muddymech
9th June 2011, 04:24 PM
Got sent this today, ealry report for the Air France A330 investigation, it looks alittle like it may create more questions than answers. Be interesting to see the final out come.
ian
Painful Lessons
AF447 crash investigation points to inadequacy of pilot training
Aviation Week & Space Technology 06/06/2011
Authors: Jens Flottau and Robert Wall
The focus of the investigation into why Air France Flight 447 crashed into the Atlantic a year ago is starting to change now that safety experts have begun evaluating information from the Airbus A330-200's flight recorders.
Questions surrounding human factors are moving into the spotlight as the investigation further unfolds, with concerns of turbulent weather and pitot-tube icing shifting into the background.
French accident investigation agency BEA released a three-page memo May 27 containing factual information excerpts that is likely to be followed by a more in-depth interim report within the next few weeks, possibly by the end of this month. The final report is not expected until 2012; it should also address concerns raised by some about technical problems with the A330.
Initial analysis of the flight data and cockpit voice recorders is revealing more about what caused AF447 to crash on June 1, 2009: The aircraft stalled at 38,000 ft. and was never recovered. The sequence of events suggests that proper stall recovery procedures could have prevented the accident.
Inflight loss-of-control accidents were the most frequent cause of fatal airliner crashes and by far the deadliest in 2000-09. Of the 89 fatal accidents recorded in the period, 20 were attributed to inflight loss of control; 16 were caused by controlled flight into terrain.
Recent crashes linked to stalls include that of the Colgan Air Bombardier Q400 on approach to Buffalo, N.Y. (2009); Turkish Airlines Boeing 737-800 in short final for Amsterdam (2009); West Caribbean Airways MD-82 in Venezuela (2005); Thomsonfly Boeing 737-300 near Bournemouth, England (2007); and XL Airways Germany Airbus A320 off the coast of Perpignan, France (2009).
"Most approach-to-stall incidents and accidents occur with sufficient altitude available for the recovery," Boeing Senior Safety Pilot Mike Coker told delegates at the Flight Safety Foundation's European Aviation Safety Seminar in Istanbul this year. "Incidents progress to accidents when the crew fails to make a positive recovery after the stall warning occurs."
Flawed training is partly to blame, he asserts. Approach-to-stall training is typically conducted at simulated altitudes of 5,000-10,000 ft., but many stalls actually happen much higher. In the case of AF447, stalls occurred at 35,000 ft. and 38, 000 ft., respectively. That has important, negative implications, Coker concludes.
"Recovery stresses an increase to maximum thrust and recovery with minimal altitude loss," he says. Therefore, "students try to minimize the nose-down pitch change while engines spool up."
To make matters worse, engine margins at high altitude are much smaller than at lower flight levels, where pilots can count on a much greater response to power increases. Also, Coker says, "it is probable when pilots remain on a particular model for extended periods of time that their exposure to approach-to-stall indications and recovery occur as infrequently as once in a decade," when stall exercises should really be part of recurring training. He stresses that training should focus on correct procedures, reducing the angle of attack and appropriate energy awareness, and not so much on minimizing altitude loss.
Airbus and Boeing have worked together to devise new procedures for stall recovery that emphasize angle of attack rather than preserving altitude.
As far as AF447 crew coordination is concerned, there are at least two indications that there may have been problems. The pilot non-flying (PNF), a 37-year-old with 6,547 total hours and 4,479 hr. on type, tried several times to call back the captain, who was on an agreed break; at the time, the pilot flying (PF), the 32-year-old junior copilot with 2,936 flying hours and 807 hr. on type, continued to pull back his side-stick at Flight Level 380 with thrust set to takeoff/go around, the angle of attack increasing further and speed decreasing. The two pilots also made simultaneous control inputs (pitch up) at around 20,000 ft. and an estimated sink rate of more than 10,000 ft. per minute.
Air France's training and crew coordination standards will therefore likely be another target for recommendations; the airline already has undertaken an outside audit, conducted by Delta Air Lines representatives, of its safety procedures. In spite of the new evidence, the airline states that "the crew, made up of three skilled pilots, demonstrated a totally professional attitude and were committed to carrying out their task to the very end."
