I figure a quick and dirty explanation of basic flight systems might not be unwelcome.
In most aircraft and certainly in jets, you have six primary instruments: airspeed indicator, attitude indicator (artificial horizon), altimeter, turn indicator, heading indicator, and a horizontal speed indicator.
The attitude, turn, and heading indicators rely on gyroscopes that are propelled by a vacuum pump and/or electric motors.
Airspeed, altimeter, and vertical speed indicators rely on a pitot-static system. The pitot tube must be exposed to the air that is uninterrupted by the plane's passage. The static port(s) must be positioned where the air is calm and undisturbed.
Each instrument of the pitot-static system relies on pressure differentials, but only the airspeed indicator is reliant on both the pitot tube and the static port. The other two instruments rely on the static port and vents or calibrated leaks.
Part of a pilot's primary training and certainly part of instrument training is in recognizing failures in this crucial system. For example, let's say you take off and your airspeed slowly drops to zero but you remain flying. There's a good chance you've got a blocked pitot tube. This is a simple example, but pilots are trained on this and other failure scenarios during primary and instrument courses. Pilots that want to die of old age train themselves beyond what's required by these courses.
At lower altitude in visual flying conditions, these failures aren't as deadly, primarily because one can still see the horizon. But high altitudes remove most of the visual cues, requiring pilots to trust the hell out of those instruments...except when they can't.
Someone else said it, but these guys lost situational awareness; I'm guessing that all of the warnings going off just overloaded them and caused them to overlook the clues that would have saved them. I've personally never flown anything bigger than a six-place Beechcraft, but I've had enough scary moments with buzzers and lights flashing to appreciate just how much pressure that situation would have caused.
NOVA did a program on this. They do a detailed look at this type of failure. They also had trained pilots demonstrate how to fly that specific plane without airspeed indication. It wasn't difficult to do. There are specific throttle and angle settings you can use to maintain stable flight. The program is available on netflix: http://www.netflix.com/WiMovie/70148706
Edit: This may not be the best place to add this but I don't feel like replying to several comments.
If I recall correctly, the pitot tubes on 447 were defective models known to be prone to icing. They met existing safety standards but they had still caused a number of failures other aircraft of the same model before this crash happened. The aircraft had been due for pitot replacement but Air France hadn't gotten around to it yet. The aircraft had flown directly into a thunderstorm system capable of making super cooled water which could easily overwhelm the defective pitots.
Several flight instruments rely on air pressure. If one of your pressure gauges gets blocked, you can get very misleading data.
This guy's theory as to what happened in this case is that the forward pressure tube (pitot tube) had an ice blockage, which led to a low airspeed reading. The autopilot tried to correct by accelerating the plane. Since loaded jetliners normally fly slightly nose-up to maintain altitude [1], the autopilot kept that orientation as it accelerated, which led to a climb and ultimately a stall.
When the plane stalled, it started dropping altitude rapidly -- but with a blocked pressure line, this could misleadingly report a high airspeed due to the increase in external pressure. As the pilots took over, they were (according to this guy's theory) trying to reduce airspeed by cutting the throttle and nosing up. Rather than fixing an overspeed condition, they were actually making the stall worse. They never would have realized what was happening because their instruments kept reporting overspeed.
[0] I'm not a pilot, but I worked in an aerospace museum's education department, and learned a lot from the pilots and engineers who volunteered with us.
[1] According to one of the volunteers, who was also an engineer for one of the big jetliners, loaded jetliners get about half of their lift by keeping their wings 3-6 degrees above level. The exact angle is selected based on load and airspeed; get it wrong, and you'll accidentally climb or descend.
At night, in the middle of a thunderstorm, at over 30,000 feet? Those are perfect conditions for vertigo. That's the reason pilots learn to ignore what they are feeling and trust their instruments. Unfortunately, some of those lied.
From what I understand, the instruments may have shown that airspeed was increasing when it was not. So the pilots tried to pitch up to reduce excessive airspeed but this in reality just caused them to go deeper into the stall. There was a stall sensors but they chose to ignore it in favor of the faulty airspeed sensor.
