This article is the synthetic analysis and timeline derived from our Air France, Flight 447 research. Target date to have all five chapters online is February 1, 2012. Photos and technical graphs are presented in a larger size than is usual for a web page so that details and small font text may be read as easily as possible. This web page was coded for 1440 x 900 monitor display which is a wide screen (landscape) format, is graphic-dense and may not load at all via a dailup Internet connection. Depending upon the technical details of higher speed Internet connections and PC maintenance, page loading could be slow. Printout of this document will be about twenty seven (28), 11 x 8.5 inch page format. Please bookmark this page and occasionally check back to remain current with the publication schedule for the AF 447 Project.
Comments and opinions in this article are the sole responsibility of Bennett Blumenberg and do not reflect the views of any organization, government or private, that are mentioned in this article. The author does not have any relationship, public or private with the corporations and organizations referenced or mentioned in this article.
This is a long e-book with several chapters and about >200 pages for printout when completed. A professional background is not requisite to understand most of this presentation. However, some of the text and graphs are technical, and they can be skipped over by those so inclined without any serious loss of the narrative. The situational awareness of Air France Flight 447 is complicated, that is the reality of this disaster, and there are several scenarios to be dissected and then interwoven. Contrary to some published analysis of this tragedy, it cannot be explained by pilot error. Elevating 'pilot error' to a position of priority and most importance only serves to erect a large screen that blocks out the multiple parameters that coalesced to produced this most awful commercial aircraft accident. Yes, the pilots in the cockpit of this Airbus A300 aircraft did make errors in judgment. They made decisions that in hindsight do not seem first rate, but then their situational awareness had been destroyed. In the dark of early morning hours, a crisis came upon F-CZCP that rapidly placed all lives at risk. The emphasis upon 'pilot error' is particularly insidious when used by the BEA of France. BEA is the rough equivalent in France of the American National Transportation Safety Board (NTSB), and is the prestigious government agency that conducts all investigations of incidents involving French aircraft and airlines when such an inquiry is warranted. BEA stands for B(ureau) E(nquiry) A(viation), which expands to Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile (BEA; English: Bureau of Enquiry and Analysis for Civil Aviation Safety]. BEA is known and respected throughout the world, make no mistake about that as you read criticisms of their investigation of Air France, Flight 447. Parallel to the investigation of the BEA are those of Airbus corporate, which may never be released to the public; and Air France, where at least a summary is expected for press publication.
“With melted wax and loosened strings, sank hapless Icarus upon faithless wings.
For when the buckled spar let down the grinding span, the blame for loss incurred conferred upon a PF-man and grief was thus a falling leaf upon the dawning of the day of June 1 2009. A brick was not falling, a fully trimmed HST was flying, the wing was thus denied its flight.”
by David Connolly on Wednesday, August 10th 2011 22:22Z
First and foremost the journey of Air France, Flight 447 on the night of May and the first morning of June, 2009 is a terrifying tale of a rapidly developing flying crisis that ended in tragedy and the death of all crew members and passengers. Almost seven miles high in the atmosphere at maximum altitude, the narrative of the last hours of Flight 447 will leave you speechless and numb. But first, let us delve into some basics so that the dimensions of this tragedy underneath the surface narrative can be explored.
Professional aviation is a technical profession that requires considerable expertise in several areas of aerodynamics, aircraft design and atmospheric sciences. The aviation world's professional handbooks and manuals are laced with acronyms as one device to condense text, but this approach has often proved daunting to the general public. A number of these acronyms are used in this 'book' as a device to make the professional work environment that pilots, aircraft designers, and aviation incident investigators work within more concise yet understandable. For an immediate acronym lookup, the Acronym Finder is very good.
AVIATION LAWS
The 'Laws' of Flying Commercial Aircraft are three linked sets of protocols specific to Airbus A330/340 aircraft, that govern how the computer system of a Fly By Wire Aircraft regulates the flight path of the aircraft. Each set of laws applies to a different level of automation, a different degree of control by the computers and autopilot as opposed to direct manual flying of the aircraft by a pilot as was done in the pre-digital age. However as you will read, the pilot is not on vacation when the computer is flying the aircraft. There is no flying protocol where the pilot becomes completely irrelevant and does not have any input into aircraft performance. Protections are the safeguards that are computer controlled. Cruise refers to aircraft flight – movement through the atmosphere. Flight Envelope is the immediate flying environment as defined by the computer system using data from the assigned flight path and weather. Flight envelope is 3-dimensional, dynamic and evolves minute by minute as data from the environmental sensors on the aircraft is fed to 'systems' – the name that is assigned to the computer system. Flight Envelope is not a static map that is loaded into the computer memory prior to takeoff. The boundaries of the Flight Envelope define the region within which the computer system can provide maximum safety for the aircraft, its human crew and passengers.
