John cox. They’re highly automated, they’re fly-by-wire, they’re some of the leading edge technology in aviation even today. Martin alder. If the pilot were to lose control for some reason the fly-by-wire system would save the aeroplane


Download 80.22 Kb.
Date conversion23.12.2016
Size80.22 Kb.
Basically, the BBC documentary ends with a plea to recover the black boxes. Rather than a different play of the BBC script, it is recommended that a XXXXXXX documentary cast forward, to what can be done to assure the retrieval of flight recorder information. The notion of triple redundancy and common inputs needs to be discussed, what improvements can be made to pitot probes, and what happens when excess speed is applied in the “coffin corner” needs to be addressed (this last item is covered in comments to the BBC transcript – but was deftly side-stepped in their program).

More on these considerations below. First, some comments (in blue) regarding selected portions of the BBC script (line numbers in the left side boxes equate to line numbers in the BBC script):


The design philosophy - that safety is greatly enhanced by automation.
JOHN COX. They’re highly automated, they’re fly-by-wire, they’re some of the leading edge technology in aviation even today.
MARTIN ALDER. If the pilot were to lose control for some reason the fly-by-wire system would save the aeroplane.

CO-PILOT. V1, Rotate.
Automation has allowed the cockpit to be crewed by two people instead of three (the flight engineer was automated out of existence) but automation per se doesn’t necessarily make things safer – just different. There are numerous cases where automation led the crew down the garden path to catastrophe. I would argue that automation facilitates airplanes flown by pilots of lesser experience, which meets the industry desire to save money. The flight management guidance computer, a centralized bit hub of automation, is an ergonomic disaster that requires the crew to be fully engaged to avoid such things as the FMGC accepting a crew input of a 100 ton takeoff weight error. (example of is one where the potential for loss of life could easily have matched the world’s worst aviation disaster). This near catastrophic runway overrun was avoided by the narrowest possible margin.


Ordinarily, this would cause the A330 to descend.

So the computer compensates by increasing engine thrust and pitching the nose up to maintain a steady altitude.

The end result - totally automatic control.
Non-moving throttles on the Airbus mean the system can alter thrust and the pilot won’t have tactile feedback….. or pick up that input visually.
When auto-pilot is switched on, the plane literally flies itself.
MARTIN ALDER. Ninety-nine percent of the time when you’re sitting as a passenger flying at thirty-five thousand feet, the auto-pilot’s flying the aeroplane.
And when the auto-pilot reaches its limits, it will suddenly switch off and leave the surprised crew with an untenable control situation. In flight structural icing is a good example; as the airplane accumulates ice, the autopilot compensates by adding increasing the airplane’s pitch attitude. When a set limit is reached, the autopilot switches off (I’m outa here) and hands off the problem to a startled and non-plussed crew.


For another thirty five minutes, Flight 447’s computer continues to send out automatic position reports, by satellite.
TONY CABLE. The reason for the automatic position reports is so that the operator can follow the progress of the flight and know whether it’s going to be early or late, to help with its scheduling effectively.

If the airplane can send ACARS (Airborne Communications Addressing & Reporting System) messages, unbeknown to the flight crew, to the airline ops center on the status of systems, does this not suggest doing the same for flight data recorders and for cockpit voice recorders (FDR/CVR)?


He thinks Flight 447 was deceived - by a quirk of the weather.
JOHN WILLIAMS. What you can see is that there is a small storm between them and the large storm system, and that as they approached, it may have blocked their radar’s view of the larger storm system and the more hazardous storm system behind.
Adjusting the sensitivity and tilt of the weather radar should enable the crew to get a good look at what’s ahead.


All airliners measure airspeed using pitot probes.
Forward facing, hollow tubes of metal, just below the cockpit.
In case of failure, there are three probes of identical design.
A supposedly fail-safe system – because the automatic systems can’t operate without them.

Three pitots on the A330.

“Supposedly” triple redundancy, but a classic example of the faux redundancy of the system. If all three pitots read the same, and wrong, the multiple redundant computers accept the false input and make flight control/engine power adjustments accordingly. The air data computer (ADC, which inputs to the flight management computer, or FMC/FMGC) may not determine that a blockage of the pitot system is a system failure. The FMCs use data from the left ADC unless a failure has been detected, at which point the right ADC is used. But if all three ADCs are getting bum dope in equal measure from the three pitots, no failure is detected!

