法航事故报告accident on 1st June 2009 Airbus A330-203 F-GZCP Air France

航空发表于 2010-8-14 11:28:41

**** Hidden Message *****

航空发表于 2010-8-14 11:29:10

Ministère de l’écologie, de l’énergie, du développement durable et de la mer, en charge des technologies vertes et des négociations sur le climat Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation civile Interim Report n°2 f-cp090601ae2 on the accident on 1st June 2009 to the Airbus A330-203 registered F-GZCP operated by Air France flight AF 447 Rio de Janeiro – Paris F-GZCP - 1st June 2009 1 This document presents an update on the progress of the technical investigation as of 30 November 2009. It adds to the first Interim report published by BEA on 2 July 2009. In accordance with Annex 13 to the Convention on International Civil Aviation, with EC directive 94/56 and with the French Civil Aviation Code (Book VII), the investigation has not been not conducted so as to apportion blame, nor to assess individual or collective responsibility. The sole objective is to draw lessons from this occurrence which may help to prevent future accidents. Consequently, the use of this report for any purpose other than for the prevention of future accidents could lead to erroneous interpretations. SPECIAL FOREWORD TO ENGLISH EDITION This report has been translated and published by the BEA to make its reading easier for English-speaking people. As accurate as the translation may be, the original text in French should be considered as the work of reference. Foreword
F-GZCP - 1st June 2009 3 Table of Contents FOREWORD 1 GLOSSARY 5 SYNOPSIS 7 UPDATE ON THE INVESTIGATION 9 COMPLETED PARAGRAPHS 11 1.11 Flight Recorders 11 1.12 Wreckage and Impact Information 11 1.12.1 Debris identification 11 1.12.2 Repositioning of the debris according to the aircraft layout 12 1.12.3 Visual Inspections 15 1.12.4 Summary 31 1.13 Medical and Pathological Information 32 1.16 Tests and Research 33 1.16.1 Summary of the Sea Searches 33 NEW PARAGRAPHS 43 1.6 Aircraft information 43 1.6.11 Functioning of the automated systems 43 1.7 Meteorological Conditions 49 1.7.3 Meteorological Analyses 49 1.16 Tests and Research 50 1.16.3 Study of losses of or temporary anomalies in indicated speeds occurring in cruise on Airbus A330 / A340 50 1.17 Information on Organisations and Management 53 1.17.6 Type certification and Continuing Airworthiness 55 1.18 Additional Information 60 1.18.5 System certification 60 1.18.6 Earlier events associated with incorrect air speed indications 64 1.18.7 History of the Pitot probes on Airbus A330 and management at Air France 65 FINDINGS 69 4 - RECOMMENDATIONS 71 4.1 Flight Recorders 71 4.2 Certification 72
F-GZCP - 1st June 2009 5 Glossary A/THR Auto-thrust AAIB Air Accident Investigation Branch (UK) ACARS Aircraft Communications Addressing and Reporting System ADIRU Air Data and Inertial Reference Unit ADR Air Data Reference AP Automatic Pilot EASA European Aviation Safety Agency FMECA Failure Modes, Effects and Criticality Analysis ARM Airworthiness Review Meeting ATSU Air Traffic Service Unit ATSB Australian Transport Safety Bureau BFU Bundesstelle für Flugunfalluntersuchung (German aviation accident investigation bureau) SB Service Bulletin CAS Calibrated Air Speed CEAT Toulouse aeronautical test centre (Centre d’Essais Aéronautiques de Toulouse) CENIPA Centro de Investigação e Prevenção de Acidentes aeronãuticos (Brazilian aviation accident investigation bureau) CFR Current Flight Report CVR Cockpit Voice Recorder DGA French Armament Procurement Agency DGAC Directorate General of Civil Aviation France DOA Design Organisation Approval ECAM Electronic Centralized Aircraft Monitoring EFCS Electronic Flight Control System ELT Emergency Locator Transmitter FAA Federal Aviation Administration FCPC Flight Controls Primary Computer FCSC Flight Controls Secondary Computer FCU Flight Control Unit FCTM Flight Crew Training Manual FD Flight Director FDR Flight Data Recorder FL Flight Level FMA Flight Mode Annunciator FMGEC Flight Management Guidance and Envelope Computer FPA Flight Path Angle FPD Flight Path Director F-GZCP - 1st June 2009 6 FPV Flight Path Vector ft Feet GPS Global Positioning System HDG Heading HF High Frequency IAC / MAK Interstate Aviation Committee (CIS) ICAO International Civil Aviation Organisation IMC Instrument Meteorological Conditions IR Instrument Rating / Inertial Reference ISIS Integrated Standby Instrument System JAA Joint Aviation Authorities JAR Joint Aviation Regulations kHz Kilohertz kt Knot LDMCR Lower Deck Mobile Crew Rest NO Normal Operation NTSB National Transportation Safety Board PFD Primary Flight Display PFR Post Flight Report PHC Probe Heat Computer Ps Pressure, static – air data measurement Pt Total Pressure QRH Quick Reference Handbook RTLU Rudder Travel Limiter Unit SAT Static Air Temperature SDU Satellite Data Unit SGMer Secrétariat Général de la Mer (General Secretariat for the Sea) SSCVR Solid State Cockpit Voice Recorder SSFDR Solid State Flight Data Recorder SSM Sign Status Matrix STD Standard (altimeter setting) TAS True Air Speed TAT Total Air Temperature TCAS Traffic alert and Collision Avoidance System TRK Track UAS Unreliable Air Speed ULB Underwater Locator Beacon UTC Universal Time Coordinated V/S Vertical speed F-GZCP - 1st June 2009 7 Synopsis Date of accident 1st June 2009 at around 2 h 15(1) Site of accident Near the TASIL point, in international wa-ters, Atlantic Ocean Type of flight International public transport of passengers Scheduled flight AF447 Aircraft Airbus A330-203 registered F-GZCP Owner Air France Operator Air France Persons on board Flight crew: 3 Cabin crew: 9 Passengers: 216 Summary On 31 May 2009, flight AF447 took off from Rio de Janeiro Galeão airport bound for Paris Charles de Gaulle. The airplane was in contact with the Brazilian ATLANTICO ATC centre on the INTOL – SALPU – ORARO route at FL350. There were no further communications with the crew after passing the INTOL point. At 2 h 10, a position message and some maintenance messages were transmitted by the ACARS automatic system. Bodies and airplane parts were found from 6 June 2009 onwards by the French and Brazilian navies. Consequences People Equipment Killed Injured Unhurt Destroyed Crew 12 - - Passengers 216 - - Third parties - - - f-cp090601ae2 publication December 2009 (1)All times in this report are UTC, except where otherwise specifi ed. Two hours should be added to obtain the legal time applicable in metropolitan France on the day of the incident. The estimated time of the accident is based on the interruption in the ACARS messages.
F-GZCP - 1st June 2009 9 UPDATE ON THE INVESTIGATION Since the publication of the first Interim Report on 2 July 2009, the investigation has continued, still in close association with foreign investigation organisations and the companies involved and in coordination with those responsible for the judicial investigation. The working groups have continued their work of gathering and analyzing information useful to the investigation. Their activity has focused on  the elements of wreckage recovered,  the meteorological situation,  the maintenance messages transmitted by ACARS,  the certification and the continuing airworthiness of the Pitot probes,  events where speed inconsistencies were encountered in cruise. The results of this work have been integrated into this report. It has made it possible to complete the paragraphs of the first report published on 2 July 2009 and to introduce new paragraphs. This second interim report presents the first safety recommendations. At this stage, in the absence of any data from the flight recorders, the main parts of the airplane and any witness testimony on the flight, the precise circumstances of the accident, and therefore its causes, have still not been determined. The investigative work is continuing with this objective. The working group responsible for the sea searches is preparing the third phase aimed at localising the wreckage and recovering the flight recorders. This group is made up of the American, Russian, German, Brazilian and British investigation organisations and the Secrétariat Général de la Mer, and benefits from the participation of experts from Airbus, Air France and the US Navy. Two plenary meetings were held, the first on 12 and 13 October and the second on 10 November 2009. A third meeting is planned for the 15 December 2009, with the objective of putting in place the means required to begin the campaign in February 2010.
