Slashdot Mirror


Fly-By-Wire Contributed To Air France 447 Disaster

Hugh Pickens writes "The Telegraph reports that although fly-by-wire technology has huge advantages, Airbus's 'brilliant' aircraft design may have contributed to one of the world's worst aviation disasters and the deaths of all 228 passengers onboard Air France Flight 447 from Rio de Janeiro to Paris. While there is no doubt that at least one of AF447's pilots made a fatal and sustained mistake, the errors committed by the pilot doing the flying were not corrected by his more experienced colleagues because they did not know he was behaving in a manner bound to induce a stall. The reason for that fatal lack of awareness lies partly in the design of the control stick – the 'side stick' – used in all Airbus cockpits. 'Most Airbus pilots I know love it because of the reliable automation that allows you to manage situations and not be so fatigued by the mechanics of flying,' says Stephen King of the British Airline Pilots' Association. But the fact that the second pilot's stick stays in neutral whatever there is input to the other is not a good thing. 'It's not immediately apparent to one pilot what the other may be doing with the control stick, unless he makes a big effort to look across to the other side of the flight deck, which is not easy. In any case, the side stick is held back for only a few seconds, so you have to see the action being taken.'"

16 of 319 comments (clear)

  1. More to it than that by Anonymous Coward · · Score: 5, Informative

    This topic has been beaten to death by professional pilots and aviation experts on pprune.

    1. Re:More to it than that by kschendel · · Score: 5, Informative

      and airliners.net also. The ones who know what they are talking about are unanimous in that it had little to do with the non-backdriven controls; the pilots flying were so disoriented that it probably would have taken a giant flashing sign saying "you're falling out of the air, dummies!" to get them to nose down.

      And anyway, FBW != back-driven controls. The thread title is wrong and misleading. Boeing uses FBW too, but they back-drive the yoke and throttles. This has been discussed plenty as well, and there's no inherent advantage to one way over the other.

    2. Re:More to it than that by PhireN · · Score: 5, Informative

      the pilots flying were so disoriented that it probably would have taken a giant flashing sign saying "you're falling out of the air, dummies!" to get them to nose down.

      There was a recorded voice yelling STALL, STALL, STALL over and over again. They would have ignored the giant flashing sign too and blamed it on a computer error.
      They were just that disorientated.

    3. Re:More to it than that by beelsebob · · Score: 5, Interesting

      Yes and no –the reason they were ignoring the voice saying STALL, STALL, STALL was because they believed that the computer software made it impossible to stall the aircraft, and that all the warning meant was "if you turn off all the computer assistance now, it'll stall", not "the computer assistance is already all off, I am stalling".

      A second warning that doesn't ever sound in safe scenarios (e.g. FALLING, FALLING, FALLING) might just have made them twig to "crap, it really is stalling".

    4. Re:More to it than that by Richard_at_work · · Score: 5, Informative

      No, they were never taught that Airbus aircraft will prevent a stall, no airline teaches that - what they did was assume the stall warning was incorrect, because they did not do their memory check lists as required by Airbus and Air France.

    5. Re:More to it than that by tibit · · Score: 5, Insightful

      The first rule is: don't freak out. If you feel like freaking out is OK, then don't be a fucking pilot, mmkay? Pilots who freak out die. It's a time proven observation.

      A pilot who doesn't know that the AoA and airspeed are sourced by the same set of vulnerable sensors is silly. Next time when you walk down the jetway have a look on your left before you enter the plane. You'll see the pitot tubes sticking out. As an engineer, they'd be the first things I'd distrust if their outputs would be in disagreement with other sensors. Icing happens all the time, it's more common than uncommon.

      Those pilots had perfectly good input from the inertial platform, GPS and perhaps radio altimeter. They should have looked at their fine instruments, determined what their ground track speed was, what the attitude was, and figured out what to do. End of story.

      --
      A successful API design takes a mixture of software design and pedagogy.
    6. Re:More to it than that by nedlohs · · Score: 5, Insightful

      If the guy flying the plane reacts to the STALL warning going off by pulling the stick back then you are already dead.

      It's just a matter of time.

    7. Re:More to it than that by DieByWire · · Score: 5, Insightful

      To paraphrase Churchill... Never in the history of aviation blogging has so much crap been said to so many by one who new so little.

      Vacuum system on an A330? The only vacuum system on an A330 is the toilet.

      The static system worked fine. They knew their altitude all the way to impact.

