Co-pilot Robert, after finally getting full control back from Co-pilot Bonin: "Damn it, we're going to crash... This can't be happening!"
Co-pilot Bonin, who had been pulling back & stalling the plane during the crisis: "But what's happening?"
Pretty much sums it up. I am thinking that perhaps Bonin had shellshock & may not have even realized he was holding the stick back. Perhaps the more experienced Robert didn't think to ask "are you pulling back the stick?" because that would be like asking "did you make sure the computer is plugged into the wall outlet?", i.e. it's so stupid & simple, that can't be "it".
There are a few things I could think that would be worth adding.
- Add a display that shows the current positions of both control sticks. Add an alarm when the two sticks are not within a certain margin of the each other, if both are engaged. Such as if one is full forward & the other is full back.
- Make clearer warnings about the implications of the "alternate law" mode. Such as a warning like "Stalling possible". Also maybe put an alarm in the pilot resting area that would relay when warnings are detected like stall or switching to alternate law.
- Delineate command better, e.g. Captain, Co-pilot #1, Co-pilot #2 so that who is in charge is clear.
> Add a display that shows the current positions of both control sticks
Yes! From the article: "As the plane approaches 10,000 feet, Robert tries to take back the controls, and pushes forward on the stick, but the plane is in "dual input" mode, and so the system averages his inputs with those of Bonin, who continues to pull back.
If this is true, it's insane. What does it mean to "average" the inputs of both pilots if one is full forward and the other one full back?? It should say "conflicting command; make up your mind".
The article alludes to the old system where the stick was just the one same stick for both pilots: no possible conflicts there.
The plane crashed because it burned all of its fuel in a holding pattern waiting to land in JFK. When the flight engineer noticed this, he was afraid to tell air traffic control, who he believed was "higher up" than he was (and he therefore had no right to question their decision). The result was 65 dead people.
There are several cases where a lower-ranking person has noticed something that the captain has not. And when they didn't do anything about it, people died.
What I don't get is why THE HELL are the two sticks averaged? What's the reasoning behind this? "Hey, one pilot thinks we should descend, the other we should climb, better maintain altitude without telling either one about it". Why?
> - Add a display that shows the current positions of both control sticks. Add an alarm when the two sticks are not within a certain margin of the each other, if both are engaged. Such as if one is full forward & the other is full back.
Even better: when you have two mechanical inputs to a single output channel, mechanically _link_ the two. If Pilot #1 moves the stick, pilot #2's stick should move. So that if there is a disagreement, they can physically observe it in their hands. Any fight over where to put the stick shouldn't be "averaged". It should be physically felt by both pilots so that they realize that there is a conflict and resolve it face to face.
It's similar to why SVN commit conflicts are so damn annoying. But they're designed to be: the only way to resolve a commit conflict is to walk over and meet your conflicter face to face and resolve. Can you imagine if SVN decided to "average the inputs"? What the fuck does that even mean? This entire plane sounds like a UI disaster (modal inputs, etc.)
- Add a display that shows the current positions of both control sticks. Add an alarm when the two sticks are not within a certain margin of the each other, if both are engaged. Such as if one is full forward & the other is full back.
This was my first thought as well. Confusion in one pilot was allowed to cause confusion in the second pilot, because he didn't realize that his partner was doing something unexpected and incorrect. If you make sure a pilot can always detect inconsistent reaction in a co-pilot, you can keep them in sync and prevent spreading confusion. An alarm when the two pilots are out of sync seems like a pretty straightforward benefit.
I think the simplest solution to the mismatched stick issue is to use servo motors to replicate the old situation--the movement of each stick mirrors the movements of the other.
A pilot wouldn't have to look for some stick position display, or indicator light, if they can easily feel the deflection of the stick.
I want a device that gives me an electric shock every time I think or say this. If one can restructure one's cognitive habits in a way that replaces thoughts like this with thoughts like "What would explain this? Is this reasonable? What are the alternaives? How can I check this?", many errors will be avoided.
Having multiple joysticks that can be in different positions at the same time and yet all simultaneously affect the flight of the Airbus is a serious design flaw.
Up to this point, the situation was playing out in a sadly too common case of pilot error, pilot inexperience, which makes up a huge portion of aviation accidents.
When I read about the dual input averaging, I literally exclaimed "what?!". I can't believe that, for all the strict standards that flight control software must meet, nobody called this out as a dangerous idea?
Exactly. Anyone who has fought for control of a television with two remote controls knows exactly how this works out. You both start pushing channel-up and channel-down in response to what you think is the other persons action but may be in fact be your own.
The state of UX design has advanced so much, perhaps we need more UX testing so that even pilots who are unfamiliar with a plane could figure out what to do. Amazon probably does more with figuring how to help users checkout their shopping cart than plane designers helping pilots get a plane out of a stall.
Alternate law and normal law introduces two modes. This breaks one of the rules of user experience, especially if it is infrequently encountered. Combined with turning autopilot off on its own, it is bound to cause even more confusion. The plane could have put an alert asking the pilot to go on autopilot, otherwise, it will continue by making educated guesses. (A pilot is no better judge of airspeed than the computer)
Another rule of UX broken is "tell" instead of "announce". The voice should have said "Stall. Dive now" or "Stall. Why are you pulling the stick back?".
The flight computer can reinforce its credibility by demonstrating it has predictive capability. For instance, it can say, "decrease your angle of attack or you will stall in 5 seconds", then "4", "3" "2" "1", "stalling". The voice should demonstrate increased tension and panic as counting down.
