> The captain then acted, most probably by reflex action, on the control column to reduce this pitch attitude without taking back the controls and making the procedure call-out, based on the principle of only one pilot having the controls. The two pilots then simultaneously made inputs on the controls. The pitch controls were desynchronized for 12 s due to opposing forces
It sounds like Air France has still not trained their pilots on proper cockpit discipline. This already proved fatal before (AF 447).
Even without training, I don't see how the pilots could make this error, I am sure every pilot at Air France is very much aware of how AF447 happened. I am a bit puzzled how they managed to basically replicate it.
Doing the right thing once is fairly easy, doing the right thing 100,000 times is vastly harder. The issue is the UI around dual inputs not lack of training or awareness.
People say this to downplay what flying an airliner is like, but driving a bus is hard! They're huge, have lots of inertia, you've got dozens of lives in your hands, some systems complexity, schedule pressure, a percentage of whacko passengers (and no crew to help) and that's on top of the day-to-day lunatics with whom you have to share the road. I'm sure your friend is being humble and is perhaps romanticizing the stick-and-rudder days; I still think it says more about how difficult it is to drive a bus rather than how easy it is to fly an airliner.
As a passenger, the real problem with flying nowadays is that it's quite a lot like riding the bus.
One of the impressive things about flight 1549 is how quickly captain Sully declared “my aircraft” which was immediately acknowledged by copilot Skiles.
Well it seems that in this case the problem stopped immediatly after the captain said my aircraft. The problem if I understand the report is that before that he was applying inputs even though he wasn't supposed to fly.
I don't want to minimize pilot errors but I can't stop thinking this dual inputs system easily ranks in the top 5 of the worst design ideas in history.
Say one pilot loses consciousness, the other one has to extract them from their seat before they can fly the airplane. That's no easy task - humans are surprisingly heavy once they pass out.
Three pilots with a voting algo, obviously. Or, maybe, a supreme court of nine pilots all constantly and continuously in search of perfect aerodynamic justice. Ah hell, just let ChatGPT fly the damn plane.
Edit: I've got it! We'll have a single pilot but they'll be based on a Rust rewrite of ChatGPT running on RISC-V.
By "dual input system" I was referring to the fact that both pilots can apply input into their sticks or trim wheels simultaneously resulting into inputs cancelling each other out or de-synchronizing.
Agreed, that seems like a really bad design. At the very least there should be an alert whenever the system detects that both pilots are touching the controls.
Airbus has had a Priority Takeover button, from the start, I assume Boeing also has something like that. Its primary use case is exactly what you’re talking about, although it also disables autopilot so it’s a good way to ensure you have manual input in case you need to react quickly.
Airbus has a dual input alert, apparently Boeing doesn’t, and didn’t add it after this incident, blows my mind. Still they’re far from perfect, stress deafness is absolutely a thing.
Active sticks (force feedback) are finally making it into commercial cockpits, they’ve been deployed in business jets, and the Irkut MC-21 was supposed to be the first implementation in an airliner (as it’s french-made, that’s been sunk by the Russian invasion of Ukraine and subsequent economic blockade).
This means hopefully active stick swill make it into big two airframes eventually. I assume there’s some redesign work ongoing as it likely requires additional power and data connection, AFAIK currently the sticks (Airbus’s anyway) are just centered and resisting via springs, I don’t think there’s any data fed back into the sticks.
Active sticks have been in development for decades. They’re getting deployed on civilian crafts these days e.g. Gulf Stream’s top of the lines jets (though retrofitting them on existing planes is likely a ways away still).
I would assume the issues are / were around reliability, failure modes, certification and training rather than patents.
The force feedback is applied by the "feel computer". On the 757 it's a hydraulic device designed to apply forces to the control column simulating the forces on the control surfaces.
> Airbus (surprisingly I think) didn’t have any sort of dual input alert
They did (and I think from the start, because unlike on Boeing's controls which are mechanically linked, there's no easy way of knowing the other pilot is inputting). From the wikipedia article of the crash:
> The inputs cancelled each other out and triggered an audible "dual input" warning.
I always hate findings of "pilot error." Like you, I don't want to minimise it, but it never feels like it gets to the root cause. It often feels a bit like scapegoating. Why did highly trained, presumably competent pilots make the error? How can it be avoided in the future?
As you say, UI design choices can make errors more or less likely. Absolutely everyone makes mistakes. We need to design to reduce the likelihood of mistakes and to minimise the impact of mistakes when they do happen.
To be clear, I think everyone in the industry understands this, but when reported in the media, the average public just hears, "Pilots f'ed up," which is almost never a complete picture.
Sometimes it really does come down to sheer stupidity or incompetence.
Taking the recent incident at HND earlier this month between a JAL A350 and JCG DHC-8, the investigation (currently still ongoing) is pointing to the JCG Captain astronomically fucking up:
* ATC ordered the JCG DHC-8 to hold short of the runway and informed them they were #1 in the take off queue. Take off clearance was never given.
* The First Officer of the JCG DHC-8 read back the order to hold short and their position in the queue.
* JAL A350 had clearance to land and (along with other aircraft) listened in to the above conversation, routine stuff to help maintain situational awareness.
* The Captain of the JCG DHC-8 entered the runway, violating order to hold short, and sat there for approximately 40 seconds until they were struck by the JAL A350.
ATC, JAL, and even the JCG First Officer all did things right and yet all it took was apparently one Captain screwing up.
Yes, there were compounding factors like how it was nighttime and all the airport lights flooded out the JCG DHC-8's lights, but pilot error is the only reasonable way of ultimately explaining incidents like this.
So, I would say that pilot error is a primary factor in this case. But, that still leaves open the question of why the error occurred and whether there is anything we can do to reduce the probability of it happening again. I highly doubt the Captain is simply stupid or incompetent given all of his experience. Perhaps, the crew was overly fatigued? People make mistakes, sometimes big ones. The question is how to reduce mistakes and how to limit damage from those mistakes.
There was an IBM article a while back advocating for '5 Hows' as a replacement for '5 Whys' with this logic. How was it possible for this to happen and that should be the root question that drives improvements. Pilot error should effectively be a non-option for root cause.
Also important is that there is no single root cause for any event. Therefore there is no single 'error' that could be attributed to any one root anyway (in particular the pilot).
Just to point out, but aviation accident investigations do not use '5 Whys' or any dumbed-down framework like that.
They go and list everything that went wrong, without even a lot of concern for causality. They also list all reasonable points of improvement, regardless if they were important for this one incident or not.
Human error is always there, of course. But the idea that they are blaming this on the human is wrong. They are not blaming anything on anything.
Sometimes it's really just pilots being incompetent or drunk - cf. Aeroflot Flight 821 and Aeroflot Flight 593 as good examples (not exclusively a Russian/Aeroflot thing, but they have particularly egregious examples.)
And how is it that incompetent or drunk people are allowed to fly airplanes? That is still only a proximal cause of the failure; there are systemic issues if this is something that happens with any kind of frequency at all.
The system has humans and computers (the airline is a cyborg!) so human incompetence is definitely up there as a failure mode.
The pilot should not be drunk.
The pilot’s boss should not have let him onto the airplane while drunk.
That guy’s boss should have ensured that they breathalyze every pilot. And so on up the chain to the owners of the airline, who should appoint a CEO who can get the job done.
