Monday, January 4, 2010

Selected 2009 Airline Crash Discussion on AVSIG

(The following are pull-quotes from forum discussion in the
Accident & Incident section of AVSIG. Direct links below each discussion).

Air France 447 Discussion (Airbus A330, June 1, 2009)

Conflicting reports on whether the aircraft was within radar coverage.
Speculation is on lightning but with very few exceptions lightning does not bring down airplanes.

Reports of electrical problems. The FBW AB can be flown WITH ALL electrical gone. Not easy but you have the trimmable horizontal stabiliser, rudder and the engines have the FADECs.

On average, almost all airliners are struck at least once a year by lightning.
To be certified the airplane has to be able to take strikes. The equipment (electrical avionics, etc) are put in a 'hardened' location to prevent the lightning from eating the systems.

Systems on most modern jets are self-monitoring and self-reporting so it is likely the -330, when some systems failed, would have made the report without requiring pilot input.

Good summary about lightning and aircraft being able to continue flight with loss of electrical. Like you said, lightning strikes are somewhat rare (I can recall about 5 strikes between my navy and Northwest -and yes, we did keep on flying OK with the loss of some minor systems in 3 cases).

Of course it's way too soon to know much about this accident -except to note that the aircraft is obviously down and all on board likely killed. The A330 has up to now had a very good safety record.

The CVR and DFDR units do have sonar signals under water, but they are not very strong and I believe takes special receivers, etc. to even find the signals.

I don't think anything can be ruled out at this early stage, including a possible bomb?

Tragic for sure and I'm doubtful if there are survivors.


I am wondering about the depth at that point in the Atlantic. It is not going to be easy to retrieve the CVR and FDR.


I'm a little surprised that the reports seem to have no real idea where the AC went down. The first report I read (NYT) said they were lost from the radar screen. Now reports are talking about the Cape Verdes. I don't understand why the position reports from the flight can't pin down the location better. Unless, they went NORAD from a lightning strike. Sadly, I too hold little hope for the pax and crew.


I don't think the surveillance in the South Atlantic is all that great. That was kinda the point of the SURTASS ships, and there are only a few of them still in operation. In fact, I understand that the whole network ain't what it used to be.

I know that supposedly the [i]Scorpion[/i] casualty was picked up but that was both a lot further north and (I suspect) a lot more energetic than the impact of an A330 would be.

The depths out there are abyssal so any search and recovery operation will be a heck of a challenge.


So far it sounds like non-radar, with a missed oceanic position report being the first ATC clue - which is why exact location is not available. Still pretty sketchy data, though.


The plane ran into strong turbulence at 4 a.m. Paris time and sent automatic distress signals at 4:14 a.m., the company said. The flight sent 10 distress messages shortly before it disappeared, signaling an “unexpected and exceptional incident aboard,” Gourgeon said, without giving more details.

No further contact isn't good. Sounds like there was no Mayday on the radio for other flights which may have been in the area to pick up. No contact after lifeboats would normally have been employed which contain ELTs.

Once radar service is terminated, about how often would the aircraft be making position reports? I remember John Deakin talking about every 30 minutes.

It's been a while but if my memory is correct, position reports are made very 10 deg. with the time not to exceed 60 minutes which would require additional reports. I don't recall ever in my many Atlantic and Pacific crossing ever exceeding the time. Airspace rules have changed considerably since I retired.

If the aircraft had an Automatic Dependent Surveillance - Contract (ADS-C) contract set up then normally a report is made every 20 - 30 minutes and at any reporting point on the ocean track with more frequent reports for track offsets and for 'events' like deviations. Each oceanic airspace authority may set its own reporting period as part of the 'contract' set up when the aircraft connects on data-link. (WATRS is every 20 minutes; Japan every 1600 seconds). The aircraft could also have ADS contracts with the next oceanic airspace and with its own AOC.

The reason for the extended period between ADS-C reports appears to be save money on the number of SATCOM transmissions made during a flight. I have been involved with experiments with ADS updates every half-second so the slow update rate is not due to a technical issue.

Re the debris spread, I just caught an interesting tidbit in Hamburger Abendblatt. The paper quotes an Air France spokesperson as saying there were multiple malfunction reports from the automated maintenance equipment over a period of three minutes.

If it was a breakup which took place over roughly three minutes, a 30 mile debris spread would seem reasonable.

Think back to the famous "pop-top" Hawaiian Air flight. The initial event certainly left debris and likely caused some systems (if only cabin lights and enterainment, maybe more) to malfunction. If the structure had continued to break up from there, the whole process could have gone on over a considerable distance. As it really was, I suspect various bits blew off for a while after the initial event.

Could this be another composite rudder loss, either due to overstress or a lightning strike? I assume the composites used on commercial airliners have an aluminum grid embedded in the skin for lightning protection. Or maybe that's not necessary on carbon fiber composite, I don't know.
Yes, the rudder (vertical tail loss) is one of about 100 possibilities at this point.

They were in or close to a lot of towering thunderstorms, which is the norm this time of year at that location.

It seems like the aircraft did break apart in the air -at least from the initial reports of possible parts noted on the ocean surfact. (and some fires noted by an aircraft behind them on about the same route). So far it's only been looked at from the air as far as I know at this point.

