This article is Chapter 5, of the synthetic analysis and timeline that is derived from our Air France, Flight 447 Research. Target date to have all chapters online is April 1, 2012. Photos and technical graphs are presented in a larger size than is usual for a web page so that details and small font text may be read as easily as possible. This web page was coded for 1280 x 800 monitor display which is a wide screen (landscape) format. Printout of Chapter 3 will be ~49 pages in 11 x 8.5 inch format. Please bookmark this page and occasionally check back to remain current with the publication schedule for the AF 447 Project.
Comments and opinions in this article are the sole responsibility of Bennett Blumenberg and do not reflect the views of any organization, government or private, that are mentioned in this article. The author does not have any relationship, public or private with the individuals, corporations and organizations referenced or mentioned in this article.
Our Air France 447 research project will result in ~200 web pages, organized as an eBook with chapters, when completed. A professional background is not requisite to understand most of this presentation. Technical text and graphs can be skipped over by those so inclined. The situational awareness of Air France Flight 447 is complicated, that is the reality of this disaster, and there are several scenarios to be dissected and then interwoven. Contrary to some published analysis of this tragedy, it cannot be explained by pilot error. Elevating 'pilot error' to a position of priority and most importance only serves to erect a large screen that blocks out the multiple parameters that coalesced to produced this most awful commercial aircraft accident. Yes, the pilots in the cockpit of this Airbus A300 aircraft did make errors in judgment. They made decisions that in hindsight do not seem first rate, but then their situational awareness had been destroyed. In the dark of early morning hours, a crisis came upon F- CZCP that rapidly placed all lives at risk. The emphasis upon 'pilot error' is particularly insidious when used by the BEA of France. BEA is the rough equivalent in France of the American National Transportation and Safety Board, and is the government agency that conducts all investigations of incidents involving French aircraft and airlines when such an inquiry is warranted. BEA stands for B(bureau) E(nquiry) A(viation), which expands to Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile (BEA; English: Bureau of Enquiry and Analysis for Civil Aviation Safety]. BEA is known and respected throughout the world, make no mistake about that as you read criticisms of their investigation of Air France, Flight 447. Parallel to the investigation of the BEA are those of Airbus corporate, which may never be released to the public; and Air France, where at least a summary is expected for press publication.
FUTURE HYPERCOMPLEXITY METAPHOR for AVIATION INDUSTRY - SAMURI FIGHT ON WING OF AIRBUS THAT IS COMING APART AT LOW ALTITUDE - TRAGICALLY IN AN URBAN SETTING.
CGI Podborka Oboev
A valid and complete explanation for the Air France, Flight 447 tragedy must reference several complex situations in an integrated manner. Single variable explanations are naïve, simplistic and miss the larger view that the Airbus aircraft is designed to live its daily life with minimal human (pilot) input. State of the art aircraft computer systems have multiple levels of redundancy and are self healing to a remarkable degree. However, their intelligence is minimal and these systems cannot recognize certain critical situations as aberrant and dangerous, and deal with them with a self-protective protocol. This article casts a critical eye upon the 'systems engineering' employed in the design of airbus aircraft and aeronautics. This research has concludeD that the Airbus aircraft is a hyper-complex system that cannot interact effectively with situations such as that encountered by F-GZCP. In such an environment, aircraft [computer systems] do not recognize the realities a 'damaged' flight envelope, and therefore it responds with 'behaviors' that do not match reality, and do not support aircraft survival. The dysfunctional self protective aspects of this system present the human pilot with a severe problem if he/she wishes to gain immediate manual control of the aircraft. Aircraft responses become dysfunctional within seconds, and the lives of passengers and crew are rapidly placed in extreme danger. Precious time is lost as the crew attempts to decipher data and messages on the Primary Flight Display, some of which do not accurately reflect the crisis that has so rapidly manifested. An adequate model for the Flight 447 disaster calls into question the assumptions and design of the Airbus Fly-By-Wire system as presented on this web site.. Performance of FBW in certain crisis situations degrades the options for positive response. The Boeing Fly-By-Wire is less rigid and easier for the pilot to manipulate when he/she wishes to access Direct Law and manual control of the aircraft's flight behaviors. However, this article remains focused on Airbus aircraft and their 'systems' design because of recent incidents where the loss of lives was very high such as Air France 447, Flight 447 (May 31/June 2, 2009); and . Understandably, both corporates will not disclose most of the 'deep details' of their respective approaches to FBW. The 'picture' of each 'system', and identification of parameters that were important to the Air France, Flight 447 incident, are derived from published materials such as a corporate technical report or manual, or a blog discussion as indicated in the references that accompany each section of this eBook.
Unfortunately, corporate interests may have clouded aspects of the analysis as indicated by the response of pilot organizations and families to the presentations offered by BEA and Air France. Furthermore, years of industry promises that new state of the art, commercial aircraft, whose routine takeoff, flight and landings are largely under computer control, would provide the safest possible and superlative passenger experience unlike any offered previously, serve to dramatically heighten the emotional 'envelope' surround Air France 447, as witnessed by media reports and reactions of the general public. This author does not believe that the internal investigation conducted by Airbus on the Flight 447 incident will ever be made public, in whole or in part. Indeed for all we know, it has already been completed, and locked away from any but the top executives in the EADS and Airbus Company. For that reason, and in the interests that this 'synthetic analysis' be as complete as possible, a case study has been offered that illustrates how a breakdown in communication between engineers and management can dramatically effect an engineering priority that has life and death consequences.
PITOT STATIC SYSTEM / STRUCTURE and FUNCTION Back to Top
In 1732, Henri Pitot invented first instrument for measuring wind speed as he was interested in air speed as it related to boat speed. Pitot tubes are positioned at several different locations on an Airbus 330 as shown in this photograph. They face forward and air rushes in. Air pressure inside the Pitot tube is measured which allows for calculation of aircraft air speed relative to the air mass in which the jetliner is moving. As frequently mentioned, this data is used to compute aircraft speed which feeds into immediate decisions for Fly-by-Wire that are made by the Airbus central computer. Some of the data processing is transmitted to cockpit data displays. Pilots quickly scan complex and dynamic data displays in the cockpit and then make rapid decisions about what actions to take, if any, to adjust the aircraft flight envelope. Fly-By-Wire sets the limits wherein pilot decisions can be activated as always. Pitot probes (sensors) are a complex of pressure sensitive instruments that are attached to the aircraft's fuselage and are used to determine air speed. Air speed is the most important datum for aircraft's computer system. As shown below, the pitot sensory apparatus is best thought of as a 'system', several components that are interconnected and acting in concert to measure temperature, density, pressure and viscosity of the atmosphere surrounding the aircraft.
AIRBUS A330 LOCATIONS FOR PITOT PROBES (captain, f/o, standby), ANGLE of ATTACK PROBE (captain), STATIC PORTS (3), TAT (captain, f/o), TCAS & GPS (1 & 2 antennas), SATCOM ANTENNA, #1 VHF, and LOC ANTENNA (dual)
Locations for A330 probes, AoA, antenna
- posted by PJ2 to PPRuNe, June 29, 2009.
