Plane seats, wing floating in Atlantic

Agence France-Presse via News.com.au ^ | June 07, 2009

[expatpat]

It sounds to me like either the Air France pilots or the journalists quoting them were confused. The pilots are not engineers, but the journalists are more likely to be the problem.
1. It is beyond belief that the plane would use air-speed sensors for navigation.
2. The Airbus fly-by-wire system does use 3 air-speed sensors, but they are used for redundancy/reliability (though the error message indicates that the triple-redundancy gambit failed).

(I would say that Airbus has a huge problem and will need to totally re-engineer their FCS)

You are correct about the recent switch to laser gyros. They do drift with temperature-gradient but probably less than the old spinning-gyros. It is my understanding that these aircraft use coupled inertial systems and GPS for Nav, the former for short-term and the latter for update correction.

[Old Professer]

Like cancer, which often presents in the absence of pain, these stories are remarkable for their lack of pictures.

[Old Professer]

“Elevator stomach” might come in handy as a warning...

[DuncanWaring]

If auto pilot erroneously increased air speed, the plane would quicky stall ...

Stalls are caused by LOW airspeed or excessive wing-loading ("g-forces").

[gandalftb]

See posts 47 and 49. Stalls are a loss of lift loading on the underside of the wing. Usually caused by low speed. At high altitude, the thin-ness of the air causes excessive drag on the upper surface that can be greater than the lower wing surface loading, if excessive pitch or attitude occurs because of increased air speed without a corresponding trim adjustment.

It's called an uncoordinated stall and all airliners are subject to it and pilots are warned against excessive speed.

Couple that with a sudden updraft at the same time, big trouble.

[bert]

Then there is the inertial navigation system based on GPS and independent from the pitot tubes. Iwould think it senior to pitot input

[gandalftb]

I agree, that is a shocking fault. However, the onboard flight control computers are redundant and could have rebooted. With auto-pilot off, they should have been able to regain regardless of speed indicator failure, there is a backup GPS speed control.

Something odd, generators shut down which usually indicates an engine failure, but no fault codes for the same. And the rudder full travel fault... If an engine failed due to hail and a severe yaw occurred, with a corrsponding over-travel of the rudder. That scenario could have done them in also. Thoughts?

[expatpat]

I don't know the details of the Airbus FBW, but I doubt very much if they use GPS data for flight control. The GPS measures ground-speed and the flight controller must use airspeed. If two or three airspeed sensors are shot, you are dead without a mechanical backup -- you have NO control of the flight surfaces, even if the computers were functioning OK (GIGO). The fact that the latter were able to tell that they had gone to alternate control law and then that the flight envelope had been violated, suggests that they were not dead.

GIGO might explain the rudder travel message, but so might a pilot going nuts with the rudder-pedals, depending on where the error message comes from (input/pedals or output/actuator).

I didn't see an error message of APU or generator shut-down in my list. Where did you see that?

[expatpat]

Not for flight control, see #68.

[COBOL2Java]

I’m surprised that some of Obama’s brethren haven’t claimed credit for this, true or not. ;-)

They don't want to ruin anything that might screw up his plans. Professional courtesy...

[expatpat]

You seem hung up on a secondary effect, when there was a serious primary problem with the all-important FBW flight controller. If the input to the FCS is garbage due to A/S sensor failure, then the output moving the flight surfaces will be garbage. The FBW alt. law message indicates that either most of the sensors were screwed up or the computers were. The later Flight envelope message strongly suggests that the output was indeed garbage.

[Gandalf_The_Gray]

The following is a portion of the ongoing discussion at http://luckybogey.wordpress.com/2009/06/04/air-france-disaster-update-is-there-a-cover-up/
I'll post it for what its worth as it seems to be fairly informed comment and departs from some of the comments registered here.

---

Out of respect to the families who lost loved ones, I don’t want to speculate and weather may have been the most significant contributing factor to this disaster, however a review of several airline pilot message boards and forums shows us that the pilots who fly the Airbus A330 are very concerned about the ADIRUs and specifically the lack of any software redundancy: Below is a sample of these comments.

