Being a privat pilot myself, I was fascinated by the story of AF Flight 447 from both a human and technical point of view, since many times, a combination of these two factors would eventually lead to an unpleasant situation.
There is no (central) display indicating the current position of both control sticks.
There is no redundant system allowing the pilots to see their speed, even if the method used is inaccurate it would still be better than nothing (GPS, heated pitot tubes, ...) Same for the altimeter.
Flight recorders aren't designed to float and broadcast their position, or at least release a small beacon that would give rescue teams a general idea about where to search.
>>Flight recorders aren't designed to float and broadcast their position, or at least release a small beacon that would give rescue teams a general idea about where to search.
They are not designed to float, because there is no guarantee that the flight recorder will separate from the rest of the wreckage, but most importantly because accidents at cruise altitude are incredibly rare, it's the safest time of the flight - and you are very unlikely to be over the ocean in any other mode of flight. Even with airports close to the sea, a crash few km from the shore would not be difficult to locate.
And flight recorders have auxiliary batteries and actually broadcast their location for a month after the crash - the problem here was that no one had an idea where the plane crashed, something that's very,very improbable in its own right.
I feel like this exact same problem is going to be encountered when automatic cars are introduced. Automatic systems will be good enough to take care of 98% of situations, but in the 2% when the system is just not good enough, the humans will not fare much better, if at all. Good drivers will still exist, average drivers will remain average, while people who should never be in command of a moving vehicle will now be "driving".Only very few of them will be able to cope with truly critical situations. Of course all of that will be dismissed on the basis of automatic cars saving innumerable human lives, but I believe we will observe the exact same phenomenon.
In some ways one can draw parallels with this and the increasingly complex multilayered abstractions of software - it decreases effort so people can throw together a bunch of libraries and quickly create some app that does something useful, but at the same time decreases motivation to understand the details of what they're building or how things actually work, making it much harder for them to troubleshoot when things go wrong.
I can see the day when teenagers can't drive a non-automated car, just like most people today have a hard time driving a vehicle with a standard transmission. It wasn't that long ago that everyone had to know how to drive a standard.
In EU if you passed your test in a vehicle with an automatic transmission you can't drive a manual, unless you re-take the test in one. So that kind of already happened.
My point is that if we let teenagers drive fully automated cars,they might find themselves in a truly critical situation they will not be able to get out of, due to their lack of experience and training. People will then say - if they were experienced drivers, and if not for all this automation, they would be able to get out of this situation. Because that's exactly what this article is saying - if the aircraft wasn't as automated, and the pilots had a lot more experience actually flying, they would have realised that the plane was, in fact, stalling, and maybe would have saved it. That does not change the fact that automation, overall, saves more lives than it takes.
The difference is that an automatic car that gets in over its head can just stop, presumably pulling off the road first if it's able. In this instance, instead of falling back to various alternate laws and finally crashing into the ocean, the car analog of AF447 could just pause and let the pilots figure things out at leisure.
Well, it's not too hard to imagine a situation when the computer loses control over the breaks, engine and the transmission - so it quickly realizes that in its own state it cannot bring the car to a halt. In that instance an automatic car would do what that airplane did - assume that it's own instruments are unreliable(after all, maybe the breaks work when you push the pedal, it's just a sensor that's broken), and give the control back to the driver. And then the driver would have very little time to react - as soon as the autopilot disengages the driver would have to avoid hitting other traffic, buildings or falling off a cliff. And then we arrive in the same situation as those pilots were in - an experienced driver, who had many hours of actual behind-the-wheel experience could possibly save the car and himself from an accident, avoiding obstacles long enough for the car to stop. An unexperienced driver, who has only ever "driven" automatic vehicles would lack the wisdom to avoid crashing, would most likely panic and let the car hit something. To me, the comparison is almost perfect.
A broken sensor wouldn't completely disable the brakes. It would make them less precise, but the computer could still apply braking force. You'd have multiply-redundant systems to ensure that they were always available. It would take way more than just a couple of sensor failures as happened here, and that kind of massive failure only appears in really dire circumstances coupled with bad design, e.g. that DC-10 that lost all hydraulic systems when the engine exploded, because they managed to route them all past the same point.
Yes, but the computer only knows as much as its sensors tell it. If according to the sensors the breaks are not working, it doesn't matter that they defacto work - the only logical conclusion that the computer can take at that point is assume it's unable to apply breaks and relinquish command to the driver. And even multiple sensors can become broken - like here, the plane had 3 sensor pipes and they all became clogged with ice. The autopilot assumed that the values are invalid, therefore it couldn't continue functioning - and gave control back to the pilots.
Also, don't forget that you can't have redundant systems for everything, unless you want to be driving a tank. Imagine driving an automatic car and then some bird poo falls on the laser-sensor and the car literally can't see anymore(I am exaggerating, but the car can surely be blinded by something, the laser sensor on top can become dirty or damaged). The best it could do is apply full breaking force,but if you are on a motorway and there is an 18-wheeler behind you it could be a fatal idea. Again - the autopilot can't continue, it has to give control back to the driver - and the driver might crash the car if they are not experienced enough.
