The Limits of Technology, A Chilling Reminder
Who can forget the horror of learning, a few years back, that a modern Airbus A330-200 aircraft simply vanished over mid-Atlantic, initially without a trace?
Over the weekend, the Telegraph published a chilling analysis of the June 1, 2009 crash of Air France Flight 447 from Rio de Janeiro to Paris. After the autopilot disconnected in a thunderstorm--a fail-safe response to faulty airspeed data from frozen pitot tubes--the pilot flying AF447 commanded excessive nose-up trim, entering a deep stall. Incredibly, the pilot held this attitude throughout the plane's descent.
For most of its four-minute, 7-mile plunge, AF 447 could have resumed controlled flight if the pilot flying had lowered the nose and held the attitude long enough to regain flying speed. This basic stall recovery procedure is taught to every pilot in initial training and drilled repeatedly in flight checks.
What went wrong? In a word: technology. Too much technology in between the pilots and the aircraft.
But there is another, worrying implication that the Telegraph can disclose for the first time: that the errors committed by the pilot doing the flying were not corrected by his more experienced colleagues because they did not know he was behaving in a manner bound to induce a stall. And the reason for that fatal lack of awareness lies partly in the design of the control stick – the “side stick” – used in all Airbus cockpits.
Cockpit controls in most modern airliners are connected to computers, not directly to engines and flight surfaces. Both Boeing and Airbus make extensive use of such "fly-by-wire" systems. Where Airbus goes further--a step too far in the case of AF447--is in eliminating the tactile signaling provided by the older controls. In a conventional aircraft, the pilot flying commands a nose-up attitude by pulling the stick back and the stick on the other side of the cockpit likewise moves aft, providing feedback to the PNF (pilot not flying). Boeing emulates this control behavior in its fly-by-wire aircraft, Airbus does not. Relax back-pressure in a new Boeing airliner and the nose will lower to its previously trimmed position, just like an old-style cable-and-hydraulics plane. In an Airbus, the computer carries on with the last command input until receiving a new one, even though the stick is visibly in the neutral position.
Under normal circumstances, the Airbus approach provides a lower pilot workload--a better "user experience" in Web 2.0-speak. However, in the corner case of an emergency with multiple instrument failures, overloaded pilots lack the physical cues that would likely have saved 228 souls on board AF447.
And the problem of too much well-meaning-but-intrusive technology goes beyond the flight controls: even the design of the computer-automated stall warning contributed to the disaster.
Bonin’s insistent efforts to climb soon deprived even the computers of the vital angle-of-attack information. An A330’s angle of attack is measured by a fin projecting from the fuselage. When forward speed fell to 60 knots there was insufficient airflow to make the mechanism work. The computers, which are programmed not to feed pilots misleading information, could no longer make sense of the data they were receiving and blanked out some of the instruments. Also, the stall warnings ceased. It was up to the pilots to do some old-fashioned flying.
With no knowledge of airspeed or angle of attack, the safest thing at high altitude is to descend gently to avoid a stall. This is what David urged Bonin to do, but something bewildering happened when Bonin put the nose down. As the aircraft picked up speed, the input data became valid again and the computers could now make sense of things. Once again they began to shout: “Stall, stall, stall.” Tragically, as Bonin did the right thing to pick up speed, the aircraft seemed to tell him he was making matters worse. If he had continued to descend the warnings would eventually have ceased. But, panicked by the renewed stall alerts, he chose to resume his fatal climb.
- Comment (43)
- · Quote
- · UnfollowFollow (1)
Comments:
Feb '11
Re: The Limits of Technology, A Chilling Reminder
There was a somewhat related accident on the Washington Metrorail system a few years ago. Trains are normally operated under computer control, with the operator there as a standby: on this day, the tracks were icy, and the operator requested permission to switch the train to manual operation. Which was denied by the "controller." (The computer system did no always properly account for the longer stopping distances with icy tracks, which was known to some but apparently not all within Metrorail.) The train slid into a parked train at the next station, killing the driver.
The implicit assumption of Metro's procedures was that software designers who would not be present in either space or time, plus a controller who was present in time but not in place, would necessarily have better judgment than the man on the spot in both space and time.
May '10
Re: The Limits of Technology, A Chilling Reminder
I am a total novice here but intensely interested in what I'm reading. In crude layman's terms, are you saying that AF447's demise was a controlled and slow (yet unwitting) swan dive?
Oct '10
Re: The Limits of Technology, A Chilling Reminder
I am a low-time (500 hours) non-instrument rated pilot, but, yes, you are spot on.
