Understanding Air France 447 (25 page)

In the decade of 2000-2011, almost 1500 people died in loss of control in-flight accidents.
⁴⁰
If the fatality rate could be reduced by any meaningful measure by applying the risk to the pilots in training instead of the traveling public, it seems to be a reasonable thing to do. There are, of course, the cost and logistical factors of adding a completely new type of training, that is not widely available, any applying it to tens of thousands of airline pilots. It will not come without resistance from those paying for it.

ICATEE believes the current airline pilot population should receive dedicated simulator sessions in upset recovery training, “including specific elements that can create surprise in the simulator.” It should be followed by recurrent training every 3-5 years.
⁴¹

Creating an element of surprise in simulator training will not be easy. Nobody expects to go to a training or checking session and sit at cruise for 8 hours. The subjects to be covered are known to the trainees, even if they were not well briefed immediately prior to the training session. A degree of randomness in checking scenarios is often currently used, but the simulator’s programming and the instructor’s ‘bag of tricks’ contains only so many possibilities.

In 1985 we did not know how to train crew-resource management (CRM), threat-and-error management (TEM), or how to incorporate other human factors elements. All of which are integrated into flight crew training now. Perhaps techniques will be developed to better prepare pilots to deal with startle, surprise, working under high stress situations.

Enhancements to the simulators themselves to add additional faults (e.g., clogged pitot scenarios) and simulations of post-stall behavior will neither be easy nor inexpensive. Detailed analysis of incidents and accidents like AF447 by simulator manufacturers and regulatory authorities will go a long way toward making the simulators of the future better than today’s.

Chapter 10: Lessons Learned

There is much to be learned from almost every accident and the loss of AF447 is no exception. This accident centered around a loss of control at altitude. According to the British Civil Aviation Authority, loss of control events have been identified globally as the current most serious risk to flight safety - and the biggest single cause of commercial air accidents over recent years. Loss of control often follows a partial or full stall to an aircraft.

Many of the largest threats of the past such as controlled flight into terrain, wind shear, and mechanical failure have been very successfully reduced with improved Ground Proximity Warning Systems (GPWS), improved airborne weather radar, wind shear detection and recovery guidance, and improved engineering.

High Altitude Stalls

Clearly this is a stall accident. All of the major aircraft manufacturers have updated their stall recovery procedures to emphasize reducing angle of attack as the immediate and primary means of stall recovery, with power application only after control is assured. These revised procedures also acknowledge that high power settings on airplanes with low hung engines may in some instances be contrary to the ability to reduce angle of attack effectively. We have seen, in this case, how at one point the reduction of power caused the nose to pitch down and angle of attack to reduce. Unfortunately, the pilots were acting contrary to the required inputs to complete the recovery.

Primary flight students are taught that an airplane always stalls at the same angle of attack. That is true enough within the operational envelope of a single engine Cessna. However, when the effects of high speed flight are concerned, where speed is measured in Mach number, we find that airplanes
do not
always stall at the same angle of attack. The stall angle of attack at high speeds due to the compressibility of the air at high speeds (and some egghead fluid-dynamics factors) is significantly lower, on the order of 5°—6° at Mach .80, where the cruise AOA is about 2.5°. This means the maneuver margin is significantly reduced. You cannot yank on the stick like you can at 5,000 feet.

This narrowed stall margin is reflected in what jet pilots refer to as the “buffet margin.” At low altitudes we have a 2.5 g limit and can maneuver freely within that range with no stall warning. The 2.5 value is also a structural load limit, in many scenarios the stall limit would be higher. At altitude we see only 1.3 or 1.5 g margin is available before stall. (Thus, a .3 g margin from normal 1 g flight, vs. 1.5+ g margin at low altitudes and speeds - a factor of five!) Pilots must be gentler on pitch maneuvers at high altitudes to avoid stall.

For Airbus pilots, Normal Law normally provides protection, but not Alternate Law. As a result, Airbus has increased the stall warning margin a bit in this regime to provide adequate warning. As explained earlier, there is a very narrow angle of attack margin between cruise and stall warning. One result of this is that when flying in Alternate Law in turbulence, the stall warning may sound momentarily with vertical gusts. It should warn the pilot to continue to maneuver with care, as a stall is not far away, even though recovery action is not necessary for these transient warnings.

Pair this concept with the fact that there is significantly less "excess" power available at altitude. In cruise there is little difference between cruise power and full power. Contrast this with the low altitude regime where application of TOGA thrust imparts a significant power addition and allows the possibility of "powering out" of a stall situation. No such ability exists in the high altitude/high Mach arena. At a given point on the drag curve, it is impossible to accelerate in level flight with the available power alone. Therefore, stall recovery MUST be accomplished with a reduction in pitch to lower the angle of attack. If airspeed has been lost, there is little excess power to regain it with, the only available source of energy, even once the AOA has been reduced, is to trade altitude for airspeed.

