AF447… What we now know

27/05/2011 — 12 Comments

 

Air France Tail plane (Image Source: Agencia Brasil CCLA 2.5)

The BEA has released a precis of the data contained on AF447′s flight data recorder and with the data so provided we can now look into the cockpit of AF447 in those last minutes of flight as the pilots battled to save their aircraft.

The BEA’s report in general supports my tentative theory that the pilots, presented with confusing and inconsistent information misinterpreted the situation and as a result inadvertently placed the aircraft into a deep stall.

This post is part of the Airbus aircraft family and system safety thread.

More specifically we now know that:

  1. the aircraft did not break up in a storm,
  2. the aircraft was responsive to control inputs up until it hit the sea,
  3. the accident commenced with an unreliable airspeed event,
  4. there was an initial high speed climb as the TCAS ACARS implied,
  5. the pilots did not carry out the unreliable air speed QRH,
  6. pilot inputs after the initial climb placed and maintained the aircraft in a high alpha (stall) state,
  7. As the cabin vertical speed ACARS implied the aircraft hit the sea at greater than 10,000 fpm.

While there are still open issues from the BEA report, such as the THS trimming to 13 degrees, it appears the danger that the pilots faced was not a tropical storm or failing aircraft but their own perceptions of the situation.

12 responses to AF447… What we now know

  1. 

    And the redundancy of three experienced pilots in the cockpit could not overcome the confusion and ambiguity of incorrect instrumentation about [apparently] just[?] the speed indications. They had 3min and 30sec to get their wits about them in some manner of collaboration, but PF stalled the aircraft for the whole time… or so it seems. An amazing failure!

    • 
      Matthew Squair 28/05/2011 at 1:30 am

      The problem in these circumstances is that humans are boundedly rational actors, that is we’re limited by a whole series of cognitive constraints, circumstance and biases. See the works of James Reason (amongst others) on human error if you’re interested.

      • 

        You sidestepped John’s point. Assuming your characterization of individual human behavior is correct, there were three people in the cockpit. One of the main reasons CRM exists at all is precisely to alleviate confirmation bias on the part on any one person. I recognize that we don’t have the full and detailed transcript yet, but it seems to me that we need is a theory about small group dynamics and “group think”. Even if the PF was a “strong but wrong” type there were two other people on the flight deck who had a responsibility to recognize that behavior and intervene.

        Given what we know at this stage, I’m not convinced that any of them had any theory or mental model at all about what was happening to them. It seems that they went from a state of surprise to a state of of being stunned or disbelief. I can’t recall the specific accident off the top of my head but there is one where the captain is caught on tape repeatedly saying, “why is it doing this?” in regards to the airplane’s response to his commands. The crew in this accident may never have got past the “huh?” stage.

      • 
        Matthew Squair 03/06/2011 at 10:14 am

        Hi Daniel, I agree with your comments on the objectives of CRM. As to whether it is truly as effective as it’s proponents would have us believe is another question. At the moment I think it’s premature to speculate too much on the crew dynamics without the benefit of a full transcript from the cockpit voice recorder. So yes I did side step the question. The most that we can say is that based on the released transcript no one perceived and therefore identified that they were in a stall. The consistent back force on the controller supports that conclusion.

        A final point on mental models, if the crew couldn’t fix the problem by applying learned skills or rules and recognised the fact (didn’t mistakenly apply the wrong rule) then, using James Reasons GEMS model, they would be operating in a knowledge based mode of problem solving. Unfortunately that type of information processing is also the most intensive in it’s use cognitive resources, slowest and therefore the most vulnerable to performance shaping factors such as time pressure and environment stressors. But as I noted before we have insufficient information at the moment to make these sort of conclusions.

  2. 

    I was told by an industry insider that different companies are operating different crew management procedures on long haul flights. Air France are carrying a team plus additional members (co-pilot) who are rotating during the flight. Other companies, like Singapore Airlines, are carrying 2 full crews who are alternating at the controls of the plane. Do these differences result in 2 different safety standards?