Pitot probes and static ports measure characteristics of the air mass that surrounds the aircraft. The Pitot-Static Tube page at NASA's Aerodynamics web site is particularly instructive. This data becomes input to the main computer system and then the calculations (instructions) that are sent to the autopilot which flies the aircraft through the defined flight envelope. Although heating elements are present in the pitot probe – static port system, the devices can become blocked by ice. This is a serious problem because data transmission from 'systems' in such a situation is corrupt, a situation that was apparently under investigation for several years before the tragedy of Air France, Flight 447. Errors or corrupt data can be lethal because the calculations generated from this data will be faulty, thereby causing the autopilot to guide the aircraft through a flight envelope that is not an accurate portrayal of the actual atmospheric and weather environment that surrounds the aircraft. If weather has become stormy with possible high winds, cold temperatures and ice, any aircraft performance that is not tightly related to the flight envelope can place the crew and passengers in extreme danger.
There are several manufacturers of Pitot probes that include Thales, Honeywell and Goodrich. The pitot-static system assesses an air gradient, measures pressure differences and uses these values to derive aircraft speed and altitude. These pressure readings are taken from either the static port (static pressure) or the pitot tube (pitot pressure). The static pressure reading is used in all measurements, while the pitot pressure is the only reading used by the central computer to determine air speed and therefore it has extreme importance. Corruption or absence of the pitot tube digital data flow to PRIM-1 is one of the most serious defects that occur during a flight because the calculations and instructions to the control flight surfaces that follow will be corrupt. The auto pilot actions force the aircraft into a maladapted flight pattern and lives are often immediately in danger. There are methods and preventive measures that can be taken that greatly reduce the probability that this worst case scenario is activated. Time is long overdue for this multifaceted protocol to be implemented, a cost effective analysis should not be placed on human lives. As the reader has already seen, elements of this protocol are introduced in this eBook in the chapters titled "Hypercomplexity 1", "2", "3" etc.
Pitot pressure is obtained from the pitot tube, and is a measure of ram pressure – the air pressure created by aircraft motion (air streaming into the tube.) Under ideal conditions, this ram pressure is equal to the 'stagnation pressure' (total pressure). Some aircraft have only one pitot tube which would be located on the wing or front section of the aircraft in order to minimize distortion by the aircraft's overall structure. As airspeed increases, ram air pressure increases.
PITOT STATIC SYSTEM / EQUATIONS for STATIC PRESSURE and VELOCITY Diagram - Pitot-Static tube / Bernoulli Equation NASA K-12 Aerodynamics / Prandtl Tube - Bernouilli's Equation for Statis Pressure and Velocity
Static pressure is obtained from the static port which is often a flush mounted hole on the fuselage, located where it can access air from a relatively undisturbed area. Some aircraft have only a single static port, others have one on either side of the fuselage. In the latter case, a more accurate average pressure is computed. Sometimes, an alternative static port is located inside the cabin of the aircraft, as a backup if the external static port(s) become blocked (ice). A pitot static tube effectively integrates the static port into the pitot probe. It utilizes a second coaxial tube(s) with pressure sampling holes on either side of the probe and outside the direct airflow, to measure the static pressure. As an aircraft gains altitude, the static pressure will decrease.
A330 - ANGLE of ATTACK VANES on FUSELAGE Photo - - A Personal Reflection on the Air France 447 Accident by Roger Wilco, January 7, 2011.
Corrupt data flow from the central computer also affects cockpit flight displays. Corrupt data displays severely degrade situational awareness, catalyze hesitation, mask the new realities of a rapidly changing flight envelope and promote potentially dangerous decisions. Furthermore, some options such as accessing Direct Law and manual control of the aircraft are not straightforward in Airbus aircraft. Such a situation was central to the crisis that Air France, Flight 447 faced in the early hours of June 1, 2009.
Flush ports measure static pressure (Ps), the pitot probe or static port system measures total pressure (Pt), impact temperature (Ti), angle of attack and sideslip are recorded by probes exposed to the ambient air surrounding the aircraft. From these five parameters, 'systems' computes: airspeed (Vc), total air temperature (TAT), true air speed (TAS), altitude (height of aircraft) – H, altitude rate (Vz), Mach Number (M), true angle of attack (AOA) and true angle of slideslip (SSA).
To quote and paraphrase from the NASA web page: Pitot-static ('tube' in the USA, 'probe' everywhere else) are used on aircraft as a speedometer, but very complex speedometers if comparisons were made to those more familiar such as automobile speedometers. The tube used on aircraft is about 10” (25 cm) with a 1/2” (1 cm) diameter. “Several small holes are drilled around the outside of the tube and a center hole is drilled down the axis of the tube. The outside holes are connected to one side of a device called a pressure transducer. The center hole in the tube is kept separate from the outside holes and is connected to the other side of the transducer. The transducer measures the difference in pressure in the two groups of tubes by measuring the strain in a thin element using an electronic strain gauge. The pitot-static tube is mounted on the aircraft so that the center tube is always pointed in the direction of the flow and the outside holes are perpendicular to the center tube. On some airplanes, the pitot-static tube is put on a longer boom sticking out of the nose of the plane or the wing.
Since the outside holes are perpendicular to the direction of flow, these tubes are pressurized by the local random component of the air velocity. The pressure in these tubes is the static pressure (ps) discussed in Bernoulli's equation. The center tube, however, is pointed in the direction of travel and is pressurized by both the random and the ordered air velocity. The pressure in this tube is the total pressure (pt) discussed in Bernoulli's equation. The pressure transducer measures the difference in total and static pressure which is the dynamic pressure.
With the difference in pressures measured and knowing the local value of air density from pressure and temperature measurements, we can use Bernoulli's equation to give us the velocity. Please refer to the NASA web page for the calculation of V(elocity) using the equations in the schematic above. This quote from the NASA web page is extremely important background to the early history of pitot-static probe design and deployment on Airbus aircraft. “If the tubes become clogged or pinched, the resulting pressures at the transducer are not the total and static pressures of the external flow. The transducer output is then used to calculate a velocity that is not the actual velocity of the flow. Several years ago, there were reports of icing problems occurring on airliner pitot-static probes. Output from the probes was used as part of the auto-pilot and flight control system. The solution to the icing problem was to install heaters on the probes to insure that the probe was not clogged by ice build-up.“
Standard Procedure for Pitot Probe Maintenance at Air France are described in the operator’s maintenance manual. The Pitot probes are subject to a daily visual inspection by a mechanic, who checks their general condition. The crew performs the Type C Check on the Pitot probes before each flight of the day:
• cleaning of the complete probe using compressed air (“blowing” operation),
• cleaning of the drains with a specific tool,
• test and check of probe heating by the standby electrical power supply system,
• check of the sealing of the circuits.
In the case of speed inconsistencies being reported by the crew, corrective actions are the same as those in the Type C checks. Air France, (EADS) Airbus, EASA and Thales have known about problems with pitots and severe weather (incl. Icing) since 1994.
PITOT-STATIC SYSTEM PROBLEMS / AIRBUS TIMELINE Back to Top
Problems with the pitot-static port system and the accurate measurement of air speed data were known to Airbus, and thereby we can presume EADS and Air France as well, for more than a decade prior to June 1, 2009 and the Air France Flight 447 tragedy.
A TAT measurement error is produced by ice crystals building up in an area on the aircraft which sensors are located. In one example, ice crystals are partially melted by the heating element of the pitot tubes which causes a 0 degree Centigrade reading. In some instances, the 0 degrees C reading stabilizes for a long enough time period to allow for notice by the pilots during aircraft descent. In other situations, the TAT is transitory and cannot provide an early warning about ice crystal build up.
