Air France crash

[jayb]

Any of you guys follow aviation-related topics?  I'm always interested in finding out more about what causes crashes, and today some interesting data became available from the flight data recorder of the ill-fated Air France flight from Brazil to Europe.  This flight crashed inexplicably in the summer of 2009, and based on some automated signals from the plane before it crashed, indications were that the pitot tubes (which provide airspeed information) may have malfunctioned.  The crash was in the middle of the Atlantic, and for a long time the flight data recorders were not found, but recently they were both recovered and went to France for analysis. 

Turns out that the plane was not getting good airspeed data; stall warnings came on and off a couple times, and finally the airspeed read as an extremely high value.  But the plane basically stalled at a very high altitude, and fell, without flying, all the way to the ocean.  While this was going on the pilots were trying to hold the nose of the plane up, indicating that they thought they were going to fast, not too slow; normally you put the nose down to fly out of a stall.

Its a very strange situation, and I'm looking forward to the further analysis on this by the aviation authorities.  I can think of several possible scenarios that could be the root cause of the crash:

- Loss of most instrumentation, including airspeed and the artificial horizon.  In a storm this would make it nearly impossible to understand where you were and what the plane was doing.

- Computer lock up, where the computer that is responsible for most of the plane's functions took bad data from the airspeed indicator and did not allow the pilots to properly control the airplane.

- Pilot error, where the pilots misinterpreted the available data and controlled the airplane incorrectly.

Anybody else have thoughts on this?

[ToddK]

I've been following this crash and investigation with a bit of interest, as I fly the same aircraft type, Airbus A330's for a living.

There has been a lot of speculation about the causes of this crash, but hopefully now they have recovered the data recorders we will get a definitive answer. However, recently Airbus released a revised procedure to deal with unreliable airspeed indications as well as how to handle stall warnings. These revised procedures reinforced the basics of flying in that if you set a known power and a known attitude, the aircraft will fly a known performance. From this, it has been speculated that there may have been a mishandling of the recovery procedure of the unreliable airspeed indications that it appears the AF aircraft suffered.

The modern Airbus aircraft has a complex flight control system that is computer controlled or "fly by wire". There are no direct control cables running from the cockpit to the control surfaces. It has 3 primary and 2 secondary computers that control the flight surfaces, and these computers operate in various states of flight control law, depending on the phase of flight and the level of equipment and data serviceability. So when things start going wrong, like having pitot tubes blocking or AOA sensors failing, which leads to faulty information coming from the Air Data computers, the flight control computers try to decide which information is correct by comparing the data from all the inputs. A problem can arise when only one data input is correct, but 2 other data inputs are the same but in error, the flight control computers will use the faulty data. It then becomes the pilot's job to disconnect all the autopilots, auto thrust and flight directors and fly the aircraft the same way you were taught to fly your first basic training type, so you can recover the aircraft to a stable and safe flight path and then hopefully sort out the data problems and recover the aircraft safely to land.

I really feel uncomfortable when any sort of aircraft crash or incident where there has been a loss of life gets attributed to pilot error, as it shows either a lack of training or lack of understanding of the principles of flying. In this case, I believe the AF training system is quite good, better than a lot of other carriers around the world who I would not allow either my family or myself to travel on. So, maybe if the AF crash does come down to mishandling, the crew were caught unaware or just had a bad day. Which just shows how unforgiving the aviation industry can be - have one bad day and so much loss of life can follow. But hopefully, when that bad day does come around, the guys up front flying have had enough training and experience to deal with the situation correctly.

[jayb]

Wow, great to have a real expert on the board!  Todd, do you think it is possible that the inputs to the computers were faulty, and the pilots didn't recognize this and as a result did not put the controls in full manual mode?  I imagine that in the dark, in a turbulent storm, and with a bunch of faulty instrument readings, discerning what the aircraft is really doing could be rather difficult.

I'm guessing that China Air is at the top of your no-fly list...

[ToddK]

Yes, China Air and Air China are both up there.

With the way the Airbus flight control logic and laws work, it is quite easy to get the aircraft into a divergent stability type situation by trying to override the protections for stall/overspeed that are built in, with manual control inputs.

