Questions Raised about Airbus Automated Control System

Der Spiegel (Germany)    05/30/2011

Author: Gerald Traufetter

 

It took just three-and-a-half minutes for Air France flight AF 447 to plunge 11,000 meters into the Atlantic two years ago. An initial analysis of the plane’s data recorder hints at errors made by the pilots. But questions have also been raised about the A330’s automated control systems.Everything pointed to a routine flight, two years ago. The Airbus A330 was flying along at its cruising altitude high above the Atlantic Ocean and had just passed an area of light turbulence. The captain of the flight, Marc Dubois, left the cockpit for a bit of rest.

Co-pilot Pierre-Cédric Bonin, whose wife was a passenger onboard the aircraft, told the cabin crew that “in two minutes we should enter an area where it’ll move about a bit more than at the moment.” The co-pilot’s exact words are part of the interim report on the crash of Air France flight AF 447, released by the French aviation accident investigation agency BEA on Friday. The report, dry and almost entirely free of commentary, provides insight into the final three-and-a-half minutes of the flight, before it plunged into the Atlantic killing all 228 people on board.

Based on an initial analysis of the flight data recorders, the anticipation prior to the report’s release was high. Both the data recorder and the voice recorder belonging to the Airbus, which crashed on June 1, 2009, were found on the ocean floor at a depth of 4,000 meters (13,125 feet) in early May.

‘A Mysterious Crash’

The crash of the A330 had made millions of airline passengers uneasy. How, many wondered, was it possible for a passenger jet to simply be lost as it traversed the ocean? It was reminiscent of ships disappearing without a trace on the high seas in bygone centuries. Would the data recorders finally solve the mystery?

It was only much later, after hours of radio silence and well after the plane was scheduled to have completed its crossing of the Atlantic, that planes were dispatched to search for the missing Airbus.

Even experienced accident investigators were caught completely off guard by the calamity. “This is a mysterious crash,” said Peter Goelz, former head of the National Transportation Safety Board (NTSB) in Washington. He said it was in the same category as air disasters such as that on the island of Tenerife in 1977, with 583 deaths, the deadliest in the history of air travel.

On Wednesday of this week, families of the victims — from 32 countries — are set to gather in Paris and Rio de Janeiro to mark the second anniversary of the crash. The meeting is taking place at a time when the veil that has covered the accident in mystery may slowly be lifting. The four-page BEA report provides answers to several of the most pressing questions the crash left behind — and raises just as many additional issues.

The drama began at 2:10 a.m. and 5 seconds GMT: Without warning, the autopilot and the auto-thrust disengaged. The report is silent as to why. But crash investigators have an explanation: The three speed gauges on the outside of the aircraft, known as pitot sensors, had become iced up.

Extremely Dicey Situation

Suddenly, the routine flight turned into a nightmare. “I have the controls,” co-pilot Bonin told his colleagues. At that point, the aircraft pitched to the right and Bonin quickly moved to correct and to pull up the plane’s nose. His colleague informed him: “We’ve lost the speeds.”

It must have been clear to both of them that they were suddenly in an extremely dicey situation. At the plane’s cruising altitude of 11,000 meters (36,000 feet), maintaining a precise speed is critical. Just 15 kilometers per hour (9.3 mph) faster or slower and the plane can stall. With the margin of error so small, pilots call this altitude “coffin corner.”

And it wasn’t long before the cockpit was pierced with the feared warning: “Stall! Stall!” The warning comes from a synthetic voice and is accompanied by signal loud enough that the business class passengers behind the cockpit must have been able to hear it.

In such moments, however, the noise from outside the aircraft is one that heralds disaster. The sound of the wind rushing past disappears and only the high-pitched whines of the two turbines is audible inside the cabin. Aviation experts know that the noise means that the plane’s wings are no longer providing enough lift.

It is at this moment in the sequence of events where expert opinions diverge when it comes to the answer to the most fundamental of all questions: Who was to blame for the deaths of the 228 people on board the flight? An animated debate has erupted between the plane’s manufacturer Airbus and other experts. The interim report is short on clear answers.

A Serious Error

The pilots reacted to the stall warnings with maximum thrust — just as was called for in the training manuals. But they also pulled the nose of the aircraft up. It is an intuitive thing to do, but aeronautically it is a serious error.

Increased thrust can result in an aircraft’s nose rising on its own and manufacturers themselves have recognized the problem. In a Flight Operations Telex dated May 12, 2010, Airbus removed the maximum thrust instruction from its flight manuals.

But why would co-pilot Bonin pull up instead of pushing the nose down? It wasn’t long before the plane’s angle to the onrushing air became dangerously high.

An explanation for the A330’s rising nose, however, could also be provided by a line in the BEA report referring to the trimmable horizontal stabilizer. Situated at the tail of the aircraft next to the flaps controlling the aircraft’s pitch, known as the elevator, the horizontal stabilizer likewise helps control the plane’s horizontal stability. According to the BEA’s interim report, the horizontal stabilizer moved from three degrees to 13 degrees, almost the maximum. In doing so, it forced the plane into an increasingly steep climb. It “remained in the latter position until the end of the flight,” the report notes.

Airbus considers the reading not to be out of the ordinary and refers to the co-pilot’s efforts to pull the nose up.

But Gerhard Hüttig, a professor at the Institute of Aeronautics and Astronatics at the Technical University in Berlin, considers the high angle of the horizontal stabilizer to be a failure of the Airbus’ electronic flight control system. Hüttig, a former Airbus pilot himself, calls it “a programming error with fatal consequences.”

