by Palmer, Bill
Airbus said that there was no solution that could totally eliminate the risk of probe icing, that the three types of probes installed on the Airbus satisfy criteria that are much higher than the regulatory requirements for certification in relation to icing, and provided a reminder of the procedure to be applied in the event of an erroneous airspeed event.
On November 24, 2008 the issue of inconsistent airspeed indications was raised during a meeting between the technical divisions of Air France and Airbus. Air France requested an analysis of the root cause and a technical solution to resolve the issue. Air France suggested that BF Goodrich probes should be fitted, due to an appearance of greater reliability over the Thales models. Airbus confirmed its analysis and agreed to check the option of replacing the Thales probes with BF Goodrich probes.
Meanwhile, other airlines were also experiencing loss of airspeed events. It was not known what caused these events. The leading theories centered around water ingestion that was tossed around inside the pitot by the turbulence that seemed to be a common factor with each event. Many of the airspeed transients were quite short, such that in some cases the crew did not even see what caused the autopilot to disconnect. Others lasted longer (one to three minutes) with flight control law degradation effects, but loss of control had not been a problem. Looking at the flight data from some of these incidents, the loss of airspeed was so sudden that it looked like it could easily be an electronic problem.
At the end of March 2009 (about two months before the accident), Air France experienced two additional events involving the temporary loss of airspeed indication, including their first one on an A330.
On April 3, 2009, in light of these two new cases, Air France once again asked Airbus during a technical meeting to find a definitive solution. On April 15, Airbus informed Air France of the results of a study conducted by Thales. Airbus stated that the icing phenomenon involving ice crystals was a new phenomenon that was not considered in the development of the Thales BA probe, but that probe still appeared to offer significantly better performance in relation to unreliable airspeed indications at high altitude. Airbus offered Air France an “in-service evaluation” of the BA standard to check the behavior of the probe under actual conditions.
Air France decided to extend this measure immediately to its entire A330/A340 long-haul fleet, and to replace all the airspeed probes. On April 27, 2009 (32 days before the accident) an internal technical document was drawn up to introduce these changes . The modification work on the aircraft was scheduled to begin as soon as the parts were received.
The first batch of Thales BA probes arrived at Air France on May 26th, 2009, six days before flight 447 crashed. The first aircraft was modified two days before the accident. At the time of the accident, flight 447, registration number F-GZCP, was fitted with the original Thales AA probes. They were due to be replaced upon the airplane’s return to Paris.
As of November 2009 (five months after the accident) Airbus had identified thirty-two loss of airspeed events that had occurred between November 2003 and June 2009. According to Airbus these events are attributable to the possible “destruction” of at least two pitot probes by ice. Eleven of these events occurred in 2008 and ten during the first five months of 2009. Twenty six of these incidents (81%) occurred on aircraft fitted with Thales AA probes, two on aircraft with Thales BA probes, and one on an airplane equipped with Goodrich HL probes.16
Post accident wind tunnel tests with large concentrations of ice crystals were able to duplicate the issue in a controlled environment. The Goodrich manufactured probe behaved better than the Thales probes and was therefore the eventual replacement probe.
Pitot Static Operation
The pitot-static system is designed to determine airspeed and altitude by precisely measuring both the dynamic pressure resulting from forward movement through the air, and the ambient static pressure at that altitude.
The air pressure measured in a pitot tube is the combination of the dynamic air pressure plus the static pressure. To determine the dynamic component (airspeed), the static pressure must be subtracted from the total pitot pressure. The dynamic component then directly relates to indicated airspeed. That is where the fun begins, as that value must then be corrected for temperature, pressure, and errors induced by the probe’s placement on the airplane to determine the airplane’s true airspeed.
You may have seen photos of flight-test aircraft where the probes are mounted on long poles that project out in to undisturbed air in front of the airplane for greater accuracy. No doubt, if production airplanes had those long probes, they would be broken on a regular basis by all manners of ramp equipment banging into them. Instead, the pitot, static, angle of attack, and other air data sensors are mounted on the fuselage.
Manufacturers attempt to position the sensors so that they can be reasonably accurate throughout the range of the airplane’s operating envelope. This can be quite challenging, as airflow around the fuselage changes quite a bit throughout an aircraft’s speed range. Sometimes the outputs of additional sensors, such as accelerometers, are used to tweak the air data to avoid erroneous readings.
Static ports are located to get an accurate measurement of the outside atmospheric pressure. But the ports have little choice but to be mounted on the fuselage somewhere, subject to local pressure differences as air flows around the complex exterior of the airplane. Almost all airplanes have some error due to the position of the static ports. These errors are carefully recorded during flight testing. The manufacturers provide a correction table and in the case of modern airplanes like the A330, build the corrections into the air-data computer software, so that the values displayed to the pilot are accurate.
