Understanding Air France 447 (15 page)

The third message, also auto-flight related, indicates that the reactive wind shear detection was rendered inoperative. That system only works below 1,200 feet above ground and requires a reliable airspeed indication. There are no steps associated with this item, and it would not have applied at their altitude anyway.

Shortly after the autopilot disconnected, the autothrust disconnected and its message appeared above the Alternate Law annunciation.

There were two messages associated with autothrust:
AUTO FLT
A/THR OFF, and
ENG
THRUST LOCKED. The first message indicates that the autothrust has disconnected due to a fault, and the second that the engine speed is frozen at its last setting. Both include the corrective action, THRUST LEVERS...MOVE, indicating that the pilot needs to take control of the thrust levers.

On the ECAM display the THRUST LOCKED message appears above the autothrust-off message, and cycles on and briefly off every five seconds until the thrust levers are moved or the disconnect button is pushed. Each time it reappears a chime sounds, ”ding!” to get the pilots attention, insisting that the thrust levers be taken over manually.

At 02:10:16, 11 seconds after the autopilot disconnected, Robert said, “we’ve lost the speeds so...” He then read from the ECAM, “engine thrust A T H R engine lever thrust.” His reading of the ECAM was imprecise. This is not due to a transcript translation error as he spoke in English.

Bonin questioned the reading, “Engine lever?”

At 02:10:22 Robert read, “Alternate Law protections lost.” This was a major point that should have been made clear to the pilot flying. It indicates that the airplane will handle slightly differently, and that care must be taken to avoid exceeding the limits of the flight envelope.

At 02:10:23 instead of moving the thrust levers, the autothrust disconnect button was pushed before the THRUST LOCKED message chimed again, and because the thrust levers were in the climb detent, the thrust began to increase to climb thrust.

This is as far as they got in following the ECAM procedure.

The images above illustrate the display of the ECAM if no messages were cleared. The illustration below, shows all the faults and messages that would have been displayed in turn, had the clear function been used as intended. We do not know the extent to which the clear function was used, but because the transcript contains no more items read from the ECAM, it is reasonable to conclude that the ECAM was abandoned at that time.

The Theoretical Symptoms column lists the aural and warning light displays associated with each item:

• MW: Master Warning Light (a red general purpose awareness light in front of each pilot)
  
• MC: Master Caution Light (an amber general purpose awareness light in front of each pilot)
  
• SC: Single Chime
  

At 02:10:39 climbing through 37,000 feet First Officer Robert switched the source of the right side instruments to the #3 source for air data and attitude/heading, saying: “I’ll put you in A-T-T.” There is no ECAM step directing this, but if he doubted the accuracy of the instrument readings it is not an unreasonable thing to do.

The
NAV
ADR DISAGREE message at 02:12 indicated a disagreement between airspeed sources and did not annunciate until two minutes or more after the pitot clogging started. This may indicate that the left and right airspeed displays agreed up until that point, even if they were wrong. Since the right side display is not recorded, it is not possible to be sure. This message indicates that the primary flight control computer has rejected an air data reference (ADR), and then identified an inconsistency (”disagree”) between the two remaining ADRs on one of the monitored parameters (i.e., airspeed). This condition left the system with no known trustworthy reference for the airspeed.

At 02:12:15 the selectors were positioned to place the left side instruments on the #3 source, immediately followed by First Officer Bonin saying “There you are.” However, Bonin was the only person making control inputs at this time, so it is not clear who moved the selectors. It is clear why the air data source would be selected, but not why the attitude source was.

There were no comments made about unreliable attitude indications, though the captain did refer to the standby horizon at 02:12:23 while approaching 24,000 feet, “The wings to flat horizon, the standby horizon.” (The standby horizon has independent sensors and is not connected to the three inertial reference systems or the ATT/HDG switch.) At 02:13:32 passing 10,000 feet the air data selector is placed back in the NORM position.

Seconds before the air data selector was positioned back to NORM, First Officer Robert told the captain, “Try to find what you can do with your controls up there, the primaries and so on.” Despite the captain’s remark that “It won’t do anything” (he was correct), the final ECAM messages PRIM 1 FAULT and SEC 1 FAULT indicate that at 02:13:37 and :39 they were selected off - and presumably back on - in a reset attempt. This reset step is not in the procedure and is not a method for restoring Normal Law. It was a made-up corrective action.