F-GZCP - 1st June 2009 11 COMPLETED PARAGRAPHS (the paragraph numbers correspond to those in the Interim Report issued on 2 July 2009 and the titles of some sections have been changed) 1.11 Flight Recorders According to the information supplied by Air France, the airplane was equipped with two flight recorders, in accordance with the regulations in force: Flight Data Recorder (FDR)  Manufacturer: Honeywell  Model: 4700  Type number: 980-4700-042  Serial number: 11469 This Solid State Flight Data Recorder (SSFDR) has a recording capacity of at least twenty-five hours. The decoding document, supplied with this airplane, has around 1,300 parameters. Cockpit Voice Recorder (CVR)  Manufacturer: Honeywell  Model: 6022  Type number: 980-6022-001  Serial number: 12768 This Solid State Cockpit Voice Recorder (SSCVR) has a recording capacity of at least two hours in standard quality and thirty minutes in high quality. Both recorders were equipped with the regulation Underwater Locator Beacons (ULB) whose transmission duration is at least 30 days, on the 37.5 kHz frequency. Note: the manufacturer of the beacons stated that the duration of transmission was of the order of forty days. 1.12 Wreckage and Impact Information 1.12.1 Debris identification All the pieces of debris were found by the French and Brazilian Navies. They were detailed in a database that includes about 1,000 references concerning the aircraft parts. Almost all of the aircraft debris was identified and classified by type: cabin, cargo compartment, wing, belly fairing, LDMCR (Lower Deck Mobile Crew Rest). This information completed the position, date and recovery time data that had been referenced previously. Most of the parts found were low-density honeycomb or composite material parts. F-GZCP - 1st June 2009 12 They were identified:  either directly with the Part Number when this was identifiable;  or indirectly by analysing the shapes, materials, coating colours and manufacturer’s documentation when the Part Number was not available. 1.12.2 Repositioning of the debris according to the aircraft layout All of the debris was gathered in a hangar at the CEAT in Toulouse. Most of the debris could be positioned precisely in relation to the aircraft layout. Forward part of the aircraft General view of the hangar Left aisle Right aisle View of the hangar: central part of the aircraft F-GZCP - 1st June 2009 13 View of the hangar: aft part of the aircraft This repositioning provides a distribution of the debris:  from the forward (radome) to the aft end (vertical stabiliser) of the aircraft;  from the left- to the right-hand side of the aircraft for the cabin or wing parts. Vertical stabiliser, radome, flight control surfaces, engine cowling, engine pylon, belly fairing Rudder Vertical stabiliser Elevator Trimmable Horizontal Stabilizer Cargo compartment parts Airframe Underbelly Engine Engine pylon LH wing Cabin Radome Position of the recovered parts (exterior and cargo) F-GZCP - 1st June 2009 14 Position of the cabin part debris recovered in relation to the aircraft layout F-GZCP - 1st June 2009 15 1.12.3 Visual Inspections 1.12.3.1. Cabin parts  A high degree of vertical compression can be seen on the cabin parts such as the galleys, stowage, partitions and toilet doors. This vertical compression is observable from the front (stowage and toilet at the level of door 1) to the rear of the aircraft (Galley G5), and from the right- to the left-hand sides. Certain overhead luggage racks were found with their fuselage attachment fittings. Besides the damage due to the vertical compression, these fittings have deformations that are due to a forward movement of the overhead luggage racks. Part of Galley G3: downwards deformation at the level of the galley’s heavy parts Front Luggage rack fi tting deformed Toilet door (L54) metallic stiffeners towards the front deformed by buckling F-GZCP - 1st June 2009 16  The lifejackets that were found were all in their packaging. Lifejacket found in its packaging  Three Cabin Crew seats were recovered. The two seats located on the partition at the level of left-hand door 1 (photos below) were not deformed; which was also the case for the corresponding seat belt fasteners and attachments. The seat located at the level of right-hand door 2 was damaged due to the deformation of the partition on which it was attached. Cabin crew seats located on the toilet L11 partition at the level of left-hand door 1 F-GZCP - 1st June 2009 17 1.12.3.2. Cargo compartment parts The outer parts making up the LDMCR were all found. The wall fragments were crumpled. The reconstitution of the ceiling showed it was bent downwards and the floor bent upwards. These deformations were symmetrical on the left and right sides with respect to the aircraft centreline. Part of the crumpled aft wall Floor of the LDMCR: Ceiling of the LDMCR: with bottom-upwards deformation with top-downwards deformation 1.12.3.3. Examination of the passenger oxygen containers The passenger oxygen containers were all of the same type, with two, three or four oxygen masks depending on their position in the aircraft. Twenty-nine containers were found in the debris. The deformations observed on three of them showed that they were in the closed position. Note: The supply system for cabin oxygen is designed to trigger the simultaneous opening of all the containers in case of depressurisation. A test was carried out on F-GZCP in July 2008 during a type C overhaul. This test showed no malfunctions. F-GZCP - 1st June 2009 18 Passenger oxygen container recovered closed: the deformations on the cover and box match In normal operation, the oxygen is sent to the mask when the passenger releases the system’s lock-pin by pulling on the mask. On the less damaged containers, the pins were found in place, closing the oxygen circuit. Passenger oxygen container recovered open: the three pins are in place 1.12.3.4. Wing and trimmable horizontal stabiliser flight control surfaces The following parts were found:  left wing: part of the inboard aileron, part of the outboard flap trailing edge, spoilers 1 and 6;  right wing: part of the outboard flap trailing edge, parts of spoilers 2 and 6;  flap track fairings for flaps No. 2, 3, 4 and 5 left-hand side, No. 2, 3 and 4 right-hand side;  parts of the left- and right-hand elevators outboard side. F-GZCP - 1st June 2009 19 On the left-hand spoiler No. 1 and left-hand inboard aileron, certain fittings attaching the moving part to the wing aft spar were still present. The failures observed on these fittings were the result of the bottom-upwards loads applied on the spoiler or aileron. Front Lower surface of left-hand spoiler No. 1 with a piece of the fi tting attaching spoiler No. 5 to the wing aft spar: failures due to the bottom-upward loads on the spoiler Contact marks between the fitting and the aileron resulting from the loads exerted on the aileron Upper surface of the left-hand inboard aileron with the fi ttings attaching it to the wing aft spar: failure due to the bottom-upward loads applied on the aileron F-GZCP - 1st June 2009 20 On the right-hand half elevator, four of the seven fittings attaching the elevator to the trimmable horizontal stabiliser were present. They had bottom-upwards deformations. Outboard half of the right-hand elevator: the four attachments that can be seen were deformed bottom-upwards From these observations it can be seen that the general direction of the loads that caused these deformations is bottom-upwards. Several parts of the flap extension mechanism fairing were found. There were marks on two of them (positioned at the level of flap track No. 3), made by the flap extension track on impact. Analysis of these marks (morphological and dimensional examinations) and comparison with an identical aircraft made it possible to determine that the flaps were in the “retracted” position at the time of impact with the water (measurement of the distance between the track and the lower surface of the flap, position of the carriage on the track). Flap extension mechanism (or fl ap track) No. 3 in extended position F-GZCP - 1st June 2009 21 Carriage Flap extension mechanism (or fl ap track) No. 3 in retracted position Part of the No. 3 fl ap track fairing on the left wing F-GZCP - 1st June 2009 22 1.12.3.5. Examination of the vertical stabiliser 1.12.3.5.1 General vertical stabiliser data Fin Rudder Trimmable Horizontal Stabiliser THS actuator RCV Rudder control unit Frame 84 Attachments Frame 91 29.3° RTLU The vertical stabiliser consists of the fin (fixed part) and the rudder (mobile part).It also includes panels from the leading and trailing edges and the fin (sandwich structure). The vertical stabiliser is attached to the fuselage by three attachments (forward, central and aft) situated at the root of the stabiliser. Each attachment consists of two lugs (male on the stabiliser, female on the fuselage), one on the right and one on the left. On the fuselage, the 6 female lugs are situated between frames 79 and 80, 84 and 85, 86 and 87. Assemblies 84-85 and 86-87 are main frames, and they receive the rudder control unit (frames 84 and 85) and the screw that is used to adjust the horizontal stabiliser (frames 86 and 87). Frame 91 is a particularly rigid frame because it is used to attach the trimmable horizontal stabiliser. There are two rods (one right and one left) at the level of each of the three attachments that pick up the lateral loads on the vertical stabiliser. F-GZCP - 1st June 2009 23 Fuselage skin Female attachment lug Rear view Front of aircraft Fr84 Fr85 Top view Side view Fr84 Fr85 Overview of Main Frame 84-85 Main aft attachment Lateral load pickup Main centre attachment Main forward attachment Lateral load pick-up Lateral load pickup Main aft attachment Main centre attachment Main forward attachment Stabiliser attachment diagram F-GZCP - 1st June 2009 24 The rudder is attached to the fin by means of eight hinge arms and one vertical load pick-up arm in the rudder’s hinge axis (arm 36 g). The rudder is controlled by means of a control unit (frames 84 and 85) and a mechanical control linkage (rods). Hinge arms Arm 36 g Rudder attachment to the fi n 1.12.3.5.2 General examination of the vertical stabilizer The vertical stabilizer was in generally good condition. The damage observed on the side panels and on the rudder was largely due to the recovery and transport operations. The damage due to separation from the fuselage was essentially located at the root of the vertical stabiliser. The vertical stabilizer separated from the fuselage at the level of the three attachments:  the forward attachment (male and female lugs) and part of the leading edge are missing;  the centre and aft attachments are present: male and female lugs and parts of the fuselage frames (frames 84, 85, 86 and 87). In the water Recovery operation F-GZCP - 1st June 2009 25 Unloading from the boat 1.12.3.5.3 Examination of the fin structure Rib 1 had almost completely disappeared. Rib 2 was bent upwards with a right-left symmetry. The front of the fin showed signs of symmetrical compression damage:  failure of the leading edge right- and left-hand panels  longitudinal cracking of the leading edge stiffener  HF antenna support (attached to the forward spar): failure of the lower part, crumpling indicating bottom-upwards compression loads Remaining part of rib 1 Rib 2 bent upwards Compression breakage of the leading edge panels Longitudinal crack perpendicular to the leading edge stiffener Compression of the HF antenna support F-GZCP - 1st June 2009 26 1.12.3.5.4 Examination of the vertical stabiliser – rudder attachments The vertical load pick-up arm in the rudder’s hinge axis (arm 36 g) broke at the level of the attachment lug on the rudder side. The size of this arm is calculated to withstand a maximum load of 120,000 N, corresponding to a relative acceleration of 36 g of the rudder in relation to the vertical stabilizer. Breaking of the right-hand attachment of arm 36 g Front Arm 36 g, right view: failure of the rudder attachments Shear cracks, along a top-down axis, can also be seen on the rudder hinge arm attachment fittings close to arm 36 g. These observations indicate that the vertical stabiliser was subjected to a load greater than 120,000 N in the rudder’s hinge axis. 1.12.3.5.5 Examination of the Rudder Travel Limiter Unit (RTLU) The RTLU was found in its place in the fin and disassembled. An examination was performed at the manufacturer’s and showed that it would allow travel of the rudder measured as 7.9° +/- 0.1°. As an example, at FL350, this travel is obtained for Mach 0.8 +/- 0.004, corresponding to a CAS of 272 +/- 2 kt. Note: the maximum travel of the rudder is calculated in relation to the airplane confi guration, its speed and its Mach number. This travel can be commanded between 4 degrees and 35 degrees. F-GZCP - 1st June 2009 27 1.12.3.5.6 Examination of the fuselage parts (remains of the skin, frames and web frames) The fuselage was sheared along the frames and centre and aft attachment lugs by loads applied bottom-upwards. Frame 87: shearing of the frame and fuselage skin along the frame Right-hand aft lug: shearing of the fuselage along main frames 86-87 The part of frame 87 that can be seen had undergone S-shaped deformation: the left-hand side forwards, and the right-hand side backwards. The horizontal stabiliser actuator supports were deformed and broke in a backwards movement from the front. These observations indicate a backwards movement of the trimmable horizontal stabiliser. F-GZCP - 1st June 2009 28 Forward S-shaped deformation of frame 87 Frames 84 to 87: S-shaped deformation of frame 87, with frames 84 and 85 pushed in backwards Frames 86 and 87: failure of the horizontal stabiliser actuator supports Frames 84 and 85 were pushed in backwards in the middle. The deformations observed on the rudder control rod are consistent with this indentation. The deformations of the frames were probably the consequence of the water braking the aircraft’s forward movement. F-GZCP - 1st June 2009 29 Deformations of the rudder control rod consistent with the backwards indentation of frame 84 1.12.3.5.7 Examination of the fin-to-fuselage attachments The centre attachment had pivoted backwards with the parts of the frames and web frames that were attached to it. The aft attachment had pivoted forwards with the parts of the frames and web frames that were attached to it. Front Fin centre and aft