Jet Crash Forum

One thing I think that is helpful in addressing this sort of case is the idea that theories at this point are not proven.  In short, any theory which reasonably fits the facts if viable at this point, though some  are markedly more likely than others.

At this point, my understanding is that around fifty bodies have been recovered, and are subject to autopsy.  The vertical stabilizer, the left inboard wing spoiler, and a variety of other pieces have been recovered, though at this point no public data seems to be available regarding analysis of these pieces.  The debris field is around 50 miles long.

The plane also sent out a number of automatic messages, most of which seem to be related to bad stagnation pressure measurements from the pitot tubes (interestingly the TCAS failure also cascades from this).

What we currently do not know is what sort of telemetry readings the FDR recorded, nor do we have the CVR (which would shed considerable light on crew decisions).  Also the first officer had more A330 experience than the captain, though the captain had more total flight experience than the FO.  All three pilots were certified for the A330, meaning that all would have been ranked "captain" on domestic flights.

Now, the initial question comes down to the group of ACARS messages from 0210Z.  Each of these messages is consistent with pitot tube malfunction.  These include cascading failures to the rudder travel limiter, the degradation to alternate law, the ADR disagree, and so forth.  According to maintenance engineers I have talked to, the Airbus manual states that the TCAS inop fault is triggered by the ADR disagree fault.  At this point air speed warnings are displayed to the AFD.  So at this point we can say with reasonable certainty that the pitot tubes were blocked.

I can see three possible causes for the pitot tube failures:
1)  Ice crystal ingestion.  Ice crystals can block pitot tubes even where there is no "icing" activity elsewhere.  This seems to be the most likely cause. (Moderate to high likelihood). For a parallel, see http://www.atmos.washington.edu/kwajex/ops-web/aircraft/19990902/discussion.html
2)  Lightning damage.  This would be unlikely for a couple of reasons.  Airplanes are typically engineered to tolerate lightening strikes.  Most lightning damage tends to be localized and minor (2mm hole in the hull, for example) around the entrance and exit points.  Similarly lightning causing damage to electronic systems would tend to follow a localized damage model.  To be a problem, the lightening would have to enter or exit next to the radome, and take out either the AIRU's A second reason that lightening is unlikely is that this type of storm is characterized by an unusual lack of lightening.  We can't rule it out, but it seems quite unlikely.  Likelihood: low to very low.
3) A small meteor strike cannot be ruled out.  However there the likelihood there is very very low.

As more data becomes available, we may be able to rule out the second two possibilities and assume ice ingestion is the certain cause of the problem.  At the moment, however, the other two possibilities are to be set aside as unlikely but not discarded.

A few unknowns here:
1)  What were the autothrottle outputs prior to disconnect?  How fast was the plane going airspeed-wise?
2)  What were the pilot decisions prior to 0210Z?
3)  What was the autothrust output from 0200Z through 0210Z?  What was the speed of the aircraft during that time?

A lack of airspeed data by itself is insufficient to down the airplane, but combined with other factors, it could be a major contributor.

The next minute is where things go from bad to disasterous.  The IR disagree error, according to some of my sources, only occurs AFTER the first inertial reference system is voted out.  Hence we have IR 2 voted out prior to the error, and then IR's 1 and 3 disagreeing, while we have cascading failures to ISIS units.  This means a loss of reliable attitude data.  The loss of both airspeed and attitude data in a cloud at night  may be an unrecoverable situation. and in fact the loss of attitude data is probably more of a serious problem than the loss of airspeed data (with airspeed out you can set thrust to known reasonable levels and have a fighting chance, with attitude data out you might not even know which way is up).  As far as I can tell from schematics, the IR1 is the pilot's IR, IR2 feeds to the copilot, and IR 3 feeds to the standby.  This error cascades to the flight vector warning on the Pilot Flight Display noted in another ACARS message.

IR systems are entirely closed systems and do not depend on airspeed input (they are basically gyroscopes and lasers).  They supply heading, pitch, and yaw information to the pilots and computer systems.