Auto-thrust

The Airbus thrust lever design differs from that used on Boeing and most other aircraft that have autothrust/auto-throttles. The difference has led to some misstatements in articles concerning the meaning of the thrust lever positions, especially the term “TOGA.”

Most other manufacturers use a motor driven servo to move the thrust levers to reflect the autothrust command to the engines. This is commonly called
auto-throttle
as the system moves the throttles/thrust levers. This design allows for pilot awareness of engine activity, as he can see and feel the thrust levers move, and the pilot can change their position if the auto throttle system is not doing exactly what is desired. This design requires other switches to signal a desired change in mode, such as telling the autothrust system to select takeoff thrust, reduce to climb thrust, and to advance to and maintain power for a go-around. Proper settings for climb power, maximum continuous power, and full power are determined by setting the power according to the engine instruments.

On Airbus aircraft, when the autothrust is off, the pilot manually controls the thrust in a conventional manner, that is, engine speed correlates with thrust lever position.

The thrust levers have tactile detents at the climb power, maximum continuous power, and full forward stop which is the Take-Off/Go-Around position (TOGA). When the autothrust is on, and the thrust levers are between idle and the climb detent (known as the active range), the autothrust has the authority to control the thrust within that range. The lowest allowable thrust being idle (as used in descents) and the highest is the actual position of the thrust lever. The thrust levers are normally in the climb detent, but could be positioned to a lower setting to limit thrust, though it is rarely done. When the thrust levers are positioned out of this active range, i.e., moved above the climb detent, the thrust lever directly controls the engine speed, thus always allowing the pilot to gain control and add thrust by simply pushing the thrust levers forward.

The design incorporates the selection of the various thrust modes simply by positioning the thrust lever itself, eliminating the need for other switches or selections in the flight management computer. In this system, the thrust levers are not back driven, saving the weight and complexity of the servo mechanism.

The thrust levers are normally placed in the climb (CLB) detent from shortly after takeoff until shortly before touchdown. So, it is a normal situation for the actual engine thrust to be something lower than the current position of the thrust levers. When the autothrust disconnects due to a failure, the actual engine thrust remains at its previous setting instead of suddenly matching up with the current thrust lever position. This mode is called “thrust lock”. Locked may be too strong a term, for as soon as the pilot moves the thrust levers, the engine thrust will try match the actual thrust lever position. Therefore when a failure occurs, the ECAM step says “THRUST LOCK, THR LEVERS … MOVE”. Because there has been no actual change in engine thrust, this could otherwise easily go unnoticed. To remind the pilot that manual control must be taken, a single chime will sound every 5 seconds until the thrust levers are moved (wherein the thrust will match the new position) or the disconnect button is pressed, in which case the thrust will also match the thrust lever position - climb.

There is an automatic thrust function called Alpha Floor that is worth mentioning as well, though it was not a factor on AF447. It is a protection built into the autothrust system instead of the flight controls.

Alpha Floor will automatically select TOGA power when a set of continuously monitored parameters detects a pending high angle of attack situation, regardless of the actual position of the thrust levers. Its purpose is to initiate a preventative recovery before the situation becomes critical. The activation threshold is calculated such that aggressive maneuvering will trigger its activation at a higher speed than a slow speed decay. It is only operable in Normal Law, above 100 feet, below Mach .53, and only when the autothrust is operational. Once activated and the triggering parameters are no longer present, the thrust mode reverts to Thrust Lock, with the thrust set at TOGA regardless of the thrust lever position. Thrust lock is then disengaged by disconnecting the autothrust.

On AF447, seven seconds prior to the disconnection of the autopilot and autothrust, the crew had elected to slow down slightly due to turbulence. As a result, the engine power reduced from the normal 95% N
₁
²⁶
setting for cruise to 84% N
₁
in order to accomplish the speed reduction. When the autothrust disconnected moments later, the power remained there while in thrust-lock mode.

15 seconds after the autothrust disconnected, the disconnect button was used to deactivate the thrust lock. This commanded the engines to climb power (where the thrust levers were positioned), which is not significantly more than normal cruise power at that altitude. 20 seconds later the thrust levers were reduced for about 7 seconds before they were advanced to TOGA.