Airbus reviews instrument logic in aftermath of AF447

This story is sourced from Flight International
Subscribe today »

Airbus is to examine a possible change in stall-warning logic in the wake of the Air France flight AF447 accident, although the airframer does not believe it would ultimately have prevented the crash.

It is also prepared to look at whether the flight director should undergo similar changes after the inquiry found that AF447's pilot might have overly trusted the instrument as he struggled to regain control of the Airbus A330.

"If there's a way to improve safety, we won't wait for a mandate," says the airframer.

The twinjet's stall alarm was designed to cut out at 60kt (110km/h), to prevent spurious warnings, because the system logic interprets the airflow at low speeds as insufficient for a valid angle-of-attack measurement.

French investigation authority BEA stated that the "repeated activation and de-activation" of the warning, as the validity threshold was crossed, might have made the pilots' analysis of the situation "considerably more difficult".

Airbus concedes that the inquiry's recommendation to the European Aviation Safety Agency that low-speed stall-warning function logic be reviewed is "not a stupid one" - although it points out that AF447 was already far outside the flight envelope at the point at which the cut-off occurred and questions whether a continuous alarm would have made any difference.

BEA has similarly recommended the consideration of dedicated visual alarms to accompany aural warnings during approach to stall. The alarm briefly sounded after AF447 initially started climbing out of its assigned altitude, the result of a nose-up input from the pilot. BEA says the non-flying pilot might not have put this alarm into context - possibly because he was unaware of the input, the proximity of the flight-envelope limits, and the switch to alternate control law which removed angle-of-attack protections.

More mystifying was the apparent failure to react to a prolonged second stall warning, generated as the aircraft climbed towards 38,000ft (11,600m). But this stall warning had been preceded by a "C-chord" altitude alert horn, which had sounded almost continuously for 34s.

"In an aural environment that was already saturated by the C-chord warning, the possibility that the crew did not identify the stall warning cannot be ruled out," the BEA states.

It cites cognitive research suggesting that visual, rather than auditory, information is prioritised by pilots coping with high workloads. "Piloting, calling heavily on visual activity, could lead pilots to a type of auditory insensitivity to the appearance of aural warnings that are rare and in contradiction with cockpit information," the analysis says.

Although some of the flying pilot's actions appear consistent with approach-to-stall procedures, the BEA cites evidence that the pilot might have interpreted certain cues - such as buffeting and aerodynamic noise - as an indication of overspeed rather than stall.

Not only had the pilot reduced thrust shortly before the prolonged stall warning, but he also later mentioned having an "impression" of speed, and there was an attempt to extend the speedbrakes.

The BEA also states that the flight director was advising a nose-up attitude, and this might have confirmed a belief by the pilot that the stall warning was "not relevant".

This has generated a recommendation that the flight director's logic be reviewed, and that the position of its crossbars be stored by the flight-data recorder.

Disconnection of the flight director is normally part of the "unreliable airspeed" procedure. But after the A330 lost its airspeed information, and the autopilot and autothrust automatically disconnected, the crew left the flight directors engaged.

The flight director crossbars disappeared and re-appeared intermittently as the crisis unfolded, and the BEA says the "credibility" of the crossbars could have been "strengthened" by their re-appearance. "If they appear, it implies that the indications that they display are valid," it adds.

In its attempt to explain the crew's failure to recognise the A330's fatal stall, the BEA has queried whether the pilot might have been "tempted" to trust the flight directors "without validating the information presented".

"The concurrence of the information from the [flight director] with the stall warning may have undermined the credibility of the actions to take in response to the warning," it adds.

The "charged emotional" situation, combined with the workload, might have led the pilot to trust the flight director "independently of any other parameter", says the BEA, and he may have viewed the flight director crossbars as a means of maintaining cruise altitude.

Even if there is uncertainty about whether the crew followed the flight director's indications while the stall warning was active, it adds, the crossbars' orders were "in contradiction" with the appropriate inputs and "may have troubled" the pilots. The BEA is seeking a review of flight director display logic to avoid conflict if the stall warning is triggered.

Airbus points out that disconnection of the flight directors is a procedural item, a response to unreliable airspeed, but will study whether - like the autopilot and autothrust - their automatic disconnection should warrant specific crew action to re-engage them.