Cavalry Charge

Did you hear about the A330 that encountered severe turbulence, pitot icing, unreliable airspeed indications, and a cascade of system warnings while crossing the Atlantic towards France? The pilots did a great job getting that airplane to Paris in one piece.

No, I haven't entered an alternate reality where Air France 447 reached its destination. I'm reading a company memo from Hugh Houang, the Air Caraïbes flight safety officer, describing technical difficulties they had with that airline's A330-200 aircraft in August and September last year, and the inadequacy of the Airbus checklists for dealing with them. The memo is in French, but someone who speaks Airbus will probably be able to read it with minimal trouble. Airbus system and warning names are all in English. Below is a highlights summary, with my own commentary in parentheses.

It first documents the flight of F-OFDF, en route from Fort de France, Martinique to Paris, France:

• 22:11 - They encountered adverse conditions. Prescribed weather deviation procedures didn't help flight conditions, so they returned to FL350 at 22:14.
• 22:22 - They reduced speed and power settings, and disconnected the autothrust in accordance with the SEVERE TURBULENCE checklist.
• 22:22 - In seconds, the air temperature rose from -14 to -5, indicating the temperature of the ice, as opposed to of the outside air, a sign of severe pitot icing. The displayed calibrated airspeed dropped from 270 kts to 85 kts (yikes! that's too slow for me!); the flight directors and autopilot disconnected and there were a cascade of warnings and alarms, my favourite of which was CAVALRY CHARGE. (An Airbus speaker explained that this apparent Napoleonic reference is the name of the distinctive audio signal associated with autopilot disconnect). The stall warning sounded, as did the CRICKET (another type of annunciator) and the master warning came on. (I'm skipping many of the alarms listed. Suffice to say, this cockpit looked and sounded like a pinball machine).
• 22:23 Over the next two minutes the temperature dropped again, the airspeed came back up and the altitude jumped up to 34500'. They soon recovered their flight directors and autopilot.

For 86 seconds the crew had no reliable airspeed, mach or altitude indications. (This may seem like a very short time, but 178 seconds was the average time a pilot with that information but without the training on how to use it took to destroy a simulated small airplane. And those test subjects weren't in severe turbulence. All the training in the world doesn't help a crew keep the airplane under control if they don't have the data). The crew concentrated on flying the airplane, using GPS data, and trying to complete the Unreliable Speed Indication checklist. They were helped by the fact that they had already completed the Severe Turbulence checklist, but there was not time during the incident to complete its recommendations. The manual strongly suggests to the pilot flying that the stall alarms are inappropriate. (The picture given by the message RESPECT STALL WARNING AND DISREGARD "RISK OF UNDUE STALL WARNING" STATUS MESSAGE IF DISPLAYED ON ECAM is of someone flying an airplane where the stall warnings are saying that the airplane is stalling, the ECAM screen is telling the pilot to disregard the stall warnings, and the manual is telling the pilot to disregard the ECAM and heed the stall warnings, but the pilot doesn't believe that the airplane is stalling. It's like having your chief pilot, training manager and captain all on the flight deck, telling you do different things).

The next part of the memo then analyzes the event and the warnings in terms of the Airbus protections offered by ALTERNATE LAW, NORMAL LAW, and DIRECT LAW, detailing what was and lost or changed in response to the various alarms, such as the F/CTL ADR DISAGREE. He points out that the checklists contradict each other when the unreliable speed indication checklist says, RELY ON THE STALL WARNING THAT COULD BE TRIGGERED IN ALTERNATE OR DIRECT LAW. IT IS NOT AFFECTED BY UNRELIABLE SPEEDS, BECAUSE IT IS BASED ON ANGLE OF ATTACK, while the icing checklist warns UNDUE STALL WARNINGS MAY MAINLY OCCUR IN THE CASE OF AN AOA DISCREPANCY. (AoA is angle of attack, measured by vanes outside the aircraft, which in severe icing can also be unreliable).

(With the autothrust selected off and the crew confidence that they were not in a stall, no stall recovery inputs were made. Which is good, because the result of stall recovery inputs when you are not in a stall could be an overspeed, and in alternate law, if I understand M. Houang correctly, the high speed protection warnings are reduced).

In response to the two incidents (the second one is not described, but the partial aircraft ident "PTP" is given), Air Caraïbes quickly replaced the pitot tubes on its fleet with a different kind, with drainage designed especially for the heavy precipitation and severe icing encountered.

In October, Air Caraïbes officials met with Airbus representatives, who understood that the stall warning messages were contradictory and that the checklists were difficult to complete rapidly. They said they'd think about modifying the checklists.

And then M. Houang says he hopes the memo has answered everyone's questions, and wishes everyone good flights.

I expect a lot more Airbus pitot tubes to be replaced now, whether or not the similar events preceding the loss of AF447 is determined to stem from the same cause.