Man-machine interface and anomalies [Archive]

RR_NDB

7th Apr 2012, 04:33

Hi,

Bear:

The Air France crash is a case study, at least from what we know. (http://www.pprune.org/tech-log/481350-man-machine-interface-anomalies.html#post7122036)

Certainly a rich "case study". A loss of this magnitude and the "surprises" requires attention. :8

Cruise flight is a challenge to remain "engaged" for the Humans.

I made dozens of high speed night long trips, solo in a "lethal fiberglass jeep" (non shock absorbing body). The technique used to be "calibrated aware" (during 10 hours single lane hwy) was to use the HF radio communicating world wide in phone (SSB). Much safer than hearing music, etc.

The interaction with other radio operators (with the car and HF background noise) allowed the right awareness. :8

I had two emergency situations (one transmitting and the other receiving -PTT off) without any difficulty to be "immediately inserted in the loop". ;) doing immediate corrections.

In one, a truck hit a horse and i saw the animal flying against my car. In the other an indigent was walking in my lane and it was required to steer (at high speed) so violently the "tires singed". The second almost causing a LOC. In both cases the other operators told my voice sounded different. Like as of gas Helium gas respiration. :eek:

I compared when used another (quiet) car without HF gear. Impossible to have the same performance. :)

Man machine interface is jargon. I used the concept since 1980 in a big project where i was responsible for "testability". I will consider your comment on terminology "trap".

The emphasis i put on the interface on 447 case is "manyfold":

1) Consensus must be checked. :}

2) The interface is important to the proper (and safer) operation

3) The concept is not sufficiently disseminated IMO

4) It can always be improved. Endless (almost). And must be K.I.S.S.

5) Affects directly crew performance, awareness, etc.

6) Automation (and complexity) requires better interfaces

So, it's a rich field connected to Human Factors. Interesting issue.

roulishollandais

7th Apr 2012, 15:18

@ RR_NDB

Good luck to this thread ! :ok:

Lyman

7th Apr 2012, 16:28

@HazelNuts39 Post #1308, Thread Seven.

[/B] Thirty knots drop of IAS in one second is not sufficient to identify UAS. It is not inconceivable that it would occur as a real change of airspeed in a windshear/downburst close to the ground or in the vicinity of the jetstream at altitude. Considering the multitude of possible causes and flight conditions, IMHO the computers cannot reliably identify UAS, but must leave the diagnosis of the problem to intelligent humans. [/B]

2:10:05 ( 04.6 ) : AutoPilot drops out

2:10:06 : "I have the controls"

2:10:10 : STALL/STALL

2;10:14 : "We haven't got a good display,,,"

2:10:18 "...of Speed"

As simply as I can, I note the Pilot is Flying one second after loss of Autopilot. Per the chronology (above) he is doing so without benefit of 'Airspeed' display. Airspeed is a result of controls input, so he begins with a RESULT, not a condition. The result on which he is to base his manual input is verbalized, we assume it is the most important thing to him as well.

For thirteen seconds, he flies not knowing airspeed, and we also assume he doesn't know why airspeeds are bad. Like it or not, he has flown the most important part of the flight of his life, without identifying the problem that will destroy his aircraft. Now well and good, but I will offer a defense.

RR_NDB

Ebb, Flow, Consistency, Continuity. A dynamic condition cannot be entered (looped) ad hoc. We think the a/p was lost due as simple as GUSTS? So in reality, the AIRSPEED WAS NOT UNRELIABLE. It was accurate, and caused the a/p loss. Hazelnuts39 post is instructive, but it is my inference, not his. Much of the original debate on the very first thread had to do with Pilot Flying, and his Awareness.

I posited long ago that the autopilot may have been lost due to simple limit/exceedance. as did many others. Then the argument devolved to LAW, and got ever more arcane from there. Thence to STALL.

The idea in controlled systems is Seamless Transition. With seams, important stuff can fall through. If not UAS, then there is the possibility of Pilot Flying believing he is (remains) in NORMAL LAW, and his zoom becomes rather vanilla flavored, and more understandable.

The autopilot quitting becomes what esteemed members have said: not a big deal. The DEAL was Pilot unawareness. If he was piloting without an awareness of the controls degrade, then we have liftoff. The LAW degrade was annunciated at 2:10:22. 17 seconds after cause, and well into effect.

Facility, Systems, Flow.

RR_NDB

8th Apr 2012, 17:05

Hi,

Surprises "coming from her" may "startle" a pilot. But the "interface" could "help":

When at 02:11:07 Air Speed was reliable again, the System could inform the "good news" to the yet startled crew.

So:

IMHO the System should inform immediately when (after an UAS occurrence) that:

You can now rely on (Pitot's "failure" ceased) Air Speed, again.*

(*) Left and ISIS shows 183 Kts. (RH likely the same) We can assume?

RR_NDB

8th Apr 2012, 17:41

Hi,

After Captain entered crew told:

"We tried everything". (indeed not true: didn't try stall recover ;) )

And could tell (to Cpt):

We had a "temporary UAS".

Why Captain didn't was better briefed?

Many reasons, we may understand.

One important reason:

Crew (it seems) didn't realize they had a (not important) UAS

Crew (likely) didn't know they had a TEMPORARY UAS. (Anomaly completely disappeared) at 02:11:07)

Perhaps (due UAS known consequences on related indicators, etc.) they created a model of something much more serious: An (unknown) System failure.

HF study may clarify. Anyway, crew could be better helped (by the System). It seems System aggravated the "obsolete Pitot trigger". And contributed to an ACCELERATED DEGRADATION. Perhaps even "misleading the crew" due a design IMHO could (should) be improved.

Lyman

8th Apr 2012, 17:56

Hi RR

Thanks. Doubtful RHS had ever experienced an actual a/p loss in those conditions. So his response likely was precisely as if it was Sim setting. In exercise, one knows the drill, and the actions are "pre-programmed". His taking the controls was rote, by memory, and suffered by Sim experience. He likely did not Pause, and try to become "present" in the moment. Now that may sound "New Age", but it is quite old, "get the picture".

Following his instant "I have controls" was likely an 'expected' need to orient the airframe, hence inputs. Off on the wrong 'foot', could be....?

No one can experience the conditions exactly, but it is instructive to consider them anyway. RRecent posts have illuminated the cockpit environment.

There are at least two schools of thought, separated by a chasm of ego and 'wisdom'. UAS was badly understood, or was 'a walk in the park'. I submit that UAS, even if 'well understood' by the pilots flying, would be a serious problem.

Nothing is more important in high altitude flight than smooth, consistent input and reaction. Bad start, eh? A Sim induced 'muscle memory', that Pitched up an airframe that was already Pitching up on her own? "Lose no altitude".....? Who knows.

What a pilot knows, and 'feels' ( "I feel some crazy speed..."), drives the continued safe operation of the flight. Will we ever know why the PF continued his Pull to and through 1.65 G up to 380? I believe some things are missing that would help us understand why this a/c Stalled.

No one knows the displays....will we ever? Even if the Speeds returned, the flying pilot must re develop some confidence in a system that did, after all, dump the Flight Path into his lap without a 'Heads Up'. We assume.

An assumption can go either way, just as 'assume' good displays, so to, 'assume' bad data on the screens. They did not turn off FD's, nor did they control the throttle levers. They also did not unselect the AUTOPILOT. They were early guinea pigs in the search to get a handle on UAS......

RR_NDB

8th Apr 2012, 18:23

No one knows the displays....will we ever?

It will be possible for investigators to conclude (not risking)?

Lyman

8th Apr 2012, 19:02

RR

And so, not knowing these displays, there are conclusions re: PF ? How? Sorry, insufficient data.....

No video exists of these all important reads, yet people condemn, and attack?

Instructor #1 : "Surprises",,,,,,,not good. Also, "never ASSume. Ever. Act with knowledge, you guess, you die...." "Don't make an ASS of U and ME."

Plus, (forgive): "Prior Planning Prevents Piss Poor Performance."

Lyman

10th Apr 2012, 19:02

#7 is busy, and going in several directions. "Interface". This is a word. As such, it deserves respect, both for what the creator of it intended, and what , practically, it adds to the culture, in this case, aviation?

To me it implies transparency, facile communication, and HONESTY. From these flow what you have emphasized (:D): CONFIDENCE. It is instructive, all these years on, that the dialogue remains unresolved.

It has been said: "And let the Humans figure out the UAS..." Well and good, and they eventually will (17 seconds too late, imo). My point from the beginning is that if the Computer is designed to reject speeds, drop the auto, and DEGRADE, somebody ought to tell the you know....Humans. It is not enough to quit, and expect a cold seat to pick it up without flaws in situational awareness, and attitude attitude.

Linguistics? Familiar. One cannot state a conclusion, (the pilots screwed up) by asking a question. "Why the chronic PITCH UP?" That is unanswered, and predates a logical conclusion, by definition.

As we see, the Pilot flying (for three seconds) appears to voice concerns about the accuracy of the aural STALL-STALL. Was it, actually, correct? It does not matter, the pilot was PREPPED to expect a faux STALL.

I reaffirm that: We know what the DFDR tells us. They did NOT know. Can anyone honestly claim that it is certain the Pilot was aware of the Controls LAW degrade? If only for a second or two, if he thought he remained in Normal LAW, his Pitch UP bobbles the airframe past a human's ability to "feel" PITCH. The displays, especially on his screen are UNKNOWN.

There is no certainty that the confusion that resulted eventually did not start even prior to the a/p loss.

One CANNOT reject the PF's handling, from the report. To do so requires facts. Facts are lacking, the most important facts, of all. Just as it cannot be claimed the Pilots did all wrong, one cannot claim the a/c performed flawlessly. This is fair, and would set the table for improvements to both.

RR_NDB

10th Apr 2012, 19:41

(17 seconds too late, imo) (http://www.pprune.org/tech-log/481350-man-machine-interface-anomalies.html#post7128043)

PF put the plane into Stall very fast. :{ Fate was sealed rapidly.

Too critical for a System, REQUIRED to degrade GRACEFULLY.

(This seems accelerated degradation): 4 min from normal flight to SL. (with a ALT spike in the meantime).

We will ever know what really happened?

Lyman

10th Apr 2012, 20:03

Hi RR

The DFDR is a wonderful tool, as is the CVR. It is tempting to enjoy the luxury it affords us in hindsight. It played no role in the disaster. NONE. To the extent that anyone believes it will cement a complete knowledge of the cockpit events it is useless (but will help a partial picture). It also is useless and worse, if people misunderstand the exact events, the cheeses, and allow it to cloud an objective view.

We see how important is the language of the events, and the "reporting" of the language. To this day, there are those who have a reaction to "En ligne de Vol", and reject its nuance, in favor of bastardizing its meaning to cement a foregone conclusion.

The Human accelerometer is in the butt cheeks, and the computer in the Inner Ear. How ironic and frustrating that had the pilots been instantly privy to a readout of the guts of the boxes, this thing would not have happened. I think PF was trying doggedly to incorporate his human sensing skills into his flight Path. "I feel some crazy Speed....". Vitesse feu. Don't go there cowboy.

In that, there be demons.

BUSS takes us in the direction of the "Problem solving by computer", when the human is not equipped to figure things out, either due to lack of capacity, or shortness of time. OR the inability of the Flight computer to find the words, and the pathway, to tell him/her. Quickly.

RR_NDB

10th Apr 2012, 20:25

Hi,

Bear

And all this stuff has it's inherent limitations. BUSS AFAIK would be useless.

Let me ask you:

From ice crystals noise (heard on CVR) til apogee how many seconds elapsed?

UAS onset certainly was well before Law change. So, if they had an UAS detector (a simple resource capable to precisely inform the impending Law change) they could had be warned how many seconds before zoom climb?

Lyman

10th Apr 2012, 20:45

RR

I think the ice crystals theory is overblown. First off, these crystals are "microcrystalline", and do not resemble Hail, or other "Solid" particles. Small droplets of water would make a great deal more noise than this "fog". We were subjected to the same professional "conjecture" re: Fuel. "Hitherto unknown characteristics of water ICE".

Flight at this height and in this region has been going on for SIXTY years. Without aircraft falling out the sky. I am sceptical. (Imagine that!).

Shall we have a listen? What shall we think, then? Is it important enough to drop an airliner, but so scary that the Public shall not hear it, lest they faint?

BEA? Hello?

I like BUSS. It int perfect, but more than a few actual experts think had 447 been so equipped, we'd be playing bridge and smoking cigars, not agonizing oer the 'interface' .

:ok:

RR_NDB

11th Apr 2012, 22:07

Flight at this height and in this region has been going on for SIXTY years. Without aircraft falling out the sky. (http://www.pprune.org/tech-log/481350-man-machine-interface-anomalies.html#post7128194)

With most crews respecting WX. All other flights deviated around this time.

Indeed, the plane :{ in normal position. :mad:

The Pitot's deserve an R&D. Or be complimented by other means to have even a degraded redundancy.

We don't need to know what the plane hit (whatever) but vaporized it shortly. The System didn't wait. IMO there is a "timing" issue that could be improved. Posted this earlier.

Anyway the UAS processor i envision could help to (almost) completely avoid similar cases.

If ACARS could participate in the R&D would be great. (Data gathering to design "calibration")

safetypee

12th Apr 2012, 01:34

The initiating question infers that increasing technological sophistication has changed the balance of the man-machine interface.
The interface represents a process which takes place within a situation (context); thus any change in the process can originate either from man or machine, or from the situation. However, none of these are independent; there is human input in all aspects.

One view such a system is to use the SHEL model of human factors. Normally the focus is on the central (L), but from a technology viewpoint (H) the links remain the same. The limits of SHEL are in its simplistic view; in reality all constituent factors in each category will have some interface with the other factors, e.g. autopilot alt hold mode (H) will link with the effects of weather (E) & (S) in the choice hard/soft ride vs accuracy – a human decision in design (L) and procedures and training (S) & (L).
Thus the balance sought involves a highly complex process (a chaotic system) – where a small change in input can have an unexpected disproportionate result.

The behavior of complex systems can be analyzed with techniques such as FRAM, (http://sites.google.com/site/erikhollnagel2/fram) and FRAM intro. (https://docs.google.com/viewer?a=v&pid=sites&srcid=ZGVmYXVsdGRvbWFpbnxlcmlraG9sbG5hZ2VsMnxneDo3ZTA3ZjQ2ZT BhZjc1MjNh)
Note the four steps:-
- Identify and describe essential system functions, and describe these by six basic parameters.
- Describe the context.
- Define the functional interactions
- Identify safety barriers and specify required performance monitoring.
A technological comparison: – describe the automatic system and use, the usable conditions; define the dependencies and interactions, and the safety barriers. The human is involved in these and in the basic assessment parameters – input, time, control, output, resource, and precondition; an example ‘risk assessment’ (https://docs.google.com/viewer?a=v&pid=sites&srcid=ZGVmYXVsdGRvbWFpbnxlcmlraG9sbG5hZ2VsMnxneDo1OWYxZTUzYT MxN2UyZjMz).

We need not stray into higher science with these ideas, as in the broadest sense they are like managing everyday life; e.g. humans use of fire – there are advantages and hazards, we elect to use it and take precautions, fireproofing, water, restricted situations, and have procedures for guidance. The human continually assesses and adjusts activity as the situation changes; the objective is to remain in control of the situation.

In many cases it’s the increasing complexity of operational situations that demands an increase in technical capability; both operations and capability are driven by economics. The changes (input to the system) can either be proactive – the pilot wishes to achieve an objective by using automation, or reactive where pilot activity is required – normal and non-normal situations – again the objective is to remain in control of the situation.
The situational aspects are in most (all) scenarios, and where these require a change of action, i.e. a malfunction (technology, human, or situation), the human has to understand the changed situation and its significance within the larger complex situation, and then choose a revised course of action. This will be an iterative process.

The above is a very high level view; however most events with technical / operational interfaces can be viewed this way, e.g. accident investigation. (https://docs.google.com/viewer?a=v&pid=sites&srcid=ZGVmYXVsdGRvbWFpbnxlcmlraG9sbG5hZ2VsMnxneDo0MmNlOGQ3NG RkMTliNDcx)

As much as technology has changed, so too may have the human due to the changes in the social environment, education, career expectation, and interaction with complexity. This does not automatically represent a change in training standards. Aspects of the context also change; economic pressure, airspace accuracy, operational need.
In addition we may be biased by the current salience of technology related accidents. The industry has a very low accident rate thus any significant event will stand out. In a complex system just because increasing automation use is seen as an input, this may not mean that it is a dominant cause of the ‘accident’ output.