In the case of AF 447, it is quite possible that false pitot readings (which agreed with one another close enough to be accepted) led the system to believe the airplane was flying slower than it actually was and to increase power on the engines to fly physically faster. Because Airbus throttles wouldn’t move and the added power would be gradual and incremental; they the crew would only have had an indication of the additive power on their engine instruments – if they were very attentive and alert. But it is also common for crews flying long-range, fuel critical profiles to deselect the engine synoptic and instead display the fuel management screen.

Automation is a sucker for incredible, yet systematically systemically credulous, data inputs. Many pilots have seen mute acceptance of garbage data by Flight Management Computers that produce false take-off power and rotation speed figures, leading to take-off overruns and tailstrikes. It’s an area fraught with danger, because automation can be so gullible (and crews so trusting). For another Airbus example of triple trickery, see (“Thrice Almighty - The Virtues of Triple Redundancy “) 

When a pitot goes rogue, it is usually voted out. That’s the beauty of redundancy. But if two or more airspeed sensors fail simultaneously in a similar fashion, the system isn’t geared to detect such coincident anomalies; any incredulous input remains “balanced”, credible - and hence unquestioned. This is the sort of incongruity that leaves airplane wreckage on land and sea.


JOHN COX. We know that the air speed indication systems, all three of them, were compromised.
How? Overcome by a sudden snap-freeze of a pure supercooled water – a form of precipitation that’s allegedly found only over oceans? Or overcome by a slow accumulation of ice crystals that re are found in relatively smooth-flying CirroStratus and CirroCumulus clouds (i.e. high-level clouds that are made up solely of ice crystals)? In the tropics these clouds can be quite dense but present little in the way of turbulence. Cs and Cc clouds can be found around storm cells, projecting extensively in all directions.

It was in this type of cloud that most (if not all) of the prior incidents involving pitots supplied by Thales occurred (two pitot suppliers are approved for the A330, Thales Avionics and pitots supplied by Goodrich). The accident airplane was equipped with pitots by Thales. These were known to be prone to ice-crystal accretion blockage in high level cruise outside storm conditions.

The BBC on ground (laboratory) demonstration of supercooled water’s instant freeze (once adulterated) was very convincing. Whether this was the mechanism affecting Thales pitots begs the question of “why only to Thales pitots?” It seems to be an instantly agglutinating phenomenon that would overpower most brands and designs of pitots, whatever their heating capacities.

If a valid construct, it is possible that the Thales tubes’ heaters were more prone to being overcome; i.e. they were never designed to combat being hit by already frozen ice particles. Think in terms of calories/BTUs in and out, and one can see why the pitot heaters were finally overcome – if only by exposure time in dense Cirro-stratus. That’s the design deficiency, I’ll wager.


At high altitude, the most likely way a pitot tube could get blocked – is by ice.
Supposedly, heating elements prevent this.

A pitot tube blocked by ice. The pitot translates pressure into airspeed readings, so a blockage can result in a too low sensing of airspeed. But as stated above (#135), there are two entirely different mechanisms for blockage; one is experienced in storm conditions (the pure water theory) and the other in a non-stormy protracted cruise in a dense cirrus stratiform cloud layer.

MARTIN ALDER. The pitot tube sticking out into the airstream means that it’s vulnerable to being hit by ice and rain. It’s a small device, small things pick up ice quicker than big things, so the pitot tube is a prime candidate for picking up icing.
The rate of pitot heating (BTU’s in) is supposed to be greater than the rate of ice cooling (BTU’s or calories out). It becomes a calorific conundrum for the pitot designer.


For this reason, the pitot tubes have a powerful heating element…
….supposedly able to handle any conditions an aircraft could encounter at altitude. Its mission is to stop ingested water freezing into ice.

But long exposure to thick stratus clouds in cruise is a case of the pitot-heater’s BTU capacity versus the cooling BTUs of ice crystals continually impacting and collecting inside the pitot tube.

It’s possible that over time the cooling BTUs prevailed, because the pitot’s heating element is of limited capacity meant to stop rainwater from freezing into ice. He The difference is that CirroStratus and CirroCumulus cloud layers consist of varying densities of minute ice crystals.

