Understanding Air France 447 (13 page)

A wind shear recovery uses the same principles, and allows the pilot to ask for maximum performance when achieving what is critical to survival. In a severe wind shear scenario, the sidestick can be held full back if required. The airplane will respond with changing pitch attitudes in order to provide maximum performance, a feat that is difficult at best to do manually.

The airplane does not disregard what the pilot has instructed it to do with a full back sidestick input or other maximum control inputs. This is a matter of interpretation of what the pilot wants - full up elevator or maximum escape performance.

The simplicity with which Normal Law can keep the airplane within the normal operating range and provide maximum recovery performance may have been what the pilot flying on AF447 remembered when things went wrong and the flight control laws degraded to Alternate Law. Full power and pull back is an effective escape maneuver for emergency terrain avoidance and wind shear recovery, and also provides stall protection. However, only in Normal Law and only at low altitude when lots of extra power is available.

Alternate Law

When failures no longer make it possible to carry out Normal Law, other reconfiguration laws take effect. The failures could be failures in the physical flight control systems, hydraulics, computers, or the information needed to carry out the laws themselves.

Some of that information comes from the three Air Data Reference units (ADR) which are combined with the three Inertial Reference units (IR) making up the Air Data Inertial Reference System (ADIRS). For Normal Law to operate, requires two of the three air data sources to agree so that there is reasonable assurance that the data is reliable.

The next step below Normal Law is Alternate Law.

Alternate Law has two basic versions, depending on what has failed: Alternate 1 and Alternate 2.

In either case, an ECAM message displays “ALTN LAW (PROT LOST)” (Alternate Law, protections lost), and a second line states that the speed should be limited to 330 kts/ .82 Mach (slightly less than the Normal Law limitations). Additionally amber X’s replace the green equal signs that are displayed at the pitch and roll limits when Normal Law is active.

The main difference between the two levels of Alternate Law is in the roll portion of the law. In Alternate 1, the roll command remains rate-of-roll, like Normal Law. Bank angle protection (67°) remains in place, but is lost in case of triple ADR failure or ADR disagree.

In Alternate 2 the roll command is a direct stick-to-control command with no protections or stabilities. A few spoilers are inhibited to keep the potential roll rates from being excessive, and the gains on the flight controls are set according to the flap/slat position
²⁴
. Alternate 2 is activated with an ADR disagree or dual ADR or IR fault as well as with some other multiple failures of the flight control system.

At low altitude, the two sub modes do not really handle that differently, and pilots often have a hard time telling them apart, though Alternate 2 is more sensitive in roll. At high altitude, the same control deflection can result in higher roll rates due to less aerodynamic damping, usually a minor effect. The long fuel-filled wing and the weight of the engines also add a rolling inertia component. In Normal and Alternate 1 laws, since the sidestick commands the rate of roll, those effects are automatically compensated for. However, in Alternate 2 and Direct laws, the sidestick commands the control surfaces directly, so the controls must be used with care to prevent over controlling, and with the realization that once the wing is in motion, it won’t stop instantly just because the control is centered. The difficulty with roll control may have directed the flying pilot’s attention away from the pitch control.

Immediately after the autopilot disconnected, the airplane rolled into an 8° right bank in about 2 seconds due to external forces. First Officer Bonin corrected with up to 1/2 left sidestick input. Within the same two seconds the airplane rolled 14° left to a 6° left bank.

As the airplane rolled through wings level to the left the sidestick was moved about half way to the right. The lateral sidestick displacement and the airplane’s bank angle became exactly out of phase (peak bank angle in one direction with peak control input in the other), and the airplane rolled back to the right. The second and third lateral inputs reached the full stick input to the left and 3/4 to the right.

For 30 seconds he struggled to get the bank angle under control. The bank angle was never excessive, the maximum was only 11°. But the dynamics of the roll response made it difficult to control, and may have added to a lack of attention in the vertical axis. For halfway through his efforts to control the bank angle, the vertical speed reached 6,900 feet per minute and First Officer Robert called out, “Watch your speed, watch your speed.”

Bonin started to reduce the pitch attitude, “Okay okay, okay I’m going back down,” he said, as he struggled to control both pitch and roll.

Precious airspeed was lost during this time. It was only after the roll was back under control that First Officer Robert offered the advice, “Above all try to touch the lateral controls as little as possible.” But by then, the stall warning had started to sound and loss of control was only seconds away.

In determining the active flight control law, the flight control computers monitor the input from the various sources. When only two sources agree the third value gets voted out. For the purpose of the flight control system, when one of the three airspeed sources deviates too much from the other two it is automatically rejected by the PRIMs and the voted value then becomes the average of the two remaining airspeeds. In this scenario, Normal Law continues to function.

The remaining airspeed values are then monitored both individually and collectively. If the difference between the two remaining values becomes too great, the PRIMs reject them both and the control law reconfigures to Alternate 2.

If voted value falls by more than 30 knots in one second, then that will also trigger a reconfiguration to Alternate 2 Law. In the case of AF447, the indicated airspeed fell from 274 to 52 knots within 3 seconds (an average drop of 74 knots/second) and as a result, Normal Law degraded to Alternate 2.

In both Alternate 1 and Alternate 2 the pitch law remains the same as in Normal Law. That is, g-load demand with maneuver (maximum g load) protection. The “hard” speed protections are lost. If there is enough data available, the hard protections are replaced by low and high speed “stabilities.”