A case of lack of situational awareness or rather faulty situational awareness brought on by a sensor failure.
A little background on the warnings. There are no specific sensors for them. They are issued by the computer when it detects a dangerous situation, which it uses a variety of inputs to determine. With unreliable airspeed and altitude (pitots tubes not working) the overspeed warning should have been ignored completely and the stall would have to be verified with other data if possible.
I don't think the report deepens the mystery, it answers questions. The flight data recorder information was recovered and tells what happened. The flight speed sensors weren't working and so autopilot shut off while the captain was taking his rest period. Then the two copilots didn't know what to do and called him. When he came they all continued doing random things indicating none of the three had any flight training that they remembered. This behavior, of not knowing how to deal with flight problems because they are used to running everything on autopilot, is not uncommon in airlines based in third world countries where pilots are the nephews of autocrats, but is unusual for French pilots.
> When he came they all continued doing random things indicating none of the three had any flight training that they remembered.
Power + Attitude = Performance. Every PPL knows this, as did the three AF pilots that night. They deserve more credit.
We know the pilots received an audible stall warning the moment PFD's and STBY ASI failed and the A/P & A/T disengaged. That was a false stall warning, moments later they received another real stall warning.
They were flying at night entering turbulence with unreliable and conflicting data with flight control laws that went from Normal Law to Direct Law. The ASI is showing 25+ knots over the max limit while at the same time stall warning is going off. The plane is in direct law mode so any side-stick input could rip it appart.
I'm going to wait until more data is released before making a conclusion, there are too many whys.
I'll start by saying that I fly for a living, and have logged hours in so many different types of aircraft that I've lost count (I suppose I could check my logbook...), everything from bug-smashers to helicopters to supersonic jets (barely more than zero in the helos, though).
EDIT: I should also mention that I have an MS in aeronautical engineering, and specialized in stability in control and avionics (the things that went wrong in this mishap)./EDIT
I agree 100% with the assessment that the new information does not deepen the mystery, it pretty much explains everything.
The quote from gp about lack of flight training is excessive, but it is in the right direction: those guys screwed up big time, and a big contributing factor was almost certainly inadequate training in dealing with emergencies of this nature.
They screwed up because their SA bubbles just completely collapsed because they were getting conflicting information from their instruments: simultaneous stall and overspeed warnings. Situations like that are exactly why we still need real, human pilots in these aircraft, because a properly trained crew, who truly understand the systems will be able to put together the clues to figure out what's really going on. A disproportionate amount of my training as an aviator has been dedicated to understanding all of the ways that the systems in the aircraft I fly can break. It's critical to understand not just the common failure modes, but also the interactions between them (what we call "compound emergencies"), especially when following the procedures for one emergency can exacerbate a concurrent emergency.
The thin is, in this situation they didn't even have a compound emergency: the only failure was in the pitot-static system. This is an aircraft which requires a sophisticated automated flight control system to remain stable in many flight regimes, and that automated flight control system is utterly dependent on reliably accurate data from the pitot-static system. In that context, these guys should have been drilled heavily on all the ways that the pitot-static system could fail, the manifestations of those failure modes, and how to respond to them. For example: "If you get simultaneous overspeed and stall warnings and your VSI is deeply negative, you are in a stall and need to ignore the overspeed warning and execute stall recovery procedures." Actually, when I word it that way, they shouldn't even have needed special training to figure that out: the VSI should have made it obvious.
Situational awareness is a holistic understanding of the entire situation. A big part of that is knowing which information sources to trust or not, which humans still do better than computers.
For example: "If you get simultaneous overspeed and stall warnings and your VSI is deeply negative, you are in a stall and need to ignore the overspeed warning and execute stall recovery procedures." Actually, when I word it that way, they shouldn't even have needed special training to figure that out: the VSI should have made it obvious.
wow, and how were they supposed to know that VSI is reliable?
but it is in the right direction: those guys screwed up big time, and a big contributing factor was almost certainly inadequate training in dealing with emergencies of this nature.