It is high time the flight computer act as the "third pilot". It is similar to video judges in competitive sports.
Of course people may choose to ignore the computer, but we can then continually review why the computers assessment was wrong and improve on it.
What I don't understand is, how does a plane know it's stalling if the pitot tubes are frozen?
By the way, optical flow meters could have been used as a backup.
my dad is a captain, very experienced -- flies 777s, has > 20k hours and is trained in both airbus and boeings.
over dinner i once asked him "so what's the most exciting or difficult situation you've even been in?"
"hm... nothing i can think of, it is all pretty boring, really"
"i mean c'mon, there's got to be something!"
"you see? if you do things by the book plus a little on the safe side it usually works out that you are never in an exciting situation -- my job is to ensure that even the most unlikely exciting situations become more unlikely."
in this particular instance, it seems that there are a few actions that could've avoided the whole situation had the people in charge had the mentality of "by the book plus a little on the safe side". the most glaring one is that the other planes in the area diverted to avoid the storm. another: the captain should have made clear who is in charge.
of course, this is very easy for me to type from the comfort of my office without any situational stress.
It's interesting that First Officer Bonin is able to doom the plane by continuing to hold back on his joystick, even when that action isn't having positive results. Had the other first officer pushed his joystick forward, would the plane begin to dive? I assume that one joystick has precedence over the other...
It seems dangerous to have two joysticks, both capable of controlling the plane, that have no physical or simulated physical link. It means that one pilot could be attempting to control the plane and his actions will have no effect whatsoever if the other seat is panicking (as in this case).
The men are utterly failing to engage in an important process known as crew resource management, or CRM. They are failing, essentially, to cooperate. It is not clear to either one of them who is responsible for what, and who is doing what.
I have read a few other transcripts from crashed planes and this seems to be the most common and significant contributor.
I see variations of this problem almost daily in my day to day work. It strikes me so many times that people flat out refuse to communicate or do do in an extremely ambiguous fashion, people violate responsibility boundaries all the time (faux-technical people forcing technical decisions for e.g.) and that directly results in losses far greater than they should have been if there was any notion of discipline and communication.
That was one of the tensest things I've read in a while. My heart was pumping up until the end. The level of stress, confusion, and terror those pilots, not to mention the passengers, must have experienced must have been truly terrible.
Looks like one issue might be that all the instruments show what the aircraft is doing and what is happening outside, but it doesn't show what the pilots are doing. When we design interfaces, we of course assume the user is aware of their own actions and embodied state. But I guess when there are multiple users we need to help them be able to sense the actions/state of others.
Linking the two sticks is one way, another might be to show the state of the two sticks on the display next to the indicator of pitch, perhaps using coloring to highlight when the sticks are being pushed forward or backward. But of course there is already an overload of indicators. Really, improvements in the software/AI might be the best solution.
I've followed the discussion of the AF447 investigation on several flight discussion forums.
The PF (Bonin) apparently never became aware of his angle of attack (once the airplane fully stalled, AOA was absurdly high). He did not seem to be aware that his constant inputs had caused the Airbus's THS (trimmable horizontal stabilizer, horizontal flaps on the tail) to deflect to maximum in order to try to keep the nose up. Therefore when he tried to input stick up (nose down) several times briefly, and there was no obvious response (the computer takes a while to reduce THS elevation in response to opposing input), who knows what he thought -- maybe that all readings were incorrect.
Strangely, Bonin was the one pilot who had significant recent glider experience as I recall. The Airbus computer even in "alternate law" functions nothing like a glider (only "direct law" is sort of close to direct input), so maybe that further confused him.
In my opinion, at night, over an ocean, in a storm, with no visibility, in possibly significant turbulance, a modern aircraft cutting off Autopilot for any reason other than computer failure is completely unacceptable. A computer should be able to fly as well as a human under those circumstances.
People suggesting that on airliner forums get flamed. But it's true. Most pilots kept up the refrain that a computer cannot safely fly by gps and gyros unless they also have airspeed. Which is true. It's dangerous to fly if you don't have true airspeed (gyros and gps cannot accurate provide relative wind speed). However, if pitot tubes are frozen and the computer no longer has valid airspeed, the pilots no longer have valid airspeed either. Pitch and power is all they can do. The computer can do that just as well. All it needs to know is aircraft weight, which can be entered (maybe it is entered) before takeoff and automatically adjusted to account for fuel consumption.
There are a bunch of factors that contributed to the accident:
Pitots shouldn't have frozen.
Lack of Air France training for controlling an aircraft at altitude with the computer in "alternate law" (mode without full flight envelope protection; it's therefore possible to stall).
The command structure in the cockpit without the Captain (who had just gone on break) actually had Bonin in command, even though the co-pilot in the left seat outranked him... AF has since changed that. CRM (crew resource management) was poor; the co-pilot in the left seat didn't try to take control until way too late. The co-pilot was preoccupied with where the Captain was rather than offering constructive input on how to fly.
Bonin was not adequately aware of what his inputs were doing, or what the plane's Angle of Attack was, and did not react properly to the stall warning which in almost every case at high altitude means drop the nose, not raise it (though without valid airspeed there's a risk of overspeed which can cause a new set of problems).
The Airbus computers had some quirks; stall warnings stop if airspeed drops too low (due to some computer programming logic involving low airspeed, AOA sensors, and the result being silencing the stall warnings).