I don't understand the almost 3-4 minute series of ACARS messages. It seems like they should have been closer together.

The clock is indeed ticking on finding the DFDR and CVR boxes.
It would be amazing if they actually get the black (well they are orange) boxes back within the next 21-30 days that they will be (in theory) pinging.

I assume that a possible bomb idea is still on the table -although it seems to be mostly dismissed in most reports I've noted.

Regards, and I have the start of a worry that we may never know the causes. Hope I'm wrong about that concern


New information provided by sources within Air France suggests, that the ACARS messages of system failures started to arrive at 02:10Z indicating, that the autopilot had disengaged and the fly by wire system had changed to alternate law. Between 02:11Z and 02:13Z a flurry of messages regarding ADIRU and ISIS faults arrived, at 02:13Z PRIM 1 and SEC 1 faults were indicated, at 02:14Z the last message received was an advisory regarding cabin vertical speed. That sequence of messages could not be independently verified.
This from the Aviation Herald, esp. the third paragraph quoted below:

Air France reported, that they had received an automatic message from the
airplane reporting an electrical short circuit and the failure of multiple
systems at 02:14Z. Air Traffic Control as well as Military Stations along the
Atlantic coast of South America, Africa, Portugal, Spain and France have been
alerted and attempted to contact the airplane without success. Attempts to
locate the airplane using civil and military radars from both west and east
coasts (including France) of the Atlantic also proved unsuccessful. The
airplane entered service in 2005 and had accumulated 18870 flights hours. The
captain had 11700 flight hours, one of the first officers had 3000, the other
6600 flight hours.

Sources within Air France reported, that the automatic message did not only
report an electrical short circuit, but also the loss of cabin pressure. This
information has been confirmed by FAB, who also stated, that the position of
the airplane was given as N3.5777 W30.3744 in that message.

New information provided by sources within Air France suggests, that the
ACARS messages of system failures started to arrive at 02:10Z indicating,
that the autopilot had disengaged and the fly by wire system had changed to
alternate law. Between 02:11Z and 02:13Z a flurry of messages regarding ADIRU
and ISIS faults arrived, at 02:13Z PRIM 1 and SEC 1 faults were indicated, at
02:14Z the last message received was an advisory regarding cabin vertical
speed. That sequence of messages could not be independently verified.

Would you (or anybody) mind 'splaining what ADIRU and ISIS mean to this Cessna pilot?


The ADIRU of which there are three provides the pilot with airspeed, altitude and position.

The ISIS in the Integrated Standby Instrument System, the backup.

Lose ADIRU 1 and you will probably (not sure) have the autopilot disconnect. The PRIM1 and SEC1 are flight control computers again where there are 3. Lose some of these computers and the flight control laws may change from NORMAL to ALTERNATE. Again, not sure..

The Laws are NORMAL, ALTERNATE and DIRECT. With all laws gone you have a trimmable horizontal stabilizer, rudder and engines... very basic.

[Why not stream systems data?] You can access the net from an aircraft, no excuse whatsoever that at least partial *critical* flight data isn't streamed. Technical reality.

That said, I'd hope folks here know where I stand as regards privacy (oh, in favor of it ;-)), and my respect for those that fly self-loading cargo types like myself. This accident just makes the point that the current system doesn't work, the technology exists to get around it a bit, be interesting to see the results this time as regards the tombstone mentality. My $0.02...

Flight data recorders exist due to regulation.

Who is going to pay for the streaming of data? What's the benefit to payee?

I don't see anything changing until regulations change.

The passenger pays, just like they do now for being able to stream their data on flights where that's available. This cost issue doesn't particularly fly for me ;-) Spread the cost around among *all* required-to-be FDR equipped passenger aircraft.

I don't know how many parameters the 330 currently records, best I can tell it's a minimum of 280 and may range upwards to 1200 (?). Regardless, compressed, I can't see how that would be anything but a minimal load, even streamed real-time, compared to one pax sending video or similar large files as Reams mentioned. As regards reliability, well, the FDR would still be there too, and the thought process that streaming the data would have to be perfect outa the box doesn't play. Call it a non-critical/experimental system, whatever, but get it started. Something tells me that if I can stream live video from my apartment, this isn't a technical challenge that's out of the reach of Airbus, Boeing, and the avionics designers. Which is obvious, given that they were getting messages from the aircraft when certain fail modes occurred. So, write some new code to parse incoming real-time data to anticipate upcoming potential failures, also not an impossible task, as demonstrated by the FBW systems themselves.

Ask Airbus, Air France and the avionics manufacturers what the benefit may be if the current rumor that faulty airspeed indicators/indications may have directly contributed to the accident. Let's start with number of family members * large sums of money per. Penny-wise, pound-foolish mate, the FAA doesn't have a lock on the tombstone mentality.

I believe the regulatory issue was addressed elsewhere, so, they pass a new reg. . Note that I'm not talking about CVR streaming, just the data that's now going to the FDR.

Maybe... To the extent that maintenance items might be valuable, seems that such data is already provided in periodic bursts. So, users will have to either see a value proposition in it for them, or have "forced cost" added by government that is tacked on to fares.

As to CVRs, such data could be easily encrypted, to be unencrypted only in event of accident investigation....