I think you're too early to jump onto conclusions based solely on impartial and interim report.
You're not alone though - seems that opinion of internet experts is divided between putting full blame on pilots or putting full blame on sensors.
I think actual situation was a bit more complex than that.
Because the VSI doesn't use the pitot tubes? IIRC, it uses a gyroscope. [Confirmed: http://news.ycombinator.com/item?id=2595230 ] The chance of having a failure of two separate, redundant systems is unlikely. Pitot tube failure in a thunderstorm is far more likely than gyroscope failure.
Anyway, the computer had reported loss of reliable airspeed so they should have ignored all instruments that use airspeed and fly on what's left. There are procedures for this kind of failure. It looks like they didn't follow them.
Nova did a program on this. It's on netflix. http://www.netflix.com/WiMovie/70148706 They showed the correct solution was to fly the plane based on angle of attack and throttle settings. You don't need airspeed to keep the plane in the air long enough to figure something else out.
The attitude, turn, and heading indicators rely on gyroscopes that are propelled by a vacuum pump and/or electric motors.
Airspeed, altimeter, and _vertical speed indicators_ rely on a pitot-static system. The pitot tube must be exposed to the air that is uninterrupted by the plane's passage. The static port(s) must be positioned where the air is calm and undisturbed.
The VSI (and the altimeter) uses the pitot-static system, but not the pitot tube.
The pitot-static system consists of a static pressure port, the pitot tube, and (on more sophisticated aircraft) a computer for interpreting the readings from the two sensors. The altimeter and VSI only rely on the static port (VSI is just the derivative of altitude with respect to time), while the airspeed indicator relies on the satic port and the pitot tube in combination.
If the static port has a problem, none of those three instruments will work properly. Whenever I've seen this happen, altitude remains stuck at some fixed number (usually sea level, but not always), VSI is zero (becuase the derivative of a constant is zero), and airspeed is way off (but continues to change).
If just the pitot tube has a problem (as was the case in this mishap), the airspeed indicator won't work (usually stuck at some fixed number, most often zero) but the alitimeter and VSI will be fine. The VSI and altimeter were both telling them that they were falling out of the sky like a rock, and they should have paid attention.
If they were unsure as to whether it was a problem with the pitot tube, the static port, or both, they had a tie-breaker: the stall warning system uses a completely different set of sensors (they measure the airflow over the wings, looking for signs consistent with a stall). The stall warning system was telling them they were in a stall, the VSI and altimeter were giving them information consistent with a stall, and the airpseed was not changing as it should have in response to low-throttle and nose-high. Put those together and the most logical explanation is that the airspeed indicator is full of shit. That's what I was talking about when I said that human pilots have (or should, at least) the ability to figure out the truth when multiple sensors are in disagreement.
An analogy: there's an old adage that you shouldn't go sailing with two compasses: three, or one, but not two. The reasoning is that if you have two compasses and one goes bad, you won't know which one to trust, so you might as well have none. If you have three, you can trust the two that agree with each other. A lot of avionics systems operate on this principle: three sensors, with the results combined by a voting system. Computers do this well. However, when you have a human in the loop, with access to information the computers don't have, this adage is actually a bunch of bullshit. If you have two compasses and they disagree, you're better off than if you only had one because at least you know immediately that something is wrong. Then you can pull in other clues to figure out which compass is right: look at the sun, or the stars, or rely on your knowledge of prevailing wind and current conditions in your general area. If the compasses disagree by more than a few degrees, you'll be able to quickly figure out which is wrong. If they only disagree by a few degrees, they'll probably get you safely close enough to land that you can go back to navigating by dead reckoning, and then figure out which compass is wrong.
the stall warning system uses a completely different set of sensors (they measure the airflow over the wings, looking for signs consistent with a stall)
AFAIK stall warning system uses AoA vanes, located on the nose close to static system pitots. Completely different system? Yes. Same working principle? Yes.