Nobody believed a passenger aircraft would be so stable during a full stall. This undoubtedly contributed to confusion about whether they were actually stalled. The Airbus's computer setting the trimmable horizontal stabilizer to max nose-up deflection, in response to Bonin's almost constant nose-up input, possibly contributed to the stability during stall.
Angle of Attack information may not have been adequately displayed to the PF (Bonin) -- the black box doesn't record data from the right set of instruments, so nobody knows what Bonin had on his screen.
There was poor notification on the co-pilot's side of what the PF (Bonin) was doing. Unlike traditional aircraft, it is not easy to see what the pilot in the other seat is doing with the stick.
There was poor notification on either side of the cockpit when the other pilot took control. When the co-pilot took control, Bonin almost immediately took control back, and it's not clear either of them knew what the other was trying to do. Apparently there's a light that indicates override, but who would notice such things under that amount of stress?
IOW, it was a disaster from top to bottom. Usually in aircraft accidents there's a chain of events, but in this case there were so many possible contributing causes that other than having better pitots that didn't freeze over, solving any one other problem may not have broken the chain.
What's missing from this article is the fact that the Captain chose to fly right into the storm, saying "on va pas se laisser emmerder par des cunimbs" (in essence: "fuck this storm")
Then, in the middle of the storm he leaves the two copilots alone, one of them quite inexperienced, and goes for a nap. He's obviously trying to demonstrate that he's not afraid of anything.
Well, maybe he was fearless, but now he's dead and so are all the passengers, passengers he was in charge of.
- - -
Once in the storm, and with the incredible amount of stress, it's hard to say if other pilots would have done better (other pilots that night avoided the storm!)
I've read that pilots are trained to react to a stall at the beginning of their career, but not as part of their regular training -- I don't know if it's true or not.
What's true is that stall is one of the worst things that can happen; it's like training bus drivers to hit the brakes when they're going right into a wall: of course they would do that...
I find the fact that the control sticks do not move together the most troubling design flaw. Bonin's actions were not obvious to the other two pilots, if the other pilot saw his stick pulled all the way back when he knows they need to get the nose down and pick up airspeed, he'd instantly know what was wrong. Instead he is looking at instruments and talking to the other pilot and is completely unaware of how self-inflicted the crisis is.
You suggest that one problem might be that Bonin didn't know his angle of attack. Alternately, I remember a similarity here with an Egypt Air flight that went down when some instruments went dead: when one of the instruments experienced malfunction, the pilots suddenly found it hard to believe anything the computer was saying. So maybe, on some level, Bonin dismissed the stall warning because the speed sensor had failed. One sensor is faulty, he might have reasoned, how can I know the computer isn't just over-reacting to that?
That last thing is the most important thing to notice since this is what most people think is the main result of air crash investigations: making a change to break the event chain leading to the incident.
In this case there were probably a number of human errors, a.o: not noticing speed restrictions on the speedtape (even in alternate and abnormal alternate law/mode these are present, although Valpha max and Valpha prot are removed a barberpole is present up to Vstall warning) and 'ignoring' the nose-down moment the airbus tries to induce in a low speed situation.
Possibly some design errors in the form of the alpha-floor protection removed in alternate law/mode.
Seems like there is a lot to learn from this investigation for both pilots and manufacturers and although it might seem harsh and insensitive (believe me, it's not; I've lost friends due to an aircraft crash) I am actually looking forward to the 'final incident reports'.
Making a computer that can fly without airspeed makes less sense to me than making an airspeed sensor that either doesn't ice, or can de-ice itself. Is that so impossible?
Thanks for the great summary. I also read the full BEA report which was very informative.
Is there ever a situation in a commercial plane where a stall would be a good thing? My non-pilot brain is trying to figure out why the plane would allow a stall even in alternate law mode.
I'm sure the Airbus user interface designers know what they are doing, but wouldn't it be possible to make stall protection always enabled, and then add a failsafe requiring both pilots to press a button to override stall protection? Then they would both have to consciously do a physical act to enter this dangerous state.
I don't think the average person realizes that for aircraft pilots ice is a constant worry even in tropical areas of the world.
The temperature drops 1.98C for every 1,000 feet you go up so you can see quite quickly how fast you can enter an area below the freezing point of water.
Icing of the pitot tube and carburetor are a constant worry at least for prop driven aircraft. Right from day one you're taught what to look for signs of carburetor icing and how to correct it. Water in the fuel is probably #3 on the list.
I never got far enough along to learn about wing icing I ran out of money for lessons but really everyday it's ice, ice, ice!
I never got far enough along to learn about wing icing I ran out of money for lessons
Hey, me too! (And 9/11 happened which made it a lot harder for foreigners to fly.)
But I did have the opportunity to get a lesson in how to avoid carb icing without carb heat when I pulled the carb heat control straight out of the dash on our 152. ;-)
I simply don't undersand (or don't comprehend) how the pilots don't know these things. My knowledge of planes is 4 hours of pilot lessons and watching a few documentaries on the Discovery channel yet I know that pulling the nose up of a plane would stall, that when you get bad readings from instruments you cross-check, and that a frozen pitot tube giving bad airspeed readings is very likely in high-altitude storms.
I even knew about the two modes of the Airbus - because I once watched an episode of "Air Crash Investigation" where the exact same thing as what is described in this accident happen to an earlier flight.
I don't know if I am jumping to judgement, but it sounds like some of these modern pilots aren't really enthusiasts - they are just people who are trained and do their jobs, and do them by the book and then go home (just like bus or taxi drivers).