RR_NDB

12th Apr 2012, 04:28

Hi,

safetypee,

Thank you for your dense comment. Very rich and motivating.

The theme is fascinating. I did study Technology (starting in 1967) and increasingly became interested in the "Human Factors", and the non tangible aspects.

My view is Technology as a just a tool to allow us to:

1) Do more (efficiency)

2) Do it better (effectiveness)

3) Do it safer

4) To help for Quality of Life

All this require proper use of it (technology). Requiring adequate understanding, (of what you are doing, using, etc.). Adequate in some adverse situations could mean: Deep understanding.. Just (operation) training could be insufficient.

I will study the links you provide. As a researcher (working in R&D) currently working in 2 projects (and a family of products) the concepts of this thread are also important to me. I visited your thread on Monitoring & Intervention (http://www.pprune.org/safety-crm-qa-emergency-response-planning/478368-monitoring-intervention.html#post7113960) and will be a pleasure to do an effort with you, may be useful to professionals who emphasizes Safety. As a way to preserve human life and have better Quality of Life.

* And last not least to do more, including high ROC to reach new heights in non tangible and also in tangible aspects. :)

In a complex system just because increasing automation use is seen as an input, this may not mean that it is a dominant cause of the ‘accident’ output.

Sure.

The initiating question infers that increasing technological sophistication has changed the balance of the man-machine interface.

I see the "interface" as being necessarily SOPHISTICATED in the meaning Leonardo da Vinci put: Simplicity is the ultimate sophistication.

My feeling is the "interface" don't receive the "required attention", the necessary investments. Complex Systems to be operated safe need you can be in control (full) control if necessary. This requires a lot of "features" in the Project.

What we need is "Fault tolerance and Graceful Degradation" (System + Man). With a good "interface" the man can do better. With less stress on his shoulders. When extreme situations occur. Anomalies of all types simply occur. And you not need to be a Chuck Yeager or Bob Hover. "Trained" to the highest requirements.

So, the theme is vast. My idea is just put some light (i consider this important to us) on the interface because it may play a role in our Safety. Important for our life. As pilots, engineers or just SLF.

I consider important to share concepts we are convinced as important to many people. Concepts obviously not even mentioned in the marketing of the products we use.

In aviation IMHO many incidents and accidents seems received "direct contribution" from "lack of investments" in good man machine interface. Pilots vulnerability as a result. This seems not fair.

LOC (AF447 crash, Fukushima plant, etc.) may be considered as design failures where problems were a consequence of human limitations (of several types, including $) that led to disasters. Three GE engineers quit Fukushima Daichi project when realized the project was not being made in the way they considered adequate.The Tsunami was much higher than (the design specs.) and the APU's were flooded and failed triggering the LOC. In AF447 case atmospheric conditions triggered a cascade of events. But you also must think the crew triggered the disaster by entering WX. Or Fukushima was triggered by lack of enough investment (placing the APU's higher). Always there will be a trigger. :E

But some designs fail smoothly. Giving better chances to be saved or even, survive. Accelerated degradation has to be avoided. (By design, maintenance and operation). And it's possible (in many cases) to do much better. You need to be careful. And well prepared.

Terraplaneblues

12th Apr 2012, 15:28

Misguided technology? We now have incredibly complex airplanes, where untold man decades have been spent on whether or not the throttles move or a if a computer should emit information in red or amber, that fly so slowly the passengers are in beds and the pilot unions are at odds with the authorities regarding sleep deprivation/life quality issues
v interesting thread btw.

TTex600

12th Apr 2012, 17:58

RR, I find myself without adequate time to do your topic justice, but I will initially say this; in my mind two differing interfaces need discussion. the "man - machine" interface and the "human intelligence - computer intelligence" interface.

The man machine interface discussion is easy, at least for me. I want the machine to give me the information in the least confusing manner, in the most usable manner. And I want the machine to allow my control inputs to be made from the perspective of and in the manner that the average human achieves control in abnormal situations.

For example, I have a talk radio station playing on my computer as I type this and I realize that even though I am interested in listening to the topic being discussed. I have NO idea what was said during the time I focused on typing this reply.
IOW, humans only have limited attention, or focus, and it is fairly well accepted that humans have limited in focus when in stressful situations (tunnel vision) ; so why does an aircraft designer build a interface in which multiple inputs are offered? Why does the operator build a process that requires attention to peripheral issues? The Airbus cockpit, and other modern airliners as well I assume, virtually explode with data in an abnormal situation. Bells go off, lights flash, clicks sound, horns sound, ECAM messages appear, more ECAM messages appear, etc. Operators train pilot enslavement to the machine, AB procedures would convince a pilot that the proper technique in clearing an ECAM message is more important than actually flying the airplane.

But that is only a tangential issue. Back to the topic.

The intelligence interface becomes the problem, especially in the AF447 example, and that is the what I think you really desire to discuss.

The Airbus has a sort of AI, or at least a memory bank of programmed data/intelligence. The problem I see is that the "machine" was designed to be flown by reference to the programmed intelligence with oversight of/management by the human intelligence. The problem with the AB approach is simply that the machine interfaces with the human through the AI interface. When the AI is unable to fly the machine, the human is forced to interface with the machine using the same interface that just failed. When one ponders this, one wonders why the designers did not think it necessary to provide a "last resort" interface that allows the human to interface directly with the machine.

Lyman

12th Apr 2012, 18:13

Direct Law, then?

Sequential degradation is a myth, and 'graceful degradation' is a tragic and broken promise.

Tex, you have framed the problem in solid Gold. :D

safetypee

12th Apr 2012, 20:33

TT, “The intelligence interface becomes the problem” (#22).
I have some agreement with this view, but not as you describe – you cannot equate human and machine intelligence.
Whatever limited ‘intelligence’ aircraft might have is the result of human ‘programming’; so “the bells, lights, clicks, horns, and ECAM messages” will have some prioritisation relating to the safe operation of the aircraft; this is specified by the design team. However, as the design team cannot foresee all possible circumstances there remains a requirement for human ‘intelligence’ to seek out specific information, and apply understanding, but this depends on the context of the situation and background systems knowledge. Thus the ‘intelligence’ interface is a partnership which requires a balance in activities, this is influenced by the overall system context. It is not an easy balance as technology never holds responsibility (exercised via human intelligence) – ‘technology is dutiful but dumb’.

The human has the advantage of being able to construct context – understand the situation (which can be flawed); the machine is very limited, e.g. how to differentiate between a null (failed) value, an erroneous value, and a valid signal.
This is not a failure of the machine intelligence, but a limitation of design and engineering. It is not the division between being able to fly the aircraft or not; – the lack of auto flight control and envelope protection are consequential issues.

Serious problems arise at the limits of the machine ‘intelligence’ where the interface becomes ambiguous (‘capability’ actually as machines cannot think). In these situations the human is required to change mode of operation (thinking) which requires deeper understanding of the situation and its implications.
Many accidents involve the failure of the human to recognise the need to change ‘mode’, or if recognised, then the abilities in the changed behaviour are limiting – all of which is influenced by context.

Without intelligence, technology cannot describe its graceful degradation; whereas a human can indicate the approach to limiting performance, technology just quits.
Why should we expect anything else? Many posts state what they need from technology – this is usually context dependent and biased (due to human cognition), but consider, what if the reasons behind the human wish lists are flawed; we have inappropriate expectations or mental models of the big system involving humans and technology.

An alternative view: “The Design of Future Things.” (www.jnd.org/dn.mss/Norman%20HowToTalkToPeopleDOFT.pdf)

Lyman

12th Apr 2012, 20:52

An interface as we discuss must be hierarchical. Value, limit, and ability (consequence) must be innate, self evident. And without any prejudicial load.
Expectations can be the enemy of the well designed system.

At its most basic, Command. One must be taught more importantly than power, is the ability to prioritize importance, not power. Skill must be measured in a form of humility that honors each, the machine, and the man.

Not really a training issue per se, but attitudinal. The 200 hour pilot is not contra indicated (preferred?) if the format is taught without bias, of any kind. In a sense, traditional pilot training is in many ways a negative v/v fluid exchange of command. Is it patience, then, until all the old ones go?

Natstrackalpha

13th Apr 2012, 16:12

Rule No.1 Always keep the aircraft in the loop.
Rule No 2 Man is boss over the machine.
Rule No 3 If machine disagrees with Rule No 2 Interface is replaced by Inyerface and man MUST take over.
>
>
bleepxxxxxwhirrxxxxxxxthats what he thinksxxxxx:Esniggerrrrrrrrrxrxrxrxrxxxxx

Natstrackalpha

13th Apr 2012, 16:51

The 200 hour pilot is not contra indicated (preferred?) if the format is taught without bias, of any kind. In a sense, traditional pilot training is in many ways a negative v/v fluid exchange of command. Is it patience, then, until all the old ones go? I like you lyman, you are interesting. If I may conceptualise your comment and hope that I have got it correctly - would I be right in assuming that you were saying that if the 200hr guys and gals approach this interfacery with an uncluttered mind, free of bias or greater depths of absolutes and worldly knowledge, then they (s/he+machine) can get along - `till ode fogies `av slipped mortal coil, never mind surly bonds uv Earth.

Maybe, but - See Rule No.1 and Number 2. above lest, the ground rise up and smite them. ok?

Automation is a tool, you would no way give up to an automated diety anymore than you would trust your tin opener to plan, prepare and cook a banquet for 15 people.

If, if, if the `lil `ol aeroplane did what it wanted and A L W A Y S ended up landing beautifully at destination all on its little lonesome, come hell or high water - then yes-

but until this has a) happened and b) been proven to happen 100% of the time then the best we young `uns (who just look old) can do, is steer the wee bairns in the right direction and hope that the desire to live is instilled into them in such a way that even the cosy rosy flightdeck won`t lull them into a false sense of security. Remember phrases like Garbage in Garbage out referring to computors like the FMS - is a man factor. Remember, things go wrong but that certain machines - mentioning no names, like the A320 Airbus, will not only tell you what is going on but also make optional suggestions on what to do next, backed up by a seriously structured training program like the one you get on your type rating course which in itself is backed up by all your ATPL training and all your CPL training and all your PPL training and all the flying experience to boot, including loads of experience gained flying aeroplanes the pilot (she or he) has a most composite time working through all the problems as they have studied the aeroplane which will do what it is told to do, or, made to do. Pilots of said machine should always be one step ahead of events so that automagicary - if it decides not to work, can be overriden by the pilot by taking it out of Managed mode and putting it into Selected mode thereby, choosing to press buttons to tell the aeroplane exactly what to do (as it has misbehaved, it must be told off) and failing that lop everything off and hand fly the thing yourself - you can do it in other aircraft and you can damn well do it in this and other aircraft still - ad nauseam. Just as they know when it is best to cross the road by looking very carefully for traffic, like lorries and cars, so it is the case in the swish jetty whirry machine with computers - a toy..
Computors are there to help you (a little bit) to satiate human`s need to be lazy b-----ds. Would you trust a stranger who was directing you while you walk fast towards a brick wall while you were blindfolded? So, you cannot therefore, expect to go hurtling along at 8 miles a minute by a bit of kit, without monitoring the whole shabang.

If it doesn`t work properly then downgrade its authority, just as they do with humans. YOU have the power to do this (as pilot) as you are the boss, the human-boss, the president/chairperson - the pilot, the brains and mind of the aeroplane. The aeroplane does not care who is flying it nor what is flying it, it cares about nothing but responds symbiotically to very sensible piloting.

Sure, you can fly Auto-Cento per Cento all the time, no worries, but should something go beyond non-normal ops then you will have to work for a living. There is less interface between the controls than conventional aircraft as fly-by-wire is all the rage and glass cockpits help by stuffing all the info into a nice ergonomic square for you so - you don`t even have to move your eyes, much. Also, feel has all but gone too - as pilots inputs go to the flying surfaces, through computors and via wires with little or no feedback, synthetic? No, not even that, there is simply nothing there at all, in feedback, except for a slight forward pressure induced just before touchdown - thats a tiny bit of feedback for a 4 hour flight..

It is YOUR machine that you are playing with, not a toy that is in command of YOU.
And, all the time it is still a great and beautiful aeroplane, which you FLY, so don`t let a tantrum of a bit of plastic mess that up for you - take over, quit playing Xbox commanders - and fly., it. Downgrading from automagicary means, the machine becomes an - aeroplane, again. And, Aeroplanes are flown by pilots who have learned piloting skills from other (instructor) pilots and from "learning to fly"

Lyman

13th Apr 2012, 17:34

Attitudinal. Case in point? In a forensic follow up, everything needs to be spilled onto the conference table. Everything. All the traces, data, and artifacts. Withholding anything is withholding everything. No secrets. Without transparency, the old ones hold too closely the POWER. I foresee the loss (good riddance) of the old mercantile dynamic of "Trade secrets".

As with the tribes of old, and long before common knowledge, the Shaman had spells, icons, totems, and chants. All to cow the tribesmen into a fear that perpetuated the power of the Shamans' BOSS, the Chief, and his allies abroad.

The interface can be pitched as complex, as with anything. It will be soon understood, and well, by the common man. I am optomistic we will soon see the loss through attrition of the old suits, the liars, the con men, the profiteers.

It's a MACHINE, eh?

Command, not Power. The first requires discretion and wisdom, the second, merely secrets held by the unworthy. The old ones fear the loss of proprietary, and to be found out to be shamans.

sayin.

Lyman

13th Apr 2012, 18:54

One thing at a time, if you are a human, and if well trained, perhaps three. With a PM, you are in 6 ville, and if that is not enough, well, the a/c actually wants to fly, that is why they look alike.

The safest pilots are two hundred hours in, and newly certificated, but you knew that. The most unsafe? Around a thousand hours. Instructive of the human condition, reality, and the traditional construct.

Knowledge is useless generally, without experience. The best pilot is one who can remain confident, in front, and on top, and for the longest time; at least until things settle into something one can recognize.

If one has a longer wait, refer to: a/c want to fly, it's in the planform. Level, powered, and within limits.

Grace under pressure is more important than rote. Pilots have retracted gear prior to rotate, in honor of rote. "Light a Pipe" (with apologies, PJ2?). The effective a/c is built to cruise, a long long way, in comfort and economy. The current paradigm should suffice, save for some bonehead plays, terrorists, and Weather, mostly avoidable.

All things considered, this thread is exploratory, I jump onto a twin tomorrow for Hawaii, and will sleep as a babe, and why not? The interface is called into question here, and collaterally in honor of the dead out of Rio. I don't think it was the interface what done it. In fact, I am certain. Mechanical, and PE, in some exotic blend, and we will never know, not this time, again. Gotta make not only a buck, but as many as logic and hypnosis will provide.

Thanks Nat

Natstrackalpha

13th Apr 2012, 19:14

Well, hmm, either you are a machine. Or communicating in a much more different way than most.

I trust that your (twin) journeys will be forever safe and comfortable.

Ha! Rio. Hmmm, well I DID put the point across and got only one attack. felt like I was trying to move a mountain. Lost also my instructor to policy. I always remember what I see. As - ahh, yes, rest easy - it is a safety bred industry - safety this, safety that . . the higher we get authority, the greater WHACK! we have with safety and the more we can influence things to get safer and safer and safer. It always works, some people think you are telling them that their fly is undone - put them on the one out of Rio they will soon forget their embarrasment. Happily, most , no, all pilots, don`t trust Jack Diddly, which is why they check the b--cks out of everything they use and everything they do, confirming this, and that. keeping each other in a kind of working communicative loop, called, the loop.

Statistically - flying is safer than riding a bicycle.

Also, Captains need balls. To be able to enforce their authority and safety policies, they trust nothing and no-one, lest they (their flights) are "safe" which is why thousands, but, thousands of flights every day are flown without hiccup.

Also, Security don`t like terrorists one little bit.

Ground Crew are also safety orientated. Hope Brasil was not one of your family.
Don`t remind me- I saw it on TV. No way will circumstances get me in that situation.

If it helps, we study a lot of . . incidents to find out what went wrong, so as we can make sure it won`t happen to us. Is is a lifelong . . .quest for ever greater safety Ask any of the pilots on here . . they will tell you the same thing. Happy landings.
======================================

Added the next day - No, Rio was due to them wandering off into the rainforests and there were survivors.

I was referring to this one -

Here is a clip from youtube - courtesy of youtube.com etc., this is the one I meant, of which I think zero survived, extremely not good. (If I remember rightly), the pilots glided away from all the built up areas and landed it in a wood.

