF said "go
ahead you have the controls".
The angle of attack, when it was valid, always remained above 35 degrees.
The recordings stopped at 2 h 14 min 28. The last recorded values were a vertical speed of
-10,912 ft/min, a ground speed of 107 kt, pitch attitude of 16.2 degrees nose-up, roll angle of
5.3 degrees left and a magnetic heading of 270 degrees.
 
neW findings
At this stage of the investigation, as an addition to the BEA interim reports of 2 July and 17
December 2009, the following new facts have been established:
ˆ The composition of the crew was in accordance with the operator’s procedures.
ˆ At the time of the event, the weight and balance of the airplane were within the operational limits.
ˆ At the time of the event, the two co-pilots were seated in the cockpit and the Captain was
resting. The latter returned to the cockpit about 1 min 30 after the disengagement of the
autopilot.
ˆ There was an inconsistency between the speeds displayed on the left side and the integrated standby instrument system (ISIS). This lasted for less than one minute.
ˆ After the autopilot disengagement:
„ the airplane climbed to 38,000 ft,
„ the stall warning was triggered and the airplane stalled,
„ the inputs made by the PF were mainly nose-up,
„ the descent lasted 3 min 30, during which the airplane remained stalled. The angle of
attack increased and remained above 35 degrees,
„ the engines were operating and always responded to crew commands.
ˆ The last recorded values were a pitch attitude of 16.2 degrees nose-up, a roll angle of
5.3degrees left and a vertical speed of -10,912 ft/min.
 
IMHO, it's criminal that we rely on sims as much as we do. If a plane is capable of recovering from a stall, the PIC should have stalled it, seen that it is recoverable, and seen what really happens. Regardless, I'm sorry for the loss of your friend/acquaintance. Didn't mean to pick at old scabs for anyone.

Well, some of the problems the industry has is that whenever I hear something like "we tested this procedure in the simulator and it works" I just want to cringe.

The simulator is an "artist's rendition" of how the aircraft should perform based upon known and assumed characteristics.

The airplane is an airplane.
 
If they hit severe icing, then there was nothing that would allow the probes to continue to work. In fact, no aircraft will be able to overcome a severe icing encounter by the design limits of how aircraft are certified.

"Can't happen" and "incomprehensible" are how engineers talk. Mother Nature is still calling the shots and can (and does!) generate conditions far outside the icing certification envelope.

From the BEA report it sounds like the first sign of trouble was autopilot disconnection, and the flight controls reverted into alternate law. There's no angle of attack protection in alternate law along with a whole host of other changes to flight control behavior (this is the way I understand it from looking at the Airbus flight control systems in a software engineering class - Airbus pilots please correct me). Pitch remains a load factor demand law, but roll becomes direct command of the spoiler-aileron system (and roll rates become a function of airspeed and sidestick displacement, rather than the normal Airbus "displace the stick this much to get this much roll rate regardless of airspeed").

Most importantly: The airplane CAN be stalled in alternate law. The airplane trims nose down as angle of attack increases, but this input can be overridden (as opposed to normal law, where the airplane will simply go Alpha Floor/Alpha Max and be right on the edge of the critical angle of attack no matter how much you pull). The stabilizer trimmed from 3 to 13 degrees ANU and then stayed there, says BEA...TOGA thrust and full-aft sidestick makes sense in normal law. TOGA thrust and full aft sidestick in alternate law will hurt you.
 
"Can't happen" and "incomprehensible" are how engineers talk. Mother Nature is still calling the shots and can (and does!) generate conditions far outside the icing certification envelope.

From the BEA report it sounds like the first sign of trouble was autopilot disconnection, and the flight controls reverted into alternate law. There's no angle of attack protection in alternate law along with a whole host of other changes to flight control behavior (this is the way I understand it from looking at the Airbus flight control systems in a software engineering class - Airbus pilots please correct me). Pitch remains a load factor demand law, but roll becomes direct command of the spoiler-aileron system (and roll rates become a function of airspeed and sidestick displacement, rather than the normal Airbus "displace the stick this much to get this much roll rate regardless of airspeed").