Ice can cause: a reduction of lift, a reduction of stall angle, an increase in drag, a modification in longitudinal stability or an increase in weight. Rime ice, in some conditions, may also cause an increase in lift at low
incidences. Even a small amount of roughness on airfoil leading edge can decrease stall characteristics.
AIRBUS A320-232, FLIGHT HEATHROW (ENGLAND) TO EDINBURGH (SCOTLAND), NOVEMBER 29, 2003 Back to Top
AIRBUS A320-232, REGISTRATION G-EUUI, FLIGHT HEATHROW (ENGLAND) TO EDINBURGH (SCOTLAND), NOVEMBER 29, 2003 DAMAGED PITOT-STATIC SYSTEM, ADIRU and FLIGHT ENVELOPE/CRUISE
A particularly instructive Airbus A320 incident involving pitot probe system damage and malfunction is little mentioned in the aviation press. This flight and its subsequent 'incident' are worth reporting in detail because they reveal a scenario and information that is rarely available on the public record, and because this narrative has direct and important implications for the incident that Air France, Flight 447 experience May 30 - June 1, 2009, Rio de Janeiro to Paris. On November 29, 2003, a British Airways flight that utilized an Airbus A320-232, registration G-EUUI undertook a usual flight from Heathrow (England) to Edinburgh (Scotland). An experienced pilot of 39 years and 11,350 flying hours (930 hours on Airbus A320) led a crew of 7 and 92 passengers. Upon reaching cruise level of Flight Level (FL) 280 a brief noise and vibration went through the aircraft, to be repeated after approximately one minute had passed. The noise was two loud bangs which crew and passenger noticed, to be immediately followed by a shudder. An orange flash on the right engine had been seen, and the pilot identified that No.2 engine had surged and its gauges were rising to match those of the No.1 engine. Quickly, engines appeared to have recovered with all indications now indicating normal function. It must be stated that the Quick Reference Handbook on board, and the particulars of their flight training did not provide the crew with adequate background to fully assess this situation. Discussion and advice from operator brought forth a decision to return to Heathrow. At this point, the engines began to surge and recover repeatedly. The commander drew the co-pilot's attention to the right (No.2) engine EPR, N1 and EGT gauges which were reduced and returning to the levels seen on the No.1 (left) engine. The crew now believed that No.1 engine was also malfunctioning and they declared Mayday. A successful diversion to the Birmingham Airport concluded the flight. Weather was benign and not a factor in this incident.
Subsequent review revealed that a progressive fault in the No.2 engine P2T2 created faulty data in the transmission to the No.2 computer. This in turn created an incorrect scheduling of the compressor inlet guide vanes, which caused the engine surges. Four safety recommendations would follow. It is important to know the extent of crew training and procedures that were available to them when abnormal situations were present. Air France is now under a searchlight for possible inadequacies in crew training and less than rigorous procedures that a crew can access when something goes amiss with pitot probes and 'systems'.
As with so many Airbus aircraft, G-EUUI was equipped with the IAE V2500, a two shaft, high bypass, turbofan engine manufactured by International Aero Engines, a Swiss consortium that is backed by four aircraft engine manufacturers. The IAE V2500 may be the most successful, high bypass engine in history. More than 4,000 units have been delivered as it is the engine of choice to power the Airbus A320 family (A320, A321, A319, Corporate Jet) and the McDonnell Douglas MD-90.
“The V2500 turbofan engine is a two spool, axial flow, high bypass ratio turbofan engine. It has a single stage fan, a four stage Low Pressure (LP) compressor (booster) and a ten stage High Pressure (HP) compressor. The LP compressor is driven by a five stage LP turbine and the HP compressor is driven by a two stage HP turbine. It is equipped with a Full Authority Digital Engine Control (FADEC), which provides engine control and monitoring via a dual channel Electronic Engine Control (EEC) unit, and this takes data inputs from dedicated engine sensors to monitor and control the engine. The FADEC manages power according to two thrust modes; manual mode, where thrust is computed depending on Thrust Lever Angle (TLA), and autothrust mode, where an Engine Pressure Ratio (EPR) target is computed by the Flight Management and Guidance Computer (FMCG). The EEC compares this EPR target with the actual EPR and, together with other engine sensor data, calculates an error signal. The signal is then used to adjust the fuel flow and compressor airflow in order to achieve the required EPR.”
In what would now be deemed an inadequate procedure, British Airways had reproduced the Airbus Abnormal Procedures in their Operations Manual (OM) as separate drills, depending upon whether or not the aircraft was fitted with IAE or CFM engines. The two Airbus checklists had been combined by British Airways into one checklist. However, Sections of the Airbus ENG 1(2) Stall Abnormal Procedure for aircraft fitted out with IAE engines were omitted in the BA checklist.
The omitted material includes:
“A stall may be indicated by varying degrees of abnormal engine noises, accompanied by flame from the engine exhaust (and possibly from the engine inlet in [a] severe case), fluctuating performance parameters, sluggish or no throttle response, high EGT and/or a rapid EGT rise when thrust lever is advanced.
This preamble illustrates that an engine surge can cause a wide variety of symptoms and, as such, represents valuable advice to flight crews.
Later in the procedure, after an instruction to check that the engine parameters on the affected engine are normal with the thrust lever at idle, the drill continues as follows:
ENG A. ICE (affected engine)...............................................................ON
WING A. ICE ........................................................................................ON
Operation of engine and wing anti ice will increase the stall margin, but EGT will increase accordingly.
THR LEVER (affected engine)..........................................SLOWLY ADVANCE •
THR LEVER (affected engine).........................................................REDUCE
Reduce thrust and operate below the stall threshold.
The above two advisory sentences, after the action to switch the WING A-ICE to ON and the instruction to REDUCE the THR LEVER, respectively, are, again, absent in the manufacturer's QRH procedure. The manufacturer's FCOM procedure also states that, in flight: Only ENG1(2) STALL is displayed on ECAM! This information is reproduced in the QRH procedure.
After this incident, the operator drafted a revised ENG 1(2) STALL abnormal and emergency procedure for the QRH, which included the initial preamble at the beginning of the manufacturer's full FCOM procedure. However, not all the explanatory material contained in the manufacturer's procedure was added in this revision, which had yet to be issued at the time of writing.
The operator stated that the volume of the Operations Manual which contains the full ENG 1(2) STALL procedure is available to crews in flight. However, the workload during an abnormal event could be such that crews would normally only be expected to refer to the ECAM and QRH and not resort to another publication, unless previously trained to do so.” This editor comments: "Is this Outrageous, or What"
AIRBUS A320-232, FLIGHT HEATHROW TO EDINBURGH / ENGINE POST-MORTEM Back to Top
No.1 Engine of G-EUUI was examined with the standard troubleshooting procedure, The solenoid bleed valves were corroded in a fashion that the manufacturer stated had not been seen previously. Nonetheless, no faults were found and No.1 engine passed the EEC Built In Equipment Check (BITE) without errors and the T2 indication was 'normal'. However, the No.2 Engine produced errors related to the T2 and two Class 3 messages as well. These messages revealed that a surge had occurred at 1949 hours, and that another five legs previously. The initial surge message was latched as a Class 3 message at the first time it was detected, therefore subsequent surges would not have been recorded as additional messages. What ever the probability of a serious, possibly life endangering situation, what amounts to a 'dismissal' of such events and the near absence of information available to the cockpit appears to this writer as 'cavalier' and irresponsible decisions when this message function was initially designed.