Breathalyze every pilot? Really? That sounds like a depressing, degrading work environment, which, when combined with the taboo against seeking mental health treatment as a pilot, might contribute to an increase in on-the-job suicide attempts.
In aviation, every knob you turn has at least two effects.
> Why did highly trained, presumably competent pilots make the error?
Confirmation bias is really hard to break. When you're in a situation and start telling yourself a story about what's going on, it's really hard for even break that narrative, even when the "you're being an idiot" light turns on.
Aircraft investigations don't really work like pointy-haired-bosses who want a single simple answer for every problem. They do have nuance and list everything that contributed to the problem. Humans err frequently, and this is definitely a case where humans contributed. Dual input is a very fundamental violation of basic pilot training. While there may be systematic changes that could be made to improve it, pilot error absolutely should be on the list as well.
> when reported in the media, the average public just hears, "Pilots f'ed up,"
Unfortunately, for a mass media audience, this is unavoidable. People are always looking for "the answer". To understand nuance in a specialized field, most people will need an overview of the problem set to grasp the topic. Really you'd need more of a 60 Minutes type exposé to explain that; it's too much for a typical news report.
There should never be a 'net' input. Only one pilot can fly a plane at a time. This is fundamental training for pilots, they would have learned this in the very first few moments they sat behind the controls.
Dual inputs is there for redundancy in case of a jam in one of them, or in case one set of cables is cut. Everything is dual.
The reason pilots are there is to diagnose problems and take the right corrective action. This also means they can misdiagnose problems and take the wrong action. This is where pilot training comes in.
> The two pilots then simultaneously made inputs on the controls for 53 s. The pitch controls were desynchronized for 12 s due to opposing forces.
Does anyone know what "The pitch controls were desynchronized for 12s" actually means? and was this a system response to the two controls having opposing forces, or an unexpected result of it.
It means one was trying to increase pitch angle (trying to climb?) and one was trying to do the exact opposite. They were canceling each other’s inputs.
it's an "interesting" difference between Airbus and Boeing - on Boeings the input is averaged between both pilots. So if one is giving it maximum tilt left, the other maximum tilt right, the airplane doesn't move.
On an Airbus both sticks have to mave in unison, they are physically linked.
Wasn't the problem here that Boeing is only linked if no great force is applied and also switches to the average it the force difference is large enough, and that it didn't really document that behaviour?
I thought it was the other way around, which is what led to the AF447 flight crashing — the other pilots didn't realize what the one in control was doing?
> The inputs cancelled each other out and triggered an audible "dual input" warning.
I think you're getting your aircraft manufacturers mixed up. On all modern Airbus airliners, there is no physical link between the two pilots' controls at all. On Boeing aircraft, the controls are physically linked and both move even when one pilot is making inputs. On the 777-300ER, if both pilots are making inputs, and those inputs differ enough, then the physical link can be disabled and then the inputs are considered "desynchronized" and only then to the inputs become averaged.
> then the physical link can be disabled and then the inputs are considered "desynchronized" and only then to the inputs become averaged.
My understanding is that it always averages the input, even when they're not desynchronized (but obviously, since the inputs are equal in that case, the average ends up being equal to the inputs themselves).
No, it's the opposite. Airbus does not use active side sticks; you get no haptic feedback from the other pilot. You do get an aural warning, "dual input," if split control inputs are detected, and each stick has an override button against the other side. See here[0].
Boeing's control columns are mechanically linked, but given (iirc) 50 lbs of force, they will mechanically desynchronize. If memory serves, they will snap back into sync once the force is released. I don't recall there being an aural warning for this.
The issues with Airbus's approach are that (a) in high-stress environments, aural warnings are the first ones to be unconsciously ignored, and (b) you get no haptic feedback, either from the other pilot's side stick, or from the control surfaces (since modern Airbuses are FBW, though you could still do electronic feedback via an active side stick). There's some talk of Airbus moving to active side sticks in the future to mitigate this issue.
The issue with Boeing's approach is that in a high-stress, tunnel-visioned situation, you can't tell another pilot's input feedback apart from something like jammed flight controls, a runaway stabiliser, or any other trim or autopilot malfunction, to name a few. There's also some talk of Boeing moving to active side sticks in the future to mitigate this issue.
Note that here a breakout is exactly what happened and the behaviour of the controls in case of breakout is similar to Airbus’s:
> in the event of antagonistic inputs exceeding the breakout mechanism’s activation threshold, the controls would be desynchronised and the control surface would react according to the mean control position.
The breakout threshold is 50lbs, but it’s the combined thresholds, so sudden opposite force applied by two pilots (as apparently happened here) can unexpectedly trigger it. The report confirms there is no warning of breakout situation whether visual or aural.
What a horribly confusing control mechanism. It could become very hard to distinguish between (1) desynchronization (2) your copilot yielding control to you and (3) a control jam being overcome. They would all feel exactly the same. Not the sort of ambiguity you would want in an emergency situation!
I'd like to think that people designing this aren't idiots - they are very well trained intelligent engineers. And probably the reason why this method was chosen was because it has some objective advantages over any other method. I don't know what those advantages might be, but I really hope they exist.
> I don't know what those advantages might be, but I really hope they exist.
The advantage is obvious: it's the most similar to how it worked back when the controls were fully mechanical.
IIRC, some old planes even had each side mechanically controlling independent halves of the control surfaces, such that the end result is the average of the inputs in case one of the control surfaces (or the cabling connecting to the controls) is jammed.
Stick shaking is already used for stalls, and only for stalls (ok, specifically, it activates right before a stall, but for all intents in this argument, that's the same thing).
Pilots are trained very thoroughly to react to stick shakers in one specific and immediate way -- execute the stall escape manoeuvre, and that's to immediately, with only very minimal instrument scanning (typically, just check altitude and airspeed), apply power and push nose down to the extent the surrounding terrain will allow you.
I do agree that dual input could be better handled, but I doubt we'll see many big leaps in that area until active side sticks become the norm. For Boeing aircraft with yokes, I can't see a good solution. Maybe have some kind of hard-to-miss, single-purpose visual indicator on the glare shield, like where Airbus puts theirs? Or an alert when the two control columns get unlinked?
Also, to be clear -- stick shakers are a Boeing-only feature. Airbus has an aural, but very distinctive "STALL, STALL" warning, plus flight envelope protection provided by the FBW system. Alpha floor protection (A.FLOOR) is the subsystem responsible for preventing stalls.
EDIT: ya know, maybe as HUDs get more widespread in civil aviation there might be better ways to surface this information. Fundamentally, we can only alert pilots in so many ways based on the five major senses, and with taste and smell being out, that leaves aural, haptic, and visual indicators.
Aural and haptic are sort-of out for the reasons outlined above, and visual indicators have to resort to being easily parseable in peripheral vision, since if a pilot's in a high-stress situation they may be looking out the windshield first. That's why it makes sense to put urgent stuff on the glare shield; it's easier to see it out of your peripheral.
With HUDs, these indicators can be more information dense. Instead of a green light or an arrow indicating dual input or stick priority, you can have DUAL INPUT flash over the centre of the HUD.
Most modern HUDs have the drawback of being monochrome green, which is a limiting factor on information density here.
