Ian_W;
While I don't disagree that cognitive overload can and does occur (
we can experience it in a demanding simulator exercise just as it may be experienced in the aircraft under a series of cascading failures resulting from a primary system failure), I want to offer a slightly different POV.
My bolding in your quoted passage:
Originally Posted by Ian_W 29th Jun 2011, 05:51 [URL
http://www.pprune.org/tech-log/454653-af-447-thread-no-4-a-27.html#post6542805[/URL]] Perhaps this is the reason for the repeated 'set power and pitch' effectively saying disregard all those messages they aren't important - fly the aircraft.
Not just "
perhaps", but without doubt, that is
the key requirement in an unreliable airspeed event.
Rather than saying "
disregard all those messages as they aren't important", let me put it another way: "Look through", all those messages
while establishing stable flight. "Note and absorb", but
do not be distracted by all those messages.
It is not that they are not important. It is that they are far less important than establishing and maintaining stable flight.
This is what I have always meant by stating that, "doing nothing" while taking over and flying manually to wait for the situation to stabilize, is an appropriate response. Such a calm response gives oneself a chance to absorb what's happening.
To emphasize as strongy as possible, stabilizing the situation to ensure the continued safety of flight is primary - the ECAM messages, (none of which required a memory drill) can wait.
Executing the UAS drill memory items as written in the UAS drill and checklist is the way to maintaining the primary goal of stable flight. That kind of crew response is NOT stated in any ECAM message or aural warning. It is (hopefully) trained for just as other memory responses are trained and checked for.
I will not say that the checklist is without its problems. It has been modified a number of times since its appearance in ~2002. I have said before and will say it again here: The UAS drill and memory items are confusing and that is a "support" factor, ('support' meaning well-written drills, checklists and procedures), which may even be relevant to this accident.
The aircraft was under control before the UAS event, pitch and power set for stable flight, notwithstanding some turbulence and a possible change in TAT.
A loss of airspeed information does not change that state. Without airspeed information the aircraft is still under control.
It will remain under control so long as that stable relationship between pitch and power and the resulting stable AoA, is not substantially altered.
Again, to emphasize,
providing this stable state of affairs is maintained by the crew the series of ECAM messages, aural warnings, autopilot/autothrust disconnections does and will not change this state of affairs.
Putting it another way, stable flight is not affected by the ECAM and aural series of messages and warnings, provided pitch and power settings are set, by all means available and necessary, to maintain stable flight.
An unreliable airspeed event would be no time to make large changes in pitch or power.
The Airbus and Air France memory drill and checklist for UAS, (reproduced below for reference) which was in force at the time is cited in the First BEA Interim Report.
If safe conduct of the flight is not impacted, the UAS memory drill items do not require any immediate action by the crew when the aircraft is in stable cruise flight. The checklist requires that the aircraft be "leveled off for troubleshooting". That troubleshooting is to set pitch and power to initial settings and, under "
Flying technique to stabilize speed" in the UAS checklist section, watch the results for deteriorating trends and adjust either/both accordingly.
Any departure from stabilized flight immediately takes the crew away from "known, stable circumstances". Eliminating the "knowns" makes returning to stable flight a difficult but not impossible task but one must set pitch and power according to the QRH very quickly to avoid true disorientation not in pitch attitudes or power settings but in terms of the energy state of the aircraft and returning the aircraft to pre-event values.
The implication of this though is perhaps those messages that the designers and systems engineers thought were important are not really important at all. They can actually lead to a worse outcome by overloading a flight crew that tries to listen.
I address this point above, but it requires elaboration. It is not as though the designers and engineers didn't think these messages were not important, because of course they were/are.
Let us consider that there are other ways of seeing this and not just an "either/or", (as in, "either they were important or they were not"). The ARE important. But flying the airplane is THE most important priority and no designer or engineer would disagree. The airplane is not on fire, it is not depressurizing, it has not had an engine fire or failure and at the start of the event it is stable, with lots of energy. There is no "emergency" here.
So I don't think the implication (that the messages were 'unimportant'), applies in this accident.