Trouble shooting also revealed via the Data Management Unit (DMU) that both No.1 engine P2T2 probe and aircraft TAT were in agreement to within 1ºC, BUT that No.2 engine probe indicated a value 36ºC lower. As can be read further along in the main document, this inability for an engine probe to come into agreement with TAT can have serious consequences for the internal check upon data that is sent to 'systems' , and subsequent calculations that send instructions to flight control surfaces. To further describe the consequences of this problem for aircraft performance within the assigned flight envelope for G-EUUI, this text from the AAIB report is quoted. Such detailed insight into the function of Fly-By-Wire, Flight Control, is not often found in documents whose access is not restricted. We hope that the BEA final report will contain this level of disclosure and detail about the damaged data gathering functions of the P2T2 probe, dysfunctional ADIRU transmission and the central computer's reactions to the absence of a required, ever-present data stream during the last agonizing minutes of F-GZCP during Air France, Flight 447.
“At 19:49:24 hrs, as the EPR command reduced on both engines when the aircraft was leveling at FL280, there was a surge on the No 2 engine. This was indicated by a divergence of the actual EPR from the commanded EPR, accompanied by a dip in the fuel flow. This was followed by two further surges at 19:49:31 and 19:52:10 hrs, indicating that the engine had not fully stabilized following the previous occurrence. The fuel flow data showed a reduction at these times indicating that the EEC surge recovery logic control was operating to allow the engine to recover. The surge events were all coincident with autothrust commands to reduce engine power. The EGT data showed that, subsequent to these surges, a difference of 35-40°C existed between the values for the No 1 and No 2 engines. Further analysis of the data by the engine manufacturer revealed that the VSV angle was approximately 7° more open on the No 2 engine than the No 1 engine, as a result of the difference in T2 sensed by each engine. The position of the VSVs demanded by the EEC depend on the T2 temperature measurement and the effect of a considerably lower T2 was to schedule the vanes more open than necessary, thus increasing the air mass flow to the HP compressor. During the cruise at 20:10:45 hrs, when the autothrust signaled a small reduction in engine power, the EPR command reduced on both engines. The No 2 engine surged and this was followed by a secondary surge at 20:10:55 hrs as the power was reduced further. The EPR value decayed to around 0.93 whilst the No 1 engine EPR remained at the commanded value of 0.96. There was a further surge on No 2 engine at 20:11:25 hrs followed by a secondary surge at 20:11:37 hrs, again associated with small power changes. When the autothrust reduced engine power to commence the descent into Birmingham, at 20:12:08 hrs, the No 2 engine surged again followed by a secondary surge at 20:12:16 hrs. A higher EGT was noted on the No 2 engine compared to the No 1 engine during the descent.”
Both engines had been fitted to this aircraft since new and both had completed 1,620 hours and 959 cycles. Analysis by the operator of previous takeoff and cruise reports from AIDS indicated that, around 7 November 2003, the No 2 engine T2 value had started to diverge from the No 1 engine and the aircraft TAT probe readings. Based on the stored data, it is expected that the T2SSF fault would first have been detected around 20 November 2003. However, the SMR messages on which T2SSF faults are recorded were only checked by the operator every 500 hours.
AIRBUS A320-232, FLIGHT HEATHROW TO EDINBURGH / P2T2 PROBE DAMAGE Back to Top
The P2T2 probe was removed and examined by its manufacturer. The probe consists of an aerodynamic housing inside which a tube, containing the two independent electrical resistance temperature sensing elements, are located. These two elements (Channels A and B) are contained within inner and outer shields and cracks were found within both elements. These had allowed moisture to enter the dielectric material within the resistance elements and cause false temperature indications on both channels. The initial testing confirmed that, compared with the test points, a low temperature on Channel A was recorded, but Channel B results were closer to the test point. It was likely that the time between the incident and the probe examination allowed any moisture to dry out, at different rates, and hence be responsible for Channels A and B producing different test results.
The two independent, electrical resistance, temperature sensing elements (Channels A and B) of the P2T2 probe are contained within inner and outer shields, both of which were cracked. Moisture had entered the dielectric material within the resistance elements. This situation caused false temperature to be produced on both Channel A and Channel B. This P2T2 probe conforms to the 'long probe' design which was introduced in 1999, and by the time of the incident with A320 G-EUUI,, 1,170 'long probes' had been placed in service. According to the probe manufacturer, there had been five previous potential, dual element, failures and one single element failure of the 'long probe' design. This record does indicate a low probability of failure – 0.513%, lower than that of the previous probe model. However, this rate for dual element failure is high than predicted in the Failure Modes Effect Analysis (FMEA) and the manufacturer committed to further work to determine the reasons for these failures.
Back to the A320.232-G-EUUI and the flight on November 3, 2009 .. It is worth discussing the AAIB report in detail once again, and quoting where germane. This AAIB report concluded that during the short duration surges on the right engine, the crew were faced with a situation for which their training and QRH were inadequate. IF the QRH checklist had included all the advice and instructions contained in the aircraft's manufacturer's complete FCOM “abnormal procedure, then the crew may have been prompted to take action at the outset of the surges and complete the ENG 1(2) STALL drill. However, the manufacturer's procedure indicated that on this aircraft type, with IAE engines fitted, there would be an ENG 1(2) STALL message on the ECAM in the event of an engine surge. This was misleading. G-EUUI was operating with the SCN-16 EEC software standard, which was not able to inform the crew that a surge had occurred unless the surge caused engine parameters to exceed specified limits for longer than two seconds (or in which engine). As the preamble at the beginning of the aircraft manufacturer's FCOM abnormal procedure illustrated, an engine surge could be associated with a wide variety of symptoms.”
“The flight crew's decision not to follow the QRH procedure for a 'stall' on the right engine, up to the point that they decided to divert, was understandable since it accorded with a reasonable interpretation of that QRH drill. When both engines were thought to be surging, which was a mistaken belief because the left engine was in fact operating normally, there was a suspicion that the crew was facing a more complicated problem. With that in mind, they carried out part of the ENG STALL Procedure, but not all of it. This was the result of a keen desire to land at Birmingham without delay, not being sure what was wrong with the engines. Had the crew been given all the relevant information, as contained in the manufacturer's FCOM abnormal procedure, in the operator's QRH, plus the knowledge that an engine stall (surge) might not prompt an ECAM message, then they would have had all the advice needed for them to know that it was appropriate to follow the ENG STALL procedure. In doing so the situation would not have developed as it did. If the latest EEC software standard had been installed, a surge warning would have been displayed on the ECAM after the initial short surge. This would have assisted the flight crew in determining which engine was surging and would have fitted with the manufacturer's ENG 1(2) STALL procedure. All V2500-A5 operators are being encouraged [!ENCOURAGED, how REQUIRED?] by the manufacturer to adopt the new software standard as soon as possible. Having experienced the first surges on No 2 engine as the aircraft leveled at FL280, the later power reduction commanded on both engines to an EPR of 0.96, which was accompanied by the noise of No 2 engine surging, may have given the flight deck crew the impression, albeit erroneous, that both engines had in fact surged. It was this belief that led the crew to divert to Birmingham Airport. In the light of that, it was a reasonable and prudent decision to take.”