attachments The aft attachment lugs (male on the fin and female on the airframe) had marks indicating a backwards movement of frames 86 and 87 as a whole. F-GZCP - 1st June 2009 30 Rear view of the left-hand aft lug: there were marks showing a backwards pivoting of frames 86 and 87 The centre and aft lateral load pick-up rods showed damage that was consistent with this backwards pivoting of frames 84 to 87:  tensile failure of the centre spar at the level of the centre rod attachments;  compression failure of the aft spar at the level of the aft rod attachments and failure of the left-hand rod by buckling. Tensile failure of the centre spar at the level of the attachment of the lateral load pick-up rods F-GZCP - 1st June 2009 31 Compression failure of the aft spar at the level of the attachments of the lateral load pick-up rods and failure of the left-hand rod by buckling 1.12.4 Summary The cabin crew’s seatbelts that were found (three out of eleven) were not in use at the moment of impact. The containers recovered closed showed that the passenger oxygen masks had not been released. There had been no cabin depressurisation. Note: Depressurisation means pressure inside the cabin corresponding to an altitude of more than 14,000 ft. The flaps were retracted at the time of impact with water. The vertical stabiliser’s side panels did not show signs of compression damage. The breaks seen at the level of the lateral load pick-up rods were the result of the backwards movement of the attachments and centre and aft frames. The observations made on the vertical stabiliser are not consistent with a failure due to lateral loads in flight. The observations made on the debris (toilet doors, partitions, galleys, cabin crew rest module, spoiler, aileron, vertical stabiliser) evidenced high rates of compression resulting from a high rate of descent at the time of impact with the water. This high rate of compression can be seen all over the aircraft and symmetrically on the right- and left-hand sides. High levels of loading would be required to cause the damage observed forward of the vertical stabiliser (compression failure of the forward attachment). These observations are not compatible with a separation of the aft part of the fuselage in flight. F-GZCP - 1st June 2009 32 The damage found at the root of the vertical stabiliser was more or less symmetrical, as were the deformations due to the high rate of compression observed on the various parts of the aircraft. This left-right symmetry means that the aircraft had low bank and little sideslip on impact. The deformations of the fuselage frames at the root of the vertical stabiliser were not consistent with an aircraft nose-down attitude at the moment of impact. From these observations it can be deduced that:  The aircraft was probably intact on impact.  The aircraft struck the surface of the water with a positive attitude, a low bank and a high rate of descent.  There was no depressurisation. 1.13 Medical and Pathological Information This section is based on examination of the autopsy reports and photographs of the victims made by the Brazilian authorities and provided to the BEA. It should be noted that interpretation of the injuries is disrupted by the effects of prolonged presence in water. The autopsies performed made it possible to identify fifty persons: forty-five passengers, four flight attendants, including an in-charge flight attendant, and the Captain. According to the assigned seat placements at check-in (appendix 1), the passengers were distributed around the cabin as follows:  Eight were seated in business class between doors 1 and 2;  Three were seated in business class aft of door 2;  Twelve were seated in economy forward of the over-wing exits;  Twenty-two were seated at the rear of the airplane, between the overwing exits and the number 3 doors. Forty-three of the victims had fractures of the spinal column, the thorax and the pelvis. The fractures described were located mainly at the level of the transition vertebrae. The compression fractures of the spinal column associated with the fractures of the pelvis(2), observed on passengers seated throughout the cabin, are compatible with the effect, on a seated person, of high acceleration whose component in the axis of the spinal column is oriented upwards through the pelvis. Note: the information from the autopsies does not make it possible to reach a conclusion as to the location of the Captain at the time of the accident. (2)Fractures of the pelvis can also be associated with the wearing of a seat belt. F-GZCP - 1st June 2009 33 1.16 Tests and Research 1.16.1 Summary of the Sea Searches Note: This summary replaces part 1.16.1 in the 1st interim report (a summary of phases 1 and 2 is in appendix 2). It will subsequently be completed by a dedicated report that will detail all of the various phases of the sea searches. 1.16.1.1 Difficulty of the searches The first difficulty is the remoteness of the zone, which requires transits of the order of two to four days from ports such as Praia (Cape Verde), Natal (Brazil) or Dakar (Senegal). The absence of any trace of the accident in the first days and absence of an emergency distress message and radar data complicated the searches. The environment is also very unfavourable since the search zones are above the Atlantic ridge close to the equator. This implies that the underwater terrain is rough, with great variations in depth over short distances. The proximity to the equator affects the modelling of the currents in the estimated accident zone. The lack of available on-the-spot data and the complex oceanic dynamic (notably due to the seasonal start of the northequatorial counter-current during the month of June) also make it difficult to model the marine currents. These factors contributed to making the reversedrift calculations imprecise, added to which it was necessary to make them over a period of five to six days, which accentuated the gaps. 1.16.1.2 The various phases in the searches The sea search operations can be broken down into the following phases:  surface searches;  searches for the recorders’ underwater locator beacons (ULB);  searches for the wreckage with additional means (sonar or ROV). The surface operations focused on the search for possible survivors, the search for possible transmissions from ELT beacons, then the localisation and recovery of bodies and floating debris. This led to the recovery of bodies and parts of the airplane from 6 June 2009 onwards. A variety of acoustic devices were deployed in the zone to locate the airplane’s Underwater Locator Beacons (ULB) between 10 June and 10 July (phase 1). These searches did not succeed in finding the beacons. Another team worked in the zone to try to locate the wreckage with the aid of side-scan sonar and a remotely operated vehicle (ROV) between 27 July and 17 August 2009 (phase 2). Despite these efforts, the wreckage was not located. At the end of these two phases, an international working group was set up to prepare the third phase of the undersea searches, planned for the beginning of 2010. F-GZCP - 1st June 2009 34 1.16.1.3 Preparation of phase 3 of the undersea searches 1.16.1.3.1 Organisation of the preparation of the searches To prepare this third phase, the BEA formed an international group, to which it associated Airbus and Air France. The group comprises the following organisations:  Air Accident Investigation Branch (AAIB, United Kingdom),  Bundesstelle für Flugunfalluntersuchung (BFU, Germany),  Centro of Investigação e Prevenção de Acidentes aeronãuticos (CENIPA, Brazil),  Interstate Aviation Committee (IAC/MAK, Moscow, CIS),  National Transportation Safety Board (NTSB, USA),  Secrétariat Général à la Mer (SG Mer, France),  US Navy (USA). The group called on experts from the following organisations for the localisation work:  Société Collecte Localisation Satellites (France),  Ecole Normale Supérieure (France),  Laboratoire de Physique des Océans / IFREMER (France),  Laboratoire de Physique des Océans / CNRS (France),  Institut de Mathématiques de Toulouse (France),  Institute of Numerical Mathematics of the Russian Academy of Sciences (of Russian Federation),  Mercator Océan (France),  Météo France (France),  National Oceanography Centre (United Kingdom),  Service Hydrographique et Océanographique de la Marine (France),  Woods Hole Oceanographic Institution (USA). 1.16.1.3.2 Areas of work The group is working on two areas in parallel:  Defining the search zone;  Selection of the means to conduct the searches and recover the relevant parts of the wreckage. Defining the search zone consists of:  Expanding the collection of data around the last known position,  Refining the modelling of the structures of the current in this zone around the date of the accident,  Estimating the drift of bodies and debris,  Proposing a probability distribution in relation to the localisation of the wreckage. As regards the selection of the means to be employed, a review of equipment that allows work to be carried out down to a depth of 6,000 metres is under way. F-GZCP - 1st June 2009 35 1.16.1.3.3 Provisional programme for the operations The preparatory work must be completed in January 2010 so that the means can be deployed in the zone from February 2010 onwards. The estimated duration of searches is sixty days. If the wreckage is localised, a campaign of undersea observation, cartography, raising some parts of the equipment from the wreckage and, if need be, the recovery of any human remains will follow the searches.  1.16.2.4 Analysis of the messages received on 1st June from 2 h 10 Note: this paragraph completes the analysis of maintenance messages transmitted by ACARS. Only the analysis of messages that could not be explained during the drafting of the fi rst stage report is included here. 1.16.2.4.1 Analysis of Cockpit effect messages NAV TCAS FAULT (2 h 10) ECAM alarm Aural warning Visual warning SD page Local alarm Inhibited in phase 6 NAV TCAS FAULT - - - Flag on PFD and ND no Meaning: This message indicates that the TCAS is inoperative. Without an associated fault message, it could be the consequence of an electrical power supply problem or of an external failure. Amongst the possible external failures, only one is compatible with the CFR received. This is a monitoring process internal to the TCAS which applies to the standard altitude parameter. The latter is received from the active transponder (it can thus be the altitude elaborated from ADR 1 or 2) and is submitted to a “credibility” test. In actual fact the TCAS elaborates an altitude prediction that it compares permanently with the altitude received. When these two parameters move too far apart, it stops operating and generates this ECAM message. Once the altitude becomes “credible” again, normal operation resumes and the message disappears. FLAG ON CAPT PFD FPV and FLAG ON F/O PFD FPV (2 h 11) Symptoms: Disappearance of the FPV (bird) on the PFDs, Captain and First Officer sides, and display of the corresponding flag. F-GZCP - 1st June 2009 36 Meaning: This message indicates that the flight path vector (FPV) function is selected but unavailable. In order to lose completely this function, which is elaborated by the three IRs, in a way that is compatible with the CFR, one of the following three conditions must be met for each ADR:  barometric vertical speed higher, as an absolute value, than 20,000 ft/min,  true air speed higher than 599 kt,  measured calibrated airspeed lower than 60 kt. Once the operating conditions are satisfied again, the FPVs reappear on the PFD (if TRK/FPA mode is still selected). F/CTL PRIM 1 FAULT (2 h 13) ECAM alarm Aural warning Visual warning SD page Local alarm Inhibited in phase 6 F/CTL PRIM 1 FAULT Single chime Master caution F/CTL “Fault” light on corresponding button no Meaning: This message indicates that FCPC1 (PRIM 1) has stopped functioning. This shutdown may have been commanded or be the result of a failure. In the absence of an associated fault message, it is not possible to command a shutdown. However, a fault message that had not had sufficient time to be transmitted can not be excluded. Indeed, this message was received at 2 h 13 min 45 and the last message at 2 h 14 min 26, whereas the fault message could have appeared up until 2 h 14 min 45. F/CTL SEC 1 FAULT (2 h 13) ECAM alarm Aural warning Visual warning SD page Local alarm Inhibited in phase 6 F/CTL SEC 1 FAULT Single chime Master caution F/CTL “Fault” light on corresponding button no Meaning: This message indicates that FCSC1 (SEC 1) has stopped functioning. This shutdown may have been commanded or be the result of a failure. In the absence of an associated fault message, it is not possible to command a shutdown. However, a fault message that had not had sufficient time to be transmitted can not be excluded. Indeed, this message was received at 2 h 13 min 51 and the last message at 2 h 14 min 26, whereas the fault message could have appeared up until 2 h 14 min 51. MAINTENANCE STATUS ADR2 (2 h 14) This message was received at 2 h 14 min 14 and a class 2 fault message should have been received between 2 h 15 min 00 and 2 h 15 min 14. There are nine class 2 fault messages that could have been the origin of this message. Four of them are linked to a ground/flight logic. Two others are linked F-GZCP - 1st June 2009 37 to pin-programming, for the activation of options. And finally, the last three are linked to three coherence monitoring processes on the total pressure, static pressure and angle-of-attack parameters delivered by the three ADRs. In the case of ADR 2, a fault message will be generated if, from beginning to end, one of these monitoring processes has observed a deviation greater than a certain threshold between its parameter and those of ADRs 1 and 3. 