Comments on: The Paradox of ‘Simplicity’

By: fjcastil

fjcastil — Tue, 23 Jun 2009 04:28:00 +0000

Could not agree with you more! That is why I note my suspicion of flaws with the designs of Airbus, specially them being so dependent on the FBW. In the case of AA587, the plane had been maintained in Miami before flying to NY a few days before the crash. That plus that same plane had encountered severe turbulence during a flight a few months before the accident. I also remember that at one point, AA had to ground their fleet of Airbus A300’s due to redundancy problems with their flight computers.
And just today, another Quantas A330 on route from Hong Kong to Perth, encoutered severe turbulence and 12 passengers were injured. Only this time there were no further incident, thanks be to God!
But like Miles has said, we just do not know how many situations have been saved by the same FBW systems.
In the end I also tend to think that the media and the entire airline industry tend to cover up details and a lot of the truth in order not to scare people from flying. As many ATP’s know, there are many incidents on a daily basis that simpy go unknowned and untold. But if you fly enough, like some of us have to do, you may end up experiencing these situations “live”!
Unfortunately today, AF447 is not big news, and soon it will be out of mind.

By: fjcastil

fjcastil — Tue, 23 Jun 2009 04:00:13 +0000

Miles, miss you from your CNN days but finally caught with you!
May the grace of God be with all the victims of AF447 and their families. But for business people like me that have to fly over 60K miles a year, both domestic and overseas, this incident leaves even more questions about airplane safety and pilot decision making than ever before.
The pictures of flight AA587, an Airbus 300, bound to DR (where I am originally from) that crashed in NYC are still vivid in my head. If these airplanes are so safe and sophisticated, how come the flight computer allowed the pilots on AA587 A300 to yank the rudder so hard that the tail was ripped apart?! To this day I am still not entirely convinced we know for certain what happened on AA587.
Also, since pilots receive an on-route weather briefing before take off, why not choose a different route from the get go? As you have well indicated, initial investigations clearly show flight AF447 might have been at the wrong place, at the wrong time, in an area of heavy towering stoms.
Personally I think that many times having and depending on so much technology gives pilots a dose of false sense of security and over confidence, and sometimes (some of them with me as a passenger) pilots decide to fly through weather that turns out to be more serious than expected. Afterall, these machines are not flying tanks, and this humble passenger thinks that many storm systems should be avoided, and not flown thru, period. Deep inside my head, I hate to think that there may be serious flaws with the design of an Airbus airplane flown outside of “normal” circumstances or beyond the FC capabilities. In my book, right or wrong, the only two airplanes that I know in recent times have broken apart in mid-air due to unexpected turbulence have been Airbus. I pray to God that they do find the blackbox of AF447 so many questions and doubts can be answered. Meanwhile I say safety must always come first!

By: dhiscock

dhiscock — Tue, 16 Jun 2009 16:50:53 +0000

I wonder if we are jumping too soon to conclusions on the pitot tube. There are several other indicators (throttle, radar, gps, etc.) that would have given the pilots the same information. I think it is more important to note the A330 is the common link. How exactly flight controls work or do not work in certain control situations, and how robust those algorithms are is an open question. Seems to me the easy answer is to question the A330 as the open cause…this could be a ground the fleet problem…changing the pitot tube could be like putting chewing gum on a crack in the Hoover Dam…

By: willcushman

willcushman — Mon, 15 Jun 2009 20:45:08 +0000

Some anecdotal information I got today from an aviator friend implies that the Airbus has had a history of vertical stabilizer and control surfaces failures linked to attachment hardware structural failure. Apparently these attachments are made from composite materials rather than machined aluminum, as in most commercial aircraft. The use of composites is common for flight control surfaces but not for attachment hardware. Perhaps the vertical stab failed in the severe loads caused by the storm. The anecdotal info I got was from a professional aircraft dismantler who salvages airliner airframes for a living. He has taken apart A310 and A320 aircraft. Maybe the recovered vertical stabilizer will shed some light on this but will we ever know the chain of events that led up to the structural failures? Maybe they will find the flight data recorders.

By: robert

robert — Mon, 15 Jun 2009 20:41:46 +0000

In 2008 the Hubble Space Telescope had a failure in a data unit. I think it took them months to change over to the backup unit. And that was with the help of who knows how many PHDs. That shows the high level of complication with technology today.

By: newsfan

newsfan — Sun, 14 Jun 2009 17:40:34 +0000

The more I read about this the more interested I am in the software that is used by the ADIRS to interpret information from the ADIRU’s. The Time article said that the Quantas Flight 72 investigation showed that the ADIRS software did not choose to use the accurate information from the properly functioning ADIRU, instead choosing to use the inaccurate information from the malfunctioning ADIRU. This faulty information then fed into the autopilot software causing it to choose an incorrect angle of attack sending the plane into sharp dives that nearly caused an accident. The redundancy of the multiple ADIRU’s did not help because the software problem caused the ADIRS to choose the malfunctioning ADIRU as the source of it’s information. Quote from Time, “For some reason, the damn computer disregarded the healthy channels,” says Hans Weber, an aviation expert who heads Tecop International, an aviation-consulting firm in San Diego. “Instead, it acted upon the information from the rogue channel.”

