The Oil Drum | DrumBeat: June 4, 2009

81 comments on DrumBeat: June 4, 2009

Comments can no longer be added to this story.

Show without comments | PDF version

Ignorant on June 4, 2009 - 9:08am

What price for fuel efficiency? I got a bit angry yesterday as I was reading the sequence of the Air France failure signals. I’ve studied aeronautics and aerodynamics; I’ve worked on things used by aircraft; I’ve done it from behind a drafting table... to working with the mechanics who worked with the items... to being inside a flying plane as a system was tested.

Planes built back in the 1960s had multiple redundant systems. Some had one safety critical system with 3 redundant backups. Today, the claim is that redundant systems are unnecessary because today’s equipment has such a high rate of reliability. FINE! What happens when that one piece fails???

In the 1980s somebody had the bright idea of eliminating quality control oversight (claiming that it only encouraged complacency). That became an industrial fad.

Instead of spending a few extra years of testing new flight control computers on in-flight test beds “we” went ahead and did “imagineering” to work out bugs. “We” then built these aircraft and sold them. “We” lost quite a few planes and people to poorly programmed computers... the most famous one being at the Paris Air Show when the plane’s computer program decided that fuel conservation was more important that a pilot’s need for immediate engine power.

Maybe my memory is mistaken.

I don’t have any answers.

Comments can no longer be added to this story.

RalphW on June 4, 2009 - 9:30am

An alternative cost cutting theory has emerged.

A report on reuters

http://www.reuters.com/article/newsOne/idUSTRE5501PB20090604

suggests the pilot might have cut airspeed to save fuel, triggering a stall in sharp downdraft.

We may see more of this sort of failure in the collapse of aviation. The FSU airlines became hideously unsafe in the 1990s.

BTW WTI back over $68.

EDIT

Looks like reducing airspeed is normal procedure in turbulence. The pilots may have over-done it. Not a cost cutting exercise.

Comments can no longer be added to this story.

westexas on June 4, 2009 - 10:23am

At higher altitudes, there is a a thinner margin between stall speed and mach buffet. I have read that the U-2 routinely operated right at the top of its ceiling, so that the margin between stall speed and mach buffet was only 5 to 10 knots. Here is an article that discusses the "Coffin Corner," the thin margin between stall speed and mach buffet at higher altitudes:

http://airplanepilot.blogspot.com/2007/01/coffin-corner.html

The blog post discusses the importance of pilots training for high altitude stalls. Interesting that Airbus has already advised pilots not to lower their speed too much while approaching turbulence at higher altitudes. One does have to wonder if this was a combination of some type of fly by wire failure combined with a high altitude stall, and the pilots didn't have a enough time to reboot the system in turbulent conditions.

BTW, an interesting factoid. According to news reports, since airlines started flying Europe to South America and vice-versa in 1947, this is reportedly the first commercial airliner crash (of course there have been crashes on other transatlantic routes).

Comments can no longer be added to this story.

Leanan on June 4, 2009 - 9:21am

I'm curious about this, and have been trying to find more information, but it's scarce and contradictory right now. Time points out that Airbuses have had problems in the past with the autopilot throwing the plane into a dive. They did have backups, but for some reason, they didn't work.

The system is intended to eliminate the possibility of electronic error: the flight computer, which is always monitoring the trio, can disregard one ADIRU if it begins relaying information that conflicts with the other two.

But that's not what happened when one of them went awry on Oct. 7 and began sending erroneous data spikes on the plane's angle of attack (AOA) — the angle between its wings and the air flowing over them — to the flight-control computer. "For some reason, the damn computer disregarded the healthy channels," says Hans Weber, an aviation expert who heads Tecop International, an aviation-consulting firm in San Diego. "Instead, it acted upon the information from the rogue channel."

Comments can no longer be added to this story.

710 on June 4, 2009 - 10:23am

Looking back on all the data, it can be clear to the human observer which channels were the healthy ones. But the "decisions" were made by a computer in real-time, programmed ahead of time by some other distant human removed from the actual environment. Whatever inference engine or heuristics were programmed in, they got confused by the chaos of the erroneous data, and "decided" that the rogue channel was the only healthy channel.

Comments can no longer be added to this story.

Black_Dog on June 4, 2009 - 10:35am

I think it's too early to decide the cause of the crash. There was a story today in which another pilot is quoted as reporting a bright flash of light for a short period of time near the crash area. Obviously, the aircraft came apart rather quickly, so fast that the crew did not have time to radio in an emergency call. There was a report of a bomb threat a few days before the crash. One can only hope that the black boxes are found, which would allow determination of a probable cause of the breakup. As things now stand, all is speculation.