The sequence of events in the crash that killed all 228 people onboard the flight from Rio de Janeiro to Paris can be segmented into two distinct phases. In the first phase, the pilots were dealing with the failure of speed readings that are almost certain to be linked to iced-over pitot tubes. The second phase began when speed indications returned to normal and the aircraft was at the edge of its flight envelope but under control and not stalled. Phase two also coincided with the captain's return to the cockpit from an agreed-upon rest.
The initial chain of events was kicked off by erroneous speed readings at 2:10:05 (UTC), when both the primary flight display and integrated standby instrument system (ISIS) showed a sharp fall from 275 kt. to just 60 kt. The autopilot and auto-thrust disengaged and the flight management system switched to alternate law. The aircraft rolled to the right and the PF reacted by making a nose-up and left input. The stall warning sounded twice.
The nose-up inputs led the aircraft to climb fast, at a rate of up to 7,000 ft. per minute, but it almost leveled off at a slight climb of around 700 ft. per minute and Flight Level FL375. At 4 deg., the angle of attack was only slightly higher than in cruise flight (3 deg.). The return to normal of the primary speed indication after 40 sec., and after close to 1 min. on the ISIS, indicates the pitot tubes started to transmit valid data again and the icing issue appeared to have subsided.
At this stage, the event could have been over, with the aircraft still in alternate law and manual control but stabilized. There appears to be no technical, aerodynamic or meteorological reason that would have kept it from returning to its previously assigned altitude (FL350) by simply applying nose-down stick-forward control inputs.
But then things went terribly wrong. At 2:10:50, the PF continued to provide nose-up inputs, causing the trimmable horizontal stabilizer to go to 13 deg. nose-up from 3 deg. nose-up. The airspeed began decreasing, to 185 kt., and the angle of attack reached 16 deg.
Gerhard Huettig, a professor of aeronautics at the Berlin Technical University, says the change in the horizontal stabilizer position was due to a software malfunction that could have been neither recognized nor corrected by the pilots and was a key factor as to why they were unable to fly out of the subsequent stall. He consequently asserts that the entire A330 fleet should be grounded until the software is corrected. However, industry officials point out that the automatic trim only became active after the crew pulled back on the stick and that it worked as expected.
In this phase, the captain re-entered the cockpit. What role he played subsequently is not clear yet, because the full cockpit voice recorder content has not been published. According to one report, he immediately told his two copilots that they were in a stall and therefore should put the aircraft's nose down and reduce thrust. Others doubt that because there was hardly any nose-down control input in the remaining 3 min. of flight and from 38,000 ft. to sea level.
In fact, forward speed declined so much that even stall warnings stopped, in spite of the fact that the aircraft remained in a stalled situation for the remainder of its flight. That only happens when measured speeds are below 60 kt. and angle-of-attack values are considered invalid. When speed drops below 30 kt., that is also registered by the flight management system as invalid-and that is what seems to have occurred 30 sec. later, as the PF stated, "I don't have any more indications" and the PNF replied, "We have no valid indications." That second instrument failure is thus most likely due to the slow speed and not linked to pitot-tube icing.
Around 2.5 min. before impact, there was one short period in which the PF did the right thing by pushing the side-stick forward. The angle of attack decreased and speeds became valid again, with the stall warning returning and indicating an acceleration in horizontal speed. The stall warning may have caused the PF to pull back on the stick again, repeating his previous pattern; it was not corrected by either the PNF or the captain. "[The pilots] never made the inputs necessary to recover," says one official close to the investigation.
"We will learn a lot from this accident," says William R. Voss, president and CEO of the Flight Safety Foundation, who believes that AF447 should have fundamental consequences for the content of pilot training globally. "We are still training [for] the engine fire at V1, but the complexity of automated systems has grown. We have to develop crews that can deal with incidents such as QF32," the Qantas Airbus A380 that suffered an uncontained engine failure after takeoff in Singapore on Nov. 4, 2010, and returned to the airport severely damaged.
