Jet Crash Forum

Caveat: While I don't fly jets - let alone the Airbus 330, I do fly just about everything else, including sailplanes which is the most natural form of flying. The comments that follow are simply from a layman who is interested in learning about the recent events over the Atlantic and how to prevent accidents like this one again...

The Airbus 330 is a commercial aircraft designed with FBW (fly-by-wire) technology in order to ameliorate its performances in maneuverability both in the temporal and frequency domains. Nevertheless, the achilles heel of these systems at this time is that the flexible dynamics of these airplanes have been mostly ignored when the software systems that control them were written. A phenomenon known as "spillover" is a common in these rigid algorithms. By spillover, it is meant that commands between the current software and flexible systems (Airbus 330) there is always a tendency to overshoot or spillover when movements occur that were not expected.

Most articles in these forums point to the initial cascade of events as the Airbus flying into the storm system. Air in the cumulus nimbus was sucked up with humidity to the altitude that the airbus was flying at, and the pitot tubes AS WELL as other structures took a hit, including I am sure the wings and the horizontal stabilizer. (I keep reading pitot-tube, but no mention of ice elsewhere, and this is critical too!)

The next sequence of events is that the flight computers begin to detect differences in airspeed from the different pitot tubes, all placed in different parts of the airplane. They likely detect that the plane is in fact flying slower (clogged/iced pitot = lower pressure = lower airspeed) and they drop the nose (maybe increase power? to maintain altitude?). The pilots are several hours into the flight, have just had a meal, and don't notice anything abnormal except for the bumps as they enter the storm system. Perhaps they pull the power back, and the autopilot generously responds with more pitch down attitude?

I have tried hard to find at what speed an Airbus 330, will flutter, and although numbers are inexact, it would seem to be no greater than 10-15% of their cruising speed. Watch this video from YouTube if you want to see how a glider flutters: http://www.youtube.com/watch?v=kQI3AWpTWhM It will also give you a visual on how the Airbus probably shaked, not only due to turbulence but also to overspeeding.

So in fact, I believe this is what doomed the airplane - flutter. This would explain the failure of multiple systems, autopilot disengage, and ultimate breakup.

I have personally had the autopilot get me into trouble with regards to airspeed. Since I was in the loop, I checked my GPS speed which I always correlate with my airspeed taking known winds into account - (there probably was little wind where AF447 was since there is no jetstream there)) and I was able to quickly do what Airbus Industries is telling the pilots to do these days - if in doubt - fly it like a glider - that is, choose an attitude that they know is a safe one (for instance - drop the nose some 5 degrees) and in their case, an adequate and safe power setting (meaning - not too much, not too little...)

Is the pitot tube the scapegoat in this story? Certainly! Next, the pilots will probably be indicted, as well as AF airline procedures. Why a 200 million dollar airplane has technology, software, etc. that controls its airspeed with a device designed around the year 1700 (Monsieur Pitot...) is beyond me. Modern commercial flight is all about making lighter airplanes with more flexible materials, so that they can fly farther, and with more passengers. The safety envelope has probably decreased with these aircraft, since the FBW engineering behind them has not caught up with the complexities of flexible structures. Think of the algorithms after thousands of years in the brain of a hawk or eagle as its flexible wings encounter the different air that they fly in.

Think of what I suspect are the current FBW algorithms in case of decreasing airspeed at a set altitude:
If
  AirspeedFromPitot1 AND AirspeedFromPitot2 AND AirspeedFromPitot3 are decreasing    '(algorithm for this)
  CrossCheckOtherReadings()      'If they keep blaming the pitots, and saying a new pitot will fix the problem I doubt there is any code here...
Then
  DropNose(x degrees) (algorithm for this) AND IncreasePower(x percent) '(algorithm for this)
Else If
   AirspeedFromPitot1 AND AirspeedFromPitot2 AND AirspeedFromPitot3 ARE NOT EQUAL ' (algorithm for what = means)
Then
   DisconnectAutoPilot()
   AlarmtoPilots()
End If

I am sure I am oversimplyfying, but from the results, I doubt it is much more complex than this. In my case, when I got into trouble with my autopilot and airspeed, the algorithms included scanning all my instruments (Instrument rating 101) noticing that my GPS was reading higher than previously - looking at my mechanical artificial horizon, looking out the window, looking at my EGT's, feeling for flutter or buffetting on the stick - etc. You get the picture - fly it like a sailplane...

