Old news but good article by Wm Langewiesche on Air France 447

RotorAndWing said:
Pilot error, plain and simple. The airplane did exactly what it was commanded to do.
Click to expand...

Has anyone said otherwise? Neither the comments nor the article has said the airplane malfunctioned nor that the pilots did not make fatal mistakes.
 
What many here don't understand is when the PF is on the side stick and the PNF moves his side stick there is a loud voice annunciation as well as a caution light on the glare shield flashing. In the simulator when it happens it will definitely get your attention.

All the other pilot has to do is hold down the red button on the side stick and he takes command.
 
Matthew said:
, "Hey, let's think about this for a second", but didn't.
Click to expand...

Yeah, think and observe. The report said GPS groundspeed was alive during the time the pitot was offline. Also, don't commercial transport aircraft have angle of attack indicators? Lots of clues that were not observed.
 
RotorAndWing said:
Pilot error, plain and simple. The airplane did exactly what it was commanded to do.
Click to expand...
I'm not so sure it's "plain and simple."

The crew is a part of a pretty complex system. Yeah, the crew is ultimately responsible for putting the airplane into the ocean, but the rest of the system (controls, software, training, ...) and design philosophy has to be considered for its contribution.
 
RotorAndWing said:
Pilot error, plain and simple. The airplane did exactly what it was commanded to do.
Click to expand...

No argument from me.

But....

There was a design feature that, in an extreme corner, contributed to the accident.

The FMS was giving a stall warning as the co-pilot held the stick back, until it reached an angle of attack so high that the FMS assumed it was a measurement error...and stopped the stall warnings.

From that point on, as long as the co-pilot held the stick all the way back, the stall warning didn't sound. As soon as he relaxed back pressure...the stall warning would start again.

This is basically negative feedback, encouraging a panicked pilot to continue with the stick jammed back. Yes, the pilot SHOULD realize what's going on...but the capability for logic tends to flee in high-stress situations.

Not sure how to fix it, though. Even if the FMS continues the stall warnings once it assumes measurement error, that might tend to bite on cases where there actually IS a problem with the sensors.

Ron Wanttaja
 
jesse said:
The logic is that if they're going to build a FBW airplane with side sticks way apart it's easier to do what they did and it works fine 99.9999% of the time...
Click to expand...

When Boeing designed the 777 they listened to what pilot's said they wanted in a FBW aircraft and they wanted a traditional yoke. In order to accommodate that an elaborate system of back-drive actuators had to be installed under the cockpit floor. The yokes do not move because they are connected to the controls, they move because the computer is commanding them to at the same time it is commanding the flight control surfaces to move. The same is true on the 787.

On an Airbus, when the autopilot is in control the sticks and rudder pedals do not move so there is no tactile indication, everything is on the screens and this has been criticized but it would not be an easy thing for Airbus to change that feature.

In the AF447 incident I can agree that the autopilot did just drop the ball and say "I have no idea what is going on, it's your airplane" All of the points discussed in the article are valid and you really could call it a conspiracy of circumstances but my thought is that it should have been impossible for all three pitot tubes to freeze over like that on what was essentially a routine encounter with weather. It shouldn't have happened.
 
RotorAndWing said:
What many here don't understand is when the PF is on the side stick and the PNF moves his side stick there is a loud voice annunciation as well as a caution light on the glare shield flashing. In the simulator when it happens it will definitely get your attention.
Click to expand...
That was brought up in the article which mentioned that the artificial voice was saying "DUAL INPUT" at various points. But maybe the pilots were too overloaded to notice or pay attention.

RotorAndWing said:
All the other pilot has to do is hold down the red button on the side stick and he takes command.
Click to expand...
What if both pilots are holding down on their respective red button?

Guessing that you have never worked for Air France, but as an Airbus pilot, what kind of training are you given about this feature of the sidesticks and how it differs from "normal" controls which work in unison on both sides?
 
Where Rotor is disconnecting is common. When a pilot makes a mistake and bites the bullet other pilots look at that and say that pilot botched it plain and simple.