Please understand these are on-line comments are between pilots and give a good insight to the cause or causes of this accident however the are not FACT and only speculation at this time:

In light of no other information, this really spooks me that it’s an ADIRU issue which brought this plane down. I agree. After the QF lucky break and others, I have feared there is a core problem with the Airbus software that is a catastrophic accident waiting to happen. You just have to wait, and it will happen.

————————————————————– As the usual, it takes a series of contributing problems to bring down a plane at altitude, but if there was, say a sudden auto-generated disfunctional operation of the plane coupled with an extreme weather event that made disfunctional flying much more stressful on the plane than the norm, and also preventing the pilot from regaining a healthy flying condition, could have destroyed the plane.
————————————————————– It was confirmed that each PRIM was loaded with identical operational software The significant issue is that Air France appear to have opted not for Litton for their ADIRUs, but for the other manufacturer, Honeywell. Yet, once again, ADIRU malfunction is among the possible causes being investigated.
————————————————————– The important thing about ADIRUs is that they work not from the traditional instruments but from probes which mostly measure air pressure etc. from different directions. So it can tell not only how fast the aeroplane is flying, and in what direction, but also whether it is skidding, sideslipping, gaining or osing altitude etc.
————————————————————– Hmmm, if the ADIRUs mostly measure air pressure, and you fly through an extreme thunderstorm with highly oscillating air pressure measurements, how does the ADIRU handle that? Could that convince the ADIRU that the plane is somewhere it shouldn’t be? (Let’s say, FL850), causing it to nosedive?
————————————————————– A poster asked for an explanation of ADIRUs in plain English. It’s as simple as that.

The ASI works on airflow from ahead. The altimeter works on barometric pressure. The compass works on magnetic attraction, sometimes with added gyros. The turn and bank usually works on a simple pendulum arrangement…….

Inertial navigation works on differential airflows from numerous directions – it’s a true breakthrough in that it can precisely and continuously record and display an aeroplane’s true flightpath and speed.

That is NOT "inertial" navigation as I know it. Inertial navigation does not use sensors or signals external to the unit itself. It computes its own position by measuring accelerations along three mutually orthogonal axes using accelerometers mounted on a gyro stabilized platform. The signal is integrated once to render a velocity output and a second time to yield a position signal. The integration process is pron to drift as any noise present in the signal is added along with the actual signal. The electrical drift along with the tendency for gyros that establish the reference plane to drift requires that the system be periodically tweaked using an external reference (GPS or celestial sightings) to minimize accumulating error. GtG

————————————————————– Yet again, the flight was at night, the crew was probably able to see a lot of lightning and get a hint of what they’re flying into. This in fact is confirmed by a first ACARS message “flying into CBs”. But why would anyone knowingly fly into such a storm?
————————————————————– I think right now I’m more leaning towards a fly-by-wire control system failure similar to an incident with a QF A333 when the plane’s air data inertial reference unit (ADIRU) failed, causing a sudden out-of-control flight that the flight crew barely recovered from. That’s why if we see a lot of anomalous data from the flight data recorder in regards to control surface movements and in pitch, roll and yaw, an ADIRU failure sounds more and more like the cause of the crash.
————————————————————– “Over a time span of four minutes, starting at 02:10 UTC, a series of ACARS messages were sent -automatically- from the plane. The first message indicated the disconnection of the autopilot followed and the airplane went into ‘alternate law’ flight control mode. This happens when multiple failures of redundant systems occur.

“From 02:11 to 02:13, multiple faults regarding ADIRU (Air Data and Inertial Reference Unit) and ISIS (Integrated Standby Instruments System) were reported. Then on 02:13 the system reported failures of PRIM 1, the primary flight control computers that receive inputs from the ADIRU and SEC 1 (secondary flight control computers). The last message at 02:14 was a ‘Cabin vertical speed’ advisory.”