I agree it's difficult to understand. I think a combination of confusion, distrust in the instruments and and a belief that the airplane would not stall must have contributed.
The PNF acknowledges "alternate law", if he had only made the PF aware of the implications of that, maybe he would have "snapped out of it" and stopped pulling up.
At some point during your training or flying career you'll probably have situations where in hindsight you'll try to understand why you acted a certain way despite knowing better. I've certainly encountered situations like that.
I think most commercial pilots today in a way have to be enthusiasts, or at least start out as one. The job market is simply too uncertain and cost of education so high that you really have like flying to go through with it. But keeping the enthusiasm in a job with a busy schedule and demanding family life might not be so easy. That's one reason why I don't plan on flying for a living.
Surely there must be more to it. Clearly all of us who've played a flight simulator know that going up too fast will cause you to lose speed and eventually stall and fall until you regain enough speed to stabilize.
Sadly in this case it sounds like a mix of overconfidence (not avoiding the storm, trusting the plane more than the stall warnings, not waking up the captain until it was too late) and a lack of training for unexpected situations were the major factors in the crash.
At night, over an ocean, in a storm, with no visibility, in possibly significant turbulance and responsible for the lives of 300 people. I doubt knowledge acquired from an episode of "Air Crash Investigation" is very useful in such a case.
Watching documentaries or looking up stuff on the internet does not make anyone an expert. That Bonin guy, as inexperienced as he was, knows far, far more about piloting airplanes than you do.
Presumably the stall warnings were ignored because in "normal law" even if you try to stall the plane, a). the plane will not allow itself to stall and b). the stall warning will still sound.
Hence the stall warning SHOULD NEVER SOUND in "normal law" mode.
Therefore, the only time a pilot should hear the stall warning is when they actually have to intervene.
Ultimately, if the plane was funcioning perfectly well and assuming the pilots weren't complete idiots, the problem was a 'usability' issue.
(think again everytime you see a bug logged as 'usability' and assume it is not important!)
Absolutely. You can almost feel the panic they must have experienced, trying to comprehend what was happening, in the dead of night, over the ocean:
"What the hell is happening? I don't understand what's happening."
"Damn it, I don't have control of the plane, I don't have control of the plane at all!"
It's like a non-fiction horror story. Cockpit data recorders provide some really gripping stories. Same with the air traffic control audio from the bird strike incident that ended with a plane landing in the Hudson river in NYC.
What impresses me most in this tragedy is its illustration of the culture of rigorous process to get to the bottom of what happened so that lessons can be learned to make flying safer. Relentlessly followed for decades, in all countries, this culture has made large airliner air travel the safest way to get between two distant places.
The lack of reaction to "Stall!" implies one of two things; either it was broken and the sound didn't play or the complete lack of understanding about what the word "Stall" meant with the pilots. Has either of these been proposed and discussed? The author of this piece doesn't seem to touch on why they ignore "Stall!", unless it's been confirmed the sound had been heard (on the recording maybe?) and they did indeed understand what "Stall" meant as it's "standard" pilot language?
Forgive my ignorance, maybe some pilots can shed some light on this. In the article it mentions that even though the plane was flying in "alternate" mode, my understanding is that it still has limits to what inputs can be given.
That said, even if autopilot is off, why wouldn't the computer have emergency functions to negate strange situations like this? When would pulling completely back on the stick while losing altitude rapidly ever be considered within the range of normal?
why wouldn't the computer have emergency functions to negate strange situations like this?
I think there are two main reasons. First, one is dealing with a situation where the autopilot has disengaged because it is receiving contradictory input from its sensors. How is the computer to know that a second sensor has not failed, and that its notion of what is normal is not? Failures may tend to cluster. The current technological presumption is that in the event of something unexpected, trust the human over the computer. At the current level of technology, this is still often a good bet.
Second, I think the legal situation encourages having a human be the final point of control. Presume that computer overrode the human, and that due to some low-probability unexpected combination of failures this caused the plane to crash despite the pilot doing "the right thing" as proven by the flight recorder. Then picture the size of the lawsuit against the everyone involved in the building and licensing of the plane. Contrast this with the same situation, but with the pilot responsible and dead in the crash. One may find that there isn't much desire from the manufacturer to change the system to take that final responsibility.
There is a famous incident with an A330 test flight where the auto pilot system happily flew into the ground precisely because, unlike Bonin, it did not panic and give in to the instinct to pull the nose back up.
I'm guessing this incident made the engineers who designed the plane a little more eager to provide for a true unhampered manual override.
> When would pulling completely back on the stick while losing altitude rapidly ever be considered within the range of normal?
I don't have a terribly accurate model of airplane control in my mind, but I think this would be the right answer when the nose is pointed down (i.e., the plane is diving). In some cases I think it might also be the right answer if your nose is level but you're losing altitude, e.g. when in a strong downdraft.
Pulling back was the wrong thing in this situation because the plane was in stall, but due to sensor problems and later high angle of attack/low airspeed, the avionics didn't have a complete image and an absolute certainty that the plane was in a stall (hence the stall warnings cutting in and out, too). I'm not sure I'd want the plane overriding me in this specific case.
Hmmm, lovely reading on a day I am due to fly with Air France across the globe!
It is easy to blame Bonin for being such an idiot and pulling on the stick all the time but it is a natural reaction, just like inexperienced drivers continuing to lock the brakes while skidding off the road. How many die that way every day?