      The pitot was heated. It was heated from the moment the first engine was started, automatically. The pitot design was unable to cope with the amount of supercooled water thrown at it. The subsequent design had problems, too. The current pitots by Goodrich work fine.

      Nobody 'put their head in the sand.' They made a fundamental error at the start and then were deeply confused as to what their problem really was.

      Seeing you expound an A330 crash based on your light aircraft experience is like watching a model rocketeer tell us what went wrong with Challenger based on his experience with cardboard tubes with fins.

      The accident report is painful to read because it was so avoidable. Your post made me as angry as the accident made me sad because you don't know squat about jet aviation yet feel free to tell us exactly what went wrong.

      --
      Never shake hands with a man you meet in a fertility clinic.
  2. Fly by wire.... by mseeger · · Score: 5, Insightful

    When i read the annotated black box transcript a few weeks ago, i asked airplane experts about this. They told me:

    If one pilot pulls and the other pushes the stick, there is an optical and audio signal.

    Also the person was questioned if he pulls the stick and he confirmed it. Unluckily it was already too late by then.

    I am no expert, but the root cause was IMHO the crew ressource management and training problem.

    1. Re:Fly by wire.... by Balinares · · Score: 5, Insightful

      Yeah, but your version has the unfortunate side-effect of not making a Boeing competitor look bad. Can't have that, you know.

      (Seriously, WTF is this summary? Fox News Scare Quotes around 'brilliant'? Really, Slashdot?)

      --

      -- B.
      This sig does in fact not have the property it claims not to have.
    2. Re:Fly by wire.... by Registered+Coward+v2 · · Score: 5, Insightful

      When i read the annotated black box transcript a few weeks ago, i asked airplane experts about this. They told me:

      If one pilot pulls and the other pushes the stick, there is an optical and audio signal.

      Also the person was questioned if he pulls the stick and he confirmed it. Unluckily it was already too late by then.

      I am no expert, but the root cause was IMHO the crew ressource management and training problem.

      While I agree it was a CRM issue; the control system design contributed to this, IMHO. Just because there is a visual and auditory clue at some point does not mean that is understood and remembered; or that it was even heard on more than a subconscious level. Having a visual clue helps, so when you look at a control you see the actual order to the system, rather than a neutral position. That helps operators realize what the system is doing and will help them realize when something is not in a position they expect for a given situation.

      Personally, I prefer Boeing's approach of having the controls positioned where they represent the input the system is receiving, that allows a pilot to scan the controls and develop an accurate mental model of what the plane is being told to do; which they can then determine if it is appropriate for the current situation. Not having that picture requires much more inquiry and analysis which may take critical seconds away from correcting the problem.

      This is not a problem unique to the aviation industry; I've seen it happen in others where there are complicated systems that have a myriad of controls and require an good understanding of the current conditions to ensure operators respond correctly. Three Mile Island is a good example of a similar set of conditions that lead operators to make bad decisions that were compounded by the control system design.

      Unfortunately, it is far easier to say "pilot or operator error" than fix the underlying causes that lead to that error when they are system control related.

      --
      I'm a consultant - I convert gibberish into cash-flow.
    3. Re:Fly by wire.... by darkeye · · Score: 5, Informative

      the thing with the Airbus control system is that you issue 'change' commands to the plane. you issue a 'roll command' when you push the stick to the side, and you issue a 'G command' when you push it forward or back. the plane will remain in the new commanded state until commanded otherwise.

      (now read the last sentence again, and chew on it, make sure you understand it thoroughly)

      thus, the usual way to fly the plane is to issue small, well-intentioned commands, not to pull on a stick for minutes, as one of the pilots here did. and the plane will stay in the new situation. 'will stay' means that it will issue corrections on its own to maintain the commanded attitude. for example, after having been issued a roll command for a few degrees, the plane will stay in that attitude even of there are disturbing factors - say, turbulence. (as a result, in such a case it is an error for a pilot to try to manually compensate for turbulence-induced attitude changes, as the plane does it on its own anyway, and he will end up over-compensating)

      all-in-all, this is a big change in the philosophy on how to fly a plane, even when flying alone, when compared to a 'legacy' system of direct physical coupling of control instruments to control surfaces.

      as for simultaneous inputs: actually, one of the pilots can 'take over' command of the plane, and shut out the other one, if he so chooses. none of the pilots did this on this occasion. when having multiple inputs, the plane does signal that the other person is entering inputs as well (at least visually, maybe there is also an aural indication). although, as pointed out, there is no physical feedback on the stick that would signal the other pilots inputs. when both are entering commands, their commands are 'added together'. thus a full pull & a full push on the stick will cancel each other out. two 'small' pushes will results a 'big' push. this makes sense, so that either pilot can 'adjust' the planes behaviour in addition to what is already happening.

      the point of not having physical feedback is to reduce strain on the pilots. this way, the stick is always centered, and when moving off center, the pilot knows he's issuing commands to the plane. if it was not so, the pilot wouldn't be sure in which state of the stick is it in a 'neutral' position.