Voss argues that AF447 would not have crashed if the aircraft had been of an older generation. "Highly automated aircraft have saved many lives, but they fail differently than aircraft of 20 years ago," he says. He sees it as a "failure of the industry" that pilot training has not kept in step with the latest aircraft technologies. He also argues for improved upset recovery training, as "we are not explicitly training that" and the AF447 A330 "seems to have had pitch-and-roll authority all the way down to the water."
The focus on the pilots is not likely to have an immediate impact on the legal landscape. Steve Marks, an attorney with Miami-based Podhurst Orseck, who represents 41 families of AF447 victims, notes that investigative reports like this "tend to focus on pilot conduct," adding that "in this case, there is no doubt the pilot confusion is linked directly to the failure of the pitot tubes." Marks is bringing a case against the companies involved in the A330 navigation system. On June 3, a San Francisco judge was due to hear arguments on whether the case could be brought in the U.S., or if the liability claims must be made in French court. If it is the latter, plaintiffs would have to wait until the judicial inquiry in France is complete, which, as in the case of the Concorde crash, could take years.
The BEA report plays down two other issues that have been in the spotlight. One is speculation that the aircraft entered a severe storm; the BEA document suggests it was merely turbulence that is standard for that region. During a crew briefing 2 hr. into the flight, in which all three pilots participated, the PF said that "the little bit of turbulence that you just saw, . . . we should find the same ahead . . . . We're in the cloud layer. Unfortunately, we can't climb much for the moment because the temperature is falling more slowly than forecast." And 11 min. later, the PF told the captain that "in two minutes, we should enter an area where it'll move about a bit more than at the moment. You should watch out," adding that "I'll call you as soon as we're out of it." The PNF proposed 2 min. later that "you can maybe go a little to the left" and the aircraft turned left 12 deg. None of the actions suggest anything out of the ordinary.
The second speculation surrounded pitot-tube icing. Although the pitot probes appear to have iced over, the speed discrepancy between the primary flight display and ISIS lasted around 45 sec., not atypical for the phenomenon.
There remain some long-term questions related to the AF447 accident. Would better aural cues help focus pilot attention on recovering from a stall? One industry official doubts replacing the "stall" alert with a more specific instruction, such as "push stick," would make much of a difference. And should research be funded toward devising a better backup mechanism to pitot tubes or finding another way to determine true air space that is less susceptible to outside environmental factors? "It would be interesting to have another technology," the industry official says.
AF447's Final Minutes (May 31/June 1, 2009)
Time*
2:01:46 FL350
Mach 0.82
Pitch about 2.5 deg.
2:10:05 Autopilot, autothrust disengage
Pilot makes left nose-up input
Stall warning
Recorded speed drops from 275 kt. to 60 kt. (in primary flight display (PFD) and integrated standby instrument system)
2:10:16 Pitch attitude exceeds 10 deg.
Pilot makes nose-down control inputs
Vertical speed falls to 700 ft./min. from 7,000 ft./min.
Speed displayed on PDF increases to 215 kt.
FL375
Recorded angle of attack: 4 deg.
2:10:51 Stall warning
Thrust levers at takeoff/go-around
Pilot maintains nose-up input
Recorded angle of attack increases beyond 6 deg.
Trimmable horizontal stabilizer passes from 3 to 13 deg. nose-up
2:11:16 Speed on integrated standby instrument system increases to 185 kt.
Pilot continues nose-up inputs
FL380 reached
Pitch attitude and angle of attack: 16 deg.
2:11:40 Captain re-enters cockpit
FL350
Angle of attack exceeds 40 deg.
Vertical speed: descending 10,000 ft./min.
Engines' N1 shaft speed near 100%
Pilot makes nose-up inputs
2:12:02 Thrust levers at idle
Engines' N1 at 55%
2:12:17 Pilot makes nose-down inputs
Angle of attack decreased
Speed indications become valid
2:13:32 Angle of attack remains above 35 deg.
2:14:28 Vertical speed: descending 10,912 ft./min.
Ground speed: 107 kt.