I remember a flight several years ago where I was working on the internet sitting in my seat on an SAS machine while flying over the North Atlantic and Greenland, sending real time emails with large file attachments back and forth, using the Boeing Connexxion system (now defunct). So, the technology is available, but apparently the question is at what cost...

Reliability matters a lot, too. It needs to be sent in real time, or at least in some way that guarantees that the most recent data isn't lost - ever - over a comm link that works in remote areas, regardless of aircraft attitude, even when the aircraft may be doing some pretty strange things. I suspect that this isn't as simple as it may first seem. "Ooops - we seem to have missed the last minute of flight..." isn't real helpful.
Oh, I can see it now - "we pay for live streaming so your loved ones will know exactly how you died". Hmmmm, I think marketing it going to have a tough sell on that one.

Eventually, yes, they'd pay. But there's no advantage for an airline or airplane manufacture to voluntarily file that flight plan.

The only direct beneficiaries are the news media, the investigators, and the government that has to pay to retrieve the black box.

Howz 'bout future passengers and crews who don't have to crash (or disappear from the face of the Earth) thanks to lessons learned from that streamed info?

(There's probably some feel-good marketing in there somewhere).

I'm not denying there's public good to the idea. But the lessons learned are passed to all pilots of all airlines.

Any marketing campaign is going to have to be on a "feel good" type of thing so that the public is willing to pay a bit more for a favorite carrier. But usually anything that even suggests that flying might result in a crash sends most marketing types into a fit. ("Acme Airlines - We learn from our mistakes")

I still say it's easier to talk a congress critter into the idea than an accounts/MBA type.

The marketing reference is tongue-in-cheek, but I like your campaign tagline. IMO we are long overdue for remote voice/data telemetry. F447 has already proven the value on a small scale (the automated status messages are better than nothing), and I can't think of any reason more info couldn't be transmitted. Having to go hunt a little metal box in a smoking hole or 12,000-ft-deep ocean to get cockpit and flight control info in this day and age makes no sense to me.

Cost? Somebody convince me they'll have to cut out my .3 oz bag of in-flight pretzels to pay for it and I'll shut up :).

Well I am hearing a lot of comments about 'not flying airbus' from passengers. Lose one more airbus and the entire company could be out of business as its fly-by-wire and composite construction aircraft are grounded.

How much would that cost the industry?

How much would streaming FOQA or DFDR data cost?

There are open connections on the Iridium network that could be used - you don't have to fund INMARSAT

So Airbus and the airlines would rather risk being grounded and go bankrupt than stream DFDR data. Is this a logical business approach?

It need not be continuous but could auto-start on particular events to be cancelled by the crew if there is no crash. So turbulence above a certain value, any failures or exceptions would trigger a minimun of say 300 seconds streaming DFDR if not cancelled it would continue.

In this case if this auto-streaming had taken place it might already be apparent why the A330 crashed and retrofit action could be being taken on airframes perhaps with particular hardware or software versions. But no - we saved a few hundred dollars per flight and are happy to accept the risk of another A330 accident leading to a total grounding of all similar aircraft.

Is this a logical risk analysis?

Hmmmmm, the problem with that logic is the streaming data is unnecessary unless you lost another one. As long as the plane makes it back OK, you've got your data in the flight recorders. And by your own argument, if we do lose another one it would be too late for Airbus.

If Airbus is really hurting that bad, they better get one of their airplanes and start flying it around in bad weather. Use test pilots, not paying passengers.

I don't understand that comment about losing another one. At all. Not trying to hammer on ya, but that defies any logic I can muster. Once again, what would it *actually* cost to implement?

Here's another take: Airbus, Boeing et al. make certain things a requirement with the aircraft. Like requiring streaming data. Don't want to comply, "No airplane for you!" ;-) Simplistic, I know, but that changes the landscape a bit. This isn't a weight or space issue, how many modern *independent-of-aircraft-power* quad core physically hardened rack mounts can you fit in a very small box, or boxes? Lots.

If large scale data management is an issue, call the kids @ Google, they have some experience in that area. PR is a non-issue, seen any ads explaining the TSA taxes on the ticket I just bought for Deb? I haven't. Closest I've seen is Southwest making a point that what you see is what ya get, fare-wise, and that's about baggage. Do *you* look at the taxes on your tickets?

Bottom line for me, what's the problem utilizing proven, relatively inexpensive current technology to make all flights safer? And if it breaks in the first few revs, so what, we're exactly where we are right now, with a mysterious accident that most likely won't be solved.

Let me take it from the top. I find it strange that no one seems to be agreeing with me, so either someone slipped drugs into my chocolate so that I'm only making sense to myself, or somehow we're on parallel but different tracks.

I assume the proposal that's on the table is to take the data stream that's currently going to the black boxes and stream a copy of the data to safety. Now, unless I've misunderstood the idea, this is only to eliminate or substantially reduce the need to hunt for the black boxes. There's nothing about analyzing the data for anomalies that might have previously escaped notice or didn't arise to the level of a incident. Nor is there any plan to add a "back seat driver" to give advice in real-time. Those are interesting ideas, but I don't think that's what's been proposed.

So, if I've understood the idea correctly, this would only be an advantage if the airplane ended up in a smoking hole or a watery grave. If a/c makes it back to the gate, the effort to retrieve the boxes is trivial.