The value of the measured static pressure must be corrected for this error before being used to calculate other parameters such as airspeed. The value of the correction depends in particular on the Mach, and takes into account the position of the sensors on the fuselage. Therefore, the correction performed for each static port is slightly different.17
For each airspeed system, the calculation principle is as follows:
Knowing Pt (total pitot pressure) and Ps (static pressure) makes it possible to calculate a Mach value used to correct the Ps. The corrected Ps is then used to calculate the CAS (calibrated airspeed) and the standard altitude.
With the known Mach value, the total air temperature (TAT) measurement makes it possible to determine the static air temperature (SAT), which in turn makes it possible to calculate the true air speed (TAS).
The corresponding IR (Inertial Reference) then uses the true air speed to calculate the wind speed from its own internal ground speed and track values. It also uses the derivative of the standard altitude value that it combines with the integration of the vertical accelerations to calculate the vertical speed, known as baro-inertial (Vzbi), which is that displayed on the PFD.
The A330 static ports are located below the fuselage mid-line forward of the wing. On the A330-200 in particular, as a result of the position of the static pressure sensors, the measured static pressure overestimates the actual static pressure. One of the first effects after AF447’s pitot tubes became obstructed was that internal altimeter corrections were recalculated as if the airplane were flying at the lower speeds. This resulted in false indications of a 300 foot decrease in altitude and a downward vertical speed approaching 600 feet per minute.
18
The pitot icing lasted for about a minute and five seconds. But 30 seconds later the airspeed indications again fell to extremely low levels.
Consider that in normal operation, the angle of the airflow along the fuselage is no more than a few degrees. At 02:11:45, as the airplane was descending through 35,000 feet, the angle of attack started to exceed 45° on a regular basis. At the same time the indicated airspeed fell to values that were well below its actual forward speed. If it were only a matter of the air striking the pitot tube at the 45° angle, geometry tells us that the resulting ram pressure would
be 70% of its actual value, but the indicated airspeeds were often below 60 knots for the number one air data system and near zero for the standby instrument.
This created a situation where the air was pushing into, in addition to flowing over, the static ports. Dynamic pitot pressure is only calculable by subtracting the static pressure component. If the air is directed at the pitot inlet and the static port inlet at the same angle then the differential will fall to zero, or perhaps beyond. This dynamic accounts for the repeated falling of the airspeed indications to invalid values.
In addition to airspeed, altitude and vertical speed indications were also compromised because of this effect. At this same time, the recorded vertical speed indications become erratic, and changed at rates that had no corresponding change in the vertical g load.
Further evidence of this phenomenon is that sometime during the 02:11 minute (the ACARS-transmitted fault reports were not recorded more precisely than to the minute) the comparison between the static and pitot pressures were “out of bounds.” That is the static pressure was greater than the pitot-tube sensed pressure. This caused a hard speed/Mach function error in the standby instrument (“hard” meaning that it persisted over a period of time). In normal flight regimes this would be a nonsense situation, where static pressure was greater than pitot pressure, even if the pitot tubes were completely blocked. But the correlation of this message with a time period where the angle of attack became consistently excessive lends credence to the explanation that the angle of attack was responsible for the airspeed values at ridiculously low readings, long after the icing issue ceased to exist.
Airspeed vs. Angle of Attack
There have been many calls for the installation of angle of attack (AOA) indications on transport category airplanes. This accident would seem to be the perfect example to make that case. Unfortunately, it is not that simple.
Airspeed/Mach is an excellent indication for a number of reasons. It provides a direct indication of limit speeds for the airframe and flaps/slats. In cruise flight, it provides a higher degree of precision for performance than AOA alone, and an indirect indication of AOA within the normal envelope. Cruise performance is more related to Mach number than AOA. Lift is increased and stall AOA decreased with increasing Mach number, even at the same airspeed and AOA.
Angle of attack indications are no panacea. In cruise, one degree of angle of attack change is equivalent to up to 25 knots of airspeed change. The stall AOA is also not a constant, at least not at Mach numbers above 0.3. Therefore, to act as a replacement in case of loss of airspeed/Mach number, the Mach number actually needs to be known to know the stall AOA, or conservative assumptions made. It is a catch-22. That is not to say it would be useless. In the case of AF447, it would have shown an obviously excessive AOA, and perhaps would have allowed the crew to answer the question both first officers posed: “What’s happening?” It might have led to earlier attempts to recover from the stall with pitch. However, in so much as the pilot flying seemed to be ignoring the more fundamental indications of pitch attitude and altitude, along with numerous stall warnings, one could question what difference a rarely used AOA gauge would have made.
AOA indications are more useful at low altitudes (where the stall angle is constant) for higher AOA flight regimes like approach. Precision in the approach and climb phases is more critical and an AOA reference is appropriate from a aerodynamic perspective. Military jets equipped with AOA indications use them in those flight phases and high performance maneuvering, but not at high-altitude cruise. The military attitude/AOA critical carrier approach also uses a “back side of the power curve” technique not compatible with transport category flight director and autothrust operating. 19 Additionally, the stall AOA is also influenced by flap and speed brake position. The addition of flaps actually reduces the stall AOA.20 Other factors such as CG, required body angle clearances, gust factors, and minimum control speeds (not AOA related), combine so that no single AOA can be targeted to ensure proper speed or landing attitude margins.