    • 
      Matthew Squair 29/05/2011 at 11:46 pm

      An excellent question. Crew dynamics and the effects of crew changes are an entire area of study in and of itself. But you should remember that in civil aviation crews are fairly ad hoc (unlike the military) with crew coordination coming from having worked in a small pool of company pilots for a while. As a comparison the US navy operates it’s nuclear submarine fleet with alternating (and highly stable) blue and gold teams. They have an exemplary nuclear and submarine safety record.

  3. 

    A simplistic summary at best. Multiple aircraft control modes, stall warnings that went silent when the aircraft was still fully stalled, fully trimmed-back stabiliser, not to mention known dud pitot probes or pilot training where I’ll bet they never had even seen a full stall in the SIM, let alone practice pushing the nose down past 30deg to recover. There’s more to this than just three “dumb” pilots fighting “their own perceptions of the situation”.

    These guys were set up by “the system”, big time.

    • 
      Matthew Squair 01/06/2011 at 2:02 am

      Thanks Al, not-withstanding the performance shaping factors you alluded to, it really does come down to perception of the situation.

      Why for example in a study conducted by the BEA on aircrew responses to unreliable airspeed events did they find that the most likely response was not to ‘fly pitch and throttle’ as per the QRH but to sit tight and do nothing? Why would crews go against the training? What is their perception of the situation (and risk)?

      Over the last decade there have also been a number of stall accidents on different airframes in which ‘stick forward’ was either never used or was insufficient. For example the 2005 West Caribbean MD-82 that crashed in Venezuela after the crew, reacting to a stall at cruise altitude applied full aft controls all the way to the ground. Why did all these aircrew fail to get the nose down and in this instance why did AF 447 crew do so as well?

      I’ll give you another example that combines unreliable air speed and stall. In 1975 a NW Airlines B727-251 crashed outside Thiells NY due to a loss of control after pitot icing and erroneous airspeed. Fundamentally the aircrew failed to recover the aircraft from a high alpha, low airspeed stall. They got themselves into that situation by misinterpreting aircraft performance anomalies as being due to the aircrafts light weight combined with unusual weather. In that investigation the NTSB made a very telling conclusion that even after the crew recognised they were stalling, “…they continued to react primarily to the high rate of descent indications and proprioceptive sensations because they continued to exert a pull force on the control column..”.

      The take home for me is that once a ‘theory’ of a situation has formed it can be very persistent and confirmatory bias (our tendency to only search for information that confirms a theory) can further reinforce it. In human error terms this is known as the ‘strong but wrong’ error type which highly trained and experienced operators are particularly vulnerable to.

      If you have the time (and inclination) read of some of my earlier posts if you want a deeper analysis. See http://msquair.wordpress.com/2010/04/14/the-airbus-a330-aircraft-system-safety/.

  4. 

    To me seems like the sequence of the fatal event it was:

    - extreme weather conditions
    - extreme weather conditions failed the speed sensors
    - failed speed sensors turned off auto pilot / auto thrust
    - without computer protected cruise, the plane was taken by the heavy turbulence, present in the flying zone
    - multiple, not prioritized, confusing warning sounds and lights are started on
    - the first reaction of the FP (flying pilot) was maybe not adequate, it was taken by surprise, and he also may be sleepy because he was woke up only 15 minutes earlier
    - the FP response induce a stall
    - the computer signals the start of the stall, then it goes quiet despite the plane remained stalled
    - the FP didn’t know that the plane is still stalled, the computer doesn’t help him
    - the plane falls down from the sky
    - when the stall warning sounded again, it was to late to apply the stall recovery procedures
    - the plane hits the ocean

  5. 

    zoli

    Not really, you missed quite a few things there…

  6. 

    Airbus seems to have changed its mind regarding the handling of stalls: on January 2011 new procedures appeared on Airbus’ “Safety Magazine”

    http://www.ukfsc.co.uk/files/Safety%20Briefings%20_%20Presentations/Airbus%20Safety%20First%20Mag%20-January%202011.pdf

    It seems this change in procedures is not exclusive to Airbus, but it involves the whole industry.

    So pilots on AF447 might have done what they were trained to, but today, these procedures do not seem to be the best way to keep the plane in the air in case of a stall.

    Gotchafr from Paris.

Trackbacks and Pingbacks:

  1. AF447 wreckage found - Page 56 - PPRuNe Forums - May 31, 2011

    [...] [...]

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s