- airbus controls are not mechanically linked, save possibly on the A300 (which has a yoke not side-stick), but there’s less than 200 of these still flying
- airbus sticks have a priority / takeover button, but by default dual inputs are averaged (this is also what happens in Boeings when you trigger a breakout apparently)
It appears that the two controls are physically linked, but have a 'fuse' mechanism. When the two pilots apply lower forces to their controls, the forces are transferred between the controls and they 'fight' each other to move the sticks. After a certain threshold (50 lbs?), the two controls move independently.
In all cases, the flight computer works of the average of the two sticks. When they are in sync, this works great. In a situation like this one, where the pilots are pushing in opposite directions, the average will all of a sudden, be quite different from both controls.
I would have hoped for Boeing to add a warning system in the case of dual input, like in Airbus aircrafts, but it seems they did the bare minimum here. Simple warnings were added to the pilot hanbook that basically amount to "don't apply opposite inputs".
This seems to be the core reason why pure capitalism is a failed concept. There must be regulatory oversight to ensure that what is done MOST RIGHT and not CHEAPEST.
Thinking that "fuck it, we'll risk loss of human life and possibly having to shut down the company" isn't due to capitalism, it's psychopathy and I'm fairly sure that never happened.
Anything that goes wrong is due to dysfunctional management, not greed.
Ford literally did a cost/benefit analysis for fixing the Pinto versus societal costs of injuries and deaths, and went with the cheaper option. They actually put it to paper and sent that to the NHTSA to argue against fuel system regulations.
“Dysfunctional management” is a direct function of managerial incentives, which is generally capitalistic greed (aka “obligation to maximize shareholder value”)
Every auto manufacturer does the same thing. The Ford Pinto case was particularly poorly handled. But for any given car design, it's always possible to further improve safety by making it more expensive. A Mercedes-Benz S-Class is far safer than a Nissan Sentra by any objective standard. Should we tighten safety requirements so that every car is as safe as the S-Class, and costs about as much? Where do we draw the line on safety regulations?
If we tightened safety regulations so that every car was as safe as the S-Class then cars as safe as the S-Class would dramatically drop in price, simply by virtue of there being more of them.
As for where you draw the line on safety regulations, the optimum answer is always “considerably past the point that business owners start complaining about excessive regulation”.
The S-class is a bad example, because it is expensive for other confounding reasons.
However, all else equal, a vehicle with more active and passive safety features and more safety engineering is more expensive. Even after you account for economies of scale.
For example, airbags are extremely mass produced and have just about as much economies of scale as possible. But, in countries where they are not mandated, you can still find cars offered without them, because they are cheaper. The same is also true for vehicles without UHHS safety cages, ABS, stability control, etc. All of these things cost money.
Take all the safety items that do actually contribute to the S-Class sticker price, now mandate them in all cars. The price of all cars goes up, sure, but also the cost of a car that’s as safe as the S-Class is goes down. What you’ve done is decreased the cost of having the more safe option while eliminating the less safe option, precisely because most of those currently premium / luxury items simply haven’t benefitted at all from economies of scale. The airbag example proves the point, inside any country that mandates them. Are there cheaper and more dangerous cars available without them? Sure… but not inside the borders of any country that cares about the survival of its citizens.
We should all live in countries that mandate extremely high safety standards and spend their time worrying about how to raise the average income to compensate, rather than in a country that accepts unreasonable risk just to keep wages unreasonably low.
They thought they went with the cheaper option, but in fact they only considered the value of a life as estimated by the NHTSA ($0.2M). In reality, the damages that juries tended to assign for each needless loss of life turned out to be more like $100M.
If Ford had accounted for those punitive costs in their calculation, then the outcome of the cost/benefit calculation would have overwhelmingly favoured a fix. The real business problem was not the empathy-free approach, but poor mathematical modelling.
> They thought they went with the cheaper option, but in fact they only considered the value of a life as estimated by the NHTSA ($0.2M). In reality, the damages that juries tended to assign for each needless loss of life turned out to be more like $100M.
That was in large part due to the disgust over the report they had penned.
> If Ford had accounted for those punitive costs in their calculation, then the outcome of the cost/benefit calculation
Would still have been a cost/benefit calculation rather than a moral or ethical one, aka capitalistic greed.
Don’t make excuses. Putting psychopaths in the drivers seat is a precipitation of capitalism. Capitalism decides the ultimate KPI, and eventually things shake out this way. We don’t just get to say, yes, there goes another psychopathic executive, and wash our hands of the whole thing. Christ. We all make systems for a living. Look at indirect consequences.
Even psychopaths don't want to end up disgraced or in jail. So maybe it's the lack of punishment we dole out to these kinds of people.
Nowadays companies can seriously suffer by mishandling their "attitudes" over social justice issues, my gut reaction was that if that's true how could they get away with a plane falling out of the sky. Still a bigger deal than dozen people dying in cars with faulty fuel systems, perhaps just because of the optics.
> Even psychopaths don't want to end up disgraced or in jail. So maybe it's the lack of punishment we dole out to these kinds of people.
You're describing effective regulatory oversight. That is a manual control on capitalism, and something capitalism inevitably fights against. Psychopaths exist and look for ways to exploit capitalism, including "fuck it, we'll risk loss of human life and possibly having to shut down the company", which you said isn't due to capitalism. But it is: it's due to the combination of capitalism and human nature, but we can only control the former. The solution is regulatory oversight, as you just pointed out.
Also: realize that psychopaths will absolutely risk shutting down the company if they think they can exit with a personal profit before that happens. CEOs routinely fuck over the longevity of the companies they lead, knowing they won't be around for the fallout. In fact it's hard to find situations where this doesn't happen -- it's almost always private companies or companies where the CEO is completely entrenched.
> Don’t make excuses. Putting psychopaths in the drivers seat is a precipitation of capitalism.
That's a disingenuous take. There are plenty of examples where psycho apparatchiks of anti-capitalist regimes made decisions "for the common good" that resulted in loss of life and even genocide and still they hailed those results as a win.
GP said "System A doesn't work without controls" and you replied "that's disingenuous: System B also doesn't work without controls". Okay? That has nothing to do with it.
You missed the whole point. The point is that having psychos in charge is not a characteristic of an economic system. It's a characteristic of forming organizations manned by human beings.
It's terribly disingenuous to use that as a pretext to bash an economic system as if you don't have the exact same problem affecting organizations that are not ran based on that economic system. It's like claiming that the fact that water is wet is a precipitation of capitalism.
Yeah I get that dunking on Boeing is the cool new thing but realistically the amount of caution they take with things almost certainly dwarves whatever most of us software gardeners do.
> if they were an SV startup, they'd be receiving abundant praise for rapidly disrupting their market
If Boeing were developing radical new designs, I’d be with you. I might even be with them. But they’re not. The 737 Max 9 isn’t revolutionary in any capacity; the newness is practically all in the engines.
Yeah, punting everything on "airlines should just establish procedures" is such a lazy copout.
Funnily they're doing the same thing with the 737 Maxes undergoing certification now (10 and 7), which have a small design defect in that if the engine de-icing is on and you leave it on after takeoff, it will overheat and melt the cowling... silently, without any warning or sensor or indicator. They plan on fixing this in like 2025 and want an exemption to allow them to certify the 7 and 10, same as the 8 and 9 that are already certified and flying with this defect, with the solution of "pilots should just not forget to turn it off".