Most importantly: The airplane CAN be stalled in alternate law. The airplane trims nose down as angle of attack increases, but this input can be overridden (as opposed to normal law, where the airplane will simply go Alpha Floor/Alpha Max and be right on the edge of the critical angle of attack no matter how much you pull). The stabilizer trimmed from 3 to 13 degrees ANU and then stayed there, says BEA...TOGA thrust and full-aft sidestick makes sense in normal law. TOGA thrust and full aft sidestick in alternate law will hurt you.

According to the BEA report the PNF verbalized that since speeds missing, they were in alternate law. I believe the FO never acknowledged unless I missed it. So who knows if he was in normal law or alternate law mode. But still it seems very strange to me that even if one were to think they were in normal law, to respond to a stall warning with TOGA thrust and full-aft sidestick. I'm sure we'll see in the final report how AF pilots were trained for stalls.
 
Is there an annunciation to the crew as to which law they're operating under?

The ECAM will display "F/CTL ALTN LAW * PROT LOST *" or something to that effect and there are subtle changes to the speed tapes and attitude indicator.
 
In an airplane that the crew just uses full aft stick for windshear escape, would, under normal law, there be an advantage to utilizing the protections in the system when faced with uncertainty, or might a pilot revert to that faced with an uncertain situation?

Here are some other possible issues with what we know so far:

1. Is it possible that the aft input was not intentional, but a result of other things, such as turbulence?

2. Do we know if both pilots were attempting inputs simultaneously?

3. Are we certain that the aft input was actually a pilot input and not from the system itself?

4. What parameters are actually recorded (as opposed to what has been reported as being recorded)?

5. It is clear that there was no recording of the F/O side airspeed indications.

6. It is not clear to me whether the PF was in the left or right seat. It appears from the text that it was the right seat.

There are a number of other issues as well, but suffice to say that there is not sufficient information to decide what occurred at this time.

We do know that there is no "feedback" across the systems, so the PNF may not have been aware of the reason the aircraft was pitching up, assuming that was a result of a PF input.
 
If they hit severe icing, then there was nothing that would allow the probes to continue to work. In fact, no aircraft will be able to overcome a severe icing encounter by the design limits of how aircraft are certified.

It happens. I think instead of throwing our arms up in the air and screaming about how this could NEVER happen, we should probably get to the point of accepting that some of us aren't going to survive this industry, and that what we do is inherently dangerous. We make it very, very safe, but there are going to be days where there's no real good way out of a bad situation, and while we should learn everything we can from accidents like this one, there's the possibility that these poor guys were simply screwed.

While I agree with the above, it happened ten times prior. Ten. I can't imagine ten separate crews accidently encountered sever icing. If they did, there is waaaaay more of a training problem then anyone thought. You're right, we are all one golden BB away from.......
 
In an airplane that the crew just uses full aft stick for windshear escape, would, under normal law, there be an advantage to utilizing the protections in the system when faced with uncertainty, or might a pilot revert to that faced with an uncertain situation?
Primacy. With the flight controls in normal law you can pull as much and as hard as you want and you won't stall the airplane. Which is actually pretty cool, as long as you're in normal law.

Here are some other possible issues with what we know so far:

1. Is it possible that the aft input was not intentional, but a result of other things, such as turbulence?

2. Do we know if both pilots were attempting inputs simultaneously?
At one point yes; the PF handed control to PNF after conflicting inputs were made according to the BEA analysis of the CVR and FDR ("Go ahead, you got it"). In the event of a conflicting input the flight controls take the algebraic sum of the two sidestick positions unless a priority/takeover pushbutton is pressed.

3. Are we certain that the aft input was actually a pilot input and not from the system itself?
Not with what has been presented thus far. An A321 or A320 once took off out of I-forget-where in Europe and had the roll control wired backwards on the Captain's side, and a gutsy first officer had to mash on his takeover pushbutton and fly the airplane when they almost dragged the wingtip on departure.

4. What parameters are actually recorded (as opposed to what has been reported as being recorded)?
I don't know, but I'm sure that it's whatever is required under Part 121 for FDRs and can be found in a type certificate somewhere.
5. It is clear that there was no recording of the F/O side airspeed indications.
The BEA report says there was an inconsistency between Captain's side and standby airspeed indications, with no mention of FO's instruments, so yeah.

