Grado en Gestin y Operaciones de transporte Areo Universidad Politcnica de Madrid Seguridad Area

Realizado por:

David Garca Luque Francisco Arias Virseda Ricardo A. Hernndez D.

Martes, 18 de diciembre de 2012

Seguridad Area-AF447 Tree Fault Analysis

Index
1. 2.

INTRODUCTION ............................................................................................................ 3 FACTUAL INFORMATION ......................................................................................... 3

History of Flight ......................................................................................................................... 3 Killed and Injured ...................................................................................................................... 4 Damage to Aircraft .................................................................................................................... 4 Other Damage ........................................................................................................................... 4 Personnel information .............................................................................................................. 4 Aircraft information .................................................................................................................. 4 Meteorological situation ........................................................................................................... 4 Aids to Navigation ..................................................................................................................... 4 Telecommunications ................................................................................................................. 4 Aerodrome Information ............................................................................................................ 4 Flight Recorders ........................................................................................................................ 4 Wreckage and Impact Information ........................................................................................... 4 Fire............................................................................................................................................. 5

3. 4. 5. 6. 7. 8. 9.

FAULT TREE ANALYSIS ............................................................................................. 5 CONCLUSIONS ................................................................................................................ 6 Tree Fault Analysis (general view): ................................................................... 7 Tree Fault Analysis (Obstruction Pitot Tubes): ............................................ 8 Tree Fault Analysis (Cockpit Confusion): ........................................................ 9 Tree Fault Analysis (sustained stall):.............................................................. 10

Description of the Tree Fault Analysis applied to the accident of the AF447 ....................................................................................................................................... 11
Obstruction of Pitot Tubes ...................................................................................................... 12 Cockpit Confusion ................................................................................................................... 12 Loss of reliable airspeed information.................................................................................. 12 Autopilot Disengaged .......................................................................................................... 13 Excessive input controls ...................................................................................................... 13 Sustained Stall ......................................................................................................................... 14 Failure to identify aural warning ......................................................................................... 14 Confusion with overspeed situation ................................................................................... 14

Seguridad Area-AF447 Tree Fault Analysis

Flight Director Indications ................................................................................................... 14

Seguridad Area-AF447 Tree Fault Analysis

1. INTRODUCTION
The Airbus A330 flight AF447 took off from Rio de Janeiro bound for Paris on 31 May 2009. The sequence of events in the accident is the following:

The Captain left the cockpit at around 2 h 02.

The crew made a course change of 12 degrees to the left at around 2 h 08.

There were some automatic systems disconnected and the speed indications were incorrect at 2 h 10 min 05.

The Captain rejoined the crew at 2 h 11 min 35. In that moment, the airplane was in a stall situation.

The airplane impacted the sea at 2 h 14 min 28.

2. FACTUAL INFORMATION
History of Flight
Date of accident 1st June 2009 at 2h 14 min 28s Aircraft Airbus A330-203

Site of accident At reference 30357 N, 303342W, near the TASIL point, in international waters, Atlantic Ocean

Owner and Operator Air France

Operator Air France

Seguridad Area-AF447 Tree Fault Analysis

Type of flight International public transport of passengers Scheduled flight AF 447 Persons on board Flight crew: 3 Cabin crew: 9 Passengers: 216

Killed and Injured

Fatal injuries Crew Members: 12 Passengers: 216

Damage to Aircraft
The airplane was destroyed.

Other Damage
Not applicable.

Personnel information
The crew possessed the licenses and ratings required to undertake the flight.

Aircraft information
Air France had owned the aircraft since April 2005. It had been delivered new.

Meteorological situation
The general conditions and the position of the ITCZ over the Atlantic were normal for the month of June. Cumulonimbus clusters were present.

Aids to Navigation
The GNSS is the only navigation aid near the TASIL point. At the time of the event, the GPS constellation gave the required navigation precision on the route.

Telecommunications
Flight AF 447 was under radar control from departure from Rio de Janeiro airport to the INTOL waypoint, and under radar coverage up to the SALPU waypoint. After this point, AF 447 was under en-route control (via a flight progress strip).

Aerodrome Information
The support aerodromes for this ETOPS 120 minute flight were: Natal (Brazil) and Sal Amilcar (Cape Verde).

Flight Recorders
The aeroplane was equipped with two flight recorders.

Wreckage and Impact Information

The French and Brazilian navies found debris belonging to the aeroplane from 6 June onwards. There were found about 1000 plane pieces.

Seguridad Area-AF447 Tree Fault Analysis

Fire
There was no evidence of fire or explosion.