1.16.2.4.2. Analysis of the fault messages FCPC2 (2CE2)/WRG:ADIRU1 BUS ADR1-2 TO FCPC2 (2 h 10) ATA: 279334 Sou rce: *EFCS1 Identifiers: *EFCS2 Class 2, HARD It is possible to explain this message by the rejection of ADR 1 by FCPC 2. It is correlated with the MAINTENANCE STATUS EFCS 1 and EFCS 2 messages. ISIS (22FN-10FC) SPEED OR MACH FUNCTION (2 h 11) ATA: 342200 Source: ISIS Identifiers: - Class 1, HARD This message is transmitted by the ISIS, and may be the consequence of:  an internal failure at the level of the CAS or Mach elaboration function,  CAS or Mach values that were outside certain limits. The airspeed measured by the ISIS is based on the pressure measurements from the probes in the standby system, which also feed ADR 3. The static pressure is not corrected (notably from Mach). The only cases of excursion outside the validity envelopes compatible with the CFR are:  a CAS higher than 530 kt without the Mach value exceeding 1. This condition implies that the aircraft was at an altitude comprised between about 4,000 and 14,000 ft;  a CAS such as the difference between the total and static pressures being lower than a given threshold. This case implies notably that the static pressure is higher than the total pressure. The “HARD” nature of the message indicates that the problem lasted longer than 2 seconds. ADIRU2 (1FP2) (2 h 11) ATA: 341234 Source: IR2 Identifiers: *EFCS1, IR1, IR3 Class 1, HARD F-GZCP - 1st June 2009 38 This message was generated by IR 2. For an ADIRU of this standard, it means that the IR considered that the three ADRs were invalid, that is to say that at least one of the three parameters was invalid (SSM status not NO) amongst pressure altitude, barometric vertical speed and true airspeed. As soon as the third ADR is rejected, the IR generates a message pointing to its ADIRU. If one of the IRs considers the three ADRs as being invalid, this must also be the case for the other IRs. It is therefore logical that, in parallel with this ADIRU 2 message generated by IR 2, an ADIRU 1 message was generated by IR 1 and an ADIRU 3 message by IR 3, which would explain the presence of the latter amongst the identifiers. The fact that EFCS1 was present amongst the identifiers preceded by an asterisk indicates that EFCS1 had at least generated one class 2 message, perhaps followed by a class 1 message. There are too few elements available to determine precisely what the presence of EFCS1 amongst the identifiers means. Nevertheless, it is possible to state that it concerns a rejection of ADR by at least two PRIMs. It has not been possible at this stage to understand why EFCS2, the clone of EFCS1, is not an identifier. FMGEC1 (1CA1) (2 h 13) ATA: 228334 Source: AFS Identifiers: - Class 1, INTERMITTENT This message cannot be the trace of a reset which, in particular, excludes the possibility of a manual shutdown. This message could be the consequence of inconsistency between the two channels in the FMGEC (COM and MON). Such an inconsistency could be the consequence of erratic input parameter values. In any event, the effects of such a message could only be the disengagement of automatic systems, whose associated cockpit effect messages had already been transmitted at 2 h 10. The “INTERMITTENT” nature of the message means that the problem lasted for less than 2.5 seconds. 1.16.2.4.3. Interruption of the messages The last ACARS message was received at 2 h 14 min 26. The traces of the communications at the level of the satellite show that the ACARS acknowledgement from the ground was effectively received by the aircraft. No trace of any attempted communication by the aircraft with the ground was then recorded, although there was still at least one message to be transmitted (see above). In absolute terms, there are several reasons that could explain why communications stopped.  no message to be transmitted: as explained above, the “MAINTENANCE STATUS ADR2” message should have been followed, one minute later, by the transmission of a class 2 fault message. The aircraft therefore had, at 2 h 15 min 14 at the latest, one message to be transmitted. F-GZCP - 1st June 2009 39  loss of one or more system(s) essential for the generation and routing of messages in the aircraft:  ATSU / SDU / antenna: none of the maintenance messages sent is related in any way whatsoever with the functioning of these systems. A malfunction of this type should have occurred after the transmission of the last message and without forewarning.  loss of electrical power supply: this would imply the simultaneous loss of the two main sources of electrical power generation.  loss of satellite communication:  loss of data during transmission: the satellite’s quality follow-up does not show any malfunction in the time slot concerned.  loss of contact between the aircraft and the satellite: • unusual attitudes: given the relative position of the satellite with respect to the aircraft and the aircraft’s tracking capability, the antenna would have to be masked by the aircraft’s fuselage or wings. Examination of the debris showed that the aircraft hit the water with a bank angle close to zero and a positive pitch angle. The aircraft would therefore have been able, in the last seconds at least, to transmit an ACARS message. • end of the flight between 2 h 14 min 26 and 2 h 15 min 14. F-GZCP - 1st June 2009 40 1.16.2.4.4. Correlation of the messages Analysis of the maintenance messages makes it possible to group the fault messages and the cockpit effect messages together as foll. Time Fault message with cockpit effect Cockpit effect messages 0210 PROBE-PITOT 1X2 / 2X3 / 1X3 (9DA) AUTO FLT AP OFF AUTO FLT REAC W/S DET FAULT F/CTL ALTN LAW FLAG ON CAPT PFD SPD LIMIT FLAG ON F/O PFD SPD LIMIT AUTO FLT A/THR OFF FLAG ON CAPT PFD FD FLAG ON F/O PFD FD F/CTL RUD TRV LIM FAULT 0210 FCPC2 (2CE2) /WRG:ADIRU1 BUS ADR1-2 TO FCPC2 MAINTENANCE STATUS EFCS 2 MAINTENANCE STATUS EFCS 1 0211 ADIRU2 (1FP2) FLAG ON CAPT PFD FPV FLAG ON F/O PFD FPV 0214 Note: this message is necessarily correlated with a fault message, but this fault message was not received MAINTENANCE STATUS ADR 2 Fault messages without cockpit effect 0211 ISIS(22FN-10FC) SPEED OR MACH FUNCTION Note: the flags on the ISIS are not captured by this CMC 0213 FMGEC1(1CA1) Note: the only cockpit effects potentially associated with this message had already been generated and could not be generated a second time Cockpit effect messages without fault 0210 NAV TCAS FAULT 0212 NAV ADR DISAGREE 0213 F/CTL PRIM 1 FAULT 0213 F/CTL SEC 1 FAULT 0214 ADVISORY CABIN VERTICAL SPEED F-GZCP - 1st June 2009 41 1.16.2.4.5 Partial conclusion on the analysis of the messages At this stage of the investigation, analysis of the messages makes it possible to highlight an inconsistency in the speeds measured just after 2 h 10 which in that minute generated ten of the twenty-four maintenance messages. Eleven other messages generated between 2 h 10 and 2 h 14 can also be linked to anemometric problems (inconsistencies in the speeds, low speeds and/or erratic speed values). The aircraft switched to alternate 2 law in the minute at 2 h 10 and remained in that law until the end of the flight.. No message present in the CFR indicates the loss of displays or of inertial information (attitudes). Note: in addition, as the ATSB mentions in its second interim report(3) on the incident to the A330-300 that was performing fl ight QF72, in relation to problems with ADIRU’s, the maintenance messages relating to the events on fl ight AF447 and fl ight QF72 show signifi cant differences, both in their sequence and in their content. (3)http://www. atsb.gov.au/ media/748444/ ao2008070_ ifr_2.pdf
F-GZCP - 1st June 2009 43 NEW PARAGRAPHS (These paragraphs complete the Interim Report of 2 July 2009) 1.6 Aircraft information 1.6.11 Functioning of the automated systems 1.6.11.1 Probe heating The probes that are installed on the aircraft are heated electrically to protect them from icing. Three independent Probe Heat Computers (PHC) control and monitor the heating of the static pressure pick-offs, Pitot probes, total air temperature (TAT) and angle of attack (AOA) sensors. One of the PHC’s manages the Captain probes, another the First Officer probes and the third the standby probes (there is no TAT standby sensor). On the ground, neither of the TAT sensors is heated and the three Pitot probes are heated only a little to prevent any potential damage. The PROBE / WINDOW HEAT push-button located on the overhead panel in the cockpit allows the crew to force the Pitot tube heating onto flight mode. 1.6.11.2 Autopilot, flight director and autothrust The autopilot, flight director and autothrust functions are ensured by two Flight Management Guidance and Envelope Computers (FMGEC), connected in particular to a Flight Control Unit (FCU). Each of these two computers can perform these three functions. The flight director (FD) displays the control orders from the FMGEC on the PFD. In normal operation, with the FDs engaged (FD push-buttons lit on the FCU), FD 1 displays the orders from FMGEC 1 on PFD 1 (left side) and FD 2 displays the orders from FMGEC 2 on PFD 2 (right side). It is possible to display only one of them at a time, although the Airbus normal procedures recommend that either both or neither of them should be displayed. Furthermore, the autopilot 1 function is ensured by FMGEC 1 and the autopilot 2 function by FMGEC 2. The autothrust function (A/THR) can be ensured by the two FMGEC’s independently, but by priority is ensured by the FMGEC associated to the engaged autopilot. The materialisation of the FD on the PFD depends on the mode selected with the HDG-V/S / TRK-FPA push-button:  in HDG-V/S mode, the FD is represented by two trend bars and represents the autopilot orders;  in TRK-FPA mode, the FPV speed vector (or “bird”) is displayed, it indicates the drift and slope. The associated flight director is the FPD (Flight Path Director) which makes it possible to indicate how to maintain the desired path. The FD orders, both in HDG-V/S mode and in TRK-FPA mode, are elaborated by the FMGECs. As for the drift and flight path angle (FPA) parameters that are used to display the FPV, they are elaborated by the IRs. F-GZCP - 1st June 2009 44 Flight Control Unit (FCU) An FMGEC uses a certain number of parameters to perform its functions, particularly inertial or anemometric, delivered by several independent sources which it consolidates by means of a monitoring mechanism. The airspeed, for example, is given by the aircraft’s three ADRs. By default, FMGEC 1 uses the parameters from ADR 1 and FMGEC 2 those from ADR 2. When one of the three speeds deviates too much from the other two, it is automatically rejected by the system without any loss of function. But if the difference between these two remaining values becomes too great, the FMGEC then rejects both of them. In such a situation, it is no longer possible to ensure most of the functions normally performed by the FMGEC. If one of the FMGECs is no longer valid, both PFDs’ FDs display the orders from the other. If the associated Autopilot is engaged, it will be disengaged automatically, generating the AUTO FLT AP OFF red ECAM message associated with the characteristic “cavalry charge” audio alarm and with the MASTER WARNING. Control of autothrust is automatically transferred to the remaining FMGEC. If both FMGECs are invalid, the two flight directors disappear and the red FD flag is displayed on the PFDs. If one autopilot is engaged, whichever one it may be, it will be disengaged automatically, generating the red ECAM message AUTO FLT AP OFF. If the autothrust is engaged, it will be disengaged automatically, generating activation of the amber ECAM message AUTO FLT A/THR OFF and activation of the THRUST LOCK function. As long as this function is engaged:  the thrust remains frozen at the value it had at the time it was activated,  an amber “THR LK” message flashes on the FMA at the level of the third line in the left column,  the amber “ENG THRUST LOCKED” ECAM message is displayed and a single chime sounds every five seconds: ECAM Alarm Aural warning Visual warning SD Page Local warning Inhibited in phase 06 ENG THRUST LOCKED Single chime every 5 sec Master caution every 5 sec - - no F-GZCP - 1st June 2009 45 Thrust must be controlled manually, either by moving the thrust control levers or by pressing the disconnect push-button located on the levers (instinctive disconnect). Disengagement of the autopilot resets monitoring of the parameters carried out in the FMGEC: as soon as the FMGEC becomes valid again, for example because the two speeds are once again consistent with each other, its functions are ensured again. Thus, if the associated FD is still engaged, the red FD flag disappears and the trend bars re-appear. If the associated autopilot and the autothrust are also made available again, a crew action on the corresponding button on the FCU is necessary to re-engage them. The FPV is elaborated in the IR part of the ADIRU which, for this purpose, uses inertial parameters and also an anemometric parameter: the barometric vertical speed. It is thus necessary for the IR to have at least one valid ADR at its disposal. From the perspective of the IR, an ADR is valid if the three parameters, altitude, barometric vertical speed and true airspeed are valid (SSM status is NO) If the three ADRs are considered invalid by the IR it is no longer possible to calculate the FPV and the red FPV flag appears on the PFD. When it is used, the autopilot elaborates the control surface position orders itself and it functions independently from the flight control law in force. These orders are transmitted to the servo-controls via the PRIMs. 1.6.11.3 Design and limit speeds A certain number of speeds are represented by specifi c symbols on the PFD’s speed scale (protection or design speeds – “green dot”, F, S, Vmax, Valpha prot, etc.). Some of these speeds are calculated by the FMGEC, others by the PRIMs which transmit them to the FMGEC for display. In the case where the three ADRs are rejected by the PRIMs, the SPD LIM flag appears at the bottom right of the speed scale. The current speed and the target speed remain on display. If at least one ADR is valid in the FMGECs, the Vmax speed may remain displayed on one side and/or the other. 