BEA interim report on Air France Flt 447 Accident -  *Extract*

Comment

PAGE 33/72

The DAKAR OCEANIC Regional Control Centre created the flight plan and activated it. The

result of this was to generate a virtual flight following the planned trajectory in the DAKAR

FIR between TASIL and POMAT. There was no radio contact between AF447 and DAKAR,

nor any ADS-C connection. The flight remained virtual.

At 2 h 47 min 00 s, the DAKAR controller coordinated flight AF447 by telephone (ATS/DS)

with the SAL controller (Cape Verde) with the following information: passing the POMAT

point (leaving the DAKAR FIR) estimated at 3 h 45, FL350, Mach 0.82.

At 2 h 48 min 07 s, the DAKAR controller told the SAL controller that flight AF447 had not yet

established contact with him.

At 3 h 54 min 30 s, the SAL controller called the DAKAR controller by telephone (ATS/DS) to

confirm the estimated time for passing the POMAT point. The latter confirmed that POMAT

was estimated at 3 h 45. The DAKAR controller stated that the crew of flight AF447 had not

contacted him to correct its estimate. The SAL controller replied that the estimate was

probably later. He asked the DAKAR controller if there was any change. The DAKAR

controller then said that he was going to try to contact flight AF447.

At 4 h 07 min 4 s, the SAL controller requested confirmation of the flight AF447 estimate. The

DAKAR controller confirmed again that POMAT was estimated at 3 h 45. The SAL controller

pointed out that it was 4 h 8 and that the estimate was not correct. The DAKAR controller

recalled that contact had not been established with flight AF447. The SAL controller stated

that he had identified flight AF459 on his radar whereas its estimate was later than that of

flight AF447. The SAL controller said that he thought that the POMAT estimate was later, at

4 h 29 or 4 h 30. The Dakar controller told the SAL controller that he would call him back.

At 4 h 11 min 53 s, the DAKAR controller asked flight AF459 to contact flight AF447.

At 4 h 20 min 27 s, the crew of AF459 informed the DAKAR controller that they were passing

point POMAT at FL370. They had not succeed in contacting flight AF447 and said that they

had sent a message to Air France so that the airline should try to contact flight AF447.

At 4 h 20 min 36 s, the DAKAR controller asked the crew of AF459 to contact SAL on the

128.3 MHz frequency.

At 4 h 21 min 52s, the DAKAR controller asked the ATLANTICO controller to confirm that

flight AF447 had passed TASIL at 2 h 20 at FL350. The ATLANTICO controller confirmed

that TASIL was estimated at 2 h 20 but that no contact had been made.

etc etc etc (to end page 33/72)

Over 3.5hrs after AF447 had crashed:

"At 5 h 50, after several unsuccessful attempts to obtain information on flight AF447, Air France contacted the SARSAT (Search and Rescue Satellite Aided Tracking) centre." (PAGE 40/72)

Apart from the "absence of a flight plan" and ACARS ATC rejection of AF447 messages because of that, the SAR alerting reaction and ready response is just not good enough in this technological day and age

It's not known whether the recorders and their pinging locator beacons can designedly withstand vertical g as well as they can the usual crashworthy dictate of longitudinal g forces. However it's also apparent that the recorder's sonic ping-rate and frequency is a factor in battery rundown. ICAO should consider a new standard that ensonifies the ocean over greater ranges at a far lower frequency (distinct  from whales and marine life) and at a slower ping-rate. The average detection range of the USN's towed TPLs (pinger locators) is estimated at two kilometres at least (and 3.5kms at most in very benign conditions of salinity and thermocline).

It's suggested that a ping generated only every five minutes starting no earlier than impact plus 48 (or even 72) hours would give search vessels time to enter the area. It could even be considered that an initiator frequency be provided so that a typical ASW frigate, submarine (or air-dropped surface buoy's hydrophone) could send an acoustic trigger to cause the recorder's underwater locator beacons to start earlier than 72 hours. Alternatively (or additionally) a different trigger frequency could be used (by air-dropped buoys sowed in the impact area) to cause the recorder to boost its pinger's output or, for precise localization and battery life extension during periods of bad weather, drop its ensonification levels. Think in terms of the air-dropped buoy having many times the power of the recorder's weak pinger and thus being able to contact it - yet whilst also being unable to detect the recorder's relatively weak pinger output.

 Another possibility is to provide two batteries per recorder and to design in a handover voltage at which the dying battery hands off the ping duty to the fresh battery. You could also have the CVR's recorder remain dormant for the period of the DFDR's pinging and then have it cut in (with the assurance that once the DFDR is found, the CVR's pinger will either auto-start on time or be capable of being triggered by a discrete frequency into itself starting its ping cycle). In any case the two recorders must be near each other (i.e. find one and then easily find the other).

A ping only every five minutes? It would also give surface search vessels and submarines the time to be somewhere else along their search grid's track with a different aspect on the recorders (important when bottom topography is deep-troughed and rugged/mountainous).

It's a technology that's so critical but way past its "sell by" date and overdue for updating and modernisation.