Examination of the engines identified a fault on the No 2 Engine T2 sensor and analysis of the data confirmed that there had been surges only on this engine. Analysis of the onboard maintenance system identified that the T2 sensor was reading a significantly lower temperature than that of either the No 1 engine or the aircraft TAT probes, the effect of this being for the VSV system to set an incorrect VSV angle for the engine operating conditions. This led to a reduced surge margin during engine power reduction and hence the surges experienced. Analysis of the EGT data showed that, after the first surges, a difference of 35-40°C existed between the EGT of
the two engines which did not exist following the second surges. The most likely explanation for this was a sticking BV or solenoid, as the temperature difference was consistent with a stage 7 BV stuck open. The higher EGT noted on the No 2 engine compared to the No 1 engine during descent into Birmingham was probably attributable to a leaking BV. However, the subsequent examination by the manufacturer confirmed the correct
operation of the bleed valves, despite the presence of some internal corrosion within the solenoid unit of the stage 10 BV.”
“The classification of the T2SSF message as Class 3, led to the P2T2 probe failure not being identified until after this incident had occurred, although the CFDIU had probably received the first failure message some nine days prior to this flight. Although in this case the aircraft landed safely, the continued dispatch of the aircraft with a failure known only to the on board maintenance system, could have led to a more serious engine surge problem on a subsequent flight. The loss of a primary engine input, such as TAT, would appear to require a higher priority in the CFDS so that a status message in the post flight report is produced. [This author is near speechless at reading this last sentence. Or shall we say typing fingers have experienced a major fault and no longer function properly within the required PC keyboard interface? The first recommendation after reviewing a flight incident with a P2T2 probe failure is to change the priority of a post flight report item!]” Yes, AAIB had more to say about what might be done..
PAKISTAN INTERNATIONAL AIRWAYS (PK-340)/KARACHI TO FAISALABAD - EMERGENCY LANDING, APRIL 17, 2007. Back to Top
On Tuesday April 17, 2007, Pakistan International Airways Flight 340 Karachi to Faisalabad experienced serious flight control problems. The pilot chose to divert back to Karachi for an emergency landing during which all eight tires blew out. Passengers and crew numbered 110 and there were no serious injuries to anyone. The aircraft was an Airbus A310-308, registration AP-BDZ which experienced an incident in November, 2006. The analysis of the situation, revealed information that is germane to the situation with AF 447 two years later. It is almost impossible to obtain photographs of post-incident pitot-static equipment from a post accident analysis. For obvious reasons, the corporate world will withhold such information from news media and the public. There are no expectations that BEA will release such data in their final public report about the Air France 447 incident.
This incident is reported on the History of PIA Blog. Among the details set forth are that the controls were sluggish in response, and the Air Speed Indicators for the Captain and F/O read very differently, perhaps 100 knots or more. Soon after takeoff, the pilot lost control of AP-BDZ an the plane started to sink after reaching an altitude of 1,000 meters. There seemed to be a distinctly asymmetrical sense of air speed between the left and right sides. Commissioned in 1991, AP-BDZ should have been retired as it was likely being flown after its designated lifetime had expired. Two similar incidents before that of April 17, 2007 failed to reveal a specific cause for the problems, although the nose gear has sustained excessive loads. It does appear that the captain and f/o were working to cross purposes vs a vs increase or decrease airspeed. Actual air and ground speeds could have been determined from the approach controller of ACC of KHI radar. From one blog posting: "I have seen the DFDR readout, the aircraft landed with a pitch angle of -2.1, also both the engines were over-boosted beyond the allowable limit." It does seem that data from the Air Data Computer was corrupted, possibly by a blocked or defective pitot-static system. Once again training has been criticized, particularly that of coordination between crew members. Perhaps the most astute remark is one that re-appears frequently. When the incident is upon aircraft and crew, that most pilots and crew have to exert maximum self discipline to maintain a disciplined situational awareness. No criticism of the crew should ever be intended when Fear enters the cockpit.
The EEC logic normally takes the TAT values from the left ADIRU. However should the difference between the aircraft TAT and the equivalent temperature sensed by an engine's T2 probe exceed a given range, the TAT signal is rejected and individual engine T2 data is used. This provides an independent temperature signal for each engine should a problem exist with the aircraft's left ADIRU TAT value. However, in this case the logic led the EEC to select an erroneous TAT signal when it had already recorded the T2SSF fault message relating to this signal, even though two valid sources, from the left and right aircraft ADIRUs, were available. In addition, a soft fault such as the erroneous T2 signal in this case, was not brought to the attention of the flight or maintenance crews by the monitoring systems on board the aircraft due to the way in which it had been classified. Therefore the following three recommendations [correction – 'four recommendations – see below] are made:
Safety Recommendation 2004-59 -
It is recommended that Airbus Industrie and IAE review the EEC logic on the V2500 engine fitted to the A320 aircraft, regarding the selection of a temperature source, in the event that the system detects a greater than normally permitted difference between the available sources, so that an erroneous signal is not used for engine control.
Safety Recommendation 2004-60 -
It is recommended that Airbus Industrie review the logic of the Centralized Fault Data Interface Unit (CFDIU) and the Engine Electronic Control (EEC) on A320 aircraft fitted with the V2500 engine, with respect to the Class 3 classification (a fault having no impact on flight safety) of a T2 Sensor Soft Fault (SSF), so that soft faults, such as an erroneous signal, are brought to the attention of flight and maintenance crews at the earliest opportunity.
Safety Recommendation 2004-61-
It is recommended that Airbus Industrie review the ENG 1(2) STALL abnormal procedure for the A320 to reflect the ECAM messages which crews can or cannot expect to see during engine stall events on aircraft fitted with IAE V2500 engines, taking account of the EEC software standard installed. Had the operator's QRH checklist, which was derived from the QRH provided by the aircraft manufacturer, included all the relevant advice and instructions already contained in the manufacturer's FCOM procedure, then the crew may have been prompted to take action at the onset of the surges and complete the ENG 1(2) STALL drill. The following recommendation is therefore made.
Safety Recommendation 2004-62-
“It is recommended that Airbus Industrie review the content of the ENG 1(2) STALL checklist, as it appears in their A320 QRH, to ensure that it includes all the advice and information contained in the abnormal procedure for the same event, as laid out in their Flight Crew Operations Manual.”
The Follow-Up Report from the Civil Aviation Authority (UK), that was published on December 24, 2004, evinces a strange lack of concern nor indication that the experience of G-EUUI during the flight in question was particularly dangerous. There were four Recommendations made: a) review the EEC logic on A320 aircraft fitted with V2500 engines regarding selection of temperature source; b) review the logic of the Centralized Fault Data Interface Unit (CFDIU) and Engine Electronic Control (EEC) on same Airbus aircraft with respect to Class 3 classification (faults having no impact on flight safety) of a T2 Sensor Soft Fault (SSF); c) review ENG 1(2) STALL procedure for ECAM messages that crew is expected to see (or not see) during engine stall events on aircraft fitted out as described; and d) Airbus to review ENG 1(2) STALL checklist for completeness as regards event under scrutiny. None of the recommendations were addressed to the CAA and the casual approach to this revised 'training' is highly disturbing.