I actually think autopilot for an airplane is much, much safer than in a car. Airliners fly at several tens of thousands of feet in altitude and have glide ratios that are rather impressive, between 10:1 and 30:1 meaning that at cruise (where airliners spend most of their time on autopilot) the flight crew has several tens of minutes to figure out what's going wrong. Even if the airplane loses power completely!
Further, these airplanes are kept fairly widely separated in altitude and the skies are rather sparse, so collisions are something to be avoided but it's not all that hard.
In a car though, the safety margins are much, much lower. Because there are vehicles everywhere the time to collision is probably measured in milliseconds rather than minutes. Because there are no redundant systems to ensure safety once the car "realizes" it can't control itself anymore you're prettymuch hosed. Are any of the regulations on self-driving cars taking this into account and at least mandating that the control system has sufficient battery back-up for it to at least TRY and gracefully de-energize the vehicle?
Once cars become self-driving you can't really rely on humans to suddenly jump in and take the wheel and save the day. They're going to be asleep or not paying attention or watching a movie or whatever. And if they are going to be required to watch the road paying 100% attention to what they car is doing, what's the advantage of having the car drive itself? You're in a constant battle of "what's the car going to do?!" which is actually more tiring than just driving it yourself.
An easy solution might require that self-driving cars only self-drive in lanes which are adjacent to a shoulder of sufficient width giving the car an out that requires only minimal controls, so basically far-right or far-left lanes on a freeway.
A self-driving car might also need to have multiple, redundant regenerative braking systems so that it can power itself enough to power the controls to safely guide the car to a stop. But then it also needs multiple control systems so that if one of those fails, the car isn't out of control.
The economics of having an autopilot on an airliner (which costs many millions of dollars) and a car (95% of which cost less than $100k) are really, really different.
I think it's clear enough that you're right just from experience. We've had autopilots of various kinds of airplanes for decades, and they can fly pretty much autonomously at this point.
But in this one specific area, of how to handle failures and returning control to the human, I think cars have the advantage. It just doesn't compensate for all the other places where a car autopilot is vastly more difficult.
So my gut reaction to "cars have the advantage" is "you're clearly wrong!" but that's not really polite or enlightening. Rather than argue about it (which I'm sure we could do endlessly) I'd like to know why or how you think that cars have the advantage. I saw earlier that you posted "because you can always have the car pull over to sort a problem out" and I would agree that provided the car can still control itself, yes it could do that.
I guess my assumption on when the car tells a human being to take control are in a few circumstances:
1. it loses the ability to control a driving input that ostensibly the driver still has the ability to control (steering servo fails)
2. it loses the ability to control a driving input that the driver also can't control (tire blowout)
3. it doesn't know what to do or can't make a decision so the driver is the tiebreaker (crash imminent, road disappears, brand new road with no map data, etc)
4. it loses a sensor input completely or starts getting data that it considers garbage and thus can't safely operate the vehicle (LIDAR or camera fails)
5. loss of power so that autopilot just straight up fails
I could probably think of some more scenarios but the point isn't to be exhaustive but illustrative.
So in some of these circumstances the car does have an opportunity to pull over and wake the driver up and say "hey you need to drive now" but in others, it's going to be split second.
If ALL the car failure modes resulted in the car pulling over and the driver taking back over at his/her leisure then I would 100% agree with you. But there clearly are failure modes where the driver is going to get put back in the control loop with little/no warning and be asked to make a decision perhaps faster than they can wake up and/or process the scene and catch up enough to decide well.
So basically what you have to do is make some kind of guarantee about "the car will never ask the driver to take over with less than 60 seconds of notice" or something like that. But the hardware cost to enable you to make that kind of guarantee is substantial; sensors, battery backups, autopilot systems, actuators, etc all in triplicate. And I don't know that you can do with just two because in the situation where you go from two to one you don't have any kind of ability to determine if one of the pieces of software is malfunctioning due to memory corruption.
Although the price of doing all this is going down drastically I suspect that it'll be a while before people are willing to pay enough to get the kind of redundancy they have in airplanes.
A sudden catastrophic failure means you're probably screwed, indeed. But for cases like AF447 where it's small sensor failures, it seems to me that the car should be a much easier environment to work with, because you can always write some code that goes, "if important sensor X is wonky, pull over and stop".
For example, when the airspeed data was lost, the Airbus had to fall back to an alternate behavior which is part of what confused the pilots. In a car, you could skip that fallback and just go straight to "pull over and stop," but the airplane has to keep trying somehow. Similarly, the angle of attack went beyond the range the designers had anticipated, and the computer assumed that it was a bad reading. But it kept going, because it had to. In a car, if there's a bad reading, it can again just go straight to "pull over and stop".
Big failures will always mean big problems, but what's striking about AF447 is that it was such small failures. And when it comes to small failures, I think a car is in a much better position to deal with it because it can just cut the gordian knot.
Yeah when you put it that way, your position makes a lot of sense. Thanks for sharing.
