(AF 447) Recording Indicates Pilot Wasn't In Cockpit During Critical Phase

Der Spiegel ^ | 5.23.2011 | Guibbaud Christophe

[libh8er]

What happened on board the Air France jet that crashed into the Atlantic en route from Rio to Paris? According to information obtained by SPIEGEL from the analysis of flight recorder data, pilot Marc Dubois appears not to have been in the cockpit at the time the deadly accident started to unfold.

The fate of Air France Flight 447 was sealed in just four minutes. That short time span began with the first warning message on one of the Airbus A330 aircraft's monitors and ended with the plane crashing into the Atlantic between Brazil and Africa, killing all 228 people on board.

Since last week, investigators from France's BEA civil aviation safety bureau have been analyzing the flight data and voice recordings extracted from the cockpit of the Air France flight that crashed on June 1, 2009 while traveling from Rio de Janeiro to Paris. What they have learned from the recordings seems to suggest both technical and human failure.

Sources close to the investigative team have revealed that the recordings indicate that Marc Dubois, the aircraft's 58-year-old pilot, was not in the cockpit at the time the trouble began. It is reportedly audible that Dubois rushed back into the cockpit. "He called instructions to the two co-pilots on how to save the aircraft," the source with inside knowledge of the investigation told SPIEGEL.

But their attempts to save the plane were ultimately in vain.

At the beginning of May, underwater robots were able to retrieve the flight recorders from the wreckage almost four kilometers (2.5 miles) below the surface of the Sargasso Sea. Two weekends ago, investigators succeeded in extracting data from the black boxes. Within 24 hours, reports were circulating suggesting that the crash seemed more likely the result of pilot error than a manufacturing flaw by Airbus.

[raygun]

It would not be a deep stall in the traditional sense, however any aircraft with a moving horizontal stabiliser can potentially mask the elevator, which has the same effect as the wing masking a t-tail. Stall recovery in that case will involve moving the horizontal stabiliser as well as the elevator.

One will notice that almost all jet transport aircraft will have takeoff range that the horizontal stabiliser is effective over, not having the horizontal stabiliser set in this range for takeoff could make the elevator potentially ineffective, hence it is an item check during the walk around and pre takeoff.

Keep in mind that ACARS messages are not sent sequentially when problems are reported, but according to a priority logic when multiple messages hit the que at near the same time. Folks with detailed knowledge of the A330 systems have said they expected several additional messages to have been received based entirely on those actually received.

• The first ACARS message received was the auto pilot was off
• The fourth and fifth messages sent were the Captain and F/O PFD SPD LIMIT warnings
• The 10th message received approx 1 min 11 seconds after the first message was a fault on rudder trim (Rudder hard over?)
• The 13th and 14th messages were HARD failures of the Pitot Probes
• The last message received 4 minutes and 16 seconds after the first was ADVISIORY CABIN VERTICAL SPEED

The last being presumed to indicate that the fuselage had broken apart until the evidence recovered from the ocean showed that the oxygen masks had not deployed and there was no indication of decompression. It is this last message that provides the basis for the assumption that the entire event took 4 minutes. We don't know that.

It is now assumed the last message indicated the aircraft was descending with such negative vertical velocity that the pressurization system was unable to equalize cabin pressure quickly enough.

The aircraft acknowledged receipt of a verification message of the last message about 2 seconds after receipt - there was no further communication (The ACARS transmission process included four back and forth verification hand shakes between the receipt center and the aircraft).

We also know that one gap in the nessage sequence of approx 31 seconds was due in part to the difficulty of maintaining reliable satellite communications by the automated systems. It is assumed that additional messages were in the transmission que by never sent due to abrupt termination of the event that occured.

[fireman15]

You obviously know far more about jet transports and the specifics of this crash than I do. The only T-tailed aircraft that I have personal knowledge of is the Piper Tomahawk. I have no doubt that your explanation of the "deep stall" and loss of horizontal stabiliser authority could have been a factor.

My brother was a check airmen for one of the airlines he worked for. I got to play in one of the big simulators with him on one occasion. It was very important to fly that simulator by the numbers, when I tried to land the simulator without using the instruments, the seat of my pants didn't work out well for me. I think these fly by wire complex aircraft do tend to insulate the pilots from the basics of flight and maybe that can become a problem at some point.