“No matter how hard the crew tried to push down the nose of the aircraft, they would have had no chance,” Hüttig says. He is demanding that the entire fleet of Airbus A330s be grounded until the phenomenon is adequately explained.

The BEA report, in its current form, only provides the angle of the stabilizer but provides no explanation as to why. The report merely indicates that it was at this moment that Captain Marc Dubois re-entered the cockpit.

Exactly what orders he issued are not part of last Friday’s report. But sources close to the investigation are saying that he said: “This is a stall. Reduce power and nose down!”

This order would have been the correct one were the situation not already hopeless. By that time, the jet, which was pointing steeply upwards, was already losing vertical altitude at a rate of 200 kilometers per hour.

The passengers, who had just a short time before been pressed into the backs of their seats, were now being held into their seats only by their seatbelts. “At this moment, I would have feared for my life even if I was sitting in the passenger cabin,” said one A330 pilot after reading the BEA report. That the plane was in freefall would have been clear to all on board. The nose of the plane pointed skyward at an angle of 16 degrees. “That’s more than immediately following takeoff,” the pilot said.

Too Late

In its report, the BEA has only published statements from the pilots that contain information about technical matters. “I don’t have any more indications,” said the co-pilot Bonin, for example. One and a half minutes of free fall later, he said: “We’re going to arrive at level one hundred.” That means that the plane is only 3,000 meters above sea level.

The last few minutes of Flight AF 447 must have been especially tragic for Captain Dubois. The rules do of course stipulate that the captain can rest in the rear area during this phase of the flight. But why did he not remain in the cockpit until they had passed through the storm?

On his return, the experienced pilot recognized the situation immediately and issued the correct commands. But if the suspicion of aviation expert Hüttig is accurate, by this stage it was too late to change anything.

Indeed, the BEA report documents efforts undertaken following the captain’s return to bring the plane’s nose down. Forty-one seconds before impact, both co-pilots were pushing on the controls. Then Bonin cried desperately: “Go ahead, you have the controls.” There were just 30 seconds left before the end.

But why were all the crew’s efforts in the cockpit in vain? Did the plane no longer react to the cockpit commands as it fell? Or did the horizontal stabilizer, which was still almost fully deflected at 13 degrees, continue to force the nose of the plane up?

Airbus vehemently denies that the plane’s automatic controls could have worked against the pilots’ commands. Were the suspicions proven true, however, then the software would have to be replaced in over a thousand A330s and in its sister model, the A340. The costs would run into hundreds of millions of euros.

Insufficient Recommendations

In any case, flight engineer Hüttig, who also advises the victims’ families regarding technical issues, is concerned about the description of the horizontal stabilizer as being at 13 degrees. That is consistent with behavior he observed in an Air France A330 simulator in Paris a few months ago, when he replicated the situation together with other pilots. “The phenomenon is startlingly similar,” he says.

Was it really the stabilizer that doomed the pilots? In theory, they could still have adjusted it — its position can be manually altered using a wheel near the thrust levers. But as Hüttig notes, one would first have to know that the stabilizer is deflected.

Huttig pointed out that Airbus published a detailed explanation of the correct behavior in the event of a stall in the January issue of its internal safety magazine. “And there, all of a sudden, they mention manually trimming the stabilizers,” he says.

It remains an open question who will be proved right at the end of the investigations. But it is already clear that no one individual will bear the burden of responsibility alone. The pilots could have stabilized the aircraft if they had reacted differently. But the airline had also probably not prepared them properly for such a situation. Similarly, Airbus’ recommendations were insufficient. That much is spelled out in the files of the French authorities which investigated the crash of the A330. “To date,” the experts say, the deficiencies have “not been rectified.”

If the speed sensors fail, it has a “particularly confusing” effect in Airbus models, the experts say, pointing to the high degree of automation in the cockpit. “If the control computers, which are actually supposed to provide more safety, fail, then the automatic systems can become a danger at that moment,” says William Voss, president of the Flight Safety Foundation.

‘No Unsafe Condition’

The manufacturer Thales was well aware of the catastrophic consequences of a failure of the speed sensors as early as 2005. At the time, the French company concluded that such a failure could “cause plane crashes.”

A total of 32 cases are known in which A330 crews got into difficulties because the speed sensors failed. In all the cases, the planes had pitot sensors from Thales, which were significantly more prone to failure than a rival model from an American manufacturer.

But none of the responsible parties intervened. In 2007, Airbus merely “recommended” that the sensors be replaced. Air France took that as a reason not to carry out the costly work — and it even got official blessing for doing so. The European Aviation Safety Agency wrote that it currently saw “no unsafe condition that warrants a mandatory modification of the Thales pitot tubes.”

The letter was sent on March 30, 2009, almost two months to the day before Flight AF 447 ended in tragedy.

In their accident report, the BEA investigators noted the end of the recordings at 2:14 a.m. and 28 seconds on June 1, 2009: “The last recorded values were a vertical speed of -10,912 ft/min.”

In other words, the Air France plane hit the Atlantic at a speed of almost 200 kilometers (124 miles) per hour.

 

Also see http://www.flightglobal.com/articles/2011/06/01/357394/stalled-af447-did-not-switch-to-abnormal-attitude-law.html for a discussion about autotrim and indeed accidents caused by it.