Understanding Air France 447 (8 page)

After the accident, six additional events, not filed as air safety reports, were found by analyzing recorded flight parameters from the fleet and maintenance reports.

Meanwhile in 2007, prompted by the earlier incidents caused by water ingestion on A320 aircraft, an exercise incorporating the “flight with unreliable airspeed” procedure conducted in an after-takeoff scenario was added to Air France’s 2008-2009 training program. The exercise was considered to be representative of the main difficulties in conducting the procedure in all flight phases. However, when conducted in a low-altitude environment, the procedure calls for pitch attitudes between five and fifteen degrees. When conducted above the minimum safe altitude, the procedure calls for maintaining level flight for troubleshooting. There were no simulator exercises added to reflect the high altitude environment events that were encountered in 2009.

In September and October 2008, Air France asked Airbus for information about the cause of these events and the solutions. They also asked if the Thales BA probe could resolve these problems. Airbus replied that the cause of the problem was probably probe obstruction by a rapid accumulation of ice crystals, and that the Thales BA probe was unlikely to improve the performance in an ice crystal environment.

From October 2008 onward, Air France alerted Thales about the increasing problem of icing at high altitude. Thales started an internal procedure to perform a technical analysis of these incidents.

During the autumn of 2008, Air France considered that flight safety was not immediately affected by this type of incident.

Four Air Safety Reports (ASRs) relating to these incidents were published during this period in several issues of the
Sûrvol
flight safety bulletin, which was circulated to Air France pilots. On November 6, 2008, information about the airspeed anomalies that had occurred in cruise and that affected the A330/A340 fleet was circulated as an operational memo titled
Info OSV
within Air France to the pilots working in the sector. The document indicated that six events of this type were reported by crews. First Officer Bonin was about to check out on the A330 when this bulletin came out. He received his type rating in December 2008.

The
Info OSV
document stated that the incidents are characterized by losses of airspeed indication, numerous ECAM messages, and in some cases, configuration alarms. The events occurred at high altitude in turbulence, in zones in which icing was forecast or observed, for aircraft flying at a Mach of 0.80 to 0.82, with autopilot and autothrust engaged. The chronology of the anomalies was described. It stated that, “during this phase, which lasted for approximately a few minutes, the crews did not report any feeling of over-speed (vibration, acceleration) or the approach to stall (pitch attitude, angle of attack, reference to the horizon) despite the activation of the stall warning.”

It stated in bold red letters “be vigilant in flight conditions of high altitude, icing, and turbulence.”

Four general recommendations were included in the document. (Approximate translations)

• Read the complementary technical information carefully.
  
• Do not be taken by surprise.
  
• Identify and confirm the situation.
  
• Recovery in case of manual control of the aircraft. Proceed by making small corrections.
  

The presence of this information and the dissemination of these bulletins indicates that Air France pilots, especially A330 & A340 pilots, should have been aware of these incidents. The conditions that AF447 encountered were exactly the conditions that the bulletins and Air Safety Reports referred to.

Unfortunately, the “Flight with Unreliable Airspeed” procedure and the conditions for its application were not mentioned in the
Info OSV
document. A safe attitude and power setting to go to in the event of the loss of automation and/or airspeed indications was also not mentioned. Yet, that key piece of information is what pilots who have successfully flown through the loss of airspeed events report having used in the critical first seconds.

Training by bulletin rarely has lasting effectiveness, and perhaps even less so when the guidance is general in nature and includes only vague corrective actions.

On November 12, 2008 Airbus revised the earlier 2007 service bulletin. Like the earlier version, this version mentioned the improvement that could be provided by the Thales BA probe in relation to water ingestion, but no longer mentioned icing conditions.

Airbus said that there was no solution that could totally eliminate the risk of probe icing, that the three types of probes installed on the Airbus satisfy criteria that are much higher than the regulatory requirements for certification in relation to icing, and provided a reminder of the procedure to be applied in the event of an erroneous airspeed event.

On November 24, 2008 the issue of inconsistent airspeed indications was raised during a meeting between the technical divisions of Air France and Airbus. Air France requested an analysis of the root cause and a technical solution to resolve the issue. Air France suggested that BF Goodrich probes should be fitted, due to an appearance of greater reliability over the Thales models. Airbus confirmed its analysis and agreed to check the option of replacing the Thales probes with BF Goodrich probes.

Meanwhile, other airlines were also experiencing loss of airspeed events. It was not known what caused these events. The leading theories centered around water ingestion that was tossed around inside the pitot by the turbulence that seemed to be a common factor with each event. Many of the airspeed transients were quite short, such that in some cases the crew did not even see what caused the autopilot to disconnect. Others lasted longer (one to three minutes) with flight control law degradation effects, but loss of control had not been a problem. Looking at the flight data from some of these incidents, the loss of airspeed was so sudden that it looked like it could easily be an electronic problem.