May '10
Re: The Limits of Technology, A Chilling Reminder
George Savage
If you let go of the stick on an Airbus that is in an unusual attitude, such as the deep stall described above, it will stay there. This is because the computer executes the last command input by the stick: you do not need to maintain pressure on the stick for it to stay put. If you want to lower the nose, you need to command it to do so. Sadly, releasing the controls is insufficient.
A pitch angle CAS makes sense in a high performance fighter, but not an airliner below the stall speed. You'd think the CAS would switch off at that point and require some pilot input to maintain such a ridiculous attitude. It eliminates the natural phugoid mode that would have saved the aircraft in this case.
For the uninitiated, here's a quick overview of a few types of autopilots. George is talking about type 1.1.
Jul '10
Re: The Limits of Technology, A Chilling Reminder
Cont'd. Turbulence makes it very hard to judge pitch attitudes as well as increasing the pucker factor.
Last: Pilots today are not thoroughly trained in VFR or visual, seat of the pants flying. Therefore, they are insufficiently experienced when they have to do it as they have developed an over-reliance on automation. You can better believe that training departments all over the industry are working to figure out how to train and test for this.
Jul '10
Re: The Limits of Technology, A Chilling Reminder
READ THIS FIRST
I'm a Marine trained 737 Captain retired from one of the majors. We had Boeing and Airbus. My mates and I have been following this and things came out of this that caused the accident.
1. PIC, Pilot In Command or the Captain, was out of the seat for the whole evolution and tried to manage it without getting into the seat and taking over. Bad plan.
2. This was exacerbated by the fact that he didn't know what control inputs were being made, nor did the pilot not flying, as the side sticks are not connected. In the Boeings when you turn or push back/forward both do it and can be seen to do it. Makes a huge difference.
3. The most complicated thing you can do in an Airbus is fly it by hand. It's very hard to turn off all the automation. In the Boeing you just say, "Screw it", push two buttons, and you're hand flying it. Then you can set a thrust setting and pitch attitude and know you will fly, no matter what the instruments say.
4. They were in moderate to severe WX.
Re: The Limits of Technology, A Chilling Reminder
Mark Wilson
George Savage
If you let go of the stick on an Airbus that is in an unusual attitude, such as the deep stall described above, it will stay there. This is because the computer executes the last command input by the stick: you do not need to maintain pressure on the stick for it to stay put. If you want to lower the nose, you need to command it to do so. Sadly, releasing the controls is insufficient.
A pitch angle CAS makes sense in a high performance fighter, but not an airliner below the stall speed. You'd think the CAS would switch off at that point and require some pilot input to maintain such a ridiculous attitude. It eliminates the natural phugoid mode that would have saved the aircraft in this case.
For the uninitiated, here's a quick overview of a few types of autopilots. George is talking about type 1.1. · 6 minutes ago
And in the Airbus, manual flight is not what most pilots instinctively think of as "manual flight." In a sense, the autopilot never fully disconnects, it just washes its electronic hands of responsibility for the outcome.
Re: The Limits of Technology, A Chilling Reminder
Norm Hapke Jr.: READ THIS FIRST
I'm a Marine trained 737 Captain retired from one of the majors. We had Boeing and Airbus. My mates and I have been following this and things came out of this that caused the accident. · 2 minutes ago
Norm, thank you for the definitive word on this.
May '10
Re: The Limits of Technology, A Chilling Reminder
George Savage
And in the Airbus, manual flight is not what most pilots instinctively think of as "manual flight." In a sense, the autopilot never fully disconnects, it just washes its electronic hands of responsibility for the outcome. · 4 minutes ago
Can you elaborate on "never full disconnects"?
Re: The Limits of Technology, A Chilling Reminder
Mark Wilson
George Savage
And in the Airbus, manual flight is not what most pilots instinctively think of as "manual flight." In a sense, the autopilot never fully disconnects, it just washes its electronic hands of responsibility for the outcome. · 4 minutes ago
Can you elaborate on "never full disconnects"? · 4 minutes ago
Sure. On an Airbus the control paradigm seems to be full autopilot or, following disconnect, roll and pitch hold mode. There isn't what I would think of as a manual hand flying mode.
Dec '10
Re: The Limits of Technology, A Chilling Reminder
George, back in the 1970's we had a small placard on the yoke of a Falcon 20 that read "Pull back to go up, Pull all the way back to go down". To my mind the Airbus is jammed full of all kinds of bad design decisions, but, the pilots should have quickly recognized that a high rate of descent and a high angle of attack ...
Edit: Of course, given the history of the design of the Airbus fly-by-wire computers, it's possible the pilots knew what the problem was and the computer over rode the pilot's corrective actions.