1.6.11.4 Control laws The Airbus A330 has fly-by-wire flight controls. The aircraft is controlled by means of two side-sticks whose movements are transmitted in the form of electrical signals to flight control computers. This aircraft has three flight control primary computers, called FCPC or PRIM, and two flight control secondary computers, called FCSC or SEC. Their role is to calculate control orders in manual control law, and to control the various control surfaces. The laws governing this transformation are called control laws. On the A330 in nominal operation, the control law is called the normal law. In the case where monitoring is triggered in the flight control system, it may be replaced by degraded laws, known as the alternate (alternate 1 or 2) law or direct law. F-GZCP - 1st June 2009 46 Normal law offers complete protection of the flight envelope: in terms of attitude (the pitch and bank angles values are limited), load factor, at high speed and with a high angle of attack. Outside the protections, the longitudinal orders from the sidesticks command a load factor according to the aircraft’s normal axis and the lateral orders command a rate of roll. In alternate law, the longitudinal orders from the side-sticks command a load factor according to the aircraft’s normal axis, like with normal law but with fewer protections. In alternate 1, the lateral orders from the sidesticks still command a rate of roll with the same protections as with normal law. In alternate 2, they command the ailerons and lift dumpers directly. With direct law, the orders from the sidesticks control the position of the various control surfaces directly. Another law, called the abnormal attitudes law, is triggered in certain cases where the aircraft’s attitude is outside certain ranges, for example when the bank angle exceeds 125 degrees. This is an alternate 2 law with maximum lateral authority. Like the FMGECs, the PRIMs consolidate the parameters that they use by means of monitoring mechanisms. Concerning the airspeed, it is the voted value that is used. In normal operation, this is the median value. When one of the three speeds deviates too much from the other two, it is automatically rejected by the PRIMs and the polled value then becomes the average of the two remaining values. But if the difference between these two remaining values becomes too great the PRIMs reject them and the control law switches to alternate 2. Furthermore, another monitoring procedure is applied to the value of the voted airspeed and triggers switching to alternate 2 law when it falls by more than 30 kt in one second. In alternate or direct law, the angle-of-attack protections are no longer available but a stall warning is triggered when the greatest of the valid angle-of-attack values exceeds a certain threshold. In clean confi guration, this threshold depends, in particular, on the Mach value in such a way that it decreases when the Mach increases. It is the highest of the valid Mach values that is used to determine the threshold. If none of the three Mach values is valid, a Mach value close to zero is used. For example, it is of the order of 10° at Mach 0.3 and of 4° at Mach 0.8. 1.6.11.5 Presentation of information on the PFD A nominal PFD and a PFD in alternate 2 are shown hereafter. The displays presented on these PFD’s are not exact representations of those that could have been displayed of the fl ight AF 447 crew’s PFD’s. F-GZCP - 1st June 2009 47 Nominal PFD PFD in alternate 2 law F-GZCP - 1st June 2009 48 1.6.11.6 Consequences of a drop in the measured total pressure The static pressure (Ps), total pressure (Pt) and total air temperature (TAT) allow the ADR to calculate the following parameters in particular:  Standard altitude  Mach  Calibrated Air Speed (CAS)  True Air Speed (TAS) The order in which these different parameters are calculated is not immaterial because the value of the measured static pressure must be corrected to take into account the measurement error due to the air flow disturbances in the vicinity of the sensor. This correction depends in particular on the Mach and has a direct influence on the standard altitude which only depends on the static pressure. On an A330-200 in cruise flight, the measured static pressure overestimates the real static pressure. If Pt and Ps are known, it is possible to calculate a Mach value that provides access to the correction of Ps. The Ps thus corrected is then used to calculate the CAS and the altitude. When the Mach value is known, the TAT measurement makes it possible to determine the static air temperature (SAT), which in turn makes it possible to calculate the true air speed and in turn other parameters such as the wind speed. If there is a drop in the measured total pressure (obstruction of the Pitot tube), this will therefore impact the values of all those parameters. For example, for an A330-200 flying at FL 350 at Mach 0.8 in standard atmosphere with a 30 kt head wind and without any disturbance in the measurement of the TAT or variation in the ground speed, a fall in the total pressure causing a decrease in the Mach value to 0.3 would be accompanied by the following variations: Mach 0.8 0.3 Standard altitude (ft) 35,000  34,700(4) CAS (kt) 272 97 SAT (°C) -54 -31 TAS (kt) 461 182 Wind speed (kt) -30 249 (4)Due to the correction of the static pressure F-GZCP - 1st June 2009 49 1.7 Meteorological Conditions 1.7.3 Meteorological Analyses The additional analyses on the meteorological situation in the accident zone, based on the study of the observations made at 2 h 30 UTC by the Tropical Rain Measuring Mission (TRMM) satellite, are included in appendix 3. Though the TRMM lightning imager indicates an absence of lightning in the accident zone at 2 h 30 UTC, the infrared image taken at the same time is consistent with those of Meteosat 9: taken together, this information does not make it possible to conclude that there was a sudden and exceptionally intense development of the convective activity between 2 h 07 and 2 h 30 UTC. Analysis of the observations by the TRMM TMI instrument, the only one operating in the microwave area, indicates the presence of strong condensation around 10,000 metres altitude, lower than the altitude of the cumulonimbus tops. This strong condensation would correspond to convective towers active at this altitude, which confirms the strong probability of notable turbulence within the convective cluster that was crossed by planned flight path of flight AF447. F-GZCP - 1st June 2009 50 1.16 Tests and Research 1.16.3 Study of losses of or temporary anomalies in indicated speeds occurring in cruise on Airbus A330 / A340 The BEA studied thirteen events(5) losses of or temporary anomalies in indicated speeds occurring for which it had both crew reports, parameter recordings the PFR. The following operators made this data available to the BEA :  Air France (4 cases);  TAM (2 cases);  Qatar Airways (4 cases);  Northwest (1 case);  Air Caraïbes Atlantique (2 cases). Several other known events were not studied in detail as a result of the absence of adequate information. The other events recorded that could not be studied as a result of the absence of adequate information do not call into question the validity of this analysis (see paragraph 1.18.6). The BEA also interviewed some crews on these flights. The study of these events made it possible to identify several notable facts that are analyzed in this report. Note that these analyses are made within the strict context of this study and can in no way be interpreted as an indication on the orientations or the conclusions of the investigation. Analysis was, in particular, limited by the absence of recordings of some relevant parameters. For example, the three CAS and the three angle of attack measurements are not all recorded (at least one, sometimes two are). The aural stall warning and the position of the probe / window heat push button are not always recorded. This study made it possible to identify some significant points in terms of the environment, the automated systems and flight path control. As far as the environment is concerned, this study shows the following points:  The flight levels were between FL340 and FL390;  The air masses were highly unstable and were the seat of deep convection phenomena;  The static temperature was below -40 °C(6) in twelve cases(7). In ten cases, the temperature in standard atmosphere changed from 0 °C to 6 °C; in the three other cases it was above STD+10 °C;  The crews reported not observing any significant radar echoes on the chosen flight path(8) but to have identified active zones nearby or lower, which is also noted in a study by Météo France on these events undertaken at the request of the BEA;  Three crews reported having heard or observed what they identified as rain or ice; (5)These are defi ned by the temporary loss of reliable indications of one or more air speeds. (6)-40 °C is the commonly accepted value below which no more supercooled water exists and thus the risk of ice accretion on the aircraft airframe. (7)See appendix 4. (8)Some crews had deviated from the planned fl ight path for meteorological reasons before the events occurred. F-GZCP - 1st June 2009 51  All the events occurred in IMC;  The recordings of total or static temperatures(9) show increases of ten to twenty degrees during the event, which sometimes began before noticing any speed anomalies, except in a case where the increase was lower;  Turbulence was always recorded and reported. The levels felt by the crew varied form slight to strong. The recorded amplitude in recorded normal went from to . As regards the automated systems and the other systems, the following points can be noted:  The autopilot disengaged in all the cases without any intervention by the crew;  In all cases, the crew were able to use autopilot and auto-thrust again;  In twelve cases, the airplane switched to alternate law until the end of the flight. In one case, this switch was temporary(10);  The autopilot disengagement was accompanied by the disappearance of the associated flight director and sometimes of the other for a variable duration. All the cases studied show the reappearance of the flight directors during the event. In certain cases(11), this reappearance was recorded simultaneously with a return to two close speed values returning;  In seven cases, the autopilot was reconnected during the event. In two of them, the re-connection occurred when the two speeds were consistent with each other but were erroneous;  The autothrust disconnected in ten cases, leading to the activation of the Thrust Lock function. In five of them, this function remained connected for over one minute;  In one case, the crew had disconnected the autothrust and displayed the thrust corresponding to the speed recommended in turbulent atmosphere before the event;  In two cases, the autothrust did not disconnect and the flight directors did not disappear. The recording of the engine RPM parameters shows fluctuations in thrust with N1 values of between 48% and 100% ;  The speed anomalies can be characterised by two distinct signatures:  Intermittent falls (peaks);  Fall followed by levelling off (continuous period). They were accompanied by an instant increase in displayed static temperature (and total when it was recorded), and with a “drop“ in altitude indicated on the airplanes equipped with altimetric correction (A330-200). In both cases, the lower speed limits recorded were below 100 knots;  The maximum continuous duration of invalid recorded speeds was three minutes and twenty seconds; (9)The total temperature is not always recorded. (10)See the analysis of the « Pitot probe » message § 1.16.2.4 in the Interim Report n°1. (11)Case observable only on airplanes equipped with ISIS for which both CAS values are recorded. F-GZCP - 1st June 2009 52  When the values of the speeds calculated by the ISIS system were recorded, their anomalies possessed signatures and/or durations that differed from those observed on the speed displayed on the Captain’s side display. With regard to crew reactions, the following points are notable:  The variations in altitude stayed within a range of more or less one thousand feet. Five cases of a voluntary descent were observed, of which one was of 3,500 feet. These descents followed a stall warning;  Four crews did not identify an unreliable airspeed(12) situation: in two cases, the crew concluded that there was an inconsistency between the AOA sensors; in the two other cases, the crew considered that the speeds were erroneous and not and doubtful. For the cases studied, the recording of the flight parameters and the crew testimony do not suggest application of the memory items(13) in the unreliable airspeed procedure:  The reappearance of the flight directors suggests that there were no disconnection actions on the FCU;  The duration of the engagement of the Thrust Lock function indicates that there was no rapid autothrust disconnection actions then manual adjustment on the thrust to the recommended thrust;  There was no search for display of an attitude of 5°. Significant points following the analysis of these 13 events of losses or indicated speed anomalies In the cases studied, it is notable that:  the airplane remained within its flight envelope during these relatively short events;  the FD remained connected;  the auto-thrust had been disconnected before the anomalies in one case. In the other cases, either the autothrust remained connected, or the thrust lock function remained active several dozen seconds before the manual adjustment on the thrust. Crew Reactions This type of anomaly most of the time leads the AP to disengage, the FD to disappear, the autothrust to pass to thrust lock and the airplane to switch flight controls to alternate law. The pilot flying gives priority to piloting the airplane and to the airplane flight path, by maintaining a cruise attitude or by performing a descent to increase the margins for evolution within the flight envelope. The descent can also be decided following the triggering of the stall warning. (12)This is the name of the Airbus procedure. Air France uses the term “IAS douteuse“. (13)Air France uses the term “manoeuvre d’urgence“. F-GZCP - 1st June 2009 53 The reappearance of the flight directors on the PFD when two air speeds will be calculated that can lead the crew to rapidly engage the autopilot. However, these speeds, though of the same order, can be erroneous and weak and thus lead the autopilot to command movements of the flight control surfaces that are inappropriate for the real speed of the airplane. In case of automatic disconnection of the autothrust with activation of the thrust lock function, the absence of appropriate manual adjustment of thrust can present a risk of an attitude/thrust mismatch, especially when this disconnection occurs with a low N1 value. Stall warning Nine cases of triggering of the stall warning were observed. Note : the manufacturer’s additional abnormal STALL warning procedure is included in appendix 5. The stall warning triggers when the angle of attack passes a variable threshold value. All of these warnings are explicable by the fact that the airplane is in alternate law at cruise mach and in turbulent zones. Only one case of triggering was caused by clear inputs on the controls. Note: At high altitude, the stall warning triggers in alternate law on approach to the stall. The stall manifests itself particularly through vibrations. 