TIMELINE OF PITOT-STATIC SYSTEM PROBLEMS ON AIRBUS AIRCRAFT, 1993 - 2009 Back to Top
Documented events and commercial aircraft incidents that reveal a direct involvement of the pitot-static sensor/ record / transmit complex begin in 1963. Aircraft incidents whose profile was not deemed appropriate for the public domain theoretically include all those involving military aircraft and the research and development of advanced aircraft and space mission transports at Groom Lake, Nevada and other localities.
This timeline begins in November, 1996 when Airbus issued a T(echnical) F(ollow) U(p) to replace one that was issued in December, 1995. It is worth quoting text from the November 1996 TFU because the problem addressed for A330 and A340 aircraft bears a close resemblance to that encountered by Air France, Flight 447 thirteen (13) years later in 2009! This research module will shed light on the extraordinary lack of professionalism and attention by Airbus and ?Air France to serious maintenance issues with the pitot-static system that were emerging in the early 1990s. The pitot system used by Airbus in November 1996 was made by Rosemount, but the professional obligations for maintenance were identical to what would surface in later years with pitot-static systems made by other manufacturers.
Yet another complexity is the weather analysis. Limitations that are set upon pitot-static system function may derive from weather conditions that are very unusual and more extreme than those for which a probe-static system unit is certified. These HIWC models are described and discussed in Air France, Flight 447 - The Last Five Minutes; and b) Air France, Flight 447 - Final Weather / A Synthetic Analysis. This material describes weather situations that are difficult to document, are likely invisible in terms of cockpit display, environmental variations and situational awareness. An understanding is now emerging that such HIWC weather patterns are not frequent in the ITCZ. They carry with them very serious consequences for shredding situational awareness and seriously endangering the aircraft and everyone on board. There is no indication that these weather environments are under professional scrutiny by Airbus and/or BEA and/or Air France for their relevance to design changes in the Airbus computer system and/or software design; and/or changes in Airbus family structural (fuselage) elements.
3. This TFU was considered closed because a solution was available. Airbus had 'launched' the development of a new pitot probe (cf Rosemount) that matched the new requirements. Flight tests and wind tunnel tests were completed. The FCPC logic was improved so that it would revert back to Normal Law after airspeed had recovered consistent values between 'each others' . . . The potential for airspeed discrepancies under marginal weather conditions had been considerably reduced via the functional check, leak test, flush test.
Installation procedure for the pitot probes now ensured that the draining holes in the pitot were not obstructed by foreign materials. Unfortunately, rather than setting a potentially serious problem to rest, this 1996 Airbus TFU represents an early documentation of an
awareness of the problem that recommended a solution but failed to prove effective.
November 1996: The probe Rosemount P / N 0851GR is replaced by the probe Goodrich P / N 0851HL, (Service Bulletin A330-34-3038 for Model A330-301, -321, -322, -341, and -342 Series Airplanes) (ref. FAA states that this replacement is made necessary because the inconsistency of measured velocities can cause the A330 to fly outside its flight envelope). This new probe is duly certified by Airbus.
December 1998: Emergence of the probe Sextant P / N C16195AA who replaces her as the probe Rosemount P / N 0851GR but for a limited number of A330 (Service Bulletin A330-34-3071 for Model A330-301 Series Airplanes) (ref.FAA). Was the new probe certified by the DGCA considering the experience with the Rosemount pitot? For more demonstrates its inefficiency!
Airbus issued a revised S(ervice) I(information) L(etter) 34-026 - on November 22, 1999 for all commercial aircraft to address problems with the pitot probe system . Following reports of inconsistent air speed problems, it was decided to replace by December 31, 2003, the Rosemount pitot probes that were standard equipment on A330/A340. Their successors were either the a) Goodrich 0581 HL probe; or b) Thales C16195AA probes. However, problems continued but recognition of reality by the airline industry was glacial." This SIL was subsequently revised in 2008 – see below.
GSAC (Direction Generale de l'Aviation Civile) issued an Airworthiness directive on August 8, 2001, clearly stating that the modifications described are to be treated as “mandatory” for Airbus aircraft models -301, -321, -322, -341 and -342. “Operators have reported cases of loss or fluctuations in air speed indications in severe weather conditions. Following investigation, the cause of these anomalies prove to be the presence of ice crystals and / or water in the Pitot probes ROSEMOUNT P / N 0851GR in upper limits original specifications. The installation of these new design pitot probes, that were newly certified and met criteria more stringent than previous models, was deemed mandatory.
The following measures are rendered mandatory from the date of entry into force of this AD Airworthiness: Before December 31, 2003, unless already accomplished, remove the Pitot probes ROSEMOUNT P / N 0851GR and replace either by probe type BF Goodrich Aerospace P / N 0851HL, according to the instructions of SB A330-34-3038, or by type probes SEXTANT P / N C16195AA in accordance with the instructions of SB A330-34-3071.
On April 7, 2004, The Federal Aviation Administration (United States) issued a comprehensive Airworthiness Directive about pitot probes that was applicable to families of Airbus aircraft up to and including A330. Service
Bulletins are mentioned that date back to June 25, 1976. Service Bulletins that are incorporated by reference date back to January 3, 1980. Replacement, configuration and testing of pitot probe – static systems cost estimates vary. Parts cost are as low as $120 (A300 configuration) to $56,669 (A300 configuration), with most estimates $5700-$6000, $11,000. Time for compliance is 30 months. The substance of the directive is as follows:
“Compliance: Required as indicated, unless accomplished previously. To prevent loss or fluctuation of indicated airspeed, which could result in misleading information being provided to the flight crew, accomplish the following: For Model A300 B2 and A300 B4 Series Airplanes; Model A300 B4–600, A300 B4–600R, and A300 F4–600R (Collectively Called A300–600) Series Airplanes; and Model A310 Series Airplanes: Replacement of Pitot Probes With New Pitot Probes (a) Within 30 months after the effective date of this AD, do the action specified in
paragraph (a)(1) or (a)(2) of this AD, as applicable. . . . For Model A319, A320, and A321 Series Airplanes: Replacement of Thales Pitot Probes f) For Model A319, A320, and A321 series airplanes: Within 24 months after the effective date of this AD: Replace the Thales (formerly Sextant) pitot probes in zones 125, 9DA2, and 122 with new Thales pitot probes, per the Accomplishment Instructions of Airbus Service Bulletin A320–34–1127, Revision 01, dated December 4, 2001. Replacements accomplished before the effective date of this AD per the original issue of Airbus Service Bulletin A320–34–1127, dated April 24, 1997, are acceptable for compliance with this paragraph. For Model A330–301, – 321, –322, –341, and –342 Series Airplanes: Replacement of Rosemount Pitot Probes (g) Within 30 months after the effective date of this AD, do the action specified in paragraph (g)(1) or (g)(2) of this AD, as applicable. (1) For Model A330–301, –321, –322, –341, and –342 series airplanes: Replace the Rosemount pitot probes in zones 121 and 122 with new Rosemount (formerly BF Goodrich) pitot probes, per the Accomplishment Instructions of Airbus Service Bulletin A330–34–3038, Revision 01, dated September 14, 2001. Replacements accomplished before the effective date of this AD per Airbus Service Bulletin A330–34–3038, dated November 19, 1996, are acceptable for compliance with the corresponding action required by this paragraph. (2) For Model A330–301 series airplanes: Replace the Rosemount pitot probes in zones 121 and 122 with new Thales (formerly Sextant) pitot probes, per Airbus Service Bulletin A330–34–3071, Revision 01, dated May 3, 2001. Replacements accomplished before the effective
date of this AD per the Accomplishment Instructions of Airbus Service Bulletin A330–34–3071, dated December 11, 1998, are acceptable for compliance with the corresponding action required by this paragraph.”