Edited on May 1, 2012 at 7:19amAug '10
Re: The Limits of Technology, A Chilling Reminder
I currently fly the 330 and have 24 years flying in the Air Force. As much as it pains me to say, this was an example of poor pilotage. All pilots are trained to "recognize, confirm, recover". Recognize the situation you're in, confirm with other instruments (to account for erroneous instruments) and recover using appropriate procedures. Unfortunately these pilots failed in all 3 steps. Airplane design is always a tradeoff between various accommodations for human factors, protections, and efficiency. I've found the 330 to be a wonderful airplane to fly, but as with any airplane you have to have an understanding of the design parameters.
Dec '10
Re: The Limits of Technology, A Chilling Reminder
sven, in the Airbus, who has final authority for control inputs, the pilot or the computer? ... I'm asking in the context of the well known Airbus accident a number of years ago at the Paris Airshow.
Mar '11
Re: The Limits of Technology, A Chilling Reminder
I used to be a believer in the Boeing philosophy.
I work in aerospace, and we recently changed the design of our (non-flight-critical) system so that it is always second-guessing the pilot. The alternative was to have something that pilots could, over time, break. And pilots like pushing the envelope.
I know pilots who, on empty ferry flights, loop and roll commercial aircraft. They simply cannot resist.
Apr '11
Re: The Limits of Technology, A Chilling Reminder
I'm an aircraft mechanic, not a pilot. I wrote fairly extensively on this topic about a year ago, when the preliminary investigation report was released. I have no experience on the Scarebus, but I cannot believe, even with multiple instruments blanking out, the pilots did not have an artificial horizon and VVI.
There was a really excellent two-part article in Playboy by Laurence Gonzalez? after American 191 went down, in which some pilots could not fly the simulator into the ground the way it happened in real life. I'm pretty sure that's true for AF 447 as well.
Dec '11
Re: The Limits of Technology, A Chilling Reminder
When problem solving sometimes people miss the basics. We all do it. What I understand of the Airbus that in one mode it is suppose to be impossible to stall but it was not in that mode so disaster struck. Because of the pitch of the airplane slowly bled speed which caused the stall. The road to destruction is usually a gentle decline but in this case it was a gentle incline.
Sep '11
Re: The Limits of Technology, A Chilling Reminder
I have a good friend who is a Delta pilot. He too was unhappy when Delta went back to Airbus, and as someone who was on the International flight schedule he had to learn how to fly them. He hated them for the reasons stated above (can't fully shut off the auto pilot, Captain doesn't really know what co-pilot is doing, etc).
He told us that the Airbus was basically designed by a committee of all the European companies/countries that own it. The plane designers, much like their bureaucratic counter parts, don't seem to trust individuals to make decisions.
Aug '10
Re: The Limits of Technology, A Chilling Reminder
That's a trickier question than you might think since the flight control computer is analyzing all inputs and flight parameters and determining the electrical control input to the actuator moving the control surface. The Airbus is similar to the C-17 in that as long as your flight control input is within a programmed envelope you are in charge. If the computer determines that those crazy pilots are out of control, it will override their input. I can't comment on the modern Boeings but older ones and planes like the C-141 would execute whatever the pilots requested, even if it resulted in a stall or over G etc.
jetstream
sven, in the Airbus, who has final authority for control inputs, the pilot or the computer? ... I'm asking in the context of the well known Airbus accident a number of years ago at the Paris Airshow. · 15 hours ago
Aug '10
Re: The Limits of Technology, A Chilling Reminder
The big difference is "fly-by-wire" versus control cables. In a fly-by-wire, flight data and control inputs are processed by the flight control computer. The autopilot controls the airplane through the flight control computer. I believe this is where the perception that the autopilot "never disconnects" comes from. It would be better to say "the flight control computer never disconnects" as it would be impossible in a fly-by-wire. Most Boeings use the older technology of control cables, when you engage the autopilot, servos take control of the cables. The new 787 uses fly-by-wire so the same "never disconnects" theme will apply. Because everything is routed through the flight control computer, how the aircraft responds to inputs is dependent on the programming of the computer.
May '10
Re: The Limits of Technology, A Chilling Reminder
You're right. In this case it's most useful to talk about virtually disconnecting, which means the flight computer switches controller modes. I don't know the details of the Airbus design but we can discuss control systems generically.
Normally the pilot's stick sends commands to a digital Control Augmentation System (CAS) (stick = blue circle; CAS = green box). The CAS compares the pilot's pitch command against the measured pitch angle from the gyro, and generates commands to the control servos to make the measured angle match the pilot's command (called "closing the loop around the pitch angle").
When the autopilot "disconnects", the pitch controller (CAS) is bypassed and the pilot's stick directly commands the control servo deflections or applied torques (stick = red circle).