I am not one bit a purist with regards to flying - that is, FBW is the future of aviation and am sure it has done much to prevent accidents and make aviation safer. It has also knocked down a few Airbuses, but my point is that its software seems to be coming from Redmond! It's just not there yet. Furthermore, I doubt Airbus (correct me if I am wrong anybody) makes public these algorithms to the pilots. I certainly did not find them. What IS public is how to fly the airplane when they fail...

From what I see, we are going to be seeing many more airline pilots at our gliding club in the near future! "Sully" clearly applied these skills (which Airbus is now promoting), and the outcome was very different.

Actually, pitot tubes are a nice, elegant solution to the problem.  Just some more information about how exactly they work.

If you have a fluid (gas or liquid) stream, and you want to measure the speed of the stream.  The first, simple approach is to put a tube into the stream and measure the pressure that the stream places on a sensor on your side of the tube.  If you know other things about the stream, you can then calculate its speed.

In an aircraft, however, you have additional problems.  The relative pressure change with both speed and altitude, so you can't just rely on the pitot tube itself.  Hence what one needs is a "static pressure source" so that one can measure the difference between what is being measured in the pitot tube and the static source.  From here, you can measure dynamic pressure which is the key to understanding airspeed.  My understanding (I don't work on A330's or any other planes for that matter) is that the A330 has three pitot tubes, and three separate static pressure sources (basically a hole in the fusilage with a pressure sensor).  Pitot tubes 1 and 2 are located close together on one side of the radome (located in the nose of the aircraft), while pitot tube 3 is on the other.

BTW, fighter jets often place the static pressure sources on the sides of the pitot tubes.  I don't know whether this poses more of a risk of icing or not.

Now, pitot tubes are not infallible.  If they are clogged, they can give inaccurate readings.  Wasps nets, mud, etc have all brought down airliners by clogging these tubes, as have icing and even ice crystals/grapnel getting lodged inside the tubes.  This is why I think the time between 0200Z and 0210Z is critical regarding this accident (and I agree generally with your outline as a best guess at the moment).

However, one other thing...  Theoretically (and I am not aware of any actual examples of this happening), a lightning strike  which might directly enter or exit on the tubes might blow them out.  Even a small hole in the side of a tube could reduce the pressure it senses.  However. this would seem like an unlikely event in my view, so icing seems more probable.

An article pointing to the same conclusions - it's not the pitot - it's the software... And glider training is once again recommended!

http://www.informationweek.com/blog/main/archives/2009/06/did_computer_fa.html;jsessionid=R4M2DAWOG3QIGQSNDLOSKHSCJUNN2JVN

This is becoming a stunning exercise in scientific thinking: there are multiple hypotheses, each with its own strengths and weaknesses, and we will get to discuss and debate the merits of each as we continue to find further factual evidence.  The most important aspect of that is that everyone maintain the ability and readiness to alter the current interpretation as new facts come to light.
For example, when I first read that icing on the pitot tubes was suspected, I was very skeptical because at 30,000 ft the temp is usually too cold for liquid water to be present, and so structural ice does not form.  But in reading the comments on Tim Vasquez's WeatherGraphics page, I was reminded that 'supercooled' droplets might be present in temps as low as -45 C
So icing on the pitot might be possible.
Pitot tubes are an elegant and reliable means of providing airspeed information, without need for electronics or a power supply; they are usually quite dependable - especially in fair weather.
Fly-by-wire is an elegant and sophisticated means of manipulating the control surfaces of an aircraft, allowing the use of less inherently stable airframes - even inherently unstable ones.  When it is working, FBW is fine stuff; but when it goes away, someone had better be paying close attention!
Further uncertainty surrounds the flight path, the crew's decisions (or lack thereof), and Airbus operating procedures.

