alph2z

I've been watching all the threads carefully.

Nobody seems to have mentioned the pilots turning on the landing lights and watching the ice, snow, hail, and rain going upwards. (pilot, and engineer).
.

infrequentflyer789

@BOAC:

Well, inadvertent pitch up is always going to give you a climb you don't want/need by definition - and it only "ensures you stay" until you tell it to stop.

For every safety measure you can always find a scenario where it will be bad for you. If you are asking "will this ever possibly kill someone" then you are asking the wrong question.

@Lonewolf:
Agreed, and if I understand it right, it is one of the things that gives AB superior GPWS escape capability. On the other hand, it has acutally caused one crash on landing (which is near the ground...). The activation logic has changed as a result.

Clearly if above 30kft, we shouldn't be needing a GPWS escape, so maybe disable it. Then what happens if the plane has dodgy altitude info ? Ah, but what's the probability of needing a GPWS escape and at the same time the altitude being screwed ?

[ Bit like what's the probability of grid power at a major power station being down for several hours and there being a tsunami at the same time... (think about it) ]

No easy answers, and the events are so rare it can be decades before you get a clue if you made the right call.

@galaxy flyer
You know, I admire the boeing backdrive, impressive feat of engineering - but there's still a nagging doubt that it's added a whole lot of complexity, and hence failure risk. All to give the pilots a "feel" of something that hasn't acutally been there (ie. direct cable control) for decades. That "feel" is something you want most when things go wrong, but, you know, it's precisely when things are going wrong that you shouldn't trust it - because it is purely artificial and is calculated using the same airdata, config etc. information that may be what is going wrong in the first place.

The backdrive has limits (soft, not hard, but there) - if the a/c is flying on bad data, those limits will be in the wrong place. I am also pretty sure it will use airspeed etc. in calculating gains even within the limits - lose airspeed and are you sure the feel is going to be "right" ? If it's dark over water and your instruments start acting up, and the autos drop out, are you going to start flying the plane based on that backdrive feel - even though it's being calculated from the same airdata that you know is screwy ? Is that better or worse than "no feel" ?

And, of course, the backdrive is modal too - or at least sometimes it can cause "higher than normal control forces" in a way that is, as you say, "confusing in an emergency". But that's ok, no one's died so far, and there's an AD for it now - a software fix to make sure we don't activate that mode at the wrong time. That sounds so very... airbus, doesn't it ? [ But I'm sure you B fans will know the AD and I don't have to dig out the reference, right ? ]


It's an imperfect world, A or B side, fbw or non. Both fbw are very safe, but also very different. Feel free to have a preference as to which is nicer to fly, but as to which is safer to fly in - I don't believe there is anywhere near enough data, and too many variables, to separate them.

CogSim

My naive (non software literate) attempt at defining the SE concept of abstraction. Nothing more. But lets face it, even if he/she needed to, what chance has a pilot got at understanding what goes on software wise on one of these a/c?

Unlike understanding the abstraction at work in guages that you describe, which helps me be a better airman (in case of, say, pitot blockage), understanding the voting logic of various computers does nothing for my airmanship.

infrequentflyer789

Inherently false.

Question should be does the increased sophistication result is a system that is less prone to failure, or more prone to failure.

The overall "system" is aircraft + pilots. Maybe as the engineers have sought to decrease the failure rate of the aircraft, this has lead to airlines dumbing down the pilot side of the equation to reduce cost but keep the overall same level of risk.

Note that this amy not be a concious decision, and the effects might take many years to notice in the accident stats.

Commercial flight has to be at both a profit and an acceptable level of risk - or it will not happen. It has always been that way, and applies to most if not all industries, not just airlines. There will always be an element of commercial feasibility in regulatory decisions - otherwise you risk regulating the industry out of existence.

In the absence of an aviation regulator that insists on highest possible safety at any cost, you can always choose not to fly. The effect is the same.

DozyWannabe

Let's be honest here, what percentage of pilots in the steam-gauge era knew - and I mean really *knew* - exactly how the mechanical and pneumatic systems were translating the data? What the tolerances and ratios were, what every possible failure mode looked like, the whole shebang.

This is just an opinion mind, but I'd say it probably does in this day and age. Airmanship is about knowing your craft and having a healthy amount of aeronautical knowledge to back it up. Arguably these days it also includes the art of delegation if you're in a senior position, and how to be the best member of the crew you can be regardless. Understanding the systems to the best of your ability fulfils the very first thing I mentioned.

As far as Software Engineering goes, what is involved is no different than any other type of engineering discipline, it's just that you're dealing with instructions on a microprocessor rather than building a bridge, designing an airfoil or designing a circuit.

Going back to the first point, I'd say that it is no different understanding that the air sensor output goes through a transducer and is converted to a digital value than it is knowing that the air sensor output drives a needle round a gauge via mechanical means. It's not the most in-depth knowledge, but it's enough.

jcjeant

Hi,

Indeed .. not noticed
Maybe the pilots had to play with others buttons or "Humor mode open" they were afraid to dazzle those who could be facing "Humor mode closed"

jcjeant

Hi,

It should be noted that this system was adopted by Boeing cause the express request of pilots

jcjeant

Hi,

More you add systems .. more you have chances of problems or failures.
More we are ... more fun !

jcjeant

Hi,

Seem's we have already enough statistics from a long period of time ...
The stats are:
+ - 70 % accidents = pilots errors
The other 30 % can be attributed as human errors (bad maintenance .. bad materials .. bad systems or designs ) and some act of God.