Sounds like my coworker telling a marketing campaign operator he has yet again let Excel interpret phone numbers as integers. And that he should learn to properly wield Excel. The downstream system is a call center made of humans. They lose a few seconds inputting the phone number manually though. No lead is lost. I don't want to speculate too much, but I think we might be in the clear. The client is not losing too much money. But if he complains once, we'll have to implement more checks to validate the Excel file. Then I'll have to buy my coworker breakfast, so that he doesn't bitch the whole implementation time. Such is life.
Generally, yeah. Red tape bad, and anything that reduces a pilot's cognitive load is generally going to be a very good thing. In an emergency, there is a lot for them to process.
But this?
Expecting pilots to communicate to each other about which one of them is flying the aircraft (as opposed to like, just grabbing a yoke and YOLOing it?) does not seem like an overly onerous amount of red tape.
That seems like an absolutely fundamental aspect of flying. It's so fundamental I'm not even sure it would qualify as CRM (crew resource management)
> Expecting pilots to communicate to each other about which one of them is flying the aircraft (as opposed to like, just grabbing a yoke and YOLOing it?) does not seem like an overly onerous amount of red tape.
It already exists, but in emergency under stress it's an easy thing to forget or even not hear at all(cf. the linked incident and many others).
The Air France 447 incident occurred in an Airbus aircraft with these warnings, and it ended in a crash (https://en.wikipedia.org/wiki/Air_France_Flight_447). The airplane in this incident had a flight system that gave tactile and visual feedback that the other pilot was giving inputs. I think it would indeed be better to have an additional auditory warning, but we should not underestimate the fact that pilots can and do make serious mistakes. Since this is the same company, it points to issues in training.
Pretty chilling reading. A disturbingly similar situation occurred in AirAsia Flight 8501 (Airbus A320): https://en.wikipedia.org/wiki/Indonesia_AirAsia_Flight_8501#.... Similar to the AF incident, the autopilot disengaged and the flight control switched to alternate Law. The aircraft began to roll and the first officer over-corrected back and forth while also pitching the nose up and causing the plane to stall. The pilot and the first officer were both providing opposite inputs (nose down and nose up respectively) which cancelled each other out, preventing recovery from the stall condition. The plane crashed into the ocean, killing everyone onboard.
I'm starting to wonder if there's something inherent in the design of the Airbus side-stick that makes this sequence of events (i.e. banking, overcorrecting, climbing) more likely if the aircraft suddenly switches from normal to alternate law.
> I'm starting to wonder if there's something inherent in the design of the Airbus side-stick that makes this sequence of events (i.e. banking, overcorrecting, climbing) more likely if the aircraft suddenly switches from normal to alternate law.
I think it’s less something specific to the Airbus sidestick implementation and more over-reliance on cockpit automation in general. Airbus alternate law flies more like (not exactly like) a non-FBW traditional airplane, and pilots who never train that skill (because they always fly normal law) become overloaded when thrown into that situation unexpectedly.
A primary problem is that your muscle-memory is all wrong. Holding the stick to the side no longer gives a constant-bank turn. You have to re-center the stick when you get to the desired bank angle. Pulling all the way back doesn’t give you a constant near-maximum rate of climb (You can stall the airplane), and need to apply a little less back pressure when you get to the desired pitch. You also need to manually adjust pitch trim for any speed or power changes. So a failure that induces alt law means that you took off in one airplane and are now flying a different airplane.
The event that precipitated alt law is nearly always an emergency or near-emergency on its own. So not only are you flying a different airplane than the one you’re used to, you’re also diagnosing system failures at the same time.
If there’s anything to blame with Airbus’s implementation, I would argue it’s that the normal law is too dissimilar to how airplanes actually fly.
I wasn't aware of this accident, it does look very similar.
Airbus got some flak at the time for the AF 447 accident, both for this side stick issue and for the way the stall system unintuively stopped when the plane was pointed up (because its speed decreased to a level that was below some threshold that allowed the warnings).
I find it surprising how these UI elements in aviation are so primitive, we should improve them.
Mechanically linked dual controls, like those on this aircraft, do give you indication that the other pilot is operating them (i.e. your controls physically move in tandem with their inputs). The problem is that if you both provide exactly opposite inputs at the same time both parties can interpret the physical resistance as jammed controls. An audible warning could be useful, but it could also fail if you're in a critical situation that has triggered other audible alerts (e.g. an audible stall warning). Audible warnings also carry the danger of not being comprehensive - if pilots come to rely on warnings of input conflicts instead of training to use explicit verbal communication, they may mistakenly assume that the absence of a conflicting input warning means there is no conflicting input (which may not be the case if the warning system is not absolutely comprehensive).
Another approach here is to have a mechanism that allows one pilot to lock-the controls of the other pilot, coupled with some sort of visual/audible indication as to who is in control. This is sort of a different spin on the 'explicit communication' approach.
This thread is kinda funny because generally aviation threads on HN like to shit on airbus for their sidesticks and tout linked controls as obviously superior.
Rather than saying: "aviation threads on HN" have you considered using the usernames to identify the individuals with negative comments and positive comments and determine whether it's a small number of accounts saying the same thing repeatedly or a large proportion of the users?
The trouble is that those warnings should not be necessary.
It is drummed into the skulls of all pilots that there is only ever one person at the controls.
When you are a student pilot with an instructor in the other seat, the "I have control", "You have control" mantra is drummed into you.
When you progress onto professional multi-crew operations, this is further re-enforced through operational "Pilot Flying", "Pilot Not Flying" roles introduced during your MCC (Multi Crew Cooperation) training.
Also, from a purely practical perspective Boeing are yoke-based aircraft, not Airbus joysticks. So it should be pretty bloody obvious if dual control is going on.
> it should be pretty bloody obvious if dual control is going on.
Yet we have an example here where it wasn't obvious to a (presumably) fully competent crew who got to the point of missing an approach and declaring an emergency for a flight control anomaly that they couldn't diagnose as being the other human 4 feet away from them also being on the controls.
"Should be" obviously wasn't "is" in this case.
Edit to add: Also from the report:
The following factors may have contributed to the simultaneous inputs on the controls:
<snipped 5 other bullets>
• the conviction that simultaneous inputs on the controls would be quickly perceived by crews on this type of aeroplane.
> fully competent crew who got to the point of missing an approach and declaring an emergency
I think you need to re-read the PDF. My reading of it is that the missed-approach decision was made by the PF on the basis of the unstablised approach, and that it is what happened after that decision that is under investigation in this report. Undertaking MAP due to unstable approach is pretty standard stuff that occurs all day, every day.
The report states there were zero force inputs by PM prior to the missed-approach, which correlates with the other note in the report that the PM ghosted the controls in the period following the missed-approach and that is when the apparent reflex action occured.
My read is that the approach was not unstable (it met stabilized approach criteria at all significant checkpoints) at the moment when the PF (co-pilot) become spatially disoriented and began giving improper control inputs.
This disorientation of the PF was the triggering event, which caused him to call the go-around [prior to stabilized approach criteria being violated], the approach to be terminated, and required the PM (the captain) to make corrective [and conflicting] control inputs. These conflicting inputs were not accompanied by the normal exchange of controls communications.