I think the disconnect is that I see that sensor as hugely important. If you were in a car and it lost the ability to sense speed via the speedometer, how would it pull over and stop? How would it know how quickly to steer towards the shoulder? How would it know when it had stopped?
When airline autopilots were developed you didn't have a dozen ways to sense speed. With a car you have the speedometer, GPS, probably some kind of estimates from LIDAR and vision, and the ability to integrate output from the accelerometers and feed all those into a kalman filter to make a really good model for the car's speed even if the more accurate methods fail. Certainly there are good odds it could perform well enough to move the car to the shoulder.
I guess I am less worried about those kinds of more minor failures and more worried about the kinds where humans are suddenly thrust back into the loop. On airplanes the pilots nearly always have a way to control the plane and plenty of time to react since they've got 5-30 minutes worth of glide.
In a car when something goes wrong you might well have vehicles on either side, in front and behind if it's heavy traffic. And in that case if the car finds itself asking for a human driver very suddenly who has to start making very good decisions faster than a human is capable of.
In my mind the "you can always pull over and stop" only works if you're assuming that the car is driving on an immaculately paved stretch of nearly or completely empty road.
a flight attendant walked in, asking that the temperature in the baggage hold be lowered because she was carrying some meat in her suitcase. Bonin lowered the temperature. Fifteen minutes later a flight attendant called the cockpit on the intercom to report that passengers in the back were cold. Bonin mentioned the meat in the baggage hold.
This is a bit douchy, no? Or is it common practice?
Recently there have been many articles and different takes on the AF447 crash. To anyone who is truly interested I would highly recommend to read the official Final Report [1] as it gives a much more nuanced and complete picture than the journalistic dramatizations and heavy handed simplification.
But really, all the other interesting stuff aside (cascading errors, modal input), it really boils down to the undefensible decision by Airbus to average inputs from both pilots.
This one is really mind blowing. Also I don't get why they switched to joysticks instead of the traditional yoke. With mechanical feedback, yokes should be much more intuitive. I'd love to hear a pilot's opinion who has used both.
Captain Chesley Sullenberger (the famous pilot of the Hudson River crash landing) has the opinion that mechanically linked yokes (Boeing philosophy) is superior to independent fly-by-wire joysticks (Airbus philosophy).
A video from CBS shows a very eye-opening demonstration of tactile feedback the mechanical linkage can provide. It's a feedback loop that the non-flying pilot can't ignore.
I'm a glider pilot, and gliders universally use sticks (presumably because they're mechanically simpler and considerably smaller, and space is at a premium). I've flown planes with yokes before, and have on rare occasions more recently, and I don't like the feel of it at all. The stick gives much better control and feedback in my opinion. However, that could just be because it's what I'm used to. In any case, I don't think the joystick is a problem, but rather how it's implemented, with no feedback in the system. A yoke implemented in the same way would have had the same problem.
I used to be a glider pilot (and an instructor). A disadvantage of a yolk is that when you are flying one handed and apply g (or encounter turbulence) the g forces on your arm induce roll inputs, a stick reduces that. As most powered aircraft are optimised for cruising at 1g this is not so much of a problem but with gliders varying g forces are quite common.
The other consideration is that with most light powered aircraft the pilot and passenger get in from the side and a traditional stick sprouting out of the floor gets in the way, a yolk doesn't. With gilders you usually enter from above so the stick is not a problem.
No, I don't think it boils down to that. It was just a one of many different design decisions (and philosophies) that has provided a stellar safety record for Airbus planes right up to the point where it contributed to an accident.
Remember that it's easy to criticize such decisions in hindsight, but the decision was taken for a reason, and approved by government agencies at the time.
Positive exchange of control and knowing who is flying the plane is literally one of the first things you cover when learning to fly, before you even get in an airplane for the first time.
Averaging inputs in this way interferes with that in such an obvious fashion that it's really inexcusable. I really don't believe this is purely a hindsight thing. Sure, they made this decision for a reason and it was approved my government agencies at the time. However, that doesn't mean I can't think those reasons don't override the fundamental principle of always knowing who's in control of the airplane, and that the government agencies were wrong to approve it.
This crash is fairly amazing in how basic a failure it was. The two main things that went wrong (confusion over who was controlling the airplane, and not putting the nose down in a stall) are both extremely basic things. It's the computing equivalent of not checking to see if your machine is plugged in, except that people die because you forget to check.
It seems that training was deficient when it came to the basics, and I also think that the non-linked averaged controls are completely inexcusable and should be eliminated.
Or, if you're going to INSIST on doing something that's maybe not too smart (non-linked controls) there are a bunch of things you could do to fix the problem:
1. Have a switch that determines "who is flying the airplane" i.e. which controls are active
2. Implement some kind of feedback even if it's not direct mechanical such as moving both joysticks with a little bit of servo force: not enough to overpower one's hand but enough for the non-flying folks in the cockpit to see
3. Have an "averaging error" sound, light up, whatever if the two joysticks have inputs which are too far from one another to make sense. This isn't great because you still have to pick one joystick to have priority and that might be non-intuitive to pilots
Ultimately I think the biggest problem with the Airbus design is that it adds an extra level of indirection between pilot's inputs and airplane course. In most aircraft if you let the controls return to "neutral" the airplane will slowly return to neutral as well. In an Airbus if you let the controls return to neutral the airplane just continues to do whatever it was you were doing; if you're climbing it continues to climb; turning it continues to turn; etc.
