If the pitot probes on Air France flight 447 were clogged with ice, and that condition set in motion the sequence that led to the crash in the Atlantic of the airplane, the accident raises the question of independent redundancy and whether or not a different method of measuring speed ought not be substituted for one of the three pitots.
Recall that the airplane crashed because two, or all three of the pitots were probably clogged with ice crystals formed from supercooled liquid droplets (SLD). The fly-by-wire system on the airplane “sensed” a speed reading slower than what the airplane was actually flying, leading to subtle thrust additions and trim adjustments. When system parameters were exceeded, the surprised pilots were handed a situation to which they were unaccustomed and were not trained to handle. (see Aviation Safety Journal, “Latest Air France Crash Update Bereft of Analysis”)
Three years before the fatal 2009 crash, the manufacturer of the accident A330-200, Airbus, announced a back-up means for fly-by-wire aircraft to fly safely in the event of faulty readings from the pitot probes. The system was not retrofitted to the accident aircraft; had it been, the accident may have been avoided.
According to Airbus vice president of training and flight operations, Captain Jean-Michel Roy, a degraded primary flight display mode has been developed that does not rely on pressure difference in the pitot. Rather, it uses angle-of-attack data to provide speed information while barometric altitude is replaced with positional data derived from the global positioning system (GPS), which uses signals from orbiting satellites to compute the airplane’s location in three-dimensional airspace. Close to the ground, the radio altimeter provides height data.
“We have had cases of unreliable airspeed information on the A330/A340 fleet, due to contamination of the ADR [air data reference] system where it was not able to isolate the faulty information,” Roy stated.
To compensate for this situation, Airbus developed a back-up mode where “the speed scale will display the back-up speed information derived from the angle-of-attack with the very simple logic; you have red and green and the logic is ‘fly the green’, ” Roy said.
This back-up speed mode was rolled out on new A330/A340 aircraft in 2006. The accident A330 was built in 2005 and had not been retrofitted with the back-up speed mode.
The back-up speed mode is standard equipment on the A380 and will be standard on the A350, a new airplane slated to replace the A330/A340.
The thought occurs that not only should the new speed and altitude measuring methods be provided as a back-up in degraded mode, the independent speed calculation should be one of the three measures routinely fed to the ADR. Having three pitots of the same design supplying information to the ADR seems a violation of the principal of “reliable redundancy” propounded a few years ago by the U.S. National Transportation Safety Board (NTSB). Although the NTSB was offering the concept in the context of the B737 rudder power control unit, it seems equally valid in sensing speed.