1.17 Information on Organisations and Management 1.17.2.4 Operator training for the Unreliable IAS / ADR check emergency / backup procedure The OPS 1 requires that operators train their crews in annual training courses. This training, made up of briefings and simulator exercises includes regulatory exercises and additional exercises at the choice of the airline. In this context Air France had introduced into its 2008/2009 training programme, a briefing on anomalies in airspeed indications for all phases of flight accompanied by practical exercises on a simulator, on climb shortly after take-off. Note: In the Flight Crew Training Manual (FCTM) dated January 2005, the manufacturer describes the condition in which speed anomalies occur and the QRH unreliable airspeed/ ADR check procedure to apply when crews are confronted with this. The Air France training module on A330 for the instruction season running from 1st April 2008 to 31 March 2009 includes a UAS exercise. Extracts from the A330/A340 Periodic Training/Examination briefings handbook are given in appendix 6. This handbook serves as a supplement to the analytical instruction programme that describes the sequence of exercises and checks. It is issued to the trainee pilots to help them in their preparatory work. The Operating Manual remains the only regulatory reference work. F-GZCP - 1st June 2009 54 Note: The introduction to the UAS topic(14) in this briefi ngs booklet mentions losses of control on conventional aircraft further to the non-detection of incorrect speed indications by the crew. It then says that on A330, saving exceptional special circumstances, a failure or incorrect information will be presented by the ECAM ,and the FMGEC computers will reject the ADRs delivering the incorrect speeds/altitudes. In the exceptional case where the incorrect speeds are not rejected, the flight control and guidance computers use the two incorrect ADRs for their calculations. In this case the crew will have to:  Trigger the emergency manoeuvre(15) if they consider control of the flight is dangerously affected (initial climb, go-around, etc.);  Trigger the Flight QRH procedure with UAS / ADR check if the trajectory has been stabilised and flight is under control. This briefings booklet also provides a list of points that can help or affect the accomplishment of the emergency manoeuvre and indicates the following in particular:  The factors identified as aids are: ground speeds, GPS altitude, radioaltimetric height and STALL warning;  The following factors, however, could be sources of confusion and cause stress: unreliability of the FPV and of the vertical speed if the altitude indications are affected, incorrect primary information without any associated message on the ECAM, presence of alarms (false or real, overspeed for example);  The key points presented for the correct management of the situation are: detection of the problems, interpretation of the alarms and coordination in processing. The scenario used in the simulator led the crew-members to perform the emergency manoeuvre items in a context where the aircraft remained in the normal law and no alarms were triggered. In view of the information provided by the operator, the pilots of F-GZCP had taken this training session on the following dates:  Captain: 330 training on 12 March 2008(16)  First Officer 1: 330 training on 6 December 2008  First Officer 2: 330 training on 2 February 2009 It has not been possible to identify any other UAS training on A330 or A340 simulators that may have been taken by the flight crew. Note: The research carried out on the pilots’ training made it possible to identify an exercise called “fl ight with unreliable IAS”, done by the Captain at the time of his A320 type rating course at Air Inter. (14)The topics cover the exercises done during the ECP simulator sessions. (15)Performing the emergency manoeuvre: Basic control: AP, ATHR and FD off Attitude / Thrust match consistent with the fl ight phase Maintain the fl ap confi guration Retract the speed brakes and landing gear. (16)At this time, the 2008-2009 programme was applicable in agreement with the authority. F-GZCP - 1st June 2009 55  1.17.6 Type certification and Continuing Airworthiness 1.17.6.1 European regulations The basic rules(17) establish the regulations relative to certification (airworthiness, environmental, design and production organisations) and to maintaining the airworthiness of aircraft and aeronautical products, parts and appliances, according to the following structure: 1.17.6.2 Part 21 Part 21 (annex to regulation 1702/2003) establishes the requirements relative to the certification of aircraft and aircraft products, parts and appliances, and of the design and production organisations. It also establishes the procedures for issuing airworthiness certificates. 1.17.6.3 Notions of type certificate and airworthiness certificate The certification principles require that a product (type of aircraft for example) must first of all be certified. When the product has successfully completed the certification process, a “type certificate” is issued by the authority to the company that designed the product. This certificate states that the generic product meets the applicable technical conditions in every aspect. An individual airworthiness certificate is then issued for each product (aircraft for example) after it has been demonstrated that it conforms to the certified type. Among other things the holder of a type certificate is obliged to ensure the continuing airworthiness of its fleet. (17)EC No 216/2008 F-GZCP - 1st June 2009 56 At the time of the issuance of the first type certificate for the A330, the DGAC was the authority responsible for issuing certificates to Airbus. The certification principles, based on the JAR 21 regulations developed by the Joint Aviation Authorities (JAA) were similar to those defined today in part 21. In particular, in accordance with JAR 21, the decree dated 18 June 1991 put in place a design approval procedure for the manufacturers of aeronautical products and determined the conditions that must be met by approved manufacturers. This approval – called DOA (Design Organization Approval) – obliges the manufacturer to give details of the working procedures that it will put in place to meet the requirements of JAR 21 or of part 21, in particular in relation to continuing airworthiness. 1.17.6.4 Continuing airworthiness Continuing airworthiness rests in particular on the evaluation of the criticality of occurrences, classified during type certification according to four levels (in accordance with AMJ 25.1309): minor, major, critical and catastrophic. The certification regulations associate an acceptable probability to each of these levels. Continuing airworthiness is in fact ensured both by the manufacturer and the certification authority according to the division of tasks and principles established in section A of Part 21: 1.17.6.4.1 Obligations of the manufacturer, holder of a type certificate Article 21 A.3 of Part 21 stipulates that: 1) the holder of a type certificate must have a system in place for collecting, examining and analysing the reports and information relative to failures, malfunctions, faults or any other events that has or could have harmful effects relative to maintaining the airworthiness of the product covered by the type certificate. 2) the holder of a type certificate must report to EASA all failures, malfunctions, defects or any other occurrences that it is aware of and that has led to or could lead to conditions that might compromise safety (unsafe conditions). These reports must reach EASA within 72 hours following identification of the unsafe condition. The following definition of “unsafe condition” is proposed in AMC 21 A 3b (b): (a) An event may occur that would result in fatalities, usually with the loss of the aircraft, or reduce the capability of the aircraft or the ability of the crew to cope with adverse operating conditions to the extent that there would be:  A large reduction in safety margins or functional capabilities, or  Physical distress or excessive workload such that the flight crew cannot be relied upon to perform their tasks accurately or completely, or  Serious or fatal injury to one or more occupants F-GZCP - 1st June 2009 57 unless it is shown that the probability of such an event is within the limit defined by the applicable airworthiness requirements, or (b) There is an unacceptable risk of serious or fatal injury to persons other than occupants, or (c) Design features intended to minimise the effects of survivable accidents are not performing their intended function. The document states that certain occurrences of a repetitive nature may be considered to be “unsafe conditions” if they are likely to lead to the consequences described above in certain operational conditions. Note: Guidance material to 21 A 3b (b) provides a methodology and some examples to determine if an unsafe condition exists. 3) for any deficiency that may reveal a dangerous or catastrophic situation, the manufacturer must look for the cause of the deficiency, report the results of its investigations to EASA and inform it of any action that it undertakes or proposes to undertake to remedy this deficiency. 1.17.6.4.2 Role of EASA When EASA considers that an “unsafe condition” has existed or exists and could occur on another aircraft, it can issue an Airworthiness Directive. An Airworthiness Directive is a document that imposes actions that must be taken on aircraft of the same type presenting certain common technical characteristics to restore them to an acceptable level of safety. It is drawn up jointly with the manufacturer. 1.17.6.4.3 Provisions put in place between Airbus and EASA In September 2003, the responsibilities for continuing airworthiness were transferred from DGAC to EASA. The regulatory provisions described above are detailed in documents internal to EASA and Airbus. The procedures that apply to Airbus are described in an internal document covering continuing airworthiness and approved by EASA. This document was the subject of exchanges between DGAC and Airbus in 2002-2003 and was then implemented after the transfer of continuing airworthiness to EASA. The procedures that apply to EASA are described in an internal document called “Continuing Airworthiness of Type Design Procedure”, referenced C.P006-01. F-GZCP - 1st June 2009 58 1.17.6.4.4 Working methods 1.17.6.4.4.1 Initial processing of events Airbus receives from airline operators the events that have occurred in service. An initial sort is performed to determine whether these events effectively correspond to the criteria for notification by operators to manufacturers, as laid down in the EASA AMC 20-8 document. These criteria are adapted to the Airbus fleet and validated by EASA. Events relating to airworthiness, called “occurrences”, are notified to the manufacturer’s continuing airworthiness unit. 1.17.6.4.4.2 Analysis of the occurrences These occurrences are then analysed in detail each week by a panel of Airbus specialists. One of the tasks of this review consists of undertaking, for each occurrence, a preliminary evaluation of the impact on airworthiness according to the following classification:  Occurrence with no consequences for airworthiness. These occurrences are closed quickly;  Occurrence that can lead to an unsafe condition. These occurrences are subject to processing and closure with EASA (see following paragraph);  The other occurrences are subject to in-depth analysis and must normally be covered by a risk assessment that allows either for the closure of the occurrence or proposes a plan of action for closure within a period of three months. After each weekly meeting the list of occurrences that can lead to an unsafe condition is sent to EASA. In accordance with the provisions put in place between EASA and Airbus, Airbus is authorised to close the other occurrences internally after analysis, identification of the problems and implementation of the corrective measures. These are issued by Airbus to operators in the form of simple information, reminders relative to procedures, operating or technical methods; or actions, modifications or inspections to be carried out. 1.17.6.4.4.3 Processing of occurrences that may lead to an “unsafe condition” General principle These occurrences are processed by Airbus and then presented to EASA at the time of ARMs meetings (Airworthiness Review Meeting) or at the time of specific meetings or phone conferences for urgent matters. If action is required to remedy an “unsafe condition”, EASA may at any moment decide to issue an Airworthiness Directive in coordination with the manufacturer. F-GZCP - 1st June 2009 59 Initial processing by Airbus The follow up of each open occurrence is presented by Airbus to EASA. This follow up includes the history of the occurrence, the safety analysis performed, planned corrective actions and the position of Airbus and EASA, in particular in relation the need to issue an Airworthiness Directive. This document is filled in regularly until closure of the occurrence. Processing at the ARM meeting Each occurrence is presented during these meetings which bring together the Airbus and EASA specialists in the area of airworthiness and safety. This meeting allows:  Airbus to present for each event the conclusions of its analysis and a corrective actions plan;  EASA to examine the work presented by Airbus and, if necessary, strengthen the proposed action plan;  Airbus and EASA to reach agreement on the conclusions, the level of impact with respect to airworthiness and the corrective action plan to be implemented. Where applicable, EASA may decide to issue an Airworthiness Directive. Note: Certain occurrences are presented to the ARM meeting that are not classifi ed as likely to lead to “unsafe conditions” but for which, due to their recurrent or specifi c nature, it has been decided to put in place special monitoring. 1.17.6.5 Monitoring of Airbus, the manufacturer, by EASA EASA organises the oversight of Airbus’ design agreement in such a way as to cover all of its areas of activity over a three-year cycle. The last audit relating to occurrences was carried out in November 2007. EASA concluded that the overall organisation was satisfactory. 