Situation, if I remember it, was . . .coming from Brazil, they encountered unforecast headwinds depleting their fuel, then their destination was socked in with bad weather, thus slowing down the number of aircraft landing there for they had to stack up all the aircraft, in like a vertical waiting queue, if you like, everyone is at a different level, (altitude), as each aircraft lands, the next one up in the queue is told to commence an approach and the one above him or her is descended to the next level down in the stack - one can jump the queue in an emergency - Avianca here - as you can hear have told ATC that to hang around is hardly an option and the rest . . well, its on the tape. I dont think they were stacked up I think they were just trying to get what they could out of the approach. There are times when we should be able to beat our way out of a paper bag. sometimes, it actually does pay to declare an emergency (whereby the controller will give you any cleared runway you want) its all fine and dandy being cool calm and collected, serene and reflective, this has to be trainined, or we would all be screaming because they got the wrong colour ice cream in the inflight catering meal, but somtimes it pays, to return to "proverbial has hit the fan = actions stations! And cooly and calmly and swiftly race with the devil to put rubber to tarmac, prontissimo!!

Poignant, for want of a better word. there are other tapes on the dialogue, giving a fuller lead up to this disaster.

Seems to be drifiting away from Interface and spreading across to lack of go juice.

http://www.youtube.com/watch?v=uWgKHdJoCZw

N.B. It was Columbia not Brasil

THREAD - this is more about my fuel thread the other day, inadvertant thread spread.

Avianca Flight 52 - Wikipedia, the free encyclopedia (http://en.wikipedia.org/wiki/Avianca_Flight_52)

TTex600

14th Apr 2012, 15:19

TO: no one in particular.

TTex600 is just a average dumbarse pilot. I've been doing it for well over 25 years and I've managed to survive, but sometimes only by the skin of my teeth. I represent the vast VAST majority of the men/women flying your tail around the friendly skies.

Either build yourself an heavier than air high speed transportation device that is entirely independent of my human failings and buy your tickets on it, or build yourself a heavier than air high speed transportation device that requires (because I do have the ability to recognize degradations etc) my flawed personage and build it to help me cover my failings.

Recent accident stats show that fuel CFIT etc kill aircraft. Cockpit confusion kills aircraft. IIRC, BritishMidlands lost a 738 some years ago when the crew shut down the good engine, AF447 was lost when the crew couldn't decipher the instruments after suffering UAS,

Recent trends in automation do nothing to reduce confusion when the excrement hits the fan. Give me a bird that gets out of my way and let's me fly it when it can't fly itself, that's all I ask.

Turbine D

14th Apr 2012, 21:25

Natstrackalpha,

Well, hmm, either you are a machine. Or communicating in a much more different way than most.

It's the latter, although at time its seems like the former...;)

RR_NDB

15th Apr 2012, 08:40

Hi,

TTex600:

AF447 was lost when the crew couldn't decipher the instruments after suffering UAS (http://www.pprune.org/tech-log/481350-man-machine-interface-anomalies-2.html#post7134943)

Recent trends in automation do nothing to reduce confusion when the excrement hits the fan.

Airbus SAS designed and introduced their products "in close contact" with pilots, we obviously believe.

Normally all incidents and accidents ideally should provide a strong feedback to the design.

Considering "economics" could we expect improvements in the aftermath of AF447?

Considering what we heard from BEA we could be skeptical.

One possibility here in this thread is to characterize "where is the problem"

There is a trend? i think so. Why? In simple terms is:

A complex System when degrades (for any reason: obsolete pito'ts, harness damage due uncontained eng failure, etc.) presents complex challenges. Crescent complexity should require more R&D investment in the "interface". And crescent "capabilities" in the crew.

The antagonic factors in the problem seems generating a concerning trend. Example:

Require the crew to diagnose consequences of obsolete parts (Pitot's). This problem could be EASILY tackled buy the System. The (lack of) automation here IMHO is because "the Design" doesn't considered important (and/or feasible) help the pilots. Just to inform. It seems the automation was considered more important to act (like auto THS) than to provide means to reduce confusion.

Is there a deep and thorough analysis (from the A/C manufacturers) of possibilities of failures and how pilots would react? Is it possible? The time required to diagnose is compatible with the contingencies you may have?

Pitch and Power "solution", memory items seems tentatives to solve problems without required investment (in the interface).

It seems the "training" is being pressured by lack of investments in the ifce. And in this situation, crew would be vulnerable (to be prone to error).

TTex600:

in my mind two differing interfaces need discussion. the "man - machine" interface and the "human intelligence - computer intelligence" interface. (http://www.pprune.org/tech-log/481350-man-machine-interface-anomalies-2.html#post7131654)

safetypee:

I have some agreement with this view, but not as you describe – you cannot equate human and machine intelligence.
(http://www.pprune.org/tech-log/481350-man-machine-interface-anomalies-2.html#post7131906)
We will characterize this in our discussion. Indeed interesting point. What concerns me is both issues work together and this mix is complex. Pilots could be required to solve (unpredictable issues) very fast. Is this possible? Or will create a "serious "CRM" issue between the man an the machine, via this complex interface?

When man interacts with a complex interface it seems you have something like a CRM involving not just the crew, but a CRM issue between PF, PM and the machine. Auto THS may be used as an example: A System going to a high FL stall should autotrim to the limit? (13deg NU). And how the should interact with auto features? And in presence of failures?

To be continued to comment on posts of: Bear (machine :)), Nat and safetypee. I am preparing to the denser posts more requiring. :8 .

It's the latter, although at time its seems like the former...

Well, hmm, either you are a machine. Or communicating in a much more different way than most.

I need to be prepared to "on the fly" reconfiguring to discuss with "flying anthropologists". :8

PS

safetypee,

You put very interesting points and i am studying and thinking. I started to look the issues you commented more recently. And in your thread on monitoring & intervention you are ahead many miles. I need to study to be capable to present good arguments. :) . You will feel the heat! The theme is fascinating. An R&D rich field. We will fly (with air superiority) over it. TTex600 put the basic. Good to start.

Rule No.1 Always keep the aircraft in the loop.
Rule No 2 Man is boss over the machine.
Rule No 3 If machine disagrees with Rule No 2 Interface is replaced by Inyerface and man MUST take over.

I liked rule #1. We need to be proactive. Is it always possible? The interface must be friendly to allow. The trend seems not allowing. You can't override (in Airbus). System can decide when degrade. And caught you in surprise. :eek: This concerns me.

Misguided technology?

:confused: The trend has it's own power. Concerning.

safetypee, Thank you good links :ok:

Natstrackalpha

15th Apr 2012, 12:03

Man, your English is weirder than a CAA exam question.

Look - it is not a case of Human intelligence V Computor intelligence - because computors do not have intelligence - they do not have a mind, nor do they have a lifetime of emotional and practical intelligence programmed into them like us cool Human Dudes and Dudesses do. We, Humans, designed the thing - so it is unlikely that we would design it if it was going to do us any harm. In training we realise that there is greater future in pointing the gun away from you when pulling the trigger. So, being pilots we have the human ability to switch it off - and - if we get p----d off with it then we will do it. Like the other pilots have stated - there is more facility to switch it off and fly the aircraft than there is for it to switch us off and fly us. This is very important - for if it were not true - then tomorrow, when you turn up at the airport - all the aeroplanes would have gone, disappeared. They would have taken-off into the night and they would be sunning themselves on some sexy beach in a deep blue ocean - surrounded by other blonde aircraft and holding a cool Pina-Colada in each hand. So, all the passengers would need a refund as there would be no aircraft left to fly them. Although, they, the aircraft, would be doomed - as, when they tried to take off from the lovely sexy beach, to fly somewhere to get some fuel, they would not be able to move. Not because they are fat on Pina Colada, or exhausted due to too much blonde, aircraft company, but because there is no hard tarmac on a beach and like the dinosaurs, they would sink into obscurity and be replaced by aeroplanes that are designed, manufactured and flown by hu-mans and hu-womans who have been filtered through a gate of training and, if they pop out the exit of the training the wrong shape then they don`t make it to the flightdeck. To make sure, they, the pilots in training, are taking shape, they are tested, not only on their flying ability but also on their ability to reason. this testing is provided to them, covert, to test their psychological make up - not only in their medicals which they have to pass every 6 months (or more if they are ill, with lassa fever or something) but also by trick questions, especially in their early years of flying. They have to think out of the box, back in the box and be trained in such a way that in the rare event of an appalling flight, it will seem like easy peasy lemon squeezy - and indeed be so, as usually they, the pilots, have been to hell and back in order to pass through the training.
They are trained to fly aeroplanes, having a computerised Xbox type thing is a glittery luxury, a `fun` thing to have. To operate such jolly kit takes, added training at great expense, thousands and thousands of dollars/pounds/yen (ache, ouch!)

All of the qualified pilots on here - could just as easily fly a fully automated flight from A to B or indeed, fly it manually, as that is what they were trained to do and that is what they have been doing all of their flying lives, `till FMGS came along - and now they get to play with something on those long flights, its fun, for everything that the pilot has just worked out with a pencil, why, there it is in computor LEDs, it is also entertaining to see how accurate the box of tricks can be, and as mentioned before, if it does not behave, then switch it off and fly the aircraft - just as we are trained to do. You know, you should start a thread on Artificial Intelligence.

RR_NDB

15th Apr 2012, 16:29

Hi,

Natstrackalpha words:

Look - it is not a case of Human intelligence V Computor intelligence (http://www.pprune.org/tech-log/481350-man-machine-interface-anomalies-2.html#post7136154)

As i told in my post (http://www.pprune.org/tech-log/481350-man-machine-interface-anomalies-2.html#post7135878) the comment was from TTex600: in my mind two differing interfaces need discussion. the "man - machine" interface and the "human intelligence - computer intelligence" interface. (http://www.pprune.org/tech-log/481350-man-machine-interface-anomalies-2.html#post7131654)

I agree with safetypee: I have some agreement with this view, (my bold)

The "dangerous confusion" may come from an automated interface (with no AI built in). Simple protections can present "inputs" to the crew difficult to be understood in certain situations. This can occur with just combinational logic. E.g. a simple interlock. When we introduced microprocessors (i designed with the first one: Intel 4004) you put the so called "Finite State Machines" in the "loop". They memorize and it's outputs DEPENDS on new inputs and the MEMORIZED data. look, i am not talking of AI. Just saying crew may face situations where an almost immediate understanding could be vital and could be forced by training to clear several memorized states, just to allow the System to return to normal thinking :} (operation).

Problem as i see is: The interface must be with K.I.S.S. principle built in to allow a safe operation (in abnormal situations). Even dumb interfaces can present challenges to a crew. And training is concentrated on predictable issues. We are capable before new situations to deliver an interface that really ALWAYS help the crew? I think is just not possible to assure. What's the solution? Very simple: a well prepared pilot (not just by Pavlov training, memory items, P&P approach, etc.) can do miracles. Why. Because his Natural intelligence is "open" to highly creative solutions. We may list examples of this and examples of incidents and accidents where confusion was installed from even dumb interfaces. like the LOC of Thiells 727.

You know, you should start a thread on Artificial Intelligence.

After understanding the issues presented by microprocessor based interfaces with just algorithms built in we could discuss something on AI in an "off topic" way. I don't see reasons to complicate the thread with this component. The problems we observe in the current interfaces IMHO recommends attention. Because seems complex enough to, in some cases, cause "CRM issues" between the pilots and the machine. In a sense tha both (partners) don't work together to effectively use all available resources to save the A/C.

AF447 may be is a dramatic example:

1) The plane had no failures* (the sensors were operating as per design)
2) Crew including Capt. had all resources available (engines, system, etc.)
3) The had no chance to "decipher" the interface outputs and were forced to rely on other inputs
4) They aggravated the initial issue and were caught in a "unsolvable surprise"
5) They never understood what really happened

Despite the interface being MUCH MORE advanced than the 727. Confusion. And the result was the same. Crew were put in a "terminal state" requiring a super pilot. Even test pilots could not leave this "state"

* Just a temporary "cold" in 3 sensors

In the aftermath of AF447 case what could be made? It seems to me this is a (dramatic) wake up call to the importance of the interface (and it's characteristics) to the Safety of the "advanced planes". I don't operate "the thing". I know what an interface MUST present:

ALWAYS present to the crew the possibility to NEVER be caught in a surprise impossible to be solved, specially when the plane has no failures. Design (technology limitations, whatever) never could put the crew in the situation PF+PM, then Captain entered.

This (confused crew with no time to even understand) could happen again? I think so.

Why? IMO because the interface could be improved. And probably as i understand better without adding extra complexity, like AI features

RR_NDB

15th Apr 2012, 17:31

Hi,

TWO anomalies were present in F-GZCP:

1) Sensor anomaly (not capable to operate properly). A well know issue.

2) System anomaly (System was reconfigured by lack of redundancy in the design) Something the System "realized" immediately and never told properly (assertively and with the required clarity) to the crew. Instead the interface informed other issues to the crew. Actually we could never know what PF really received (inputs). RHS was not recorded.

Question:

There is a better way to deal with this kind of problems without relying on pilots capable to deal with external (induced by WX) and internal (inadequate processing of sensor anomalies)?

It's fair to require the pilots (not seasoned pilots) to manage and solve simultaneous anomalies in a rush? (through scan while simultaneously being required to aviate the plane sometimes in difficult conditions)

Or it's just a training issue? You teach the pilots on possible ways to "solve" consequences of anomalies.

IMO an interface must be designed to HELP and not present challenges or surprises. The surprise of iced sensors is enough. To degrade the plane by the first surprise IMO is a way to create chances to confusion. And this is dangerous. Could force PF to "new ideas" that could present "new problems".

In Thiells 727 case a basic crew error triggered anomalies in the sensors and the confusion was due "redundant anomalies" in the interface (alt and climb indicators misleading crew).

In AF447 crew didn't trigger both anomalies, and were required to understand very fast reason of SEVERAL interface outputs, adding to the initial surprises.

Indeed, A/C operated as designed. (no permanent failures) Just a "glitch" (a temporary cold) generated enough outputs making 3 crew not able to decipher interface outputs.

It's not necessary to review or improve the interface? Or it's just enough to train on similar situations (after the more obsolete sensors were substituted)? And the current sensor with know limitations? May trigger again anomalies in the System? The Redundancy issue (lack of) was solved?

RR_NDB

15th Apr 2012, 18:12

A problem (of interfaces):

Even simple interfaces can generate secondary anomalies. A complex (not K.I.S.S.) interface could always be "deciphered" when you need most?

The responsibility of the interface is huge: V/v FO (PF) of ANA 738 rolling with the Captain locked behind cockpit door. :E

Or should be simply considered crew error? Automatism (the crew interacts through the interface) can be dangerous. And can act "ahead" of the crew.

Is it possible to stay ahead of the "automated interfaces". Silent THS move, non observable (directly) SS, System reconfig (due sensor and System lack of redundancy) allow you to be ahead of the plane? And to enter the correction loop with a clear and fast understanding to execute your pilot capabilities? (aviate, etc.)

I see a conflict here.That played a role in a big number of incidents and some high profile accidents.

IMO training is not the only solution.

RR_NDB

15th Apr 2012, 18:16

Man, your English is weirder than a CAA exam question. (http://www.pprune.org/tech-log/481350-man-machine-interface-anomalies-2.html#post7136154)

System, interface (or both) issue?

Natstrackalpha

15th Apr 2012, 19:16

This is to lyal, safeteezee, TTEX600, RRNDB, Lyman and anyone I have forgotten or have spelt their name wrong. (you know, people are beginning to talk about us . ?)
===========================================

Guys. sorry. I was generalising. I thought you were discussing a mere concept, I apologise. Also, I was not being offensive when I asked if you were a machine, but I see you took no offence, excellent.

Taking a more practical and serious view, as you mentioned the AF, I think you mean the 330 / Atlantic?

I can comment on this and it is easy for me as I saw it on a documentry, on the T.V. but - for that reason only. However, much can we "apply" from such horrendous happenings - I also think I can understand and address what you are saying.

The situation in its worst moments (before the final one, ) had obviously provided the crew with a surreal situation.
Also, at high altitude at night having their little minds reversed as little Alice through the looking glass herself!!

