Air France Flight 447: Search for the Black Boxes
Brazilian and French Military Ships Have Rcovered 17 Bodies and Large Amounts of Plane Wreckage
Monday, June 8, 2009; 12:00 PM
A U.S. Navy team was flying to Brazil on Monday with high-tech underwater listening devices to help the search for the black boxes from an Air France plane that crashed into the Atlantic Ocean.
, professor in the
at MIT and director of the International Center for Air Transportation, was online
Monday, June 8, at Noon ET
to discuss the search and the investigation into the cause of the crash of Air France Airbus A330.
R. John Hansman: John Hansman is now online to answer some questions about Air France 447
New York, N.Y.: Dear Prof. Hansman:
Why are modern airliners dependent on relatively primitive pitot tubes? Aren't there better ways to measure air speed, say with Lasers, that are less prone to failure to failure?
R. John Hansman: You need to know the speed of the aircraft through the air as well as the pressure forces on the aircraft. Pitot tubes are a very simple and reliable way to do this. If there was severe icing which blocked the Pitot tubes, lasers would have had the same problem.
Silver Spring, Md.: There was discussion on news outlets (CNN and USA Today) about black boxes that would deploy from the aircraft and float. What is the status of this technology and would it have enabled rescue crews to arrive on the crash site faster as claimed?
R. John Hansman: It is hard to know when to eject the boxes and to do it in a way which would not hurt people on the ground. It is easier to do this in a military aircraft with ejection seats. You can assume that if the pilot ejects there is a real problem.
Cleveland, Ohio: Mr. Hansman -
Why do we still use black boxes in this day and age? Can we not relay real-time information from the cockpit to a remote server? Please advise.
R. John Hansman: The amount of data is very large (400 parameters some of which are recorded 30 times a second). It is technically difficult and expensive to send all that data in real time, particularly from remote regions such as the oceans
Boston, Mass.: Per news reports attention is being focused on the Air Data Intertial Reference Unit (ADIRU) in the Airbus 330 due to two prior incidents of uncommanded descent.
Have there been similar incidents with any Boeing aircraft? Is the ADIRU a standard unit used by both manufacturers or are they made specifically for a type of aircraft?
R. John Hansman: There have been cases of Boeing aircraft having problems with blocked Pitot tubes. One time the aircraft came out of maintenance with the tubes taped over. Boeing Aircraft have similar ADIRU units. Only the 777 and the new 787 are fully fly by wire. The 737, 747, 757 and 767 aircraft all have mechanical control systems.
Anonymous: How would you rate the Brazilian authorities' response to this incident, the third major commercial airline disaster to take depart from the country in the past three or four years.
R. John Hansman: So far the response has been good. This is a difficult case and they have done a reasonable job in the search and rescue phase.
Arlington, Tex.: Is the signal from the black boxes too weak to be detected by a pattern of passive sonobuoys from a P3 Orion? Are shipboard or helicopter borne transducers more sensiive?
R. John Hansman: It is possible that a sonobouy could detect the signal from the Flight Data and Cockpit Voice Recorders if it were within range
Norman. Okla.: Professor
It seems like this is a design flaw if a failed sensor could induce an immediate manuever that causes loss of vehicle. Shouldn't the control system rate limit inputs given the vehicle state vector to minimize airframe risk?
The scenario Ii've heard is a failed air data unit initiated a high rate descent that may have destroyed the airplane.
R. John Hansman: If the failed sensor was identified then it would have been possible to control the airplane on attitude. That is the procedure which Airbus reminded the operators about. However if multiple sensors failed in the same way (for example being iced over by severe icing conditions which the Pitot heaters could not handle) then there are possible failure modes such as the auto-throttles increasing the speed above the maximum operating Mach number because of a faulty low speed indication.
Caracas, Venezuela: Professor Hansman: in which ways, a storm can be blamed in the failure of equipment aboard? I have read that it is normally safe to fly in stormy conditions without major problems. Thank you!
R. John Hansman: One hypothesis is that severe icing conditions at the top of the storm may have been more than the heaters on the air-data sensor (Pitot tubes) were designed for and were not able to prevent the tubes from icing over. This would be consistent with some of the later reports of problems in the air data system
Cambridge, Mass.: You say it is technically difficult and expensive to send FDR/CVR data in realtime to a central server. How does the difficulty/expense compare to the cost of the current recovery effort and similar past efforts (Swiss Air 111 Adam Air 574? etc.)?
R. John Hansman: One of the questions would be who would cover the costs of both the equipment and the data transmission charges. Messages through geostationary satellites are fairly expensive (a few dollars a message). There are also issues of dispatch reliability and lack of complete coverage of the communications network as well as bandwidth issues.
Anonymous: Prof. Hansman, on your next trip to Europe, would still feel comfortable flying on an A330?
R. John Hansman: Yes
Charlestown, Mass.: How many square miles is the black box expected to be located in? Also, what is the timeframe for finding this thing and what are your expectations? Thank you.