3. FAULT TREE ANALYSIS

Fault Tree Analysis (FTA) is a logic and probabilistic technique used in system reliability assessment. The Fault Tree Approach The fault tree is a graphic model of faults that will result in the occurrence of the predefined undesired event. It is a qualitative model that can be evaluated quantitatively. The faults can be events that are associated with component hardware failures, human errors, software errors, or any other events which can lead to the undesired event. FTA doesnt include all possible system failures or all possible causes for system failure. The fault tree includes only those faults that contribute to the top event. A fault tree is composed of gates that serve to permit or inhibit the passage of fault logic up the tree. The gates show the relationships of events needed for the occurrence of a higher event. The higher event is the output of the gate; the lower events are the inputs to the gate. The gate symbol denotes the type of relationship of the input events required for the output event. The probability of occurrence of the AND gate fault event is:

The probability of occurrence of the OR gate fault event is:

Seguridad Area-AF447 Tree Fault Analysis

4. CONCLUSIONS
Ice crystals phenomenon was known but misunderstood, at the time of the accident. This occurrence during cruise surprised the pilots of flight AF 447. After data inputs inconsistency because of Pitot probes blocked, crew members decided to disconnect the autopilot. They didnt understand the situation and there was a bad cooperation between crew members. That led to a total loss of cognitive control of the situation. They didnt understand the airplane was in a sustained stall, although there were signals of it. Consequently, they didnt apply a recovery manoeuvre and the aircraft ended crashing the sea.

Seguridad Area-AF447 AF447 Tree Fault Analysis

5. Tree Fault Analysis (general view):

Accident AF447

Obstruction of Pitots Tubes

Loss of reliable airspeed information

Cockpit Confusion

Sustained Stall

Formation Ice Crystals

Autopilot Disengaged

Excesive Control Inputs

Night and ITCZ

Failure to identify aural warning

Any Visual Information

Confusion with Overspeed Situation

Flight Director Indications

...

...

...

...

...

...

...

Seguridad Area-AF447 AF447 Tree Fault Analysis

(Obstruction Pitot Tubes): 6. Tree Fault Analysis (

Obstruction Pitot Tubes

Formation Ice Crystals

Freezing Cores

Temperature <40C

Seguridad Area-AF447 AF447 Tree Fault Analysis

7. Tree Fault Analysis ( (Cockpit Confusion):

Cockpit Confussion

Loss of Reliable airspeed Information

Autopilot Disengaged

Excessive Input Controls

Night and ITCZ

Lack of link between indicated airspeed and procedure

Lack of training flying NIC

Lack of a clear display of airspeed inconsistencies

Captain was not flying

Wrong task sharing between co-pilots

Activation Alternate Law

Erroneous airspeed information

ECAM Messages

Excessive Warnings

Incomprehension of the situation

Startle effect: Emotional Factor

Seguridad Area-AF447 AF447 Tree Fault Analysis

(sustained stall): 8. Tree Fault Analysis (

Sustained Stall

Failure to identify aural warning

Any Visual Information

Confussion with overspeed situation

Flight Director Indications

Low Training stall phenomena

Low training stall warnings

Low training Buffet

Thrust to Idle

Nose-Up Position

Late Identification of deviation from flight path

Insufficient correction of deviation from flight path

Seguridad Area-AF447 Tree Fault Analysis

9. Likelihood
P(Accident AF447) = P(1) * P(2) * P(3) P(1) = P(1A) = P(1A1) * P(1A2) : Obstruction of Pitot Tubes Formation Ice Crystals Freezing Cores Temperature <40C 1 1A 1A1 1A2

P(2) = [1 - P(2A)] * [1 - P(2B)] * [1 - P(2C)] * [1 - P(2D)]: P(2A) = P(2A1) * P(2A2) * P(2A3) P(2B2) = P(2B2A) * P(2B2B) P(2B) = P(2B1) * P(2B2) * P(2B3) P(2C) = P(2C1) * P(2C2) * P(2C3): Cockpit Confusion Loss of reliable airspeed information Lack of link between indicated airspeed and procedure Lack of training flying NIC Lack of clear display of airspeed inconsistencies Autopilot Disengaged Captain was not flying Wrong task sharing Incomprehension of the situation Startle effect: Emotional Factor Activation Alternate Law Excessive Control Inputs Erroneous airspeed information ECAM Messages Excessive Warnings Night and ITCZ P(3) = P(3A)] * P(3B) * P(3C) * P(3D): P(3A) = P(3A1) * P(3A2) * P(3A3) P(3C) = P(3C1) * P(3C2) P(3D) = P(3D1) * P(3D2): Sustained Stall Failure to identify aural warning Low Training stall phenomena Low training stall warnings Low training Buffet Any Visual Information Confusion with Overspeed Situation Thrust to Idle Nose-Up Position Flight Director Indications Late Identification of deviation from flight path Insufficient correction of deviation from flight path

