There seem to be mounting evidence that Air France and the French Government are not being forthcoming in the root cause of this aviation disaster and in fact, Airbus and European aviation officials for some reason are not releasing most of the flight messages leading up the the event. I will be reviewing later today several stories in the European and Brazilian press once I’m able to complete my translations into English.
First, here’s what we do know. The Aviation Safety Network (flightsafety.org) provides the following:
|Date:||01 JUN 2009|
|C/n / msn:||660|
|First flight:||2005-02-25 (4 years 3 months)|
|Total airframe hrs:||18870|
|Engines:||2 General Electric CF6-80E1A3|
|Crew:||Fatalities: 12 / Occupants: 12|
|Passengers:||Fatalities: 216 / Occupants: 216|
|Total:||Fatalities: 228 / Occupants: 228|
|Airplane fate:||Written off (damaged beyond repair)|
|Location:||ca 160 km NNW o São Pedro and São Paulo Archipelago (Atlantic Ocean)|
|Phase:||En route (ENR)|
|Nature:||International Scheduled Passenger|
|Departure airport:||Rio de Janeiro-Galeao International Airport, RJ (GIG/SBGL), Brazil|
|Destination airport:||Paris-Charles de Gaulle Airport (CDG/LFPG), France|
Narrative:An Air France Airbus A330-200 was destroyed when it crashed into the sea while on transatlantic flight from Rio de Janeiro-Galeao International Airport, RJ (GIG) to Paris-Charles de Gaulle Airport.
The airplane carried 12 crew members an 216 passengers. Flight AF447 departed at 19:03 local time (May 31) from Rio de Janeiro (GIG).
Last radio contact with the flight was at 01:33 UTC. The crew was in contact with the Atlantic Area Control Centre (CINDACTA III) when the flight reported over the INTOL waypoint, estimating TASIL at 02:20 UTC. INTOL is an RNAV waypoint located in the Atlantic Ocean, 565 km from Natal, Brazil. The TASIL waypoint is located 1228 kilometers from Natal. TASIL is at the border of the Recife FIR and Dakar Oceanic FIR.
At 01:48 UTC the aircraft went out of the radar coverage of CINDACTA III, Fernando de Noronha. Information indicated that the aircraft flew normally at FL350 and a speed of 453 kts.
A preliminary analysis of meteorological information shows that AF447 crossed through three key thunderstorm clusters: a small one around 01:51 UTC, a new rapidly growing one at about 01:59 UTC, and finally a large multicell convective system (MCS) around 02:05-02:16 UTC.
Over a time span of four minutes, starting at 02:10 UTC, a series of ACARS messages were sent -automatically- from the plane. The first message indicated the disconnection of the autopilot followed and the airplane went into ‘alternate law’ flight control mode. This happens when multiple failures of redundant systems occur.
From 02:11 to 02:13, multiple faults regarding ADIRU (Air Data and Inertial Reference Unit) and ISIS (Integrated Standby Intsruments System) were reported. Then on 02:13 the system reported failures of PRIM 1, the primary flight control computers that receive inputs from the ADIRU and SEC 1 (secondary flight control computers). The last message at 02:14 was a ‘Cabin vertical speed’ advisory.
On June 3, 06:40 UTC, a Brazilian Air Force R-99 plane positively identified four points of wreckage: Various objects scattered in a circular area of 5 km radius; an object 7m in lenght; ten objects (some of which metal) and an oil stain extending 20 km.
Out of respect to the families who lost loved ones, I don’t want to speculate and weather may have been the most significant contributing factor to this disaster, however a review of several airline pilot message boards and forums shows us that the pilots who fly the Airbus A330 are very concerned about the ADIRUs and specifically the lack of any software redundancy: Below is a sample of these comments.
Please understand these are on-line comments are between pilots and give a good insight to the cause or causes of this accident however the are not FACT and only speculation at this time:
In light of no other information, this really spooks me that it’s an ADIRU issue which brought this plane down. I agree. After theQF lucky break and others, I have feared there is a core problem with the Airbus software that is a catastrophic accident waiting to happen. You just have to wait, and it will happen.
As the usual, it takes a series of contributing problems to bring down a plane at altitude, but if there was, say a sudden auto-generated disfunctional operation of the plane coupled with an extreme weather event that made disfunctional flying much more stressful on the plane than the norm, and also preventing the pilot from regaining a healthy flying condition, could have destroyed the plane.
It was confirmed that each PRIM was loaded with identical operational software The significant issue is that Air France appear to have opted not for Litton for their ADIRUs, but for the other manufacturer, Honeywell. Yet, once again, ADIRU malfunction is among the possible causes being investigated.
The important thing about ADIRUs is that they work not from the traditional instruments but from probes which mostly measure air pressure etc. from different directions. So it can tell not only how fast the aeroplane is flying, and in what direction, but also whether it is skidding, sideslipping, gaining or osing altitude etc.