I suggest that as the possibilities abound, so do the explanations; as facts begin to thin down those possibilities, we may get a glimmer of the truth of the situation.

"stand by..."

What I'm coming away with about this "icing at cruise" reports (where is not supposed to be a danger) is that it's not "on" these instruments it's somewhat "in" them. Where the mechanics of trying to heat and keep ice from glogging them up is giving it an environment to mess them up. And it was so rare they had to document the problem before they could go about solving it without other unexplored consequences.

So, I don't know, does that provide an answer to why Airbus wants to run around replacing this vital instrument with a different design?

Cynthia,

Agreed. Whatever the final cause of the accident, Airbus has avowed, by going ahead and changing the pitots, that there is a problem with them.

But the airplane is controlled by its "brain" (flight computers) like your body is controlled by what is inside your skull. If for instance, your right index finger begins to tell you that it is getting fried on a skillet, a reflex mechanism immediately pulls it away, and your brain then reassesses what went on. In the case of the Airbus, the flight computers asked the plane to "further press on the skillet", when its "fingers"  where in the vicinity of it, even though they were receiving conflicting data from other fingers (sensors) as to where they were.

I have seen the tail section of the plane being pulled out of the water in pictures, and it appears to have ripped off in mid-air,  this once again pointing to flutter induced breakup.  Flutter came from pressing too hard on the skillet...

So yes, the pitots have design issues, but it would seem that so does the software that runs the entire plane. We are entering a Darwinian scenario here. Airbus wants to replace the "fingers" as a way to evolve their plane into a safer one. Mother nature may end up telling us that the real problem is in the "brain" that cannot properly parse data from its external organs.

Thank you for using the correct term here. 
Too many people are using the word 'theory' which is incorrect in this thread (and similar threads, and the media) from a scientific/engineering viewpoint.

People, pitot icing, or for that matter, any kind of icing, does not occur where significant humidity is not present, regardless of the temperature.
Cb´s at 35000...maybe. That a pilot would fly straight into it.... not.
That pitots could clogg at any altitude...maybe...one never knows... I thought not, now I´m in doubt, but that this faliure would bring down the plane....not.
That all sensors went kaput.... not an excuse, still got thrust and attitude. These are experienced pilots guys that went down.
Something happened there that these guys lost everything, horizons, speed, altitude.....
No freezing will do that.
Cheers.

Pablito1978, the more experienced you are the more chances you take. The longer I didn't get hit by a car the faster I took my bicycle on the Chicago streets in rush hour. All it was going to take was one opening car door and I'd be in a world of hurt. And in six years of riding around and a number of near misses in daytime I eventually did get smacked by one at night. There's a post somewhere from a pilot instructor that struck me as true. There's distinct experience levels of pilot experience where a pilot feels invincible. And then they get snapped out of it. And 11,000 hours was one section of time he pointed out as one of those phases.

LeoM, I'm just wondering, if the auto pilot hung on trying to overcome a condition it can't perceive, the icing and bad data coming to it, by (and I don't know if it works like this) inching up the speed, when does it finally meet conditions where it would disconnect and admit the data is wacky? Is it only when instrument readings differ between two of them or is there other criteria? We talk about the pitot sensors but there are a second system of ports. And these should have entered the equations somewhere. I hate to think the a/p applied power thinking it was slow and then dumped the issue in the pilot's lap with a plane already over the 0.82 Mach. But maybe it has better programming than that.

Greetings, All:

    I'm guessing that one advantage for a sailplane with an unreliable airspeed indication, is that it would be possible for the pilot to maintain control over a rather broad airspeed range.