Most high-level cirrus cloud at temperate latitudes is thin, not dense, and you can see the sun through it as a halo. But in the ITCZ (inter tropical convergence zone, (link) where the crash occurred), the cirrus cloud can be quite dense. At a high true airspeed, the ice collection capacity of a pitot tube can be considerable…. per unit time.

Cirrus cloud defined: a class of cloud characterized by thin white filaments or narrow bands and a composition of ice crystals, occurring in the altitude band of 20,000 to 40,000 feet. Classically, Cirrus clouds in the tropics (ITCZ area) are situate at higher (and therefore much colder) levels.


But as the accident investigation reports concede, scientific knowledge of the conditions Flight 447 flew into…
…a storm at 35 000 feet, are worryingly incomplete.
All that can be gleaned from aircraft reports and satellite coverage is that there were expanses of thick clouds en route with localized storm cells. Active cells need to be identified and avoided…. that’s the design intent of aircraft weather radar. Active cells in the tropics are normally no greater in diameter than 10-15 NM. These can become clearer on weather radar as they’re approached, and the initial avoidance heading can be refined. The 250 mile wide assertion is confusing. There may have been a 250 mile wide line of spaced but proximate cells, but that’s not unusual for the mature ITCZ. It seems to me that it might be a bit of wishful thinking by Airbus to convincingly deflect this accident into the publicly acceptable near certainty of a “weather accident”.


Did Flight 447’s pitot tubes meet a situation they were not designed to handle?
Yes, but for different reasons than the BBC program postulates. Not a rare encounter with a particular form of transmogrifying “pure water” ice; rather, the build-up in the pitot because of its overwhelmed heating capacity. The pitot will readily drain off water through its small diameter drain-hole - but will not allow an emission of “already crystalline” ice. Result? An agglomeration of loosely packed ice-crystal granules.


Minus 40 Celsius may seem extremely cold - but in fact it’s much warmer than is usual at 35 000 feet.

And, Williams thinks, just right for a highly unusual phenomenon.
JOHN WILLIAMS. What we’ve found out from this analysis is that it’s possible that there was super-cooled liquid water at the altitude of the aircraft.
The BBC program never quite admits that the extremely pure super-cooled water’s presence is “theoretical.” As said in Line 156, “The official reports agree that more research is required into super-cooled water at high altitude.”


All the failed pitot tubes met existing safety standards. But in late 2007, Airbus recommended a refit of all A330s, with uprated pitots.
Airbus recommended the Goodrich pitots. “Uprated” is not the right word. The question is why the Goodrich probes are better. A different design that won’t trap ice crystals? A bigger drain hole that’s located differently? More Increased heating capacity?


After more than 3 hours on auto-pilot, the pilots are suddenly faced by information overload.
Agree with this point.
JOHN COX. That crew faced an almost unheard of series of failures, one right behind the other, and for them to sort through it would have been very difficult that night. It was never a “simulator constructed” scenario experienced by pilots in conversion or LOFT sessions. (Line-oriented flight training)

JOHN COX. Why is the airplane doing what it’s doing, what are all these failures, why are they all coming at one time?


Bombarded by faults – the pilot must cope with the most serious problem of all.
“Bombarded by faults” is another way of saying an error cascade of failing interrelated and interdependent automated systems. Think of it under a “House of Cards” analogy.
He must maintain speed - or they will go out of control.

How? An erroneous speed sensing got him into this problem in the first place. The true speed of the airplane, as it approached Mach tuck, would NOT appear on the primary flight display (PFD). Faux redundancy at its worst. So did the automatics react to a perceived underspeed condition by powering up the engines and unwittingly exceeding the compressibility Mach number? The end result? A nose-down pitching “Mach tuck”, leading to sudden controllability problems in pitch and roll.

If this theory is correct, the four minutes of ACARS messages that flowed from the aircraft reflected a wild ride down from 35,000 feet.

One bets that Airbus, the French and U.S. regulators, and Thales, are now quietly aware that each played his part in the accident’s scene-set. I’ll bet warrant that the possible ramifications of a pitot icing event at high altitude (and what sort of confusion and control problems it could lead to in the cockpit) were never spun into a plausible accident scenario when the need for the Thales piot replacements were being factored into a cost/benefit equation. Airbus came up with a quite innocuous Service Bulletin and a fatuous homespun procedure for pilots to simply fly “power and attitude” if the speed indication is became suspect. This “solution” did not play well with the Air France pilots, as evidenced by their post-accident industrial unrest. One suspects they either knew the score (or, more likely, in the aftermath of AF447, suddenly realized their collective peril).