The inverse can be a little humorous. I have an old Rogallo style hang glider that can be towed behind a boat. I tried to get my brother who is a Captain for a major airline up in it once and it sort of freaked him out. It is basically a big kite when towed behind the boat. We use about 500 feet of line; it comes off the water at only 15 mph, less than 10 mph when launching into the wind. Unlike a parasail you can control its altitude and guide it from side by side and even release from the tow line and land on shore or soar the ridge lift from nearby cliffs. My brother was certain the glider was going to drop out of the sky and kill him at at any moment. He was however the first one to test fly my Skypup ultralight which has no flight instruments and loves it.

[raygun]

That's funny. A while back I was conversing with a former -16 pilot in a previous life who after two some odd decades in the cockpit, cashed out and became a MD-11 jockey for FedEx. I'd previously shared with him documentation concerning a dynamic campaign engine -16 flight simulation that I had on my PC. After perusing the hundred+ page PDF concerning just modifications to the stock simulation (concerning the FM, avionics and instrumentation), he said he'd have to check it out.

Later he relayed an anecdote to me.

On one of his check out flights as a new right seater, they spent 45 minutes on the tarmac trying to program a balky NAV computer for their flight. Everytime they got it programmed, they had to redo it based on changing weather conditions and other issues, e.g., ATC and traffic. Finally in frustration my friend exclaimed, "Why don't we just kick the tires, light the fire, and fly this bird to where we're going?". The left seater just looked at him like he had three heads. What?!?!? Fly, what is that?

He told me that he had no doubt that I - merely a virtual pilot - could probably fly one of the big liners as well as any of the crew with several thousand hours under their belts (and probably IFR too). But in commericial aviation nobody just flys anywhere anymore.

[naturalized]

Doubtful. Source?

[raygun]

Engine failure, either single or dual, is pure speculation. Turbulence on its own would not stop the engines. The only realistic way to stop the engines is to starve them of fuel or oxidizer. Either by running out of fuel, some sort of blockage in the lines, multiple fuel pump failures (every system has at least one back up system, and proper planning prevents fuel exhaustion). Complete engine failures (of all causes including mechanical) of modern jet engines is very rare. Ingestion of FOD has caused engine failure. Ingestion of massive quantities of water - virga - constitutes as FOD.

If the engines were to stop for whatever unlikely reason, the airplane does continue to fly. The only thing an airplane needs to fly is airspeed. Normally, the engines produce thrust which in turn gives airspeed, but without the engines altitude can be traded for airspeed. Just like on a roller coaster, as you go down, your speed increases. If you can go down at a controlled rate at an airspeed that produces the most lift with the least amount of drag (called L/D max, for maximum lift to drag ratio) most airplanes glide very well. A -16 has a glide ratio of akin to a 30,000 Lb metal cinder block (7 mile / 5,000'); well, perhaps a little better than a cinder block (it has wings). The pilot maintaines 210Kts + 4Kts / 1000 Lbs of gas and external stores (but only at 6^o AoA). I've heard 737 have 15:1 glide ratio (15 miles glide per 1 mile altitude lost).

The details concerning engine out can be found in:

• QRH 2.18 (Engine relight in flight)
• FCOM 1.70.80 (Ignition and starting)
• FCOM 3.02.70 (Engine Dual Failure)

Per A319/A320/A321
FLIGHT CREW TRAINING MANUAL
REV 21 MAY 98
POWER PLANT

Following a dual engine failure the flight deck indications change drastically as generators drop off line, the RAT is deployed and ECAM prioritizes checklists. Control of the aircraft must be taken immediately by CM1, and a safe flight path established.

It is important at this stage to correctly identify the failure as it can be easily confused with all engine generators fault. ECAM will prioritize checklists so to avoid confusion read ECAM carefully to correctly identify the failure. It is vital to establish good crew communications and to apply efficient task-sharing.

Clearly if they are dealing w/unrealiable airspeed indicator scenario, they have some problems on their hands.

[PiperShade]

I guess that means the PIC not having a “transatlantic bladder” is the reason.....At least to the know-nothing media mavens.

Don’t know how AF conducts its business but most lines conducting long overwater flights have at least three FULLY RATED/QUALIFIED PILOTS, (sorry for the shout, but emphasis is needed), aboard with two at the controls at all times.
Sorry, I don’t belive the presence/absence of the “Captain” in the left seat made any difference.