And it’s not comforting when Time reports that Airbus officials say the problematic algorithm is only found in the mathematical models used for it’s Airbus A330 and A340 models. Here’s some good questions for a reporter to ask Airbus: What have you done to fix the algorithm problem in the ADIRS software that caused the pitch down problem on the Quantas flight? If nothing, why not? What would the cost be to Airbus to fix that sort of software problem? Isn’t the software problem as large of a problem as the Pitot tubes?

The other thing that interests me is the redundancy of systems on Airbus. On Wikepedia it says that this redundancy of back up systems will sometimes cause airline companies to delay maintenance of backup systems. If Wikepedia is accurate on it’s write up of ADIRS/ADIRU’s it says the A330 has 3 ADIRU’s. If I was a reporter I’d be asking Air France whether any of the ADIRU’s on AF Flight 447 were in need of maintenance. What was the status of backup ADIRU? What was the status of the rest of the ADIRS system for that plane?

The other thing that is interesting about the redundancy systems in the Airbus is how they can be confusing to the pilots during an emergency situation. This is described in Wikepedia, in regards to Quantas Flight 72: “Analysis of complex systems is itself so difficult as to be subject to errors in the certification process. Complex interactions between flight computers and ADIRU’s can lead to counter-intuitive behaviour for the crew in the event of a failure. In the case of Qantas Flight 72, the captain switched the source of IR data from ADIRU1 to ADIRU3 following a failure of ADIRU1; however ADIRU1 continued to supply ADR data to the captain’s primary flight display. In addition, the master flight control computer (PRIM1) was switched from PRIM1 to PRIM2, then PRIM2 back to PRIM1, thereby creating a situation of uncertainty for the crew who did not know which redundant systems they were relying upon.” In a moment of emergency everything must work in an extremely synchronized fashion and after reading this report of the Quantas flight I’m not confident that switching between back up systems in an emergency is as easy as advertised.

By: rcp727

rcp727 — Sat, 13 Jun 2009 20:32:20 +0000

Hello Miles,

Very informative article, again. In particular, the comparisons to “old generation” cockpits and FBW.

An interesting overview, would be the safety record of Airbus and Boeing in the lat 15 years, and in particular, US Airlines / Aircraft operating under Part 121. The only FBW comparison would be including the 777, with certain criteria added.

Also, two other points:

1. There seems to be much discussion of the total time of the Captain (approx. 11,000 hours). There is no proof the Captain was even in the cockpit, since many long leg commercial flights are operating with an augmented crew (additional crew member(s). Quite often the “Senior” Captain may take a sleep break in a berthed area or of First Class seat.

2. It was quite odd to me that terrorism was initially “ruled out” by the network coverage before any investigation began.

Regards

By: newsfan

newsfan — Sat, 13 Jun 2009 19:20:27 +0000

Miles,

Here’s some info from a Time article that ties in with your article about equipment/fly by wire/software issues. Looks like some of the Ptiot tubes are defective and so are some of the ADIRU’s.

“It is not yet known whether Air France 447, an A330, carried the troublesome variety of ADIRU. But if it did, and if the Air France plane plummeted into an uncommanded dive while traveling through a downdraft generated by storms — a common occurrence over the region of the Atlantic Ocean where the plane went down — it could have been doomed as it entered a steep dive and likely broke up.”

“Aviation authorities around the world have ordered inspections and procedures to try to eliminate the problem. “In these fly-by-wire systems, one never really knows if one has checked out all possible combinations of events to make sure that the computer properly reacts,” Weber says of modern flight control. Fly-by-wire systems use computers and wires instead of mechanics and hydraulics to control a plane’s flight. Electronic systems are more reliable than mechanical processes but are prone to software errors that can’t always be anticipated. “There could be some other sequence of events that could cause another bad software reaction,” says Weber.”

“The Australians’ March report concluded that the October dive was due to a series of events that, when combined, was “close to the worst possible scenario that could arise from the design limitation in the AOA processing algorithm.” Airbus also told investigators that this particular mathematical formula for flying the plane is found only on its A330 and A340 models. “Different algorithms were in use on other Airbus types, which were reported to be more robust to AOA spikes,” the report said. “The manufacturer advised that AOA spikes matching the above scenario would not have caused a pitch-down event on Airbus aircraft other than an A330 or A340.”

By: lgordonj

lgordonj — Sat, 13 Jun 2009 01:23:27 +0000

The Dash 8 SOP suggests disconnecting the AP in known icing conditions. And not be used during the landing. The link will provide you with some interesting info on the Dash 8, icing and other stuff.

Lon

http://www.upsetrecovery.com/forum/viewtopic.php?f=5&t=44
sequence.

By: lgordonj

lgordonj — Sat, 13 Jun 2009 00:21:00 +0000

Debris photographs of the Air France Airbus Flt 447 breakup suggests that the vertical stabilizer separated, more or less intact, from the aircraft just as it did on the American Airlines Airbus that crashed at JFK on 11/12/2001. The NTSB determined that the JFK accident was caused, in part, by excessive rudder input (Part of the stabilizer) while reacting to wake turbulence. These aircraft are “Fly by Wire” meaning that control surfaces are reacting to inputs from by the crew via computers. One would think that the software that drives these computers would be able to sense dangerous inputs by the crew and dampen it before it becomes catastrophic. Especially when one considers that crew reactions to unusual attitudes of the aircraft responding to turbulence may be spontaneous.

Lon Wilmington, NC

NTSB report on causes of the American Airlines accident at JFK on 11/12/2001 http://www.ntsb.gov/ntsb/AccList.asp?month=11&year=2001