Normal Law governs the usual flight where there are no serious problems from takeoff to landing. This is the regular operating mode of the fly by wire (FBW) system and includes all protections. It provides maximum protection, that is the list of parameters that can be assigned to the computer system to ensure the safest flight possible is in operation. Pilot input through the side stick is assigned a priority equal to the data flow from the sensors such as those that measure Angle of Attack and Air pressure (pitot-static system). It can be thought of as a discrete data flow that is integrated by systems with environmental data to generate commands that fly the aircraft through precisely adjusted, moment by moment, movements of the control surfaces.
With Direct Law, the pilot has direct manual control and flies the aircraft through movements of the side stick. The controls (sidestick) inputs are converted into direct movements of control surfaces without computations or checks. Before Fly By Wire and digital computer systems were invented, manual control of flight was the only flying protocol possible. Whatever 'protections' are possible for the aircraft, they must be derived directly from the actions of the Pilot Flying (PF).
ACRONYMS APPLICABLE TO FLY BY WIRE
These few acronyms that are applicable to Aviation Law exemplify the dozens that are utilized in professional aviation writing and technical manuals.
ADIRU: Air Data and Inertial Reference Unit provides air data (airspeed, altimeter, ...) and positional data (attitude, position) to the instruments
ISIS: Integrated Standby Instrument System is a completely independent, self contained system providing a third independent set of basic instruments (attitude indicator, altimeter, airspeed indicator) to the crew.
PRIM 1: Flight Control Primary Computer #1, three of them monitor each other, one of them controls the control surfaces as master computer.
SEC 1: Flight Control Secondary Computer #1, each of the two can control all airplane control surfaces in direct law and can become the master computer in case of failure of all primary flight control computers.
At the outset, note that NASA has fine education web site online for Aerodynamics and related physics that is written at the college level but can be enjoyed by high-school or private school students who are at ease with the requisite maths. If you want additional background in basic aerodynamics before reading further, click on these links which are a selection from the NASA K-12 curriculum.
Domeotica.net has an excellent presentation about aerodynamics that emphasizes relationships and interconnections between functional units. Click on a tag and a flow chart of related terms and concepts is displayed. Keep clicking to find more, related basic concepts and explanations that fill out the 'function tree'.
Airbus regrets to inform that an A330-200 aircraft operated by Air France has been lost over the Atlantic during flight AF447 from Rio de Janeiro to Paris, CDG on June 1st 2009.
The missing aircraft, registration number F-GZCP bearing MSN 660 was delivered to Air France in April 2005 and had logged over 18800 flight hours and 2500 flight cycles. It was powered by General Electric CF6-80E1 engines.
Preliminary report indicates that communication with the aircraft was lost over the Atlantic after approximately 3.5 hours since departure. Further information is not available at this time. In particular the exact location of the aircraft has still to be identified.
According to available information, there were 216 passengers and 12 crew members on board.
In line with international ICAO Annex 13 convention, Airbus has offered full technical assistance to the investigation board which should be the French BEA (Bureau Enquêtes et Analyses) as the aircraft is registered in France and has been presumably lost over international waters.
The concerns and sympathy of Airbus go to the families, friends and loved ones affected by the accident.
Further update will be provided as soon as reliable information is available and Airbus is authorized for public release.
In line with the ICAO Annex 13 recommendations, the French investigation Board - BEA (Bureau d'Enquêtes et d'Analyses) is leading the technical investigation, with accredited representatives from the Brazilian Investigation Board and US NTSB, with Airbus providing technical support.
The following data have been approved for release by the French BEA.
The route of the aircraft was crossing a tropical multicell convective area at the time of the accident.
Failure/ maintenance messages have been transmitted automatically from the aircraft to the airline maintenance center.
The above mentioned messages indicate that there was inconsistency between the different measured airspeeds. Therefore and without prejudging the final outcome of the investigation, the data available leads Airbus to remind operators what are the applicable operational recommendations in case of unreliable airspeed indication.