You are correct that the missed approach procedure was initiated before the controls conflict between humans began (but after the co-pilot's disorientation made him suspect a flight controls problem). I was wrong on that point.
Safety often comes via overwhelming redundancy and back up protections. The human should do X, but if they don't do X, another system will do Y to save the plane, and if that system fails, then another system will do Z...
Single points of failure should be avoided. Like in driving, things should work out if driver A or driver B does the right thing, or if the road is designed right, or if pedestrians are following reasonable rules, you just try to make all those things true, so if any of them are not, it isn't a disaster.
> The trouble is that those warnings should not be necessary.
Of course they shouldn't be, but it's a protection against scenerios such as miscommunication, being distracted and forgetting you handed them over, etc.
> mantra is drummed into you.
The real danger to well-trained behavior is emergencies and task-saturation. That's when you're most likely be distracted, act impulsively, etc.
Literally halve of all warnings can be covered by "The humans should have been paying attention and noticed it".
“…The documentation provided to the pilots did not therefore allow them to reasonably envisage that, in the event of antagonistic control inputs exceeding the breakout mechanism's activation threshold, the controls would be desynchronized and the control surface would react according to the mean control positions. The behaviour of the aeroplane during this phase of simultaneous control inputs could not be anticipated.”
It is unconscionable that the training for this aircraft does not include a thorough examination of competence in interpreting multiple control inputs/control jamming.
The fact that under these conditions the aircraft defaults to responding to -neither- control input, but rather the mean of the two, without any master caution or obvious alarm condition seems like a dubious engineering decision at best, and certainly should merit significant training to recognize the conditions under which the -aircraft would decide not to respond fully to ANY control input- .
Of course, cockpit discipline is paramount, and this near-accident was a direct result of CRM failure, but by design the control system makes this forseeable eventuality much more insidiously dangerous and disorienting to pilots. At the very least, significant training on the specific possibility is merited, and an alarm condition for this specifically out of parameter situation should exist.
If I didn’t know better, I would suspect that Boeing was intentionally engineering their flight control automation systems to exploit foreseeable pilot errors and exacerbate them, and then maliciously forgoing trading requirements on those features.
Hopefully that decision is based then on sound engineering and aviation principles. I can certainly see that as a “better than nothing “ approach, and I can imagine some failure scenarios where it might even be the -best- solution… but it would seem that that operating mode would at least merit enough training so that pilots would recognize the operating mode, as well as some kind of obvious indication that the airplane was electing to algorithmicly synthesize the control outputs.
Wouldn’t it be better to simply hard-lock the controls together, with a release switch for each control to allow either pilot to unlock their controller from the other in case of a stuck control system or an uncooperative pilot? That would seem to capture the benefits of de synchronizable controls while avoiding the empirically problematic downside.
TL;DR - The pilots failed to engage in a 'positive exchange of flight controls' procedure and ended up providing opposite control inputs at the same time, so it felt to both of them like the controls were unresponsive / jammed.
This is a well understood and generic problem in dual-control aviation - see https://www.faasafety.gov/files/helpcontent/Courses/ALC-36/c... for example. The standard exchange of flight control procedure is designed to create a common understanding between the pilots as to who is in control of the plane. Interestingly it's similar to a TCP three-way handshake:
Pilot A: You have control of the plane.
Pilot B: I have control of the plane.
Pilot A: Acknowledge you have control of the plane.
It looks similar to the 757 design. The 757 has two sets of cables going from the cockpit to the elevator actuators, one set for each pilot. The left pilot controls the left elevator, the right pilot the right. They are synchronized via a cam with a detent (notch) in it.
The detent connection enables one pilot to control the left and right cables. The idea is that if one set of cables jams, the pilot can still control his elevator by applying enough force to pop the cam out of the detent.
Of course, if both pilots pull hard enough in opposite directions, it will come out of the detent as well.
I was one of the engineers working on the 757 elevator system. I don't recall anyone talking about the possibility of the two pilots fighting each other for control. It was just inconceivable. Besides, both pilots would be able to feel the controls "popping" out of the detent. I doubt a warning horn would have made them less confused.
I don't know if pilot training included popping out of the detent so they know what it feels like, but it seems like a good idea.
I've seen more than one video from the Mentour Pilot channel on YouTube (where he covers air accidents, fatal and not) where the pilots experience spatial disorientation and input opposite commands on their respective yokes. So it definitely happens on accident.
To ask the obvious question (aside from "oh wow you worked on the 757 that's so cool tell us everything you legally can?" :D ) which I'm assuming has an obvious answer, what happens if one of the four cables (or the elevator itself on that side) simply jams when its elevator is fully actuated in that cable's direction? Isn't this effectively the same situation as one pilot yelling "hail hydra" and going full send on their elevator lever? Either way your control authority (ignoring roll) has gone from [-1, 1] to [0, 1] or variants thereof.
Also something I've always wondered - when designing an airliner what's the boilerplate error rate for a trained human pilot, that you use in "ah yes but what if the pilot does it wrong?" type calculations?
The output is the median of both controls, so the result would be neutral elevator.
A lot of effort goes into figuring out what a pilot would naturally do, and to make that work. Much information comes from real life incidents.
The engineers and management I worked with were all keenly aware of their responsibility for safety and quality. Nobody wanted to make a mistake that caused an accident. I never heard anyone try to sacrifice safety for money.
I'm not him (and I'm also not a pilot or aircraft designer), but AFAIK there's also the elevator trim, which uses a separate mechanism and could be used to shift the range of the control authority.
1.5.5.1 Captain’s statement
The captain indicated that it was a flight with difficult hours. He explained that six hours before the flight, he had had a nap of an hour and a half, and that with the co-pilot, they alternated controlled rest periods during the cruise flight.
1.5.5.2 Co-pilot’s statement
The co-pilot said it was a tiring flight. He added that they had taken controlled rest during the flight to deal with this specificity. He explained that four hours before leaving the hotel, he had had a nap of an hour and a half to two hours.
--
More from the captain statement:
The captain noticed that at 400 ft9, the aeroplane had clearly veered to the left. He was surprised. He saw the wheel move 45°10 to the left and did not see the co-pilot correct this. The co-pilot then called out “go around”. According to the captain, this was a critical situation: aborting the approach in a turn with the wheel turned in the same direction. The captain saw the co -pilot make a nose-up input on the control column, press the TO/GA switches and push the throttle levers forward. The power increased but the captain did not see the LNAV TO/GA display appear. The co-pilot then held the wheel with both hands and the pitch attitude became positive. But the wheel was still turned to the left
139 comments
[ 2.6 ms ] story [ 193 ms ] thread> The captain then acted, most probably by reflex action, on the control column to reduce this pitch attitude without taking back the controls and making the procedure call-out, based on the principle of only one pilot having the controls. The two pilots then simultaneously made inputs on the controls. The pitch controls were desynchronized for 12 s due to opposing forces
It sounds like Air France has still not trained their pilots on proper cockpit discipline. This already proved fatal before (AF 447).
As a passenger, the real problem with flying nowadays is that it's quite a lot like riding the bus.
Probably just behind the MCAS.
Say one pilot loses consciousness, the other one has to extract them from their seat before they can fly the airplane. That's no easy task - humans are surprisingly heavy once they pass out.