More worrying to me is that the whole plane control is inherently and crazily unsafe. Whatever were the designers thinking, making the two sets of controls without cross-feedback and even 'averaging their inputs' ?!? Whatever were they thinking introducing flabby delays between stick movements and control surfaces? Ever tried to play a computer game with a two seconds delay of the controls?
The actual cause of the crash is this. There were three pilots trying to fly that plane at the same time: the computer, plus the two co-pilots. I guess four, if you include the captain chiming in from the back. Neither of them had any information or understanding or confidence about what the others were doing, due to no particular fault of their own. In such circumstances, adding and withdrawing auto-pilots, plus adding different 'computer modes' is totally insane and only adds to the confusion.
At least you can find some comfort in that AF447 was the first fatal accident with the type, and that there's been continuous improvement throughout the years (including replaced pitot probes). But bigger design problems might have gone unadressed because it's difficult to justify a major change in a certified design until it causes an accident.
Very insightful. Indeed it seems that one of the main contributor was the copilot's attitude (at least one of them, pulling back on the joystick all the way)
02:13:40 (Bonin) Mais je suis à fond à cabrer depuis tout à l'heure!
Obviously they were in panic mode and did not take time to think - they were reacting to the "plane go down" message by a "pull back" mode, where they should have been trying to understand why they were losing altitude.
I hope the analysis of the flight was more accurate than some of the translations.
02:08:03 (Robert) Tu peux éventuellement le tirer un peu à gauche.
You can eventually pull it a little to the left.
Eventuellement is not the French equivalent of the English. It should be "You could pull a little to the left."
Many sentences read like a straight copy and paste from Google Translate.
[+] [-] Klinky|14 years ago|reply
Co-pilot Bonin, who had been pulling back & stalling the plane during the crisis: "But what's happening?"
Pretty much sums it up. I am thinking that perhaps Bonin had shellshock & may not have even realized he was holding the stick back. Perhaps the more experienced Robert didn't think to ask "are you pulling back the stick?" because that would be like asking "did you make sure the computer is plugged into the wall outlet?", i.e. it's so stupid & simple, that can't be "it".
There are a few things I could think that would be worth adding.
- Add a display that shows the current positions of both control sticks. Add an alarm when the two sticks are not within a certain margin of the each other, if both are engaged. Such as if one is full forward & the other is full back.
- Make clearer warnings about the implications of the "alternate law" mode. Such as a warning like "Stalling possible". Also maybe put an alarm in the pilot resting area that would relay when warnings are detected like stall or switching to alternate law.
- Delineate command better, e.g. Captain, Co-pilot #1, Co-pilot #2 so that who is in charge is clear.
[+] [-] bambax|14 years ago|reply
Yes! From the article: "As the plane approaches 10,000 feet, Robert tries to take back the controls, and pushes forward on the stick, but the plane is in "dual input" mode, and so the system averages his inputs with those of Bonin, who continues to pull back.
If this is true, it's insane. What does it mean to "average" the inputs of both pilots if one is full forward and the other one full back?? It should say "conflicting command; make up your mind".
The article alludes to the old system where the stick was just the one same stick for both pilots: no possible conflicts there.
The new planes should have a way to emulate that.
[+] [-] jrockway|14 years ago|reply
This antiquated idea has killed many more people than it would have saved in this case. Read about CRM:
http://en.wikipedia.org/wiki/Crew_resource_management
I think a classic example is:
http://en.wikipedia.org/wiki/Avianca_Flight_52
The plane crashed because it burned all of its fuel in a holding pattern waiting to land in JFK. When the flight engineer noticed this, he was afraid to tell air traffic control, who he believed was "higher up" than he was (and he therefore had no right to question their decision). The result was 65 dead people.
There are several cases where a lower-ranking person has noticed something that the captain has not. And when they didn't do anything about it, people died.
[+] [-] StavrosK|14 years ago|reply
[+] [-] arjunnarayan|14 years ago|reply
Even better: when you have two mechanical inputs to a single output channel, mechanically _link_ the two. If Pilot #1 moves the stick, pilot #2's stick should move. So that if there is a disagreement, they can physically observe it in their hands. Any fight over where to put the stick shouldn't be "averaged". It should be physically felt by both pilots so that they realize that there is a conflict and resolve it face to face.
It's similar to why SVN commit conflicts are so damn annoying. But they're designed to be: the only way to resolve a commit conflict is to walk over and meet your conflicter face to face and resolve. Can you imagine if SVN decided to "average the inputs"? What the fuck does that even mean? This entire plane sounds like a UI disaster (modal inputs, etc.)
[+] [-] jforman|14 years ago|reply
This was my first thought as well. Confusion in one pilot was allowed to cause confusion in the second pilot, because he didn't realize that his partner was doing something unexpected and incorrect. If you make sure a pilot can always detect inconsistent reaction in a co-pilot, you can keep them in sync and prevent spreading confusion. An alarm when the two pilots are out of sync seems like a pretty straightforward benefit.
[+] [-] snowwrestler|14 years ago|reply
A pilot wouldn't have to look for some stick position display, or indicator light, if they can easily feel the deflection of the stick.
[+] [-] konstruktor|14 years ago|reply
I want a device that gives me an electric shock every time I think or say this. If one can restructure one's cognitive habits in a way that replaces thoughts like this with thoughts like "What would explain this? Is this reasonable? What are the alternaives? How can I check this?", many errors will be avoided.
[+] [-] nodesocket|14 years ago|reply
A indicator light, saying the plan is in "alternate law" mode, and SHIT can go wrong, very quickly.
