Air France Disaster – Focus On Airbus Air Data Inertial Reference Unit (ADIRU) System

The Australian ^ | June 3, 2009 | LuckyBogey

[buccaneer81]

WOW! Pucker Factor Infinity on that one!

The only passengers on a scheduled airline to fly supersonic without being on a Concorde. That's a story of a lifetime.

[Travis McGee]

I think to survive flights like those two linked would be life-changing events.

People have had black hair turn white overnight. (Not all the grown hair, but from the roots.)

[buccaneer81]

I think to survive flights like those two linked would be life-changing events.

For sure. I guarantee there were some cases of post traumatic stress.

[Squantos]

Yep asshats flying desks overrule safety 90 % of the time sadly .....

[Habibi]

“I wonder what happens to pilotos who “chicken out” and return to base? Can’t be good.”

In 25 years, I did it twice. Nary a word from the head shed. Non-issue. Really! Pilots are seldom, if ever, questioned re. their judgement, unless it’s a stupid, dangerous judgement.

I was only “pressured” once on a safety item. Quit the next day. Plenty of other opportunities, and I continued to improve my career. The guy that did it, never “progressed” above where he was.

[Travis McGee]

I’ll bet a lot of folks wish that the AF pilots had done a 180*, if indeed they did decide to fly into a wall or through a fast-closing sucker hole.

Very, very sad.

[Conspiracy Guy]

Microburst or rotor cloud

[smokingfrog]

Air France jet likely broke apart above ocean

June 3, 2009 7:40 p.m. EST

[PapaBear3625]

You're assuming that the problem really is with the ADIRU.

There's also the possibility that a bug in the ADIRU software caused to to wildly overcompensate for the turbulence.

[zipper]

• 11 p.m. local time — The pilot sends a manual signal saying the jet was flying through CBs — towering cumulo-nimulus thunderheads.

• 11:10 p.m. — A cascade of automatic messages indicate trouble: The autopilot had disengaged, stabilizing controls were damaged, flight systems deteriorated.

• 11:13 p.m. — Messages report more problems: The system that monitors speed, altitude and direction failed. The main flight computer and wing spoilers failed.

• 11:14 p.m. — The final message indicates a loss of cabin pressure and complete system failure — catastrophic events in a plane that was likely already plunging toward the ocean.

http://news.yahoo.com/s/ap/brazil_plane_messages

[BP2]

My analysis, piggy backing on Tim Vasquez's work over at Weather Graphics:

The freezing level was at 16,000 feet at the time of the flight and AF447 was at 35,000 feet. The winds aloft temperature at their altitude is estimated to be -43 deg C.

A rule of thumb the USAF teaches is the majority of Lightning strikes occurs within 5000' and/or within +/- 20 deg C of the freezing line. So, unless they descended to avoid thunderstorm anvils, or were forced to descend because of loss of pressurization and/or needed to perform some sort of driftdown procedure, I think it is somewhat UNlikely they were hit by lightning as an Air France official originally suspected.

I'm sure they were above 400 knots TAS (true airspeed) at their cruise altitude. Icing is not normally a problem for aircraft flying above 400 TAS. One possibility is they had to slow the aircraft for (unintentional) thunderstorm penetration procedures (I'm guessing approx .75 mach in the A330, but slower if below 20,000') and then got hit with supercooled water droplets. Another possibility is they had some sort of structural damage due to the prior turbulence they reported and had exposed internal damage in the wind stream. However, Severe Icing bad enough to bring down a large aircraft like an A330 that has anti-icing bleed air is very unlikely, unless the circumstances were equally bizarre.

Looking at this "Probable Radar Depiction" (above), and time/location between INTOL and TASIL, it sure looks like Turbulence from an embedded storm is a very likely culprit. It doesn't look like a particularly menacing cell, but depending on where it was in its life cycle, they could have been caught in a microburst that made a weak structural member fail (e.g., the rudder).

The crew reported a bumpy ride and electrical problems at their last position report of INTOL. A powerful embedded thunderstorm reflecting ALL of the radar energy back to the aircraft's radar, masking an even more intense cell behind it could also be a possibility (similar to the black spot in the graphic below). They may have also had a windsheer alert, depending on their equipment. If it was unannounced and catastrophic, the crew would have little warning. Dense tropical moisture can be a killer and sneak up on an aircrew, regardless of their flight experience.