It seems to me that this is how the problem occurred; someone yanked back on the joystick and nobody else noticed it and then it returned to neutral. But the airplane continued to try and hold attitude up. In a Boeing airplane that wouldn't be a few seconds of joystick back, it'd be a continuous holding of the yoke towards the pilots making it very obvious what was happening.
The pilots shouldn't have an integrator between them and the airplane because it makes the airplane handle in very non-intuitive ways to the first 80 or so years of aviation as well as basically all the smaller planes that pilots train on prior to flying big jets.
Really, I don't think there's a point to discussing ways to mitigate non-linked controls. It's basically like saying, well, if you're going to keep poisonous cobras in the baby's crib, here are some ways to help avoid getting bitten....
Now, there's no reason you can't have a full fly-by-wire system with all the conveniences and safety advantages that implies along with such a system. The two controls could be mechanically linked before feeding into the system, or they could be completely mechanically independent and then use a force feedback system to link the electronically.
There are interesting arguments on both sides of the Airbus fly-by-wire system, but it's ultimately a separate question.
Certifying and retrofitting force feedback controls on existing Airbus planes will be very expensive, and since the current safety record is so good, it's probably not going to happen unless another accident happens attributable to the same design decision.
I'm not saying I agree with the decision, just that you have to put it in context. It would be interesting to go back and see why they chose that design.
Although the failure was basic, and they certainly lacked hands-on high altitude flying experience, you have to consider that the situation they got themselves into became very confusing, to the point where they likely didn't trust any instruments or warnings they got.
The right initial reaction to the situation would _not_ have been to push the nose down, but to add power and a _slight_ nose up input.
However, pulling back on the stick would have been safe to do in normal law, so I think it's very likely that the most inexperienced pilot thought he still had stall protection, and that combined with control inputs that would only be appropriate in lower speed settings caused the initial sequence of events.
I think the initial sequence of events is entirely understandable.
Where it becomes completely ridiculous is when they're losing altitude at a rapid rate despite having the stick pulled all the way back. You are stalling. That should have been abundantly clear at that point. And then, when stalling, holding the stick back is the last thing you want to do.
Given the confusion and sensor trouble, stalling the plane is understandable. Keeping it stalled all the way down to the ocean is what is crazy. Designing the control system so that one pilot can't even know that the other pilot is keeping the plane stalled is likewise crazy.
It should have been abundantly clear, however it's not hard to imaging that if you're flying 99% of the time in an airplane that makes it _impossible_ to stall it (ie. pushing back all the way on the stick will not allow it to stall), you might be in a mindset where the possibility of a stall might not even enter your thought.
The fact that the stall warning stopped due to low airspeed and came on again when they pushed the nose forward (because airspeeds became available again and the stall warning started working) only made the problem worse, and can explain why they completely lost the trust in the instruments.
In the end, there's a host of factors and bad design decisions that led up to the accident, and on top of that poor high altitude training.
That's why I blame a lack of training for the basics. If you can ever get to the point as a pilot where the possibility of a stall might not even enter your mind, you've become dangerous. If the planes don't enter that regime themselves, then it needs to be intentionally caused in training so they don't lose proficiency.
Agreed, and that was one of the recommendations in the report. AFAIK current commercial flight simulators aren't designed to accurately simulate the aircraft outside the normal flight envelope, so pilots can only simulate approach to stall, or a stall that might not accurately represent what will happen with an actual airplane, in contrast to the stall training you do in a light aircraft.
I'd criticize this decision even without an accident. I've minimal experience flying planes, but I have a hard time trying to come up with a reason to remove feedback. The safety record is probably due more to the redundancy and safety attitude in air travel in general. The safety record shouldn't be used to excuse specific poor design decisions.
The decision to standardize controls and use fly-by-wire was made for practical reasons. The Airbus philosophy was to use fly-by-wire to make different airplanes of different sizes handle the same, reducing the requirement for pilot training when moving between models.
That in itself doesn't explain the averaging design choice, but it does explain why they decided on the particular fly-by-wire design they have, where in normal law the stick inputs don't have a 1-to-1 correspondance with control surface deflections (like you have on a small airplane for instance).
But fly-by-wire does not preclude the sticks being mechanically or electronically (force-feedback anyone?) linked together. This would seem to me a much better design choice which gives immediate tangible and visual feedback to the other pilot. Instead the whole system relies on the pilots to coordinate using communication and by reading the instruments, which happen on a much higher cognitive level than the tangible input IMO and are hence very hard to maintain under stress - as unfortunately illustrated by this tragedy.
Hence I'd say this is much more a design issue than it is pilot error, as both senior pilots were advising the right course but the interface design allowed the inexperienced pilot to silently override control. Yes, this junior pilot probably had too little training and reacted terribly; but what's the point of having multiple pilots if they apparently don't add any additional safety because coordination amongst them has to rely on non-technical means instead of being facilitated by intuitive interface design? Where's the iPhone revolution in planes?