————————————————————– The AD makes no reference to that. The most recent version calls for the whole unit to be turned off in the case of a fault. The previous version called for the unit to be turned off only if the “OFF” lights in the separate controls for the ADR and IR segments of the unit did not illuminate after their associated switches had been pressed. This seems to not be an issue with crossflow of bad data as much as it is an issue with how to effectively isolate a bad ADIRU. Why they didn’t just put out a new procedure calling for the ADIRU to be turned off in the first place I don’t know – it doesn’t make a whole lot of sense to keep it running if its ADR and IR segments have both been disabled. But as long as the unit is de-energized (which is what the most recent AD calls for), there’s not going to be any bad data flowing. And there would be no need to turn a second one off unless a fault developed with that particular ADIRU.
————————————————————– Regarding the ACARS messages, I’m afraid we have not been told all the truth, or all what is known. At first it was a single short message, now it’s 4 minutes of transmission, and some even say it is much more than this, more than 10 pages full of information. When will they publicly state what the ACARS messages tell? Is it classified info for the investigators?

The points being made on here are that there have been three recent cases (all A330s) in which the ADIRUs have suddenly started transmitting ‘rogue’ messages to the autopilot (usually that the aircraft is climbing or descending when it’s not). Throwing the aeroplane into sudden sharp descents or climbs.

————————————————————– The point to remember is that the problem has NOT been solved. The AD is an emergency (and hopefully temporary) reaction to a problem of which the root cause has not yet been found. As I understand it, there appears to be mounting evidence that one defective ADIRU can somehow ‘cross-fertilise’ with the others, or with other aircraft systems – which may necessitate turning two off. What’s more, turning either or both off by normal procedures may not work – necessitating a ‘belt and braces’ approach:-

“Since that AD was issued, it has been reported that the “OFF” light did not illuminate in the cockpit after setting the IR and ADR pushbuttons to OFF. Investigation has determined that the ADIRU was indeed sometimes affected by another failure condition.

“To prevent such a failure, the operational procedure has been updated to instruct the flight crew to de-energize the ADIRU if the “OFF” light is not illuminated after setting the IR and ADR pushbuttons to OFF. Consequently, AD 2008-0225-E, which superseded AD 2008-0203-E, required accomplishment of the updated AFM operational procedure.

“Since this second AD was issued, a new in service event has been reported highlighting that, in some failure cases, even though the “OFF” light illuminates in the cockpit after setting the IR and ADR pushbuttons to OFF, the IR could keep providing erroneous data to other systems.

“In order to address all identified failure cases, de-energizing the affected ADIRU must be done by setting the IR mode rotary selector to OFF. Consequently, this AD, which supersedes AD 2008-0225-E, requires accomplishment of the updated AFM operational procedure.”

So three Emergency Airworthiness Directives in the space of a few months – and no sort of permanent solution yet.

---

For what its worth...

Regards,
GtG

[DuncanWaring]

Do you make this up as you go along? Your reply makes as much sense as “.9 millimeter semi-automatic revolver”.

I’m a licensed pilot; I’ve flown hundreds of stalls, power-off, power-on, normal, accelerated and spins (all intentional). I’m also a builder of aircraft instruments and software simulations of aircraft.

I’ve never run into anything resembling whatever it is you are trying to describe.

A stall occurs when the angle of attack of the wing exceeds the “critical” angle of attack and the airflow starts to separate from the wing.

This phenomenon has nothing to do with speed, or altitude, or temperature, or density. Coefficient-of-lift charts have angle-of-attack along the x-axis and coefficient of lift along the y-axis.

Lift is dependent on airspeed, coefficient of lift, air density and wing area.

For a given air density and wing area, as airspeed goes down, coefficient of lift must increase to maintain level flight. If the coefficient of lift required to maintain level flight (due to low airspeed) is greater than that particular wing can produce, and the pilot tries to maintain level flight, the wing will stall.

Flying faster than that speed, the wing is capable of producing more lift than necessary to maintain level, 1-g flight. Generally, the lift available rises as the square of the airspeed increase; fly 1.414 times as fast and you double the lift available, double the airspeed and you can get four times as much lift.