It is apparent that AF447 was the first of the prior TEN instances of enroute high level Thales pitot failures to experience the ADIRS system's confusing malady at night and with underlying bad weather. By direct contrast with F-GNIH (the defining August 2008 pitot incident of AirCaraib) which occurred in daytime whilst in and out of the cloud-tops at FL370, the F-GNIH captain, in his relatively benign environment, wisely reduced power and descended (thus escaping the potential adverse consequences of any other pilot reaction). It's becoming apparent that whichever pilot was PF in AF447 misinterpreted the ADIRS symptoms as an aerodynamic stall and added power (possibly also increasing AoA) - with a resultant coffin corner encounter with Mach crit (which rapidly leads to uncontrollable roll and pitch excursions - see definitions below in next box).

Why would "adding power" lead to an upset? Because of the Thales pitot failure characteristics, the aircraft was probably physically flying much faster than the airspeed indicated. In other words, all three pitots (or at least the two supplying the left and right PFD's) were suffering from partial ice/water induced blockage and under-reading - this being subtly compensated for by auto-throttle attempting to regain the scheduled speed. Because there was no ADIRU-1 and ADIRU-2 disagreement, the ADIRS system was accepting the two pitots' data inputs as bona fide and processing them accordingly.

Being physically faster than normal meant that the crew would have been unknowingly eroding the safety margins of its near coffin corner status. Any pilot reaction of increasing power (due to a misinterpretation of Mach Buffet and the low(ering) airspeed being indicative of an incipient stall) would quite probably (and I'd suggest DID) suddenly place the A330 into a Mach Crit encounter..... without any warning. As these extreme limits are never experienced by Line Pilots, the confusion that ensued at night in a pitch-down into bad weather in Alternate2 FBW Law would have induced a Loss of Control and some partial structural failure. It's also possible that the pilots may have then carried out some desperately precipitate actions that further compounded their emergency.

It's apparent that the BEA Report is laying the groundwork for an uncertain probable cause by entertaining discussion of incorrect SIGMETS and the unpredictable localized nature of the ITCZ weather (1.18.3 on pg 65/66 & P69). They apparently intend to "muddy the waters" as much as possible in order to de-emphasize the significance of the Thales pitot flaw that had been known about (but not acted positively upon) for over a decade.

In my opinion the root cause of the AF447 crash is simply that nobody analyzed in any depth the possible implications of a suddenly surprised pilot misinterpreting the confusing symptoms of a dual pitot malfunction (not failure) in bad weather at night and instantly and irretrievably reacting incorrectly - thereby placing the aircraft in an unrecoverable flight regime. Contributing perhaps was the fact that a certain system leeway is allowed for some variance in left and right pitot differences. The ADIRS system, both up and downstream, was "sucked" in by a dual failure (i.e. nil disagreement). Whether the third pitot tube, feeding the standby flight instruments (ISIS) was also partly blocked is unknown (but possible). If it wasn't however, then we can also easily conclude that the pilots had no reason to be referring to it prior to the upset incident - as everything appeared to be ops normal. Neither would they have had time to compare that ISIS data during the very dynamic evolution that followed the autopilot disconnect.

Perhaps a "twinning" of not only STBY attitude displays but also the STBY airspeed would have made any growing discrepancy apparent early enough for some astute trouble-shooting.

Effect of FBW Laws

Much has been made of the fact that a pitch overload is prevented in Alternate2 (which AF447 had auto-reverted to). FBW Laws may prevent the pilot from overstressing with his sidestick inputs, but it probably will not prevent the aircraft overstressing itself as a function of its trim state, thrust settings and having ended up in an unusual attitude.

Entry into a High-Level Enroute Loss of Control

There are probably only seven unique instances in which control can credibly be lost unintentionally whilst enroute.

a.  Unlawful interference and crew incapacitation

b.  Engine failure and a failure of the crew to respond correctly (e.g. Air China747 enroute to San Diego)

c.  Heavy Airframe Icing in SLD conditions (normally restricted to turbo-props)

d.  Heavy handed overly urgent response to a TCAS RA whilst at high-level

e.  Disorientation (normally following flight instrument failure)

f.   Thunderstorm encounter

g.  Stalling or Mach Crit encounters near coffin corner (probably induced by an incorrect manual response to a warning alert - and involving a Flight Law mode change degradation).

The last two instances are the two likely scenarios for AF447. The history of Thales pitots and the similarity of the recorded fault sequences transmitted by ACARS is pointing relentlessly at scenario g.

The ACARS' staccato flush of its message buffer during the four minute descent to impact has provided investigators with a non-chronological confusing mish-mash of randomly generated faults that (IMHO) are nothing more than what will happen as a result of a Loss of Control and partial breakup (and/or precipitate actions by the crew in extremis). Some of the data is straightforward and some of it is perplexing. None of it is unexpectedly different to what has been experienced in the multiple prior instances of pitot failure..... and that will be (or rather should be) the final arbiter in attributing the probable cause.

