Slashdot Mirror
Fly-By-Wire Contributed To Air France 447 Disaster
Hugh Pickens writes "The Telegraph reports that although fly-by-wire technology has huge advantages, Airbus's 'brilliant' aircraft design may have contributed to one of the world's worst aviation disasters and the deaths of all 228 passengers onboard Air France Flight 447 from Rio de Janeiro to Paris. While there is no doubt that at least one of AF447's pilots made a fatal and sustained mistake, the errors committed by the pilot doing the flying were not corrected by his more experienced colleagues because they did not know he was behaving in a manner bound to induce a stall. The reason for that fatal lack of awareness lies partly in the design of the control stick – the 'side stick' – used in all Airbus cockpits. 'Most Airbus pilots I know love it because of the reliable automation that allows you to manage situations and not be so fatigued by the mechanics of flying,' says Stephen King of the British Airline Pilots' Association. But the fact that the second pilot's stick stays in neutral whatever there is input to the other is not a good thing. 'It's not immediately apparent to one pilot what the other may be doing with the control stick, unless he makes a big effort to look across to the other side of the flight deck, which is not easy. In any case, the side stick is held back for only a few seconds, so you have to see the action being taken.'"
This topic has been beaten to death by professional pilots and aviation experts on pprune.
the thing with the Airbus control system is that you issue 'change' commands to the plane. you issue a 'roll command' when you push the stick to the side, and you issue a 'G command' when you push it forward or back. the plane will remain in the new commanded state until commanded otherwise.
(now read the last sentence again, and chew on it, make sure you understand it thoroughly)
thus, the usual way to fly the plane is to issue small, well-intentioned commands, not to pull on a stick for minutes, as one of the pilots here did. and the plane will stay in the new situation. 'will stay' means that it will issue corrections on its own to maintain the commanded attitude. for example, after having been issued a roll command for a few degrees, the plane will stay in that attitude even of there are disturbing factors - say, turbulence. (as a result, in such a case it is an error for a pilot to try to manually compensate for turbulence-induced attitude changes, as the plane does it on its own anyway, and he will end up over-compensating)
all-in-all, this is a big change in the philosophy on how to fly a plane, even when flying alone, when compared to a 'legacy' system of direct physical coupling of control instruments to control surfaces.
as for simultaneous inputs: actually, one of the pilots can 'take over' command of the plane, and shut out the other one, if he so chooses. none of the pilots did this on this occasion. when having multiple inputs, the plane does signal that the other person is entering inputs as well (at least visually, maybe there is also an aural indication). although, as pointed out, there is no physical feedback on the stick that would signal the other pilots inputs. when both are entering commands, their commands are 'added together'. thus a full pull & a full push on the stick will cancel each other out. two 'small' pushes will results a 'big' push. this makes sense, so that either pilot can 'adjust' the planes behaviour in addition to what is already happening.
the point of not having physical feedback is to reduce strain on the pilots. this way, the stick is always centered, and when moving off center, the pilot knows he's issuing commands to the plane. if it was not so, the pilot wouldn't be sure in which state of the stick is it in a 'neutral' position.
I hope the above gives some background to the story.
On an A320, the audio signal is to have the in-cockpit speakers bawl 'DUAL INPUT, DUAL INPUT' at you incessantly. It's not some small ding you can't hear.
This is more of a loss of instrument data problem. The pilots (and the computers) did not have reliable altitude, airspeed, or vertical speed information. They were in a storm at night. Read the third interim report, which has the data from the flight recorders. See section 1.16.6, "Reconstruction of information available to the crew".
Bear in mind that this event started with loss of airspeed information: "The PF then said âoeWe haven't got good ... We haven't got a good display ...of speed"
and the PNF "We've lost the speeds"." This was due to pitot tube icing. From the voice recorder information, it appears that the pilots never again trusted the airspeed information presented. The speed data did come back for a while, but then was lost again.
The aircraft was then in a high altitude stall: The airplane's parameters were then: altitude about 35,800 ft, vertical speed -9,100 ft/min, computed speed 100 kt and falling, pitch attitude 12 deg. and engine N1 for both engines at 102%. But one of the pilots said At 2 h 12 min 04, the PF said that he thought that they were in an overspeed situation, perhaps because a strong aerodynamic noise dominated in the cockpit. The report says "Despite several references to the altitude, which was falling, none of the three crew members seemed to be able to determine which information to rely on: for them, the pitch attitude, roll and thrust values could seem inconsistent with the vertical speed and altitude values."
Again, this is in a storm, at night, over ocean. All the crew has is its instruments. The crew misjudged which data was correct and which was wrong. Still, they had several minutes, three pilots, and plenty of airspace and altitude to deal with the problem. There was a way out. If the initial events had happened over high mountains, there would have been far less time to deal with the situation.
There are fighters which are designed unstable for maneuverability and can't fly at all if they lose their air data inputs. They have ejection seats. Transport aircraft are more stable and can manually flown without air data inputs, but it's not easy. A technical argument here is that aircraft with computer-assisted flight controls should have much more redundancy in the basic air data inputs (altitude and airspeed). If the sensors had worked, the computers would have prevented this. The Airbus had three pitot probes, but they were all the same, and vulnerable to icing. It may be appropriate to require some completely different sensors, mounted on different parts of the aircraft, as a backup.
Much of the blame belongs to Thales, which built the pitot probes. There were known problems with those probes before this crash. Air France has since replaced all Thales probes with Goodrich probes.