E. Swanson

Comments can no longer be added to this story.

paal myrtvedt on June 4, 2009 - 1:54pm

Black_Dog : "I think it's too early to decide the cause of the crash."

I totally agree. It's just stupid to start speculations at this stage - with the Black-boxes "7000 meters under the sea-surface" ...

Comments can no longer be added to this story.

Leanan on June 4, 2009 - 10:38am

This guy thinks the violent weather broke the plate apart in mid-flight:

"There was some kind of in-flight violent" incident, said Bill Waldock, an air-crash expert at Embry-Riddle Aeronautical University in Prescott, Ariz.

Waldock suspects weather — namely, the 100-mph winds the airplane apparently encountered that could have gotten underneath the wings and shaken the plane. "If they hit a 100-mph updraft while they were going 525 mph, it would have thrown them violently," Waldock said. "It's way beyond what the airplane is designed to accept."

The force could have bent or torn off a wing, Waldock said.

Comments can no longer be added to this story.

joule on June 4, 2009 - 11:44am

Leanan -

It seems to me that when flying at that altitude, even a violent weather event causing a rapid structural failure of the aircraft's wings would still have allowed at least several seconds for either the pilot or copilot to get off a quick mayday signal. That fact that there apparently wasn't any such message suggests a very rapid sudden total failure of the entire aircraft, such as in the case of an explosion.

This looks very sinister to me.

Any aviators out there agree or disagree?

Comments can no longer be added to this story.

TJ on June 4, 2009 - 12:27pm

Not an aviator, but the info I've read said the plane had power failures over a period of minutes, rather than seconds. Some of the more informed speculation I've read suggested composite failure or lightning strike.

Comments can no longer be added to this story.

Leanan on June 4, 2009 - 12:43pm

I don't think sending a mayday signal would be a priority. They were trying to fly the plane in the middle of a storm. They were concentrating on trying to figure out what was going on, and trying to control the plane.

That commuter plane that went down in an ice storm near Buffalo did not send a mayday either, and there was no sudden catastrophic failure there - just pilot error.

Comments can no longer be added to this story.

Arclite on June 4, 2009 - 5:02pm

There is also a 20m oil slick, suggesting that the plane broke up without a fire. And the wreckage is also widespread, with pieces dozens of miles apart, suggesting a mid-air breakup.

Comments can no longer be added to this story.

airdale on June 4, 2009 - 7:31pm

I am not a pilot with a current certificate. I have flown small aircraft and was a crew member with many tIhousands of hours of flight time in military aircraft.I was responsible for all Com/Nav and electronic systems both inflight and on ground.

My squadron had over 100 flyable aircraft and we kept approx 7 aloft, 24 hours per day , 7 days a week for many years as per our mission.

AFAIK we never had an aircraft ditch or crash while at normal altitude. And I might add at sufficient altitude to require cabin pressure.

Most accidents were takeoff and landings or shoot downs by hostile nations. Actual airframe malfunctions were rare.Engine loss was normal and we just diverted at that point to alternates. We flew extremely capable aircraft and capable of 2 engine losses and still be airworthy.

I have flown thru storms and had endured some lightening strikes. Those are rare since static discharge wicks usually bleed off all buildup. Since there is no 'ground' then it didn't seem to matter.

I have also been thru weather that stuck me to the overhead and also took us to our knees. We had excellent pilots and crew members and very good hangar maintenance.

I was aboard one aircraft that exploded on the flight line and burned. Another of my buddies flight crashed on landing killing many. Another lost its landing gear on takeoff and all survived that.

We did not have 'fly by wire'. It was all mechanical and a story (true one) is told of a plane commander who never removed his seat belts(over the shoulder) while in the cockpit. He was also single and a weight lifter. The plane on this usual mission he was piloting lost something crucial and went nose down and ready to 'auger in' out in the middle of nowhere. A very sharp dive such that all not strapped in piled up in the rear of the ship clawing for traction and unable to move.

What saved the crew and aircraft was him putting both feet on the instrument panel and pulling back on the yoke with enormous strength and brought this aircraft to level flight just a bit above ocean level. Thousands of foot dive straight nosedown.