Pitch attitude: 16.2 deg. nose-up
Roll angle: 5.3 deg. left
*all times UTC (June 1, 2009)
Source: BEA
ian
Painful Lessons
AF447 crash investigation points to inadequacy of pilot training
Aviation Week & Space Technology 06/06/2011
Authors: Jens Flottau and Robert Wall
The focus of the investigation into why Air France Flight 447 crashed into the Atlantic a year ago is starting to change now that safety experts have begun evaluating information from the Airbus A330-200's flight recorders.
Questions surrounding human factors are moving into the spotlight as the investigation further unfolds, with concerns of turbulent weather and pitot-tube icing shifting into the background.
French accident investigation agency BEA released a three-page memo May 27 containing factual information excerpts that is likely to be followed by a more in-depth interim report within the next few weeks, possibly by the end of this month. The final report is not expected until 2012; it should also address concerns raised by some about technical problems with the A330.
Initial analysis of the flight data and cockpit voice recorders is revealing more about what caused AF447 to crash on June 1, 2009: The aircraft stalled at 38,000 ft. and was never recovered. The sequence of events suggests that proper stall recovery procedures could have prevented the accident.
Inflight loss-of-control accidents were the most frequent cause of fatal airliner crashes and by far the deadliest in 2000-09. Of the 89 fatal accidents recorded in the period, 20 were attributed to inflight loss of control; 16 were caused by controlled flight into terrain.
Recent crashes linked to stalls include that of the Colgan Air Bombardier Q400 on approach to Buffalo, N.Y. (2009); Turkish Airlines Boeing 737-800 in short final for Amsterdam (2009); West Caribbean Airways MD-82 in Venezuela (2005); Thomsonfly Boeing 737-300 near Bournemouth, England (2007); and XL Airways Germany Airbus A320 off the coast of Perpignan, France (2009).
"Most approach-to-stall incidents and accidents occur with sufficient altitude available for the recovery," Boeing Senior Safety Pilot Mike Coker told delegates at the Flight Safety Foundation's European Aviation Safety Seminar in Istanbul this year. "Incidents progress to accidents when the crew fails to make a positive recovery after the stall warning occurs."
Flawed training is partly to blame, he asserts. Approach-to-stall training is typically conducted at simulated altitudes of 5,000-10,000 ft., but many stalls actually happen much higher. In the case of AF447, stalls occurred at 35,000 ft. and 38, 000 ft., respectively. That has important, negative implications, Coker concludes.
"Recovery stresses an increase to maximum thrust and recovery with minimal altitude loss," he says. Therefore, "students try to minimize the nose-down pitch change while engines spool up."
To make matters worse, engine margins at high altitude are much smaller than at lower flight levels, where pilots can count on a much greater response to power increases. Also, Coker says, "it is probable when pilots remain on a particular model for extended periods of time that their exposure to approach-to-stall indications and recovery occur as infrequently as once in a decade," when stall exercises should really be part of recurring training. He stresses that training should focus on correct procedures, reducing the angle of attack and appropriate energy awareness, and not so much on minimizing altitude loss.
Airbus and Boeing have worked together to devise new procedures for stall recovery that emphasize angle of attack rather than preserving altitude.
As far as AF447 crew coordination is concerned, there are at least two indications that there may have been problems. The pilot non-flying (PNF), a 37-year-old with 6,547 total hours and 4,479 hr. on type, tried several times to call back the captain, who was on an agreed break; at the time, the pilot flying (PF), the 32-year-old junior copilot with 2,936 flying hours and 807 hr. on type, continued to pull back his side-stick at Flight Level 380 with thrust set to takeoff/go around, the angle of attack increasing further and speed decreasing. The two pilots also made simultaneous control inputs (pitch up) at around 20,000 ft. and an estimated sink rate of more than 10,000 ft. per minute.
Air France's training and crew coordination standards will therefore likely be another target for recommendations; the airline already has undertaken an outside audit, conducted by Delta Air Lines representatives, of its safety procedures. In spite of the new evidence, the airline states that "the crew, made up of three skilled pilots, demonstrated a totally professional attitude and were committed to carrying out their task to the very end."
