Air France 447, update on pitot system

Posted on 07. Jun, 2009 by in Featured

Recent press releases are pointing to the pitot system bulletin recommending replacement as the probable cause for the crash of Air France 447. The A 330 series aircraft has 3 pitot systems; two are electronic and one is mechanical (tubes). A recent advisory to replace one of the systems still doesn’t explain the total failure of the fly by wire system IMO.

Faults were sent showing all 3 Air Data Inertial Reference Systems (ADIRUs) failed as well as both Integrated Standby Instrument Systems (ISIS) computers. The third ADIRU is supplied its airspeed data from the mechanical system, thus it was separate from the other two. Even if they failed due to the input of bad data from the two electronic and one mechanical pitot systems; it dosen’t explain both the backup systems (ISIS) failing. The ISIS power the backup instrumentation (old fashioned round gauges), both sent fault codes. Everything failing from one bad input (airspeed) is not likely; in fact it has happened before (pitot system icing up) in the 330 series and the fly by wire system did not fail. The past occurrences were why the bulletin was issued; and just as significant, it was an advisory not a requirement. It was only a recommendation because it was a benign failure.

Below is the latest summary of ACARS codes sent by AF 447:

02:10Z: Autothrust off Autopilot off FBW alternate law Rudder Travel Limiter Fault TCAS fault due to antenna fault Flight Envelope Computation warning All pitot static ports lost 02:11Z: Failure of all three ADIRUs Failure of gyros of ISIS (attitude information lost) 02:12Z: ADIRUs Air Data disagree 02:13Z: Flight Management, Guidance and Envelope Computer fault PRIM 1 fault SEC 1 fault 02:14Z: Cabin Pressure Controller fault (cabin vertical speed)

Two items stick out. Rudder Travel Limiter Fault and Failure of the ISIS attitude gyros.

Failure of the ISIS gyros is totally separate from the pitot systems. One is for attitude (ISIS gyro), the other airspeed. I think the investigation should concentrate on the violent control inputs of QF 72. Abrupt rudder input with the limiter off would cause the tail assembly to exceed max beta Q (side dynamic pressure) and fail. Airbus aircraft have a history of failed tails due to max beta Q issues. Looking back at the QF 72 upset, caused by EMI spikes from the ADIRU, IMO will likely provide data pointing to the cause. If the black boxes are not found QF 72 may be the only data points available.

No Responses to “Air France 447, update on pitot system”

  1. Rick 8 June 2009 at 06:36 #

    Very good post. I’m very curious why there has been no mention of listening for the ELT?? Wouldn’t that be a key to finding this wreckage? I always thought an ELT would be operable underwater. I used to own a ocean going sloop that had an ELT and I was always under the impression it would operate underwater. Everybody is concentrating on the pinging of the black boxes, but it was my understanding that the pinging of an ELT would be much stronger and durable than those. Can you color in some background on that?

  2. Chip 8 June 2009 at 10:27 #

    The ELT has a range of 4,000 feet under water. It has been a week, so I suspect it has weakened and perhaps even failed. France has a nuclear submarine in the area capable of picking up the ping. I agree it seems strange that there is little/no comment on it.

  3. Rick 8 June 2009 at 12:11 # has a picture of the vertical stabilizer…the rudder does not seem to be present. Please take a look at that shot and it will be interesting to get your opinion.

  4. Chip 8 June 2009 at 13:24 #

    Look closely at the paint stripes. IMO the rudder is still there. I’m watching Fox News they just put up a picture of the tail it looks almost complete. A diver was pushing up on the rudder and it was pivoted in the picture at the hinge attachment points. This tail did not impact the water at high speed, it seperated from the aircraft prior to impact and then fell like a leaf into the ocean, IMO.

  5. Andrew C. 8 June 2009 at 16:03 #

    While digging around the internet trying to get a better understanding of what could have happened, I found this very interesting article:

    ‘… on board of their aircraft not to limit their actions to turning off the affected ADIRU off, but to completely de-energize it under all circumstances …’
    This sounds really scary: not only does a disengage not fix the problem, but the Adiru needs to be completely de-energized – and to top it off, you might get the de-energized light, but the darned thing could still be wreaking havoc without the crew knowing about it!

  6. Rick 8 June 2009 at 19:40 #

    Yes I believe you’re right, and I appreciate your follow up posts this evening. Very informative. As always, there seems to be a cascading series of issues that led to complete breakdown. I still think that night flying was in the mix.

  7. Chip 8 June 2009 at 21:03 #

    See and avoid in the daylight is easier, I suspect we will get the answers when they pull up the black boxes. The pingers are actually good for another 22 days, so I think they will find them.

  8. Chip 9 June 2009 at 07:46 #

    I read that when researching the QANTAS 72 upset. I agree with you apparently the flight control designers never watched 2001 a Space Odyssey.

  9. Chip 9 June 2009 at 12:35 #

    Thanks for your point. It is significant enough IMO that I put up a seperate post.

  10. Andrew C. 9 June 2009 at 14:06 #

    thanks for making the Adiru info a seperate post, I think that this could be one of the problems the crew was trying to deal with. It certainly fits some of the ACARS messages.

    And you summed it up much better than I could have. Nice post!

  11. Curt 10 June 2009 at 01:03 #

    I believe the FBW will emerge as the culprit. Especially after reviewing the posts about the QF72 incident. Being a software engineer for 25 years and working on embedded system software I know there is no such thing as defect-free software. Especially when dealing with unforeseen boundary conditions (inputs that no one every expected to see – such as two or three failed ADIRUs). Also, I seem to remember how Airbus used CAD to minimize the material used in load-bearing structures in order to save weight. The result is an airframe just strong enough to meet design constraints but minimum capacity to handle over-stress beyond design limits. That’s why I am not surprised to see a tail in the water that likely failed due to side loads in excess of design limits.

  12. Chip 10 June 2009 at 15:21 #

    Reading the ATSB report for QF 72, I’d have to agree it is starting to point that way. I’m still going through the ATSB preliminary report, there is a lot of good info. See wht you think I’m linked to it on my latest post.

Leave a Reply