From that day forth no radioman ever sat on duty without his seat belt on while in an aircraft he was pilot on(we carried three pilots). For if the AC was ditching then the radioman giving a position report was all they had going for them. Rescue would not be possible unless very close to the base, but at least the AC position was known for SAR to attempt it.

We never really thought about it much then being young and full of it. Many loved to fly and made it lifelong careers. After three years I turned in my wings and walked away feeling ok about it. We had lost 4 or so by then and age was getting to be a factor on the airframes. I lost track then but the old timers at our Squadron Reunions told no stories of any more crashs and none at normal altitudes inflight.

So its not similar due to extensive electronics but for the enormous hours we flew I can say that good well built airframes should not just break apart at altitude. IMO. Given the insturments, com/nav gear and weather radar this just should not happen. You can usually find a better altitude or make another maneuver.

I suspect pilot error along with lack of experience and bad conditions. All flight plans are made with lots of valuable in-flight weather data and information. This should have been averted. Airframe failure due to fautly normal inspections may have been at fault too.

In the USA this is very strickly adhered to. Very much so. The FAA is supposed to make sure. Yet this is a foreign country so all bets are off as far as I can see.

A story. We were flying a pilot familiarization flight locally. A huge rainstorm had blown in on the island the day before. We had a lot of desk-jockeys gettting there flight hours in. We rolled out on a normal takeoff and circled for a hour. I happen for some reason to pop the lower hatch cover and looked down. We had a foot or two of water in the lower baggage area when much of the com/nav gear was stored. Good thing I never fired any up for hell would have broke loss.
I sauntered up to the flight deck and told the pilot in command. He got somewhat whitefaced and made everyone strap in. We made a right smart turnaround and return to base.went back to the tech station, yawned and went back to my pocket novel. Maybe I was reading Kerouac at the time. But I was rather unfazed while the desk-jockeys were literally almost puking up over it.

We had a slight leak somewhere. Mech's job. AND someone didn't preflight the AC. I was not regular crew. Just along to pull radio duty if need be even though I was not a radioman but I did keep the gear up and could code a signal if need be.

Note: None of the radiomans gear(hf,uhf) was in the baggage area. Otherwise there were about 20 UHF pressurized transceivers down there and huge amounts of wiring and canon plugs,etc.Plus the radar Gyro and antenna platform. I didn't fire the radar up for a simple 'flightskins' checkride/flight. Good thing but then I was NOT given a chance to preflight my area either. Preflight is when you had BEST ensure your aircraft is worthy and without problems and all systems are go.
This is or should be done reliogiously and by those who will fly it. But I doubt that is the procedure these days in the world of commercial flight. All the times I flew commercial I never saw any clue they were preforming it.Not like we did where our own lives were hanging in the balance.

Airdale-sometimes I really miss those days

PS. Editted to add this. Flying in the squardron above we did have 'aborts' quite often. Sometimes a tire blew, a bird strike or we failed to get the proper engine specs before liftoff or point of no return on the runway. This was either a pilot call or a flight engineer call. If we aborted another AC was ready to roll after its preflight. Sometimes we had two in a row abort. Rarely three.
This was the only nerve racking part. Landing was usually ho-hum. Takeoffs were when you were most vulnerable. We carried an enormous load of hi octane avgas such that we needed total full military power for takeoffs. Enough fuel for around a 14 hour mission inflight. Enough also to make an alternate if we had trouble inflight like due to heavy head winds,etc. Quite often alternates were used. But like I said. We never AFAIK lost one at altitude and ditched in the ocean.

Comments can no longer be added to this story.

ptoemmes on June 4, 2009 - 10:46am

A tad off topic but quite a while ago I worked for a computer HW company that believed in slamming product out the door and relying on rapid failure and fixes to get it right.

Okay I guess if that is part of your in house QA process, but they were doing this with customer machines some of which were "mission critical" although thankfully not of a life threatening nature.

They are no longer in business - surprise - and of course I no longer work for them, but I do work for a SW company that seems to have a similar philosophy although again thankfully no one's life hangs in the balance.

Pete

Comments can no longer be added to this story.

RalphW on June 4, 2009 - 11:05am

When I worked at the Royal Aerospace Establishment there was a 'You wrote it, you fly it' approach to flight control software in our research BAC-111. Also, as a contractor, I had to sign a paper promising (my estate) would not sue them if they killed me, before I was allowed to fly.

The main quality control method was a large red button marked 'OFF'.

That was in the early 1990s. A bit of the old 'Who dares, wins' spirit was still around.

