Slashdot Mirror

The point of having pilots in modern airliners is precisely to intervene when automation fails. This happens. There are procedures for it.

This is a factual bit we disagree about.

You can read in the transcript. The stall warnings never stopped. They didn't alarm all the time but they didn't stop. The plane eventually stalled because the pilots did not correct the problem. I refer you to the final report of the accident not the opinion of a pilot's union.

The aeroplane went into a sustained stall, signalled by the stall warning and strong buffet. Despite these persistent symptoms, the crew never understood that they were stalling and consequently never applied a recovery manoeuvre. The combination of the ergonomics of the warning design, the conditions in which airline pilots are trained and exposed to stalls during their professional training and the process of recurrent training does not generate the expected behaviour in any acceptable reliableway.

That is unless you want to argue with conclusions of the official report.

Do you really think you need to tell me what a stall is?

When you posted something factually incorrect about what a stall is, I expect you to admit that you posted factually incorrect information. I'm not a professional pilot but I know enough about aviation to know what a stall is. Stalling due to high speeds is unlikely especially when that was not the case in Air France 447. There were climbing; their air speed was not too high. They were stalling because their air speed was too low and the AoA was too high; they just didn't believe the warnings.

Yes, the stall happened because airspeed was too low. However, the stall warnings did the worst thing possible: turn off when airspeed is low and turn on when airspeed increases.

There were a number of contributing factors to this accident, but you seem desperate to dismiss that the fact that the pilots made errors that led to the crash and blame everything else. The computer did not "panic"; it did exactly what it was supposed to do. The stall warnings while intermittent did alert the pilots to the exact situation that caused the plane to crash. This was a recoverable situation, and the pilots did not apply the proper procedures: Establish initial control then deal with the situation. Instead the crew panicked not the computer.

More generally, the double failure of the planned procedural responses shows the limits of the current safety model. When crew action is expected, it is always supposed that they will be capable of initial control of the flight path and of a rapid diagnosis that will allow them to identify the correct entry in the dictionary of procedures.

Read the cockpit transcript. The stall warnings stopped whenever the crew member pulled the stick back and made the stall worse. (They stopped because the computer was programmed to treat the ridiculously low airspeed indications as instrument failures and disregard them).

I have. That's not what I read in the transcript. 2 h 10 min 03: Cavalry charge (autopilot disconnection warning)
2 h 10 min 10,4: SV: stall
. . .
2 h 10 min 13,0: SV stall
. . .
2 h 10 min 41,6: Weâ(TM)re in... yeah weâ(TM)re in climb
2 h 10 min 51,4: SV Stall
(for the next minute until 2 h 14 min 01,7 there are stall warnings)

It has 2 pitot tubes and 1 failed.

This is incorrect:

On 12 August 2009, Airbus issued three Mandatory Service Bulletins, requiring that all A330 and A340 aircraft be fitted with two Goodrich 0851HL pitot tubes and one Thales model C16195BA pitot (or alternatively three of the Goodrich pitots)

Apart from that the aircraft was in perfect condition. The failing pitot tube recovered during the fall, so all equipment worked correctly.

The pitot tubes failed because of icing. There would be no ice when they were recovered so "working correctly" isn't exactly true as the conditions of the accident were not in place when they were recovered.

The autopilot shut off and the computer put the plane into alternate law, where pilots are allowed to do stupid things like stall the plane. The computer had one perfectly working airspeed indicator to rely on, but instead it panicked.

Do you know what happens when one of the pitot tubes fails in these conditions? It give erratic readings. So the autopilot cannot determine which one of the 3 readings is correct. It's not "panicking" if it is meant to do that.

It's interesting... most of the expert opinions I have heard say that the asynchronous nature of Airbus sidesticks was *not* to blame, and that the crash would not have happened if the pilots were properly communicating as per Cockpit Resource Management protocol.

There's blame and there are contributing factors. Accidents like these are normally a series of failures that leads to the accident.

However, when you consider that the crash happened basically because a very junior pilot was pulling the stick back *the entire time* and the senior pilot did not realize this,

In the Airbus, it is not a flight stick. It is a joystick. If I remember correctly this picture demonstrates the configuration of the joystick. If I remember correctly the flying pilot was in the right-side seat so it was not evident to the other pilot what he doing with the controls. Second, the other pilot isn't having scones and coffee while all of this is happening. The other pilot was dealing with a plethora of warnings and failures and trying to diagnose them all. Communication did break down.