    My (no doubt grossly oversimplified) understanding about airliners, is that jet engines are more efficient at increasing altitude, so economics pushes to fly high.  But with increasing altitude, stall speed goes up, due to decreasing density; and the airspeed corresponding to MMO (limiting Mach number) goes down, due to decreasing temperature.
    At some altitude, the Mach buffeting speed would equal the stall buffeting speed, and of course level flight could not be maintained at any higher altitude.  [Mach buffet occurs because the speed of airflow over some parts of the aircraft is considerably in excess of airspeed; wherever Mach 1 is attained, a shock wave appears, violently disrupting airflow.]

    In practice, jets cruise fairly close to this limit.  If you can believe this story:

http://trueslant.com/milesobrien/2009/06/08/the-coffin-corner-and-a-mesoscale-maw/

then AF447 was flying inside a "window" only 25 knots wide (I presume between a safe stall margin and the operating Mach limit).  In yachting jargon, this would be sailing mighty close to the wind!  If this is true, an airspeed deviation of about 5% either way would have been a problem, and the prospects for maintaining controlled flight with a faulty airspeed indication were poor indeed.  Once buffeting began, how would the flight crew know whether it was due to overspeed, or stall?  And in the midst of a nasty storm, could the pilots distinguish the onset of buffeting from turbulence?

    As a strictly "armchair" pilot, I wonder, what would have happened had the crew maintained the throttles at their previous cruise setting, and flown by whatever they use nowadays for ADI, keeping the wings level and the pitch attitude at its average before Autopilot disconnect.  Perhaps in smooth, calm air, this could have kept them going until the Pitot tubes cleared.
    But would this have been a viable option, in the midst of possibly violent vertical drafts from the storm?  And by the time the automatic systems shut off, and the pilots were working to understand what was happening with their aircraft, how many seconds was that ship from a gross upset?

    Maybe AF447 was in a condition no amount of stick-and-rudder skill could manage.


@LeoM,

    Interpreting the apparent mid-air separation of the vertical stabilizer as evidence of flutter is reasonable, but perhaps this evidence isn't so clear.
    There have been several cases of airliners significantly exceeding airspeed limits (and often surviving).  And though they always have pieces broken off (including possibly sections of rudder), I don't recall a case where the main structure of the vertical stabilizer separated (but anyone, please correct me if you know any examples).
    Given the ACARS messages, in particular that the flight control system had gone to alternate law, and the "rudder travel limiter" fault message, perhaps the flight control system was no longer protecting the structure against large rudder inputs.  Certainly, there are documented cases of vertical stabilizer failure due to excessive rudder operation, including a non-FBW A300 in 2001.
    So in addition to the flutter hypothesis, I suggest that the vertical stabilizer might have failed in response to excessive rudder deflection, while the crew was struggling to control an aircraft that had left stable flight.

Great post AvBuff - I agree with all your observations.

Look again at the video of the sailplane fluttering, and look at the tail. It seems to be shaking just as badly as the wings! Do sailplanes fly at altitudes and speeds that will place them in the coffin corner? You betcha, and this is a problem when flying wave, when we can climb to the Airbus' 35,000 feet with ease on a good day. So the scenario is no different than what the Airbus experienced and we have to be just as careful.

But yes, excessive rudder in an effort to compensate for a plane out of control could possibly give us the same results.

So if we agree on the scenario that led to the accident (flutter or stall near the coffin corner) it would seem that ANY airliner needs to quickly pull back on its power anytime it enters bad weather or turbulence, and lower its nose slightly. Otherwise, pitots functioning or not, this type of accident is bound to happen again.

I think I now the answer, but can Airbus pilots inform us on the following: Does the flight computer detect turbulence and depending on what it is sensing (mild, moderate, or severe) will it slow down the airplane or do anything else? Or is all this supposed to be done by the pilots... In other words, does the autopilot make "intelligent" decisions, or is it really only keeping the airplane straight and level with a given heading and monitoring its many inputs redundantly?

@LeoM,

    I didn't know that sailplanes hang out in the "coffin corner" - thanks for educating me on this!

    I had thought about the possibility of the A330 losing altitude, as a way of widening the safe airspeed band.