      I hope the above gives some background to the story.

    4. Re:Fly by wire.... by bears · · Score: 5, Informative

      On an A320, the audio signal is to have the in-cockpit speakers bawl 'DUAL INPUT, DUAL INPUT' at you incessantly. It's not some small ding you can't hear.

  3. Attention, screeching children by Oswald · · Score: 5, Insightful

    Red herring #1: This isn't news.
    --Maybe not to some of us. But TFA is new, and in a more general publication than the sources many of you have cited.

    Red herring #2: This is an American anti-Airbus hit piece.
    --Probably not. The Telegraph is a UK publication, and the title seems deliberately designed NOT to call out Airbus. See #3...

    Red herring #3: The title blames FBW, that is a separate issue from back-driven controls.
    --Quite right. Perhaps the author wished to avoid seeming anti-Airbus; perhaps he just wasn't precise in his phrasing. You sure don't have to read far to find out the truth.

    Red herring #4: This is bullshit. The pilots fucked up.
    --Perhaps you're not familiar with the English phrase "contributed to." It doesn't mean the same as "caused." In any safety-critical occupation, a piece of equipment that obscures the actions of one of the team members impedes the type of cross-checking that was a major reason for using a team in the first place.

    No system is perfect. People are perfectly free to say that they think this is a minor issue which will only come up in very rare circumstances, more than compensated for by merits of the side-stick. Others might argue that the risks outweigh the benefits. I am smart enough to know that I am not qualified to have an opinion on the issue.

    I'm just tired of the hysteria here.

  4. Re:over use of tech by Anonymous Coward · · Score: 5, Funny

    Ever think we're relying a little too much on technology these days?

    Yeah! Let's go smash up some looms!

  5. Wait for the full report by Animats · · Score: 5, Informative

    This is more of a loss of instrument data problem. The pilots (and the computers) did not have reliable altitude, airspeed, or vertical speed information. They were in a storm at night. Read the third interim report, which has the data from the flight recorders. See section 1.16.6, "Reconstruction of information available to the crew".

    Bear in mind that this event started with loss of airspeed information: "The PF then said âoeWe haven't got good ... We haven't got a good display ...of speed" and the PNF "We've lost the speeds"." This was due to pitot tube icing. From the voice recorder information, it appears that the pilots never again trusted the airspeed information presented. The speed data did come back for a while, but then was lost again.

    The aircraft was then in a high altitude stall: The airplane's parameters were then: altitude about 35,800 ft, vertical speed -9,100 ft/min, computed speed 100 kt and falling, pitch attitude 12 deg. and engine N1 for both engines at 102%. But one of the pilots said At 2 h 12 min 04, the PF said that he thought that they were in an overspeed situation, perhaps because a strong aerodynamic noise dominated in the cockpit. The report says "Despite several references to the altitude, which was falling, none of the three crew members seemed to be able to determine which information to rely on: for them, the pitch attitude, roll and thrust values could seem inconsistent with the vertical speed and altitude values."

    Again, this is in a storm, at night, over ocean. All the crew has is its instruments. The crew misjudged which data was correct and which was wrong. Still, they had several minutes, three pilots, and plenty of airspace and altitude to deal with the problem. There was a way out. If the initial events had happened over high mountains, there would have been far less time to deal with the situation.

    There are fighters which are designed unstable for maneuverability and can't fly at all if they lose their air data inputs. They have ejection seats. Transport aircraft are more stable and can manually flown without air data inputs, but it's not easy. A technical argument here is that aircraft with computer-assisted flight controls should have much more redundancy in the basic air data inputs (altitude and airspeed). If the sensors had worked, the computers would have prevented this. The Airbus had three pitot probes, but they were all the same, and vulnerable to icing. It may be appropriate to require some completely different sensors, mounted on different parts of the aircraft, as a backup.

    Much of the blame belongs to Thales, which built the pitot probes. There were known problems with those probes before this crash. Air France has since replaced all Thales probes with Goodrich probes.