Now, there's two views on this: Long term and short term.

Long term, yes, it's a good idea. It may well save time doing an expensive search and might save data that would otherwise be lost. (One question that has been asked and so far not answered - how many times have we not been able to find the boxes or they had critical parts that were unreadable?) Still, it won't completely eliminate expensive searches. The black boxes are a great tool, but they are of limited help in cases of mechanical or structural failure. In some cases, we had to find the failed part to know what happened. The 747 that lost it's cargo door outside of HNL and the DC9 that lost all hydraulics due to the #2 engine are two that come to mind.

And yes, it would be a great help if AF 447 was so equipped. But it wasn't. We have to figure out where to go from here and not wish that something had turned out differently.

Short term, the public is having a crisis of faith in Airbus. The this idea is not going to help the immediate fear. Because in order for this idea to pay off, we have to loose another a/c. Yes, it will help prevent ones -after- that (which by then might be too late for Airbus), but it does nothing to protect the next one. (If not, what am I missing?) That's not going to go over with the public too well. To solve the short-term problem Airbus would be much better off flying some research missions into weather that pilots normally avoid.

As for cost, some one tell me what the bandwidth of the data is, what is the maximum number of running airplanes at any one time, and what the bandwidth of the Internet system is and then we'll talk. Without those numbers, I see a issue of scalability. Just because someone was able to send large attachments while in flight doesn't mean the system can support all the airplanes all the time. Even if it could, it's not going to be free. Someone is going to have to pay for that bandwidth used. Because bandwidth used can't be sold to someone else and more satellites cost big money.

And last, but not least, - money is what makes companies run. To implement this is all expense and no income. While the idea has potential benefits for the industry as a whole, I don't see *any* financial advantage to the company that steps forward first. Madison Avenue can try to make it a competitive advantage, but I think that's going to be a tough sell. Right now with everyone in survival mode, I don't see anyone doing this out of the goodness of their hearts or to add goodwill to their brand.

I haven't seen anyone in this thread suggest that bypassing a few smoking holes/deep oceans is the only purpose of streaming data.

Also, no need to fixate on F447 as a lost opportunity because this issue is not about what 447 didn't have, it's about what the next crashed airliner will or won't have. Losing an airliner at deep sea happens to put a fine point on the discussion, but this is not about one rare crash scenario.

Yes, it's going to cost money to stream data. It costs money to put an airliner in the air. Lots more money to crash one. Bandwidth is cheap and getting cheaper.

447 did transmit some useful data -- possibly more than we've heard about on the news, but it still looks like we're going to go deep-sea fishing for flight data and cockpit communication from a heavily computerized modern aircraft that was already capable of sending generic failure messages out to the living. Something wrong with that picture.

[The money] only comes out of someone else's budget if an accident only happens once. Imagine the effect on Airbus and the airlines flying them if there is another loss of an Airbus in convective weather in the next months and no cause had yet been found.

Its a risk analysis issue - Airbus has created a fleet based on replicated computer systems, fly-by-wire and composites. If one or more of these areas is _believed_ to be flawed then the entire Airbus series from the A319 to the A380 could be impacted. Similarly if your airline is based on one particular type or series your entire airline could be grounded.

Is that a risk worth taking? That is a commercial decision.

In the past streaming data over datalink was difficult and expensive now its easy and cheap and can use existing certified components. So the risk/cost of amelioration equation has changed.

From the other viewpoint suppose that the problem is caused by a low probability set of conditions that the software designers did not expect that causes the computers to fail-UNsafe _every_ time that set of conditions occurs. It would be really nice to know about that before multiple major disasters. It would certainly help the public perception of the industry.

I think we need a bit of perspective here. How many transport accidents have we had where the recorders were not recovered? No reason to spend a lot of money rushing in new technology to fix a non-existent problem.

As SESAR and NextGen move into implementation one of their requirements is high bandwidth reliable datalink. One of the standards being proposed in SESAR is WIMAX and IPv6. In simple terms WIMAX is like a far more powerful WiFi and a near earth orbit satellite system could provide more than 10mbs to a large number of users. (More than there are currently aircraft flying transoceanic). This bandwidth would allow streaming of DFDR and possibly even CVR from aircraft.

This is a business decision of course. But since the mid-80's we have had Air India 182 (bomb), TWA 800 (center fuel tank??), Swiss Air 111 (electrical fire), Egypt Air 990 (pilot initiated?) and now Air France 447 and that is just the Atlantic. Unfortunately, crashes of commercial wide-bodies into the ocean are NOT rare events and in each case there is an extended search for the DFDRs.

There is no technical reason why online streaming of DFDR should not be done.

It is a business risk analysis driven decision. But Airbus Industrie and Air France executives might be able to sleep easier if they had a better idea of why the AF447 A330 was lost.

Here's some actual money stuff: As of 2008 an Airbus 330-200 costs anywhere from 176.3 to 185.5 million US dollars ([url=]Airbus.pdf[/url]).

Insurance *may* cover what AF 447 was insured for, and some other issues, but doesn't pay for loss of revenue while the aircraft is replaced. And it sure ain't covering the cost of a brand new one. [url=]This[/url] may be of interest. That's the trivial stuff, money-wise, and a problem for Air France and their customers. And their shareholders.