>> But really, all the other interesting stuff aside (cascading errors, modal input), it really boils down to the undefensible decision by Airbus to average inputs from both pilots.
That's funny. I thought it was because they don't get sufficient stall training. The input blending would certainly be a contributing factor, but they would have made it if the guy did exactly nothing instead of the wrong thing.
This goes along with my feeling about the SF accident where the (was it Korean?) pilots don't generally fly planes but rely on the automation.
Both are critical. With proper input linkage, the other pilot would have realized that the panicked one was doing the wrong thing, and made him stop. With proper stall training, the panicked pilot wouldn't have misbehaved. Part of the reason why you have two pilots in the first place is so they can check each other and make up for situations where one pilot has a lapse of judgment, or panics, or is just improperly trained.
I think what was pointed out in the report was a lack of training on high altitude hand flying.
The pilots got plenty of stall training, but mostly in take-off / landing scenarios (which is realistically when you're most likely to experience a stall).
Article mentions that the aircraft also provides GPS-based speed, so maybe that's how? That's just an educated guess, I have no real idea.
Edit: Reading through the official investigation document:
"The angle of attack is the parameter that allows the stall warning to be triggered;
if the angle of attack values become invalid, the warning stops. "
So like said in another comment - even with no valid speed values, the angle of attack can trigger a stall warning.
Yes, and the angle of attack sensor also stops the stall warning if it reads a value above a certain threshold, discarding the value as invalid.
But apparently the airplane can still fly for a short time even at this crazily large angle. Therefore when the pilot did the right thing to reduce the angle, he triggered the stall warning again and completely got confused. I think this is a major design flaw in Airbus's system.
Yeah, even though it's suicidal, the angle of attack can physically be larger than 40 degrees, so I am not sure why would it be discarded as invalid. Most likely Airbus engineers decided that since no one would try to ascend at such ridiculous angle(especially since the autopilot will correct if the angle of attack is larger than 15 degrees), then such high values must indicate a broken sensor. A decision which contributed to the catastrophe, unfortunately.
Ground speed, which is what a GPS would indicate, doesn't have very much correlation with the aerodynamics of a plane. The true factor is airspeed which includes the winds around the plane. Taken to an extreme you could have a ground speed of zero and be flying perfectly normal if there's a head wind that cancels your forward velocity. (Won't happen with a commercial airliner but it illustrates the disconnect between the two factors)
I can't find a source for this right now, but I believe that the pitot tubes were only iced over briefly, and that normal airspeed readings did resume long before the end, but it seems the crew never reached any state of confidence about whether (or which of) their instruments were correct.
It raises an interesting point about instrumentation - it's easy to make a display that looks like a gauge, a needle, or whatever. But if the system behind the display can have some knowledge of whether it's getting good data or not, then really there is (at least) another dimension to the information. How do we represent that so that operators can make sound judgements in unfortunate circumstances?
A stall warning occurs when the angle of attack (angle between the wing and the airflow) is too high to maintain lift. There is a separate instrument for detecting this (which can also be disabled by ice build up, but appeared to be working here). Low airspeed is not the only condition for a stall - it can happen even at high speed!
Airspeed is actually a secondary and unreliable indicator of a stall. It's commonly said that "you can stall an airplane at any airspeed and at any attitude". This is not strictly true, but it gets the point across that there's a wide range of situations in which you can stall. You can be going near zero speed and not be in a stall if you're pulling near zero gees (e.g. going over the top of a parabolic arc), and you can be going well above the normal stall speed and still stall if you're pulling a lot of gees (e.g. making a steep turn, this is called an accelerated stall).
As sibling replies mention, angle of attack is the key indicator. There's a critical angle where you're stalled if you go beyond it, and not stalled below it, regardless of airspeed.
Light aircraft usually just have a metal flap on the leading wing edge which blows upward if the plane is angled up too much.
Edit: Having read the stackexchange explanation I think there is a big part of the reason for the crash right there. The warning system was operated by the computer taking data from the vanes and air speed indicators which gave weird results which surely confused the crew. Had the plane had a basic metal flap with switch and buzzer the crash may not have happened.
We can't have a discussion about the human factors in automated systems without talking about Sidney Dekker's book The Field Guide To Understand Human Error:
Fantastic read about the futility of placing blame on a single human in a catastrophe like this. It makes a strong case for why more automation often causes more work. Definitely worth checking out, Etsy has applied it to their engineering work by using it to facilitate blameless post mortems:
So it appears that the co-pilot was very agitated and possibly having a mild panic attack, at least from the perspective of the story. On that night, it would appear that he needed to be relieved of duty and someone else handle the flying since the thunderstorm seemed to scare him and make him agitated. Had the captain flown through the storm, I bet 447 would have landed without incident.
But isn't one huge issue here also that the way the airbus flight controls are designed it made it very hard for the experienced pilots to realize the wrong inputs the 'unskilled' pilot made and essentially allowed him to silently control the plane? This seems to heavily undermine the whole purpose of having senior people on board. And to rely solely on verbal communication to coordinate the input controls seems a very fragile concept to me.