At this point the situation is really a problem. I am not going into the detail as everyone knows the conflicting factors. The resultant factor (of this discussion) is what we have learned, which is: At a set power setting, and a set attitude we/they could have maintained level flight (which is the minimum a pilot could ask for) from that point on we would consider the nav implications as we have just taken it out of A/P which had obviously and most noisily tried to kill us. TTEX600 would have already have disengaged the A/P, me too in fact, and gone for Standby Artificial Horizon, which should have been playing ball ok, the standby Altimeter would have been tits up as would anything else from the static vent pitot tube . . system. This is not an Airbus problem, this is a very severe icing problem
Without dragging it all out again, but, as you are interested. Instead of the FMS, well, bon d`accord, it was the ADIRS actually, instead of the brains of the thing saying to itself, hey, we are all iced up therefore none of the information is reliable, it, the system(s), believed all the nonsense it was receiving from the . . inputs from the static Pitot and the ADIRS which complicates things further and everything is [also] derived from Groundspeed, as well as airspeed [inputs] - the FMGS Flight Management and Guidance System - therefore, simply conducts the flight in Association with its inputs, into its system - unfortunately all the inputs were giving wrong information due to the fact that all the sensore (they are not sensors per se` am just trying to Keep It Simple - `cos am Stupid.)

So extreme icing has block correct readings into the system.
The system not only displays incorrect data now but, the FMGS is telling it (the aeroplane) to stuff the nose down as we are losing airspeed. Coupled with some not so yummy overspeed indications all straight through the computor like a laxitive) and, and, stall warner, all more or less at the same time - this is where TTEX600 comes in . . dis-engages the A/P to stop the aircraft from commiting Hari Kari - puts the attitude where he wants it (8deg nose pitch up I think it was) and 80% N2? Sounds plausible for a setting, and hopefully, switched off all theGoddamn noise on the flightdeck, which, was obviously a cocophony, or a cresendo, a mess basically - blame Mother Nature and her huge ice bearing storm clouds and the surrounding air which was cold enough and moist enough to ice up the aircraft beyond its de-icing capabilites - however, the aircraft was flyable. If the same thing happened tomorrow, obviously, we would handle it and think "that was easy" as we have seen it, and learned how to cope with it and how to "fly the aircraft" in this situation.

You know aviation is safe, but it is young, it is barely 104 years old. We learn new stuff all the time. Only during the second world war did they discover what jetstreams (near the tropopause) were and how they could be used by pilots.
We are discovering ever new things about the jet engines we fly - how icing can occur in air which is clear supposedly will only produce ice crystals, how reduction in power at altitude can produce ice induction, no accelleration, vibration and scare us fartless, thinking we have an engine problem, where there is nothing of the sort and there is a cure to this and other "anomolies" most of which are not dangerous, provided we - we fly, the aircraft. Because, we started flying with a simple aeroplane which had little in the way of instrumentation and nothing in the way of FMS, computors, a myriad of pitot tubes and static vents or ADIRS systems which has to balance everything with its gyros, GPS inputs and relative position and its groundspeed - so to fly, is easy, or not depending on which way you look at it.
It is very simple to fly, if not easy . . ? It is not as complex as trying to figure out why the multimillion dollar piece of French pastry is just tripping out of its brain and simply going beserk.

It is just a noise, turn it off and - fly.

EVERYTHING IS EASY IN HINDSIGHT

IF THE MACHINE GETS SICK, SWITCH IT OFF, IT WILL THANK YOU FOR THIS, BY BRINGING YOU INTO LAND - after you have got rid of all the ice. you might even have the ADIRS if the IRS is still in Nav but your ETAs will be up the Swannee, but not to worry, we can also navigate right?

So then its to DR navigation, as we have all been trained to do from our baby flying days known as PPL training.

On that night, rather than the crew figuring out what the machine wanted, should simply have disconnected it Autopilot off - Autothrust Off (TLA to the do-nut, I know)

There it is.

If it does not work, at anytime, then it does NOT work - it cannot cure itself, it cannot figure or evaluate anything. It can only calculate from many different areas, SPEED, PRESSURE, TEMPERATURE, VELOCITY, ACCELERATION, WEIGHT, BALANCE DISTANCE, TIME, THRUST and even KINETIC ENERGY, via many computors, wow! but that is all! If the inputs go wrong, from any sensor to the computor, then - ((say it with me guys, all together now)) "Garbage in Garbage out"
It, the machine, can only do so much, and that is it - it won`t lick its own wounds, it WILL NOT make itself better, nor dial 911 or 112 or 999 or contact PC world, nor will it rectify or stand back from the situation nor can it realise that anything is very wrong, it just shines startling lights and blaring noises so as to wake up the pilot from any idea that this night was going to be an easy ride. AF, your flight in question, was most unfortunate and heartbreaking, but if it is any consolation is HAS dramatically rammed it to our attention this case, this scenario, so that, if it should happen, ever again, the flight will be fine and the people on the aircraft will be fine and the families will all land safely, and not be harmed, not be hurt or afraid - because of what happened over the Atlantic - all these pasengers will be saved, again and again because of that one flight over the Atlantic and all those poor people who lost their lives.

RR_NDB

15th Apr 2012, 20:17

Hi,

The Interface should be:

1) Simplest possible (K.I.S.S. design rule)

2) Allow the crew ALWAYS be capable to control the plane, when required

3) Allow the crew to be ALWAYS "ahead" of the plane

4) Always Help the crew

5)Capable to orient crew how to better enter the loop to act better (fast, precise, etc)

6) Keep crew ALWAYS ready for ANYTHING

7) ALWAYS inform on "what's doing (protecting, processing in background, etc.)

The interface additionally must be:

1) Always reliable for inputs from crew and outputs (inputs to the crew)

2) Never mislead the crew

3) Provide properly most important indications to allow a safe aviate

4) Allow immediate interventions as required by circumstances

5) Allow "recover of what happened" (for design feedback, diagnostic, etc.)

Mac

If i missed something, please include it.

Questions:

1) This is what we should expect from the Interface?

2) The Interface used in A320, 30, 40 and 80 have this characteristics?

3) If not, Why?

john_tullamarine

15th Apr 2012, 21:53

Chaps,

If I might ask that we restrict the overtly gratuitous use of those sorts of expressions not generally admitted to genteel discourse ...

safetypee

16th Apr 2012, 01:26

Lyman / Nats, you appear to be associating the majority of the interface problems with the machine.
To paraphrase Jens Rasmussen: –
“The problem in the design interface is not to match the technology with the user’s mental model, but to create an interface which generates and maintains an effective and safe mental model”.
Note that the requirement is to create an interface, not just design the automation; thus there is need of close relationship between the automation, the human, and the situation.

Attempting to meet just one pilot’s wish list with automation may only satisfy one pilot. This is similar to designing a fix for the most recent accident; you fix ‘the cause’, whereas there could have been many contributing factors, any of which can reoccur in other circumstances – situations, people.
The alternative is to design automation which helps the operator form a mental model (a construct of awareness and interpretation of the real world, together with knowledge and knowhow) and thus may benefit a wide range of pilots in various situations. For the operator this requires knowledge of the automation’s objectives, capabilities, and the limiting situations – a need for training, education, and understanding.

Perhaps these requirements identify a weakness in training, but also in the human attitudes to automation. Many posts stated what the automation ‘must give them’, but an interface has to be two-way, and is of particular value where the pilot extracts information from the machine and applies it.
Modern society has a need for instant gratification, solutions without thought (Google, SOPs); this is not the purpose of automation in aviation, excepting perhaps a few fully automatic operations. The pilot has to think, create a mental model, understand the situation, and decide on the automation’s role in that situation – risk assessment, decision making, action, and checking.

Switch it off.
Re “… the human ability to switch it off …”; this requires discipline, knowledge, and again risk assessment – do you know when to switch it off, and will you. Humans are biased in risk, action, and belief - ‘that they know better’ (macho attitude). Training should help control these behaviors, but occasionally in stressful or surprising situations human performance is insufficient and automation is allowed to continue too far.
Where such a need to switch off is recognized, it is an indication of poor situation awareness. This is not to say that automation has or has not contributed to this, but the human must to maintain control of these aspects as well as controlling their own thinking processes – part of the interface.

“… if we get p----d off with it then …”; then this is the loss of control of your thinking, discipline, CRM.

“The concept of human error: is it useful for the design of safe systems?” Jens Rasmussen. (http://ssmon.chb.kth.se/vol3/ps1.pdf)

Turbine D

16th Apr 2012, 02:04

safetypee,

Good post, I was beginning to think along your lines, it is a two way street. One thing that struck me was Nats post in which he said: (The bold is mine)

All of the qualified pilots on here - could just as easily fly a fully automated flight from A to B or indeed, fly it manually, as that is what they were trained to do and that is what they have been doing all of their flying lives, `till FMGS came along - and now they get to play with something on those long flights, its fun, for everything that the pilot has just worked out with a pencil, why, there it is in computor LEDs, it is also entertaining to see how accurate the box of tricks can be, and as mentioned before, if it does not behave, then switch it off and fly the aircraft - just as we are trained to do.

Well, interestingly, boredom can and often does lead to curiosity as to how the automatics work and do they work correctly? Here is an example of what can happen when fun and curiosity goes too far. BTW, this was a highly experienced crew.

Curious Crew Nearly Crashes DC-10

Have you ever flown a DC-10 at 39,000 feet with 115 passengers on board and been tempted to experiment with autothrottle system - just to see what would happen? In late 1973, a pair of curious National Airlines personnel, a captain and flight engineer did and their actions nearly cost everyone on board their lives.

On November 3, 1973, National Airlines Flight 27 was operating as a scheduled passenger flight between Miami and San Francisco. At about 4:40 p.m., while the aircraft was cruising at 39,000 feet 65 miles southwest of Albuquerque, the No. 3 engine fan assembly disintegrated and its fragments penetrated the fuselage, the Nos. 1 and 2 engine nacelles (which contain those engines), and the right wing area. The resultant damage caused decompression of the aircraft cabin and the loss of certain electrical and hydraulic services.

You want to try it and see?
However, it is clear that the captain and flight engineer's irresponsible actions were to blame. They were experimenting with the autothrottle system, which supplied the instruments that measure the rotational speed of each engine's fan and low pressure compressor. The cockpit voice recording contains the following conversation just prior to the number 3 engine exploding:

Flight Engineer: "Wonder, wonder if you pull the N1 tach will that, -- autothrottle respond to N1?"
Captain: "Gee, I don't know."
Flight Engineer: "You want to try it and see?"
Captain William Brookes, who had been a National Airlines pilot since 1946 and who should have known better responds, "Yeah, let's see here."
Flight Engineer: "You're on speed right now though."
Captain: "Yeah."
Flight Engineer: "You know what I mean if your annunciated speed - if you got, ---"
Captain: "Still got 'em."
Flight Engineer: "Well - - haven't got it -"
Captain: "There it is."
Flight Engineer: "I guess it does."
Captain: "Yeah, I guess it does - right on the nose."

[At the instant he says the word "nose" there is the sound of the number 3 engine exploding followed by ratcheting sounds.]

Captain: "[expletive deleted] what was that?"

By playing with the autothrottle controls - in what amounted to an in-flight failure-analysis test of the autothrottle system - the crew managed to produce a condition where the engines were pushed to higher rotation speeds than they were designed for. According to audio analysis of the CVR tape, all three engines surged (#1 to 105%, #2 to 107% and number 3, which failed, to 110%).

There are many things to consider when considering the human attitudes to automation, "fun" and curiosity/entertaining are but two consideration to keep in mind.

Lyman

16th Apr 2012, 02:34

Hi safetypee.

Fluid, Additive, Synergistic, and Timely. Call it FAST. Aviation brooks no timeouts. Thinking is time consuming, one reason why auto is superior in rote and program over human abstraction. Assessment is a pedestrian way to address not 'risk' but risk management. Auto or no auto, without a highly developed intuiton, pilots can create, rather than minimize, risk. Here I use the word to stand in for the ideal pilot, experienced, highly trained, and confident.

447 had interface problems. I don't fault the system, nor do I fault the pilots, per se. There may never be a satisfactory conclusion, but the advances have begun.

"First, do no harm." None of the more obvious blunders are outside the realm of human error. Autopilot is not a computer, it is a system of servos, acting on behalf of. Understanding the Flight control logic is incumbent upon the crew, not vice versa. What new issues? I called the interface a "partnership" for a reason. Since the beginning, pilots of renown are the ones at one with the machine.

Lack of AoA indication, Difficulty in seeing the partner's SS, Faulty probes, not being fluent in other than Normal Law; these are not interface issues, but instead, bonehead mistakes in design, programming, cockpit layout, and poor training. When plugging the dike, eleven holes exceeds the available plugs by one, and one open hole is enough, let alone several.

The successful pilot will master the machine, but has degraded chance for success with inexcusable lapses in design, training, consistency, etc.

RR_NDB

16th Apr 2012, 16:24

You want to try it and see? (http://www.pprune.org/tech-log/481350-man-machine-interface-anomalies-3.html#post7137028)

They were simply trying to learn. :sad:

I am "addicted to test". I saved* my life or avoided accidents in several opportunities applying stimuli to check the response of the UUT (unit under test).

Sometimes, to test you could destroy it. :}

In 1993 to diagnose a hidden failure (very difficult to pinpoint) i capsized a car. Just testing. :{ No consequences, fortunately. Under controlled conditions (test environment)

Did you know the Pinnacle 3701 stall and the subsequent Darwin award? :mad::E :mad:

Natstrackalpha

19th Apr 2012, 13:39

Not wishing to add to an apparently nicely concluded topic, I have to defend one or two misunderstandings (sorry).

Safetypee, “… if we get p----d off with it then …”; then this is the loss of control of your thinking, discipline, CRM.
Sorry, if you mis-understand - this does not indicate a loss of control of one`s thinking. the interactive process on modern ECAM procedures, works very well.

The situation of the AF-330 over the Atlantic, was so severe, that is; if you were to go through the ECAM procedures, on that night, (which is what they would have started to do . . ) then you would have ground to a halt in a state of catatonic awe, as nothing was holding any logic at all. I assume safety pee does not regularly fly ECAM and glass cockpit/fly-by-wire?

Once again, then, if, the system is OBVOUSLY behaving non-sensically and absurd - then the pilot would disengage what he considered relevant, in order to "TAKE CONTROL OF THE AIRCRAFT" before the non-operational system does any damage to the flight.

In the case of AF - 330 / Atlantic, had they have done the above “… if we get p----d off with it then …”; and disengaged autopilot, reset thrust and disengaged a/t then - we, that is you and me, and everyone else on this post - would not be having this conversation - nor would there be > 300 passengers in the equation.
In an unforeseeable situation or an anomaly - such as being surrounded by weather on all sides of the worst kind out of radar range, and the system having gone beserk due to incorrect processing of ADIRS inputs - then sometimes that is all there is to do - then this is the loss of control of your thinking, discipline, CRM. Far from being loss of control of one`s (or my) thinking - on the contrary old chap, the mere thought, that, "ooops, lets not die huh?" seems to me to be a totally in control and a healthy one and affording the most apt discipline, as >300 passengers would no doubt agree with me - had they have had the opportunity to do so.

We, or at least, I, do not take action or apply thinking without reason.

This is not some pseudo-important jolly fun topic on an aviation website, just for fun. Some pilots have posted on here to give an honest and in depth opinion - based on life saving flight safety. If you want to judge then find a flower show or some other topic to go and research and leave the professionals to their own profession - you Geek!

Also, Turbine-D, turbine-d, well, probably expected of non-aircrew. My point which you criticised was not to be taken literally. We do not "play" with the system, what I was trying to say was that the automated system holds far less importance than the professionals who fly them. Airlines, during their selection and recruitment process, test for pilots that would have that tendency - maybe they then become engineers.

We are fully aware of the example you have shown us, which is why we do not do it. Also, we have ample opportunity to `practice` with all the avionics kit, in flight school - again and again and again, so we have got any inkling of curiosity out of our system. Sorry, if that was not made apparent.

[U]CONCLUSION then?:O:D

It is strikingly obvious that "pilotless" air transport passenger aircraft will be a long time coming, unless, at least, at least, someone is driving it from the ground. Even then it will be a most risky leap into stupidity and disaster, as no system can evaluate with the same depth, range, clarity, foresight and value to human life as that of the cerebral system of the Airline Pilot.

safetypee

19th Apr 2012, 19:20

Nats, perhaps not a misunderstanding, but different points of view.
The details of AF447 are elsewhere.
The A330 technology did not fail; it behaved exactly as designed and certificated. If there are issues in these areas – yet to be established, then perhaps the problems are in the design / certification process, or the continued airworthiness process for an ‘in-service’ aircraft. The key to understanding AF447 is in the differences with the previous events and what exactly we (the industry) knew or assumed before the event.

Occasionally the industry encounters situations beyond the limits of certification; these are where the industry depends, either consciously or not, on the human rescuing the situation. We celebrate many notable successes. Unfortunately we suffer failures because some situations are beyond human capability; this hurts our pride, beliefs, and our professional standards.