From the transcript Around 2 hr 12 min 32 sec:
Left side pilot: "so go down "
Captain: "No you climb there "
Captain: "You’re climbing"
Right side pilot: "I’m climbing okay so we’re going down"
2 hr 13 min 40 sec
Right side pilot: "But I’ve been at maxi nose-up for a while"
Captain: "no no no don’t climb"
Left side pilot: "so go down "

From my interpretation, it appears the left is telling the right to dive and the captain is simply alerting the right that he is climbing. The right has misunderstood and is still pulling not pushing. In the second set, the left and captain realize that the right has been pulling the entire time. But it's too late.

It's interesting... most of the expert opinions I have heard say that the asynchronous nature of Airbus sidesticks was *not* to blame, and that the crash would not have happened if the pilots were properly communicating as per Cockpit Resource Management protocol.

There's blame and there are contributing factors. Accidents like these are normally a series of failures that leads to the accident.

However, when you consider that the crash happened basically because a very junior pilot was pulling the stick back *the entire time* and the senior pilot did not realize this,

In the Airbus, it is not a flight stick. It is a joystick. If I remember correctly this picture demonstrates the configuration of the joystick. If I remember correctly the flying pilot was in the right-side seat so it was not evident to the other pilot what he doing with the controls. Second, the other pilot isn't having scones and coffee while all of this is happening. The other pilot was dealing with a plethora of warnings and failures and trying to diagnose them all. Communication did break down.

From the transcript Around 2 hr 12 min 32 sec:
Left side pilot: "so go down "
Captain: "No you climb there "
Captain: "You’re climbing"
Right side pilot: "I’m climbing okay so we’re going down"
2 hr 13 min 40 sec
Right side pilot: "But I’ve been at maxi nose-up for a while"
Captain: "no no no don’t climb"
Left side pilot: "so go down "

From my interpretation, it appears the left is telling the right to dive and the captain is simply alerting the right that he is climbing. The right has misunderstood and is still pulling not pushing. In the second set, the left and captain realize that the right has been pulling the entire time. But it's too late.

The cause of the AF442 mishap is detailed here. And it says that the pilots flew into an area of weather that they knew about, lost air data, and entered a stall from which the did not recover. You're overemphasizing the pilots role, under emphasizing the mechanical failure and exaggerating the capability of automation.

Actually, when the pitot tubes of AF447 froze up, the computed and indicated speed fell down. They went back up to correct values when the tubes unfroze. You can check the relevant figure on page 89 of the BEA report.

Well, I can only advise you to read more carefully the investigation report (which was made by the BEA, not the FAA).
The airspeed indicator gave wrong information for 61 seconds at most .The others indicators (such as pitch indicator) were functioning correctly, yet it was the inappropriate control inputs of the pilot flying that directly put the aircraft into a stall. The stall warning sounded continuously for more than 54 seconds, yet nobody in the cockpit voiced the possibility of a stall. The main problem was that the crew in the cockpit was deeply confused... probably overloaded with information they couldn't prioritize, and discarded (consciously or inconsciously) the warnings presented by the aircraft systems. Saying that they "followed the computer instructions" is a deeply flawed way of describing the situation.

Aircraft design is a collaborative effort that includes pilots among many others, not just engineers. Not sure what your point is. If you're suggesting that they were overwhelmed by warnings and such, I would concur. That is the point of training and systems knowledge. All ECAMs are prioritized to allow the pilots to deal with the most pressing emergency (as a user, I think it fails from being needlessly complicated and unintuitive). This notwithstanding the fact that one must "fly the airplane first" at all times. The parent's point that Airbus have design flaws because the sticks are independent, is as I said, incorrect. He could say he he has issues with design philosophy, but its not a flaw to have independent sticks, and no machine yet can make judgments on what info the pilots need about systems failures. Perhaps you are advocating aircraft have a neural connection to the pilot's brain- sadly that is only science fiction as yet.

Certainly this would have been the only alarm they were hearing or blinking light they were seeing, you know in a stalling aircraft

Yes I do know. I think I'm qualified to make the argument that this is not a "flaw", or make observations on the AF mishap. I have over 7700 hours on Airbus and over 14000 total flight time as a commercial pilot, including training in stall recovery in large swept wing aircraft, and I've heard this argument made many times.

As a result, and to my dismay as an Airbus pilot, Airbus have modified their stall recovery procedure to retard thrust to idle- contrary to every thing pilots are taught from the very first stall.

The final mishap report makes very interesting reading (as do most reports): http://www.bea.aero/docspa/2009/f-cp090601.en/pdf/f-cp090601.en.pdf

The problem was more fundamental than the cockpit crew not being able to see what the pilot flying was doing. The problem was that it seems that nobody knew what were the right inputs to make. As the summary of the investigators interim report puts it:
- Neither of the pilots made any reference to the stall warning
- Neither of the pilots formally identified the stall situation

This is more of a loss of instrument data problem. The pilots (and the computers) did not have reliable altitude, airspeed, or vertical speed information. They were in a storm at night. Read the third interim report, which has the data from the flight recorders. See section 1.16.6, "Reconstruction of information available to the crew".