I don't have much experience with the 330, but I assume it had some sort of stall-recovery mechanism, like a stick pusher. Why did it not override the pilots' inputs and force a pitch-down?
Also, the 330 is not equipped with pitot heaters? The military aircraft (simulators) that I've messed with will start to complain if you don't have the pitot heaters on, well before you ever leave the ground.
61 comments
[ 2.6 ms ] story [ 125 ms ] threadThis documentary about AF Flight 447 is the best I found so far: https://www.youtube.com/watch?v=TsgyBqlFixo
...including the last words of the pilots.
There is no (central) display indicating the current position of both control sticks.
There is no redundant system allowing the pilots to see their speed, even if the method used is inaccurate it would still be better than nothing (GPS, heated pitot tubes, ...) Same for the altimeter.
Flight recorders aren't designed to float and broadcast their position, or at least release a small beacon that would give rescue teams a general idea about where to search.
They are not designed to float, because there is no guarantee that the flight recorder will separate from the rest of the wreckage, but most importantly because accidents at cruise altitude are incredibly rare, it's the safest time of the flight - and you are very unlikely to be over the ocean in any other mode of flight. Even with airports close to the sea, a crash few km from the shore would not be difficult to locate.
And flight recorders have auxiliary batteries and actually broadcast their location for a month after the crash - the problem here was that no one had an idea where the plane crashed, something that's very,very improbable in its own right.
My point is that if we let teenagers drive fully automated cars,they might find themselves in a truly critical situation they will not be able to get out of, due to their lack of experience and training. People will then say - if they were experienced drivers, and if not for all this automation, they would be able to get out of this situation. Because that's exactly what this article is saying - if the aircraft wasn't as automated, and the pilots had a lot more experience actually flying, they would have realised that the plane was, in fact, stalling, and maybe would have saved it. That does not change the fact that automation, overall, saves more lives than it takes.
Also, don't forget that you can't have redundant systems for everything, unless you want to be driving a tank. Imagine driving an automatic car and then some bird poo falls on the laser-sensor and the car literally can't see anymore(I am exaggerating, but the car can surely be blinded by something, the laser sensor on top can become dirty or damaged). The best it could do is apply full breaking force,but if you are on a motorway and there is an 18-wheeler behind you it could be a fatal idea. Again - the autopilot can't continue, it has to give control back to the driver - and the driver might crash the car if they are not experienced enough.
Further, these airplanes are kept fairly widely separated in altitude and the skies are rather sparse, so collisions are something to be avoided but it's not all that hard.
In a car though, the safety margins are much, much lower. Because there are vehicles everywhere the time to collision is probably measured in milliseconds rather than minutes. Because there are no redundant systems to ensure safety once the car "realizes" it can't control itself anymore you're prettymuch hosed. Are any of the regulations on self-driving cars taking this into account and at least mandating that the control system has sufficient battery back-up for it to at least TRY and gracefully de-energize the vehicle?
Once cars become self-driving you can't really rely on humans to suddenly jump in and take the wheel and save the day. They're going to be asleep or not paying attention or watching a movie or whatever. And if they are going to be required to watch the road paying 100% attention to what they car is doing, what's the advantage of having the car drive itself? You're in a constant battle of "what's the car going to do?!" which is actually more tiring than just driving it yourself.
An easy solution might require that self-driving cars only self-drive in lanes which are adjacent to a shoulder of sufficient width giving the car an out that requires only minimal controls, so basically far-right or far-left lanes on a freeway.
A self-driving car might also need to have multiple, redundant regenerative braking systems so that it can power itself enough to power the controls to safely guide the car to a stop. But then it also needs multiple control systems so that if one of those fails, the car isn't out of control.
The economics of having an autopilot on an airliner (which costs many millions of dollars) and a car (95% of which cost less than $100k) are really, really different.
But in this one specific area, of how to handle failures and returning control to the human, I think cars have the advantage. It just doesn't compensate for all the other places where a car autopilot is vastly more difficult.
I guess my assumption on when the car tells a human being to take control are in a few circumstances:
1. it loses the ability to control a driving input that ostensibly the driver still has the ability to control (steering servo fails)
2. it loses the ability to control a driving input that the driver also can't control (tire blowout)
3. it doesn't know what to do or can't make a decision so the driver is the tiebreaker (crash imminent, road disappears, brand new road with no map data, etc)
4. it loses a sensor input completely or starts getting data that it considers garbage and thus can't safely operate the vehicle (LIDAR or camera fails)
5. loss of power so that autopilot just straight up fails
I could probably think of some more scenarios but the point isn't to be exhaustive but illustrative.
So in some of these circumstances the car does have an opportunity to pull over and wake the driver up and say "hey you need to drive now" but in others, it's going to be split second.
If ALL the car failure modes resulted in the car pulling over and the driver taking back over at his/her leisure then I would 100% agree with you. But there clearly are failure modes where the driver is going to get put back in the control loop with little/no warning and be asked to make a decision perhaps faster than they can wake up and/or process the scene and catch up enough to decide well.