Interesting. AoA probes are one way to provide stall warning, but I wasn't aware that's what Airbus used on the A-330. They also have other uses. There are also other ways to provide stall warning such as directly sampling flow over the wings (as I mentioned previously). Most light props actually use a very crude version of this. For example, the stall warning on the Cessna I flew my first few hours in was a horn on the lower part of the leading edge. In an impending stall scenario, the pressure over that part of the wing would go negative, sucking air out through the horn and causing it to sound.
AoA vanes actually do work on different principles than pitot probes. The newer, fancy-schmancy ones use a whole bunch of tiny ports, each measuring pressure at different angles, and a computer interprets the results to give AoA. On older planes (including the one I have the most experience in), it's literally a vane, as in "weather vane:" it rotates into the direction of the relative airflow, so whatever angle it is at relative to horizontal is the AoA.
Even if the AoA system did work on the same principle, the more important point is that it's a separate system, meaning that a failure in the pitot-static system would not cause a failure in the stall warning system.
EDIT: from the picture you linked, the AoA vanes on an A-330 are of the type I'm more accustomed to: literal vanes that rotate into the airflow.
>You're not alone though - seems that opinion of internet experts is divided between putting full blame on pilots or putting full blame on sensors.
I actually blame both: if the sensors hadn't broken, the mishap would not have occurred. However, even once the sensors broke, if the pilots had better SA, they still could have prevented the mishap. Even then, I don't blame the pilots so much as the training system that failed to prepare them for this situation, given what I already mentioned about how reliant these aircraft are on their pitot-static systems.
I realized that my previous response didn't really convey what I wanted to, so I'll try again:
There is always a possibility that sensors will fail. Unless you have enough redundancy in your sensors to employ a voting system (not always practical, sometimes not even possible), computers are still no good at handling such failures. A properly trained human has a pretty good chance of maintaining SA when sensors fail. A computer, not so much. In fact, given the definition of SA, I'm not entirely convinced that any computer currently in existences is truly capable of having SA at all (which is what I was trying to get at in my previous reply).
The question not answered is why three trained pilots made wrong guesses as to what was going wrong with the plane.
BTW, I imagine a pitot tube placed on the body of the engine would not need extra heating and would be very unlikely to ice. You can even place it inside the exhaust and compensate the reading for engine flow.
We have to figure out what went wrong, what mistakes the crew made in order to prevent future accidents like this.
And I, coming from a third-world country, take offense at your statement. Pilots here endure very thorough training. One would have to be a lunatic to trust his nephew to a flying computer. The pilot must always know what's going on.
And that brings the main point: people die when the machine surprises its operator. "Smart" planes have become so smart pilots have trouble understanding what they are doing under all that software. And that's assuming the software is not buggy and they didn't got a very unfortunate NullPointException in the worst possible moment.
You've hit the crux of the issue. The aircraft are getting complicated to the point where training in them -- especially outside of "normal" flight regimes -- is difficult. All the references to Normal/Alternate/Direct law are indicative of this.
Ever hit the wrong key in emacs and wondered why it was suddenly responding differently? Imagine that happening at 38k feet, at night in a thunderstorm.
My doctoral work was exactly in this field. Mode awareness, transitions awareness and autoflight understanding, especially in rare flight configurations, is a deep problem that needs to be tamed.
I would a pitot tube in exhaust work? There's very little 'normal' air in the exhaust, just the engine exhaust, and unless I got my physics completely wrong, will always give the same relative speed relative to the plane(pivot tube) at any given engine setting... which doesn't tell you anything about the actual airspeed (which is what you need).
Pivot tubes are 'tubes' located away from the body of the airplane for the reason that they get away from the boundary airflow to give accurate airspeed readings. Attempting to 'compensate' for other factors just introduces more uncertainty, which is exactly what you don't want when you're 5 knots above stall.
Is the engine airflow at any given regime completely independent of airspeed? I would never use it as a primary source, but it could be used to flag abnormal readings of other instruments.
Let's imagine a plane starting take-off roll. Engines are spinning up to full throttle (99-100% of thrust), but airframe just started to accelerate slowly. Compensating for anything is pretty useless in this case - airflow trough the engines is even higher than during cruise, but airflow around wings is quite minimal.
