PPRuNe Forums - View Single Post - AF 447 Thread No. 9
View Single Post
Old 11th Jul 2012, 10:16
  #245 (permalink)  
Sriajuda
 
Join Date: Mar 2010
Location: Germany
Age: 57
Posts: 20
Likes: 0
Received 0 Likes on 0 Posts
While it appears a mystery to almost anyone as to why all three pilots seemed unable to recognize the stall, I wonder even more about the apparent lack of the computer's abilities to detect the same.

Even with the speed sensors gone or unreliable, there is ample information remaining to deduct (heuristically) that indeed, the AC was in a stall. From a system engineer's point of view, I perceive a gross discrepance between automation behaviour *before* leaving the predefined, valid flight envelope, and thereafter. Before, there is protection from all sorts of (possibly) stupid control inputs by the pilots, but as soon as a single sensor fails, the whole protection system just quits. That is highly inconsistent behaviour and might, IMHO, explain the actions of the PF. He might just have been too used to the plane doing the actual flying, and he might have expected it to do what he was used to: Interpret his stick inputs as a "goal" definition (climb!) and do the actual flying to achieve that goal.

I understand that the AC had switched to 'alternate law', and that maybe the pilots or, to the very least, the PF might have been unaware of that. The point I want to make is that I see no need for such an abrupt cessation of computer support in that situation. Three minutes is a very long time, much more so for computers. Heuristics looking at all sensory data could have determined, with reasonable accuracy,

- airspeed (correlate previous, valid readings with GPS speed and accelerations measured vs. change in pitot sensor data)
- vertical speed (sensory data was good, AFAIK, barometric and ground radar, no?)
- aircraft attitude (AI was working, no? An even if not, over some period of time it could be deduced just by observing the acceleration data in all three axis)

Using that data would be sufficient to detect the stall. Even more important, such heuristical cross-checking of sensory data by the computers could have avoided both the switch to alternate law *as well as the stall*. Even if the heuristic analysis was not good enough to safely fly the aircraft, the computer could just as well have fallen back onto pitch & power by itself. Of course, alerting the crew to the fact at the same time. Giving them the *option* of manual takeover (including a *manual* switch to alternate law), rather than just quitting and leaving them to sort it out.

Humans are not computers, and are extremely suspectible to fatigue, habits, boredom, surprise and panic. If you wanted to design a system that had the goal of provoking 'human error', these are the human weaknesses you'd exploit. And that is exactly what the airbus did: Lull the pilots into a seemingly fool-proof, fully automated environment, and then, at a slight (!) malfunction of hardware, drop everything raw onto them, intermingled with inconsistent alerts and warnings.

I think these are major user-interface flaws. Sure more/better pilot training is called for, too. But the system's design should strive to be intuitive rather than that additional/repeated training is required just to be able to deal with the system's behaviour.

The same goes for the airbus sidestick configuration: It seems to be designed with the goal of making sure the two (and sometimes a third!) pilots are unaware of what the other is doing. Out of each others sight, the passive one not moving, averaging dual inputs...I just don't get that. Does anyone here think that the captain was aware of what the PF was doing?? And to think how easily that could have been different, with a different setup.

Also the change to alternate law could, nay, should be combined with force-feedback sticks. In humans, not all the senses are equal. They get processed in different priorities. These are:

1. Smell
2. Taste
3. Touch
4. Aural
5. Visual

We can't make much use of 1 and 2, but rather than displaying a small text on a screen (5, lowest priority), why not use no. 3? The change from non-force feedback to force feedback would very distinctly signal the change from 'normal' to 'alternate' law to the PF!

Just a systems engineer's thoughts about the issue(s), who has done very little flying (albeit a lot of sailing).
Sriajuda is offline