If IR2 was not functioning at 0210Z, why?  Was this a maintenance problem?
What caused the IR disagree message?  An impact with something?  Extreme turbulance?

I don't think the inertial reference systems are supposed to fail in this way, which suggests a systems failure on the airplane.  I think the IR failure is more serious than the air data failures.  Similarly, see http://www.scribd.com/doc/2486889/Aircraft-Accident-Report-AdamAir-PKKKW.  I have questions as to how well the pilots could have maintained flight in both this case and the Adam Air case in the absence of known good inertial reference data.

After this we have primary and secondary computer systems faults, followed by a compression system controller error suggesting that the differential pressure was changing rapidly.  This could be a rapid decompression or simply a rapid descent.

There are a number of questions open as to whether the plane disintegrated when it hit the water or whether it broke up in the air.  Here again, there are multiple theories.

The plane may have come apart in the air with the vertical stabilizer the first to separate.  This would explain the large debris field.  Or:

The plane may have made a less-than-high-speed landing on the water, but broke apart on impact.  The people may have been killed on impact.  The large debris field may be explainable by differences in current speed and direction between surface and deeper currents.  This should be answerable by careful analysis of the vertical stabilizer autopsies, etc.  During the Comet disasters, it was established that clothing could be removed by ocean waves, but that certain specific types of causes of death were associated with explosive decompression.  Here at least, we should have answers in the near future.

It is quite possible that in the absence of airspeed and inertial reference data, the plane simply was the victim of a jet upset.  The questions of "why" and "what can be done differently" will take more time to discover.

Some thoughts:



News bulletin:  just saw a report that the injuries found are consistent with mid-air breakup of the plane.  So one of the open questions is perhaps answered.



Apparently, it is also possible that an updraft in the storm could have brought warm, moist air up to the aircraft, the exposed parts of which would have been very very cold by this time.  Although this air would still be well below freezing, it could contain supercooled liquid droplets, rather than ice crystals.  Generally, icing is not considered a hazard at cruise altitude, but it (reportedly) could occur under such a scenario.  I don't know how probable this might be.

But I think that both mechanisms of pitot obstruction are worth considering.  With either mechanism, the pitot tubes are sufficiently similar, that if one became obstructed, then the other two would likely also become obstructed in a fairly short time interval.



I wonder about this... airline pilots please weigh in!  Reportedly, it has been estimated that in the cruise condition of AF447, it was necessary to control airspeed within a margin of +/- 5% (or perhaps, even more precisely than that).  Going outside of this narrow margin, controllability of the aircraft would have been progressively impaired by either the onset of stall, or Mach effects.  Unfortunately, the onset of stall and the effects of overspeed may be very difficult to distinguish, so even feeling something wrong and understanding that it was perhaps due to incorrect airspeed, the pilots may have been unable to answer, is the airspeed too high, or too low?

On another thread of this forum, I have wondered out loud about the available "escape" options when airspeed indication is suddenly lost on top of big storm.  It seems possible to me that there was no course of action the crew could have taken, that would not involve high probability of catastrophe.

And although in theory this should not have prevented the pilots from controlling the aircraft, it seems quite likely that pitot blockage would have set of stall warnings regardless of the actual airspeed.  The pilots being human, the occurrence of (loud and persistent) stall warnings might have made it that much more difficult to consider the possibility that buffeting could be due to EXCESSIVE airspeed, rather than INSUFFICIENT airspeed.

I think that at the least, loss of airspeed indication from cruise would result in an acutely dangerous situation, requiring very quick and precise reaction to maintain control over the situation.  And I suspect that while the pilots were trying to understand what had gone wrong with their aircraft, and which indications could be trusted or not trusted, it would not take very many seconds to fly into a gross upset.

I would love to hear from an jet airline pilot, what is the training for how to handle complete loss of airspeed data when at altitude?



It would interesting if someone who knows the systems could address this - if an A330 with intact hull were in a dive, would this be expected to trigger the cabin vertical airspeed alarm?  Perhaps with hull intact, the pressure could not change rapidly enough to trigger the ACARS message, in which case rapid decompression would be the only likely explanation.