MARTIN ALDER. The acceleration forces caused by the turbulence means that we might stall the aircraft.
Momentary inattention while distracted by the aural and visual alarms would easily lead to an unusual attitude at night. Unusual attitudes, primarily in pitch and roll, usually happen when a roll below the pilot’s vestibular threshold occurs and he is suddenly alerted by the increasing onset of G forces. If the pilot then “snap d’s” and commands a roll in the wrong direction, the aircraft can be embedded in a rapidly accelerating spiral leading to overstress of the aircraft structure.

At FL350 (35,000 ft) the aircraft can also quickly encounter Mach tuck if the nose drops and the aircraft exceeds critical Mach.


Mach tuck: the nose of the aircraft pitches downward as the accelerated airflows around the wing itself reaches supersonic speeds. Mach tuck is the result of a transonic stall reaction due to an overspeed condition leading to unbalanced (“coupled”) shockwave formations on the upper and lower surfaces of the airfoil. This is quite different from the more common stalls resulting from boundary layer separation due to insufficient airspeed, increased angle of attack, excessive load factor, or any combination thereof.

Critical Mach number (Mcr): the lowest Mach number at which the airflow over a portion of the wing reaches the speed of sound. In an airplane not designed to fly at Mcr (all airliners), shock waves in the flow over the wing may be sufficient to stall skew the wing’s uniform lift distribution, make control surfaces ineffective, and/or lead to loss of pitch and roll control (such as aka Mach tuck.

The Airbus fly-by-wire flight control system, in either normal or degraded law, cannot prevent the aircraft’s ensuing (i.e. post Mach tuck) roll, pitch and yaw gyrations.

Note too that airline pilots, unlike their military brethren, are more susceptible to disorientation, illusions and vertigo once an aircraft suddenly enters an unusual attitude at night. It’s a very alien environment for them once an aircraft has suddenly (in the vernacular) “departed”.


If Flight 447 slows down by just a few knots, it could go into the catastrophic condition known as a stall.
Equally, the greater problem in the case of AF 447 is in the opposite sense – going too fast by just a few knots. If the airplane does this, it will hit the upper right hand limit of the aircraft’s operating envelope known as “coffin corner.” Stand by for instant Mach tuck at “coffin corner.” But in our favored scenario, the pilots cannot see that coming. The BBC program only mentions a speed-band as narrow as 20 knots at FL350 (#178) and completely steers clear of the complexities of mach tuck.

At “coffin corner” the margins for controlled flight are minimal. To the left of coffin corner you have stall buffet. To the right you have overspeed buffet.

Mach tuck could easily be misinterpreted by the pilots as a low-speed stall due to the loss of airspeed indications.

Other confusing factors are present. There seems to be some question about what could happen to the aircraft’s trim state during an insidious acceleration. One theory is that the trimmable horizontal stabilizer could be mis-positioned by the incorrect airspeed – and the autopilot’s height hold maintained by a compensating elevator deflection. Such a growing pressure might eventually cause the autopilot to kick out and the aircraft to suddenly pitch down in INTO a Mach tuck encounter.

The validity of this theory depends upon whether this postulated out-of-trim “autopilot altitude hold” condition could occur – courtesy of “fooled automation.” Whether the automation could be suckered into doing this would have to be established by Airbus simulator trials (their “iron bird” as distinct from the aircrew procedural flight simulator).

The ADIRS (Air Data Inertial Reference Unit) is geared to identify and reject systemic flaws. But it’s easily duped by protracted and skewed environmental factors that are without disagreement or asymmetry.

An ACARS message from the airplane recorded the sudden onset of critical Mach and the autopilot disconnecting due to the high aerodynamic trim loads it was holding (and no longer could). Imagine a sudden autorotative roll, the nose dropping, and the pilot wrongly assuming a stall/spin, using aileron and forward stick and adding thrust. He’s not seeing a high airspeed or Mach number on his instruments, so he could be forgiven for assuming a slow speed stall and taking the wrong action. It’s opposite to the crash at Buffalo of the Dash 8, where the aircraft stalled in approach and the pilot instinctively took go-around action by raising the nose – the opposite of the action needed if he’d recognized the upset as a stall.