When the initiator is confirmed and the incident back-tracked to the very determinate circumstances of the pilot's probable response (and its likely consequences), I'd be very surprised if the outcome wasn't simply dictated by the powerful factor of sudden surprise and the pilot's evident need to instantly react - one way or another. That he may have got it wrong in AF447 should not surprise us or in any way reflect blame upon him. The blame is with the airworthiness authorities who'd failed for many years to act responsibly and positively. That corporate failure goes all the way to the top and is shared by many at those lofty levels.

The coffin corner or Q-Corner is the altitude at or near which an aircraft's stall speed is equal to the critical Mach number, at a given gross weight and G loading. At this altitude the aircraft becomes nearly impossible to keep in stable flight. Since the stall speed is the minimum speed required to maintain level flight, any reduction in speed will cause the airplane to stall and lose altitude. Since the critical Mach number is maximum speed at which air can travel over the wings without losing lift due to flow separation and shock waves, any increase in speed will cause the airplane to lose lift, or to pitch heavily nose-down, and lose altitude. The "corner" refers to the triangular shape at the top of a flight envelope chart where the stall speed and critical Mach number lines come together.

Aerodynamic basis

Consideration of statics shows that when a fixed-wing aircraft is in straight, level, flight at constant-airspeed the lift on the main wing is equal to its weight plus the downward force on the horizontal stabilizer; and its thrust is equal to its drag. In most circumstances this equilibrium can occur at a range of airspeeds. The minimum such speed is the stall speed, or V_SO. At speeds close to the stall speed the aircraft's wings are at a high angle of attack.

At higher altitudes, the air density is less, while the area of the wing is unchanged. In order to support the weight of the aircraft, the wings must move faster through the air. Thus the stall speed, in true airspeed, increases with altitude. (Measured in indicated airspeed the stall speed is constant at any altitude.)

Air conducts sound at a certain speed, the "speed of sound". This becomes slower as the air becomes cooler. Since the temperature of the atmosphere generally decreases with altitude (until the tropopause), the speed of sound also decreases with altitude. (See the International Standard Atmosphere for more on temperature as a function of altitude.)

A given airspeed, divided by the speed of sound in that air, gives a ratio known as the Mach number. A Mach number of 1.0 indicates an airspeed equal to the speed of sound in that air. Since the speed of sound changes with air temperature, and air temperature generally decreases with altitude, the true airspeed for a given Mach number generally decreases with altitude.^[1]

As an aircraft moves through the air faster, the airflow over parts of the wing will reach speeds that approach Mach 1.0. At such speeds, shock waves form in the air passing over the wings, drastically increasing the drag due to drag divergence, causing Mach buffet, or drastically changing the center of pressure resulting in a nose-down moment called "mach tuck". The aircraft Mach number at which these effects appear is known as its critical Mach number, or Mach CRIT. The true airspeed corresponding to the critical Mach number generally decreases with altitude.

The flight envelope is a plot of various curves representing the limits of the aircraft's true airspeed and altitude. Generally, the top-left boundary of the envelope is the curve representing stall speed, which increases as altitude increases. The top-right boundary of the envelope is the curve representing critical Mach number in true airspeed terms, which decreases as altitude increases. These curves typically intersect at some altitude. This intersection is the coffin corner, or more formally the Q corner.^[2]

The above explanation is based on level, constant speed, flight with a given gross weight and load factor of 1.0 G. The specific altitudes and speeds of the coffin corner will differ depending on weight, and the load factor increases caused by banking and pitching maneuvers. Similarly, the specific altitudes at which the stall speed meets the critical Mach number will differ depending on the actual atmospheric temperature.

Consequences

When an aircraft slows to below its stall speed (or more properly, when the wing exceeds its critical angle of attack), the airflow over the top of the wing separates from the wing surface, and lift decreases dramatically (the wing "stalls"). Because the lift reduces while the aircraft's weight does not, the aircraft loses altitude. When the aircraft exceeds its critical Mach number, then drag increases or Mach tuck occurs, which can cause the aircraft to upset, lose control, and lose altitude. In either case, as the airplane falls, it could gain speed and then structural failure could occur.

As an aircraft approaches its coffin corner, the margin between stall speed and critical Mach number becomes smaller and smaller. Small changes could put one wing or the other above or below the limits. For instance, a turn causes the inner wing to have a lower airspeed, and the outer wing, a higher airspeed. The aircraft could exceed both limits at once. Or, turbulence could cause the airspeed to change suddenly, to beyond the limits.

Aircraft capable of flying close to their critical Mach number usually carry a machmeter, an instrument which indicates speed in Mach number terms. As part of certifying aircraft in the United States of America, the Federal Aviation Administration (FAA) certifies a Mach number for maximum operation, or M_MO.

Some aircraft, such as the Lockheed U-2, routinely operate in the "coffin corner", which demands great skill from their pilots. The FAA is concerned that as jet aircraft become more common, less experienced pilots will be flying those aircraft closer to the altitude of their coffin corners, and that catastrophic accidents will occur as a result.^[2]

from Wikipedia