Engineers look at the problem with a different light. Because pilots will make mistakes and systems are designed to limit the possibility of those mistakes they analyze what about the systems may have contributed to that pilot making a stupid mistake and what could change with the systems to stop the next equally bad pilot from doing the same.

They were overloaded, confused, and obviously not the best Bus drivers in the world. The systems were a contributing factor to pushing the poor pilots past their limits. I do think the pilots screwed up and I personally think the largest contribuiting factor to the pilots being unable to recover with their poor skills was the dual stick disconnect design. Yes better pilot training would have prevented it but that doesn't mean you ignore all the contributing factors. Instead you analyze and study and correct the systems related human factor problems on the next design.

Modern CRM and training is not the result of the RotorWing captains of the past deciding things needed to change. It was the result of various system designers and human factor academic folks recognizing the problem and convincing the airlines over time things needed to change.
 
Last edited:
wanttaja said:
Not sure how to fix it, though. Even if the FMS continues the stall warnings once it assumes measurement error, that might tend to bite on cases where there actually IS a problem with the sensors.
Click to expand...
The article mention there was no AOA display, I think this in addition to the generic stall warning would help in either case.
Maybe the FMS should give pilots instructions like "AOA 10 degrees, STALL STALL, LOWER NOSE" for those situations where pilots freeze up.
And the lockout should be in the center, 1 switch only, so if one pilot takes control the other will know it and not be able to take it back without taking an overt action.
 
RotorAndWing said:
Lots of speculation from folks who don't have a clue as to how an Airbus operates, much less ever sat foot in an Airbus cockpit. :rolleyes:
Click to expand...
Certainly applies here.
RotorAndWing said:
Many are trying to fault the airplane, the airplane did exactly what it was commanded to do.

The many variations of Airbus (318/319/320/321/330/340/380) have flown hundreds of thousands accident/incident free hours. As with any highly complex machine, it takes a well trained and disciplined crew to operate it.
Click to expand...
Excellent points.

Need to be careful not to fall into the same thinking that Langewische attributed to French aviation culture, "the pilot is never at fault". I recall that in the final report (there were 2 final reports I think, 1 from some international body and the other from the NTSB ), there was some discussion about the crew not fully understanding the nature of Alternate Law.

I'm thinking that independent of whether it is well designed or not, it would seem critical that pilots maintain a deep understanding of it. Just like transport pilots of old were drilled on memorizing details of electrical and mechanical system speeds and feeds.

...but no experience here, just what I can recall from reading. :rolleyes2:
 
wanttaja said:
No argument from me.

But....

There was a design feature that, in an extreme corner, contributed to the accident.

The FMS was giving a stall warning as the co-pilot held the stick back, until it reached an angle of attack so high that the FMS assumed it was a measurement error...and stopped the stall warnings.

From that point on, as long as the co-pilot held the stick all the way back, the stall warning didn't sound. As soon as he relaxed back pressure...the stall warning would start again.

This is basically negative feedback, encouraging a panicked pilot to continue with the stick jammed back. Yes, the pilot SHOULD realize what's going on...but the capability for logic tends to flee in high-stress situations.

Not sure how to fix it, though. Even if the FMS continues the stall warnings once it assumes measurement error, that might tend to bite on cases where there actually IS a problem with the sensors.

Ron Wanttaja
Click to expand...


Actually it's the FMGS (flight management guidance system).

The manufacturer has to assume the pilot would realize an extreme attitude and how it would relate to a stalled condition. At some point basic airmanship has to kick in.
 
teejayevans said:
The article mention there was no AOA display, I think this in addition to the generic stall warning would help in either case.
Click to expand...