The cost of the investigation, which AF needs to be involved with aside from the authorities investigation may be large, but nothing near what the settlements with family members will be. The cost in reputation to Airbus is immeasurable, as is the trickle down effect of passengers that are most likely, as I type, checking what aircraft they're on for an upcoming flight. Now it's not an Air France problem anymore, it's every airline that flies the Airbus...and I doubt most will be checking model numbers.

An interesting (2005) comment from Airbus as regards monitoring and predictive maintenance is [url=]here[/url], one part I thought of interest was this: "[i]Airbus soon will offer AIRMAN Onboard, which will allow cockpit crews to view the same analysis that occurs on the ground. An enhanced version that will permit the manufacturer to monitor all A380 flights from its headquarters in Toulouse will be standard equipment on that aircraft, according to Beams.[/i]" Not about streaming per se, but an indicator on how they've been thinking.

As regards bandwidth and number of aircraft aloft at a given moment, I do believe the quantities of data that any individual aircraft would produce could be compressed to next to nothing. It's data, not video. Previously someone mentioned encrypting/streaming the CVR data too. Great idea, NTSB has the key, period, not the airlines, no deal like what's going on right now as regards CVR spot checking (Colgan) regardless of flight outcome.

Hmmm, one other thing about costs, the U.S. is 'lending' the French Navy some gear. OK, now we're paying directly too, as well as for the NTSB folks that'll be involved in this.

Btw, no drugs in your chocolate, just differing points of view. This emphasis about 'cost' in some posts in the thread doesn't seem based on what those arguments seem to be about, mainly that no business is going to do something that isn't required, if it's not in their own self-interest. Let's see what the costs of the search for the boxes, the investigation, the years of litigation and settlements, plus the intangible aspects as regards Airbus in general are. And of course the simple cost of replacing the aircraft. Then tell me that even *with* the loss of AF 447 it wouldn't have been in their interest (AB and AF)to get real-time up and running. It may in fact have caught the rumored speed isuue before it went critical, though of course that's pure speculation on my part. And as to adding 'new' technology, as I believe someone else referred to it as, gimme a break, nothing new at all here.

"John, I would be interested in your opinion or the other airline (current/former)pilots on a comment from a VP with ALPA concerning the continuous monitoring/transmission of cockpit voice and other information now stored in the black boxes in real time. He was adamitly against this."

I see no reason to try to do a FOQA with the CVR. It is smoke and mirrors.

First, who is going to listen to hours and hours of CVR tapes? And who is going to spend the money to develop a program to scan the tapes? And what are you looking for? Many can not really explain what the sterile cockpit is and what is a violation except for blatant disregard.

The Continental 3407.. lots jumped on the bandwagon about the tape and yes, it was not a pristine cockpit BUT there WAS challenge and response, checklist, briefings, discussion about the wx and ice and concerns.

It is sort of like the progression from CRM to TEM and now SMS. Too often it seems we want to create benchmarks for behavior and use that as a standard for measuring. Nice but the problem is not everyone is going to solve the problem using the same tools.

We had a LOFT where there was a cabin fire shortly after taking off. Winds were 90deg to the runway and wx was 200 or lower. Some crews returned, blew through 10,000ft still running 340kts, declared an emergency, ran what checklists they could and demanded to land opposite direction. Other crews ran checklists (one even asked for holding to complete checklists and briefings) and briefed and took almost twice as long to get the plane on the ground.

So, which did better? And for the crews that took twice as long and briefed, did checklists, did all the required steps? Up or down...

What would I like? I would like to see the ability to blast FDR data securely to a data bank to preclude having to go on a huge hunt for a box the size of a toaster. THAT would be a meaningful step forward in air safety.

They are going to have to find the boxes off 447. They have to... without the box, it is all conjecture and without the box, 228 people will be dead and without an explanation of what happened.

Monitor CVRs? Scoff scoff...

The NSA is *now* scanning all the telecommunications they intercept for key words. That is public information which means they actually have better capabilities. And they're doing it basically in real time - there may be a lag but if they weren't interpreting the data as fast as it was coming in they'd be hopelessly far behind. Which means the capability already exists for computers to scan the tapes for whatever management wants. If the data becomes available it *will* be interpreted.

Near as I can tell, the Generic Union Position on using CVR data is that, outside of an accident, what the company's crew is doing in the company's airplane with a load of the company's passengers in the back is none of the company's business.

Never quite understood that line of reasoning....

Not that I'm the first one on line to defend unions, but I do see a tiny bit of logic in that. Basically, the same logic that would apply to ordinary office workers not wanting their telephone calls monitored or a recording device in their office recording everything they say.

I do think they'll get plenty more support from the union and its members if the data were encrypted and only unencrypted when there's an accident/incident. And in addition, its use would be legally limited to accident/incident investigation.

I think that you're on the right track with that.

If we could be assured that the information would be used only to promote safety the resistance would be significantly less. The CVR recordings are only supposed to be used for accident investigation now but some managements have used them for other purposes. Managers making comments in grievance proceedings that they wouldn't have known without having listened to the CVR, etc.

Then there's still the problem of nobody wanting to have every comment they make at work fed straight to their boss's ear. Treat people like children and they're a lot more likely to act like children.