On another forum, I read that in order for ACARS messages to get through, the plane must be in a fairly normal orientation (haven't checked on this).  If this is true, the cabin pressure incident would likely have occurred before any gross upset.  (It is not known whether AF447 experienced a gross upset, or was in relatively controlled flight up to the moment of major mid-air breakup, or impact.  So I speak of upset here as something that quite likely happened, but not as fact.)

I'd like to add a "branch" in the possible scenarios:  if indeed the vertical stabilizer separated before impact with the ocean, as presently seems likely, then probably this separation was either (A) the result of excessive aerodynamic forces during a gross upset, or (B) was due to an excessive rudder deflection, and then caused a gross upset.

If the cabin vertical airspeed message was due to a hull rupture, and the airplane was indeed in a fairly normal orientation, this might be consistent with stabilizer failure due to excessive rudder deflection.

I don't think a normal orientation is required to send the ACARS messages.  What is an issue is if there is a rapid change in orientation as this blocks electronic steering of the antenna (according to the discussion on the pprune.org forum).  In short, what we can say is that the aircraft was probably not in a spin at the time of the transmissions.  This discussion came about because it suggests (though does not prove) that the airplane was still flying with a vertical stabilizer at the time of the transmissions.  There might be some attitudes which might preclude transmission too, depending on antenna placement.

However the IR failure is far more serious than the air speed data issue.  THe basic issue is that with no airspeed data, you can still set the throttle to a reasonably safe setting for altitude.  With no attitude data, in a cloud, at night, you have no solid way of ensuring that the aircraft isn't entering a dangerous bank angle.  Loss of this data can thus also cause an upset and, unlike airspeed data, there is no way to even try to compensate.  This was a major factor in the Adam Air crash near Sulawesi in 2007.

Also, I would add that we can probably rule out a high-speed impact with the water, though I am not sure we can rule out a lower-speed impact with the water (perhaps caused by an attempted ditching gone awry).

This suggests the most likely cause is a jet upset and in-flight breakup, but other possibilities still exist.

Reading the article posted in the New York Times, http://www.nytimes.com/2009/06/13/world/13plane.html , titled "Error Messages From Air France Jet Offer Details but Little Insight," out of all the messages that are reported from the ACARS, the first message is the one that seems the most odd. It is a message "regarding a problem in one of the lavatories followed by another message an hour and 47 minutes later, indicating that the autopilot has switched itself off, an event that can be caused by a variety of problems." The lavatory message peeked my curiosity because I remember some time ago there being a report on lavatory safety issues, including fires, cabin pressure breech, and icing from leaking lavatory container units. One article was about a flight attendant that purposefully started a fire in a lavatory. Here is a link to that article: http://cabincrewblog.com/2008/05/flight ... re-to.html . Here is a link to another incident involving the motor that regulates the lavatory disposal: http://aviation-safety.net/database/rec ... 19830602-1 . Another link shows passenger related safety hazards: http://asrs.arc.nasa.gov/publications/d ... l9_pax.htm . All these things make me wonder. What if that first message relating to the lavatory, was actually the most important message? Maybe some sort of fire, or fried wiring, or other electrical failure that lead to the demise of AF 447. Unfortunately, the ACARS messages aren't detailed as to the specifics of the lavatory problem. Maybe someone out there has a more detailed report. Are these lavatory problem messages common?

Another interesting read regarding Airbus 300 for flight AA 1291 where lavatory signals and loss of cabin pressure were a result of faulty gauges, similar to messages on flight AF 447. http://www.ntsb.gov/Recs/letters/2002/A02_26_32.pdf

Ummm....

The lavotory messages are those of the vacuum system controller, not the lavotory fire alarms.  And they are apparently quite common on A330 flights.

So barring additional information linking them, I am inclined to set them aside for now.

What are vacuum systems controllers and why would a problem message be set aside? As in Air Canada Flight 797 ( http://aviation-safety.net/database/rec ... 19830602-1 ), the pilot when responding to a lavatory 3 lavatory circuit breakers tripping, reset the breakers and "The captain assumed that the flush motor had probably seized and took no further action at this time."  Of course, 20 minutes later, they had an all-out fire on their hands. Is it possible that these vacuum systems controllers had something to do with the rest of the events that unfolded?