When you have a definite overspeed situation, the recommended procedure is to select a lower commanded airspeed and allow the autothrust to reduce the power. However, if you go into a large overspeed the autopilot will disconnect. With the aural warning for the overspeed warning going off, the autopilot disconnect aural warning can be missed. Even though the autopilot has disconnected, the built in high speed protection will command a nose up pitch to try and reduce the airspeed. Once the airspeed has recovered below maximum, the flight controls will go out of protection mode and back to normal. However, if you are not aware that the autopliot has disconnected, then you can get into trouble. Also, if in the heat of the moment, with warnings going off, you disconnect the autothrust and bring the power back to idle, you now have the engines at idle and airspeed can bleed off quickly. So you can see how a mishandled overspeed can quickly turn into a bad situation. A few months back, the domestic branch of the company I work for had a mishandled overspeed due to clear air turbulence in the cruise. The autopilot and autothrust selected off, and it didn't take long before the pilot flying got the aircraft into an upset situation and they lost altitude as well as hurting some passengers and crew in the cabin. Luckily they recovered and landed safely. But it just shows how easily things can turn into a real can of worms in an Airbus.

Now, everything I wrote above is predicated on the air data that is being displayed is accurate. If you start throwing corrupted air data into the equation, things are a different situation. In the case where air data is corrupted and not recognised by the computer systems, the faulty data will be displayed on the cockpit instruments. This is where pilots must rely on their basic flying skills to first control the aircraft, and then identify the faulty source and take corrective action. If this event occured in the middle of the night, in a storm, and you have all sorts of warnings going off, it can be a very distracting environment, making a hard job even more difficult.

From what I have read so far about the AF crash, the aircraft was intact when it hit the water. I'm not sure on it's flight path on impact, but again I have heard that they almost pancaked onto the water. This may indicate they were close to recovering, but ran out of altitude. Again, this is just rumour and speculation, we won't know for sure until the full investigation is released.

[Kerry j]

I've been following this story too and while I don't fly the kind of iron Todd does, I have had some experience trying to control an aircraft with corrupt air data info. I had an incident a few years ago where the pito static system of my plane froze up because of a faulty pito heat circuit breaker. I had some help because it was not at night and I was talking to ATC and they alerted me to the fact that I was climbing and slowing down; because I was not staying at my assigned altitude. I also had taken simulator training and the instructor had played a trick on me trying to make me crash. He turned my 58P Baron into a R44 helicopter after I took off; LOL! He slowed down slower and slower and I was scrambling to discover what the problem was.

Anyway, because of the help from ATC and the prior sim experience, it really helped me focus on flying the plane first with the best data I had. In that case I started using my GPS ground speed as my primary source of data; I could tell if I was descending or climbing by watching the ground speed. I finally figured out what the problem was, opened the alternate air source and got the breaker to stay closed so that the pito system thawed out.

I can see how in the middle of the atlantic at night how having to deal with corrupt air data would be difficult if not impossible to deal with in a plane like the Airbus. And it makes me uneasy that new aircraft like the Airbus do not have a manual back up system for the computer and fly by wire systems so that in a case like this, the pilots have no alternate source of data or control available.

[WConley]

I'm an engineer with a background in aeronautical and control systems.  I too have been following this story closely! 

As the systems become more complex, how do we ensure that a pilot has what he needs in an emergency?  I don't know...  Remember the Aeroperu 757 that crashed because maintenance had taped over the pitot-static ports?

http://www.airdisaster.com/cgi-bin/view_details.cgi?date=10021996&reg=N52AW&airline=Aeroperu

There are lots of big brains working on this problem, but I don't see how you can manage every failure mode on such a massive system.  Could a battery-powered GPS device be an effective last-ditch information source, as it was for Kerry?

[Cyclone03]

I'm at the low end of the other responders above....
I work Aircraft Avionics. I have limited experience with large aircraft as I've only worked US Air Force trainers, currently the T6 Texan II which is all glass cockpit with a single ADC (Air Data Computer). Previously I worked the T1 Jayhawk an aircraft with dual ADC's.
On the T1 we had trouble when the AF first got them,~1992,in normal operation the #1 and #2 ADC would operate separately giving the pilot and co pilot flight data info, including Altitude, airspeed ,vertical  velocity, attitude and navigation display. Each "side" had it's own pitot, static and temp sensors. Two problems arose fairly quickly, in normal operation the ADC operated separately, sort of, because they are linked and they compare and average there output displays .So during ground preflight checks the crew will operate each side separately to verify each side operates within limits. The standby system, basically "manual" altitude, airspeed and attitude indicators gets it's pitot pressures from the #2 pitot tube, same as the #2ADC.The problem was if the #2 Pitot system had a fault in flight it would relay that (pressure) info to the #2 ADC and we would have an ADC fault because the #1 and #2 systems are out of range of each other. The early checklist noted to verify flight info using the standby indicators, well as you can see if the #2 pitot system is at fault but is believed to be correct things can turn bad quickly. The "fix" was more  procedural  than an actual fix,the checklist was changed to isolate the ADC's to verify which system was at fault ,but still a double pitot failure would remove most of the available cockpit flight info leaving just GPS for airspeed and altitude. The Attitude should be indicated by the Standby by ADI (attitude indicator) as it has a built in GYRO.
Ground control could help with some info, but it would be delayed at best. More like trend recording.