Thales Avionics SA (France) is a very important subcontractor for Airbus. The company makes a variety of critical components for Airbus aircraft that include Pitot probes, Pitot tubes, Angle of Attack Indicators, On-board Navigation Systems, Electronic Flight Systems, and Flight Management Systems. EASA Service Bulletins issued in 2007, then revised in 2008 recommended replacement of the Thales C16195AA probes by Thales C16195BA probes. On June 11, 2009 Air France reported that parts necessary to retrofit the pitot tubes arrived on May 29, 2009 two days prior to the crash of Air France Flight 447. The pitot replacement program at Air France began that day and was accelerated by the winter of 2011 if not earlier.
A330 SERVICE BULLETIN / REVISION TRANSMITTAL SHEET / ATA SYSTEM : 34 TITLE : NAVIGATION - SENSORS POWER SUPPLY AND SWITCHING - INSTALL THALES PITOT PROBES PN C16195BA, November 12, 2008. The probe to be installed is that developed in the Adeline program – Thales Pitot Probe PN C16195BA. Among the possible defects uncovered in the Adeline research program is one that is particularly insidious. “Strong Cumulo – Nimbus (Cb) containing a high density of ice crystals can be encountered, particularly in the Intertropical Convergence Zone (ITCZ). In such an icy and
turbulent atmosphere, the A/C Air Data parameters (Pressure dependent) may be severely degraded, even though the probe heaters work properly.
“It appears that the characteristics of such an environment could exceed the weather specifications for which the pitot probe are currently certified. “The weather specifications (icing/liquid water content/gutlet size) to which the pitot probes shall resist have therefore been updated with more stringent requirements on the base of the field experience and recent extensive flight tests.”
All flight and wind tunnel tests were completed and deemed successful. Certification of the new pitot probe was obtained, Improvements were made to the FCPC logic to revert back to 'Normal Laws' after airspeed recovers consistent values between each others …. “The potential for airspeed discrepancies under marginal weather, the AMM procedures (functional check, leak test, flush test, pitot installation) are updated in the next revision to ensure that the draining holes are not obstructed by foreign materials.” It is sad to now realize that that the Adeline research program was not entirely successful, and that defective pitot probes would continue to be installed in Airbus aircraft. It is very unlikely that the exact deficiencies in the Adeline research program will ever be known, nor will it be possible to know the extent to which the research staff decided to determine certain test results in the wind tunnel and AMM procedures to be non-significant when subsequent incidents with Airbus aircraft strongly indicated otherwise. That such judgments were made seems an unavoidable conclusion, but whether they were mistakenly made in good faith, or with conscious cynicism is yet another serious matter that will likely be impossible to determine.
Airbus issued a revised S(ervice) I(information) L(etter) on June 3-4, 2008 titled “Erratic Airspeed Indication – Pitot Probes Maintenance Action” which was intended for all commercial aircraft then in use. This SIL updated SIL 34-026 which was issued on November 22, 1999. Research confirmed that almost all instances where data for airspeed that revealed internal discrepancies were caused by “Pitot probe perturbation under marginal weather conditions that facilitated obstruction by external particles.” On A320 aircraft, water ingress and blockage of Pitot probe draining holes by wind driven particles appeared to cause most of the airspeed discrepancy events. This SIL had three objectives: a) introduce a new and required scheduled maintenance protocol that is intended to minimize occurrence of airspeed data that is corrupt and contains discrepancies; b) recommend actions to be taken when probes are reporting corrupt and/or incorrect data; and c) replace existing pitot probes on A320 family aircraft with Thales C16195BA probe which had just been certified for these aircraft.
Issue date August 20, 2008. Air France released NT 34-029 with Reference to SIL 34-084 regarding Treatment of Incidents with Loss of Air Speed Function. From Page 3 - “Investigations conducted on Airbus family aircraft showed that most of airspeed discrepancy events were due to Pitot water ingress and to probe draining holes obstructed by external particles. Another hypothesis is in study on a possible saturation of pitots by crystallized ice in high flight level.” “In particular flight condition, a speed discrepancy between system 1 and 2 or total loss of airspeed indications could appear with auto pilot disengagement, auto thr off, etc.”
F/CTL ALTN LAW
WINDSHEAR DETECT FAULOT
NAVE IAS DISCREPANCY
AUTO FLT AP OFF
AUTO FLT A/THR OFF”
“ These characteristics warning appeared simultaneously, the auto pilot disengagement occur when system 1 and 2 lose their information. [ Emphasis, author. System 1 and System 2 are the aircraft computers]”
Issue date August 20, 2008. Air France released NT 34-029 with Reference to SIL 34-084 regarding Treatment of Incidents with Loss of Air Speed Function.
“A new standard of pitot probe is available PN: C16195BA [Thales]. The installation of this PN is in progress by attrition on the fleet” [.. Author .. by attrition!!.. How long will this replacement take?] “The new pitot probe corrects the problems with enhanced water trap and relocated drain holes.” [Author .. There is no evidence available that justifies the certainty of this statement. Also .. no mention of heating element as a possible focal point for ice freezing problems.]
FAA AIRWORTHINESS DIRECTIVE / REPLACE THALES PITOT PROBES on AIRBUS AIRCRAFT / SEPT. 3, 2009 Back to Top
Airbus Telex to All Airbus customers: attention Support Managers (A330, A340-500/A340-600 Operators),
Subject ATA 34, Request for Information Concerning In-Flight Unreliable Airspeed, June 9, 2009. The concern in retrospect is the obvious. Why did it take a tragedy with all lives lost to generate this level of attention and concern about the Pitot probe – static system? Items in this Telex reveal a great deal about Airbus corporations knowledge base for the Pitot-probe – static system, and also their 'attitude' about the rapidly developing media interest in the crash of Air France, Flight 447, into the Atlantic Ocean.
Section 1/ of this Telex is 'Context', which title presumes to refresh the reader's memory as to the basic facts of this incident: a) that there are three 'standards' of pitot probes in service on A330/A340 aircraft, (Thales(ex Sextant)) PN C16195AA and PN C16195BA and Goodrich (Rosemount PN 0851HL); and b) AIR FRANCE, A320 F-GZCP WAS EQUIPPED WITH PITOT PN C16195AA which is the pitot probe system under review in the Adeline Program for performance defects when aircraft encounter high wind rain/ice conditions in the ITCZ and elsewhere. Airbus acknowledges in this Telex that in response to “intense speculation”, many Operators have contacted either Airbus or Thales to request an immediate replacement of the Thales AA probes with the BA upgrade model.
Operators are also lodging reports of recent and past aircraft incidents in which defective pitot probes appear to play an important role. Airbus requests that all Operators continue to report such incidents where unreliable air speed appears evident, particularly if Goodrich or Thales probes are in operation on said aircraft. The language used in this first section of the Telex implies that while “the jury is out” in the opinion of Airbus, they will continue to collect unreliable air speed data because of the concern among Operators. As of this date, there is no statement from Airbus as to probable cause, even as Operator concern mounts and targets for probable cause are identified What is helpful is that the Telex identifies the Typical Signature for Unreliable Air Speed data and the ECAM messages likely to be displayed on the PFD. Crew reports indicate loss or discrepant I(ndicated) A(ir) (S)peed ib CAPT and/or F/0 pFD and/or Standby Airspeed Indicator (ISIS). Fault message “PROBE-PITOT 1+2/2+3/1+3 is often seen. Maintenance Report clarifies that the events are Not due to System (central computer) Failure.