The reason that they are not being looked at closely is that the errors are very common on A330's.

The Vaccum System Controller is ambeded computer unit which controls the vacuum system in the lavotories.  For example, when a toilet is flushed, they activate out valves to create vaccuum pressure.  I don't think they directly impact the motors.

Einhverfr,

Your post was very helpful and informative. Even a person like me who is not from the airline industry could grasp and understand it.

I still find it odd that the first ACARS message would start with a warning about a problem in the lavatories, which as you state could be a regular problem with the vacuum control systems and not too important, but to me, the irrelevant is usually the most relevant. The reason is because there are no more messages, then the next message is an hour and 47 minutes later indicating that the autopilot has switched itself off, followed by a message that reports it has lost a computer protection that overrides any commands from the cockpit that would threaten the flight’s stability. The Airbus has a computer that accepts commands to change various settings and transmits them to the rudder, flaps, ailerons and other parts, but only if such commands do not threaten stability. But the computer switched to a mode in which the protections either disappeared or could be overridden. Experts said that could happen if turbulence was so severe that the plane was thrown into an unusual attitude, but it might also be caused by the breakdown in the speed-sensing system. The messages also indicate that warning flags appeared on the displays of the captain and the first officer indicating a problem with the speed sensing. Jets sense their speed with a system that includes a part called a Pitot tube, an open-ended, forward-facing tube. Pressure in the tube varies with speed and is compared with the pressure in an opening facing the side of the plane. The next message indicates a problem with the rudder travel limiter, a system that prevents the pilot from turning the rudder too hard when the plane is flying fast. Followed by a later message indicates a disagreement among navigation devices that receive information from the speed-sensing system. Then a flight management computer, which keeps track of the required course and altitude, shows a fault. The last transmission shows that air pressure in the cabin was dropping rapidly.
Doesn't it seem like the first lavatory warning message could be the start of something catastrophic. What if there was a leak in the vacuum control systems, as reported on other flights ( http://asiaspirit.com/lavatory.htm and http://en.wikipedia.org/wiki/Blue_ice_(aircraft) ) which formed into a massive block of blue ice on the side of the plane? If the plane's speed-sensing systems are also located on the side, ice formation would not only disrupt the device, but would also cause a heavy pitch to one side, forcing the auto pilot to shut off, then the ice could break off and damage the rudder, which would not only send the computer into a frenzy, but would also render the plane non-navigational. Could blue ice build-up on the side of the plane from a leaking vacuum control system therefore causing speed sensors to fail, or the ice to build-up on the tail rudder, or the ice to break-off and cause structural damage to the plane? It makes me think of a murder mystery, where the perfect murder weapon turns out to be made from ice. Once it melts, there is no proof. 

Well, what I said is barring a newly discovered link, the fact that the messages are common make them unlikely to be of particular importance.  However, until we have a better picture we cannot say that they are certainly unimportant.

However, could a problem with the VSC been related to water content around avionic systems (causing short circuits, electronic damage, etc)?  Could these have been something that affected the ADIRU's as well?  Maybe a water leak shorted out one system at a time?  Could this have been a reason for the IR Disagree error at 0211Z, the prim/sec faults at 2013, and the ADR Disagree faults at 2010?

These are all possibilities.  However, at this point those don't look particularly likely.  As more information comes to light, though, that might change.  Certainly if more evidence were to surface of actual electrical problems, those messages would seem to my mind to be a lot more important.

This is one reason why even routine data cannot be disregarded early in the investigation.  One can set it aside as unlikely to be relevant.  However, one should not toss it out.

Hope this helps.

Dear mars,

I think you've gotten a bit carried away with the toilet hypothesis!

Absolutely, an official accident investigation will consider all available information, including the ACARS lavatory message.

It's not clear to me that "blue ice" would be connected with the fault reported in the ACARS message (I think blue ice problems have been due to simple plumbing problems), but even if it were...