6. It is not clear to me whether the PF was in the left or right seat. It appears from the text that it was the right seat.
It would appear so. FDR might record the position of both sidesticks instead of the sum of the two, so that will be interesting to see.

We do know that there is no "feedback" across the systems, so the PNF may not have been aware of the reason the aircraft was pitching up, assuming that was a result of a PF input.

Yes indeed. At one point the PNF had the controls, though.
 
While I agree with the above, it happened ten times prior. Ten. I can't imagine ten separate crews accidently encountered sever icing. If they did, there is waaaaay more of a training problem then anyone thought. You're right, we are all one golden BB away from.......

Well, it was a known issue that certain pitot tubes installed in the Airbus were susceptible to icing. Well enough known that there was an AD in the US, http://rgl.faa.gov/Regulatory_and_G...6256a7800582828!OpenDocument&ExpandSection=-2 . That AD added to the AFM:

Switch OFF the AP/FD and A/THR

Maintain flaps/slats in current configuration

Check that speedbrakes are retracted When airborne, select landing gear up

  • With slats extended--Apply MCT thrust and set the pitch attitude to 12.5 deg.

  • In clean configuration--Apply CLB thrust

  • When below FL100, set the pitch attitude to 10 deg.
When above FL100, set the pitch attitude to 5 deg.

Note:
Respect Stall warning if in alternate law
 
Well, it was a known issue that certain pitot tubes installed in the Airbus were susceptible to icing. Well enough known that there was an AD in the US, http://rgl.faa.gov/Regulatory_and_G...6256a7800582828!OpenDocument&ExpandSection=-2 . That AD added to the AFM:

That AD is from 10 years ago. It goes on to adress a dual pitot failure not a complete loss of the pitot/static system. There might be further AFM guidance in the later case. From what I can gather this is a new problem that is occurring within the last 12 to 18 months. And a complete seperate equipment change/mod is being made to the a/c. Not just a change to the afm.

Any one know if the A330 uses separate pitot tubes and static sources, or is the static source combined into the pitot tubes?
 
http://www.airbusdriver.net/airbus_fltlaws.htm

A nose up command is introduced any time the airplane exceeds VMO/MMO to keep the speed from increasing further, which CAN be overridden by the sidestick.
yes. I understand that alternate law kicked in (and I understand alternate law!) I just don't understand the statement about "multiple system failures" since I don't have an FCOM at my disposal. I'm looking for precisely what information going wonky leads to autoflight disconnection and the loss of envelope protections.
 
IMHO, it's criminal that we rely on sims as much as we do. If a plane is capable of recovering from a stall, the PIC should have stalled it, seen that it is recoverable, and seen what really happens. Regardless, I'm sorry for the loss of your friend/acquaintance. Didn't mean to pick at old scabs for anyone.


No problem, the guy was a casual acquaintance. I didn't even know it was him in this crash until several years later when I read the full accident summary.

Still, it's always kind of a shock to find out that someone you knew was involved in a crash with a high level of notoriety...


Kevin
 
[/B]Still, it's always kind of a shock to find out that someone you knew was involved in a crash with a high level of notoriety...

Amen to that. When Valuejet Flight 592 went down, I initially had no idea that Captain Candi Kubek was the Candi Chamberlain who worked with me at KELP back in the early to mid '80s. That was a shocker.
 