I'd like to note that I didn't think, nor did I suggest that the 3407 accident was caused by the conversation, nor that monitoring the CVR in real time would have averted the accident. Once again, having the data available, both FDR and CVR, *in the event of an accident* wouldn't just save the cost of the 'black box' searches, but might lead to seeing patterns. Of course the existing 'black box' technology would remain in place, with the existing rules, though the CVR should easily be capable of more than the last 30 minutes. And being repetitive now, the CVR data would be encrypted, management doesn't have the key. Hmmm, maybe all the data is based on that, not sure what issues that'd raise. It does seem, at least as of that 2005 article as regards the AB 380 that it's not an option, comes with the airplane.

I took a look at the FOQA info I could find, interesting. A good idea, mired in the fuzziness of multiple interpretations I guess.

I do have a question, if you're the U.S. the NTSB is going to release the CVR transcripts and the other detailed technical aspects of the investigations they conduct. Is your comment about the law here related to that, or the release of the FOQA data? The former needs must be imo. The latter, if it's supposed to aid in prevention, should never be allowed in the legal arena. Kinda of what you wrote, can't see why anyone would want to participate in that case. Then again I'm guessing a case could be made that if there was a pattern...and on it goes, don't have a clue as to how that's solved.

Being a computer sorta guy, I'd like to think that predictive software can only get better, and the more data collected would help make that so, much sooner (the streaming deal).

All parties have to agree on the program and anyone can withdraw at any time. It has happened when data was accessed by others besides the 'gatekeeper'.

Also, before an event can be entered into the program it has to be reviewed. As you no doubt read, it does not cover intentional deviations without reason. Flying 350kts at 500ft will not wind up in FOQA with no sanctions.

The real benefit of the data is having someone who can read the data and find the trends before the events become accidents or incidents. For example, one FOQA group found on average the fleet was flying final faster than Vref +10 resulting in longer landings, more brake wear, etc. A memo was put out asking guys to work on it. Results followed. The great thing about FOQA is it allows you to focus and it shows you what is REALLY happening on the line.

But this data should not be available for discovery and in the Louisville (SDF) accident, the judge said ComAir had to turn over the data. Let's face it.. the average juror isn't going to understand the intent of FOQA and I come in, show you that the information shows ABC Airline KNEW their pilots were flying 'too fast' (above the recommended Vref +10) and speed was a contributing factor. And they didn't stop it. Joe Sixpack is going to look at those weeping families and 'send a message' that such shenanigans are NOT to be tolerated. BAM! big awards.

It's not a matter of collecting the data. And data collected is used to predict. The classic was the B/C LOC at CLT for runway 23. Data showed the designed approach contributed to unstablized approaches and that info was taken to the FAA which, in turn, put an ILS on 23. And data showed that arrivals at CHS and ILM were often handled in a way that contributed to unstabilized approaches. Pilots had complained but HARD data was the convincing argument.

I'm a great believer in FOQA... maybe even a (gasp) radical. I said once that I would be willing for the company to pull 3 random flights of mine and when I came to training, we could work on MY weak areas, not industry trends or fleet trends but where I was weak. Why do ILSes if the data shows I do them repeatedly and precisely? Answer.. because the training program calls for it.

But FOQA data should be shielded from discovery. We know people lie or cover up when they believe punishment is the consequence of error. We have seen programs where immunity was removed and IMMEDIATELY the number of reports went down.

I am not against lawyers or going after wrongs or cultural lapses. But without proper safeguards, FOQA will be eroded and a great safety tool will be compromised.


I should read more carefully. I thought your [i]It has happened when data was accessed by others besides the 'gatekeeper'.[/i] reference was to an unauthorized release of the FOQA data. No idea as to how you prevent the legal system from doing what you describe.

The data is 'sterilized' and 'swept' of any identifying information. The only ones who are able to unlock the ciphers and put flesh back on the report is the 'gatekeeper'.

The 'gatekeeper' can contact the pilots or individuals involved to find out what happened when a deviation occurs but that is infrequent. In one incident, the story was a senior management 'stumbled' onto the information inadvertently. ?? It was enough to halt the program for a while.

And on the other end, some pilots believe any consequence is some form of punishment. I think there were a few cases where the event was to be resolved with some training and the pilot group balked. And they then withdrew from the FOQA.

It can be VERY political if any party wants to use the program as a lever to achieve goals outside the target of safety. Having said all that, the data should be secure and one initial concern was how to dispose of the information without it becoming Nixon's missing minutes.

Data streaming is NOT real time monitoring. Although those against the former will try to lump it into the latter.

Stream the data, secure repository, 30 day (or pick a number) retention, only available to national government accident investigation bodies after an incident.

Sort of like ATC tapes.

I agree up to a point. Initially myself and I think others were referring to near real-time FDR monitoring via streaming. At least that's what I was talking about. How the data is monitored depends on how that's configured at the receiving end. Trivial example: When I've broadcast SnowCam or AntCam...Live there's a variable delay, up to ~10 seconds. Those watching are 'monitoring' in near real-time, once the initial stream is buffered, plus that delay. I don't believe the CVR data was ever mentioned as a practical real-time monitoring goal, other than getting it safely stored, with the FDR data. That FDR data *could* be analyzed, close to real-time, plus the delays as mentioned. Of course that requires software that has perhaps more up-to-date predictive 'intelligence', or maybe it's available right now, I have no idea.