Operators are requested to continue to send reports to Airbus for aircraft incidents where the signature as defined is present. What is unfortunate is that it took an aircraft incident of the magnitude of Air France, Flight 447 with no survivors to generate this level of concern and professional action from the Airbus corporate. In retrospect, this Telex might have been generated several years earlier.
On January 15, 2009, Airbus issued an Emergency Airworthiness Directive (AD) that addressed issues with the Air Data Inertial Reference Unit (ADIRU), operational procedures. Specifically, aircraft experiencing a sudden nose down order while in cruise. This order was preceded by an automatic autopilot disconnection and triggering
of the NAV IR1 FAULT. This is very serious as an ADIRU that provides 'erroneous and temporarily wrong parameters in a random manner to the 'systems' computers can force the generation of 'problems' for the pilot and crew where none exist with aircraft performance within the flight envelope. Problems that can be generated include: unjustified speed and stall warnings; loss of attitude information on the Captain's PFD, and several ECAM warnings. Abnormal parameters generated by faulty ADIRUs include: incorrect Angle of Attack (AoA) data which will cause the flight computers to command a sudden nose down aircraft movement which is unsafe for passengers and crew alike. Such a 'renegade order' is preceded by disconnection of the autopilot and triggering of the NAV IR1 FAULT. Click here to read a copy of the original AD No.: 2009-0012-E, January 15.
In February 2009, at the request of Airbus, Thales conducted a ground level, laboratory study of pitot behavior in high altitude, icing conditions. Thales C16195BA probes had superior performance, but the test environment
could not replicate all attributes of the high altitude weather regime as Thales described.
On June 5, 2009, French television station French2 aired a report about the ACARS messages that were produced during the last minutes of Air France, Flight 447. A moment by moment listing of the ACARS messages was presented. This was the first formal announcement to the public that: a) communication with the aircraft was lost ~ 3.5 hours after departure; b) 216 passengers and 12 crew were aboard, and c) the exact location of the aircraft [crash point] had yet to be identified.
BEA issued an Interim Report on July 2, 2009 about the tragedy of Airbus F-GZCP on June 1, 2009 (Air France Flight 447). As of the date of the Air France, Flight 447 disaster (June 1, 2009), three Pitot probes might have been installed on Airbus A330 / A340 aircraft: a) BF Goodrich probes 0851 HL; b) Thales C16195AA probes or c) Thales C16195BA probes. Conclusive data that might portray the benefits of such changes in pitot probes was lacking.
On August 9, 2009, an article appeared on the French blog Mediapart that asked an important question. Why are Air France A330 aircraft equipped with Pitot made by Thales, when they are certified for pitot manufactured by Goodrich ? Contextual specifications strongly imply that the Thales pitots were designed for the A320 Aircraft alone. The tests that certified the Goodrich pitot for the A330 aircraft family were exhaustive. Such testing involved several planes that flew in extreme weather conditions such as winter in Alaska, equatorial tropics, summer in the United Arab Emirates, etc. Furthermore, the A330 had to qualify for ETOPS – Extended Range Twin Engine Operation Performance Standards – in order to undertake the Rio to Paris flights. The 'reduced tests' that were applied to the assessment of the Thales pitots were not of the highest professional standard, particularly when the procedures of the France's BEA are compared to those of the NTSB in the USA. Is the mismatch between Thales pitot and the A330 aircraft family responsible for the generation of false alarms that indicate STALL? (The emergency procedures of Air France, unlike Airbus, indicate that pilots must respect the stall alarm. Follow through on such procedures could leave the aircraft in OVERSPEED. The confusion of the pilot and his crew in
the cockpit of F-GZCP during the last minutes of Flight 447 is now well documented.
In Appendix 7 of their Second Interim Report about the Air France, Flight 447 Incident, issued December 17, 2009, BEA tabulated no less than 30 incidents between December 11, 2003 and November 3, 2009 where Airbus A330 and A340 aircraft.. experienced flight difficulties due to the blockage of pitot probes by ice. For (5) five of the aircraft tabulated, the maker of the pitot probe is not identified. For 23 of the 25 incidents, Thales is listed as the manufacturer of the Pitot probes. Goodrich supplied the pitot system to two (2) aircraft. An immediate question arises as to why is there a predominance of Thales sensors on Airbus aircraft when the failure rate of their pitot probes far exceeds that of any other manufacturer?
23. Airworthiness Directives; Airbus Model A300 B2 and B4 Series Airplanes; . . . (Collectively Called A300–600); Model A310 Series Airplanes; Model A319, A320, and A321 Series Airplanes; Model A330–301, –321, –322, –341, and –342 Airplanes; and Model A340 Series Airplanes; April 7, 2004. That action proposed to require, among other actions, replacement of certain pitot probes with certain new pitot probes.
This article is segment from our Air France Flight 447 project. Each of these 'chapters' in the AF 447 'ebook' can be read as a 'stand alone' article. The first article from this research was published in August, 2011 and has two objectives: a) to illustrates management-engineer team collaboration for aircraft/spaceship design at its worst because such a work environment may have contributed to design defects in the Airbus family of aircraft; and b) pay tribute to the NASA Space Shuttle Program and the courageous astronauts who flew each mission. This article reviews several advanced weather parameters that have yet to receive much attention, and may shed new light on the storm(s) that AF-447 found itself embedded within. This article is chapter 5 in the AF 447 ebook and is potentially of some importance.
The fifth chapter of the AF 447 eBook will look at the Pitot-static and angle of attack sensors whose data is essential to the Fly-By-Wire computer system's interaction with flight control surfaces. In the Air France, Flight 447 incident, there is a consensus that iced over pitot tubes rendered the Airbus 330 computer system unable to properly instruct flight control surfaces because the essential data stream that conveyed physical parameters of the flight envelope was either absent or corrupted from a critical time point forward. The next and sixth chapter of this project will look at the vertical stabilizer of Airbus 330 aircraft, review the problems inherent with carbon-resin components in aircraft design, review aviation incidents in which tail components detached from the aircraft fuselage, and attempt to asess the contribution to the Air France FLight 447 tragedy that was made by loss of the vertical stabilizer. The seventh chapter describes the design approach that systems engineers term 'hypercomplexity' as inherently problematic in aircraft design. Hypercomplexity may heighten the challenge to maintain situational awareness in the cockpit, negate immediate pilot input during crisis situations and dramatically raise the probability that a worst case flying scenario will quickly achieve a dominant position. A few suggestions for changes to aircraft design and pilot training will be offered. Photos and technical graphs are presented in a larger size than is usual for a web page so that details and small font text may be read as easily as is possible. The design of these web pages is optimized for a monitor resolution of 1400 x 900 (wide-screen, landscape) in order to enhance readability of photos and detailed data displays. If your monitor is set to display a smaller image, then 'backing out' (Ctrl - - ) or use of the horizontal scroll bar will be necessary. Please bookmark this page and occasionally check back to remain current with this publication schedule.