Archives For AF 447

How do we  give meaning to experience in the midst of crisis?

Instead people strive to create a view of it by establishing a common framework into which events can be fitted to makes sense of the world, what Weick (1993) calls a process of sensemaking. And what is true for individuals is also true for the organisations they make up. In return people also use an organisation to make sense of what’s going on, especially in situations of uncertainty, ambiguity or contradiction.

Continue Reading…

Airbuses side stick improves crew comfort and control, but is there a hidden cost?

The Airbus FBW side stick flight control has vastly improved the comfort of aircrew flying the Airbus fleet, much as the original Airbus designers predicted (Corps, 188). But the implementation also expresses the Airbus approach to flight control laws and that companies implicit assumption about the way in which humans interact with automation and each other. Here the record is more problematic.

Continue Reading…

Thinking about the unintentional and contra-indicating stall warning signal of AF 447 I was struck by the common themes between AF 447 and the Titanic. In both the design teams designed a vehicle compliant to the regulations of the day. But in both cases an implicit design assumption as to how the system would be operated was invalidated.

Continue Reading...

The BEA third interim report on the AF 447 accident raises questions

So I’ve read the BEA report from one end to the other and overall it’s a solid and creditable effort. The report will probably disappoint those who are looking for a smoking gun, once again we see a system accident in which the outcome is derived from a complex interaction of system, environment, circumstance and human behavior.

However I do consider that the conclusions, and therefore recommendations, are hasty and incomplete.

This post is part of the Airbus aircraft family and system safety thread.

Continue Reading…

The BEA has released a precis of the data contained on AF447′s Flight Data Recorder and we can know look into the cockpit of AF447 in those last terrifying minutes.

Continue Reading...

Retrieval of the data recorders heralds the end of the beginning for the AF 447 accident investigation, rather that the beiginning of the end…

Continue Reading...

Over the last couple of months I’ve posted on various incidents involving the Airbus A330 aircraft from the perspective of system safety. As these posts are scattered through my blog I thought I’d pull them together, the earliest post is at the bottom.

Continue Reading...

A330 Right hand AoA probes (Image source: ATSB)

I’ve just finished reading the ATSB’s second interim report on the the QF 72 in flight upset that resulted in two uncommaned pitch over events (1). In this accident one of the Air Data Inertial Reference Units (ADIRU) provided erroneous data in the form of transient spikes vales of the angle of attack AoA parameter to the flight control computers which then initiated two un-commanded extreme pitch overs.

This post is part of the Airbus aircraft family and system safety thread. Continue Reading…

So far as we know flight AF 447 fell out of the sky with its systems performing as their designers had specified, if not how they expected, right up-to the point that it impacted the surface of the ocean.

So how is it possible that incorrect air data could simultaneously cause upsets in aircraft functions as disparate as engine thrust management, flight law protection and traffic avoidance?

Continue Reading...

From the BEA’s second interim report (BEA 2009) we now know that AF 447 was flown into the water in a deep stall. Given the training and experience of the flight crew how did they end up in such a situation?

Continue Reading...

Reading the 2nd BEA interim report’s analysis of ACARS message timing provides us with a further refinement of a calculation of AF 447′s terminal vertical speed (posted here) based on the cabin vertical speed advisory.

Continue Reading…

After several months of undersea searching for the black boxes of AF 447, no joy. So, let’s ask a simple question. Why should the FDR’s end up on the sea bed in the first place?

Continue Reading...

The TCAS II specification credibility window can provide us with an insight into the magnitude initial unreliable air data parameters in the AF 447 disaster.

Continue Reading...

The latest revision of the BEA report on the AF 447 accident omits mention of the last ACARS message received, a cabin vertical speed advisory. But from this message we can infer at least approximations of the final segments of AF 447′s flight profile.

Continue Reading...

Pitot sensor (Source: BEA)

The theory of Highly Optimised Tolerance (HOT) predicts that as technological systems evolve to become more robust to common perturbations they still remain vulnerable to rare events (Carlson, Doyle 2002) and this theory may give us an insight into the performance of modern integrated air data systems in the face of in-flight icing incidents. 

Continue Reading…

Invalid air data may have triggered the cabin pressure differential safety function on AF 447.

Continue Reading...

A cross walk of the interim investigation accident reports issued by the ATSB and BEA for the QF72 and AF447 accidents respectively shows that in both accidents the inertial reference units that are part of the onboard air data inertial reference unit (ADIRU) that exhibited anomalous behaviour also declared a failure. Why did this occur?

Continue Reading...

Authors Note. Below is my original post on the potential causes of the AF 447 cabin altitude advisory, I concluded that there were a number of potential causes one of which could be an erroneous altitude input from the ADIRU. What I didn’t consider was that the altitude advisory could have been triggered by correct operation of the cabin pressure control system, see  The AF 447 cabin vertical speed advisory and Pt II for more on this.

The last ACARS transmision received from AF 447 was the ECAM advisory that the cabin altitude (pressure) variation had exceeded 1,800 ft/min for greater than 5 seconds. While some commentators have taken this message to indicate that the aircraft had suffered a catastrophic structural failure, all we really know is that at that point there was a rapid change in reported cabin altitude. Given the strong indications of unreliable air data from other on-board systems, perhaps it’s worthwhile having a look for other potential causes of such rapid cabin pressure changes.

Continue Reading…

TCAS Indicator (Image Source: Public Domain)

What TCAS can tell us about AF447 (Updated 27 Sept 09)

The BEA interim report on the AF447 accident confirms that the Traffic Alert and Collision Avoidance System (TCAS) had become inoperative during the early part of the event sequence for an, as yet, un-identified reason. The explanation may actually be fairly straight forward and lie within the fault tolerance requirements of the TCAS specification. Continue Reading…