The more I hear about the [i]'pitot tubes - the instruments that measure the speed'[/i](sic) in the media, the more I am confused.

Obviously the change to another pitot tube design was not issued by Airbus as a mandatory requirement, or the change would have been done immediately. But there have been some allusions in the media to the reason being that they were more affected by icing - which I would have thought _would_ make the change to a new design mandatory.

Has anyone here got any idea what the actual Airbus requirements were for changing out the old pitot design for (presumably) a new one and what the trigger was for doing so? There must be a public maintenance instruction of some sort.

The Aussies put out an AD on Airbus pitots in [b] 2002 [/b]

New Search Fails To Locate Air France Black Boxes

7:53 PM ET 8/19/09

PARIS (AFP)--French search teams have failed to locate the black boxes of Air France-KLM (AF.FR) flight that crashed in the Atlantic en route from Rio de Janeiro to Paris in June, the French air accident bureau said Thursday.

Search teams have now wrapped up a second operation to locate the flight recorders of the Airbus A330, which crashed off the Brazilian coast on June 1 killing 228 people, and will now try to find a new way to continue looking.

The first search phase ended on July 10, when the batteries powering the black box's locator signals were thought to have run out. Underwater vessels launched a second search at the end of July, sweeping the site with sonar.

"The search having failed to locate the wreck of the aircraft, the BEA will gather an international team of investigators and experts in the coming weeks to exploit the data gathered with a view to launching a third search phase, and to determine its modalities and means," the BEA agency said.

Full discussion here.

Colgan Flight 3407 Discussion (
Continental Airlines Connector Flight, Bombardier Dash-8, 2/12/2009)

The crew was cleared to descend to 11,000 feet, and shortly afterward noticed "significant ice buildup" on the windshield and the leading edge of the wings, Chealander said. The flight- data recorder indicated a system that helps to de-ice the plane had been activated shortly before those comments were made, he said "Landing Gear Activated."

The landing gear was activated one minute before the end of the recording, and 20 seconds later the wing flaps were lowered, Chealander said. Within seconds, "severe pitch and roll" movements were recorded, he said. The crew tried to raise the gear and the flaps just before the recording ended.

I am VERY SURPRISED that the NTSB is already discussing the CVR and the indications of what seem to be a tailplane stall with the config change.

I think the NTSB has at least one outstanding recommendation concerning ice problems with this type turbo prop. -from a prior accident some years ago (Roselawn?).

Of course it's way too soon to even make a "cause" statement.
However, it seems like the initial data shows the crew was indeed using whatever deicing stuff was installed.

I was part of an accident investigation team at a turbo prop accident in Minnesota some years ago. Killed all on board around Christmas time.

We all thought it was a potential ice situation -but after some investigation and the CVR, it turned out to be a pilot problem -too low on the non ILS approach. (Well, there were a lot of other factors but I'll not go into those).
Sorry about this current tragic accident. Hope we can get some valid recommendations to prevent this in the future.
Part of the NTSB investigation will to review any previous "incidents" that could be related. I've always noted that most accident investigators would rather spend more time on investigation of incidents (the so called "close calls") and focus on prevention.

I'm just a humble Cessna pilot who has never encountered icing, but I thought the rule was: "Don't deploy flaps if your wings are iced up".
This is a plane certified for known icing. De-icing boots are on every control surface (which, BTW, is not typical on a jet... the tail feathers are usually without de-ice). Assuming the de-ice equipment was doing its job effectively, I would ordinarily not fail to use flaps. Certainly, don't use flaps 30 miles out, or in holding, since the flaps themselves have no de-icing capability.
The crew recognized the problem, and took what on the surface appears to be the proper corrective action... return the flaps to the previous configuration; in this case up.
Did they pull back on the yoke also? Don't know yet, but we will.

This accident does remind me a lot of the the Roselawn accident. The "pitch AND roll oscillations suggest more than tailplane seems to me that would principally cause only pitch oscillations. The "aileron snatch", such as what happened at Roselawn, will cause loss of both pitch and roll control. Only the FDR data will tell the tale.
This is the first fatal accident in the U.S. involving a large (>30 seat) turboprop aircraft (other than ramp accidents) since Roselawn, and the first in the U.S. involving the Dash-8, and only the second ever. Dash-8s and ATRs remain two of the safest aircraft around, even after this accident. Convincing the public of that will be an uphill battle. This is the first fatal accident in the U.S. since Comair in 2006. 28,000 flights departed yesterday, one crashed. We are now going some 20 million+ departures between fatal accidents.

Two things got my attention quickly. One was the crash site was a very tight area indicating a very steep path to the ground.
Second, later in the day a witness said when he say the airplane it was pointed northeast and he went on to describe the belly of the airplane, the left wing down and other detailed observations. Not your usual 'witness'. With the left wing down and facing northeast, the airplane would have rolled, nose down and wound up facing the opposite direction from the approach final course.
This fits the 'severe pitch and roll' comments from the NTSB and that has really surprised me that the NTSB is releasing information so quickly from the CVR and FDR.
At any rate, it was an event from which there was insufficient time and altitude to recover.
Now saying the airplane essentially hit FLAT.. 'all four points of the airplane, wing tips, tail and nose section' have been identified.
Autopilot was being used until a/c departed. Shaker and pusher activated.