Bear in mind that this event started with loss of airspeed information: "The PF then said âoeWe haven't got good ... We haven't got a good display ...of speed" and the PNF "We've lost the speeds"." This was due to pitot tube icing. From the voice recorder information, it appears that the pilots never again trusted the airspeed information presented. The speed data did come back for a while, but then was lost again.

The aircraft was then in a high altitude stall: The airplane's parameters were then: altitude about 35,800 ft, vertical speed -9,100 ft/min, computed speed 100 kt and falling, pitch attitude 12 deg. and engine N1 for both engines at 102%. But one of the pilots said At 2 h 12 min 04, the PF said that he thought that they were in an overspeed situation, perhaps because a strong aerodynamic noise dominated in the cockpit. The report says "Despite several references to the altitude, which was falling, none of the three crew members seemed to be able to determine which information to rely on: for them, the pitch attitude, roll and thrust values could seem inconsistent with the vertical speed and altitude values."

Again, this is in a storm, at night, over ocean. All the crew has is its instruments. The crew misjudged which data was correct and which was wrong. Still, they had several minutes, three pilots, and plenty of airspace and altitude to deal with the problem. There was a way out. If the initial events had happened over high mountains, there would have been far less time to deal with the situation.

There are fighters which are designed unstable for maneuverability and can't fly at all if they lose their air data inputs. They have ejection seats. Transport aircraft are more stable and can manually flown without air data inputs, but it's not easy. A technical argument here is that aircraft with computer-assisted flight controls should have much more redundancy in the basic air data inputs (altitude and airspeed). If the sensors had worked, the computers would have prevented this. The Airbus had three pitot probes, but they were all the same, and vulnerable to icing. It may be appropriate to require some completely different sensors, mounted on different parts of the aircraft, as a backup.

Much of the blame belongs to Thales, which built the pitot probes. There were known problems with those probes before this crash. Air France has since replaced all Thales probes with Goodrich probes.

That's not at all how it happened. At first the tubes were frozen over but after a short while, as the aircraft descended, they thawed and resumed providing correct data. The altimeter also worked and showed them they were descending fast. It is inexplicable why the younger copilot would keep pulling on the stick all this time, which slowed the aircraft and sustained the stall. But the technical problem went away very quickly, this accident was entirely human error. Read the report from the crash and you will see.

My information suggests that the sensors feeding the black box either cannot or were not made available to the primary flight instrument computers, astonishingly enough.

It would indeed be astonishing. Based on all your posts here you seem to be saying that:

- One of the ADIRUs (responsible for providing air and inertial data) gave up completely. Airspeed has nothing to do with inertial data such as attitude, and furthermore there is no reason to stop providing altitude information unless the three (3) static ports showed any differences. I think it's a pretty safe estimation based on the official BEA reports so far that the underlying inputs were not a problem there. For the ADIRU to shut off completely, solely because of lack of valid airspeed information, would be a curious vulnerability to say the least, it's not how it's designed, and again we have nothing to demonstrate this.
- Somehow the other two ADIRUs also gave up completely. See above. Alternatively you have suggested that one component (such as one of the ADIRUs) may affect another independent component. This is highly speculative and we have nothing to indicate that either.
- Somehow the ISIS (providing information such as airspeed, attitude, and altitude) failed. More speculation. It is heavily isolated - it has mechanical inputs - pneumatic lines for pitot/static, and internal components for attitude calculation - and a backup power supply.

I could note that there are some people out there who read the maintenance messages sent by the aircraft, one of them mentioning ISIS. What they don't say is that it refers solely to the display of airspeed. Similar grave errors are made in interpreting the maintenance messages and various known facts. Somewhere down the line someone saying "I don't know anything about this, but maybe X, Y and Z happened" becomes "experts know that X, Y and Z happened".

Let me say this again: if someone is saying that we know that other fundamentals than airspeed / stall warning was indicated erroneously, they are not basing it on published BEA data. Prove me wrong if you can. Everything should be in there along with some explanations, so please read the reports.

They don't have GPS or even ground/ocean-bouncing radar to give them altitude info?

GPS altitude should have been available if selected. Radio altimeter has a very limited range (normally displayed below 2,500 feet or so). These two and the altimeter might be about it in terms of precise altitude.

However, the altimeter should have been working anyway. There's no evidence to conclude that any of the static ports malfunctioned, or any unrelated and independent functions such as the three artificial horizons for that matter. In fact the CVR shows they were aware of their altitude when nearing 10,000 feet.