Posted on AvWeb:

Airbuses Fly "Like a Video Game" I would like to offer my comments and perspective with regard to the Air France Flight 447 accident. I have been a A-330 captain since 2003 and have over 4500 hours in the aircraft. While many A-320 pilots undoubtedly have more series time, I believe this probably makes me one of the most experienced A330 pilots in the world.
When asked how I like the aircraft, I tell people that there is likely no easier airplane to take over an ocean, and that the systems design and presentation is superb. That said, the automation is more complex and less intuitive than necessary, and the pilot-aircraft interface is unlike that of a conventional aircraft. Most important with regard to this accident is the fly-by-wire sidestick control. The sidestick itself has a very limited range of motion, making inadvertent over-control very easy. Of even greater significance, the stick itself provides no "feel" feedback to the pilot. That is, unlike a conventional aircraft, the pilot does not get a sense through pressure of how much input is being sent to the control surfaces. The most important advice I give to pilots new to the Airbus is to treat the aircraft not as an airplane, but as a video game. If you wait for the sidestick to tell you what you are doing, you will never get an answer.
Taking into consideration that Air France 447 was at FL 350 (where the safe speed envelope is relatively narrow), that they were in the weather at night with no visible horizon, and that they were likely experiencing at least moderate turbulence, it does not surprise me in the least that the pilots lost control of the aircraft shortly after the autopilot and autothrust disconnected.
Let's keep in mind that these are not ideal conditions for maintaining controlled flight manually, especially when faced with a sudden onslaught of warning messages, loss of autofllght, confusing airspeed indications, and reversion to "alternate law" flight control, in which certain flight envelope protections are lost.
A very bad Airbus design feature is thrust levers that do not move while in autothrust. They are instead set in a detent which would equal climb trust in manual mode. If the pilots did not reset the thrust levers to equal the last cruise power setting, they likely eventually ended up in climb power, making it difficult to reset the proper cruise power setting and adding to what was likely already a great deal of confusion.
But the real problem probably occurred immediately after the pilot flying grabbed the sidestick and took over manually. Unfortunately, airline pilots rarely practice hand-flying at high altitude, and almost never do so without autothrust engaged. As a result, we forget that the aircraft is very sensitive to control inputs at high altitude, and overcontrol is the usual result. Because the Airbus sidestick provides no feedback "feel" to the pilot, this problem is dramatically compounded in this aircraft.
I believe the Air France pilot grabbed the sidestick, made an immediate input (because as pilots, that's what we tend to do), and quickly became quite confused as to what the aircraft was truly doing. This confusion likely was exacerbated by fixating on airspeed indications that made no sense while trying to find a power setting with no airspeed guidance.
When transitioning from autopilot to manual control at altitude in the Airbus, the most important thing to do at first is nothing. Don't move a thing, and then when you do, gently take hold of the sidestick and make very small inputs, concentrating on the flight director (which, in altitude hold, should still have been providing good guidance). Of course, this is much easier said than done with bells and whistles going off all over the place, moderate turbulence and a bunch of thunderstorms in the area. As I said before, treat it like a video game.
So why did the Air France pilot find himself at the limits of sidestick travel, and then just stay there, maintaining a control input that simply could not logically be correct? When things go really bad and we are under intense pressure, it is human nature to revert to what we know from previous experience. Remember, the Airbus flies like no other aircraft in that the sidestick provides no feedback to the pilot. It is a video game, not an airplane.
I believe the Air France pilot unintentionally fell back on all of his previous flying experience, in which aircraft controls "talkedF" to him when he moved them. Distracted by many confusing inputs, he instinctively expected to be able to control the aircraft by "feel" while dividing his attention to address other matters. I've seen it happen in the simulator, and in an Airbus this is a sure way to lose control of the aircraft and is possibly the most dangerous aspect of Airbus design philosophy.
One last note: Airbus pilots often claim that the aircraft "can not be stalled." When the flight controls are in "normal law" this is a reasonably true statement. However, in "alternate law," as was the case here, stall protection can be lost. If we ever practiced this in the simulator, I don't remember it.
Lest anyone think I am blaming the Air France pilots for this accident, let me be clear. Despite all of my experience in the aircraft, I am not the least bit certain that I would have been able to maintain control under the same circumstances. I do feel certain that were you to spring this scenario on pilots in a simulator without warning less than half of them would have a successful outcome. Safely flying the 320, 330 and 340-series Airbus requires something of a non-pilot mindset.
Name Withheld

Editor's Note: We have spoken with the writer of this letter to confirm his identity and honored his request for anonymity. For another analysis of the trials and challenges of flying an A330, be sure to listen to Friday's podcast with airline pilot Jason Goldberg.

Bp244
 
Back
Top