The airspeed sensors (pitot tubes and static ports) are located toward the front of the aircraft, quite near the cockpit, and are well forward of any lavatory.



It's very unlikely that a "blue ice" build up would weigh more than an average passenger.  Its effect on the moments of a big airliner would be very small indeed.



Liquid leaking from a lavatory valve, and ice separating from the skin, will tend to move very nearly straight aft, being under the pressure of tornado-strength "winds" resulting from the jet's speed.  It seems quite improbable that "blue ice" would reach the vertical stabilizer or rudder.



The cases I recall where aircraft have had blue ice problems all involved jets with engines at the rear, in which a piece of ice breaking off was in line with an engine inlet, and the engine was severely damaged by ingesting the solid material.  Not relevant to the A330.  Even if a piece HAD formed on AF447, and then blew back and hit the horizontal stabilizer (which is in about the right place), these structures are made pretty strong (they have to be, to pass bird strike testing), and an airliner should be controllable even with some nasty-looking damage to the horizontal stabilizer.

I guess it's that last one that has me skeptical. "Even if a piece HAD formed on AF447, and then blew back and hit the horizontal stabilizer (which is in about the right place), these structures are made pretty strong (they have to be, to pass bird strike testing), and an airliner should be controllable even with some nasty-looking damage to the horizontal stabilizer." The problem is that they were flying through a very nasty storm as Tim Vasquez's original data shows, multiple CB's in the path of AF 447. So imagine, almost 2 hours worth of blue ice build-up, which is more common than pitot tubes malfunctioning, all of the sudden the Airbus hits mid to heavy turbulance with updrafts of up to 100mphs, this block of blue ice could cause way more serious damage at 35,000 feet, at 500 mph, than a bird strike at lower altitudes and lower speeds. Of course, bird strikes do bring planes down as well, but bird strikes leave some sort of evidence. Ice does not. I merely suggest that the industry is jumping to the conclusion that the pitot tubes are to blame, when pitot tubes have never brought down aircraft. On the other hand, blue ice from a leaking lavatories have on many occasions. If you ask me, you shouldn't go hunting for wolves when your sheep are dying from old age.

Mars:

Early versions of Tim's analysis were easily misread:  updraft speeds had a THEORETICAL maximum of 100mph.  He further stated that precipitation loading and other factors would have reduced this by AT LEAST 50%.  This means that updraft speeds could not have realistically been higher than 50mph and were probably lower.

Unfortunately the media misreported it.

Interestingly enough though, all we can do is theorize at this point. And the point of my blue ice question was, could it happen? and why would the industry jump to the conclusion that the pitot tubes are to blame when for years blue ice has posed more of problem?
Yes, properly functioning pitot tubes are important for obvious reasons, but its the smaller things that go unchecked that make me question the sincerity of the FAA. It's the old, "Let's not bother putting a stop sign in that intersection until traffic fatalities prove otherwise." It's this basic erroneous human reasoning that has led to so many unnecessary deaths and will continue to do so until people fix known design and safety problems before catastrophic events occur.
I don't think I've gone that carried away with a simple question. I guess most don't see a link between the messages, but I dare theorize that there is a link. Where there's smoke, there's fire. So, why was there an ACARS message stating a problem with the lavatory? And then an hour and 47 minutes later all hell breaks loose for no apparent reason? Like we stated before, there were 11 other flights that went through the same storm, there are thousands of other A330's up in the air with no catastrophic systems failure due to pitot tubes or computer glitches, yet there are more than 3 very serious damage reports from the NTSB stating engines falling off in flight due to blue ice impact. As stated, the A330's engine are not in the line of path to blue ice, but if blue ice can knock an engine off, couldn't it also cause serious if not fatal damage to the rudder?
And more to the point, if blue ice has caused serious damage to aircraft in the past, either engine or body damage, why isn't everyone scrambling to fix that problem first? Is it because fatality rate hasn't exceeded minimum cost repair expenditure? Whatever the reason, I still feel uneasy that a relatively "unimportant" ACARS message about a "routine" and "common" problem with a known "dangerous" occurrence could be so easily disregarded and made irrelevant.