Much is made in the BBC transcript of this first fatal accident involving an A330. Why wouldn’t the AF 447 tragedy have happened to the numerous earlier airplanes? Well, there are the different cloud thicknesses/densities and different exposure times. As in most accidents, the adverse factors often combine or “stack” to ultimately generate a catastrophe. Reportedly, the AF447 skipper got high early in the flight because he was tight for fuel and needed to save on consumption as much as possible. The action would have put him closer (weight-wise) to the coffin corner boundary. The happy outcomes for the earlier incidents tended to generate a false sense of security in all (un)concerned decision-makers and aircrews. As the AF447 accident once again demonstrates, “Nature will not be denied.” And if the skipper was himself in crew-rest……? What was the state of alertness on the flight-deck. That’s where the subject of long-haul crew “ennui” (or low alertness thresholds) can be debated at length.

Finally one could ask why aircraft fly up near coffin corner, if it’s potentially hazardous. Quite simply that’s where airliners (long-haul in particular) can achieve best air nautical miles per pound of fuel. The closer you squeeze into coffin corner the better the anmpp figures you get. It’s a balancing act. But it’s also where pilots suddenly forced to fly manually in degraded flight control laws are subject to a razor’s edge in terms of controllability and an engine’s proclivity for compressor stalling. Loss of control and/or flame-out near the aircraft’s operational ceiling is infinitely more likely, and for a crew distracted by a cacophony of aural and visual alarms, highly probable.


Stalled wings would mean a dramatic, uncontrolled descent.
At 35 000 feet, in heavy turbulence, even a very small reduction in speed would increase the risk.
MARTIN ALDER. Our speed range is quite limited.
Typically, 10 knots either side of the cruise speed….. and the engines are running very close to their surge lines (where any yaw or pitch increase could induce a locked compressor stall)


Then, he raises the elevators…
…to pitch the nose up, at precisely 5 degrees.
With 85% power, and 5 degrees pitch up, they should always settle at the same safe speed. But not so simple in the case of a sudden pitch-down into mach tuck……

MARTIN ALDER. It’s quite possible to fly the aircraft to actually quite high standards of accuracy; something in the region of about five knots or so of the, of the desired target speed would be quite achievable for most crews.

Note that discussion of the alternate scenario resulting from a 10 kt speed increase (a “coffin corner” encounter with Mach tuck) has been cunningly avoided. The finely honed instincts of a pilot encountering pre-stall buffet is to “max the power”/firewall the throttles. But think what that max thrust would do to an aircraft that was actually encountering the preliminary buffet of mach tuck….


Pitch and Power is the pilots’ lifeline.
They ignore any fault messages until they’re safely in control.
CAPTAIN. I’ve got 5 degrees on the standby, 4 degrees on the other.
MARTIN ALDER. Flying the aeroplane is the prime objective. No matter how attractive the messages might be to anybody on the flight deck, you both concentrate in ensuring that the person who should be flying the aeroplane is flying it, and flying it in the manner which is safe.
When in extremis, the safety credo is “aviate, navigate, communicate,” in that order.

CAPTAIN. OK, so we’ve got what I think is basic control of the attitude, we’re bumping a little bit with the weather, but generally that’s safe.


Martin Alder’s simulation shows that speed can be maintained even if all 3 pitot probes fail.

May be a simplistic simulation. Pilots are told over and over to trust their instruments. They’re not conditioned to question the validity of the display. The larger question becomes: “Did the pitot tubes suddenly snap-freeze over (the over-ocean pure water/no condensation nuclei theory) and the airspeed suddenly read zero per the BBC’s convincing graphic … OR did the pitots become gradually clogged by super-cooled ice crystals and gradually begin to underread? The former situation is fait accompli (pilot realization/ready acceptance of “no airspeed = airspeed indication failure”), but the latter scenario of gradual airspeed increase (but no apparent change, thanks to autothrust) is more insidious and undetectable. Which is potentially more lethal for a trained crew? Which scenario is more concordant with the preponderance of prior Thales pitot blockage instances?

The true genesis of this accident is the key to avoiding a repeat.