More particular to this crash, the plane that the Dash-8 "Q-400" shares its fuselage with, the CRJ, does not have de-ice on the tail. Just like a Boeing 777.

All the Hawker jets I have flown have tail de-ice as do all the Cessna jets. Airbus' also have tail de-ice.
The only civilian jets I have flown that do not have tail de-ice are Boeings and the CRJ.
A few months ago I was talking to an Avantair crew at Atlantic in BNA and they mentioned that the P-180 didn't have any tail de-ice. That surprised me, being that it's a turboprop, but perhaps it's because of the unusual bi-wing design? The main wing may be far enough after that the tail is producing upward lift instead of downward.

The Boeing 747 (-100, -200, -300) does NOT have any system to de-ice or anti-ice the tailfeathers.
Nor does the Gulfstream IV.
Nor the Eclipse

As you know, I'm just a humble, low-time, Cessna pilot, but the C-172's I rent have 3-axis autopilots. There have been a few times in VFR conditions when the autopilot would have stalled the aircraft, had I let it.
Caught in a downdraft, the AP tries to hold altitude and doesn't give a hoot about airspeed. If you're watching, you can see the trim wheel spinning up and the airspeed bleeding off. Eventually you get a message 'trim in motion'.
I'm sure none of this probably applies to the loss of Cogan Air, but APs are dumb.

Some are smarter than others. Not sure how "smart" the A/P is on the Q400, though. It has a relatively advanced autoflight system, however. Speed loss due to flying through a downdraft wouldn't normally be much of a concern as the airplane has lots of power but it could certainly result in a stall if the crew doesn't use the available power or auto-throttles (if installed).
Generally you'd want to use more automation in high-workload situations but icing conditions are an exception as the autopilot can mask the signs of developing control problems from ice accretion.
Worse, they don't tell you when stuff happens. Ice can come on slowly,
necessitating constant slight pitch and power increases. A pilot hand flying
will notice that rather early. An AP covers it up until some mechanical
limit is reached, which can be mighty late for real corrective action.

From what I've seen posted, John, the carrier's procedures were not to use the AP in icing conditions for the reason you point out. One can't get a feel for how the plane''s handling when the AP is engaged. It if reaches the limit of it's control and lets loose close to the ground, there may not be time to recover if it's due to ice accumulation.
The FAA has come out with recent guidance on this issue.
Even in my P-Baron, I don't use the AP in icing conditions on an approach. I might use it in light ice higher up for short periods, but hand fly it frequently too get a feel for how the plane's handling.
These folks had a lot going on. Night descent in icing conditions is always busy. John discussed using APs to land in low ceiling and visibility environments on CNN. Who knows, one investigator said the AP was engaged, but the investigation isn't over.
I am a bit surprised that the crew was not specifically trained to avoid lowering the flaps and using the AP in these conditions given the Roselawn accident. FlightSafety and Simcom instructed me not use the AP or lower flaps unless absolutely needed in icing conditions. And even if you lowered flaps you should be prepared to immediately raise them if control issues arose.For those that fly for the airlines are similar warnings provided?

The flaps did not reach what is suspected as the commanded position, flaps 15. They started down, reached 10deg and the crew attempted to retract them.
Also, there appears to be some confusion about the pitch and thus the conjecture about a flat spin. Now we are hearing pitch varied between 30deg nose up and about 40deg nose low with bank angles of 105deg. That is enough to put the airplane on its back and with that pitch variation, possibly no spin.
I believe what they meant to say is the airplane did not impact nose down rather than say the airplane did not dive. I could be wrong.
We have not been instructed not to use the flaps when needed for landing, even in icing conditions. We are PROHIBITED from using them while holding in any conditions. In Roselawn, the extention of the flaps in icing while holding allowed ice to accrete behind the boot, which, when the flaps were raised, and subsequently a higher angle of attack was required to maintain level flight, a loss of roll control occured because of disrupted flow over the ailerons.We are instructed to not use the autopilot while making approaches in icing conditions. Not so in cruise flight, at least on the regional jets we now fly. On the ATRs, IIRC, it was recommended that we disengage the AP in cruise from time to time if in ice, to see if there was an alteration in the handling, and to be prepared for large control forces to be present when we disconnected. Jets have "hot wings", and ice does not accrete on them if the anti-ice (not "deice") systems are working properly. Turboprops have "deice" systems, like boots. Ice accretes, then is removed. A turboprop engine simply does not provide enough bleed air to heat a wing.This accident is still a mystery in my mind. Tailplane icing does not explain the 31 deg pitch up they experienced. A tailplane stall would cause a pitch down, wouldn't it? Something new happened here, heretofore unexpected, I'll bet. The fact that flaps were being extended at that moment is a clue...this is an aerodynamic icident I am not familiar with, and it may be characteristic of the Q400. All the autopilot use would have done is mask the onset of ice trouble. How that pitch up occured appears to me to be the key to the whole thing. What would cause such a thing?The investigation will tell.

Full Discussion here.


No comments:

Post a Comment