The skill of a designer/certification engineer is to foresee these extreme situations and interactions. The greatest difficulty is in the assumptions to be made about human performance.
Aircraft certification is probabilistic, which to date has served the industry very well. Modern complex technology is now stretching probabilistic assessment and testing to its limits, but it’s still workable.
For the human however, this method has never been successful - excepting the probability of ‘1’ – Murphy ’s Law. Humans are not rational, we suffer bias and the effects of environment; yet within these constraints most designs can produce a satisfactory interface between technology, the human, and the situation.
Our training in the use of this interface has to consider all aspects; not just practicing pushing the buttons, but exercising the thinking processes, which in part forms and understands the situation, and thus selects action options to maintain control of that situation.

Linktrained

21st Apr 2012, 14:28

Safe T.P.

Before we go back to the 1947 C54 trans-Atlantic flight, which was all fully automatic from one runway to another, but not from Terminal to Terminal...
You mentioned Murphy's Law. Now Simulators are available, perhaps early as well as again later on, during a type's life, a few untrained or semi trained Murphys should be used, just to see just how easy it may be to make any ( or many !) mistakes. ( These may be designed-out.)

The Hermes 4 had a Variation Setting Control for who ever was navigating to adjust, to allow for local Magnetic Variation. On a course by the first operator of the type, we were told that they had been instructed ( from above) " we want all our Captains to have the most accurate information... They will fly True Courses..."
The Variation Setting was calibrated in tens of degrees with a " X10 " engraved above, in white letters in a black background. I do not know just how many flights were performed satisfactorily, before one aircraft landed in the desert. ( I am sure that somebody said that " this had never happened before...")
(Some RAF bombers had had a Variation Setting Control necessarily used on their Air Position Indicators. I never saw one fitted to a civil aircraft.)
The French BEA conducted the investigation.
The Variation Setting ability, but not the knob, was removed and the " X10 " had been painted over by the time I flew the type for some years.

safetypee

22nd Apr 2012, 20:47

Linktrained; simulators – interesting.
Unfortunately Murphy (the errant human) does not come prepackaged and labeled. Human performance varies according to the machine and situation.
Simulators are representative ‘machines’ and may have Murphy inducing qualities not found in the original aircraft.
However, simulations can be very valuable in detecting system interface problems, but with increasing technological complexity it may not be possible to evaluate all combinations of situation and human behavior. Hence the ‘stopping rule’ in aviation is based on probability – which the human does not conform to.
Furthermore, the ability to detect aircraft problems in simulation depends on the evaluator’s choice of ‘foreseeable’ scenarios and range of human behaviors; much as the designer has too.
Simulators are of great value, but as with other technological advancements it depends on how they are used (choice of situations), knowing their capabilities and limits, and on the people involved; … like any other interface involving human activity.

In science we might expect the most important wording to be ‘eureka’ (I understand); actually it is “I didn’t expect that”. In aviation’s experiments - incidents and accidents – we hear ‘I didn’t think that s/he would do that’.

Current certification guidance on human behavior – error management – is in CS 25 (www.easa.eu.int/agency-measures/docs/certification-specifications/CS-25/CS-25%20Amendment%2011.pdf) AMC 25.1302.
Guidance for CRT displays is in AMC 25.11, Alerting Systems in AMC 25.1322, in the same document.

Linktrained

23rd Apr 2012, 01:07

Safetypee,
Hi,

Thank you for your detailed reply. It would have needed many Murphys to have spotted the " X 10 " on the Hermes Variation Setting Control, and it did happen at night... Those of us who knew, sympathised with the crew in question and were glad that this one combination of circumstances had been done by somebody else, FIRST.
And this had been modified before we flew the aircraft. It was some time more before we had the flagstaff bracket removed, liable to harm either pilots head, if hit.
It was a mistake ready to happen one day !
(Perhaps it was just as well that "above" had not continued, by insisting on TAS on all instrument panels.)

thermostat

23rd Apr 2012, 22:14

YES. We do know what happened. The airworthy A330 airplane was flown into a CB with supercooled water in it. The SC water froze over the 3 pitot tubes simultaneously, causing a loss of critical systems. The surprised crew (who were also dealing with numerous fault warnings and turbulence) inadvertently mishandled the controls causing a high altitude stall from which they did not recover. Simple. I don't see why so many will not or cannot understand that.

Linktrained

24th Apr 2012, 12:47

Thermostat
Hi
You could have added that the PF may have lacked experience of HAVING to Hand-fly at high altitude and high Mach. ( Not normally allowed under RVSM, where Autopilot is mandatory.)
Jacques Roysay covered aspects of Stall Warning in Cruise at High Mach Number and High Altitude in AB's Safety First in Jan 2011.

An afterthought : there must be some combination of times and areas or routes where this strict rule could be relaxed by agreement with ATC. Watching radar traces of some cruising (civil ?) aircraft occasionally zigzagging along an otherwise empty airspace area, where we might have requested a "Direct to..." two or more check points further on, towards our destination. Even then, in the 1960s+, every mile saved was worthwhile in fuel and flight time.

TTex600

24th Apr 2012, 13:48

Will we ever know what really happened??
YES. We do know what happened. The airworthy A330 airplane was flown into a CB with supercooled water in it. The SC water froze over the 3 pitot tubes simultaneously, causing a loss of critical systems. The surprised crew (who were also dealing with numerous fault warnings and turbulence) inadvertently mishandled the controls causing a high altitude stall from which they did not recover. Simple. I don't see why so many will not or cannot understand that.
*
"inadvertently mishandled" ? ? ?

Edit: more commentary.

FAR 25.207 says, in part:"Once initiated, stall warning must continue until the angle of attack is reduced to approximately that at which stall warning began."

According to the BEA AF447 interim rpts, the stall warning did NOT "continue until the angle of attack is reduced to approximately that at which stall warning began." The stall warning ceased when the artificial intelligence stepped in and determined that it wasn't correct because the programmers had assumed that any A/S below 60KIAS was not possible in the air. The pilots were dealing with an inconsistent machine, it was sending mixed signals which added to the confusion.
Just this one fact ( which happens to be in line with the thread topic) makes this far more than just an accident where the flight crew "mishandled the controls".

Regarding the man/machine interface issue, the machine must be consistent and the interface must be accurate and consistent. In the AF447 case, the machine was inconsistent, the interface was inaccurate, and the men were unable to determine reality from illusion and perception. Had the stall Warning continued as required by the FAR (I understand that the A330 wasn't FAR certified, just accepted) the crew might have eventually recognized and accepted its validity.

safetypee

24th Apr 2012, 15:04

thermostat. This is not an AF 447 thread. Most of what you state either contradicts the currently accepted facts – location, ice-crystals; or is unsubstantiated speculation.

In terms of man-machine interface there is reasonable understanding of the environment and of the machines reaction to it; what is unknown (unknowable) are the factors and thought processes contributing to the crew’s behavior. The latter point, as discussed previously, is the most difficult aspect of the interface to predict and control.

Linktrained’s point ‘… every mile saved was worthwhile in fuel and flight time …’, is very relevant. Humans are goal driven, and as much as technology improves, the human finds new, unexpected, ways of interpreting the interface (Murphy skills). Thus with modern WXR, crews choose to interpret radar colours literally – green is ‘go’ - 'let's cut the corner'. However, this depends on the situation (machine–situation interface), thus at high level and particularly near Cbs with icing potential, green may be best level of detection for ice and ice crystals, i.e. a weakness of technology.
Training – education and knowledge can restrict some of these weaknesses, but not always.

Linktrained

24th Apr 2012, 23:34

Safetypee
Hi

We were to do a series of flights between Kano and Jeddah. A course (c) of 072 or 252 degrees usually gave us a single heading flight for many hours (boring for the A/P, which did not complain), joining a sensible base leg at Jeddah or an excessively long Finals at Kano. A following year a different route was prepared which was 117nm. longer. Any NDBs were unreliable. We used the shorter route and Astro as before.
Any fuel saved enroute should be valued at destination price as it reduces the next uplift.
(Subsequent checking with the Air Mileage Handbook showed that the direct route was 3 NM. shorter than G.C.! It had been measured very accurately between the Standard Latitudes of a Lambert's Projection. Nobody had noticed!)

Natstrackalpha

28th Apr 2012, 12:21

Somebody mentioned this today and I think it is worth a thought. Before I start - I like Airbus, I do not dislike Boeing. Had I have trained on Boeings I would have said the converse. BOTH AIRCRAFT ARE FLY BY WIRE IN THIS POST.============================= ================================= HERE IS AN AIRBUS There is a theory that Airbus, brilliant in design, was designed by engineers with perhaps engineers in mind. It is a `system/machine` with monitoring facilities and certain self correcting abilities (protections). To fly it you move the sidestick to your desired aircraft attitude, like a climbing turn say, and at the point where you release the stick, then the attitude will stay there (yet the sidestick will return to the middle/central/neutral position)(provided it is within normal parameters, there are other limits - I won`t bore you with them now or it turns into a groundschool on Airbus) apart from the Flight Controls page on the System Display page, there is no other indication of the position of the flying control surfaces, outside on the airframe.=================== The throttles, are moved to a detent and, if the autothrust (if engaged) changes a power setting then it will do this but the thrust levers will remain in the detent. So we have (in any changing situation with the aeroplane) A sidestick that is centralised and not moving. A thrust lever that is in it`s detent and also stationary.=========================== =================================== HERE IS A BOEING The theory is that it was designed by pilots (as well as engineers) with pilots in mind. It takes `stick and rudder` principles and puts them into a fly-by-wire aircraft. It may have protections, I don`t know anything about Boeings. =========When the Control column / Yoke is moved then the yoke can be seen to move, if the yoke is left in an position it can be instantly seen to be in that position, if the pilot wants to centralise the controls, then s/he would simply centralise the control column/yoke. Not only this but whatever the pilot on the left is doing is replicated by the control column of the pilot on the right - so control column right = same thing both sides of the flightdeck. The throttles are on the central pedestal, they move to the desired thrust position. They move (I believe) in accordance with any power changes from the autothrust system. As power increases thrust levers move forward, etc, etc. So, at all times the pilots can see at a mere glance what the aircraft is doing - instantly, s/he does not have to look at the FMA, to interpret what is happening, in other words it is obvious what is happening, to the position of the flying control surfaces outside, on the airframe. When the proverbial hits the fan then - that is two major concepts taken care of in an instant - ATT and PWR.

safetypee

1st May 2012, 20:12

EASA have posted an automation survey to support planning of future policy, see: - EASA Cockpit Automation Survey (http://ec.europa.eu/yourvoice/ipm/forms/dispatch?form=easaCAS2012&lang=en)

The introduction pre-supposes advantages of automation; the questions on problems focus on the man-machine interface.

An earlier view of EASA policy is in EASA Safety Conference: Staying in Control - Loss-of-Control (LoC) Prevention & Recovery (http://easa.europa.eu/conferences/loc/)
Go To: Presentations (ZIP file), Tuesday 4th October, 2nd session, “EASA Automation Policy_Michel Masson.pdf”
Also the presentation “Crew Resource Management_Jean Pariés.pdf” has relevant information.

17 theme issues are identified (slides 7 & 8); they are all from the operator perspective (I want).
The mitigating activities (by the regulator) involve design specification, particularly CS25.1302, training, and operation, but the significant human issues are on slides 15 & 17. Cognitive flying skills.
Understanding the situation.
Task vs capability.
Anticipating situations.
Surprise, workload, distraction.
Use of FD vs instrument flying.
Judging time available.
Improvements in these are to come from ‘best practice’, but what is best practice, and who judges that?
The CRM presentation also identifies similar issues – Anticipation, understanding, and ability.

The overall view suggests that the solutions are to come from ‘indeterminate’ design guidelines (CS.25.1302) and human factors training to improve the human. There appears little to control the situation in which the human and machine operate, and which often contains dominant influences.

The referenced EASA Safety Bulletin on Flight Deck Automation Policy is available from http://www.ukfsc.co.uk/files/EASA%20Safety%20Info%20Bulletins/SIB%2033%20Flight%20Deck%20Automation%20Mode%20Nov%202010.pd f
And the automation Cockpit Guidelines (OGHFA) from SKYbrary - Automated Cockpit Guidelines (OGHFA BN) (http://www.skybrary.aero/index.php/Automated_Cockpit_Guidelines_%28OGHFA_BN%29)

And if little of this is of interest, at least view the picture on slide 22 of the CRM presentation !

Linktrained

2nd May 2012, 16:07

In 1915 Frederick Lindemann a 29 year old physicist whose earlier work had included glass and radiation, joined the staff at the Royal Aircraft Factory at Farnborough (where Col. Cody had demonstrated flying some years earlier).
A lot of would-be pilots for the Royal Flying Corps and the Royal Naval Air Service were killed whilst learning to fly, by first stalling and then getting into a "Tail-spin". Lindemann developed his own theories. (He may have visited some injured pilots to hear that " Once in a spin I pulled back as hard as I could on the Joystick - so that I would not hit the ground. But it didn't do any good...")
Lindemann learned to fly in 1916, just to try out his theories. Aged about thirty he would have been ten years older than most people learning to fly.
His ideas WORKED - and have been taught to would-be pilots ever since... Saving countless lives...
( Health and Safety would have been appalled at the risk he took.)
Later as "The Prof" he was to be Churchill's Scientific Advisor and become Lord Cherwell. Perhaps he was not always right.

Linktrained

2nd May 2012, 16:42

I had been to Croydon Aerodrome and seen the giant Hannibal HP42 and Argosy Airliners in about 1935. But my wood-workings skills would only allow me to make a Monoplane. A flat piece of wood for the wings, set at a slight angle to the fuselage and a tail plane ought to do the trick... But it crashed. A Grown-up told me that the top of the wing needed to be specially shaped, not flat, to give my aeroplane LIFT... That more lift came from above the wing than from below it. It seemed odd to me... But he WAS a Grow-up... And he had been a pilot in the R.F.C... I humoured him... One day I will find out, I expect !

Lyman

2nd May 2012, 17:23

I learned from an old Navy pilot. His brand of heresy never left me. An aircraft in flight is not lifted by the upper surface, it is pushed, from beneath. The upper surface is not relevant to flight, except to say that it provides a place for the underside to rest against.

"Nature abhors a Vacuum". Captain Jim said that was because there is no such thing as a vacuum And Nature does not recognize that which is not.

The nature of flight has to do with creating differences in ambient pressures, not in establishing a "vacuum". Although, strictly speaking, the pressure is not relevant either, just as any inclined plane will lift an object.

","

"Camber produces drag, and with greater drag on the upper surface, the lower surface is in dynamic "tripping over" the upper, and creates an angle of "Up"."

Linktrained

2nd May 2012, 22:09

Lyman #60

In 1935 a vacuum to me was something to keep a drink warm, or to clean a carpet. I must find my pieces of wood and try again !
But thank you.

roulishollandais

6th May 2012, 23:57

I finally read these 20 pages " The Problem of Automation: Inappropriate Feedback and Interaction, Not Over-Automation. Donald A. Norman UCSD (http://www.jnd.org/dn.mss/Norman-overautomation.pdf) :
I see that the mandatory (with controllability) observability of dynamic systems is the most important point in all the described exemples.
In Norman's paper it concerns the Human Machine Interface often forgiven, as we are looking separately human and machin. The concept of "effective aircraft" is concerned totally, involving the HMI with observability.

Lyman

7th May 2012, 00:53

roulishollandais

From Norman paper:

4. TWO THOUGHT EXPERIMENTS
Consider two thought experiments. In the first, imagine a captain of a plane who turns control over to the autopilot, as in the case studies of the loss of engine power and the fuel leak. In the second thought experiment, imagine that the captain turns control over to the first officer, who flies the plane 'by hand'. In both of these situations, as far as the captain is concerned, the control has been automated: by an autopilot in one situation and by the first officer in the other. But in the first situation, if problems occur, the autopilot will compensate and the crew will notice only by chance (as in the case study of the fuel leak). When automatic devices compensate for problems silently and efficiently, the crew is 'out of the loop', so that when failure of the compensatory equipment finally occurs, they are not in any position to respond immediately and appropriately.

Here is the major portion of the problem, aisi. Delegating command is (become) not an enhancement, but a degradation of efficiency. In a delicate system that needs constant monitoring, it is unsafe to lose currency in the dynamic system. More is lost into the automation than is gained by mere "reduced workload", and in an emergent recapture of man control, the system has become functionally unknown to the operator! This is not a major knock on the automatic, instead it points out a glaring deficiency in the fundamental design of the system. Instead of a fluent and fluid "intermodal", we at times have an "extra modal".