Measuring AOA is also more complicated than it may first appear. The airflow around the fuselage, where transport airplane angle-of-attack vanes are mounted, is not identical with the airflow experienced at the wing. Boeing cites Mach number, flap and gear position, side-slip angle, pitch rate, ground effect, fuselage contour, radome damage, installation error, sensor inaccuracies, contamination, and damage among the factors that add errors to the measurement of AOA.
Some transport category aircraft do have AOA indications (e.g., late models of B-737, 767, and 777). The indication provides a green approach band which represents the normal range for approach operations. The band is intended not as a target reference for the approach, but a tool to detect configuration errors, reference-speed calculation errors, and very large errors in gross weight, as not all approach speed parameters are related to or sensed by AOA.
Airbus does offer an angle-of-attack based speed replacement display called the Back Up Speed Scale (BUSS). The BUSS provides a green target area based on angle of attack and replaces the barometric altitude display with GPS altitude data. However the display only comes on after all three ADRs (Air Data Reference units) are shut off by the pilot, and its use is not recommended above 25,000 feet.
Boeing notes an additional hazard: “Pulling to stick shaker AOA from a high-speed condition without reference to pitch attitude can lead to excessive pitch attitudes and a higher probability of a stall as a result of a high deceleration rate.”
For a more complete discussion of these AOA integration issues for transport airplanes, see the excellent issue of Boeing AERO magazine at: http://www.boeing.com/commercial/aeromagazine/aero_12/attack_story.html
As part of the investigation’s certification recommendations, the BEA recommended that “EASA (the European Aviation Safety Agency) and the FAA evaluate the relevance of requiring the presence of an AOA indicator directly accessible to pilots on board airplanes.”
I think it is indicative of the complexity of the issue that the agency that does not concern itself with the cost or technological barriers associated with many of its recommendations has only called for the evaluating the relevance of AOA indicators, and not their outright installation.
Chapter 6: "I Have the Controls"
As soon as the autopilot disconnected First Officer Bonin announced “I have the controls.” At that moment his skills and knowledge were put to the test. When the automatic systems stop functioning (‘the magic goes away’) and flight control laws degrade, a pilot must identify and understand the situation, and consolidate many areas of understanding into his actions. An understanding of aerodynamics, the characteristics of the A330’s fly-by-wire control system, performance, procedures, and raw instrument flying skills must be applied simultaneously.
First Officer Bonin’s inappropriate pitch up, attempts at stall recovery solely with power, misidentification of a over-speed situation, difficulty handling the airplane in Alternate Law at high altitude, and other failures highlight many the areas of understanding that must be fully grasped by every pilot crewmember to operate safely.
Understanding the Machine
Would this accident have happened in a Boeing? Some say no, but history does not necessarily agree.
The accident happened in a Airbus A330-200. A marvel of modern technology, without question. But the Airbus has its own unique qualities that pilots must understand to operate it properly and safely.
There is no question that the Airbus is different from any other civilian aircraft. Its flight control handling is different, its autothrust system works differently, and it has sidestick controllers instead of conventional control wheels, which is definitely different. I do not think it is a dangerous or bad design. In fact, overall I think it is a good design.
When I was learning to fly gliders, already an airline pilot at the time, my glider instructor pointed out that the glider was not just an airplane without a motor. It was in fact a whole different c
ategory of aircraft. Pilots will recall that the word “category” divides aircraft into airplanes, balloons, rotorcraft, gliders, airships, etc., so it is in fact a legal definition too. But while all aircraft obey the same laws of physics and aerodynamics, they have their own unique handling characteristics.
Due to a glider’s long slender wings and the slow speeds that they often operate at, a glider pilot’s coordination of rudder and aileron inputs can be quite different from a regular airplane. In tight slow turns, such as when climbing in a thermal, a glider pilot may actually have opposite aileron and rudder applied - a virtual sin in the airplane world. These differences are not unsafe nor difficult to learn or even master, but they are different. It takes understanding the principles involved and practice, and that is why there is separate license for each category.
I think that the different handling qualities of an Airbus fly-by-wire airplane have a similar degree of difference from a conventional airplane, as an airplane has to a glider. While not designated as its own category, the Airbus, like any large or jet powered airplane, requires training and a specific type rating for that model in order to operate it as a pilot, as it should.
These differences may have played a part in the failure of the AF447 pilots to recover from their loss-of-airspeed incident. They may not have fully understood what inputs they were making to the flight controls, or what they were really asking for. But they should have.
When everything is working right, as it is more than 99.9% of the time, the Airbus fly-by-wire system provides excellent protection from inadvertent stall, flight envelope exceedance, wind shear recovery, and more. When something is not working properly it is important for the pilot to understand what has changed and that he is now fully responsible for not exceeding normal limits. That responsibility is something most pilots take for granted anyway.