… so auto-thrust decreases engine power automatically. It should do so only until the speed decreases to recommended turbulence penetration speed/Mach at that height (about M0.82) – at which point it would/should autothrottle up to support that new dialled-in speed. The BBC argument is that suddenly the autopilot/autothrust kicked out, coincident with the speed winding back to zero….. and so the autothrust failed its follow-up speed-sustaining task. A very unfortunate (and perhaps unlikely) marriage of circumstances perhaps?
But it does not give the pilots an important visual signal.

JOHN COX. The thrust levers themselves, the throttles, don’t move. Unlike some other airplanes where you can feel the throttle in your hand moving, with Airbus aircraft that throttle doesn’t move with auto-thrust engaged, so you have to look at specific engine power indications.
Agreed, quite a trap. Tactile and visible throttle movement is a safer manifestation of virtual control. There are numerous instances of Airbus non-moving throttles “setting pilots up” for an accident or incident. On all other airliners (Boeing, etc) the throttles move. How the non-moving throttles were certificated and approved is a separate story.


The power indications are displayed here, on the central control panel.
But in John Cox’s scenario, the pilot doesn’t notice it.
JOHN COX. If you’re very task-saturated, your concentration’s going to be directly in front of you. What’s the power output of the engines, you’re going to have to physically turn your attention and look to the centre console area.

And assuming that the engine synoptic is displayed and not the fuel management page.

JOHN COX. This is not going to be done as frequently as looking at, at the things right in front of you, it, it’s certainly going to be in the scan, the question is how often?


In 5 cases, crews did not take manual control of thrust for more than sixty seconds.
For Flight 447, that would spell rapid deceleration…
…and the risk of a sudden stall.
MARTIN ALDER. Ten to fifteen knots would not be unusual, if you decelerate at a knot a second it’s fifteen seconds. The aircraft would slow down to a much lower speed, and you could approach a stall quite quickly in that manner at altitude.
JOHN COX. There is a good possibility that at some point in the last four minutes that there was a stall event.

But possibly not a stall, just as credibly a classic Mach tuck upset. It is quite plausible that the autothrust was insidiously increasing power to offset the speed loss as the aircraft pitots all started sensing a losing consonant speed-loss due to the ice crystal buildup – thereby actually increasing the aircraft’s speed and bringing it ever closer to Mach tuck/critical Mach at that altitude. Reflect upon the fact that supercooled ice crystals embedded in a pitot will remain granular (i.e. uncompacted) and allow some through-passage of air…..over a period and before becoming totally “blocked”. It becomes an air filtration scenario, wherein the impact air pressure is impeded and diminished - but not totally stagnated.


But a stall can be an extreme event. Flight 447’s pilots may have found themselves - in totally unknown territory.
See comments on this at line 172.

JOHN COX. If they were in a condition that it fully stalled, oftentimes when the nose breaks they’ll roll off on a wing and, and that’s a, that’s a pretty aggressive manoeuvre when the airplane does that.


Comtois is flying in the dark – with no visual cues from the outside world…
Instead, he must rely on his instruments.
PAUL COMTOIS. I have flown on missions where I felt like I was in a hundred and twenty degrees of bank but I'm looking at that gauge and it’s telling me I'm flying straight and level.
Trust your instruments – assume they are correct. However both illusions and vertigo (“the leans”) can induce overpowering sensations….. particularly when reinforced by vestibular (i.e. inner ear sense of balance) inputs.


For Tony Cable, the case of Flight 447 highlights critical training issues.
TONY CABLE. It has raised the question, about whether the situation is actually being made worse by the increase in automation, whereby crews don’t get a great deal of opportunity to manually fly the aircraft.

At high altitude, in very less dense air, manual control can be likened to walking a razor’s edge


From the existing, limited evidence, our independent team has linked together the possible chain of events.

No single link is fatal in itself.

But together – they provide the most convincing solution so far to the mystery of Flight 447. However there are equally convincing alternative theories/hypotheses.
So, as indicated, this assertion is contestable.


The next link in the chain….
The storm clouds contained a rare form of water.

Unlikely, convenient, implausible or just an unproven phenomenon? Convenient? Airlines have always favored explanations of pilot error or pilots and machines that have been overpowered by the elements. It simplifies litigation.