Edit: I've got it! We'll have a single pilot but they'll be based on a Rust rewrite of ChatGPT running on RISC-V.
Airbus has a dual input alert, apparently Boeing doesn’t, and didn’t add it after this incident, blows my mind. Still they’re far from perfect, stress deafness is absolutely a thing.
Active sticks (force feedback) are finally making it into commercial cockpits, they’ve been deployed in business jets, and the Irkut MC-21 was supposed to be the first implementation in an airliner (as it’s french-made, that’s been sunk by the Russian invasion of Ukraine and subsequent economic blockade).
This means hopefully active stick swill make it into big two airframes eventually. I assume there’s some redesign work ongoing as it likely requires additional power and data connection, AFAIK currently the sticks (Airbus’s anyway) are just centered and resisting via springs, I don’t think there’s any data fed back into the sticks.
Probably because it's a patent lawsuit minefield.
https://www.youtube.com/watch?v=3sXXx8rgeeE
I would assume the issues are / were around reliability, failure modes, certification and training rather than patents.
What force feedback in addition would you have in mind?
They did (and I think from the start, because unlike on Boeing's controls which are mechanically linked, there's no easy way of knowing the other pilot is inputting). From the wikipedia article of the crash:
> The inputs cancelled each other out and triggered an audible "dual input" warning.
https://en.wikipedia.org/wiki/Air_France_Flight_447
It's just that, as has been seen on many crashes, hearing is one of the first senses that disappears under heavy stress.
As you say, UI design choices can make errors more or less likely. Absolutely everyone makes mistakes. We need to design to reduce the likelihood of mistakes and to minimise the impact of mistakes when they do happen.
To be clear, I think everyone in the industry understands this, but when reported in the media, the average public just hears, "Pilots f'ed up," which is almost never a complete picture.
Taking the recent incident at HND earlier this month between a JAL A350 and JCG DHC-8, the investigation (currently still ongoing) is pointing to the JCG Captain astronomically fucking up:
* ATC ordered the JCG DHC-8 to hold short of the runway and informed them they were #1 in the take off queue. Take off clearance was never given.
* The First Officer of the JCG DHC-8 read back the order to hold short and their position in the queue.
* JAL A350 had clearance to land and (along with other aircraft) listened in to the above conversation, routine stuff to help maintain situational awareness.
* The Captain of the JCG DHC-8 entered the runway, violating order to hold short, and sat there for approximately 40 seconds until they were struck by the JAL A350.
ATC, JAL, and even the JCG First Officer all did things right and yet all it took was apparently one Captain screwing up.
Yes, there were compounding factors like how it was nighttime and all the airport lights flooded out the JCG DHC-8's lights, but pilot error is the only reasonable way of ultimately explaining incidents like this.
Also important is that there is no single root cause for any event. Therefore there is no single 'error' that could be attributed to any one root anyway (in particular the pilot).
They go and list everything that went wrong, without even a lot of concern for causality. They also list all reasonable points of improvement, regardless if they were important for this one incident or not.
Human error is always there, of course. But the idea that they are blaming this on the human is wrong. They are not blaming anything on anything.
The pilot should not be drunk.
The pilot’s boss should not have let him onto the airplane while drunk.
That guy’s boss should have ensured that they breathalyze every pilot. And so on up the chain to the owners of the airline, who should appoint a CEO who can get the job done.
In aviation, every knob you turn has at least two effects.
Confirmation bias is really hard to break. When you're in a situation and start telling yourself a story about what's going on, it's really hard for even break that narrative, even when the "you're being an idiot" light turns on.
I remember one airliner crash turned out to have been caused by one of the pilots letting his kid sit in the seat while at altitude.
When humans are involved, there's always the potential for human error.
> when reported in the media, the average public just hears, "Pilots f'ed up,"
Unfortunately, for a mass media audience, this is unavoidable. People are always looking for "the answer". To understand nuance in a specialized field, most people will need an overview of the problem set to grasp the topic. Really you'd need more of a 60 Minutes type exposé to explain that; it's too much for a typical news report.
The reason pilots are there is to diagnose problems and take the right corrective action. This also means they can misdiagnose problems and take the wrong action. This is where pilot training comes in.
Does anyone know what "The pitch controls were desynchronized for 12s" actually means? and was this a system response to the two controls having opposing forces, or an unexpected result of it.
Edit: Actually, I'm completely wrong, ignore me
That is my understanding of both systems at least
> often only associated it with a jammed control
I assume in no small part because
> the description of the system in the [flight crew operating manual] was limited to an explanation about the risk of a control jamming
And it seems likely the precise behaviour of the system in case of breakout is not documented either.
> The inputs cancelled each other out and triggered an audible "dual input" warning.
https://en.wikipedia.org/wiki/Air_France_Flight_447
My understanding is that it always averages the input, even when they're not desynchronized (but obviously, since the inputs are equal in that case, the average ends up being equal to the inputs themselves).
Boeing's control columns are mechanically linked, but given (iirc) 50 lbs of force, they will mechanically desynchronize. If memory serves, they will snap back into sync once the force is released. I don't recall there being an aural warning for this.
The issues with Airbus's approach are that (a) in high-stress environments, aural warnings are the first ones to be unconsciously ignored, and (b) you get no haptic feedback, either from the other pilot's side stick, or from the control surfaces (since modern Airbuses are FBW, though you could still do electronic feedback via an active side stick). There's some talk of Airbus moving to active side sticks in the future to mitigate this issue.
The issue with Boeing's approach is that in a high-stress, tunnel-visioned situation, you can't tell another pilot's input feedback apart from something like jammed flight controls, a runaway stabiliser, or any other trim or autopilot malfunction, to name a few. There's also some talk of Boeing moving to active side sticks in the future to mitigate this issue.
> in the event of antagonistic inputs exceeding the breakout mechanism’s activation threshold, the controls would be desynchronised and the control surface would react according to the mean control position.
The breakout threshold is 50lbs, but it’s the combined thresholds, so sudden opposite force applied by two pilots (as apparently happened here) can unexpectedly trigger it. The report confirms there is no warning of breakout situation whether visual or aural.
The advantage is obvious: it's the most similar to how it worked back when the controls were fully mechanical.
IIRC, some old planes even had each side mechanically controlling independent halves of the control surfaces, such that the end result is the average of the inputs in case one of the control surfaces (or the cabling connecting to the controls) is jammed.
Pilots are trained very thoroughly to react to stick shakers in one specific and immediate way -- execute the stall escape manoeuvre, and that's to immediately, with only very minimal instrument scanning (typically, just check altitude and airspeed), apply power and push nose down to the extent the surrounding terrain will allow you.
I do agree that dual input could be better handled, but I doubt we'll see many big leaps in that area until active side sticks become the norm. For Boeing aircraft with yokes, I can't see a good solution. Maybe have some kind of hard-to-miss, single-purpose visual indicator on the glare shield, like where Airbus puts theirs? Or an alert when the two control columns get unlinked?
Also, to be clear -- stick shakers are a Boeing-only feature. Airbus has an aural, but very distinctive "STALL, STALL" warning, plus flight envelope protection provided by the FBW system. Alpha floor protection (A.FLOOR) is the subsystem responsible for preventing stalls.
