AOPA Pilot Magazine - March 2013 - 77

simulator training in the A320 described as
“Preventive recognition and countermeasures to approach to stall.” The similarity
between Airbus models was reportedly
handled by type differences training in subsequent models covered in simulation and
ground training.
THE ACCIDENT A330-203 aircraft entered
service in April 2005 and had fewer than
19,000 flight hours and about 2,600 cycles
(which roughly equate to flights).
Airbus design philosophy is to make the
aircraft as automated and simple as possible. That normal simplicity can lead to some
rather complex outcomes when things don’t
work as planned, especially with multiple faults. This is compounded by the fact
that most of the time, the systems work as
designed—so crews get relatively little practice in complex abnormal operations and
even less in actual conditions, especially
those involving high-altitude stall recovery.
In a greatly simplified description of
an extremely sophisticated system, the
A330 has four operational modes as a flyby-wire aircraft: normal law, alternate law
1, alternate law 2, and direct law. In normal
law there is complete envelope protection,
which essentially prevents the pilot from
putting the aircraft into an unflyable configuration—including stalls. In the alternate
laws, the protections progressively diminish and in direct law, the protections are lost
and the sidesticks control the various control surfaces directly—just like most light
GA aircraft. In alternate or direct law, the
angle-of-attack protections are no longer
available, but a stall warning is triggered
when the greatest of the valid angle-ofattack values exceeds a certain threshold.
THE EVENT THAT STARTED the cascading
errors was the near-simultaneous icing of
all three pitot systems. Compounding the
situation was the fact that the tubes would
freeze and thaw periodically, thus providing confusing airspeed indications. This
fault had been identified 13 times before on

A330/340 aircraft. The certifying authorities knew this but apparently it didn’t
happen often enough to trigger an immediate airworthiness directive—because in all
cases, the aircraft never departed the flight
envelope. The other aircraft reverted to
alternate law when the automatic systems
disconnected, but the crews were able to
maintain altitude within 1,000 feet.
The BEA report noted that the indications on the A330 at FL350 was a drop in
indicated airspeed from Mach 0.8 to about
0.3 and the true airspeed indication would
change from 461 knots to 182 knots. The
indicated altitude would drop about 300
feet and the displayed windspeed would
change from a 30-knot headwind to a 249knot tailwind.
THE BEA SAID, “The obstruction of the pitot
probes by ice crystals during cruise was a
phenomenon that was known but misunderstood by the aviation community at the
time of the accident. From an operational
perspective, the total loss of airspeed information that resulted from this was a failure
that was classified in the safety model. After
initial reactions that depend upon basic airmanship, it was expected that it would be
rapidly diagnosed by pilots and managed
where necessary by precautionary measures on the pitch attitude and the thrust,
as indicated in the associated procedure.
The occurrence of the failure in the context
of flight in cruise completely surprised the
pilots of flight AF 447. The apparent difficulties with aeroplane handling at high altitude
in turbulence led to excessive handling
inputs in roll and a sharp nose-up input by
the PF. The destabilization that resulted
from the climbing flight path and the evolution in the pitch attitude and vertical speed
was added to the erroneous airspeed indications and ECAM (warning) messages,
which did not help with the diagnosis. The
crew, progressively becoming destructured,
likely never understood that it was faced
with a ‘simple’ loss of three sources of airspeed information.”

THE HINDSIGHT view is clear: The pitot
heat system was inadequate and needed
to be addressed as soon as it was known
that it could be overwhelmed. A critical
triple-redundant system that fails is too
important to be ignored. This is a rare case
where the hardware failed, although it can
be debated—and will be—whether the manufacturers, the airlines, and the regulators
were negligent in not addressing it sooner.
The captain chose to leave the flight
deck as the aircraft was entering the ITCZ.
This is an area that is known to have severe
weather potential, as it did the night of the
accident. Complacency regarding weather
occasionally catches airline captains, just
as it does GA pilots. Being aloft in cruise
is not always a benign environment. This
accident makes a very good case study for
crew resource management and what went
wrong. I believe in the need for bulletproof
angle-of-attack indications or, barring that,
pilot awareness. Loss of control in GA aircraft remains one of our leading fatality
producers, and this accident shows that it
also happens to seasoned aviators in firstclass equipment. The Colgan Q400 accident
in Buffalo, New York, is another example.
As many light GA aircraft begin to emulate
airline cockpits, our training regimen must
increase to deal with complexity. System
designers and certification authorities
might consider that simpler, more intuitive, and more robust is better than the “new
new” thing—driven by marketing and the
art of the possible by microprocessors.
Both air carrier and GA training can
be improved but that takes time, effort,
and investment. Stall avoidance education
begins in primary training but sometimes
does not carry through into advanced
flight—especially at high altitude, where
the margins are very thin between overspeed and stalling.
Complex systems and seldom-practiced
events can leave us unprepared. And until
we get more bulletproof designs, we have to
fly the aircraft as they are—not as we wish
them to be.
AOPA
www.aopa.org/pilot AOPA PILOT | 77

http://www.aopa.org/pilot

AOPA Pilot Magazine - March 2013

Table of Contents for the Digital Edition of AOPA Pilot Magazine - March 2013