FLIGHT CREW BULLETINS
CHARACTERISTIC AND PROTECTION SPEEDS
A318/A319/A320/A321 FLEET FCB-FCB17 P 1/6
FCOM A → 08 NOV 12
CHARACTERISTIC AND PROTECTION SPEEDS

INTRODUCTION
The different speeds displayed to the crew on the main cockpit interfaces: PFD, MCDU, ND are computed by the FACs, the FMGCs and the ADIRS.
PFD MCDU PERF PAGE FAC COMPUTATION FMGC COMPUTATION
Computed on current aircraft status and configuration. Computed for take off, go around and landing.
VLS
F
S
"O" Green Dot
Vαprot
Vαmax
Vsw (stall warning speed)
VLS of the selected landing configuration.
F
S
"O" Green Dot
Each FAC computes its own speeds which are displayed on the relevant PFD:
FAC 1 on side 1,
FAC 2 on side 2.
Each FMGC computes its own speeds displayed on the relevant MCDU:
FMGC 1 on side 1,
FMGC 2 on side 2.
The algorithms used to compute the characteristic speeds are the same in both FAC and FMGC
but as the inputs are different, the resulting values may differ.
CHARACTERISTICS SPEEDS COMPUTED BY THE FAC
The FAC computes its characteristic speeds with 2 main inputs from ADIRS (Angle of Attack (α) and calibrated airspeed (Vc)). It also uses THS position, SFCC data and FADEC data.
From these inputs, the FAC computes a stall speed Vs which is used to determine the aircraft
weight.
The following sketch gives the basic architecture for FAC speed computation.

320fmgs_zps7ad2d469.jpg
Click to expand...


teejayevans said:
Maybe the FMS should give pilots instructions like "AOA 10 degrees, STALL STALL, LOWER NOSE" for those situations where pilots freeze up.
And the lockout should be in the center, 1 switch only, so if one pilot takes control the other will know it and not be able to take it back without taking an overt action.
Click to expand...

From the A319/320 FCOM:

AIRCRAFT SYSTEMS
FLIGHT CONTROLS
FLIGHT CONTROL SYSTEM - CONTROLS AND INDICATORS

A318/A319/A320/A321 FLIGHT CREW
OPERATING MANUAL

Sidestick priority logic
‐ When only one pilot operates the sidestick, it sends his control signals to the computers.
‐ When the pilots move both side stick simultaneously in the same or opposite direction and neither takes priority, the system adds the signals of both pilots algebraically. The total is limited to the signal that would result from the maximum deflection of a single sidestick.
Note: In the event of simultaneous input on both sidesticks (2 ° deflection off the neutral position in any direction) the two green SIDE STICK PRIORITY lights on the glareshield come on and “DUAL INPUT” voice message is activated.
A pilot can deactivate the other stick and take full control by pressing and keeping pressed his priority takeover pushbutton.
For latching the priority condition, it is recommended to press the takeover push button for more than 40 s.
This allows the pilot to release his takeover push button without losing priority.
However, a pilot can at any time reactivate a deactivated stick by momentarily pressing the takeover push button on either stick.
If both pilots press their takeover pushbuttons, the pilot that presses last gets priority.
Note: If an autopilot is engaged, any action on a takeover pushbutton disengages it.
In a priority situation
‐ A red light comes on in front of the pilot whose stick is deactivated.
‐ A green light comes on in front of the pilot who has taken control, if the other stick is not in the
neutral position (to indicate a potential and unwanted control demand).
Click to expand...
 
Last edited:
jesse said:
These guys couldn't read their attitude indicator. No way they could process the control stick system.
Click to expand...

I have flown the AF447 scenario in the simulator. By applying basic airmanship and systems knowledge it wasn't that difficult to correct the situation.
 
RotorAndWing said:
I have flown the AF447 scenario in the simulator. By applying basic airmanship and systems knowledge it wasn't that difficult to correct the situation.
Click to expand...

Did you know ahead of time what the scenario would be?
 
jesse said:
These guys couldn't read their attitude indicator. No way they could process the control stick system.
Click to expand...

Not to mention it was nighttime, in marginal weather, and they had cabin lights on much of the time. They probably could not see a horizon outside to give them the visual cues they would need to figure out the attitude if they were going to ignore the instrumentation.
 
If each pushed the takeover button, and didn't know the other did, too...