2 2A 2A1 2A2 2A3 2B 2B1 2B2 2B2A 2B2B 2B3 2C 2C1 2C2 2C3 2D

3 3A 3A1 3A2 3A3 3B 3C 3C1 3C2 3D 3D1 3D2

Seguridad Area-AF447 AF447 Tree Fault Analysis

10. Description of the Tree Fault Analysis applied to the accident of the AF447
In order to apply this method to the accident of the Air France 447, we decided to prioritize the most important contributors contributor which, from our point of view, lead to the accident of this aircraft. Firstly, , we have chosen 3 main facts which trigger the fatal fatal top event. These 3 facts are: Obstruction of Pitot Tubes Cockpit Confusion Sustained Stall

Obstruction of Pitot Tubes

This is the first fact that we realized it was primordial because it is supposed to be the first cause to the rest of consequences. The obstruction occurs because the aircraft was flying in a FL350 FL with an outside temperature under -40C 40C, condition which added to freezing cores, causes the appearance of the phenomena of Ice Crystals. This phenomenon obstructs the Pitot Tubes, and nowadays, researchers are seeking for a new invention who defrosts these Ice Crystals. We have used the and gate in order to represent that it was necessary to join the two conditions to contribute to the appearance of the Ice Crystals.

Cockpit Confusion
In this time, we have utilized a or gate because the confusion produced in the cockpit, although the four items under the the or gate took place in the accident, any of the items would have induced the situation of confusion. These four items are: Loss of reliable airspeed information: this is one of the main reasons which drive the crew to get involved in a critical situation. situatio Autopilot Disengaged Excessive control inputs Night and ITCZ: the meteorology and the flight in this area were determinant to provoke the accident.

Loss of reliable airspeed information In this part of our tree, we have selected some items which could could have reduced the likelihood of the problems which the loss los of reliable airspeed information induces. Amongst others, in reference to the final report, we have elected: Lack of link between indicated airspeed and procedure Lack of training flying NIC

Seguridad Area-AF447 Tree Fault Analysis

Lack of a clear display inconsistencies

Autopilot Disengaged Under this level, the 3 items we have chosen are: Captain was not flying: it was quite unusual that if they knew that they were going to overfly an ITCZ, the captain wouldnt have been flying at this moment. Wrong task-sharing between co-pilots: this is one of the points where human factors are very important. The relationship between the PF and the PNF should always be synergistic, because if nobody takes the control of the airplane, the instructions and the decisions between the pilots can be contradictory. Beneath this level, we have added an and gate including two more contributors: the incomprehension of the situation and the startle effect. The startle effect is an emotional factor which should be always taken in account, because is an inherited item independent of the people who are flying. Activation Alternate Law

Excessive input controls Regarding to this fact we have collected from the text Sustained Stall, we have prioritized 3 of the controls which are necessary to fly the aircraft but maybe can confused the crew because they are very numerous. They are: Erroneous airspeed information: if the anemometer cant display a correct airspeed, it shouldnt show an incorrect one because the pilots are used to being looking to the IAS at any time. ECAM messages: maybe the order in which the ECAM messages were appearance in the display screen could have increased the confusion.

Seguridad Area-AF447 AF447 Tree Fault Analysis

Excessive Warnings: this point could also increase the stressful situation.

Sustained Stall
Under this level, we have used an and gate with 4 more items who influenced to the sustained stall: Failure to identify aural warning Any Visual Information: Information it is remarkable to say that if they had been able to see s some external points as references points, they would solve the situation. Confusion with overspeed situation Flight Director Indications Indicat

Failure to identify aural warning The failure in identifying the aural warning of getting into a stall situation situation might have been induced by a low training. We should remark that the training is primordial to cope with any situation of flying. They could have had more training in fields like: Low training stall phenomena Low training stall warnings Low training buffet

Confusion with overspeed situation Because of this confusion with an overspeed situation, they decided to: Decrease Thrust to idle Increase the Nose-up up position

Flight Director Indications This is the last part of our tree, in which the FDI induces in the pilots to: Identify late the deviation from flight path And added to the previous one, the insufficient nsufficient correction of deviation from flight path

Seguridad Area-AF447 Tree Fault Analysis

Bibliography
Air France 447 Final Report Aerosafety World August 2012 Document Engelamiento - Jefe Departamento Meteorologa Aeronutica de la DGSMN. NASA (2002). Fault Tree Handbook with Aerospace Applications. National Aeronautics and Space Administration.