R. John Hansman: I don't know the current search box but it will likely be 10s or 100s of square miles. The chances of recovery will be increased if the boxes can be localized before the acoustic pingers run out of battery power (about 30 days). Even then it may be difficult due to the depth and rough topography of the ocean floor in that area. It is very possible it may not be recovered.
Princeton, N.J.: Given the fact that at any point of time, huge amount of data is being generated and fed into the black box. In addition to storing this data, why isn't the cockpit equipped with a camera which also captures the video of past 5 or 10 mins? A video recording, complimenting the data generation, could also give enormous insight. Are there any drawbacks in this design?
R. John Hansman: This has been proposed and has been done in some cases (normally flight testing). There are labor issues and workplace privacy issues that would have to be addressed but it is technically feasible.
Cambridge, Mass.: If some very early indications are correct, this may be the second crash in the last few months that involved a faulty sensor (Turkish Airlines 1951 that had a faulty radio altimeter).
How can aircraft designers do a better job dealing with sensor faults and balancing automation with pilot control?
R. John Hansman: Sensor faults are one of the things that are normally considered in an automation system design. Failure of the ADIRU is considered in the Airbus systems. However common mode failures where several sensors fail in the same way (for example icing blocking the Pitot tubes) can be difficult for the automation to detect.
Fresno, Calif.: I'm a pilot with an ATP. I'm amazed, but not surprised, that Air France (AF) and Airbus would continue to operate an aircraft if there were a problem with the pitot static system. Do you have any more data on the extent of the pitot static problem?
R. John Hansman: As I understand it the modification was to add additional heating to the pitot probe to prevent icing in very severe icing conditions. The pitot's were certified within the normal icing design envelopes. At very cold temperatures (below -40C) there is normally not an icing problem because all the moisture has frozen and ice does not stick to the probes. It is possible that liquid water from lower altitudes was forced up by the storm and had not yet frozen thereby creating the severe icing problem
Pucon, Chile: How many black boxes are there and is the data recorded in duplicate or does each black box record different data streams?
R. John Hansman: There are 2. One is the Flight Data Recorder which records aircraft parameters such as airspeed, altitude, control position, etc. The other is the Cockpit Voice Recorder which records sounds in the cockpit as well as radio communications.
Warren, Pa.: Can you speculate why there was no radio communication from the crew regarding the event? Surely, sometime during the four-plus minutes that the plane was relaying maintenance data, an emergency radio call could have gone out.
R. John Hansman: The HF (shortwave) radios used for communication over the oceans are somewhat more difficult to use in that they are less reliable due to ionospheric conditions and the pilots do not talk directly to ATC but to a communications service. As far off shore as they were, there was very little that ATC could do to help at that point. I assume that the crew determined that it was more important to try to resolve the prolems they were having. The priority in aviation is: aviate, navigate, communicate in that order.
Miami, Fla.: If going "too slow" or "too fast" can break up a plane in the air as suggested in the media, would an experienced pilot not detect signs of these conditions even if the sensors are faulty?
R. John Hansman: The pilots rely on the same sensors as the autopilot to determine how fast they were going. There is not a lot of other feedback they have in a modern jet. The way you would determine if there was a problem would be if the sensors did not agree with each other.
Guatemala City, Guatemala: How come the cockpit crew was unable to send an SOS/distress call via radio to the closest control tower or even on company frequency to Paris?
R. John Hansman: They were probably busy trying to fly the airplane.
Toronto, Ontario, Canada: Why is it that when the plane sent automated messages about the malfunctions, it did not include the current GPS location? I fail to understand why such a critical piece of information is not included in those messages. GPS location could have helped in pin pointing the location or path of the plane right before it went down.
R. John Hansman: As I understand it, the maintenance reporting messages did send the GPS coordinates and the time of the report.
Fortaleza, Brazil: I am surprised that I haven't seen any news reports on what other planes flying from Brazil to Europe experienced, in ways of turbulence, etc., that same night. This was not a plane flying an isolated route. We were on a flight from Atlanta to Recife that passed through the intertropical converence zone the same night as the Air France flight, though we were far to the west of that flight's path. However, on the same night there were other flights from Rio and Sao Paulo to Europe, and even Fortaleza to Lisbon, which would seem to have passed through semilar weather systems. Also, how much leeway does a pilot in terms of diverting from the most direct route in order to avoid severe turbulence?
R. John Hansman: There were several aircraft who flew the same route that evening without problem.
Paris, France: Professor Hansman, As I understand it, France is undertaking the investigation into the Air France disaster and Brazil is undertaking the search and rescue part. Can you elaborate on those roles and speak a little about how other countries are contributing (the U.S., for example)? Warmly!
R. John Hansman: Because the accident occurred in international waters and the aircraft was registered in France, France would lead the investigation. Brazil is closest so it makes sense for Brazil to lead the S&R. Other countries who manufactured parts of the aircraft (like the US) are likely to participate in the investigation.
Clearwater, Fla.: Please tell me why they don't yet have such a thing as an EXTERIOR black box which when dettached would float instead of sinking. Think of the time and money and effort this would save.
R. John Hansman: The "black boxes" are located in the rear of the aircraft where they are most protected and have the greatest chance of surviving the impact.