It says the pilot that pushes the button last gets priority. I read that there are red/green lights to indicate who has the airplane, but in a busy emergency situation I wonder how easy it is to either miss those lights, or dismiss them as being lower priority than another warning message.

I can see where one pilot may take over by pressing his button, the other guy wonders why his stick isn't working so he re-presses his button and resumes control, the other guy doesn't realize he's lost control, ...

Not likely to happen if someone were to say "I have the airplane" and the other were to let go of the controls. But both and the stick in hand.
 
Matthew said:
If each pushed the takeover button, and didn't know the other did, too...

It says the pilot that pushes the button last gets priority. I read that there are red/green lights to indicate who has the airplane, but in a busy emergency situation I wonder how easy it is to either miss those lights, or dismiss them as being lower priority that another warning message.

I can see where one pilot may take over by pressing his button, the other guy wonders why his stick isn't working so he re-presses his button and resumes control, the other guy doesn't realize he's lost control, ...

Not likely to happen if someone were to say "I have the airplane" and the other were to let go of the controls. But both and the stick in hand.
Click to expand...

Well, for me when I see the annunciation on the glareshield and I hear the “DUAL INPUT” yelling at me I get the message pretty quick.
 
RotorAndWing said:
Well, for me when I see the annunciation on the glareshield and I hear the “DUAL INPUT” yelling at me I get the message pretty quick.
Click to expand...
It does sound like it would be hard to ignore.

From the article, and apparently from the data/voice recorders, that notice was being given several times.
 
RotorAndWing said:
What many here don't understand is when the PF is on the side stick and the PNF moves his side stick there is a loud voice annunciation as well as a caution light on the glare shield flashing. In the simulator when it happens it will definitely get your attention.

All the other pilot has to do is hold down the red button on the side stick and he takes command.
Click to expand...

Yes, the article said that. The article also said both pilots pressed their priority switches. You are not adding to the discussion.
 
wanttaja said:
The FMS was giving a stall warning as the co-pilot held the stick back, until it reached an angle of attack so high that the FMS assumed it was a measurement error...and stopped the stall warnings.
Click to expand...

I am not sure it was so much a measurement error as a a design error. You don't want the stall warning blaring at you during takeoffs and landings so the designers just inhibited it below a certain speed. The rationale was that no one would ever be that slow inflight.

Well they were proven wrong. I think a solution to that would have been to put the stall warning indication on the "Air/Ground" switch. When the airplane sensed it was on the ground the warning would be inhibited and when it was in the air, it would be active.

That might have induced other issues, but I am not the designer.
 
Everskyward said:
What if both pilots are holding down on their respective red button?
Click to expand...

Ok, its been awhile but: The last button pushed has control. And if I recall, that pilot only has sole control as long as the button is pushed. IOW, both pilots can have control if neither button is pushed, but only the pilot that pushed AND HELD the button last has control in that case

Guessing that you have never worked for Air France, but as an Airbus pilot, what kind of training are you given about this feature of the sidesticks and how it differs from "normal" controls which work in unison on both sides?
Click to expand...

Well, the idea in any multi crew operation is that only one pilot at a time can operate the controls. A positive transfer of controls must happen for the other pilot to take control. That obviously did not happen in the AF deal. So in an ideal world two pilots would not be operating the controls at the same time.

To answer the specific question, we were trained in the positive transfer of controls and that the controls don't work in unison. Not much more.
 
Matthew said:
It does sound like it would be hard to ignore.

From the article, and apparently from the data/voice recorders, that notice was being given several times.
Click to expand...
Well both ignored it.Maybe it's a french thing...check this video out of a gear up landing...
https://www.youtube.com/watch?v=5McECUtM8fw
BTW: if someone speaks french, can you translate?

As far as doing this in a simulator...the simulator doesn't simulate the pressure.
 
Last edited:
Greg Bockelman said:
I am not sure it was so much a measurement error as a a design error. You don't want the stall warning blaring at you during takeoffs and landings so the designers just inhibited it below a certain speed. The rationale was that no one would ever be that slow inflight.