Lastly, if the ADIRU is indeed suspect, oscillations from thunderstorm turbulence could have made the autopilot OVER-correct. If it was extreme, the pilots may have kicked off the auto-pilot to hand fly the aircraft. Depending on the load factor at that exact moment from thunderstorm updrafts and downdrafts, they may have unintentionally over-G'ed the aircraft, causing structural failures on the flight surfaces.

[2111USMC]

Thanks for the ping.

[luckybogey]

been reading the airliners.net forums.......following recent conversations such as these: (sorry for formating) http://www.airliners.net/aviation-forums/general_aviation/read.main/4434177/#menu51 Quoting JFernandez (Reply 50):In light of no other information, this really spooks me that it's an ADIRU issue which brought this plane down. I agree. After the QF lucky break and others, I have feared there is a core problem with the Airbus software that is a catastrophic accident waiting to happen. You just have to wait, and it will happen. As the usual, it takes a series of contributing problems to bring down a plane at altitude, but if there was, say a sudden auto-generated disfunctional operation of the plane coupled with an extreme weather event that made disfunctional flying much more stressful on the plane than the norm, and also preventing the pilot from regaining a healthy flying condition, could have destroyed the plane. Or else it all happened in a moment, and there was never any hope of pilot cure through manual corrections. It appears that the time from when the autopilot was disengaged (presumable, the pilot was trying to return the plane from a disfunctional course) to the cabin vertical speed advisory (the last message) was only 4 seconds. It was confirmed that each PRIM was loaded with identical operational software The significant issue is that Air France appear to have opted not for Litton for their ADIRUs, but for the other manufacturer, Honeywell. Yet, once again, ADIRU malfunction is among the possible causes being investigated. You can read the latest AD on here (scroll down to the 'Download' button at the bottom):- http://ad.easa.europa.eu/ad/2009-0012-E Just found the article below, which mentions the second ADIRU problem suffered by Qantas on DEC. 27. What calls may attention is the order of things: first the autopilot disconnected and then the crew received a message of the problem with the ADIRU, the same first and second messages received by AF computers. http://findarticles.com/p/articles/mi_m0UBT/is_2_23/ai_n31189475/ ".....Qantas has suffered a second air data inertial reference unit (ADIRU) failure. The Australian Transport Safety Bureau (ATSB) said it was advised on Dec. 27 of an occurrence that day involving a Qantas A330-300 cruising at 36,000 ft. on its way from Perth to Singapore. Some 260 nm. northwest of Perth, the autopilot disconnected and the crew received an Electronic Centralized Aircraft Monitor message (NAV IR 1 fault) indicating a problem with ADIRU No. 1. The crew implemented the new Airbus Operations Engineering Bulletin procedure by selecting the IR 1 and ADR 1 pushbuttons to off. The aircraft returned to Perth without incident....." also good to read these articles, already mentioned before in this forum: http://www.time.com/time/world/article/0,8599,1902421,00.html http://www.dcs.gla.ac.uk/~johnson/pa...SC09/ADIRU_Accident_Submission.pdf It was confirmed that each PRIM was loaded with identical operational software So does this mean that the hardware is triple redundant but the software has no redundancy?

[Doe Eyes]

It appears that the time from when the autopilot was disengaged (presumable, the pilot was trying to return the plane from a disfunctional course) to the cabin vertical speed advisory (the last message) was only 4 seconds.

The time was 4 minutes. I believe this was later corrected on the Airliners.net forum.

[Still Thinking]

They said no casualties, so I take it they're not counting underwear. Sounds like that incident or issue might have been the basis for Michael Crichton's Airframe (truly excellent book).

[buccaneer81]

Or as in “Star Trek The Motion Picture” when Dr. McCoy was told there were no casualties, he responded, “Wrong. My wits, as in frightened out of, Captain sir.

[wardaddy]

My dad flew through thunderheads at Mach I.5 or better as a USAF fighter jock before decent radar and described it as terrifying...he was always very cautious in our Beechcrafts later on.

That area of Northeast Brasil can be very turbulent even on clear days...the equatorial thermals and Saharan winds and dust and hot spots....a lot of disturbed air without anvil heads everywhere..

[zipper]

Yes I read the Weather Graphics analysis, which I learned about from listening to Rush the other day (really!) and I am leaning toward the author’s theory. They got into weather, lost the radar, and flew into an embedded thunderstorm that broke the airplane apart.

That’s the specific version. The less specific version is: they flew into a thunderstorm and the airplane broke apart.

My own additional analysis follows.

