Understanding Air France 447 (11 page)

Airplanes are equipped with stall warnings to allow the pilot to correct high angle of attack situations before they become an issue. The warning intentionally comes on prior to the actual stall so that the pilot may recover. It is not necessarily an indication that the wing is currently stalled.

On some types of airplanes (Airbus A320, for example), because of the aerodynamic characteristics in the approach to stall, the stall warning threshold is often independent of Mach. On the A330 and other airplanes of its generation, the stall warning angle of attack is adjusted by Mach number.

The stall margin at cruise altitude/Mach is quite small. The stall warning is set to be sensitive, to give the pilot an indication that maneuvers must be made cautiously.

A complicating factor in activating the stall warning is calculating the Mach number in order to determine the stall angle of attack. If the airplane’s sensors are compromised, as they were for much of AF447’s ordeal, the stall warning will not accurately reflect the stall angle of attack for the current Mach number because it is not known.

On the A330, if no Mach is valid the warning threshold for values below Mach 0.3 is used. If the actual Mach number is .82 then the stall warning requires an angle of attack of over two times the correct one to activate, potentially resulting in no warning prior to the stall. However, in the AF447 case that was not a factor. There was never a time when the stall warning was inhibited by the stall warning threshold being incorrectly high. From the time of the initial stall at about 02:10:50, which was about 10 seconds before the peak altitude of 37,924 feet was reached, the actual angle of attack was always high enough to generate the stall warning whenever the AOA was considered valid (i.e., the airspeed was above 60 knots). The stall warning came on at about 6° AOA, and the stall buffet is recorded starting when the AOA passed through about 10° a few seconds later.

As long as the data from the angle of attack probes is considered valid, it will reference the stall warning from the AOA probe with the highest value. This may tend to produce the warning somewhat early due to gusts or turbulence, and as a result, would tend to be on only for short periods of time. Some refer to this as a “false warning,” but it is a conservative approach to generating the warning. Studies show that most pilots, when presented with this scenario do not react strongly to the stall warning because while the triggering of the stall warning was noticed, it was unexpected and many crews tended to consider it as inconsistent with how they were handling the airplane, which would be that they were not making excessive inputs.
²²

A factor that may affect the ability to recover promptly from a stall is the effect of the application of thrust. With engines mounted below the center of gravity, like the A330 and many other large transports, an application of thrust induces a pitch-up moment. This is obviously contrary to the pitch down required to reduce the angle of attack and recover from the stall. If other pitch-down capabilities are compromised (e.g., aft CG, low elevator effectiveness from a nose-high stab trim setting), a high power setting may actually inhibit the ability to pitch the nose down and recover from the stall condition, or may at least slow the pitch down maneuver. This is not a consideration that was well taught until recently. At the time of the accident, the first step in response to a stall was the application of full power.

AF447 may have been in a position where reduction of thrust would have helped bring about an effective recovery. There are two points where nose down inputs were made, one at about 24,000 feet and the other around 9,000 feet. In each instance the pitch down command was followed by a pitch reduction and a decrease in the angle of attack. The pitch reduction resulted in a nose-down attitude of as low as of 8° below the horizon (which would look and feel quite steep), but the angle of attack only reduced from 40° to 35°, and therefore remained many times higher than the stall angle of attack. The airplane would have needed to pitch down significantly more to completely restore proper airflow over the wings, followed by a pitch up maneuver, being careful not to stall again in a high-g pull up.

Unfortunately, sufficient nose down inputs were not held long enough to complete the recovery. In fact, aggressive nose down inputs were never made for more than a few seconds, and when they were, they were followed with nose-up inputs by Bonin in the right seat. Even though the engines were at about climb power or greater for both events, the majority of the elevator’s range of movement remained unused. This indicates to me that the ability to pitch down and reduce the angle of attack enough to recover remained a possibility. However, a lower power setting may have helped the nose pitch down faster. Correction of the full nose-up trim may also have been required to regain full pitch control.

How much altitude it would have taken to complete the recovery is anyone’s guess, many thousands of feet for sure. Even the experts at Airbus declined to guess where the last point the airplane was recoverable from might be.

Since the accident, the FAA and the main aircraft manufacturers, including Airbus, ATR, Boeing, Bombardier and Embraer, have gotten together and issued a joint stall recovery technique that displaces the application of full power as the first step. The focus is now on using pitch to reduce the angle of attack, then followed by application of power when the airplane is under control again.

Flight Controls

No Airbus discussion, and no in-depth discussion of this accident is complete without covering the Airbus’s fly-by-wire flight control laws. Almost immediately after the loss of reliable airspeed data, this A330’s flight controls had degraded from Normal Law to Alternate Law. The aircraft’s handling characteristics changed slightly and most in-flight protections were lost.

Fly by Wire Introduction

In a fly-by-wire control system, included on airplanes like the Airbus A320, A330, A340, A380, and Boeing 777 & 787, the pilot’s inputs are provided to sophisticated flight control computers that then position the flight controls according to programming, called flight control laws.