1.17.6.6 Special case of inconsistencies in measured speeds The cases of inconsistencies in measured speeds are classified as major in the safety analysis that describes the associated failure conditions. At the time of the transfer of the continuing airworthiness dossiers relating to the A330 from the DGAC to EASA in 2003, EASA was informed of a case of temporary speed inconsistency in crews whose analysis was still underway at the DGAC. EASA was then not made aware of any other cases until 17 September 2008 for long-range airplanes (A330 and A340), at which date the DGAC forwarded to EASA a letter from the Director of the Air Caraïbes airline concerning two events where there was loss of speed indications on two of the airline’s A330s. The latter, in particular, said that he had taken the decision to replace the C16195AA Pitot probes with the C16195BA standard on its entire A330 fleet in accordance with SB A330-34-3206, and asked DGAC for its position regarding this type of incident. F-GZCP - 1st June 2009 60 DGAC forwarded this letter to EASA on 17 September 2008 asking it whether it was planning on making Service Bulletin SB A330-34-3206 mandatory by issuing an Airworthiness Directive. On 16 October 2008, EASA asked Airbus to give a review of the situation concerning this problem at the ARM meeting to be held on 10 and 11 December 2008. EASA answered by letter dated 18 November 2008 that an assessment of the risk associated with the speed inconsistency problems was currently being examined with Airbus and that it would inform DGAC of its conclusions. At the time of the December 2008 ARM meeting, the “Pitot icing” theme was on the agenda. Airbus presented 17 cases of temporary Pitot blocking that had occurred on the long-range fleet between 2003 and 2008, including 9 in 2008 without being able to explain this sudden increase. At the time of this meeting, Airbus indicated that recent events had not provided any new information and that the fleet’s airworthiness was not affected. The manufacturer maintained its position and proposed that EASA keep the SB A330-34-3206 (Rev. n°01). This SB no longer mentioned the improvement provided by the C16195BA probes in icing conditions. It was decided to review the situation again at the next ARM meeting. The situation was reviewed again at the ARM meeting held on 11 and 12 March 2009. No new cases of fl uctuation or loss of speed were reported. As a follow up action EASA asked Airbus to make an annual review of problems of this type. The Service Bulletin BS A330-34-3206 (Rev. n°01) was maintained as a recommendation. On 30 March 2009, EASA wrote to DGAC saying that a detailed review of the events for which icing of the Pitot probes was suspected had been carried out with Airbus, and according to this analysis:  the events reported in 2008 did not modify EASA’s position and these events’ classification remained “major”;  the increase in the number of these events recorded in 2008 could not be explained at that stage and Airbus had been asked to draw up an annual report to determine a trend. In this letter EASA concluded that at this stage the situation did not mean that a change of Pitot probes on the A 330/340 fleet had to be made mandatory. 1.18 Additional Information 1.18.5 System certification 1. 18.5.1 Regulatory aspects The A330 meets the requirements of the regulations in force – that is to say JAR 25 changes 13 or 14 and the special conditions imposed by DGAC – at the time the type certification application was made. The systems were developed in compliance with the regulatory requirements defined in JAR 25 part F and, in particular, paragraphs JAR 25.1301, 1309, 1323 (d) (e),1326, 1419 and in the corresponding ACJs (acceptable but not mandatory means of compliance). F-GZCP - 1st June 2009 61 These requirements indicate in particular how this equipment must be designed, installed and tested to verify it can ensure its function in all foreseeable operational conditions. Among other things, they state that:  the systems must be developed in such a way that failures that would prevent the flight from being pursued in complete safety are extremely unlikely. Compliance with this requirement must be demonstrated by means of analysis, and flight and ground tests, taking into account the possible failure modes, their probability as well as their consequences on the aircraft and its occupants;  the systems and associated warnings must be developed while minimising the risks of crew error;  means of information must be put in place in order to alert the crew of the occurrence of a failure and allow them to take the appropriate measures. It is necessary to perform an analysis of the criticality of the failures and to associate it to a probability of occurrence (ACJ 25.1309). For the Pitot probes, the regulations also require that:  they must be protected against humidity, dirt and other substances that could alter their function (JAR 25.1323 (d));  they must be fitted with a heating system designed to prevent any malfunctioning due to icing (JAR 25.1323 (e));  appropriate means must be provided (visual warning directly visible to the crew) to inform the crew of any non-functioning of the heating system (JAR 25 1326);  they should be protected against the icing defined in appendix C of JAR 25 (see JAR 25 1419). Appendix C of JAR 25 Appendix C of JAR 25 is the certification standard in super-cooled water icing conditions for validating the anti-icing protection systems on aircraft. The conditions are defined according to the altitude and temperature in terms of water concentration and of the droplets’ mean volume diameters. Two icing envelopes are defined:  the “continuous maximum” envelope corresponding to an average cloud 17.4 nautical miles long, with low water concentrations, rising up to 22,000 feet and with a temperature as low as - 30°C;  the “intermittent maximum” envelope corresponding to an average cloud 2.6 nautical miles long, with high water concentrations, rising up to 30,000 and with a temperature as low as - 40 °C. F-GZCP - 1st June 2009 62 1.18.5.2. Pitot probe certification process 1.18.5.2.1 General Based on these regulatory requirements, the aircraft manufacturer draws up equipment technical specifications for the equipment manufacturers for each piece of aircraft equipment. For the Pitot probes, these specifications include the physical (shape, weight, resistance to shocks, etc.) and electrical characteristics, the degree of reliability sought along with the environmental conditions (behaviour in icing atmospheres, for example). The development of the probe by the equipment manufacturer consists of several phases:  definition/design of the equipment;  development of a prototype;  tests in the laboratory and tests intended to qualify the product with respect to the required specifications;  Failure Modes, Effects and Criticality Analysis (FMECA). FMECA is an inductive approach – as exhaustive as possible – that consists of identifying the potential failure modes, their causes, effects and probability at the level of a system or of one of its subassemblies. The manufacturer systematically performs tests in the laboratory and in flight to verify that the Pitot probe behaves correctly in as real as possible an environment. The purpose of these tests is to check the interfaces (electrical, mechanical, aerodynamic) between the Pitot probe and the other aircraft systems. The certification authority is associated with all these tasks. All these operations and the documents drawn up at the time of each development phase make up the certification dossier which is sent to the certification authority. Note: The privileges associated to the manufacturer’s design agreement allow the authority to rely on the manufacturer’s internal processes for checking the justifi cations produced and thus not receive and examine the whole of the certifi cation dossier. One of the elements making up this certification dossier is a summary document: Declaration of Design and Performance (or DDP). This document certifies that the equipment meets the requirements of the certification regulations as well as of the specifications requested by the manufacturer and identifies the main substantiating documents. When they have been manufactured, and before being put on the market, each probe produced is submitted to an in-depth quality inspection (physical appearance, inspection of the finish, resistance and performance tests, etc.). F-GZCP - 1st June 2009 63 1.18.5.2.2 Anti-icing certification of the probes In order to cover all the super-cooled water icing conditions specified in appendix C of JAR 25, Airbus has developed a ten-point test table with different static air temperatures (SAT), speeds, total air temperatures (TAT), water concentrations per cubic metre of air, mean diameters of the water droplets, exposure time, Pitot heating electrical power supply and the probe’s local angles of attack in order to cover the aircraft’s flight envelope under the following conditions:  All the tests are performed with reduced de-icing power (106 VAC instead of 115 VAC);  The water concentration values are multiplied by an installation factor (1.5 or 1.7 or 2 according to the speed chosen for the test) with respect to the values in appendix C of JAR 25 in order to take into account the effect of the probe’s installation on the aircraft (boundary layer effect). Airbus then applies an additional factor of 2 (design margin coefficient). In addition to these points, whose aim is to meet the minimum regulatory requirements, Airbus specifies test points aiming to cover additional criteria defined by:  STPA specifications CIN3 n°42067 developed by Direction Générale de l’Armement (DGA);  a set of specifications developed by Airbus from 1995 onwards and designed to improve the behaviour of the Pitot probes in icing conditions including, in particular, ice crystals, mixed conditions (ice crystals plus super-cooled water) and rain conditions. The diameter of the ice crystals is set at hypothetical 1mm. These specifications include 10 tests in which the static air temperature (SAT), speed, water or ice crystal concentration per cubic metre of water, mean diameter of the water droplets, exposure time, the probe’s local angle of attack are varied. The set of icing tests to be performed to meet the Airbus specification includes 26 test points in all (10 for covering appendix C and 16 additional tests), thus covering a wider envelope than that defined by the JAR25 regulations. The Airbus specifications used for the certification of the probes are therefore stricter than those of JAR 25 (annex 4). 1.18.5.2.3 Pitot probe conformity Wind tunnel tests are performed by the equipment manufacturers (in this case Thales and Goodrich) to demonstrate the conformity of the probes with the specifications developed by Airbus. There are many wind tunnels around the world in which this type of test can be performed. Each wind tunnel nevertheless has its limits and its own utilisation envelope in terms of speed, minimum temperature possible and water or ice crystal concentration. It may therefore not always be possible to F-GZCP - 1st June 2009 64 perform some of the requested tests. Equivalence laws are then used to define similar conditions by varying the parameters in such a way that the amount of water or of ice crystals received by the probe is identical to what is stipulated for the test. For example: a test must be performed at the speed of 190m/s with a water concentration of 6.3 g/m3. The wind tunnel is limited to a speed of 161 m/s. In this case the water concentration will be increased to 7.55g/m3 (190/161) x 6.3 = 7.55 g/m3) and the temperature of the test will be increased in order to maintain a total temperature identical to the level of the probe. This similarity method is used internationally and is accepted by the certification authorities. It is important to note that there are no wind tunnels capable of reproducing all the conditions that the crew may be confronted with in reality. Furthermore, some scientific studies to characterise the exact composition of the cloud masses above 30,000 feet. They show in particular that not all the phenomena are known with sufficient precision. This is particularly true concerning the nature of ice crystals (size and density) as well as the dividing level of super-cooled water and ice crystals. The Goodrich 0851HL, Thales C16195AA and Thales C16195BA probes were certified on Airbus A330 respectively in November 1996, April 1998 and April 2007 and meet all the requirements listed in § 1.18.5.2.2. 1.18.6 Earlier events associated with incorrect air speed indications This section aims to qualify the number of events that meet the following criteria:  Those that occurred to A330 and A340 airplanes;  Those that occurred above FL 300 or in conditions described by the crew as “icing”;  Those for which the crew testimony or the analysis of recorded data shows erroneous air speed indications. The list presented below cannot be considered to be exhaustive or definitive. It should be noted that this approach is subject to numerous uncertainties, such as:  the difficulty of identification and interpretation by crews of events that are sometimes transitory or associated with additional phenomena such as turbulence;  the existence and effectiveness of the feedback process within and between organisations, from the crews to the manufacturer and the national and international authorities involved;  the existence of programmes for flight data analysis and if applicable the rate of flights really analysed (taking into account loss of possible data);  configuration of flight data analysis software;  archiving time limits for flight data. F-GZCP - 1st June 2009 65 As of 3 November 2009, Airbus had identified thirty-two events that had occurred between 12 November 2003 and 1st June 2009(18). According to Airbus these events are attributable to the possible destruction of at least two Pitot probes by ice. Eleven of these events occurred in 2008 and ten during the first five months of 2009. Twenty-six of these incidents occurred on aircraft fitted with Thales C16195AA probes, two on aircraft with Thales C16195BA probes and one on an airplane equipped with Goodrich 0851HL probes. As of 1st June 2009 Air France had identified nine events that might meet the above-mentioned criteria. After the F-GZCP accident the airline started a targeted analysis of recorded parameters and identified six additional events that occurred in 2008. In addition, a foreign operator began a targeted analysis of recorded flight parameters recorded after June 2006 on its A330 fleet. As of 18 November 2009 it had identified fourteen events. Only four of them had been detected and reported by the crews to their airline. Further, Airbus identified four events that have occurred since 1st June 2009. BEA is continuing to collect information relative to the management of these events by the various organisations, that is to say the manufacturer, the airlines and the authorities concerned. All of the events attributable, according to Airbus, to a possible obstruction of at least two Pitot probes by ice, whether previous to or after the accident, are presented in appendix 7. 