Comments can no longer be added to this story.

airdale on June 4, 2009 - 11:22am

I hsve worked quite a bit on automobile control modules. Call it computers but the service manuals call them Modules or at least on Chrysler products , of which I own 3.

While a good set of functioning auto control modules are very valuable, when problems creep in you can find that the modules are not that much able to lend them selves to troubleshooting.

One area is the capacitors. Electroylitics can leak and slowly destroy circuit lands, creating havoc. Fuses are sometimes hidden very well and can cause enormous problems.

I had been working on my 99 Jeep G.C. after it had set idle all winter.
Also a Concorde LXI. Both would not start. The 'tech tool' was of zero value and pinpointed nothing. Couldn't readout any codes.

I worked on these two vehicles off and on for weeks on end.

Finally discovered the power to the PCM(power train control module) was the fault. Contact resistance can be very very difficult to ascertain. When contacts begin to build up resistance , AND THEY EVENTUALLY WILL, then all havoc can break loose.

Its very subtle and very difficult to diagnose. One must unplug all connectors,clean them and reapply dialetrice paste to prevent it from reoccurring again.

These Electronic marvels have a marked failure point in the future. Accidents can take a toll. Long long runs of a very large number of wires and bundles of wires are prone to vibration and contamination.

You are driving within a hairs breadth of a castrosphe if control systems die. They IMO do not contain very much in the way of 'fail safe' methodology or programming.

Having worked with aircraft in the past when good old fashioned hard wired and cable controls were the norm I am a bit worried about the future of 'programming errors' as applies to this area. Not to mention hardware failures.

My 99 Jeep Wrangler has very few of these systems. Its rugged and has continued to serve while the other two vehicles are still undergoing repair and have for weeks on end.

Now its a full set of rear differentail bearing replacements after all new axle bearings,all new rotors, all new brake pads, new radiators, and the list goes on and on.

The old rugged wrangler just keeps trucking. The others eat my lunch.

If I ever do go once more into flying again it will be in a Light Sport Aircraft with just essential instruments with just possibly a handheld GPS but always a very good VOR/COM panel setup.

With two good VORs I can navigate and use cross bearing readouts to go anywhere there are stations. In fact Navaid units do exactly this but still I will always be able to plot a crosscountry flight plan.

I believe in 'seat of the pants' aviation. I prefer to not go into IFR conditions or status.

Airdale

PS. Auto modules I am informed rely on a good stable voltage to operate correctly. A failing battery, or alternator or generating system can wreck havoc. If the power distribution falls into the 10 volt range the modules tend to fail to operate correctly. A failing battery and built up corrosion can result in this. Jumpering a battery can lead to many problems unless performed correctly. A corroding high pressure line from the steering pump can render the steering inoperable and cause a life threatening accident , as I recently found out with my Chrysler sedan when that occurred. Lucky it failed in the driveway. No module can sense this unless sensors are in place and AFAIK there are none.

I believe that more airline tragidies are in our future.

Comments can no longer be added to this story.

estamos jodidos on June 4, 2009 - 11:25am

While your point is highly valid, the jury is still out on the Air France crash. It may have been weather related, (probable) but i recall a story last week about an arrest of a man associated with Al Queda in Brazil (link)

Until the find a black box, and do a proper analysis we won't know for certain.

Comments can no longer be added to this story.

FMagyar on June 4, 2009 - 1:52pm

While a terrorist attack has not yet been conclusively ruled out, it seems Occam's razor is pointing towards a systems failure due to extreme turbulence and possible lightning strike.
Someone has already posted a link to this very informative analysis.

http://www.weathergraphics.com/tim/af447/

Comments can no longer be added to this story.

damianblack on June 4, 2009 - 4:04pm

Irrelevant rant. This is theoildrum.com, did you think you were somewhere else?

Comments can no longer be added to this story.

FMagyar on June 4, 2009 - 5:16pm

Irrelevant rant. This is theoildrum.com, did you think you were somewhere else?

Having a real life example of cascading failures in a very complex group of interacting systems that probably failed due to a catastrophic event that knocked out it's electrical and computer systems on which it relied for staying airborne is not what I would consider irrelevant.

Actually I can see many parallels being drawn to our predicament and discussing them may hold valuable lessons. To me seeing the big picture and connecting the dots is more interesting than having an ultra narrow focus on a very limited range of topics which may BTW prevent us from gaining important insights.

Comments can no longer be added to this story.