Computers can be programmed to behave in any way desired, so engineers worked to program out characteristics that they deemed undesirable and programmed in behaviors that were favored instead. The latest jet fighters, bombers, and the space shuttle are all fly-by-wire, and it is said that many would be virtually uncontrollable were it not for the fly-by-wire system.

SideSticks

Airbus fly-by-wire aircraft use a sidestick controller and conventional rudder pedals for pilot control inputs. Stick-type controllers are no stranger to most pilots and are found in aircraft ranging from gliders, helicopters, and Piper Cubs to jet fighter aircraft and the Space Shuttle. On the Airbus, the stick controllers are positioned forward and outboard of each pilot’s seat and are therefore called sidesticks.

Each sidestick is lightly spring loaded to its center detent. Each is equipped with a combination autopilot-disconnect/takeover push button (the red button in the photo above), and a push-to-talk trigger on the front side for communications. The two sidesticks are not mechanically linked, nor do they move unless the pilot moves them. Moving one, does not move the other. Except on the ground, the position of the sidesticks is not displayed.

It is difficult to see the other sidestick, and in flight there is no indication of its position to either pilot. If both sidesticks are moved at the same time, their inputs are summed. Full forward on one and full back on the other results in no pitch command, but that is contrary to how it should be flown. However, when both sidesticks are out of the center detent at the same time, a green light in front of each pilot flashes, and a synthetic voice calls out “DUAL INPUT.” This “DUAL INPUT” call was heard on the AF447 cockpit voice recording during three separate time periods.

All pilots are taught that only one pilot should be flying at at time, and that is no exception with the sidesticks. In an Airbus that discipline is critical. The voice recorder transcript includes exchanges of that transfer of control, e.g., “I have the controls.” The takeover push-button is not meant to resolve a fight over who is flying the airplane. Its primary function is to override erroneous inputs due to mechanical or electrical malfunction. When a pilot’s sidestick is being overridden due to the opposite takeover push-button, a red arrow illuminates on the glare-shield in front of the pilot losing control, pointing to the pilot who has taken control. The last pilot to push the button gains control overriding opposite sidestick’s inputs while it is held down. If held for more than 40 seconds, the opposite sidestick is locked out until its takeover push-button is pressed. The point is that simultaneous dual input is not only against procedure, but when it happens, both aural and visual indications alert the crew so that a dangerous or confusing situation can be avoided.

The sidestick design is not without its detractors, including those that believe their design to be a contributing factor to the accident.

While it is difficult to see the other pilot’s sidestick position, there is rarely a reason to. The combined input is shown on the Primary Flight Display (PFD) only on the ground, intended for use in pre-takeoff flight control check. But again, the opposite sidestick can be assumed to be in neutral unless the green light is on and “DUAL INPUT” is being repeatedly announced.

When Captain Dubois returned to the cockpit, one minute and forty seconds after the autopilot disconnected, it is assumed he was standing aft of the center pedestal, between the two pilots, or likely sitting on the jumpseat in the same location. From that position, the sidesticks were blocked from view, unless he deliberately leaned forward to look.

The evidence that the hidden sidestick position was an issue is that as they were descending through about 9,000 feet, Robert told Bonin to “climb, climb, climb, climb.” When Bonin responded that he had “been at maxi nose up for a while,” the captain responded with “no, no, no, don’t climb,” and Robert took the controls within a few seconds. One theory is that had there been a big control yoke in front of both pilots, and one was pulling back as the stall warning was going off, it would be readily apparent to everyone what was happening and it could have been corrected earlier. In fact, there are a few seconds before Bonin relinquished the controls that his sidestick was all the way back, Robert’s was all the way forward, and no pitch change occurred. This obviously could not happen with mechanically linked controls.

Pilots transitioning from conventional flight control aircraft to the sidestick do so quite easily and naturally. Most will have flown some type of stick controlled aircraft in their career making it a natural transition. Even for those that have not, it is rarely an issue. However, the sidestick input is best flown with a gentle hand. Light fingertip pressure is often all that is needed to fly precisely. A firm grip and strong inputs are almost certain to result in over controlling the airplane. Constant displacement on the sidestick is almost never required, but that is exactly what the pilot flying aboard AF447 was doing as he was losing control of the airplane.

Flight Control Laws

In the past, flight controls were designed to meet two sets of criteria: they had to be “well harmonized” and had to meet the criteria for certification. With Fly-By-Wire, three possibilities have been added: improved safety by restricting maneuvers which could lead to a loss of control, reduced weight of the structure with the prohibition of some actions which may increase the loads, and finally improved comfort for the passengers.
²³

On the Airbus family, the flight control laws are similar, but not exactly the same between models A319/320/321, A330/A340, A380, and soon, the A350. Each enjoy the results of progress in design with their respective age, as well as differences due to the nature of the aircraft itself. The point being that the A320 flight control system, flight control laws and the transition between them are not the same as the A330. As a result, there are a number of posts, articles, and opinions based on A320 flight control system that do not apply correctly to the A330.