Hmmm, if the ADIRUs mostly measure air pressure, and you fly through an extreme thunderstorm with highly oscillating air pressure measurements, how does the ADIRU handle that? Could that convince the ADIRU that the plane is somewhere it shouldn’t be? (Let’s say, FL850), causing it to nosedive?
A poster asked for an explanation of ADIRUs in plain English. It’s as simple as that.
The ASI works on airflow from ahead. The altimeter works on barometric pressure. The compass works on magnetic attraction, sometimes with added gyros. The turn and bank usually works on a simple pendulum arrangement…….
Inertial navigation works on differential airflows from numerous directions – it’s a true breakthrough in that it can precisely and continuously record and display an aeroplane’s true flightpath and speed.
Yet again, the flight was at night, the crew was probably able to see a lot of lightning and get a hint of what they’re flying into. This in fact is confirmed by a first ACARS message “flying into CBs”. But why would anyone knowingly fly into such a storm?
I think right now I’m more leaning towards a fly-by-wire control system failure similar to an incident with a QF A333 when the plane’s air data inertial reference unit (ADIRU) failed, causing a sudden out-of-control flight that the flight crew barely recovered from. That’s why if we see a lot of anomalous data from the flight data recorder in regards to control surface movements and in pitch, roll and yaw, an ADIRU failure sounds more and more like the cause of the crash.
“Over a time span of four minutes, starting at 02:10 UTC, a series of ACARS messages were sent -automatically- from the plane. The first message indicated the disconnection of the autopilot followed and the airplane went into ‘alternate law’ flight control mode. This happens when multiple failures of redundant systems occur.
“From 02:11 to 02:13, multiple faults regarding ADIRU (Air Data and Inertial Reference Unit) and ISIS (Integrated Standby Instruments System) were reported. Then on 02:13 the system reported failures of PRIM 1, the primary flight control computers that receive inputs from the ADIRU and SEC 1 (secondary flight control computers). The last message at 02:14 was a ‘Cabin vertical speed’ advisory.”
The AD makes no reference to that. The most recent version calls for the whole unit to be turned off in the case of a fault. The previous version called for the unit to be turned off only if the “OFF” lights in the separate controls for the ADR and IR segments of the unit did not illuminate after their associated switches had been pressed. This seems to not be an issue with crossflow of bad data as much as it is an issue with how to effectively isolate a bad ADIRU. Why they didn’t just put out a new procedure calling for the ADIRU to be turned off in the first place I don’t know – it doesn’t make a whole lot of sense to keep it running if its ADR and IR segments have both been disabled. But as long as the unit is de-energized (which is what the most recent AD calls for), there’s not going to be any bad data flowing. And there would be no need to turn a second one off unless a fault developed with that particular ADIRU.
Regarding the ACARS messages, I’m afraid we have not been told all the truth, or all what is known. At first it was a single short message, now it’s 4 minutes of transmission, and some even say it is much more than this, more than 10 pages full of information. When will they publicly state what the ACARS messages tell? Is it classified info for the investigators?
The points being made on here are that there have been three recent cases (all A330s) in which the ADIRUs have suddenly started transmitting ‘rogue’ messages to the autopilot (usually that the aircraft is climbing or descending when it’s not). Throwing the aeroplane into sudden sharp descents or climbs.
The point to remember is that the problem has NOT been solved. The AD is an emergency (and hopefully temporary) reaction to a problem of which the root cause has not yet been found. As I understand it, there appears to be mounting evidence that one defective ADIRU can somehow ‘cross-fertilise’ with the others, or with other aircraft systems – which may necessitate turning two off. What’s more, turning either or both off by normal procedures may not work – necessitating a ‘belt and braces’ approach:-
“Since that AD was issued, it has been reported that the “OFF” light did not illuminate in the cockpit after setting the IR and ADR pushbuttons to OFF. Investigation has determined that the ADIRU was indeed sometimes affected by another failure condition.
“To prevent such a failure, the operational procedure has been updated to instruct the flight crew to de-energize the ADIRU if the “OFF” light is not illuminated after setting the IR and ADR pushbuttons to OFF. Consequently, AD 2008-0225-E, which superseded AD 2008-0203-E, required accomplishment of the updated AFM operational procedure.
“Since this second AD was issued, a new in service event has been reported highlighting that, in some failure cases, even though the “OFF” light illuminates in the cockpit after setting the IR and ADR pushbuttons to OFF, the IR could keep providing erroneous data to other systems.
“In order to address all identified failure cases, de-energizing the affected ADIRU must be done by setting the IR mode rotary selector to OFF. Consequently, this AD, which supersedes AD 2008-0225-E, requires accomplishment of the updated AFM operational procedure.”
So three Emergency Airworthiness Directives in the space of a few months – and no sort of permanent solution yet.