Also an alarm in the pilot resting area that would relay when warnings are detected like stall or switching to alternate law.
[+] [-] tcarnell|14 years ago|reply
Maybe everyone on the plane could have one!
[+] [-] donaldc|14 years ago|reply
[+] [-] anrope|14 years ago|reply
When I read about the dual input averaging, I literally exclaimed "what?!". I can't believe that, for all the strict standards that flight control software must meet, nobody called this out as a dangerous idea?
[+] [-] wavephorm|14 years ago|reply
[+] [-] teyc|14 years ago|reply
Alternate law and normal law introduces two modes. This breaks one of the rules of user experience, especially if it is infrequently encountered. Combined with turning autopilot off on its own, it is bound to cause even more confusion. The plane could have put an alert asking the pilot to go on autopilot, otherwise, it will continue by making educated guesses. (A pilot is no better judge of airspeed than the computer)
Another rule of UX broken is "tell" instead of "announce". The voice should have said "Stall. Dive now" or "Stall. Why are you pulling the stick back?".
The flight computer can reinforce its credibility by demonstrating it has predictive capability. For instance, it can say, "decrease your angle of attack or you will stall in 5 seconds", then "4", "3" "2" "1", "stalling". The voice should demonstrate increased tension and panic as counting down.
It is high time the flight computer act as the "third pilot". It is similar to video judges in competitive sports. Of course people may choose to ignore the computer, but we can then continually review why the computers assessment was wrong and improve on it.
What I don't understand is, how does a plane know it's stalling if the pitot tubes are frozen?
By the way, optical flow meters could have been used as a backup.
[+] [-] rguzman|14 years ago|reply
over dinner i once asked him "so what's the most exciting or difficult situation you've even been in?"
"hm... nothing i can think of, it is all pretty boring, really"
"i mean c'mon, there's got to be something!"
"you see? if you do things by the book plus a little on the safe side it usually works out that you are never in an exciting situation -- my job is to ensure that even the most unlikely exciting situations become more unlikely."
in this particular instance, it seems that there are a few actions that could've avoided the whole situation had the people in charge had the mentality of "by the book plus a little on the safe side". the most glaring one is that the other planes in the area diverted to avoid the storm. another: the captain should have made clear who is in charge.
of course, this is very easy for me to type from the comfort of my office without any situational stress.
scary!
[+] [-] huntero|14 years ago|reply
It seems dangerous to have two joysticks, both capable of controlling the plane, that have no physical or simulated physical link. It means that one pilot could be attempting to control the plane and his actions will have no effect whatsoever if the other seat is panicking (as in this case).
Anyone have any insight into this?
[+] [-] blinkingled|14 years ago|reply
I have read a few other transcripts from crashed planes and this seems to be the most common and significant contributor.
I see variations of this problem almost daily in my day to day work. It strikes me so many times that people flat out refuse to communicate or do do in an extremely ambiguous fashion, people violate responsibility boundaries all the time (faux-technical people forcing technical decisions for e.g.) and that directly results in losses far greater than they should have been if there was any notion of discipline and communication.
[+] [-] acabal|14 years ago|reply
[+] [-] edtechdev|14 years ago|reply
Linking the two sticks is one way, another might be to show the state of the two sticks on the display next to the indicator of pitch, perhaps using coloring to highlight when the sticks are being pushed forward or backward. But of course there is already an overload of indicators. Really, improvements in the software/AI might be the best solution.
[+] [-] runningdogx|14 years ago|reply
The PF (Bonin) apparently never became aware of his angle of attack (once the airplane fully stalled, AOA was absurdly high). He did not seem to be aware that his constant inputs had caused the Airbus's THS (trimmable horizontal stabilizer, horizontal flaps on the tail) to deflect to maximum in order to try to keep the nose up. Therefore when he tried to input stick up (nose down) several times briefly, and there was no obvious response (the computer takes a while to reduce THS elevation in response to opposing input), who knows what he thought -- maybe that all readings were incorrect.
Strangely, Bonin was the one pilot who had significant recent glider experience as I recall. The Airbus computer even in "alternate law" functions nothing like a glider (only "direct law" is sort of close to direct input), so maybe that further confused him.
In my opinion, at night, over an ocean, in a storm, with no visibility, in possibly significant turbulance, a modern aircraft cutting off Autopilot for any reason other than computer failure is completely unacceptable. A computer should be able to fly as well as a human under those circumstances.
People suggesting that on airliner forums get flamed. But it's true. Most pilots kept up the refrain that a computer cannot safely fly by gps and gyros unless they also have airspeed. Which is true. It's dangerous to fly if you don't have true airspeed (gyros and gps cannot accurate provide relative wind speed). However, if pitot tubes are frozen and the computer no longer has valid airspeed, the pilots no longer have valid airspeed either. Pitch and power is all they can do. The computer can do that just as well. All it needs to know is aircraft weight, which can be entered (maybe it is entered) before takeoff and automatically adjusted to account for fuel consumption.
There are a bunch of factors that contributed to the accident:
Pitots shouldn't have frozen.
Lack of Air France training for controlling an aircraft at altitude with the computer in "alternate law" (mode without full flight envelope protection; it's therefore possible to stall).
The command structure in the cockpit without the Captain (who had just gone on break) actually had Bonin in command, even though the co-pilot in the left seat outranked him... AF has since changed that. CRM (crew resource management) was poor; the co-pilot in the left seat didn't try to take control until way too late. The co-pilot was preoccupied with where the Captain was rather than offering constructive input on how to fly.