Now what happened in the cockpit of AF447 appears to be a cacophony of emergency aural and visual messages from the ECAM. Many of the instruments that the pilots would rely on became invalid and others were showing totally unexpected outputs.
Saying the PF should have seen this or done that is easy when all these messages are teased out on a nice timeline - but when they are all at once nobody's brain can process them all. The response in the human under this pressure can often be 'cognitive or attentional tunneling' where everything except a small portion of the inputs to the brain are just not seen/heard
It is not as though we dismiss the difficulties faced by this crew by setting the events they faced on timelines from which we then "armchair" our views.
I don't think any of us here doubt that these factors will indeed have been "at work" to some degree in this cockpit. But it is slowly being forgotten in this line of thought in the thread that aircrews are heavily trained, checked and otherwise supported by a very large infrastructure and are not "on their own" when it comes to dealing with such events.
Attending to surprise is not an unaddressed, foreign cognitive phenomenon in this industry. Intense training is the way a form of cognitive dissonance is addressed. This doesn't deny the normal, immediate human reaction to an emergency but when such circumstances occur, the crew is not on their own and that level of response is precisely the intended outcome of training and checking.
In other words, a crew's response to an emergency does not "begin in the cockpit" - it starts a long way upstream, the entire goal being the reduction of cognitive surprise and distraction.
The UAS drill and checklist cited earlier is reproduced below. I and others have discussed this checklist at length, mainly on the previous AF447 threads.
The first memory item is a requirement to assess the safety risk to the aircraft. This is a "bifurcation point", an if-then point which bifurcates to two different course of action. The two courses of action available are the listed items under MEMORY ITEMS in the box and the dot-pointed item, "To level off for troubleshooting".
The Memory Items in the box require that the autoflight system (including flight directors and autothrust) be turned off and then pitch and power settings be established depending upon at which point the aircraft is in the takeoff/climbout sequence. These are emergency settings which are intended to keep the aircraft out of immediate danger close to the ground.
If the safe conduct of the flight is not impacted then the other memory item is "To level off for troubleshooting". The memory items there require that the GPS Altitude be displayed on the MCDU, and that the autoflight system and autothrust be disconnected. The pitch and power settings are then listed for initial level off.
The appropriate settings indicated in this checklist for the "CLEAN configuration are: FL 200 - FL 360" > 260kts > 3.5deg pitch and 71.9% N1 in this A333 checklist. The A332 checklist (in French in the BEA Report) states "FL 250 - FL 370 > 260kts > 2deg pitch & 83.9%N1). The processes are the same regardless of individual aircraft settings.
Once the aircraft is stabilized in level cruise flight, the ECAM items would be dealt with.
The time frame under examination here is between the initial UAS event and the pitch-up event. Once the aircraft was at the apogee and in a partially-ballistic trajectory, with the aircraft pitched up at 16deg, the AoA rapidly increased as the aircraft started down establishing the stall, the aircraft was essentially doomed. There are discussions about stall warnings, THS positions and so on but at what point do we demand that the designers and engineers "protect" against such operations, without creating a host of further, unanticipated, possibly serious problems in different circumstances?
There are arguments which claim that "the computers" pitched the aircraft up, beyond the control and intentions of the crew. Despite some very interesting arguments which have demonstrated the possibility, I doubt if automated flight (the EFCS)
per se, was involved in the initiating event.
If the sidestick was unintentionally moved so as to strongly pitch the aircraft up and it was permitted to exceed a pitch of 10deg and a rate of climb of 7000fpm without added thrust, and with only a few mild ND sidestick inputs, as has been observed by others who know their stuff, the swiftly approaching outcome would be blindingly obvious to any aircrew - a huge loss of energy and an inevitable rapid descent in some way or another, (stalled or high speed and a lot of altitude lost).
The notion and activity of "blame" is irrelevant at the level of this discussion intends.
In this accident we simply cannot look to the crew alone, (if at all). As we all know too well, they did not set out to "have an accident" yet an accident occurred.
A form of cognitive dissonance in heavily demanding and distracting circumstances may be one of many (initial) human factors involved in this accident but the investigation will certainly not be stopping there.