This extra (outlaw) mode can be described loosely, IMHO, as: "Loss Of Control"....

Best regards,

roulishollandais

7th May 2012, 17:22

@Lyman & others

Forget to put human left, and machine right : they are both together in the effective aircraft. We do not manage a pile of plates, plate human, plate machine, separatly. Otherwise you will always have an interface problem.

Observability and controllability are minimum required. :rolleyes: I learned that when learning first year automation in Paris. They concern the total dynamic system. :rolleyes:

Describing human as a system or a part of the system is not a negation of menkind... ! :E:}:p;):)

Natstrackalpha

9th May 2012, 11:43

Y`know, (sigh) this is wind up city, the thing with machines is that they are fabulous calculators and also precision instruments. They can right an aircraft inito S & L quickly and accurately, they can warn you of this and alert you to that, they can disengage (saying "not my prob, you deal with it") but they cannot "WANT". They do not "WANT". It is womans and mens wanting for survival and civilisation that has created . . .survival and civilisation basically.
Machines do not want to live, do not want to eat a great cheesburger, savour the delights of a perfectly chilled Sauternes with the local pud. they do not want to go out with Britney Spears, or George Clooney (each to therir own gender) They do not want to preserve life. they do not want to save the situation, they do not want to be at home or down at the pub later on that evening, they do not want to take out a real foxy chick. All of these wants is what made man fly in the first place, to create flying, then some shmuck created the flying licences, fair enough, then those wonderful people to administer the licences (which only stinks when they become an authority or ceases to be an administration or organinsation) also, machines are not political, which was nothing to do with this post. At which point - a fellow human could have said to me - "why are you writing such c--p, get the hell out of here" and take control of this . . .post.

Whereas, the computor, This actual computor, will keep on spurting out the garbage as I input the garbage (In). Until a moderator - a man or a woman comes along and deletes or edits it.

Point? Machines have no "sense" no commonsense, no higher sense, no sense of preportion, no sense of humour (thank God!) no sense of living or dying, nor any sense of direction.

Even at basic high school level we study biology and machines.

The difference between machines and humans are two-fold:- firstly, we have a respiratory system a digestion system and, and, a nervous system.(ok, threefold, so I cannot count, what do you think I am a machine??) All of which a machine has not.

So, to use an accurate tool like a calculator and control inputter (A/P)(A/T)(NAV)(INS) and a reader (EFIS) and a screamer and shouter (ECAS) is fine
but bear in mind, "IT" does not know what it is doing nor why it is doing it - in fact, essentially, they (the machines) do not exist, they are just there because we put them there. They have no sense. They cannot be hurt, just bits of plastic and metal bits with wire in them.

Natstrackalpha

9th May 2012, 12:16

I learned from an old Navy pilot. His brand of heresy never left me. An aircraft in flight is not lifted by the upper surface, it is pushed, from beneath. The upper surface is not relevant to flight, except to say that it provides a place for the underside to rest against.

It is obvious I am in . . hallowed or indeed sacred company here. e the company of pilots or engineers.

The above is my theory too - problem is that if the upper surface gets rough with hoar frost say, then the thing does not work and stuffs the aircraft into the hedge, during takeoff. Therefore, the airflow must be smooooth for some reason. . . and, say just if the lift is the "push" from below, and that the aerofoil surfs along then, for some reason, only appreciated by engineers, the lift drag thang must be more delicate than we can see. . .meaning, even the slightest . . interruption of the airflow over the upper surface is going to send it all down the Swanny. (or into the hedge)

Linktrained

9th May 2012, 19:21

Going back in time... In the 1952-3 era, a York's calculator was made by Dalton ( not yet a Jeppeson), the A/P when it worked, tended to cycle the elevator about 30 - 40 times per minute, the A/T would be manually adjusted. The Navigator was human and the ECAS was in Morse Code at 20-25 wpm by another human, using a key.No CVR invented yet.( Two Pilots, one Navigator, one Radio Officer and one Flying Spanner, plus a stewardess for 36 passengers.)

My fourth and last flight in a York to KIN was from the UK via Lages, ( two 8 1/2 hour flights to Gander(N/S), then Bermuda to Kingston ). Usually we had routed via Keflavik.

Skyways York G-AHFA was the third airliner to have ditched in the N.Atlantic, on 2nd. Feb. 1953, sending out a position report followed quickly by an interrupted "SOS GA- " ( Like AF447 people knew very soon, WHEN and, to some extent, WHERE, whatever happened had occurred...) The SOS was some 6 hours and five minutes after T/O.

After about 6 hours night flight from Lages, fuel which had been in the 540 gallon Centre tank at Take Off and then subsequently transferred to the two inner tanks, when their fuel had been consumed ( each of which fed both the two engines on their own wing) would start to be used.

The water tank filler (40 gallons ?) was close to the Centre tank filler. I cannot recall whether they were marked differently. Both had similar flaps hinged at the front then fastened down with a Dzuz fastener. ( It had been part of my job as a Second Officer to check that they were screwed down.)

IF, and just if, water HAD got into the centre tank, the four fuel pressure warning lights on the flight deck would have remained out... All four engines would splutter to a stop...

An oil slick was found after a day or two 120 nm. SW of LKP. ( A number of oil slicks were found when first looking for AF447, but not related.)

120 nm. from LKP...? The aircraft was not equipped with LORAN... The sky might have been too overcast for ASTRO. It sometimes is, below F/L 10.0.

At the Inquiry, the Solicitor General " Ruled out Contaminated Fuel..."

How could he have been so certain ? The aircraft was never found...

As IGh in #230 on 7th April wrote :

" Investigating Authorities can be led astray... "

roulishollandais

9th May 2012, 21:51

RR_NDB

12th May 2012, 00:26

Hi,

Why AI (Airbus SAS) introduced the SS? What reason(s)?

It was representative (the visible item) of the Airbus new control philosophy?

What are the main advantages? And it's disadvantages?

What about the overall cost to benefit compared to original (proven) solution?

This interface is adequate when dealing with possible anomalies?

Why active feedback was not built in?

A similar device would be eventually adopted by Airbus SAS competitor(s)?

RR_NDB

13th May 2012, 21:30

On the other hand, it may be that the determination was simply that it was unimportant for the Pilots to "see" the other's controls.
(http://www.pprune.org/tech-log/482356-af-447-thread-no-8-a-35.html#post7188044)
They could position the Sticks between pilots?

What was the benefit portion of the change in approach? Anyone?

Cost? Marketing "tool" (representing a new concept of a protected plane)?

A possibility of course, exists that single pilot operation,

Just SW modification? Please clarify.

Awaiting BEA's opinion on the matter....

Too late...

What advantages? Do you know? Cost to benefit? Was a good decision?

Who gained?

Lyman

13th May 2012, 21:45

Howdy.

I considered between, on the outer frame of the console R/L. That makes for a busy console, but also makes it easy to obtain the controls of the side that is working, if one is inop, also to cage one set, if that pilot is I/C. I think as a whole, in between is a keeper.

Throttle could be incorporated into the Stick Grip, as radial movement is unadvantaged in the current design, ala helo. I honestly cannot come up with sufficient positives to go with fuselage side placement, Honest.

Console Sticking is completely visible, can be acquired by either pilot, and the only downside is throttle location, if single pilot for any reason. "Is there a pilot on board, Miss?" In this case, Console Sticks are an improvement even on the Yoke.

I am a bit cynical, so bear with me in that I think the closer was Marketing. Very different in concept, to go with the FBW design. Change for Change' sake, here, yes, I think so.

RR_NDB

13th May 2012, 22:25

I am just trying to understand why AI decided for this "two separated no feedback sticks". A decision with important implications.

I am trying to understand the Rationale used. And who gained?

FBW and protected plane (important change) was not enough? As a marketing tool for the new competitor?

Lyman

13th May 2012, 23:01

RR_NDB

i am trying to be objective, and generous. The SideStick is evocative of "A breed apart", and with "One Type Rating" family style, it certainly fits the bill. I am sad to say it is this concept (a breed apart), that sealed the design with sticks as far apart as possible.... To retain the Yoke retains the "look", and looks are important, so yes, it was a marketing tool.

Keep in mind, for better or worse, we see here in evidence all manner of "Defense of design". There is little if any of the advantages, not so apparent, are they?

Of the Bus Pilots I have interviewed, they speak highly of the airplanes' FBW. On the Stick I see mostly a shrug. It is as different, within reasonable limits, as it could be, the Stick thing.... Maybe to remind the pilot what he is driving?

Personally? I love the simplicity of the guts of the Stick arrangement, its lightweight (total add to gross) and its feel. It's solid. Placement? Not so much....

You ask the rationale, and I have to guess only. Gain? Also guessing, initial cost, (low), ongoing maintenance, (also easier and also low cost), and feather weight......

also 'Mac' (bear)

CONF iture

14th May 2012, 02:12

I am just trying to understand why AI decided for this "two separated no feedback sticks". A decision with important implications.That was also the main reason behind my question here (http://www.pprune.org/7183262-post624.html)

What are the main advantages? And it's disadvantages?
A : simplicity – overall dimensions - weight
D : suppresses first class information to a PNF

A similar device would be eventually adopted by Airbus SAS competitor(s)?
The Bombardier CSeries is going for the sidesticks but I have no idea if they will be coupled or not ?

http://i45.servimg.com/u/f45/11/75/17/84/af447_17.jpg (http://www.servimg.com/image_preview.php?i=147&u=11751784)

RR_NDB

14th May 2012, 03:50

That was also the main reason behind my question here (http://www.pprune.org/tech-log/481350-man-machine-interface-anomalies-4.html#post7188374)

I missed your question in the quick scan i made when returned from a long trip. Indeed is an interesting point.

D : suppresses first class information to a PNF

Why not a coupling (FBW means) between sticks. This could also be retrofitted quite "easily". (Not interferes with other "features")

Cost seems not to be relevant. The sensors (position) on Stick or Yoke are similar. The mechanics of the Yoke, IMHO not too much more compared to Sticks. I really suspect the decision was marketing oriented. And in a serious survey (among pilots) would not be implemented, technically speaking. Something probably happened biasing to a "novelty". We will learn more on that.

safetypee

14th May 2012, 22:56

Mac, side-sticks; consider a ‘design’ view.
FBW – it’s state of the art; many technical, weight and cost reasons for using it; this has nothing (directly) to do with the choice of SS.

Certification regulations have evolved to require dual independent (separable) control systems. Mechanically these are relatively heavy, complex (mechanical components, reliability, and servicing), and space demanding = higher cost.

With conventional columns in normal operation, only one is used at a time.
In failure conditions – split systems, again only one column should be used at a time. This assumes that one system has jammed; but if not, then dual (opposing) inputs could be hazardous, and such situations requires crew knowledge and procedure to avoid a hazardous condition.
If dual inputs are made with conventional columns in normal operation, then the larger force might dominate (CRM arguments); some (the majority?) of control systems will auto-split, the force disparity being interpreted as a jammed system.

The choice of SS provides a simpler and lighter installation, which should reduce cost and increase reliability - not necessarily safer as this is a different argument. It also avoids the need for co-ordination during failure as an electronic voting and/or override facility can be provided. This should not be seen as something which is unique or of poor design, but an aspect which is a different implementation of existing requirements, and thus requires different understanding and training in aircraft operations – again some CRM views may have misunderstood this.

SS enables space for a ‘management’ table – modern aircraft operating concept.
Either SS or centre sticks (FBW) enable HOTAS, but note the modern industry’s reliance on autothrust systems.
A SS does not enable changing hands during manual flight; but note the recent dominance of autopilot operations - and why should you write and hand-fly at the same time.

Re control position/feedback. For column designs in normal operation, physical feedback is not required (advantages for hands-on during training, but note the increased use of simulators).
Columns enable some visual feedback of hand-wheel position (roll), less so for pitch, but this may be judged as a minor contribution to awareness which should focus on the outcome – what is the aircraft doing.
In abnormal situations, controls split or not, perhaps the rarity of events and inability to define the human contribution in such operations results in a design biased towards the older regulations.
Again, irrespective of the control input, it’s the output which is important: – consider a situation with a jammed feedback-enabled SS, its essentially the same as a non-feedback SS as there is no meaningful information. This point may be arguable w.r.t. recent (post Airbus SS) requirements for the avoidance of error (CS 25.1302), but in the absence of guidance as to what errors will be encountered (foresight), the non-feedback design appears satisfactory from a design view (which would include pilots’ views).

Thus a designer might well choose SS; the advantages outweighing the disadvantages. The initial certification costs might be high – proof of concept, but thereafter identical systems can be used in all future types. SS flight operations require changes in training, but these would consistent with a new type, and marketing will have a new ‘unique’ feature for all future types.
Like most aspects of aviation these choices involve human judgement, which is often subject to bias (including culture), and even where an apparent irrational choice has been taken, it was taken because it was right ‘at that time’.

Something vaguely associated with this – between theory W and theory Z ‘Fostering successes rather than reducing failures. (www.scribd.com/doc/47279623/-Fostering-successes-rather-than-reducing-failures-Hollnagel-presentation)

CONF iture

15th May 2012, 03:14

Airbus had a new concept in mind and thought they would proceed, which they did, whatever the concerns raised by the pilots :
I had the opportunity to meet Pierre Baud, when I was invited to Toulouse in the early ninety's, to fly one of their A330 testbed aircraft. That was my first experience with a FBW aircraft (before that, only Boeing and A310's) and I personally had the chance to verbalize my worries in this regard (no feed-back on SS, added inputs on SS, lack of need for trimming, ATS in step of Auto-Throttles)
For certain aspects they steped back as for the thrust management system which was initially designed to be operated through pushbuttons only, no thrust lever at all. This was mentioned a few years back by Chris Scott who was one in the early operation of the 320.

But for the independant sidesticks concept, they were not negociable : The pilots would adapt and they would love it, which is not especially untrue.
As PJ2 put it : "We get used to it"

Still, I don't understand how they thought the visual information provided to the PNF by a yoke was of no value anymore and therefore not necessary ?
Every rotation phase, flare phase, as a PNF, I am very consious for being deprived of such nice information, just feeling a bit out of the loop. I have well a few anecdotes to make my point, even if to this day they are only anecdotes ... but I am fully aware that further on the road I could be well more seriously reminded how such information was of interest ...

Has one of the reasons behind such thinking by Airbus just been mentioned by Lyman :
A possibility of course, exists that single pilot operation, contingent on the building of an extensive record of safety thus equipped, might be "just around the corner"?
I think it is a possibility.
As I said earlier, a sidestick for a single crew operation makes a lot of sense, but makes a lot less, IMO, for a multicrew operation.

PEI_3721

15th May 2012, 13:03

The book linked here has some relevance to the thread: http://www.pprune.org/safety-crm-qa-emergency-response-planning/485173-engineering-safer-world.html#post7185320
I’m only on Chapter 2 so far, but the introduction is invigorating and inspires thoughts of improved safety.

RR_NDB

16th May 2012, 21:55

I am studying and thinking on the excellent material presented by safetypee, PEI_3721 and others, before posting.

Exciting issue. Will comment ASAP.

roulishollandais

18th May 2012, 19:21

Quote:
"Originally Posted by bubbers44
"Pilots need to be in control of their aircraft at all times"

It would be necessary that the pilots have control before to start the system, and may reverse initial conditions :

In the (relative) "old" time the pilot opened brackets for the PA/system. The pilot was "MASTER" in the effective aircraft http://images.ibsrv.net/ibsrv/res/src:www.pprune.org/get/images/smilies/tongue.gif, and the PA/system was "SLAVE" :oh:.

In the bad designed today's effective aricraft, the system puts pilots between brackets before he is sitting in the cockpit . The system is "MASTER" in the effective aircraft http://images.ibsrv.net/ibsrv/res/src:www.pprune.org/get/images/smilies/tongue.gif, and the pilot is "SLAVE" :oh:. ECAM throws him biscuits to keep him busy http://images.ibsrv.net/ibsrv/res/src:www.pprune.org/get/images/smilies/sowee.gif.

In the 8 billions Ariane 501 crash (Arianespace 4.june1996) the initial condition had been added, to compute the ground position of the rocket. At take-off the bug needed only 37 seconds to show it was the master of the rocket.
The perfect inquiry conducted by Jacques-Louis LIONS finished in less than 24 hours, written in 15 days, published in 6 weeks, showed that in computer systems we must not trust the system if we see no failures, but we must take it for faulty so long we have not been able to Proof it is safe, with all the best knowlege at this time

When a Flight control system has hard limits,which is the case for Airbus and not for Boeing, that means that the SYSTEM is MASTER and the PILOT(S) are SLAVE :}. As soon as you have ONE MASTER SYSTEM the number of pilots is only regulation and look dependant !:E

As the first woman pilot :\ came in Air France (Danièle Decuré 1974), Ziegler's machism prefered the pilots are slave :E. And to avoid they wear pants, he choose the side stick ...:}.. Danièle Decuré was wearing a skirt...