A somewhat accurate description of the last minutes of Air France, Flight 447 only became possible in late May, 2011. At that time, the press was able to report on the first data extracted from the Cockpit Voice Recorder which was brought to the surface on May 1, 2011. This research concludes that an adequate explanation of the disaster must interweave the analysis of several narratives and the breakdown of at least four components of a Fly-By-Wire by system EADS aircraft: a) malfunction of sensory equipment such as pitot probes; b) malfunction of A(ir) D(ata) I(nitial) R(eference) U(unit)s, c) structural weaknesses in aircraft components that are composed of carbon-resin materials; c) malfunction of 'systems', the computer system that is heart of autopilot and therefore directs the moment by moment response of the aircraft to a perceived flight envelope (immediate outside environment), whose definition is extremely dynamic and changes by the second; and d) the interaction of human pilots and their moment by moment changes in 'situational awareness' as they interact with an aircraft whose priority input as it moves through the flight envelope comes from hypercomplex, self healing avionics that have multiple levels of redundancy and which are designed to dominate the execution of the flight plan from takeoff to landing. If these are the minimal, required inputs to an adequate analysis and explanation for the Flight 447 disaster, then theories of single cause are out the window. Ocam's Razor may still be in force with Flight 447, but it is dominated by multiple variable input and multiple variable output. If an adequate brief emerges from the synthesis of these four narratives, each with their attached discussions of function and component breakdown, then a rigorous and fair assignment of responsibility can be attempted, and recommendations then made as to how best to avoid a recurrence of a situation which we now know has occurred multiple times, albeit with some variations.
DEATH JUGGLES / KLOSTER MICHELSBERG (Benedictine monastery, 1121 - 1833), BAMBURG GERMANY
Photo by Immanuel Giel - Wikipedia (Germany)
It must be noted that to talk about pilot error in this situation is not only ridiculous and unfair, it implies an effort that is trying to avoid complex realities. Pilots may have made mistakes during the last terrifying, chaotic minutes in the cockpit of Flight 447, but that is beside the point. The real question about pilot performance is this .... To what extent can the pilot assume partial, or complete, manual control of the aircraft during a crisis. This question is mission and life critical when a judgment has been made that Fly-By-Wire has malfunctioned and/or that the computer system alone is not adequate to the new situation. How rapidly can the pilot work his/her way into the options and capability of Alternative Law, then Manual Law? To what extent does the time that must be given over to a survival challenge, render ever more problematic the re-establishment of a proper flight envelope and a flight path that is no longer life-threatening? Are the differences between Boeing and Airbus, in their respective applications of Fly-by-Wire, significant in a crisis situation? Is one protocol superior in that it provides better crisis management tools to the pilot and/or gets those options into the pilot's hands faster than the alternative?
The 'laws' of commercial aviation flying were developed first at Airbus, then a bit later at Boeing. These 'laws' are what is referred to by the term Fly-By-Wire,. Fly By Wire has unintentionally become a satirical term considering that the most sophisticated computer procedures are what is referred to. Think of the pilot flying an aircraft amidst a severe crisis as akin to a trapeze artist in a circus, balancing upon a high wire at least one hundred feet in the air below which there are no safety devices, no catching net, etc. These 'laws' are detailed technical protocols for flying an aircraft in three different states of capability with respect to manual and computer control of flight behavior. These three protocols are the aircraft's built in (central computer programming) capacities to respond to damages recently inflicted by a newly encountered difficult situation that has removed important options from the Normal Law protocol of the central computer ('systems') and autopilot. Normal Law is just that – the usual manner of flying the aircraft through the immediate ever changing outside environment (cf 'flight envelope) as pilot and central computer interact. Alternate Law removes most flight envelope protections (programmed responses that take priority over the human pilot decision-making), so that a much greater degree of manual input by the pilot is now in force. Direct Law allows the pilot to directly fly the aircraft to the maximum extent possible. This is what the naive fraction of the general public imagines occurs all the time. Direct Law assumes that the human brain is the best damage control tool available when a serious flying crisis has developed in which lives are threatened, and therefore 'releases' most flying function back to the pilot for direct input. In the following pages, these laws are referred to again and again because: a) the time to access Direct Law from a situation of Normal or Alternate Law is a parameter of the greatest concern when a deadly situation has impacted the flight envelope; and b) there are important differences (now the subject of a heightened debate) between the implementation of Fly By Wire at Airbus and Boeing, and the degree to which the pilot has direct input into the flight behavior of the aircraft under Direct Law.