Bonin was not adequately aware of what his inputs were doing, or what the plane's Angle of Attack was, and did not react properly to the stall warning which in almost every case at high altitude means drop the nose, not raise it (though without valid airspeed there's a risk of overspeed which can cause a new set of problems).
The Airbus computers had some quirks; stall warnings stop if airspeed drops too low (due to some computer programming logic involving low airspeed, AOA sensors, and the result being silencing the stall warnings).
Nobody believed a passenger aircraft would be so stable during a full stall. This undoubtedly contributed to confusion about whether they were actually stalled. The Airbus's computer setting the trimmable horizontal stabilizer to max nose-up deflection, in response to Bonin's almost constant nose-up input, possibly contributed to the stability during stall.
Angle of Attack information may not have been adequately displayed to the PF (Bonin) -- the black box doesn't record data from the right set of instruments, so nobody knows what Bonin had on his screen.
There was poor notification on the co-pilot's side of what the PF (Bonin) was doing. Unlike traditional aircraft, it is not easy to see what the pilot in the other seat is doing with the stick.
There was poor notification on either side of the cockpit when the other pilot took control. When the co-pilot took control, Bonin almost immediately took control back, and it's not clear either of them knew what the other was trying to do. Apparently there's a light that indicates override, but who would notice such things under that amount of stress?
IOW, it was a disaster from top to bottom. Usually in aircraft accidents there's a chain of events, but in this case there were so many possible contributing causes that other than having better pitots that didn't freeze over, solving any one other problem may not have broken the chain.
[+] [-] bambax|14 years ago|reply
http://www.lexpress.fr/actualites/2/actualite/des-dialogues-...
This is incredible hubris.
Then, in the middle of the storm he leaves the two copilots alone, one of them quite inexperienced, and goes for a nap. He's obviously trying to demonstrate that he's not afraid of anything.
Well, maybe he was fearless, but now he's dead and so are all the passengers, passengers he was in charge of.
- - -
Once in the storm, and with the incredible amount of stress, it's hard to say if other pilots would have done better (other pilots that night avoided the storm!)
I've read that pilots are trained to react to a stall at the beginning of their career, but not as part of their regular training -- I don't know if it's true or not.
What's true is that stall is one of the worst things that can happen; it's like training bus drivers to hit the brakes when they're going right into a wall: of course they would do that...
[+] [-] krschultz|14 years ago|reply
[+] [-] afterburner|14 years ago|reply
[+] [-] bulte-rs|14 years ago|reply
In this case there were probably a number of human errors, a.o: not noticing speed restrictions on the speedtape (even in alternate and abnormal alternate law/mode these are present, although Valpha max and Valpha prot are removed a barberpole is present up to Vstall warning) and 'ignoring' the nose-down moment the airbus tries to induce in a low speed situation.
Possibly some design errors in the form of the alpha-floor protection removed in alternate law/mode.
Seems like there is a lot to learn from this investigation for both pilots and manufacturers and although it might seem harsh and insensitive (believe me, it's not; I've lost friends due to an aircraft crash) I am actually looking forward to the 'final incident reports'.
[+] [-] sliverstorm|14 years ago|reply
[+] [-] presto8|14 years ago|reply
Is there ever a situation in a commercial plane where a stall would be a good thing? My non-pilot brain is trying to figure out why the plane would allow a stall even in alternate law mode.
I'm sure the Airbus user interface designers know what they are doing, but wouldn't it be possible to make stall protection always enabled, and then add a failsafe requiring both pilots to press a button to override stall protection? Then they would both have to consciously do a physical act to enter this dangerous state.
[+] [-] dhughes|14 years ago|reply
The temperature drops 1.98C for every 1,000 feet you go up so you can see quite quickly how fast you can enter an area below the freezing point of water.
Icing of the pitot tube and carburetor are a constant worry at least for prop driven aircraft. Right from day one you're taught what to look for signs of carburetor icing and how to correct it. Water in the fuel is probably #3 on the list.
I never got far enough along to learn about wing icing I ran out of money for lessons but really everyday it's ice, ice, ice!
[+] [-] lutorm|14 years ago|reply
Hey, me too! (And 9/11 happened which made it a lot harder for foreigners to fly.)
But I did have the opportunity to get a lesson in how to avoid carb icing without carb heat when I pulled the carb heat control straight out of the dash on our 152. ;-)
[+] [-] nikcub|14 years ago|reply
I even knew about the two modes of the Airbus - because I once watched an episode of "Air Crash Investigation" where the exact same thing as what is described in this accident happen to an earlier flight.
I don't know if I am jumping to judgement, but it sounds like some of these modern pilots aren't really enthusiasts - they are just people who are trained and do their jobs, and do them by the book and then go home (just like bus or taxi drivers).
[+] [-] gnaffle|14 years ago|reply
The PNF acknowledges "alternate law", if he had only made the PF aware of the implications of that, maybe he would have "snapped out of it" and stopped pulling up.
At some point during your training or flying career you'll probably have situations where in hindsight you'll try to understand why you acted a certain way despite knowing better. I've certainly encountered situations like that.
I think most commercial pilots today in a way have to be enthusiasts, or at least start out as one. The job market is simply too uncertain and cost of education so high that you really have like flying to go through with it. But keeping the enthusiasm in a job with a busy schedule and demanding family life might not be so easy. That's one reason why I don't plan on flying for a living.