This means that if you’re flying 1.4 times the stall speed (same wing/flap/slat configuration), you can pull “2 gs” before stalling.

If you’re flying three times the stall speed (not uncommon for airliners in cruise), the wings will produce lift 9 times the weight of the aircraft before stalling.

Very few aircraft are built to withstand 9 g’s. None of them are commercial airliners.

If anything, the drag on the lower surface of the wing will be greater than the drag on the upper surface because of the greater pressure on the lower surface. The pressure on the lower surface HAS to be greater; otherwise there would be no lift. That’s true at EVERY altitude.

“Uncoordinated stall” is a stall in which one wing stalls before the other, due to being in a turn, generally leading to a spin. It has nothing to due with the speed at which the stall occurs.

[DuncanWaring]

Inertial navigation works on differential airflows from numerous directions

INERTIAL NAVIGATION DOES NOT WORK ON AIRFLOWS. IT WORKS ON ACCELERATIONS! ACCELERATIONS ARE INTEGRATED (CALCULUS) TO PRODUCE VELOCITIES, AND VELOCITIES ARE INTEGRATED PRODUCE POSITIONS. IT WORKS JUST THE SAME IN SUBMERGED SUBMARINES, AIRCRAFT AND SPACECRAFT!

[bert]

Thanks for the post.

[Gandalf_The_Gray]

INERTIAL NAVIGATION DOES NOT WORK ON AIRFLOWS. IT WORKS ON ACCELERATIONS! ACCELERATIONS ARE INTEGRATED (CALCULUS) TO PRODUCE VELOCITIES, AND VELOCITIES ARE INTEGRATED PRODUCE POSITIONS. IT WORKS JUST THE SAME IN SUBMERGED SUBMARINES, AIRCRAFT AND SPACECRAFT!

No need to shout, if you had bothered to read my post before you flying off the handle you would have seen that the quote that seems to have hit your hot button was from Air France pilots talking about the possible causes of the crash. That business about differential pressure signals was their comment, not mine. My comments inserted into the discussion thread reveal to anyone who bothered to read them, that we are in substantial agreement as to what is and what is not an inertial navigation system.

Forty years ago I managed to struggle my way through four semesters of CALCULUS, differential equations, vector analysis, numerical methods, and more. I graduated with two engineering degrees and made Honor roll every term. Do not presume to teach your grandfather how to suck eggs!

Regards,
GtG

[DuncanWaring]

After I read the post about the post about three more times, it started getting ambiguous about who said what.

I took all the same courses (but no Honor Roll).

And you’ve only got about five years on me, “Grand-dad”. ;-)

[Gandalf_The_Gray]

I believe that you and I and I would include "expatpat" are in complete agreement as to the nature of inertial nav systems. However, it seems the French pilots have different ideas as to how the magic behind the curtain really works. They also seem to agree that Air Bus has some major problems with instrmentation on the 330s, both hardware and software.

On a final note, would you feel comfortable flying in an AirBus 330, as a passenger not the pilot?

Regards,
GtG

[expatpat]

Interesting material.

It appears almost certainly to me that ADIRU failure is the cause (GIGO). The Air Data and Inertial Reference Unit merges input data: airspeed data from the pitots, directional info from the DGs, and yaw, pitch and bank data from other gyros etc. There are 3 ADIRUs for redundancy.

Here's the crux: the units are failure-prone. There have been three Emergency ADs issued on the ADIRU in the last few months. This is very startling in view of the importance of the component in a flight critical system. I am surprised the fleet wasn't grounded until the ADs were addressed - emergency ADs are very serious.

The other surprising thing to me is that apparently the FCS does not automatically isolate a bad ADIRU so it can't confuse the other channels -- it is up to the pilot to turn off a bad unit manually!

[DuncanWaring]

I’d be a little leery about flying on a 330 ... there’s a fellow I used to work with who’s got 30 years experience building autopilots for Boeing airplanes ... some American Airlines A330 pilots he knows say the 330 is very difficult to hand-fly if the autopilot goes out (which appears to be the case on AF447).

Not good.