Post crash data transfers: Could a black box be configured to transmit its recorded flight data after a crash in a scenario like the Air France crash where the box itself maybe too deep underwater to recover physically?
R. John Hansman: The "black boxes" need to be designed for as many possible accidents. This is a fairly unusual case and it is not clear that it would make sense to add this capability. If you could hear the transmission you could probably recover the box. Also, it would be difficult to design a system which would function after the impact.
Paris, France: Dear Professor, Could you elaborate on what will take place in the coming months -- the process of transporting debris, analyzing debris, investigating black box data, etc.?
R. John Hansman: The physical evidence will be collected and assembled in some location. I don't know if it will be in France or Brazil. The investigators will look at the physical evidence and the other information (messages, weather, etc) in great detail. There will be simulator and computer model studies to evaluate possible causes. Finally there will be an assessment and report on the probable causes. If any problems are identified instructions or Airworthiness Directives will be sent to airline operators to prevent further occurences.
Chicago, Ill.: How feasible is it to have some ATC stations in the ocean? It was pretty hard to believe that in this age we have so much difficulty in tracking down where the aircraft is? Also, how feasible is it to have location transmitters in the aircraft, so that even if a aircraft crashed, we know where it is.
R. John Hansman: Not really feasible to have ATC stations in the oceans but we are moving to satellite bases systems where it will be easier to communicate with aircraft in remote regions.
D.C.: The GPS system can also provide velocity. Now I realize that the GPS-provided-speed would be the over-the-ground speed. But surely a very large difference between reported airspeed and the over-the-gound speed would have alerted the pilot to a possible problem in their reported airspeed.
R. John Hansman: At high altitudes the winds can be very large (greater than 100MPH). Because the GPS velocity is a combination of the airspeed and the wind speed it is difficult to use GPS to validate the airspeed sensors.
Anonymous: How much leeway does a pilot have in diverting from the most direct route in order to avoid severe weather?
R. John Hansman: The pilot has significant leeway. Normally he or she must inform ATC so that you don't conflict with another aircraft but in an emergency you can deviate as far as you want. As a practical matter if you deviate too far you might run short of fuel so you have to consider that also.
Galway, Ireland: If the Air France plane was flying 'above the weather' how could it have been affected by the severe thunderstorm?
R. John Hansman: Even "above" severe thunderstorms you can get strong turbulence and can sometimes get hail out of the top of a severe thunderstorm. They may also have been above the heavy precipitation (which is what you can see on radar) but still in the cloud mass at the top of the storm.
Ocean Currents: Will they be able to back into the exact site of the crash (or at the major pieces of the plane) by where and when they pick up pieces of the plane and bodies by using computer models factoring in ocean currents and wind during the time frame?
R. John Hansman: They will be able to get some indication. Unfortunately it took several days to locate so there is a lot of uncertainty in how far the material drifted
Jersey City, N.J.: Given the reliability of computers, is it really better to rely completely on a fly-by-wire system? Mechanical parts need to be maintained, but computers can be unpredictable, even when given redundant systems to prevent accidents. Your thoughts?
R. John Hansman: There is a tradeoff. As a practical matter all modern aircraft are a combination of mechanical and computer systems. We need to do the fault analysis so that no individual failure can cause a catastrophic accident.
Boulder, Colo.: Professor: Online analyses of the weather suggest AF447 may have penetrated two MCS cells with tops above FL550. If true, severe turbulence could have caused an upset. Recovery from jet upset can be challenging under the best of circumstances, let alone at night in a cell. Can you say anything about the stall/mach tuck margin? Assuming the upset put the plane outside the permissible attitude envelope of the Airbus FBW logic, can you speculate whether the flight control logic might have interfered with recovery? Thanks. (Lear ATP)
R. John Hansman: One hypothesis is that icing blocked the pitot tubes and the autothrottles may have accelerated the airraft above it's maximum operating Mach number. The could result in mach tuck.
Maryland: Can you comment on the potential hazard of hail? It seems to me that impact with a large hailstone or group of stones could be quite hazardous, and could potentially lead to a catastrophic failure.
R. John Hansman: Hail can case damage to the leading edges of the wings and windshields. It could also damage the air data sensors.
Peterborough, U.K.: So, in laymans terms, if the sensor fails there is nothing that can be done to save the plane?
R. John Hansman: The airplane was designed so that a sensor failure should not have been a problem. There must of been some other factors. Perhaps a common mode failure were several of the sensors failed at the same time.
Charlotte, N.C.: Do you think radar coverage should be extended to cover the gaps over the ocean to keep better trak of aircraft?
R. John Hansman: We are moving to satellite based systems which will effectively fill these gaps.
R. John Hansman: I need to leave for a teaching commitment. Thanks for the opportunity to talk about this unfortunate event. I am sure we will get to the bottom of this and find ways to improve the safety of commercial aviation.
Editor's Note: washingtonpost.com moderators retain editorial control over Discussions and choose the most relevant questions for guests and hosts; guests and hosts can decline to answer questions. washingtonpost.com is not responsible for any content posted by third parties.