Flight at high altitudes is a “knife-edge proposition” in that you’re flying in what is known as the “throat”. Its a region where the aircraft’s critical mach number and its stall speed for its weight/altitude converge. Mostly this is not a problem because the aircraft, (Airbus in this instance), has redundant pressure, temperature, airspeed sensing systems feeding information to multiple flight computers that act as an “autopilot”. This system does a far better job of flying the aircraft than a human can “hand fly” it as it has far better reaction times - plus accesss to more control surfaces - than the pilot.

But this flight was crossing what I know as the “intertropical convergence zone” where great thunderstorms - with their characteristic vertical developments - can build. I posit, ‘What happens when a failure of the sensing instruments, or the computer software dedicated to reacting to this data fails’ ?

Airbus conceived a radical “globular” concept of flight management based upon computer control of all aspects of flight management. But not without accident. Its most spectacular was crashing its flagship at a public air demonstration when it wouldn’t respond - as later revealed due to software errors - to pilot inputs. Is this accident yet another example of a similar “software glitch” ?

A “stalled out” heavy in a spin in instrument conditons at high altitude isn’t something practiced or anticipated IMO. Due to fuel weight/distibution, combined with faulty air data inhibiting control responses, its possible the pilots were faced with an uncontrolable airplane. >PS

[PiperShade]

The difference twixt “light and heavy” is mass; and how the aircraft reacts to pilot control inputs. In aircraft you and I fly “mass” is a minor factor as drag/airflow and relative attitude largely overmaster the effects of mass. >PS

[PiperShade]

“Previous experience” doesn’t, unfortuantly, neccessarily mean its applicable to the extant scenario. Too many variables. That AF447 entered a “deep stall condition” is obvious from the data gleaned. But it leaves unanswered the particulars of the aircraft’s CG at the time of the accident vs those “successful recoveries”. Lets hope the recovery of the flight data and CP units resolves this.

Progress in aviation has always been earned in blood. >PS

[raygun]

The current system is the best system developed so far.

Measuring Air Speed from within an aircraft is a pretty complicated process. The pressure generated within the probes by the air, and the pressure differential on the static ports works extremely well in tens of thousands of flights every day across the globe. Usually the wings ice over long before the pitot fails due to icing.

While we do not know that the probes iced over, that is a vailid assumption based on the ACARS maintenance messages received that at least one failed to provide accurate speed information.

Icing in a probe without a mechanical failure of the heating element is very hard to prove, because if it ices, then the ice will usually melt before the probe can be examined on the ground.

As to the reliability

1. Probes are heated.
2. There where three separate independent probe/static port systems on the aircraft.
3. Several other A330 aircraft have exprienced what is apparently the same situation as AF447 - and all have come through without major problems. True none were in as severe weather as AF447.
4. Formation of ice sufficient to foul the probe at that altitude was through to be impossible, but new science has found that assumption to be in error.
5. Airbus and several airlines had determined the Thales pitot probes to potentially have an issue. Air France had already ordered a fleet wide replacement of that model - concentrating on their A320 aircraft first (the A340 aircraft also had the same probes).
6. Pilots are trained early in their career how to fly without reliable air speed indications, and the A330 has some very specific, and proven successful, methods to deal with such a problem.

Something else happened with AF447 that went beyond simple icing of the probes and loss of air speed data.

[Brass Lamp]

The fate of Air France Flight 447 was sealed in just four minutes.

Does it actually take four minutes to paint "Airbus" on the side of a plane?

[saganite]

Doubtful? It was all over the news that the plane was linked via satellite to AF and sending back data. Some of the original speculation was based on that info. Look it up yourself and stop begging for links. grrr

[PiperShade]

So much for your “strawman” argument......

IMO, the Airbus “Flight Management System” is suspect in AF 447. Its “screwed the pooch” very dramatically in the past. All too easy to place blame on a dead flight crew - as you imply - when no other evidence is apparent; or needs concealment. Happens all the time...... >PS

[fireman15]

I took a friend from work flying with me a few years back. He had never been in a small plane previously. He said that he had the profile of our plane on MS Flight Simulator and had been flying with it. He had all of the critical air-speeds for our plane memorized for takeoff, climb out, approach, and landing. Before the flight I gave him a little instruction on my philosophy of how to use trim and the flaps to make the landing easier. He took off, flew the plane and landed the plane multiple times without any hints from me at all. We visited multiple airports; the one we started out at was no challenge for him at all. Flying the real thing at least in our plane is easier than flying the simulator. So I think your friend could be right.