Lyman

19th May 2012, 01:20

Out here in the west we call that "side-saddle". Only in this case, the cowboy is heading sideways.

roulishollandais

21st May 2012, 00:58

Out here in the west we call that "side-saddle". Only in this case, the cowboy is heading sideways

1974 Air France woman uniform : skirt, no hat, no tie
(Danièle Decuré, first woman pilot)

http://i1166.photobucket.com/albums/q601/femmes_pilotes/decureenjupeAF.jpg (http://i1166.photobucket.com/albums/q601/femmes_pilotes/decureenjupeAF.jpg)

roulishollandais

12th Jun 2012, 17:17

Has anybody some information about
1. A330 feedback equations including speed parameter V ? and information about A330 cross-over velocity Vco?
C* =? Knz.nz + Kq.q and is it standard C* ?
2. relative position of the accelerometer ? in normal flight and stalling deeply,
3. where does the "speed" input in the feedback come from in the UAS case?

Thank you :)

RR_NDB

13th Jun 2012, 02:32

Hi roulishollandais,

Please provide more details on your questions.

Still very busy, unfortunately with no spare time. :{

Linktrained

14th Jun 2012, 16:52

The Drill for me as F/O, after having assisted my Captain with the Ditching, required me to go through the passenger cabin to the rear passenger door...

("Please stay in your places and let me through..." to each of the 100+ SLF)

I was to take a large Dinghy, put it through the door, inflate it and float it to the port wing, so that passengers from the port escapes could embark. I then was required to take the second Dinghy, inflate that and board it, paddle it myself around the tailplane to the starboard wing, so that the rest of the passengers could embark.

This would be easier to do, I think,
(a) by daylight,
(b) with a flat calm sea
(c) without ANY wind

We never practiced this on training... too expensive on aircraft, but we had a good write up from another airline using the same type of aircraft who said that "they were good at it because they practiced"!

(How shameful to be seen paddling away in the second dinghy just as a gust of wind sprung up taking the dinghy and me out of sight... Today, this would all have been recorded on passengers' mobile telephones !)

RR_NDB

3rd Jul 2012, 14:45

Hi,

BEA final report in two days.

But a source familiar with the situation indicates that the airframer is concerned whether the conclusions will focus too narrowly on the human-machine interface. (http://www.flightglobal.com/news/articles/final-af447-report-set-to-re-ignite-safety-feud-373527/?cp=NLC-FGFIN20120703&attr=editorial)

RR_NDB

22nd Jul 2012, 06:26

Hi,

What can be done (http://www.pprune.org/rumours-news/489790-af-447-report-out-23.html#post7308402) (should be ASAP) to avoid another case?

Linktrained

8th Oct 2012, 22:22

Our Acting Chief Pilot understood the F/O's post Ditching Drill would be impractical for the reasons that were put (above).
(Some years earlier he had successfully ditched an aircraft himself. Practical experience was valuable.)
The role of "dinghy thrower outer" was given to the No.1 Steward.
If I survived, I was to put my hat on. (It sounds daft but it would give me identifiable Authority in the confusion)
Then I was to help...

roulishollandais

9th Oct 2012, 17:15

Thank you Linktrained, to dedramatize our discussions ! :ok:

Us, French and Americans shall ask our both new Physik Nobel Price in mesurement and quantification of mécanique quantique if they have a solution (or many !)

Mac the Knife

9th Oct 2012, 18:10

Mode confusion is intrinsic in highly automated systems. It is incumbent on the system to clearly communicate why the mode has changed and the implications.

Dropping the AP and a console alarm announcing "Unreliable airspeed" won't do, particularly with pilots who do very little hand/raw data flying.

"Hi guys! Sorry to disturb you but my pitot tubes are not giving me a reliable airspeed. I have disconnected the autopilot and we are now in alternate law"

"I suggest that you turn off the FD and just fly pitch and power while see if I can get our airspeed indications back."

Result (probably), no panic stickback, no stall and no accident.

Mac (the other Mac, not a pilot but has programmed an automated system)

[Never mind the non-coupled sidesticks, the autotrim and all the rest of it]

KBPsen

9th Oct 2012, 18:33

Linktrained

11th Oct 2012, 00:36

roulishollandais #88

Nobel prize... In the last couple of hours Reuters has reported a Study showing a correlation between a nation's per capita chocolate consumption and Nobel prize winners. This is reported in " The New England Journal of Medicine". It MUST be true !

Some may have missed the obituary of Mrs. Evelyn Johnson who died aged 102. She had logged 57,635 hours, mainly as a flying instructor, continuing to teach until she was 96, latterly with a prosthesis, following a car accident. This she said "made it difficult to get into small planes !"

RR_NDB

12th Oct 2012, 18:19

"Hi guys! Sorry to disturb you but my pitot tubes are not giving me a reliable airspeed. I have disconnected the autopilot and we are now in alternate law"

"I suggest that you turn off the FD and just fly pitch and power while see if I can get our airspeed indications back."
(http://www.pprune.org/tech-log/481350-man-machine-interface-anomalies-5.html#post7457881)

Completely feasible long time ago to:

1) Inform assertively on the limitations being faced

2) Orient crew clearly on proper procedure

Simple, like Leonardo Da Vinci stated:

"Simplicity is the ultimate sophistication"

There are other possible ways to design...K.I.C.S. :mad:

A pilot in the high rocks of the R&D Dept. would generate better design. :{

RR_NDB

12th Oct 2012, 18:55

...that nothing have been missed, which is something I suppose. (http://www.pprune.org/tech-log/481350-man-machine-interface-anomalies-5.html#post7457932)

Clearly there are unsolved questions. When working in so exciting issues we need to be open minded like we need when driving a machine that can always present surprises. An a/c is female, so surprises present challenges to us. :)

Probably the focus should be the "interface" which IMhO created "HF issues".

:{

infrequentflyer789

13th Oct 2012, 00:06

A pilot in the high rocks of the R&D Dept. would generate better design. :{

Pilots were extensively involved in the design. Gordon Corps in particular - and at a very high level. There is ample evidence of this in articles, interviews and videos from the time, many available on the net if you choose to look.

He (& other pilots) were involved in design and flight testing of the control system using modified A300 test bed prior to A320 build. In fact, aspects of the control system were changed significantly following the A300 flight tests - that was on pilot feedback. I presume I don't need to detail the major change that is rather relevant to this thread, since you "know" the history of design and who was involved ?

As to the end result - you may not like the decisions those pilots made, but that is as far as it goes. You are entitled to that opinion, but that does not mean that those pilots were not there, or that they were not "real" pilots because they disagreed with you (maybe that is what you are trying to infer ?).

RR_NDB

13th Oct 2012, 06:48

Pilots were extensively involved in the design...and at a very high level. (http://www.pprune.org/tech-log/481350-man-machine-interface-anomalies-5.html#post7464310)

Obviously, this was necessary for many reasons. Their influence in the design seems as secondary. The IT, automation, etc. seems prevailed. The new concept certainly gone beyond some existing "thresholds". The new concepts appear simply not enough developed to possible scenarios when things go south. AF447 perhaps the best example of this.

The "threshold effect" (AM x FM, S/N ratio analogy) when plane degrades could create dangerous situations even for a designer flying the A/C. Airbus SAS philosophy seems adequate up to a certain threshold of problems.

Above a given threshold i heard important observations from experienced pilots that flew equivalent A/C.

The LOC after a System limitation imho should be addressed very seriously. HF seems to me a result from serious issues in the "interface" design.

I am motivated to address deeper some facts in this thread.

Could you tell me why not:

1) Inform assertively on the limitations being faced by the System

2) Orient crew clearly on proper procedure wrt to easily detectable UAS

Lyman

13th Oct 2012, 11:42

I am reasonably convinced that the lack of Pilot/Pilot interface engineered into the Airbus cockpit was not arrogance , nor ignorance.

The dynamic, ignored in the lack of interconnectivity with hand controls, shows a confidence in the human factor that has created problems in flight. The knock on the platform early on, "What's it doing now....?" has in some instances been replaced by "What are you doing now...?"

The design clearly shows a lack of attention to this dynamic factor, cockpit management. It certainly reflects on a lack of concern for the importance of either handling position relative to controller orientation, aircraft attitude.

And in fact, the sidestick is not always reflective of a direct positional relationship stick/aircraft. The geometry has at least two modes: first, the angle of the stick whilst held, and second, the short loiter at a random point in its arc driven by a human input that is not quantifiable due to its short duration. In the second instance, the target angle is a "best guess" and subject to additional refinements in subsequent "hunting" by the handling pilot. This has unfortunately been termed "stirring mayonnaise". Since this motion is guesswork by the handler, it is likewise guesswork for the non handling pilot, should he be interested in its travels.

Both sticks are active, ordinarily, and if unarticulated, rest in neutral. If a handling pilot is putting in an angle that is detrimental to the flight path, his opposite cannot know by seeing his own non moving stick. He can see the instruments, but in turbulence, or in rare occasions when instruments are unavailable or inaccurate, he relies on the flying pilot to manipulate his stick correctly.

In the even rarer circumstance when a pilot is mishandling, there is a problem.
The monitoring pilot must stop what his tasks are, and enter a zone of diminished interface, "what is he doing?" "you go up, so go down...."

"Are you pulling?" "if you are pulling, stop pulling..." "stop, STOP". These are comments based on conjecture, for the monitoring pilot has no awareness of the flying pilot's stickwork. Then, "My Airplane"... If the taking of control is based on an error in assessing, guessing, the other pilot's stick movements, the stage is set for confrontation, or a dangerous interruption of control in what may have been a mechanical problem, or weather, not mishandling....

So our non flying pilot can be put in the position of confusion; does he doubt the instruments (there were problems with one or two, perhaps airspeed, or flight director mode). Or does he put his faith in the panel, and his senses of attitude, and take control?

In this gray area when the second pilot senses something wrong, he may err on the side of continued mishandling, or take over from a pilot who is doing a proper job. In certain rare circumstances, and in emergencies, either course of action would be wrong, and possibly fatal.

It has been noted by a respected authority that the lack of visibility one stick to either pilot is notable; I have added some possible reasons why it might be dangerous? This same potential would also apply to a lack of interconnectivity.

RR_NDB

13th Oct 2012, 17:45

The cockpit of the future...

Start, Next, Next, Next, Finish. (http://www.pprune.org/tech-log/481350-man-machine-interface-anomalies-5.html#post7464663)

Your simple and direct comment motivated me to remember how rich is the "management" of a complex task when the variables are natural. For example, WX issues, varying atmospheric conditions, energy management issues, speed calibration, surface contact management, etc.

This is fascinating in planes, high speed cars, bikes, etc.

When you are dealing with "threats" and "traps" created by designers together the dynamic nature of vehicles you are in a very different challenge. Absolutely "non natural".

The need for the pilots to remember (after training) the logic implemented by non pilot designers simultaneously with natural adverse conditions, creates a formidable challenge.

And the operator of the machine you commented above is clearly a "poor" equipped guy. Very limited. This trend is indeed concerning.

IMHO there is a need for a balance in the automation specially in the interface to allow the supreme commander to exercise his very best expertise when required.

In the limit would be better to eliminate the crew...

Perhaps the crew is being attacked since the advent of Intel 4004 by "non pilot" designers.

The interface specially during anomalies MUST be very natural, intuitive.

RR_NDB

13th Oct 2012, 18:34

In this gray area when the second pilot senses something wrong, he may err on the side of continued mishandling, or take over from a pilot who is doing a proper job. In certain rare circumstances, and in emergencies, either course of action would be wrong, and possibly fatal. (http://www.pprune.org/tech-log/481350-man-machine-interface-anomalies-5.html#post7465281)This poses another set of variables to the always required good CRM. During transients and anomalies (System limitations, etc.) the threat is serious and the stakes could be high.

F-GZCP was doomed in the transient after a System anomaly. Just HF could be adequate to avoid another case? That can be more complex and brief.

Lyman

13th Oct 2012, 18:47

Hi RR_NDB

Yes. I don't think the problem of confusion can be overstated, here. There were two pilots on board this aircraft who, for 30 seconds, at least, had an extremely compromised situational awareness.

From the data, the pilots were not immediately aware of the status of autoflight, save for grasping one of the SideSticks....nor were they aware of the Controls Law that had occurred via degradation of actual data. This we know, for no mention of degraded Law until seventeen seconds after the loss of autopilot and NORMAL LAW.

The utter lack of any pre-prepared drill applied by these two crew is evidence of a complete breakdown in anticipatory planning.....

Pilot problem? Hmmm.......One immediately thinks of a programmed and annunciated sequential deletion of services, and its absence on the flight deck....

IOW..... "GoodBye". Instead, ALARMS.... INTUITIVE? NOT........

infrequentflyer789

14th Oct 2012, 22:48

Lyman

14th Oct 2012, 23:21

"Not only is it clear that they did pay attention to exactly what you say they didn't, but they also rejected the first sidestick design after flight test (not sim, flight) and sent it back to the engineers not for a bit of tweaking but for radical design changes."

IF789.... If you read my opening, I specifically say they did addresss the pilot to pilot interface, and rejected it, as an engineering decision...

"I am reasonably convinced that the lack of Pilot/Pilot interface engineered into the Airbus cockpit was not arrogance , nor ignorance."

I also believe they rejected interconnectivity due to overconfidence in the flight test crew's ability to intuit commands from the other seat. Perhaps due to the implementation of test pilots with highly developed intuitive skillset in assessment of the p/p interface....should they have used more mediocre and perhaps more independent pilots?

You say....

"... Interconnection. Yes. Really. They had interconnection and they scrapped it after test flying it. Apparently it was great in theory but didn't work when you actually tried flying it (even with test pilots). Interesting, no ?"

Can you explain? Connected controls aren't theoretical but merely a form of direct interface, sans intuition. They aren't 'flown', they are a direct cue, a blend of visual and potentially tactile cues, eg "follow me through".....

RetiredF4

15th Oct 2012, 21:22

FAST03 Airbus, mini sidestick (http://www.google.de/url?sa=t&rct=j&q=fast03+pdf+airbus&source=web&cd=1&cad=rja&ved=0CCAQFjAA&url=http%3A%2F%2Fwww.airbus.com%2Fsupport%2Fpublications%2F% 3FeID%3Ddam_frontend_push%26docID%3D18289&ei=xHZ8UNeBJYb0sgac54CACg&usg=AFQjCNFZjC5NrBKjuphh1NmCxxwfw2Zwvw)

FAST05 Airbus, Flight Control System (http://www.google.de/url?sa=t&rct=j&q=fast05+pdf+airbus&source=web&cd=1&cad=rja&ved=0CCMQFjAA&url=http%3A%2F%2Fwww.airbus.com%2Fsupport%2Fpublications%2F% 3FeID%3Ddam_frontend_push%26docID%3D18293&ei=fXp8UMr6Ko3gtQbF3YAY&usg=AFQjCNF-wtEbylFtm08LYcBe6wMoSPcZnw)

FAST09 Airbus Fly by Wire performance analysis (http://www.google.de/url?sa=t&rct=j&q=fast09+pdf+airbus&source=web&cd=1&cad=rja&ved=0CCAQFjAA&url=http%3A%2F%2Fwww.airbus.com%2Fsupport%2Fpublications%2F% 3FeID%3Ddam_frontend_push%26docID%3D18301&ei=NIV8UO63IcXvsgaS64GACQ&usg=AFQjCNFR1kezn0STFFnGsbCzDiDYouxUGw)

FAST14 Airbus Advanced technology and the pilot (http://www.google.de/url?sa=t&rct=j&q=FAST14+airbus&source=web&cd=1&cad=rja&ved=0CCMQFjAA&url=http%3A%2F%2Fwww.airbus.com%2Fsupport%2Fpublications%2F% 3FeID%3Ddam_frontend_push%26docID%3D18311&ei=Xol8UN62JoXIswbw54CYCw&usg=AFQjCNFdNbrzS2D2wYiLKhfB_1IvTH4g3Q)

infrequentflyer789
they also rejected the first sidestick design after flight test (not sim, flight) and sent it back to the engineers not for a bit of tweaking but for radical design changes.

Would you show your reference for that?