So .. the 70 % ( the most cases) can be reduced at least by schooling and training

Edit:
BTW .. all Airbus accidents so far are due to pilots errors

DozyWannabe

Just as pilots were involved in the Airbus design process - is there a point to your post? All this means is that different pilots prefer different things - it's not like the Airbus FBW flight control system was designed in a vacuum by engineers and bean-counters.

jcjeant

Hi,

French//US different culture maybe ?

Graybeard

Yes, different cultures. I'd wager there is a lot higher percentage of Boeing designers flying small aircraft on the weekends.

wallybird7

I’d like to throw in my 2 cents of input.

We have a triply redundant system of pitot tubes which all failed at the same time. Of course using the very same systems.

Which provide info to the incredibly sophisticated computers which all seemed to fail at the very same time.

Giving the pilots nothing to see on the outside and nothing reliable to see in the inside of the cockpit,

And all of the systems that were designed to prevent stall, high angle of attack, and every other kind of protection failing to do so,

And giving the pilots no guidance whatsoever what to do about any of it,

And after months analyzing what went wrong unable to come up with any solution whatsoever on what the pilots or the auto protection were supposed to do or what they did do,

I would say that had the pilots avoided this thunderstorm in the first place we would not be talking about this.

After 32 episodes of triple redundant system failure – I would say we have here a very very fragile and weak system.

The solution to me is simple, until this is all figured out I’d suggest avoiding thunderstorms.

OK465

I tend to agree with CogSim’s comparison whether semantically, technically or practically correct or not.

I flew a FBW SS fighter aircraft among other aircraft. I never really cared much about what, software-wise, those control surfaces were doing out there banging about as long as I was getting what I expected out of the aircraft while adhering to my responsibilities manipulating the SS.

For “simplicity”, I preferred to think of all of those various control surfaces as, “wish-erons”, because the aircraft gave me so much I had always wished for, but couldn’t get, in the previous non-FBW fighters I had flown.

Software engineers are on the ground writing code; I’m in the air (simulated now for this old guy) basically ignoring it. Both sides are successful. Pilots fly aircraft, not software.

It’s a given, however, that the automatic transmission/gearbox should function properly every day, but if it doesn’t, it’s not a big drop stepping out of the car.

DozyWannabe

Incorrect. All the indications we have so far imply they behaved exactly as designed to when an air data failure is detected.

jcjeant

Hi,

It's also not a big drop jumping out of the plane ... provided you have a parachute
It should be noted that as presumptuous as usual .. man was able to invent a way to rise into the air .. but it took many years to admit that his invention was not perfect .. and he resigns himself to invent the parachute .. and it's some help when it open correctly ........
Failure finally admitted

galaxy flyer

DW

Yes, no doubt, the triple redundant FBW worked exactly as the engineers designed it, but PILOTS were flying the plane. The pilots clearly did not grasp what the computers were trying to do, probably did not understand what the THS was doing and how that might have impacted their recovery attempts, and how they may have reacted properly.

Unfortunately, pilots learn to fly on planes that fly like all the planes built since the Wright Flyer, version 1908, not like Airbuses. There have been a disproportionate number of LOC accidents/incidents in Airbus aircraft. Since the A320 Habeshiem accident, there was the NAT incident, the Australian incident, the Perpignan crash, amongst others.

RR_NDB

I.e. BADLY! This redundancy implementation is USELESS specially at "cruise FL". Or worse, creating a CRTICAL design.

The use of a "voting scheme" capable to "major a/c reconfig" using identical (sub heated) not adequate Pitot´s is a direct path to PROBLEMS!

The System design managers that accepted this as a reliable System (fault tolerant) from the engineering team IMO DID NOT realize the OVERALL SYSTEM (aircraft+pilot) departed from the VERY IMPORTANT "graceful degradation" goal. It seems "bit oriented Engineers" concerned (absolutely justifiable) with computer systems (obviously requiring redundancy) induced to a "concept error" wrt to the AS measurements; To Project managers concerned (absolutely justifiably) with the importance of AS measurements for this design.

This a/c design IMO (wrt AS) is flawed in:

1) Ridiculous AS sensors redundancy (useless)*
2) The use of this voting scheme to not adequate AS sensors (sub heated)

Note: IMO this design EXACERBATES Pitot´s icing susceptibility


* Exception at TMA FL when one may mention chances of birds collision. I am not considering Pitot heater failure. We can discuss this aspect later.

Who can tell me why they implemented this redundancy in respect to AS measurements? I would like to understand the reason.

AF delay in replacing Pitot´s obviously contributed (to Murphy Law) but is not as serious imo compared to Airbus SAS (and Certification) failure.

It seems to me (as a technician) that the bureaucrats are in charge. And the pilot´s being informed they are using a redundant, etc. (advanced design).

I hope for a review of this issue (in every "advanced a/c") using this. Even with super heated Pitot´s i never would adopt this.

YRP

There has been a lot of talk about how the auto-trim system trimmed to the nose up limit and how this might have limited the control authority for recovering from the stall.

One thing puzzles me in the discussion. My reading of the BEA release is that the pilots did not attempt to push the nose down (apart from apparently brief nose down inputs around 2h12:17). So the trim position and the auto-trim function was not a factor -- it might or might not have become a factor if the pilots had reacted differently, but it does not seem that it was.

Do other people interpret the BEA report differently on this point?

PickyPerkins

Yes, probably an outlier because AF447 came down in a deep stall, with a slower descent than for a spin , spiral dive, or the like.

It might be interesting, and possibly useful, to examine these ten accident reports and compare the situations at the start of each of these events, e.g. how many of them STARTED with a disconnect of the AP?