I don't know if the AB ADC's read the stanby indicators but if they,AF,had a double Pitot failure and the pilots could not disable the FDC and ADC and fly off the stadby indicators and GPS then they where hosed for sure. Basicly they confirmed the fears of every pilot of  fly by wire aircraft. What happens if ALL the input DATA is corrupt, and the computers don't let the pilot take control of the aircraft?

[Kerry j]

More on the Air France Airbus crash; just got this article in my email:

http://www.avweb.com/eletter/archives/avflash/1920-full.html#204731

You have to scroll up a bit to see the Air France article.

I just don't understand how an experienced pilot would or could hold the stick at full nose up attitude for 3 minutes. They knew they were in trouble were scrambling for answers, yet the guy kept the plane in a deep stall for 3 minutes by holding the stick at the stops; full nose up. Makes no sense to me. But then I have no idea what kind of training the pilots had prior. Maybe they never flew a small plane and practiced stall recovery or how to recognize a stall and were totally dependent on the computerized flight and air data system. If that's the case; there needs to be a major change in the way these pilots are trained. Get back to basics and the associated maneuvers pilots should learn at the beginning of their training.

Very sad that so many had to die because the pilots didn't know enough to pitch down, level the plane and fly it.

[ToddK]

It is very sad indeed that so many lives were lost in this accident, and even more so because it looks like it is attributable to pilot mishandling.

Apparently, AF447 was not the only flight using that airway that night. A number of previous flights had diverted around the area in which the bad storm involved in the accident was located. Which prompts the question, was the AF flight's radar system working correctly, or was it not adjusted correctly? Or worst still, was it just not being monitored? When the aircraft entered the storm, the captain was taking rest and not in the cockpit. I'm not sure of the experience level of the pilots who where at the controls.

As Kerry mentioned, it does lead to questions about the level of training involved in some airline pilots these days. I know in the company I work for, which operates a fleet of 100+ wide body passenger and freighter aircraft all around the world, there is a marked difference in the experience levels of the pilots. We have pilots like myself who had an extensive background in military flying before I joined this company. And we also have pilots who joined the company's cadet scheme with no flying experience, did 200 hours basic training in light aircraft, and were then employed as a second officer for the next 2 to 4 years where they are used as cruise relief pilots. In that capacity, they do not manipulate the controls of the aircraft, apart from doing regular simulator training. Quite a number of the guys have made it through the system and are now captains with the airline. So they obviously meet the training requirements. But they still have no depth of knowledge or background experience from their past aviation life. All they know is this company's rules and procedures. And it often shows in their ability to think outside the box when confronted with a situation that is "not normal". And the company I work for is not the only one that has pilots like this working for it, it is quite prevalent at most major airlines. And these days with the growing number of low cost carriers, this situation of lower paid and less experienced pilots flying you around is going to increase.

Sorry about the rant, I'll get off my soapbox now. The guys involved in the AF crash may have all been very experienced, I don't know, and were just overwhelmed. But it does make you wonder how it could have happened.

[Kerry j]

Todd, the article says the pilot who had the controls had 3000 hours of logged flight time. That's almost as much time as I have and I've been flying since 1987. What it doesn't say is what kind of flight time that 3000 hours was made up of; as you mentioned, there is a vast difference in how savvy and analytical different pilots can be with the same number of hours. I know many CFI's who have many more hours logged than I do, but they have precious little real world experience in actual IFR conditions. They have 2000 hours of right seat time in the pattern watching primary students try to learn to fly the Cessna 152. Doesn't really translate into valuable flight time IMO.

I don't want to cast dispersions on the flight crew of 447; but it just seem inconceivable how a certified pilot with real world flight time could hold the stick full back for 3 minutes and not even consider it to be the problem. And to make things even worse, they did retard the throttles from full take off power to flight idle for a time, but still never lowered the nose. It is to my way of thinking beyond belief how they could do that.

[ToddK]

I agree, it is quite disconcerting to think about what happened and why.