Well they were proven wrong. I think a solution to that would have been to put the stall warning indication on the "Air/Ground" switch. When the airplane sensed it was on the ground the warning would be inhibited and when it was in the air, it would be active.

That might have induced other issues, but I am not the designer.
Click to expand...

Agreed. Most of us sit in a Cessna or Piper at slow speeds and the stall warning doesn't blare at us. A stall warning detects a stall. It's been drilled into us from the beginning that a stall can happen at any speed, and any attitude. However, once we get into a stall, the warning is there, continuous until we take actions to resolve it, or crash(stalled).

The point is that the stall warning in this case wasn't an accurate representation of the actual world. The plane was in fact stalled, but the stall warning wasn't blaring while the plane was deep in a continuous stall. For my money, if the stall warning doesn't represent the real world then it's not doing it's job. I don't care what speed or attitude they were at, the plane was stalled, and the annunciator didn't represent that fact accurately.
 
I just wonder ...

Instead of (or perhaps in addition to) recurrent simulator training in the Big Airplane a recurrent regimen of 2 hours dual glider and 2 hours dual aerobatics might take a few more of these sorts of accidents away.

Just a thought, mindya ...

Jim
 
wanttaja said:
There was a design feature that, in an extreme corner, contributed to the accident.
Click to expand...

The extreme corner was a direct consequence of the pilot's initial action. Enough to cause the airplane to pass all the way through the stall speed regime the engineers thought reasonable to report. Pitot tube icing did not pitch the aircraft up - the pilot did.

Both before and after the AF 447 accident it was found that other incidents of pitot icing and loss of speed indication had happened - and the pilots in those cases followed procedures and nothing bad happened. One summary is here: http://www.aviationtoday.com/regions/usa/More-Pitot-Tube-Incidents-Revealed_72414.html#.VCM0ChZuUUo

The pilot's initial reactions were wrong to start with. He may have been among the small percentage of pilots at the ATP level who would not only react that way but the same flawed thinking also may have allowed him to become a component of a "negative feedback" loop. It doesn't sound like the other two pilots were articulate enough or aggressive enough to sever the negative feedback loop.
 
In a Sim, if you screw up, you don't die. THAT is the "pressure" (psychological).
 
Just watched a program on cars trying to beat trains at train crossings. The crossings have all of the latest technology, signs, lighting, bells, etc., but a few people still try to ignore all of that and attempt to beat the train, usually with dire results.

Who should we blame? The municipality who controls the crossing? The engineers that designed the crossing? The company that built the crossing guards? How about the driver that ignored training and decided to try to get across?

Should we build crossings with more restraints? More warnings?
 
jesse said:
These guys couldn't read their attitude indicator. No way they could process the control stick system.
Click to expand...
Where's the hue and cry to change attitude indicators since pilots have been known to misintrerpret indications? Why aren't F-16B/D/F models, with non-interconnnected sticks, falling out of the sky due to failure to relinquish control? I'm somewhat limited in what I can say regarding the specifics of this accident but I encourage everyone basing their opinions solely on the referenced article to read the accident investigation final report and revisit their convictions. The article isn't bad but does simplify and editorialize a bit and the technical details are important. Suffice it to say there is no system, mechanical, analog, digital, natural, that can prevent a determined individual from digging a hole so deep they can't climb out of it.

Nauga,
and his professional decorum
 
Last edited:
RotorAndWing said:
Just watched a program on cars trying to beat trains at train crossings. The crossings have all of the latest technology, signs, lighting, bells, etc., but a few people still try to ignore all of that and attempt to beat the train, usually with dire results.

Who should we blame? The municipality who controls the crossing? The engineers that designed the crossing? The company that built the crossing guards? How about the driver that ignored training and decided to try to get across?

Should we build crossings with more restraints? More warnings?
Click to expand...

False comparison.

You could say the same thing about microbursts. Pilots should just watch the damn wind and go around when it indicates a microburst pattern, say a sudden increase in airspeed with thunderstorms in the vicinity.