EDIT: ya know, maybe as HUDs get more widespread in civil aviation there might be better ways to surface this information. Fundamentally, we can only alert pilots in so many ways based on the five major senses, and with taste and smell being out, that leaves aural, haptic, and visual indicators.
Aural and haptic are sort-of out for the reasons outlined above, and visual indicators have to resort to being easily parseable in peripheral vision, since if a pilot's in a high-stress situation they may be looking out the windshield first. That's why it makes sense to put urgent stuff on the glare shield; it's easier to see it out of your peripheral.
With HUDs, these indicators can be more information dense. Instead of a green light or an arrow indicating dual input or stick priority, you can have DUAL INPUT flash over the centre of the HUD.
Most modern HUDs have the drawback of being monochrome green, which is a limiting factor on information density here.
Is that true? I seem to recall that Airbus gave "priority" to one side or the other (with the side being switchable on demand, not fixed).
- airbus controls are not mechanically linked, save possibly on the A300 (which has a yoke not side-stick), but there’s less than 200 of these still flying
- airbus sticks have a priority / takeover button, but by default dual inputs are averaged (this is also what happens in Boeings when you trigger a breakout apparently)
- Airbus has a “dual input” aural alarm
Side sticks are not mechanically linked.
In all cases, the flight computer works of the average of the two sticks. When they are in sync, this works great. In a situation like this one, where the pilots are pushing in opposite directions, the average will all of a sudden, be quite different from both controls.
I would have hoped for Boeing to add a warning system in the case of dual input, like in Airbus aircrafts, but it seems they did the bare minimum here. Simple warnings were added to the pilot hanbook that basically amount to "don't apply opposite inputs".
Anything that goes wrong is due to dysfunctional management, not greed.
“Dysfunctional management” is a direct function of managerial incentives, which is generally capitalistic greed (aka “obligation to maximize shareholder value”)
As for where you draw the line on safety regulations, the optimum answer is always “considerably past the point that business owners start complaining about excessive regulation”.
Pricing is due to both supply and demand - there can’t be a sustainable supply of a expensive-to-make cars at loss-making prices
However, all else equal, a vehicle with more active and passive safety features and more safety engineering is more expensive. Even after you account for economies of scale.
For example, airbags are extremely mass produced and have just about as much economies of scale as possible. But, in countries where they are not mandated, you can still find cars offered without them, because they are cheaper. The same is also true for vehicles without UHHS safety cages, ABS, stability control, etc. All of these things cost money.
We should all live in countries that mandate extremely high safety standards and spend their time worrying about how to raise the average income to compensate, rather than in a country that accepts unreasonable risk just to keep wages unreasonably low.
If Ford had accounted for those punitive costs in their calculation, then the outcome of the cost/benefit calculation would have overwhelmingly favoured a fix. The real business problem was not the empathy-free approach, but poor mathematical modelling.
That was in large part due to the disgust over the report they had penned.
> If Ford had accounted for those punitive costs in their calculation, then the outcome of the cost/benefit calculation
Would still have been a cost/benefit calculation rather than a moral or ethical one, aka capitalistic greed.
Nowadays companies can seriously suffer by mishandling their "attitudes" over social justice issues, my gut reaction was that if that's true how could they get away with a plane falling out of the sky. Still a bigger deal than dozen people dying in cars with faulty fuel systems, perhaps just because of the optics.
You're describing effective regulatory oversight. That is a manual control on capitalism, and something capitalism inevitably fights against. Psychopaths exist and look for ways to exploit capitalism, including "fuck it, we'll risk loss of human life and possibly having to shut down the company", which you said isn't due to capitalism. But it is: it's due to the combination of capitalism and human nature, but we can only control the former. The solution is regulatory oversight, as you just pointed out.
Also: realize that psychopaths will absolutely risk shutting down the company if they think they can exit with a personal profit before that happens. CEOs routinely fuck over the longevity of the companies they lead, knowing they won't be around for the fallout. In fact it's hard to find situations where this doesn't happen -- it's almost always private companies or companies where the CEO is completely entrenched.
That's a disingenuous take. There are plenty of examples where psycho apparatchiks of anti-capitalist regimes made decisions "for the common good" that resulted in loss of life and even genocide and still they hailed those results as a win.
You missed the whole point. The point is that having psychos in charge is not a characteristic of an economic system. It's a characteristic of forming organizations manned by human beings.
It's terribly disingenuous to use that as a pretext to bash an economic system as if you don't have the exact same problem affecting organizations that are not ran based on that economic system. It's like claiming that the fact that water is wet is a precipitation of capitalism.
I don't think that's a valid comparison.
For a startup to disrupt a market, it should have some semblance of a win.
Boeing is doing all this to avoid a major loss.
Fighting to stay afloat is not the same as disrupting a market.
If Boeing were developing radical new designs, I’d be with you. I might even be with them. But they’re not. The 737 Max 9 isn’t revolutionary in any capacity; the newness is practically all in the engines.
Funnily they're doing the same thing with the 737 Maxes undergoing certification now (10 and 7), which have a small design defect in that if the engine de-icing is on and you leave it on after takeoff, it will overheat and melt the cowling... silently, without any warning or sensor or indicator. They plan on fixing this in like 2025 and want an exemption to allow them to certify the 7 and 10, same as the 8 and 9 that are already certified and flying with this defect, with the solution of "pilots should just not forget to turn it off".
But this?
Expecting pilots to communicate to each other about which one of them is flying the aircraft (as opposed to like, just grabbing a yoke and YOLOing it?) does not seem like an overly onerous amount of red tape.
That seems like an absolutely fundamental aspect of flying. It's so fundamental I'm not even sure it would qualify as CRM (crew resource management)
It already exists, but in emergency under stress it's an easy thing to forget or even not hear at all(cf. the linked incident and many others).
I'm starting to wonder if there's something inherent in the design of the Airbus side-stick that makes this sequence of events (i.e. banking, overcorrecting, climbing) more likely if the aircraft suddenly switches from normal to alternate law.
I think it’s less something specific to the Airbus sidestick implementation and more over-reliance on cockpit automation in general. Airbus alternate law flies more like (not exactly like) a non-FBW traditional airplane, and pilots who never train that skill (because they always fly normal law) become overloaded when thrown into that situation unexpectedly.
A primary problem is that your muscle-memory is all wrong. Holding the stick to the side no longer gives a constant-bank turn. You have to re-center the stick when you get to the desired bank angle. Pulling all the way back doesn’t give you a constant near-maximum rate of climb (You can stall the airplane), and need to apply a little less back pressure when you get to the desired pitch. You also need to manually adjust pitch trim for any speed or power changes. So a failure that induces alt law means that you took off in one airplane and are now flying a different airplane.
The event that precipitated alt law is nearly always an emergency or near-emergency on its own. So not only are you flying a different airplane than the one you’re used to, you’re also diagnosing system failures at the same time.
If there’s anything to blame with Airbus’s implementation, I would argue it’s that the normal law is too dissimilar to how airplanes actually fly.
Edited for clarity.
Airbus got some flak at the time for the AF 447 accident, both for this side stick issue and for the way the stall system unintuively stopped when the plane was pointed up (because its speed decreased to a level that was below some threshold that allowed the warnings).
I find it surprising how these UI elements in aviation are so primitive, we should improve them.