At the end of March 2009 (about two months before the accident), Air France experienced two additional events involving the temporary loss of airspeed indication, including their first one on an A330.

On April 3, 2009, in light of these two new cases, Air France once again asked Airbus during a technical meeting to find a definitive solution. On April 15, Airbus informed Air France of the results of a study conducted by Thales. Airbus stated that the icing phenomenon involving ice crystals was a new phenomenon that was not considered in the development of the Thales BA probe, but that probe still appeared to offer significantly better performance in relation to unreliable airspeed indications at high altitude. Airbus offered Air France an “in-service evaluation” of the BA standard to check the behavior of the probe under actual conditions.

Air France decided to extend this measure immediately to its entire A330/A340 long-haul fleet, and to replace all the airspeed probes. On April 27, 2009 (32 days before the accident) an internal technical document was drawn up to introduce these changes . The modification work on the aircraft was scheduled to begin as soon as the parts were received.

The first batch of Thales BA probes arrived at Air France on May 26th, 2009, six days before flight 447 crashed. The first aircraft was modified two days before the accident. At the time of the accident, flight 447, registration number F-GZCP, was fitted with the original Thales AA probes. They were due to be replaced upon the airplane’s return to Paris.

As of November 2009 (five months after the accident) Airbus had identified thirty-two loss of airspeed events that had occurred between November 2003 and June 2009. According to Airbus these events are attributable to the possible “destruction” of at least two pitot probes by ice. Eleven of these events occurred in 2008 and ten during the first five months of 2009. Twenty six of these incidents (81%) occurred on aircraft fitted with Thales AA probes, two on aircraft with Thales BA probes, and one on an airplane equipped with Goodrich HL probes.
¹⁶

Post accident wind tunnel tests with large concentrations of ice crystals were able to duplicate the issue in a controlled environment. The Goodrich manufactured probe behaved better than the Thales probes and was therefore the eventual replacement probe.

Pitot Static Operation

The pitot-static system is designed to determine airspeed and altitude by precisely measuring both the dynamic pressure resulting from forward movement through the air, and the ambient static pressure at that altitude.

The air pressure measured in a pitot tube is the combination of the dynamic air pressure plus the static pressure. To determine the dynamic component (airspeed), the static pressure must be subtracted from the total pitot pressure. The dynamic component then directly relates to indicated airspeed. That is where the fun begins, as that value must then be corrected for temperature, pressure, and errors induced by the probe’s placement on the airplane to determine the airplane’s true airspeed.

You may have seen photos of flight-test aircraft where the probes are mounted on long poles that project out in to undisturbed air in front of the airplane for greater accuracy. No doubt, if production airplanes had those long probes, they would be broken on a regular basis by all manners of ramp equipment banging into them. Instead, the pitot, static, angle of attack, and other air data sensors are mounted on the fuselage.

Manufacturers attempt to position the sensors so that they can be reasonably accurate throughout the range of the airplane’s operating envelope. This can be quite challenging, as airflow around the fuselage changes quite a bit throughout an aircraft’s speed range. Sometimes the outputs of additional sensors, such as accelerometers, are used to tweak the air data to avoid erroneous readings.

Static ports are located to get an accurate measurement of the outside atmospheric pressure. But the ports have little choice but to be mounted on the fuselage somewhere, subject to local pressure differences as air flows around the complex exterior of the airplane. Almost all airplanes have some error due to the position of the static ports. These errors are carefully recorded during flight testing. The manufacturers provide a correction table and in the case of modern airplanes like the A330, build the corrections into the air-data computer software, so that the values displayed to the pilot are accurate.

The value of the measured static pressure must be corrected for this error before being used to calculate other parameters such as airspeed. The value of the correction depends in particular on the Mach, and takes into account the position of the sensors on the fuselage. Therefore, the correction performed for each static port is slightly different.
¹⁷

For each airspeed system, the calculation principle is as follows:

Knowing Pt (total pitot pressure) and Ps (static pressure) makes it possible to calculate a Mach value used to correct the Ps. The corrected Ps is then used to calculate the CAS (calibrated airspeed) and the standard altitude.

With the known Mach value, the total air temperature (TAT) measurement makes it possible to determine the static air temperature (SAT), which in turn makes it possible to calculate the true air speed (TAS).

The corresponding IR (Inertial Reference) then uses the true air speed to calculate the wind speed from its own internal ground speed and track values. It also uses the derivative of the standard altitude value that it combines with the integration of the vertical accelerations to calculate the vertical speed, known as baro-inertial (Vzbi), which is that displayed on the PFD.

The A330 static ports are located below the fuselage mid-line forward of the wing. On the A330-200 in particular, as a result of the position of the static pressure sensors, the measured static pressure overestimates the actual static pressure. One of the first effects after AF447’s pitot tubes became obstructed was that internal altimeter corrections were recalculated as if the airplane were flying at the lower speeds. This resulted in false indications of a 300 foot decrease in altitude and a downward vertical speed approaching 600 feet per minute.