The sequence of events in the crash that killed all 228 people onboard the flight from Rio de Janeiro to Paris can be segmented into two distinct phases. In the first phase, the pilots were dealing with the failure of speed readings that are almost certain to be linked to iced-over pitot tubes. The second phase began when speed indications returned to normal and the aircraft was at the edge of its flight envelope but under control and not stalled. Phase two also coincided with the captain's return to the cockpit from an agreed-upon rest.
The initial chain of events was kicked off by erroneous speed readings at 2:10:05 (UTC), when both the primary flight display and integrated standby instrument system (ISIS) showed a sharp fall from 275 kt. to just 60 kt. The autopilot and auto-thrust disengaged and the flight management system switched to alternate law. The aircraft rolled to the right and the PF reacted by making a nose-up and left input. The stall warning sounded twice.
The nose-up inputs led the aircraft to climb fast, at a rate of up to 7,000 ft. per minute, but it almost leveled off at a slight climb of around 700 ft. per minute and Flight Level FL375. At 4 deg., the angle of attack was only slightly higher than in cruise flight (3 deg.). The return to normal of the primary speed indication after 40 sec., and after close to 1 min. on the ISIS, indicates the pitot tubes started to transmit valid data again and the icing issue appeared to have subsided.
At this stage, the event could have been over, with the aircraft still in alternate law and manual control but stabilized. There appears to be no technical, aerodynamic or meteorological reason that would have kept it from returning to its previously assigned altitude (FL350) by simply applying nose-down stick-forward control inputs.
But then things went terribly wrong. At 2:10:50, the PF continued to provide nose-up inputs, causing the trimmable horizontal stabilizer to go to 13 deg. nose-up from 3 deg. nose-up. The airspeed began decreasing, to 185 kt., and the angle of attack reached 16 deg.
Gerhard Huettig, a professor of aeronautics at the Berlin Technical University, says the change in the horizontal stabilizer position was due to a software malfunction that could have been neither recognized nor corrected by the pilots and was a key factor as to why they were unable to fly out of the subsequent stall. He consequently asserts that the entire A330 fleet should be grounded until the software is corrected. However, industry officials point out that the automatic trim only became active after the crew pulled back on the stick and that it worked as expected.
In this phase, the captain re-entered the cockpit. What role he played subsequently is not clear yet, because the full cockpit voice recorder content has not been published. According to one report, he immediately told his two copilots that they were in a stall and therefore should put the aircraft's nose down and reduce thrust. Others doubt that because there was hardly any nose-down control input in the remaining 3 min. of flight and from 38,000 ft. to sea level.
In fact, forward speed declined so much that even stall warnings stopped, in spite of the fact that the aircraft remained in a stalled situation for the remainder of its flight. That only happens when measured speeds are below 60 kt. and angle-of-attack values are considered invalid. When speed drops below 30 kt., that is also registered by the flight management system as invalid-and that is what seems to have occurred 30 sec. later, as the PF stated, "I don't have any more indications" and the PNF replied, "We have no valid indications." That second instrument failure is thus most likely due to the slow speed and not linked to pitot-tube icing.
Around 2.5 min. before impact, there was one short period in which the PF did the right thing by pushing the side-stick forward. The angle of attack decreased and speeds became valid again, with the stall warning returning and indicating an acceleration in horizontal speed. The stall warning may have caused the PF to pull back on the stick again, repeating his previous pattern; it was not corrected by either the PNF or the captain. "[The pilots] never made the inputs necessary to recover," says one official close to the investigation.
"We will learn a lot from this accident," says William R. Voss, president and CEO of the Flight Safety Foundation, who believes that AF447 should have fundamental consequences for the content of pilot training globally. "We are still training [for] the engine fire at V1, but the complexity of automated systems has grown. We have to develop crews that can deal with incidents such as QF32," the Qantas Airbus A380 that suffered an uncontained engine failure after takeoff in Singapore on Nov. 4, 2010, and returned to the airport severely damaged.