There is a reason that pilots are taught stall recognition and recovery from
incipient
stalls. We do not take airliners into a full stall, even in a simulator. The point is to recognize the warning signs (stall warning, buffet, sloppy control response) and recover
before
a full stall is reached. In the AF447 case, all the warning signs were ignored. Once the angle of attack was exceptionally high, it would have taken a large prolonged nose down movement to correct that, perhaps exceeded 35° below the horizon to get the AOA back in the normal range. This crew fought nose down attitudes of 8° below the horizon with full back stick.

Once the AOA is corrected, if a significant nose down attitude is required, the pilot must be careful in bringing the nose back up to level flight. The stall margin is small, and as the speed increases, the stall margin narrows further; therefore, the pull up must be made gently enough to avoid a secondary stall.

Understanding the Flight Control Laws

Pilots must understand their airplane. Not just enough to pass the test, but every day.

For the Airbus pilot, he must understand what the sidestick is commanding in whatever flight-control law the airplane is operating in. My experience is that, when asked, most Airbus pilots need to think about this one for a few seconds before answering.

In Alternate 1 the roll control is also the same as Normal Law (roll rate demand). When the sidestick is centered, the flight control system will attempt to maintain the current bank angle (even if 0). That doesn't mean that the airplane can instantly respond. It is still a large heavy wing with inertia to overcome. If rolling into or out of a turn, centering the sidestick does not instantly stop the roll motion. It is still possible to get a pilot-induced oscillation by moving the sidestick in a fashion that the airplane simply can't keep up with.

In Alternate 2 the roll axis is in direct aileron and spoiler control, with increased roll sensitivity. Two pair of spoilers are disabled to help keep the roll rates from becoming excessive. In Alternate 2, it is completely the pilot’s job to maintain the desired bank angle. The airplane will not counteract any external forces (such as turbulence) that may tend to change the bank angle. We see evidence of this in the first few seconds after the autopilot disconnected, where the bank changed from wings level to 11° right without pilot inputs.

There is no annunciation telling which version of Alternate Law is active. Perhaps there should be due to the differences cited above. However, from the pilot’s point of view it is virtually the same: if the bank angle is not what is desired, he must correct it. In Alternate Law, all maneuvering should be done with care. The difference is that Alternate 2 will require more pilot attention.

Bonin's 30 second initial fight for control in the roll axis, with what appears to be some pilot induced oscillation, may have diverted his attention from the pitch control, which eventually led to the stall and loss of control.

In both versions of Alternate Law, the pitch control law is exactly the same as in Normal Law (g-load demand). However, the flight control law may mask what the elevator is doing, because the elevator can move independently of the sidestick - because the pilot is not commanding elevator position, but g load. I believe this to be a key point in understanding how the airplane became so deeply stalled. If the protections are lost, even in the case of a stall the airplane wants to maintain the same g load. The normal pitching-down action, associated with positively stable civilian aircraft when below the desired speed, is counteracted by the flight control law's attempt to maintain the commanded g load. When the g load was lessened by an increasing descent rate due to the stalled condition, the elevator/stabilizer added more nose-up input in an attempt to compensate, which caused the descent rate to increase further.

Take a look at this section of the flight data recorder tracings outlined in blue showing g load, sidestick position, elevator, and stab position:

Note how the g load is less than 1. The sidestick commanded a pitch up (below the line commands a g load greater than 1). While the elevator position remained virtually unchanged, the stabilizer position was actively driving more nose-up for a total nose-up input greater than a direct sidestick-to-elevator relationship. At the right side of the outlined excerpt, the stabilizer was near its full-up position which left the elevator alone trying to fulfill the g-load command.

In another example, the elevator position is full up for a great deal of time near the end of the flight, despite the sidestick NOT being full up. At this point the descent rate had stabilized at approximately 12,000 ft/min, and the g load was approximately 1g. There were long periods of time where the pilot had moved the sidestick back, but not fully back, but the elevator was full up anyway. This was because the sidestick does not command elevator position, but g load. The elevator was trying to satisfy a g-load demand of greater than one and was doing everything it could to do so. The only thing it could do to increase the g load was more up elevator!

The full-up elevator was in addition to the stab position being full nose up at this time as well. A full-up stabilizer position will also reduce the elevators' pitch-down authority. Therefore, for a successful recovery with a full nose up stabilizer, a pitch down command for a longer period of time might be required. In extreme cases the pilot may have to manually move to trim to gain back pitch-down authority. The application of TOGA thrust (and its associated pitch-up moment) will also slow any pitch down action, as the engine’s thrust vector would be acting in the opposite direction of the elevator’s limited pitch down moment.

The elevator reached full nose up about the time that the AOA exceeded 30°. The airplane was falling (no better word to describe it) at a constant rate, and therefore maintaining about 1 g. Sidestick displacements were causing some elevator movements, but they were not held long enough to successfully reduce the angle of attack, which increased to 45°. While there is no guarantee that a recovery was possible (the final reports states that it was not recoverable at this point), full nose down control, for as long as it takes, was required to reduce the angle of attack.