My brother says that he is just a flying bus driver. But commercial pilots are under a lot of pressure; they are constantly having to learn new equipment and they have to keep track of a lot while they are flying around. The constant communication required at a busy hub can be a real challenge. At this point, I prefer to just fly to small uncontrolled airports if possible. The communication can get very confusing when you are going into a big place for the first time. It takes all of the fun out of it. For pure fun you really can't beat an ultralight or a hang glider.

[fireman15]

IMO, the Airbus “Flight Management System” is suspect in AF 447.

My guess would be that a number of factors were at play in this case. Programmers and aircraft engineers cannot foresee every possibility in such a complex system. When such a system is put into a very challenging situation and equipment starts malfunctioning... it is no real surprise that the end result could be a crash regardless of the actions of the flight crew.

I know my own experiences are only anecdotal here... but my wife and I once had to divert all the way to Utah to get around a weather system on our way to her sister's place near San Francisco. Along the way we were dodging thunderstorms and fighting with some pretty severe turbulence. Thirty miles out from Bend Oregon we heard a commuter plane say that they couldn't land there because it was a level 3 thunderstorm and it was way beyond their capability.

We ended up landing to get fuel at a little place called Christmas Valley in Eastern Oregon. The twin engine plane that landed ahead of us had been hit by lightning and it had destroyed virtually all of the electronics in his panel. They were shaken up but not hurt. Supposedly when a plane gets hit by lightning it passes around the skin and doesn't go through, but I have seen planes with holes from lightning.

I know the electronics on these fly by wire transports have redundancy and are protected from lightning. But those of us not thoroughly familiar with such things can't help but wonder if the effect of “1.21 gigawatts” ; ) on a computer system can really be adequately planned for. Can the electromagnetic energy from a large bolt of lightning cause some fluke glitches in even a well shielded computer system. Despite assurances to the contrary I still wonder.

[ConservativeWarrior]

Disclosure: I’m a private pilot an an ex-USAF avionics mechanic (C-5s). I understand how to trade energy in flight, and which systems can fail on large jet aircraft.

Losing both engines would be rare, but possible.

If it were to occur, the Unreliable Airspeed procedure wouldn’t be valid, as it calls for pitch & thrust combinations.

[naturalized]

Warning lights aren’t data. That graphic is speculation passing for information.

[SeeSac]

however any aircraft with a moving horizontal stabiliser can potentially mask the elevator

I am having a hard time finding a photo of a plane with both a moving horizontal stabilizer and elevator ....

[saganite]

It was data. I’m sorry you’re too dense to understand that and too lazy to find out.

[raygun]

I'm guessing there'd be no choice but forced to fly AoA exclusively; that's tricky but not impossible.

Based on aircraft weight, there's an ideal speed to maintain unpowered lift, and that speed is predicated on AoA flown down a glide slope optimized to convert altitude for distance; determined by the aircraft's flight path.

In a clean -16, 6^o AoA is flown on a -11^o to -17^o glide slope. With AoA at 6^o, you're in the ballpark of 210 Kts (all things equal, by dropping the gear and the airspeed will decrease to 200Kts).

Flying whatever pitch necessary to set artificial horizon to whatever pitch for whatever optimum glide slope, and fly whatever AoA will set speed needed per procedure mandated for unpowered flight in the FCOM, QRH or whaterver manuals / checklists they consult.

If L/D is 15:1, this works out to a glideslope of 3.8^o. Too high AoA and glide slope decreases but airspeed will also decrease (eventually leading to stall onset), too low AoA and glideslope increases along with airspeed (at expense of height, distance and time for engine relight procedure).

I'm guessing at any altitude and weight there's a guestimate of the stall speed. Pilot would probably fly in and out of the stall onset region. Through use of a stop watch, an approximation of average velocity could be made. +/- 20Kts either side of that required for unpowered glide should be gutenuff for engine relight procedures.

[raygun]

Dude, where’ve you been? What is all this talk in my post #81 about ACARS messages? Where did they come from? The discussion about those ACARS messages has been both voluminous and comprehensive since day 1 two years ago.

That’s all we know about what happened to the plane until the FDR/CVR were recovered a couple weeks ago.