So basically what you have to do is make some kind of guarantee about "the car will never ask the driver to take over with less than 60 seconds of notice" or something like that. But the hardware cost to enable you to make that kind of guarantee is substantial; sensors, battery backups, autopilot systems, actuators, etc all in triplicate. And I don't know that you can do with just two because in the situation where you go from two to one you don't have any kind of ability to determine if one of the pieces of software is malfunctioning due to memory corruption.
Although the price of doing all this is going down drastically I suspect that it'll be a while before people are willing to pay enough to get the kind of redundancy they have in airplanes.
So what am I missing? I'm really curious.
For example, when the airspeed data was lost, the Airbus had to fall back to an alternate behavior which is part of what confused the pilots. In a car, you could skip that fallback and just go straight to "pull over and stop," but the airplane has to keep trying somehow. Similarly, the angle of attack went beyond the range the designers had anticipated, and the computer assumed that it was a bad reading. But it kept going, because it had to. In a car, if there's a bad reading, it can again just go straight to "pull over and stop".
Big failures will always mean big problems, but what's striking about AF447 is that it was such small failures. And when it comes to small failures, I think a car is in a much better position to deal with it because it can just cut the gordian knot.
I think the disconnect is that I see that sensor as hugely important. If you were in a car and it lost the ability to sense speed via the speedometer, how would it pull over and stop? How would it know how quickly to steer towards the shoulder? How would it know when it had stopped?
When airline autopilots were developed you didn't have a dozen ways to sense speed. With a car you have the speedometer, GPS, probably some kind of estimates from LIDAR and vision, and the ability to integrate output from the accelerometers and feed all those into a kalman filter to make a really good model for the car's speed even if the more accurate methods fail. Certainly there are good odds it could perform well enough to move the car to the shoulder.
I guess I am less worried about those kinds of more minor failures and more worried about the kinds where humans are suddenly thrust back into the loop. On airplanes the pilots nearly always have a way to control the plane and plenty of time to react since they've got 5-30 minutes worth of glide.
In a car when something goes wrong you might well have vehicles on either side, in front and behind if it's heavy traffic. And in that case if the car finds itself asking for a human driver very suddenly who has to start making very good decisions faster than a human is capable of.
In my mind the "you can always pull over and stop" only works if you're assuming that the car is driving on an immaculately paved stretch of nearly or completely empty road.
This is a bit douchy, no? Or is it common practice?
[1] http://www.bea.aero/en/enquetes/flight.af.447/rapport.final....
A video from CBS shows a very eye-opening demonstration of tactile feedback the mechanical linkage can provide. It's a feedback loop that the non-flying pilot can't ignore.
http://youtu.be/kERSSRJant0?t=3m9s
However, it doesn't mean there aren't other pilots who prefer fly-by-wire joysticks and can list (safety) advantages over mechanical linkages.
Remember that it's easy to criticize such decisions in hindsight, but the decision was taken for a reason, and approved by government agencies at the time.
Averaging inputs in this way interferes with that in such an obvious fashion that it's really inexcusable. I really don't believe this is purely a hindsight thing. Sure, they made this decision for a reason and it was approved my government agencies at the time. However, that doesn't mean I can't think those reasons don't override the fundamental principle of always knowing who's in control of the airplane, and that the government agencies were wrong to approve it.
This crash is fairly amazing in how basic a failure it was. The two main things that went wrong (confusion over who was controlling the airplane, and not putting the nose down in a stall) are both extremely basic things. It's the computing equivalent of not checking to see if your machine is plugged in, except that people die because you forget to check.
It seems that training was deficient when it came to the basics, and I also think that the non-linked averaged controls are completely inexcusable and should be eliminated.
1. Have a switch that determines "who is flying the airplane" i.e. which controls are active
2. Implement some kind of feedback even if it's not direct mechanical such as moving both joysticks with a little bit of servo force: not enough to overpower one's hand but enough for the non-flying folks in the cockpit to see
3. Have an "averaging error" sound, light up, whatever if the two joysticks have inputs which are too far from one another to make sense. This isn't great because you still have to pick one joystick to have priority and that might be non-intuitive to pilots
Ultimately I think the biggest problem with the Airbus design is that it adds an extra level of indirection between pilot's inputs and airplane course. In most aircraft if you let the controls return to "neutral" the airplane will slowly return to neutral as well. In an Airbus if you let the controls return to neutral the airplane just continues to do whatever it was you were doing; if you're climbing it continues to climb; turning it continues to turn; etc.
http://www.apollosoftware.com/products/flybywire/flybywire_e...
It seems to me that this is how the problem occurred; someone yanked back on the joystick and nobody else noticed it and then it returned to neutral. But the airplane continued to try and hold attitude up. In a Boeing airplane that wouldn't be a few seconds of joystick back, it'd be a continuous holding of the yoke towards the pilots making it very obvious what was happening.
The pilots shouldn't have an integrator between them and the airplane because it makes the airplane handle in very non-intuitive ways to the first 80 or so years of aviation as well as basically all the smaller planes that pilots train on prior to flying big jets.