Voss argues that AF447 would not have crashed if the aircraft had been of an older generation. "Highly automated aircraft have saved many lives, but they fail differently than aircraft of 20 years ago," he says. He sees it as a "failure of the industry" that pilot training has not kept in step with the latest aircraft technologies. He also argues for improved upset recovery training, as "we are not explicitly training that" and the AF447 A330 "seems to have had pitch-and-roll authority all the way down to the water."
The focus on the pilots is not likely to have an immediate impact on the legal landscape. Steve Marks, an attorney with Miami-based Podhurst Orseck, who represents 41 families of AF447 victims, notes that investigative reports like this "tend to focus on pilot conduct," adding that "in this case, there is no doubt the pilot confusion is linked directly to the failure of the pitot tubes." Marks is bringing a case against the companies involved in the A330 navigation system. On June 3, a San Francisco judge was due to hear arguments on whether the case could be brought in the U.S., or if the liability claims must be made in French court. If it is the latter, plaintiffs would have to wait until the judicial inquiry in France is complete, which, as in the case of the Concorde crash, could take years.
The BEA report plays down two other issues that have been in the spotlight. One is speculation that the aircraft entered a severe storm; the BEA document suggests it was merely turbulence that is standard for that region. During a crew briefing 2 hr. into the flight, in which all three pilots participated, the PF said that "the little bit of turbulence that you just saw, . . . we should find the same ahead . . . . We're in the cloud layer. Unfortunately, we can't climb much for the moment because the temperature is falling more slowly than forecast." And 11 min. later, the PF told the captain that "in two minutes, we should enter an area where it'll move about a bit more than at the moment. You should watch out," adding that "I'll call you as soon as we're out of it." The PNF proposed 2 min. later that "you can maybe go a little to the left" and the aircraft turned left 12 deg. None of the actions suggest anything out of the ordinary.
The second speculation surrounded pitot-tube icing. Although the pitot probes appear to have iced over, the speed discrepancy between the primary flight display and ISIS lasted around 45 sec., not atypical for the phenomenon.
There remain some long-term questions related to the AF447 accident. Would better aural cues help focus pilot attention on recovering from a stall? One industry official doubts replacing the "stall" alert with a more specific instruction, such as "push stick," would make much of a difference. And should research be funded toward devising a better backup mechanism to pitot tubes or finding another way to determine true air space that is less susceptible to outside environmental factors? "It would be interesting to have another technology," the industry official says.
AF447's Final Minutes (May 31/June 1, 2009)
Time*
2:01:46 FL350
Mach 0.82
Pitch about 2.5 deg.
2:10:05 Autopilot, autothrust disengage
Pilot makes left nose-up input
Stall warning
Recorded speed drops from 275 kt. to 60 kt. (in primary flight display (PFD) and integrated standby instrument system)
2:10:16 Pitch attitude exceeds 10 deg.
Pilot makes nose-down control inputs
Vertical speed falls to 700 ft./min. from 7,000 ft./min.
Speed displayed on PDF increases to 215 kt.
FL375
Recorded angle of attack: 4 deg.
2:10:51 Stall warning
Thrust levers at takeoff/go-around
Pilot maintains nose-up input
Recorded angle of attack increases beyond 6 deg.
Trimmable horizontal stabilizer passes from 3 to 13 deg. nose-up
2:11:16 Speed on integrated standby instrument system increases to 185 kt.
Pilot continues nose-up inputs
FL380 reached
Pitch attitude and angle of attack: 16 deg.
2:11:40 Captain re-enters cockpit
FL350
Angle of attack exceeds 40 deg.
Vertical speed: descending 10,000 ft./min.
Engines' N1 shaft speed near 100%
Pilot makes nose-up inputs
2:12:02 Thrust levers at idle
Engines' N1 at 55%
2:12:17 Pilot makes nose-down inputs
Angle of attack decreased
Speed indications become valid
2:13:32 Angle of attack remains above 35 deg.
2:14:28 Vertical speed: descending 10,912 ft./min.
Ground speed: 107 kt.
Pitch attitude: 16.2 deg. nose-up
Roll angle: 5.3 deg. left
*all times UTC (June 1, 2009)
Source: BEA