[+] [-] abk|14 years ago|reply
Sadly in this case it sounds like a mix of overconfidence (not avoiding the storm, trusting the plane more than the stall warnings, not waking up the captain until it was too late) and a lack of training for unexpected situations were the major factors in the crash.
[+] [-] mtts|14 years ago|reply
Watching documentaries or looking up stuff on the internet does not make anyone an expert. That Bonin guy, as inexperienced as he was, knows far, far more about piloting airplanes than you do.
[+] [-] rohit89|14 years ago|reply
>> 02:14:23 (Robert) Putain, on va taper... C'est pas vrai! Damn it, we're going to crash... This can't be happening!
What a frightening moment. I can only imagine what was going through his head at that moment.
[+] [-] tcarnell|14 years ago|reply
Hence the stall warning SHOULD NEVER SOUND in "normal law" mode.
Therefore, the only time a pilot should hear the stall warning is when they actually have to intervene.
Ultimately, if the plane was funcioning perfectly well and assuming the pilots weren't complete idiots, the problem was a 'usability' issue.
(think again everytime you see a bug logged as 'usability' and assume it is not important!)
[+] [-] rudiger|14 years ago|reply
[+] [-] anrope|14 years ago|reply
"What the hell is happening? I don't understand what's happening."
"Damn it, I don't have control of the plane, I don't have control of the plane at all!"
It's like a non-fiction horror story. Cockpit data recorders provide some really gripping stories. Same with the air traffic control audio from the bird strike incident that ended with a plane landing in the Hudson river in NYC.
[+] [-] fr0sty|14 years ago|reply
I personally can't think of much more to say than that.
[+] [-] Xuzz|14 years ago|reply
[+] [-] worldvoyageur|14 years ago|reply
Ideas really can change the world.
[+] [-] citricsquid|14 years ago|reply
Why would they ignore it...
[+] [-] ookblah|14 years ago|reply
Forgive my ignorance, maybe some pilots can shed some light on this. In the article it mentions that even though the plane was flying in "alternate" mode, my understanding is that it still has limits to what inputs can be given.
That said, even if autopilot is off, why wouldn't the computer have emergency functions to negate strange situations like this? When would pulling completely back on the stick while losing altitude rapidly ever be considered within the range of normal?
[+] [-] nkurz|14 years ago|reply
I think there are two main reasons. First, one is dealing with a situation where the autopilot has disengaged because it is receiving contradictory input from its sensors. How is the computer to know that a second sensor has not failed, and that its notion of what is normal is not? Failures may tend to cluster. The current technological presumption is that in the event of something unexpected, trust the human over the computer. At the current level of technology, this is still often a good bet.
Second, I think the legal situation encourages having a human be the final point of control. Presume that computer overrode the human, and that due to some low-probability unexpected combination of failures this caused the plane to crash despite the pilot doing "the right thing" as proven by the flight recorder. Then picture the size of the lawsuit against the everyone involved in the building and licensing of the plane. Contrast this with the same situation, but with the pilot responsible and dead in the crash. One may find that there isn't much desire from the manufacturer to change the system to take that final responsibility.
[+] [-] mtts|14 years ago|reply
I'm guessing this incident made the engineers who designed the plane a little more eager to provide for a true unhampered manual override.
[+] [-] jarek|14 years ago|reply
I don't have a terribly accurate model of airplane control in my mind, but I think this would be the right answer when the nose is pointed down (i.e., the plane is diving). In some cases I think it might also be the right answer if your nose is level but you're losing altitude, e.g. when in a strong downdraft.
Pulling back was the wrong thing in this situation because the plane was in stall, but due to sensor problems and later high angle of attack/low airspeed, the avionics didn't have a complete image and an absolute certainty that the plane was in a stall (hence the stall warnings cutting in and out, too). I'm not sure I'd want the plane overriding me in this specific case.
[+] [-] SagelyGuru|14 years ago|reply
It is easy to blame Bonin for being such an idiot and pulling on the stick all the time but it is a natural reaction, just like inexperienced drivers continuing to lock the brakes while skidding off the road. How many die that way every day?
More worrying to me is that the whole plane control is inherently and crazily unsafe. Whatever were the designers thinking, making the two sets of controls without cross-feedback and even 'averaging their inputs' ?!? Whatever were they thinking introducing flabby delays between stick movements and control surfaces? Ever tried to play a computer game with a two seconds delay of the controls?
The actual cause of the crash is this. There were three pilots trying to fly that plane at the same time: the computer, plus the two co-pilots. I guess four, if you include the captain chiming in from the back. Neither of them had any information or understanding or confidence about what the others were doing, due to no particular fault of their own. In such circumstances, adding and withdrawing auto-pilots, plus adding different 'computer modes' is totally insane and only adds to the confusion.
My conclusion: design fault (over engineering)
[+] [-] gnaffle|14 years ago|reply
[+] [-] ekianjo|14 years ago|reply
02:13:40 (Bonin) Mais je suis à fond à cabrer depuis tout à l'heure!
Obviously they were in panic mode and did not take time to think - they were reacting to the "plane go down" message by a "pull back" mode, where they should have been trying to understand why they were losing altitude.
[+] [-] deadmansshoes|14 years ago|reply
02:08:03 (Robert) Tu peux éventuellement le tirer un peu à gauche. You can eventually pull it a little to the left.
Eventuellement is not the French equivalent of the English. It should be "You could pull a little to the left." Many sentences read like a straight copy and paste from Google Translate.