    But normally a descent would be managed by decreasing thrust and flying a target airspeed (maintaining the cruise IAS would probably do).  Once the PFDs were warning that the airspeed indication was unreliable, I suppose the maneuver might have been manageable using the vertical airspeed indicator, if you were prepared in advance to know what combination of thrust setting and vertical airspeed should correspond to the desired forward airspeed.  If the flight crew didn't have these numbers prepared, they probably had precious little time to look them up, or compute them.  And the transition as thrust is decreased and the nose brought down must be made carefully, lest they bust out of their tiny safe airspeed range at FL350.
    Of course, in their environment, the VSI might have been fluctuating pretty wildly, in which case using it to manage descent could have been a really tough option.

    A perhaps more serious problem is that they seem to have been on top of what what to my eyes (as an ignoramus about meteorology) was a powerful thunderhead.  In this situation, what would the cockpit crew have thought about descending deeper into the maelstrom?  If their ship was icing at FL350, what could they expect as they went lower?

    I fear that their coffin corner perhaps had a bottom nailed to it, that left no escape.

Well, the problem is that as the air over the wings goes transsonic, the wing loses lift in that section.  Since this starts on the root (where the lift aspect is greatest) and moves back, the center of pressure moves back until the plane nose dives.  That doesn't disregard flutter, but it isn't the same thing on a jumbo jet as on a sail plane :-).

Of interest here is the open question of whether the IR disagree and flight vector PFD warnings here suggested that attitude reference had also been lost.  Quite frankly, with lost attitude and airspeed reference in the middle of a cloud at night, I can't imagine possible recovery.

If the comments that follow are simply from a layman, it should be takes a right direction that the problem can make a easy solution.Thanks


________________
education software

This from an unknown source...


Well, I'm sure you have all heard of the Air France accident. I fly the same plane, the A330.

Yesterday while coming up from Hong Kong to Tokyo, a 1700nm 4hr. flight, we experienced the same problems Air France had while flying thru bad weather. I have a link to the failures that occurred on AF 447. My list is almost the same.

http://www.eurocockpit.com/images/acars447.php

The problem I suspect is the pitot tubes ice over and you loose your airspeed indication along with the auto pilot, auto throttles and rudder limit protection. The rudder limit protection keeps you from over stressing the rudder at high speed.

Synopsis; Tuesday 23, 2009 10am enroute HKG to NRT. Entering Nara Japan airspace.

FL390 mostly clear with occasional isolated areas of rain, clouds tops about FL410. Outside air temperature was -50C TAT -21C (your not supposed to get liquid water at these temps). We did.

As we were following other aircraft along our route. We approached a large area of rain below us. Tilting the weather radar down we could see the heavy rain below, displayed in red. At our altitude the radar indicated green or light precipitation, most likely ice crystals we thought.

Entering the cloud tops we experienced just light to moderate turbulence. (The winds were around 30kts at altitude.) After about 15 sec. we encountered moderate rain. We thought it odd to have rain streaming up the windshield at this altitude and the sound of the plane getting pelted like an aluminum garage door. It got very warm and humid in the cockpit all of a sudden. Five seconds later the Captains, First Officers, and standby airspeed indicators rolled back to 60kts. The auto pilot and auto throttles disengaged. The Master Warning and Master Caution flashed, and the sounds of chirps and clicks letting us know these things were happening. Jerry Staab, the Capt. hand flew the plane on the shortest vector out of the rain. The airspeed indicators briefly came back but failed again. The failure lasted for THREE minutes. We flew the recommended 83%N1 power setting. When the airspeed indicators came back. we were within 5 knots of our desired speed. Everything returned to normal except for the computerlogic controlling the plane. (We were in alternate law for the rest of the flight.)

We had good conditions for the failure; daylight, we were rested, relatively small area, and light turbulence. I think it could have been much worse. Jerry did a great job fly and staying cool. We did our procedures called dispatch and maintenance on the SAT COM and landed in Narita. That's it.