Stabilities function similar to a conventionally controlled airplane that is out of trim. With the sidestick in neutral, if the airspeed approaches a limit, the airplane wants to pitch down or pitch up to return to the trimmed airspeed. Without the stabilities the unaltered g-load demand control system will provide no resistance to going dangerously fast or slow. The stabilities will gently pitch the airplane down or up if the sidestick is near neutral. The pilot can override the stabilities by holding the sidestick forward or back. The force required is the same as moving the sidestick at any other time, and as a result the effect is somewhat subtle.

Low speed stability is activated by reference to indicated airspeed, not angle of attack. It is active from 5 to 10 knots above stall speed. When low speed stability is active, automatic stabilizer trim stops and the pitch law changes to Direct Law. This restores the airplane’s natural stability, and it will tend to pitch down.

If the aircraft weight data, flap position data, or a dual or triple air data loss or disagreement occurs, the low speed stabilities cannot function. The g-load pitch law remains in effect and automatic trim continues to operate. This was the case with AF447.

Alternate Law requires awareness as no computerized protections or aerodynamic pitch down forces will assist in maintaining flight within the normal operating envelope. This is why the ECAM says “Alternate Law, protections lost.” In the Flight Crew Training Manual, Airbus states, “Outside the normal flight envelope, the PF must take appropriate preventive actions to avoid losing control, and/or avoid high speed excursions. These actions are the same as those that would be applied in any case where non protected aircraft (e.g., in case of stall warning: add thrust, reduce pitch, check speedbrakes retracted).” However, the speed stabilities are not lost in conventional aircraft.

AF447 lost airspeed indications at some points while the values disagreed at others, therefore the low speed stabilities were not available due to both reasons.

The Final Report states:

Specifically, the approach to stall on a classic airplane is always associated with a more or less pronounced nose-up input. This is not the case on the A330 in alternate law. The specific consequence is that in this control law the airplane, placed in a configuration where the thrust is not sufficient to maintain speed on the flight path, would end up by stalling without any inputs on the sidestick.
It appears that this absence of positive static stability could have contributed to the PF not identifying the approach to stall.

If the PF had simply pointed the nose of the airplane up and made no more pitch inputs, the outcome may have been much the same. However, Bonin
did
make nose up inputs. His inability to conclude that the airplane would quickly run out of energy while making these inputs and that a stall was a genuine threat is baffling.

Abnormal Attitude Law

Some have speculated that the particulars of Alternate Law worked contrary to the recovery, and if the pilots had more authority a recovery may have been easier. Abnormal Attitude Law is an automatically engaged law designed to give the pilots additional authority in rare occasions, such as extreme wind shear or structural damage. If the airplane exceeds the following parameters, Abnormal Attitude Law becomes active:

• Pitch attitude > 50° nose up or 30° nose down
  
• Bank angle > 125°
  
• Angle of attack > 30° or < -10°
  
• Speed > 440 kt or < 60 kt
  
• Mach > 0.96 or < 0.1
  

Unlike Alternate 2 Law where some spoilers are disabled and the flight control gains are set according to flap position, Abnormal Attitude Law provides a full-authority direct law in roll. This provides the pilot the highest capacity to recover from unforeseen circumstances.

In the pitch axis, Abnormal Attitude Law provides Alternate Law pitch handling with no protections except g load. Auto trim is also disabled.

When the recovery is complete, the flight control law reverts to Alternate 2 Law and remains there for the rest of the flight.

Due to the rejection of the speed and angle of attack data by the primary flight control computers on AF447, the Abnormal Attitude Law could only have been triggered by a pitch or bank angle exceedance, but neither of those conditions were ever met.

While it may have been helpful if the pitch trim was disabled at some point to aid in recovery, by the time the angle of attack reached 30°, the stabilizer was already close to full nose up trim due to the prolonged application of pitch-up commands by the pilot. After the stall at 38,000 feet, the pilots were not fully using the authority they already had to make the recovery. Therefore, even if Abnormal Attitude Law had engaged, it most likely would not have made any difference. Also, in consideration of the difficult time that First Officer Bonin had controlling the roll axis of the airplane with the dampened roll response of Alternate 2 Law, given the same control inputs, the full roll authority of Abnormal Attitude Law may well have resulted in more extreme roll excursions and further loss of control.

Flight Directors

The flight director on the A330 consists of a pitch and a roll command bar displayed on the attitude portion of the Primary Flight Display (PFD).  The flight directors provide guidance for following the selected pitch and roll modes by displacing the command bar from the center position. Each command bar operates separately to instruct the pilot to make a pitch or roll input. 

Flight directors allow the pilot to hand fly the airplane very precisely by responding to even small displacements of the command bars. This relieves the pilot of the task of scanning the instruments for deviations from the desired path and speed, calculating any needed correction, making an attitude adjustment to initiate the correction, monitoring the correction, resuming an attitude to maintain the desired path, and repeating every few seconds. In this way, flight directors allow for reduced mental workload and increased accuracy when hand flying.

The autopilot and the flight director both operate in the same mode when either is on, with the guidance selected by the pilot and computed by the Flight Management Guidance and Envelope Computer (FMGEC). The selected modes for the autopilot and/or flight director are displayed at the top of the PFD in an area referred to as the Flight Mode Annunciator (FMA). The FMA has separate columns for autothrust, pitch, roll, and autopilot/flight director/autothrust status. Engaged modes are displayed in green, and armed modes in blue. Newly engaged modes are surrounded by a white box.