Instead, we got windshear radar, and microburst accidents almost went away.

In this accident, as in most, there were many contributors. Was it Airbus' fault? Certainly not. Could Airbus do something differently? Yes. Human factors are arcane, and extremely difficult to predict without in situ experiments. Even with such experiments, there is a huge amount of variability.

The primary fault was a clearly disoriented pilot. Important secondary faults were poor CRM, poor interface, and especially poor transfer of controls.
 
Well, here is a link to the final report BEA Final Report on AF 447 Go to page 197 and/or 199 to get to the meat of the findings.

Interesting references to "startle effect" (think pressure)

Though the AP disconnected, the display of the flight director (AP commands) remained. That could be confusing.

However, no matter how it's spun, it's pilot error. But since the pilots are never to blame, it's a training problem, including stall detection and recovery - sounds familiar doesn't it?

I come away thinking that highly trained, experienced, and disciplined crews made up of intelligent and motivated individuals would never have made such a cluster of mistakes.

But how does the industry continue to attract such individuals to operate aircraft that increasingly require so little of their ability? Seems like the training is much more challenging than actual operations.
 
Last edited:
Bill Watson said:
Though the AP disconnected, the display of the flight director (AP commands) remained. That could be confusing.
Click to expand...

That's normal operation. The Flight Director is independent from the Autopilot.

Bill Watson said:
However, no matter how it's spun, it's pilot error. But since the pilots are never to blame, it's a training problem, including stall detection and recovery - sounds familiar doesn't it?
Click to expand...

Yep.


Bill Watson said:
I come away thinking that highly trained, experienced, and disciplined crews made up of intelligent and motivated individuals would never have made such a cluster of mistakes.
Click to expand...

Agreed.
 
This accident for me is just a shining example of why I am ALL for the 1500 hr requirement. You take someone rapidly thru beginning stages of flight and put them into automation and viola ! You get guys like this and guys like we had on the Colgan flight. In both instances they had much more than 1500 hours but they never had any time to build any kind of foundation. Or rather the training curriculum did not think to allow for it.

These guys were systems managers not pilots. When something went wrong they sought to find the system's solution instead of falling into the most basic mode and flying the aircraft. They didn't know how to fly with their butt like you guys do, to really "feel" the aircraft. All of that had never been allowed to take root in them by virtue of their training curriculum.

Ideally nobody wants to spend eleven or twelve hundred hours being a flight instructor but whether you believe it or not - you sure learn a lot from it. You don't see that going into it but you're never sharper than when you're doing it every single day. And I'm not talking about just VFR private pilot training. I'm talking about instrument instruction and multi-engine work too. It all builds a pretty strong visceral Aviator - which is just what we really want to have up front.
 
Last edited:
Greg Bockelman said:
Ok, its been awhile but: The last button pushed has control. And if I recall, that pilot only has sole control as long as the button is pushed. IOW, both pilots can have control if neither button is pushed, but only the pilot that pushed AND HELD the button last has control in that case
Click to expand...
I see, thanks.

Greg Bockelman said:
Well, the idea in any multi crew operation is that only one pilot at a time can operate the controls. A positive transfer of controls must happen for the other pilot to take control. That obviously did not happen in the AF deal. So in an ideal world two pilots would not be operating the controls at the same time.
Click to expand...
But in their confused and panicked state that obviously didn't happen. With controls which work in unison you could see or feel what the other pilot is doing if they were pushing or pulling against you.

Greg Bockelman said:
To answer the specific question, we were trained in the positive transfer of controls and that the controls don't work in unison. Not much more.
Click to expand...
I wonder if the training is any different now that this has happened.
 
Matthew said:
It does sound like it would be hard to ignore.

From the article, and apparently from the data/voice recorders, that notice was being given several times.
Click to expand...
Are the words "DUAL INPUT" in English? How often do they hear this spoken? Probably not much. Wondering if language could have also been a problem.
 
You must log in or register to reply here.
Back
Top