According to the documentation of Airbus the system was evaluated in flight by one SS on the left and one yoke on the right. The double SS and the linkage of those was tested only in the SIM and the linkage between SS was then discarded for reasons not like you describe them.

But please read yourself.

RetiredF4

15th Oct 2012, 21:45

Human Factors Engineering and Flight Deck Design (http://www.davi.ws/avionics/TheAvionicsHandbook_Cap_9.pdf)

roulishollandais

16th Oct 2012, 16:02

Watching these threads is like watching TV at 3 o'clock in the morning. You know it is going to be nothing but re-runs of stuff you've seen many times before. It does give you the benefit of being able to switch off for weeks at a time knowing that nothing have been missed, which is something I suppose.

"Vingt fois sur le métier remettez votre ouvrage" :) (from a French poem from Nicolas Boileau (1636-1711) : Twenty times on the loom you will hand your work)

@RetiredF4
Thank you for these links

Lyman

16th Oct 2012, 16:43

Dans le visage du prejudice, repeter la verite......

roulishollandais

18th Oct 2012, 17:09

Dans le visage du prejudice, repeter la verite......
thank you for that Court version ! it will be useful...
or
Hasten slowly, and without losing heart, put your work twenty times upon the anvil

CONF iture

22nd Oct 2012, 00:58

RF4,
according to FAST05 (http://www.pprune.org/7469030-post104.html), in 1983 Airbus had opted not to have a mechanical linkage between the sticks but an electronic mixage between signals emitted by the two sticks following a specific logic. But in 1988 that specific logic had already considerably changed. Are you aware of a FAST publication detailing the reasons for forgetting the logic of 1983 or the reasons for adopting the new logic as we know it today ?
Thanks

RetiredF4

22nd Oct 2012, 14:16

Are you aware of a FAST publication detailing the reasons for forgetting the logic of 1983 or the reasons for adopting the new logic as we know it today ?

NO, i don´t.

mm43

22nd Oct 2012, 21:13

Fast 05 - bolding mine.
With standard flight control the aircraft may move significantly without flight control input and also a significant input of the flight control may have no apparent effect on the aircraft (i.e. when countering the flaps or engine change).
With the A320 Fly-by-Wire there is a consistant relationship between the aircraft movement and stick input at least in the normal flight envelope below minimized turbulence effect : no input, no motion change. Therefore, the natural detection of roll or load change gives an unmistakable warning that the other pilot (or the AP) is activating the flight control and the stick linkage is not necessary.Then there are the HF effects that can skewer any perfected flight control system, that in the 447 case comprised a high level of abnormal noise, which was apparently ignored - with the exception of the SW after the aircraft had left the normal flight envelope.

The expectation of : control input equates to motion change, appears to have been missed in the case of longitudinal inputs. Likewise, assimilation of the "glass interface" data expected in a normal scan, didn't provide an answer. Similarly, the differences between pre-stall and post-stall lateral control, and the motion effects associated, didn't rattle any brain cells. The PF's sensed "over-speed" situation would, if it was true, have provided a good number of barrel rolls, based on his lateral inputs.

Simulated feedback derived from standard inertial sources wouldn't have provided any additional tactile information once the airspeed had gone down the drain. Would have "stick shaker / ND inputs" induced into the SS provided further tactile feedback? In the 447 situation, I believe it wouldn't have changed anything, as the Microsoft "blue screen" effect accompanied by a "memory dump" seems to have claimed the day.

If AF447 is consigned as a "Black Swan" event, the major consideration with regard to safety needs to be focused on the Human Factors that contributed to the outcome. To do that, you start at the beginning with pilot selection, etc....

RetiredF4

22nd Oct 2012, 21:36

Imho there is the behaviour in degraded law missing...........

roulishollandais

23rd Oct 2012, 16:46

at least in the normal flight envelope

Imho there is the behaviour in degraded law missing...........

@ RF4, mm43
agreed, but FAST05 is an old document (1985) and before 1988

If AF447 is consigned as a "Black Swan" event, the major consideration with regard to safety needs to be focused on the Human Factors that contributed to the outcome. To do that, you start at the beginning with pilot selection, etc....

"Human Factor" ?! During 1980 I discovered a big trafic of French ATPL licenses. ARONDEL at that time was "Président du Jury du Personnel Navigant Professionnel" who accepted with much difficulty my complaint. He tried to discourage me, by telling that it was going to create trouble for me. But I did not change my decision. For me what I had discovered was unthinkable, and very dangerous.The Gendarmerie des Transports Aériens (Brigade de recherches ORLY, Adj. R.) started investigation after I give them seven names, and facts... After two and a half month beginning 1981, they thanked and congratulated me :O ... but adding they were not able to distinguish rumours and facts and they would have to stop the investigation :* ! Two years ago Gérard Feldzer confirmed the fact on a question I asked on a public radio :p. I listened during all these years trafic connected to other trafic was not finished. So is selection of ATPL in France.:ugh:

RetiredF4

23rd Oct 2012, 19:49

Another read on the airbus FBW concept

FAST 20 Airbus (http://www.airbus.com/support/publications/?eID=dam_frontend_push&docID=18323)

By the way, i now found the link to all FAST magazines on the airbus page

Publications | Airbus, a leading aircraft manufacturer (http://www.airbus.com/support/publications/)

jcjeant

24th Oct 2012, 00:58

"Human Factor" ?! During 1980 I discovered a big trafic of French ATPL licenses.Do you don't seen the same in 1988 ? :)

roulishollandais

24th Oct 2012, 17:22

Do you don't seen the same in 1988
It increased with blackmails. When Y.Moureaux replaced Arondel he could not change that and everything got worse and worse. The worms were in nearly all the cockpits...AF447 was in the long drift :ugh:
rh

roulishollandais

24th Oct 2012, 17:29

Thank you RetiredF4
Rh

AvMed.IN

28th Oct 2012, 08:41

Automation surprises (http://www.avmed.in/2012/10/old-facts-new-insights-lessons-from-a-320/) result from an imbalance between ‘autonomy’ and ‘authority’ of advanced systems and lurking gaps in operators' mental model of the system affecting the "human-automation interactions", rather the "man-machine interactions".

RR_NDB

2nd Nov 2012, 13:22

AvMed.IN sez (http://www.pprune.org/tech-log/481350-man-machine-interface-anomalies-6.html#post7490384)

Automation surprises result from an imbalance between ‘autonomy’ and ‘authority’ of advanced systems and lurking gaps in operators' mental model of the system affecting the "human-automation interactions", rather the "man-machine interactions". (http://www.avmed.in/2012/10/old-facts-new-insights-lessons-from-a-320/)

:ok:

The vital factor at play in such cases could be low observability interfaces in novel (“nonroutine elements”) situations with operator caught in a bind while trying to track and anticipate the actions by the system in his hands! Simply put, when he (rather, they, being multi crew environment) is loosing the grip of the unfolding situation and finds himself inadequately prepared for the fast unwinding situation, which was chillingly evident in Air France Flight AF 447 as brought out in the final report [1]:-
(http://www.avmed.in/2012/10/old-facts-new-insights-lessons-from-a-320/)
:ok:

“The accident resulted from the following succession of events: (I changed the sequence)

Temporary inconsistency between the measured airspeeds, likely following the obstruction of the Pitot probes by ice crystals that led in particular to autopilot disconnection and a reconfiguration to alternate law,

The crew not making the connection between the loss of indicated airspeeds and the appropriate procedure,

Inappropriate control inputs that destabilized the flight path,

The PNF’s late identification of the deviation in the flight path and insufficient correction by the PF,

The crew not identifying the approach to stall, the lack of an immediate reaction on its part and exit from the flight envelope,

The crew’s failure to diagnose the stall situation and, consequently, the lack of any actions that would have made recovery possible.”

Simply put:

The Interface should provide immediate and precise outputs to the crew even during anomalies

A brief cold in AS probes could and should be reported in the very beginning of the cascaded events. Surprises should be always reduced to a minimum and in AF447 case the uncertainties certainly played an import role to the outcome.

So, Human Factors emphasis or the need for better interface?

Clearly both are important and are closely related.

DozyWannabe

2nd Nov 2012, 20:46

Obviously, [the pilot engineering team] was necessary for many reasons. Their influence in the design seems as secondary. The IT, automation, etc. seems prevailed.

Incorrect. The system was tripartite (engineering, management, pilot engineers), and the pilot engineer team led by Corps had veto power on the design specifics.

RR_NDB

2nd Nov 2012, 22:26

DozyWannabe sez: (http://www.pprune.org/tech-log/481350-man-machine-interface-anomalies-6.html#post7499718)

...and the pilot engineer team led by Corps had veto power on the design specifics.

The "environment" at this time certainly was:

Management (overall philosophy, etc.)

Engineering (how to implement the overall philosophy, etc.)

And, Pilot engineers (As an important check of the above with veto power, etc.)

In this environment dealing with new frontiers it is very probable that:

Their (pilot engineers) influence in the design was reactive. The IT, automation, etc. as the "driving force", the top down "bias" that seems ultimately prevailed.

This obviously influential to marketing, sales, training, etc.

Veto power on specifics does not mean "enough power" to define the new philosophy. Not "coarse adjustments", just trim.

BTW:

I am motivated to address deeper some facts in this thread.

Could you tell me why not:

1) Inform assertively on the limitations being faced by the System

2) Orient crew clearly on proper procedure wrt to easily detectable UAS

I don´t like the "design approach" to delegate to the crew (creating "startling factors") both above issues.

This easily could generate a fatal "threshold effect" similar to the one observed in AF447 case.

And this not seems to me a "black swan" one as commented by mm43. (http://www.pprune.org/tech-log/481350-man-machine-interface-anomalies-6.html#post7481222)

Graceful degradation is very important for survivability. Anomalies can be multiples. An the Interface is the "channel" in increasingly complex Systems.

DozyWannabe

3rd Nov 2012, 00:12

From what I was told, you've got it 180 degrees the wrong way. The original detailed specifications were drawn up by the pilot and aeronautical engineers. The systems engineers simply implemented those specifications.

Unfortunately I don't have any more detail than that, because sadly my source is no longer with us - but don't let the fact that you don't like aspects of the result on a personal or even professional level inform assumptions about how it was done.

Machinbird

3rd Nov 2012, 01:16

From what I was told, you've got it 180 degrees the wrong way. The original detailed specifications were drawn up by the pilot and aeronautical engineers. The systems engineers simply implemented those specifications.

The fact that the Airbus FBW flight control system is so different from previous conventional flight control systems that have gone before is a strong indicator that the engineers had the lead and the developmental pilots were left with the job of making it something that line pilots could live with.

Pilots are generally a conservative bunch. It promotes longevity.:}

DozyWannabe

4th Nov 2012, 03:31

In my admittedly limited experience (after all, I don't spend all day every day around pilots), the only generalisation that can be made about them as a breed is that they tend to be of above average intelligence and as individuals are what you would call "driven". Other than that it's a crapshoot - I've encountered (and heard second-hand information of and from) pilots who are technophobes, technophiles, liberal, conservative, religious, agnostic - the list goes on and on.

The Airbus FBW system and flight deck layout is not that much of a jump - and actually a fairly logical iterative step, based on historical precedent. The sidestick (or "minimanche" en francais) was initially tested on a Concorde testbed by the French aerospace agency - the idea was to bring the advances used in the space programme and military aviation to the civil arena - it certainly wasn't particularly controversial initially amongst the pilots who were involved. Once the decision is made to go all-hydraulic, a lot of the necessity for interlinked controls with significant physical leverage goes away. As soon as you have proven technology that can keep the aircraft inside its flight envelope, it makes sense to use it. Remember that the head of the pilot engineer group at Airbus was previously D.P Davies' successor at the ARB, and to those who knew him he was pretty much the dictionary definition of a "pilot's pilot". He had around three decades' worth of experience evaluating aircraft designs in terms of safety, and - from what I gather - in spite of being genial, whip-smart and collegial in his approach, not the sort of person who would buckle to demands from outside for the sake of political comity.

He was known for challenging (in the spirit of friendly competition) pilots who had reservations about the design to simulator exercises in which the A320 was pitted against conventional designs, and in every case the simulated A320 outperformed the challenger in terms of safety margins. His untimely death* was a tragedy in every sense, because he above all others was qualified to explain the design to pilots in terms they'd find natural, and his gregarious nature (not to mention his reputational clout) would likely have won more pilots over in the early years had he lived to do so.

The design brief has been misconstrued horribly based on rumour over the years, but at it's heart was this:

To develop a flight deck layout that could be used across a wide range of airliner types, yet retain a consistent feel in order to minimise conversion training costs
To develop a flight deck environment that would be ergonomically best-of-breed, applying modern (but proven) technology where necessary
To maximise systems safety by keeping mechanical and electronic complexity to a minimum

This wasn't something that was given to the engineering bods to build and thence to the pilot engineers to tweak - it was a collaborative process from beginning to end.

Of course, once this had gone through the sausage machine of the mainstream press, what was reported was that Airbus were designing a system that would reduce training costs in a radical way, with an unprecedented level of computer technology which would be the safest airliner in the world. At the time FBW was little understood outside of military aviation circles, and the best-known computer presence on other designs was the FMS (incorporating autopilot), so unfortunately the meme that the new Airbus models would be automated to an unprecedented extent (and that this was the reason for the cost savings - at the expense of pilots) took hold, and even more unfortunately has never entirely gone away. The move from large, central control yokes to sidesticks seems to have been interpreted in some quarters as a symbolic indication of diminished pilot authority, rather than the more prosaic attempt to improve ergonomics and ease type conversion that it actually was.

To address RR_NDB's questions, ECAM (and Boeing's response - EICAS), actually presented systems messages in a more concise and relevant way than anything that had come before it, and I'm sure that they've been incrementally improved with each new type that was made (by which I mean that the ECAM system in the A380 is probably a lot more refined than that fitted to the A320). The problem is that UAS specifically is a notoriously difficult failure mode to diagnose without some form of polling over time. Prior to the introduction of these systems, diagnosis was entirely reliant on crew communication - one pilot spotting an incongruous airspeed reading and cross-checking it with his opposite number.

AF447 is an interesting case for several reasons in this regard, because triple pitot tube failure was unheard of until the introduction of the Thales AA pitot tube (which was an optional fit), several years after the A330 and A340 had entered service, and the accident sequence was initiated not because of the UAS situation itself, but because for reasons which will likely be hotly debated for years to come, the designated relief pilot began a series of pitch-up commands before properly assessing the situation. Over 30 other incidents related to the same failure mode had a successful outcome, so the premise that the indications are somehow deficient is at best highly debatable.

[* - due to complications from altitude sickness when he travelled to the Himalayas as part of an accident investigation team - characteristically he requested to lead the technical team in the face of a hazardous assignment despite his seniority.]

RR_NDB

4th Nov 2012, 12:53

DozyWannabe (http://www.pprune.org/members/54871-dozywannabe)

I am traveling but will comment now on some points of your good post. (http://www.pprune.org/tech-log/481350-man-machine-interface-anomalies-7.html#post7501548)

After all the effort we made in trying to understand this case my opinion is:

UAS events are important and crew must and can know it immediately before any processing of it by the System. Why? Just because pilots don't like complex surprises.
Complex Systems interact with pilots through Interfaces: Man-machine interfaces. The one used in F-GZCP certainly played an important role to the Human Factors issue.
Above a certain threshold (of problems) faced by the A/C the current Interface can present important difficulties agravatting Situational Awareness issues. It's characteristics could delay a fast comprehension of "whats going on" something vital in certain situations.
In AF447 case the "series of pitch-up commands" could not be happened if PF and PM received proper inputs from A/C and System.
1 out of 32 previous cases are not low enough to regard AF447 a "black swan" ocurrence.
The Interface is more important in a Design philosophy where automation is using "hard limits"
Fault Tolerance and Graceful Degradation (a/c+crew) are important for survivability. The "treshold effect" i commented in an earlier post is extremely dangerous and may appear in situations not predictable by the "mangement/engineers/pilots" who design a complex A/C.

The toll Airbus SAS paid for the new concepts is "natural" when pursuing:

To have a flight deck layout that could be used across a wide range of airliner types, yet retain a consistent feel in order to minimize conversion training costs
To have a flight deck environment that would be ergonomically best-of-breed, applying modern (but proven) technology where necessary
To maximize systems safety by keeping mechanical and electronic complexity to a minimum

Better interfaces should be a natural evolution. Not just as a response to crashes but through complex R&D effort in order to improve the Human Factors aspects when facing complex scenarios, of any type.

RR_NDB (http://www.pprune.org/members/349485-rr_ndb)