BTW, I imagine a pitot tube placed on the body of the engine would not need extra heating and would be very unlikely to ice. You can even place it inside the exhaust and compensate the reading for engine flow.
There are such things in the engines! They're used to feed the data about engine performance to FADECs (http://en.wikipedia.org/wiki/FADEC) and the crew.
But they're totally useless for airspeed calculation! Bear in mind that air flowing trough and around the engine has totally different dynamics than the air passing around the rest of the airframe. Well, that's kind of the point of the engine - to create thrust, isn't it? That's why airspeed, altitude and AoA sensors actually have to be placed further away from the engines - so that they give as accurate picture as possible.
Can't you compensate for that? Most of the time planes fly normally - data could be gathered on how to relate the readings of engine management sensors to airspeed.
I don't mean using it as a primary source for airspeed data, but backups in case other sources show weird or no data. The data that comes from those sensors already enters the cockpit, so it would make sense to use it.
You might be able to, but I imagine the calculations will be very complex and readings will be highly unreliable in anything but ideal conditions and constant speed level flight.
But yes, I think the conclusion after AF447 investigation is completed will be that some kind of back-up speed indicator is needed beyond pitot tubes.
perhaps you can show at least ONE incident that happened because "third world pilots rely too much on autopilot"? I'm genuinely interested, 'cause I'm aviation enthusiast and haven't heard of any.
I wonder if you could accurately measure airspeed acoustically, instead of using pitot tubes and pressure? For instance, suppose you placed microphones near the trailing edge of the front wings, and near the leading edge of the rear wings.
Compare the sound of the engines as picked up by the front microphones and the rear microphones, and figure out how far behind the latter is shifted in time compared to the former. The faster the plane is going relative to the air, the shorter that time should be.
If the engine sound is too uniform to provide any way to match up the sound as recorded from the two locations, some kind of sound source could be added.
I wonder if you could accurately measure airspeed acoustically, instead of using pitot tubes and pressure? For instance, suppose you placed microphones near the trailing edge of the front wings, and near the leading edge of the rear wings.
But microphones ARE measuring pressure!
Basically you propose the same method for measuring airspeed, except less precise and as prone to disturbances by external objects (like ice).
Anybody read Airframe by Michael Crichton? Similar thing happens, and the recordings show an experienced pilot makes questionable moves to correct the problem. In the end, it turns out that the pilot's son was flying the plane when it happened.
In most aircraft and certainly in jets, you have six primary instruments: airspeed indicator, attitude indicator (artificial horizon), altimeter, turn indicator, heading indicator, and a horizontal speed indicator.
The attitude, turn, and heading indicators rely on gyroscopes that are propelled by a vacuum pump and/or electric motors.
Airspeed, altimeter, and vertical speed indicators rely on a pitot-static system. The pitot tube must be exposed to the air that is uninterrupted by the plane's passage. The static port(s) must be positioned where the air is calm and undisturbed.
Each instrument of the pitot-static system relies on pressure differentials, but only the airspeed indicator is reliant on both the pitot tube and the static port. The other two instruments rely on the static port and vents or calibrated leaks.
Part of a pilot's primary training and certainly part of instrument training is in recognizing failures in this crucial system. For example, let's say you take off and your airspeed slowly drops to zero but you remain flying. There's a good chance you've got a blocked pitot tube. This is a simple example, but pilots are trained on this and other failure scenarios during primary and instrument courses. Pilots that want to die of old age train themselves beyond what's required by these courses.
At lower altitude in visual flying conditions, these failures aren't as deadly, primarily because one can still see the horizon. But high altitudes remove most of the visual cues, requiring pilots to trust the hell out of those instruments...except when they can't.
Someone else said it, but these guys lost situational awareness; I'm guessing that all of the warnings going off just overloaded them and caused them to overlook the clues that would have saved them. I've personally never flown anything bigger than a six-place Beechcraft, but I've had enough scary moments with buzzers and lights flashing to appreciate just how much pressure that situation would have caused.