Now, there's no reason you can't have a full fly-by-wire system with all the conveniences and safety advantages that implies along with such a system. The two controls could be mechanically linked before feeding into the system, or they could be completely mechanically independent and then use a force feedback system to link the electronically.
There are interesting arguments on both sides of the Airbus fly-by-wire system, but it's ultimately a separate question.
Certifying and retrofitting force feedback controls on existing Airbus planes will be very expensive, and since the current safety record is so good, it's probably not going to happen unless another accident happens attributable to the same design decision.
AFAIK they could see how the controls were manipulated on the FDR, and I think both pilots actually applied nose-up inputs for some time.
Although the failure was basic, and they certainly lacked hands-on high altitude flying experience, you have to consider that the situation they got themselves into became very confusing, to the point where they likely didn't trust any instruments or warnings they got.
The right initial reaction to the situation would _not_ have been to push the nose down, but to add power and a _slight_ nose up input.
However, pulling back on the stick would have been safe to do in normal law, so I think it's very likely that the most inexperienced pilot thought he still had stall protection, and that combined with control inputs that would only be appropriate in lower speed settings caused the initial sequence of events.
Where it becomes completely ridiculous is when they're losing altitude at a rapid rate despite having the stick pulled all the way back. You are stalling. That should have been abundantly clear at that point. And then, when stalling, holding the stick back is the last thing you want to do.
Given the confusion and sensor trouble, stalling the plane is understandable. Keeping it stalled all the way down to the ocean is what is crazy. Designing the control system so that one pilot can't even know that the other pilot is keeping the plane stalled is likewise crazy.
The fact that the stall warning stopped due to low airspeed and came on again when they pushed the nose forward (because airspeeds became available again and the stall warning started working) only made the problem worse, and can explain why they completely lost the trust in the instruments.
In the end, there's a host of factors and bad design decisions that led up to the accident, and on top of that poor high altitude training.
That in itself doesn't explain the averaging design choice, but it does explain why they decided on the particular fly-by-wire design they have, where in normal law the stick inputs don't have a 1-to-1 correspondance with control surface deflections (like you have on a small airplane for instance).
Hence I'd say this is much more a design issue than it is pilot error, as both senior pilots were advising the right course but the interface design allowed the inexperienced pilot to silently override control. Yes, this junior pilot probably had too little training and reacted terribly; but what's the point of having multiple pilots if they apparently don't add any additional safety because coordination amongst them has to rely on non-technical means instead of being facilitated by intuitive interface design? Where's the iPhone revolution in planes?
That's funny. I thought it was because they don't get sufficient stall training. The input blending would certainly be a contributing factor, but they would have made it if the guy did exactly nothing instead of the wrong thing. This goes along with my feeling about the SF accident where the (was it Korean?) pilots don't generally fly planes but rely on the automation.
The pilots got plenty of stall training, but mostly in take-off / landing scenarios (which is realistically when you're most likely to experience a stall).
Off topic but how does the airplane know it's stalling if the airspeed indicators are not working?
Edit: Reading through the official investigation document:
"The angle of attack is the parameter that allows the stall warning to be triggered; if the angle of attack values become invalid, the warning stops. "
So like said in another comment - even with no valid speed values, the angle of attack can trigger a stall warning.
But apparently the airplane can still fly for a short time even at this crazily large angle. Therefore when the pilot did the right thing to reduce the angle, he triggered the stall warning again and completely got confused. I think this is a major design flaw in Airbus's system.
It raises an interesting point about instrumentation - it's easy to make a display that looks like a gauge, a needle, or whatever. But if the system behind the display can have some knowledge of whether it's getting good data or not, then really there is (at least) another dimension to the information. How do we represent that so that operators can make sound judgements in unfortunate circumstances?
As sibling replies mention, angle of attack is the key indicator. There's a critical angle where you're stalled if you go beyond it, and not stalled below it, regardless of airspeed.
The A330 has vanes which measure the airflow direction
http://aviation.stackexchange.com/questions/2094/how-does-an...
Light aircraft usually just have a metal flap on the leading wing edge which blows upward if the plane is angled up too much.
Edit: Having read the stackexchange explanation I think there is a big part of the reason for the crash right there. The warning system was operated by the computer taking data from the vanes and air speed indicators which gave weird results which surely confused the crew. Had the plane had a basic metal flap with switch and buzzer the crash may not have happened.
http://www.amazon.com/Field-Guide-Understanding-Human-Error/...
Fantastic read about the futility of placing blame on a single human in a catastrophe like this. It makes a strong case for why more automation often causes more work. Definitely worth checking out, Etsy has applied it to their engineering work by using it to facilitate blameless post mortems:
http://codeascraft.com/2012/05/22/blameless-postmortems/
The automation may have created new dangers, but it probably reduced more common errors.
To me, as an experienced pilot, that says it all.
Also, the 330 is not equipped with pitot heaters? The military aircraft (simulators) that I've messed with will start to complain if you don't have the pitot heaters on, well before you ever leave the ground.