These following few paragraphs were just released by the union I am a member of. It summarises the France's Bureau dÉnquetes et dÁnalyses (BEA).
"It appears that the most junior pilot with only one year’s experience on the A330 was the PF the FO
as PM in the left seat with the Captain resting in the cabin. The pilots attempted to deviate around
weather and soon thereafter got conflicting flight instrument information. As the information varied and
became contradictory (between PFD1 and the ISIS) the aircraft reverted to Alternate Law. For the non-
Airbus readers this means that the Flight Computers can no longer provide certain protections, such
as stall and overspeed, as the flight computers have no way of ensuring their inputs are accurate. This
effectively turns the A330 into a 744 in that the pilots are now responsible for ensuring the aircraft does
not overspeed or stall. In Alternate Law the A330 will similarly provide stall or overspeed (aural) warnings
but without the stick shaker associated with a 744 stall.
From the BEA report it appears that after the reversion to Alternate Law, the aircraft was pitched to a high
nose attitude climbing 3,000ft, from 35,000’ to 38,000’. This placed the aircraft into an ‘aerodynamic stall’.
For the next few minutes, angle of attack was in excess of 35 degrees with a ROD of over 10,000 fpm. It
appears that from the initial ‘upset’ to impact with the Atlantic Ocean was approximately three and a half
minutes.
It is quite sobering reading this initial report. Obviously, the potential for disorientation is high, flying unacclimatized
and operating through your Window of Circadian Low whilst getting unusual warnings and
failures. It is times like this that the basics from flight school must come to the fore: Power + Attitude =
Performance.
The cause of the crash is still being investigated. Many hypothesise that the pitot tubes may have iced up
leading to the erroneous and conflicting flight instrument indications. Of note, this incident led to the first
fatality involving the A330 in passenger service in almost 15 years of passenger operation."

An explanation of some of the terminology:
PF - pilot flying, the nominated pilot who has control of the aircraft
PM - pilot monitoring, the support or co-pilot
PFD - primary flight display, in a glass cockpit it shows attitude, airspeed/mach, altitude, VS and heading, as well as the flight director and other information
ISIS - intergrated standby instrument system, the standby attitude, airspeed/mach, altitude and VS indications

[BarryB]

Wow! I didn't see this thread until now. FWIW, Air France from a maintenance P.O.V. is top-notch. Flight-ops, not so much. I dealt with them on a daily basis in Mirabel (Montreal) a few years ago. The flight crews were arrogant beyond words, I'm okay with that but it was readily apparent that any sense of CRM
(Cockpit Resource Management) was not a priority, at all. At that time I saw operations on B747-200, B747-300, B747-400, B747F, B767-300 and the occasional A310-300. They had 28 flight/week at that time, I saw them a lot. The captain's word was god, period. 
My day-to-day role these days is an AME (Aircraft Maintenance Engineer) with the occasional stint as a heavy maintenance tech rep on B737NG's.

This is a great thread on a Canadian bullboard about this crash. I've been on here for years.

http://theairlinewebsite.com/index.php/topic/391344-why-did-air-france-447-go-down/

[Kerry j]

More thoughts and insight from an experienced A320 pilot:

http://www.avweb.com/eletter/archives/avflash/1925-full.html#204773

Some very good insight as to how this could have happened.

http://www.avweb.com/avwebflash/news/air_france_447_investigators_stall_crash_204730-1.html

It was inconceivable to me how they could hold the nose up at 3 - 13 degrees pitch for so long and no one even consider it to be a problem. Until I read this experienced A320 pilots comments. It makes a lot more sense now how easy it would be to overcontrol the aircraft and how hand flying the plane is rarely if ever practiced.

Sounds to me like there needs to be some systems overhaul on the aircraft and much more attention to training in case of a systems failure = hand flying the plane with limited data input. Something beginning or learning IFR pilots to on a regular basis; fly the plane by hand with partial panel.

[jayb]

Back in my model airplane days I used to fly with a guy who flew 767s and 747s for Northwest.  He also trained on the A320, and he commented once to me that with the Boeing planes the throttle levers always moved to reflect what the engines were actually doing, while the Airbus throttle levers did not.  He said he used to watch the throttle levers on his 767 out of the corner of his eye while performing certain actions in the cockpit; I've long forgotten the details, but he felt that having the throttle levers moving was an important feedback mechanism for the pilot, and he felt a little blind without that on the Airbus.

What the pilot in your link said sounds kind of like the same thing.  It is kind of beginning to sound to me like Airbus "dumbed down" their planes too much to make them easy to fly in manual mode.

[Kerry j]

The throttles would be hard for me to deal with, but having a joy stick that requires such small inputs while giving no feedback, would be impossible to deal with unless all the instruments were working. I've had a lot of partial panel time while under the hood doing the training my insurance company requires and it would be impossible to keep an aircraft under control with partial panel and the aircraft set up like the that A320 pilot describes how the A320's are.

There are techniques that are taught which really help you keep the aircraft under control if some of your instruments quit, but those techniques use airspeed, compass and yoke feedback to give you an alternate picture of what's going on. And with some practice you can hold altitude and heading without having the use of the ADI. How one would do that with no feedback from the yoke and throttles and no reliable speed indication; I do not know.