1.18.7 History of the Pitot probes on Airbus A330 and management at Air France The Airbus A330s were initially equipped with Goodrich 0851GR probes. In August 2001, further to fluctuations and/or losses of speed indication on A330 reported by certain airlines, the French DGAC published Airworthiness Directive 2001-354 (B) which imposed the replacement on A330 of the Goodrich 0851GR probes either with Goodrich type 0851HL or by Thales type C16195AA probes before 31 December 2003. According to the analysis carried out at the time, the most likely cause of the problem was the presence of ice crystals and/or water in the Goodrich 0851GR type Pitot probes within the upper limits of the original specifications. In accordance with this Airworthiness Directive, the Thales C16195AA model was installed on the Air France A340 fleet. As from December 2001, Air France received its first A330 originally equipped with Thales C16195AA probes. In September 2007, following measured speed inconsistencies being observed at the time of heavy precipitations or icing conditions on A320 and some cases on A330/340, Airbus published Service Bulletin SB A330-34-3206 (Rev. n°00) which recommended the replacement of C16195AA Pitot probes with the C16195BA standard. The Service Bulletin indicated that this model performed better in the case of water ingestion and of icing in severe conditions. (18)Of these 32 events, twelve were reported to Airbus after 1st June 2009. F-GZCP - 1st June 2009 66 Note: the C16195BA probe was initially developed in 2005 to answer problems relating to water ingestion observed on the A320 family during strong precipitation at low altitude. In the absence of problems of this type with its long-range fleet, Air France chose to replace the C16195AA Pitot probes with C16195BA Pitot probes only in the case of a failure. The first event with a temporary loss of speed indication at high altitude occurred in May 2008 and was followed by several others: one in July 2008, three in August 2008, one in September 2008 and then another one in October 2008, all on A340. Air France reported these events to Airbus as early as July 2008, in accordance with SIL 34-084 published by Airbus “incorrect speed indications - maintenance actions on the Pitot probes”. On 24 September 2008, Air France contacted Airbus about the cause of these events and the solutions to be applied, and asked whether the Thales probe C16195BA would be able to remedy these problems. Airbus answered that the origin of the problem was probably a blockage of the probes due to a rapid accumulation of ice crystals and that the Thales C16195BA probe, developed to cope with problems of water ingestion at the time of heavy precipitations, was not likely to improve the performance in the presence of ice crystals. Airbus stated that there was no solution for totally eliminating the risk of probe icing, that the three types of probe installed on Airbus satisfy much stricter criteria than those of the regulatory certification requirements in the area of icing and recalled the procedure to be applied in the case of incorrect speed indications. From October 2008, Air France alerted Thales to the worsening problem of icing at high altitude. Thales opened an internal technical analysis procedure on these incidents. On 12 November 2008, SB A330-34-3206 was revised by Airbus (Rev.n°01). This Bulletin mentions the improvement that can be provided by the Thales C16195BA probe in relation to water ingestion and no longer mentions the improvement that the Thales C16195BA probe can provide in icing conditions. On 24 November 2008, the problem of speed inconsistencies was raised at the time of a meeting between the Air France Technical Directorates and Airbus. Airbus confirmed its analysis. In February 2009, Thales carried out a comparative study of the behaviour of the two C16195AA and C16195BA standards in icing conditions that were more extreme than required by the specifications. This study concluded that, in the icing conditions tested, the C16195BA standard performed better while saying, nevertheless, that for technical reasons it was not possible to reproduce in the wind tunnel all the conditions that may be encountered in reality. At the end of March 2009, there were two new events with a temporary loss of speed indications at Air France, including the first event on A330. F-GZCP - 1st June 2009 67 On 15 April 2009, Airbus informed Air France of the results of the study carried out by Thales. Airbus pointed out that icing with ice crystals was a new phenomenon that had not been taken into account in the development of the Thales C16195BA probe, but that this model seemed to provide a significant improvement regarding the incorrect speed indications at high altitude. Airbus proposed an “in-service assessment” of the C16195BA standard to Air France, in order to verify the behaviour of the probe in a real situation. Air France decided to immediately extend this measure to all of its long-range A330/ A340 fleet and to replace all of the speed probes. An internal technical document to launch the modification was issued on 27 April 2009. The start of airplane modifications was planned to take place on reception of the parts. The first batch of C16195BA Pitot probes arrived at Air France on 26 May 2009, that is to say six days before the F-GZCP accident. At the time of the accident, F-GZCP was equipped with C16195AA probes.
F-GZCP - 1st June 2009 69 FINDINGS (New findings established since the Interim Report on 2 July 2009 appear in italics)  The crew possessed the licenses and ratings required to undertake the flight.  The airplane possessed a valid Certificate of Airworthiness, and had been maintained in accordance with the regulations.  The airplane had taken off from Rio de Janeiro without any known technical problems, except on one of the three radio management panels.  No problems were indicated by the crew to Air France or during contacts with the Brazilian controllers.  No distress messages were received by the control centres or by other airplanes.  There were no satellite telephone communications between the airplane and the ground.  The last radio exchange between the crew and Brazilian ATC occurred at 1 h 35 min 15. The airplane was arriving at the edge of radar range of the Brazilian control centres.  At 2 h 01, the crew tried, without success for the third time, to connect to the Dakar ATC ADS-C system.  Up to the last automatic position point, received at 2 h 10 min 34, the flight had followed the route indicated in the flight plan.  The meteorological situation was typical of that encountered in the month of June in the inter-tropical convergence zone.  There were powerful cumulonimbus clusters on the route of AF447. Some of them could have been the centre of some notable turbulence.  An additional meteorological analysis shows the presence of strong condensation towards AF447’s flight level probably associated with convection phenomena.  The precise composition of the cloud masses above 30,000 feet is little known, in particular with regard to the super-cooled water/ice crystal diving, especially with regard to the size of the latter.  Several airplanes that were flying before and after AF 447, at about the same altitude, altered their routes in order to avoid cloud masses.  Twenty-four automatic maintenance messages were received between 2 h 10 and 2 h 15 via the ACARS system. These messages show an inconsistency in the measured speeds as well as the associated consequences.  Before 2 h 10, no maintenance messages had been received from AF 447, with the exception of two messages relating to the confi guration of the toilets. F-GZCP - 1st June 2009 70  Twenty-one messages present on the CFR are caused or can be caused by anemometric problems;  None of the messages present in the CFR indicate loss of displays or inertial information (attitudes);  The operator’s and the manufacturer’s procedures mention actions to be undertaken by the crew when they have doubts as to the accuracy of the speed indications,  The last ACARS message was received towards 2 h 14 min 28,  The flight was not transferred between the Brazilian and Senegalese control centres,  Between 8 h 00 and 8 h 30, the first emergency alert messages were sent by the Madrid and Brest control centres,  The first bodies and airplane parts were found on 6 June,  The elements identified came from all over the airplane,  The oxygen masks had not been released; there had been no in-flight depressurisation,  All of the life jackets that were found were still in their containers,  The airplane’s flaps were retracted at the time of the impact with the water,  Three of the eleven cabin crew seats were found; they were not in use at the time of the impact,  Examination of all of the debris confirmed that the airplane struck the surface of the water pitch-up, with a slight bank and at a high vertical speed,  Analysis of thirteen previous events shows that:  they occurred in air masses that were highly unstable and the seat of deep convection phenomena;  autopilot disengaged in all of the cases;  the maximum continuous invalid recorded speed duration was three minutes and twenty seconds;  the uncommanded altitude variations remained within a range of more or less one thousand feet,  the airplane always remained within its flight envelope  The probes that equipped F-GZCP met requirements that were stricter than the certification standards,  On 30 March 2009, analysis of previous events had not led EASA to make mandatory a change of the probes on the Airbus A330 / A340 fleet. F-GZCP - 1st June 2009 71 4 - RECOMMENDATIONS 4.1 Flight Recorders The investigation into the accident to AF 447 confirms the importance of data from the flight recorders in order to establish the circumstances and causes of an accident and to propose safety measures that are substantiated by the facts. As in other investigations, it also brings to light the difficulties that can be encountered in localizing, recovering and reading out the recorders after an accident in the sea. These difficulties raise questions about the adequacy of the means currently in use on civil transport aircraft for the protection of flight data with the technological possibilities and the challenges that some accidents represent, in particular those that occur over the sea. In the context of this investigation, the BEA thus formed an international working group in order to examine the various techniques that can be employed to safeguard flight data and/or to facilitate localisation of the wreckage and recovery of the flight recorders. This working group dedicated itself to analyzing each field as completely as possible, from the transmission of flight data by satellite to new ULB technologies and it settled on three additional areas for significant improvements in safety: increasing the transmission time and range of the ULB beacons, the sending of data on initialisation and the installation of deployable recorders. This work was presented on 19 November 2009 to the ICAO Air Navigation Commission. On the basis of this work, le BEA recommends that EASA and ICAO: 1. extend as rapidly as possible to 90 days the regulatory transmission time for ULB’s installed on flight recorders on airplanes performing public transport flights over maritime areas; 2. make it mandatory, as rapidly as possible, for airplanes performing public transport flights over maritime areas to be equipped with an additional ULB capable of transmitting on a frequency (for example between 8.5 kHz and 9.5 kHz) and for a duration adapted to the pre-localisation of wreckage; 3. study the possibility of making it mandatory for airplanes performing public transport flights to regularly transmit basic flight parameters (for example position, altitude, speed, heading). In addition, the BEA recommends that ICAO: 4. ask the FLIRECP(19) group to establish proposals on the conditions for implementing deployable recorders of the Eurocae ED-112 type for airplanes performing public transport flights. (19)Flight Recorder Panel. F-GZCP - 1st June 2009 72 4.2 Certification Examination of reported UAS events in cruise has shown that the majority of them occurred outside of the envelope defined in Appendix C. In fact, the certification criteria are not representative of the conditions that are really encountered at high altitude, for example with regard to temperatures. In addition, it appears that some elements, such as the size of the ice crystals within cloud masses, are little known and that it is consequently difficult to evaluate the effect that they may have on some equipment, in particular the Pitot probes. In this context, the tests aimed at the validation of this equipment do not appear to be well-adapted to flights at high altitude. Consequently, the BEA recommends that EASA : 1. undertake studies to determine with appropriate precision the composition of cloud masses at high altitude, and 2. in coordination with the other regulatory authorities, based on the results obtained, modify the certification criteria. Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation civile Zone Sud - Bâtiment 153 200 rue de Paris Aéroport du Bourget 93352 Le Bourget Cedex - France T : +33 1 49 92 72 00 - F : +33 1 49 92 72 03 www.bea.aero N° ISBN : 978-2-11-098715-0

mrmmx 发表于 2010-8-14 17:25:34

啊沙发沙发

f214216709 发表于 2010-11-10 09:28:38

空难报告哦看看的

页: [1]

航空论坛_航空翻译_民航英语翻译_飞行翻译's Archiver

法航事故报告accident on 1st June 2009 Airbus A330-203 F-GZCP Air France