JOHN WILLIAMS. What’s possibly unusual in this storm is to have super-cooled liquid water this high up in the atmosphere.

Agree, it seems meteorologically inconsistent.

Three questions pertain:

  1. Can pitot heating be improved? Yes, possibly barometrically switched so that a higher rate of heating (i.e. amperage) cuts in at (say) above 25,000ft.

  1. Is there a way to get speed readings without pitot tubes? A qualified Yes. They’d need to be derived from other than pitot-sensed air data.

  1. Why must flight data be at the bottom of the ocean? There are other ways than filing critical information into shockproof, waterproof boxes lodged in the tail section of the aircraft.

Take each question in turn.

1. Can pitot heating be improved?
The simple solution to the pitot conundrum is to have a two stage heat selection. In normal operations, selecting higher than the present amperage of pitot heating at higher low altitude ambient temperatures would cause an overheat failure of the heating coils.
However, in the case where an airliner cruises at high altitudes for long periods, and in clouds composed of supercooled ice crystals, the present heating formula no longer works. The rate of cooling exceeds the ability of the heater to keep the pitot head warm enough to stop ice from entering, congealing and ultimately blocking the pitot tube. What’s needed is a stepped heating arrangement, either automatic or pilot selected (preferably automatic/barometric with a manual back-up) to bump the amps up to a higher rate of heating (i.e. BTU’s/minute). This could be done via an altitude switch or via an outside air temperature (OAT) threshold. This recourse assumes that the OAT sensor is not going to itself suffer from a single icing-induced error.

2. Is there a way to get speed readings without pitot tubes?
A new laser-based, optical airspeed sensor has been developed. It relies on Doppler wavelength shifting and short duration laser pulses fired from the aircraft into the atmosphere. The project has reached the stage where a prototype test-bed system is being assembled. See or

The “Backup Speed Scale” or BUSS is used when the nomal normal pitot-based speed indications cannot be used. With the BUSS system, speed is no longer calculated based on pitot probe readings. Rather, the aircraft’s incidence probes (angle of attack) are used. This speed indication is less precise.

On its A330s and A340s, Air France considered installing the BUSS system, but the carrier decided against buying BUSS after tests in its flight simulators. The system proved difficult to use at high altitude. In a Flight Operations Telex of 9 September 2009, Airbus recommended against using BUSS at altitudes higher than 25,000 feet. See or

3. Alternatives to “black boxes.”
a. One recourse is the ejectable FDR/CVR. The memory is stored in an impact-hardened case that automatically ejects from the airplane when an imminent uncontrolled or potentially damaging impact with ground or water is sensed. The spring-mounted device is flush on the tail of the aircraft, and it contains an electronic beacon to aid in its location. The device is also designed to float on the water. It has found wide use in the military, but to my knowledge has yet to find a customer in the airlines.

For more on this technology, contact former Safety Board Chairman James Hall at He would be an excellent on-air advocate for improved recorder technology and the jectable ejectable recorder particularly.

b. There are any number of vendors hawking the downloading of FDR/CVR data in real time.
See the 1998 concept called Iridian-Roadshow at James XXXXXX, a retired pilot friend and colleague of mine can walk you through this approach. He’s in Australia and can be contacted via He is an excellent resource on the AF447 disaster and I highly recommend you contact him.

Star Navigation Systems Group has announced “The world’s first real-time in flight safety monitoring system” as an “ideal” counterpart to the “black box” and a “quantum leap in aerospace safety technology.” See BEYOND THE BLACK BOX - LIVE FLIGHT DATA ANALYSIS at (and )

Sy Levine has patented here in the U.S. a system called SAFELANDER that captures data and broadcasts it to a ground station. He can be reached at and his technology is discussed at

For general reading, in addition to articles on AF 447, see, where I’ve posted the following articles you may not have seen:

“Substitute Ice for Beetle in the Pitot and Air France Crash is Explained.”

“Broadcasting Flight Data Seen as Possible & Inevitable”

“Difficulty Locating Lost Jet’s Flight Recorders Shows Need for Upgraded Technology”

Also look at a 2007 European Aviation Safety Agency (EASA) presentation on pitots blocked by ice. This talk addresses the need for research to upgrade the certification requirements for pitot probes. See

I am available to help in any way I can.

File: XXXX comments


The database is protected by copyright © 2017
send message

    Main page