Mechanically linked dual controls, like those on this aircraft, do give you indication that the other pilot is operating them (i.e. your controls physically move in tandem with their inputs). The problem is that if you both provide exactly opposite inputs at the same time both parties can interpret the physical resistance as jammed controls. An audible warning could be useful, but it could also fail if you're in a critical situation that has triggered other audible alerts (e.g. an audible stall warning). Audible warnings also carry the danger of not being comprehensive - if pilots come to rely on warnings of input conflicts instead of training to use explicit verbal communication, they may mistakenly assume that the absence of a conflicting input warning means there is no conflicting input (which may not be the case if the warning system is not absolutely comprehensive).
Another approach here is to have a mechanism that allows one pilot to lock-the controls of the other pilot, coupled with some sort of visual/audible indication as to who is in control. This is sort of a different spin on the 'explicit communication' approach.
This thread is kinda funny because generally aviation threads on HN like to shit on airbus for their sidesticks and tout linked controls as obviously superior.
The trouble is that those warnings should not be necessary.
It is drummed into the skulls of all pilots that there is only ever one person at the controls.
When you are a student pilot with an instructor in the other seat, the "I have control", "You have control" mantra is drummed into you.
When you progress onto professional multi-crew operations, this is further re-enforced through operational "Pilot Flying", "Pilot Not Flying" roles introduced during your MCC (Multi Crew Cooperation) training.
Also, from a purely practical perspective Boeing are yoke-based aircraft, not Airbus joysticks. So it should be pretty bloody obvious if dual control is going on.
Yet we have an example here where it wasn't obvious to a (presumably) fully competent crew who got to the point of missing an approach and declaring an emergency for a flight control anomaly that they couldn't diagnose as being the other human 4 feet away from them also being on the controls.
"Should be" obviously wasn't "is" in this case.
Edit to add: Also from the report:
I think you need to re-read the PDF. My reading of it is that the missed-approach decision was made by the PF on the basis of the unstablised approach, and that it is what happened after that decision that is under investigation in this report. Undertaking MAP due to unstable approach is pretty standard stuff that occurs all day, every day.
The report states there were zero force inputs by PM prior to the missed-approach, which correlates with the other note in the report that the PM ghosted the controls in the period following the missed-approach and that is when the apparent reflex action occured.
This disorientation of the PF was the triggering event, which caused him to call the go-around [prior to stabilized approach criteria being violated], the approach to be terminated, and required the PM (the captain) to make corrective [and conflicting] control inputs. These conflicting inputs were not accompanied by the normal exchange of controls communications.
You are correct that the missed approach procedure was initiated before the controls conflict between humans began (but after the co-pilot's disorientation made him suspect a flight controls problem). I was wrong on that point.
Single points of failure should be avoided. Like in driving, things should work out if driver A or driver B does the right thing, or if the road is designed right, or if pedestrians are following reasonable rules, you just try to make all those things true, so if any of them are not, it isn't a disaster.
https://en.wikipedia.org/wiki/Swiss_cheese_model
Of course they shouldn't be, but it's a protection against scenerios such as miscommunication, being distracted and forgetting you handed them over, etc.
> mantra is drummed into you.
The real danger to well-trained behavior is emergencies and task-saturation. That's when you're most likely be distracted, act impulsively, etc.
Literally halve of all warnings can be covered by "The humans should have been paying attention and noticed it".
It is unconscionable that the training for this aircraft does not include a thorough examination of competence in interpreting multiple control inputs/control jamming.
The fact that under these conditions the aircraft defaults to responding to -neither- control input, but rather the mean of the two, without any master caution or obvious alarm condition seems like a dubious engineering decision at best, and certainly should merit significant training to recognize the conditions under which the -aircraft would decide not to respond fully to ANY control input- .
Of course, cockpit discipline is paramount, and this near-accident was a direct result of CRM failure, but by design the control system makes this forseeable eventuality much more insidiously dangerous and disorienting to pilots. At the very least, significant training on the specific possibility is merited, and an alarm condition for this specifically out of parameter situation should exist.
If I didn’t know better, I would suspect that Boeing was intentionally engineering their flight control automation systems to exploit foreseeable pilot errors and exacerbate them, and then maliciously forgoing trading requirements on those features.
Wouldn’t it be better to simply hard-lock the controls together, with a release switch for each control to allow either pilot to unlock their controller from the other in case of a stuck control system or an uncooperative pilot? That would seem to capture the benefits of de synchronizable controls while avoiding the empirically problematic downside.
This is a well understood and generic problem in dual-control aviation - see https://www.faasafety.gov/files/helpcontent/Courses/ALC-36/c... for example. The standard exchange of flight control procedure is designed to create a common understanding between the pilots as to who is in control of the plane. Interestingly it's similar to a TCP three-way handshake:
Pilot A: You have control of the plane.
Pilot B: I have control of the plane.
Pilot A: Acknowledge you have control of the plane.
The detent connection enables one pilot to control the left and right cables. The idea is that if one set of cables jams, the pilot can still control his elevator by applying enough force to pop the cam out of the detent.
Of course, if both pilots pull hard enough in opposite directions, it will come out of the detent as well.
I was one of the engineers working on the 757 elevator system. I don't recall anyone talking about the possibility of the two pilots fighting each other for control. It was just inconceivable. Besides, both pilots would be able to feel the controls "popping" out of the detent. I doubt a warning horn would have made them less confused.
I don't know if pilot training included popping out of the detent so they know what it feels like, but it seems like a good idea.
Suicidal pilot?
https://en.wikipedia.org/wiki/Suicide_by_pilot
see: https://en.wikipedia.org/wiki/Germanwings_Flight_9525
and: https://en.wikipedia.org/wiki/EgyptAir_Flight_990
Also something I've always wondered - when designing an airliner what's the boilerplate error rate for a trained human pilot, that you use in "ah yes but what if the pilot does it wrong?" type calculations?
A lot of effort goes into figuring out what a pilot would naturally do, and to make that work. Much information comes from real life incidents.
The engineers and management I worked with were all keenly aware of their responsibility for safety and quality. Nobody wanted to make a mistake that caused an accident. I never heard anyone try to sacrifice safety for money.
This is an automatic range limiter, not under pilot control.
There is also a stabilizer trim system, which pivots the entire horizontal stabilizer, elevators and all.
It's all rather complicated.
1.5.5.1 Captain’s statement The captain indicated that it was a flight with difficult hours. He explained that six hours before the flight, he had had a nap of an hour and a half, and that with the co-pilot, they alternated controlled rest periods during the cruise flight.
1.5.5.2 Co-pilot’s statement The co-pilot said it was a tiring flight. He added that they had taken controlled rest during the flight to deal with this specificity. He explained that four hours before leaving the hotel, he had had a nap of an hour and a half to two hours.
--
More from the captain statement:
The captain noticed that at 400 ft9, the aeroplane had clearly veered to the left. He was surprised. He saw the wheel move 45°10 to the left and did not see the co-pilot correct this. The co-pilot then called out “go around”. According to the captain, this was a critical situation: aborting the approach in a turn with the wheel turned in the same direction. The captain saw the co -pilot make a nose-up input on the control column, press the TO/GA switches and push the throttle levers forward. The power increased but the captain did not see the LNAV TO/GA display appear. The co-pilot then held the wheel with both hands and the pitch attitude became positive. But the wheel was still turned to the left