All aircraft have a "safe-mode" angle of attack

I don't believe that any AoA indication was available in this particular A330, other than indirectly through the stall warning (which unfortunately had design limits and thus was somewhat inconsistent, read the latest report).

Still, there's no evidence to conclude that they lost any fundamental information other than airspeed indications anyway.

the pilots flew into a thunderstorm

What we can assume is that they expected only a slight increase in turbulence. The pilot in control of flying the plane told the cabin crew: "in two minutes we should enter an area where it’ll move about a bit more than at the moment, you should watch out". They also made a left turn shortly after that in hopes of avoiding even that, and then the turbulence "increased slightly". As for visibility, they probably had no visual references prior to entering the storm. For instance, as far as I can tell with Celestia the moon was not visible from their location at 0200 UTC on 20090601.

once all 3 pitots froze

We only know for sure that 2 of the indicated airspeeds were incorrect at some points, probably due to icing in the pitot tubes. The third was not recorded.

the redundant computers started disagreeing and then finally agreed that things were ugly

the effect in the cockpit is that a serious of cascading failures were unfolding

Yes, the speed inconsistency lead to the following among other things:

- alternate law in effect (see below),
- autopilot disconnecting, and
- autothrust disconnecting (although I understand the engine thrust would have stayed the same at this point until a pilot altered it).

likely overwhelming the pilots

This is pure speculation at this point.

additionally, there would be NO functional indicators for alt, speed, horizon, etc.

Wrong. There's no evidence to support malfunctioning fundamental indicators other than loss of airspeed indication, and perhaps the somewhat inconsistent stall warning.

Once the computers have faulted, they no longer share that information

See previous point.

Also, as the computers degrade authority, in an Airbus the pilots get MORE control of the aircraft.

This is a fair statement. They degraded into alternate law.

This means that controls move through larger ranges.

More or less so (stalling etc. possible), but the computers still have an intermediary role so for instance they could not go beyond max G loads in this particular mode.

As flight control reverts to failsafe mode, the controls in the cockpit do not "auto-zero".

Are you talking about auto trim? Auto trim was still available, as shown in the report. (If the aircraft had degraded into direct law, it would have been disabled.)

And the forcefeedback goes off line.

There's no force feedback that I'm aware of, other than a stick shaker during indicated stall.

Effectively, the pilots are 100% blind, and the inputs they make have no feedback whatsoever.

The report clearly states that the engines responded, and the report seems to be consistent with the aircraft responding to all "mainly nose-up" inputs by one or both pilots. What was displayed to the pilots was inconsistent for a time, yes, but again many of the instruments may never have failed at all.

They cannot even tell if they have _stopped trying_ to turn.

What do you base that on? Again other than the stall warning and airspeed indications there is every reason to believe that many if not all other instruments were working, such as:

- Information from GPS etc. (such as g

The actual BEA report, which should be read before commenting, does not assign blame. That will come later.

At one point, the left side airspeed display showed 215 knots, far above stall speed. The backup airspeed indicator showed 185 knots, also above stalling speed. The right side airspeed display value isn't logged. Then all speeds showed as invalid. Given that conflicting information, at night in a thunderstorm over water with no outside visual cues, it's not totally unreasonable that the pilots, finding themselves losing altitude but thinking they had more airspeed than they did, tried to pull up.

Two hours voice recording, data logs from a few hundred sensors, it all has to be done meticulously and perfectly in accordance with aviation authorities from Brazil, the UK, France, Germany and the United States. And lawyers, alot of lawyers.

"The download was completed in the presence of two Brazilian investigators of the Aeronautical Accidents Investigation and Prevention Center (CENIPA), two British investigators of the Air Accidents Investigation Branch (AAIB), two German investigators of the German Federal Bureau of Aircraft Accidents Investigation (BFU), one American investigator of the National Transportation Safety Board (NTSB), an officer of the French judicial police, and a court expert. The entire download was filmed and recorded."

http://www.bea.aero/en/enquetes/flight.af.447/info16may2011.en.php

And their press presentation slides in French and English.

They're lucky. According to the bathymetry map on page 8 of the press release [PDF], the wreckage has been found on a relatively flat/smooth sediment abyssal plain area rather than the more rugged, exposed bedrock of the surrounding sea floor. This made identification of the crash site with sonar much easier (it stands out from the otherwise smooth sediment surface, as seen on page 2) and should make subsequent mapping of the site easier too. Depending upon how soft the sediment is, there could be items sunk into the sediment, which wouldn't be so good, but overall the location is quite fortunate.

TFA in English.