This is damn serious stuff, first and foremost because of lives that can be lost. The loss of Air France 447 was the deadliest accident in French aviation history and the worst commercial aviation tragedy in eight years. While this was the first fatal accident with an Airbus 330 aircraft, analysis of recent Air France operations has opened a Pandora's Box of questions and deficits. In the long view, this situation speaks to the promises that originated some years ago by both Boeing and Airbus that address safety, industry and passenger costs and the travel experience for the next generation of commercial service. In fact, this 'next generation of commercial aviation' arrived some years ago. Full Authority FBW controls with ‘hard limits’ was first implemented by Airbus in the design of their A320 series of commercial jet liners which entered service in March, 1988. This 'generation' of commercial aviation relies upon highly redundant, self healing avionics to fly the aircraft as digital instructions are sent to control surfaces. Avionics is responding moment by moment to input from the central computer system which is responding to data streams from external sensory devices such as the angle of attack sensor and pitot probes which have received so much notice in the analysis of the AF Flight 447.
As regards commercial aviation, several fundamental questions emerge from this analytical model. 1) What is the minimal level of performance below which predicted and actual aircraft performance vs a vs crew and passenger safety is unacceptable? 2) What changes must be rapidly instituted in the four components of Fly-By-Wire identified above so as to reduce the probability of a recurrence of the Air France 447 scenario to near zero? 3) As Black Gold becomes ever more expensive to find, drill and produce, can commercial aviation costs be controlled, and the savings passed to the customer. A lighter aircraft costs less to fly and the latest commercial airliner designs make extensive use of lightweight, non-metallic materials. Are these new composite materials as safe as the familiar aluminum alloys? 5) Has pilot training and the cockpit work environment retained a no compromise, “pursuit of excellence' vision and application? Or have corporate priorities created a highly stressful work environment that endangers crew and passengers alike? 4) Where do responsibilities for the tragedy of Flight 447 lie and what are the derived legal implications? Biases are unavoidable in this article and the author makes no pretense to neutrality or complete 'objectivity'. With all humility, this article attempts to present information that addresses these questions and draw some conclusions.
AF 447 DEBRIS on OCEAN SURFACE, JUNE 9, 2009
Photo -
- Brazilian Navy
This article is Chapter One of our Air France Flight 447 project. Each of these 'chapters' in the AF 447 'ebook' can be read as a 'stand alone' article. Chapters and appendices in this ebook are released out of sequence so as to make them available at the earliest possible date.
The second chapter in this eBook discusses the search for the wreckage of Air France, Flight 447, and the recovery of the Flight Deck Recorder and Cockpit Voice Recorder. The third chapter reviews the last five minutes of Air France, Flight 447. The fourth chapter examines the design and function of the pitot-static and angle of attack sensors whose data is essential to the Fly-By-Wire computer system interaction with flight control surfaces. There is a consensus that iced over pitot tubes rendered the Airbus 330 computer system unable to properly instruct flight control surfaces because the data stream the conveyed essential parameters about the flight envelope was either absent or corrupted from a critical time point forward. The fifth chapter will look at the vertical stabilizer of Airbus 330 aircraft, review the problems inherent with carbon-resin components in aircraft design, review aviation incidents in which tail components detached from the aircraft fuselage, and attempt to assess the contribution to the Air France FLight 447 tragedy that was made by the loss of the vertical stabilizer.
The sixth chapter will look at 'hypercomplexity' as inherently problematic in aircraft design. The seventh and last chapter will attempt an integrative scenario - synthetic analysis - to explain the AF 447 tragedy. Several suggestions for changes to aircraft design and pilot training will be offered. Target date to have all chapters and appendices online is February 1, 2012, at which point this ebook can be read in a coordinated sequence. Photos and technical graphs are presented in a larger size than is usual so that details and small font text may be read as easily as is possible. The design of these web pages is optimized for a monitor
resolution of 1440 x 900. If your monitor is set to display smaller dimensions, horizontal scrolling of these web pages will be necessary. Please bookmark this page and occasionally check back to remain current with this publication schedule.