Regarding BP2’s comment: Windshear alerting systems are for low altitude approaches. They incorporate the radar altimeter, which only functions at low altitude — usually around 2500 feet.

Also regarding BP2’s comment: Icing may have been a slight factor since having the engine anti-ice on (likely in clouds with total air temp below 6 degrees) is a slight drain on available power, and having the wing anti-ice on is a significantly larger drain on available power. This is important since it might limit their ability to climb to the next higher assignable altitude (in this case flight level 370) to help avoid the storms or to get back in visual conditions (out of the clouds to see the weather better). Climbing to the max altitude for the weight is not necessarily a good idea either, since the stall margin decreases, and turbulence already compromises the stall margin.

The A330 is equipped with automatic ice detection and my bet is, if they were in clouds icing was detected. This would have caused them to at least turn on the engine anti-ice.

---

There are at least three crashes that I know of involving aircraft flying into thunderstorms.

C-141 enroute to Mildenhall AB, UK, 1976:

http://www.c141heaven.com/mishap_paul_hansen.htm

Northwest Flight 705, 1963:

http://aviation-safety.net/database/record.php?id=19630212-0

and Pulkovo Aviation Enterprise Flight 612, 2006:

http://en.wikipedia.org/wiki/Pulkovo_Airlines_Flight_612

---

If the aircraft’s radar tilt isn’t set properly by the crew, or if the tilt wasn’t properly calibrated in the pitch axis and the crew didn’t notice, it’s possible they flew straight into a thunderstorm with a fully functional radar. If there’s a strong storm ahead you must clear the tops by at least 5,000 feet to guarantee not experiencing the effects of turbulence from the storm.

Aicraft radar systems detect precipitation gradients. The modern ones have color coded presentations, much like the charts you posted. One big problem is, unlike these charts from satellite, with aircraft radars the radar signal strength may be attenuated by a strong cell and therefore you can’t see what’s beyond the cell on the back side. So you may be suckered into taking a route through a line of weather that you will regret, like proceeding through a maze into a dead end. At high altitude your turn radius is very large and so picking your way through cells can be difficult if turns are required.

If your radar is out and you’re flying at night, the most immediate alternate option for avoiding cells is visually. They would have the cockpit lights turned down, leaning over the cockpit instrument panel looking outside. Your best friend in this case is available light, which would come from lightning flashes and moonlight (analysis to follow below). The cadence and volume of lightning flashes, indicated by static on the radios, is also a useful aid to detecting the severity of the weather.

If you fly into a storm inadvertently your options are limited. You could try to turn around but turns at altitude are very large in radius and often slow due to automatic bank angle limiting. Turning reduces the available g’s for the withstanding of turbulence, since a level-altitude turn would be more than one g (30 degree bank turn is 1.5 g’s).

Of course if the storm cells are embedded within clouds, and your radar (two transmitters) is knocked out due to lightning, you will have few visual options, either at night or during the day.

I computed their position at the time of last ACRS message (0214Z, to be 78 NM northeast of ORARO, coordinates N 03 hours 23 minutes, W 30 hours 36 minutes. This is based on their flight planned speed of 481 knots true at FL 350, a 10 knot headwind, extrapolation from the last reported position of Intol at 0133Z, and being on course on airway UN873.

Consultation of moonrise tables with the coordinates plugged in yields a moonset time at the location of the last contact as 0328Z, or in Rio time, 1228 a.m. local. The full moon is on the 7th of June, so they had about 2/3 illumination but the moon was low on the horizon since the last electronic message was 1 hour 14 minutes before moonset.

http://aa.usno.navy.mil/data/docs/RS_OneYear.php

[KeyLargo]

The FDR may be somewhere in the Mid-Atlantic Ridge. Undersea mountains.

[mewzilla]

Thanks for the link!

From the link, the comments section....

Most (but not all) airliners that transit the ocean are now using CPDLC which essentially allows the airplane to pulse out position reports every so often regardless of the passage of a specific navigation fix. By doing so, the ATC computer can create what amounts to a radar blip on a screen where no radar really exists. If you were to go to Flightaware.com and input a FedEx flight from Memphis to Honolulu you would, in years past, see the track disappear off the map shortly after it passed beyond the Calif. coast. Now you can see the track all the way across the Pacific. The ATC controlling that segment of oceanic airspace would have to have compatible equipment. Many do these days. I don't know if that is available off the coast of Brazil but I feel certain most or all of the Air France long haul fleet are CPDLC capable....

If that is indeed the case, why didn't Air France have a better idea where the plane was?