Lyman

The THS kept going due lack of Pilot input. In other words, it autoed into the STALL.

That's called non-cognitive runaway TRIM. Un-commanded in the first place, but requiring a command to stop.

Arse about.

Someone, please define "TRAP".

Mr Optimistic

Please stop discussing this: all that needs to be said has been said.

RR_NDB

Automation helps but can create very dangerous situations as all of us know. This danger increases when the designers creates “tools” to help the operator introducing a “partner” with high hierarchy. Protections are excellent when designed to preserve limits (e.g. Rudder Travel limiter, etc.) But can generate adverse effects not to mention the “de skilling” potential.

IMO, under stress (normal in many situations) even a designer would be confused.

All good Engineers apply confidently WHAT IS NECESSARY to implement a required function. My concern is concentrated in the Top System Engineering approach simply because impacts everything. And cannot be corrected (or tweaked) by SW or even HW fixes.

They are learning and their leadership in this area requires more R&D. My concern is if the commercial success will allow the investment in areas with clear room for improvement, as you mention.

I bring the Finite States Machines because the "partner" introduced to the crew has this structure. Very powerful and increasingly present in our lives. And because they must be well designed and normally requires evolution.

This was not the case in TAM 3054 plane and the other similar cases before.

5LY

Bla bla bla! Know an approximate pitch and thrust setting for all flight regimes, and get out the unreliable airspeed checklist. Land, have a beer.

RR_NDB

Trimmable Resource Automatically Positioned



PS

The designers made the algorithms. And the a/c' s really (BEA said) worked as designed.

Question:

The crew (under stress) of AF 447 and TAM 3054 did receive ADEQUATE real time indication on the IMPORTANT (auto) configs, respectively of THS (in an stalled a/c) and eng#2 PWR after touch down (landing)?

Observe in both cases i am not even suggesting this as the main cause of the accidents.

i am just commenting the danger of auto (pre programmed) functions that apparently don't respect how rich is reality faced by us. And the potentiality (risks) of complex systems to perform as K.I.C.S. mechanisms. Just the opposite intended by the designers.

C. stand for Complex

DozyWannabe

That would depend what you mean by "this" - after all, you yourself were advocating the old "big red button" argument a short time ago, which would arguably have had no effect on this incident at all.

Depends on your definition of "Automatic" - it moved because the PF commanded it to move. If he wasn't aware that he was commanding it to move, then that was a fault in his training - not the aircraft, for which plenty of documentation on the functions of autotrim in both Normal and Alternate Law is available even to non-pilots.

The control laws were designed by the systems engineers rather than the software engineers as a way to abstract the complex operations involved to a more easily-understandable level to non-techies.

Of course - in the case of the trim wheel position indicator in the case of the former and engine power indicators in the case of the latter. The problem is that no-one appeared to have been looking at those indications - understandable in a stress situation, but in this case the design of those systems was no more or less complex than in any other modern aircraft. The trim wheels are in the same place on every other equivalent airliner, as are the engine indications. In the case of the TAM accident, even the old moving thrust lever argument can't be brought up, because whether they move or not the fact is that one of them was clearly in the wrong position. Unfortunately it would appear that neither pilot noticed, presumably because they were (understandably) fixated on speed indications and trying not to run off the end of the runway. This was also cemented when the Turkish crew did not notice the moving thrust levers of their 737 pulling off power.

In the case of AF447, the only automatic function involved was the trim, and that was wholly slaved to the inputs of the flight crew on the sidestick as soon as Alternate Law was latched - at the risk of repeating myself, If [the PF] wasn't aware that he was commanding it to move, then that was a fault in his training - not the aircraft, for which plenty of documentation on the functions of autotrim in both Normal and Alternate Law is available even to non-pilots..

In the case of TAM, if you only move one thrust lever to idle on a conventional aircraft, the engine controlled by the other thrust lever will continue to produce power just the same as it did in that case. It was likely there was no "confusion" on the part of the crew as to why they were using the old and deprecated method - because at least one of them knew that it stopped the aircraft faster. It was just unfortunate that in adopting that method that they made the same mistake that caused the old method to be deprecated in the first place.

I don't think systems complexity had a great deal to do with either case, notwithstanding the fact that there is no such thing as a "simple" system to control a modern airliner.

gums

No problem here with HAL until HAL starts to get in the way of what we pilots believe, actually BELIEVE, what we need to do and HAL gets in the way because HAL is programmed to PROTECT us. 'nuf there, so on....

INSERT: Alaska airlines THS accident not relevant here, as it was a clear mechanical problem and the crew tried everything in the book and some neat techniques until all was lost..

The 'bus reversion sequence appears to preserve many "autopilot" functions until all else turns to worms ( old fighter pilot phrase, so excuse me). Fer chrissakes, the jet seems to be very docile and has inherent spin resistance and such. There should only be two "laws" - autopilot and manual. The Otto limits could also be the "manual" ones, but the pilot inputs would be from the pilots and not some confuser. So retain the overspeed and AoA warnings. Let the pilots fly as they wish, but don't allow HAL to keep trying to "protect" them.

Problem with the 'bus is after A/P disconnects for whatever reason the pilot may think he/she has the "protections" that existed just a second before. Not so. The "autotrim" function still is active, and the alpha prot feature can be confused or even disabled when HAL decides that air data is unreliable.

What the pilots need is something to hang their hats on when the autopilot functions and all the layers of "protections" are invalid.

To Doze:

Many of the sfwe-illiterate pilots, and even anti-sfwe folks can provide bad inputs to the sfwe folks. I have some great war stories about the shuttle folks when NASA implemented the HUD for that beast. My roomie helped get the one you all saw a few months ago on its last landing.

As a systems engineer that wrote the spec for the sfwe folks to implement I always explained our rationale. I was open to tweaks and helpful features. But I basically used the state machine concept that RR has crowed about. And I am a disciple of the finite state machine for many implementations, especially those involving nuclear weapons and flight control systems.

We can discuss this issue privately, or we can create a new thread.

DozyWannabe

The problem there is that in the vast majority of cases, the FCU (or as you insist on calling it, "HAL") is right. In any case you have to be doing some pretty unusual maneouvres for an airliner before any of the hard protections kick in (namely continuing to demand bank angles past 67 degrees, letting the AoA increase until approach to stall or increasing thrust or downward pitch at the overspeed limit).

I wasn't saying the incidents were similar, I was using it to illustrate the different tactics the higher-ups were using to reduce costs - cutting maintenance in the '90s, and training when the FAA closed the door on dodgy maintenance practices.

You're getting autopilot functions and limits confused with FCU protections - for a start, traditional autopilot limits are set considerably more stringently than the FCU protections will allow (as far as I'm aware there's no autopilot in the world that will allow 67 degrees of bank, for example). FCU protections can also command the engines to increase thrust in the case of stall protection whether FMC (A/P) is engaged or not, which is one of the reasons why they are called "protections" rather than "limits" (I believe you asked that question earlier on?).

With all due respect, I find "confuser" as infuriating as "HAL". If I started using derogatory terms for pilots in the same manner I'd be banned before too long. I go out of my way to show respect to the pro flyers on here, and I don't think it's unfair to request a bit of common courtesy in return.

If the A/P disconnects in almost all cases, the pilot *will* still have the protections - the protections are lost in a UAS situation when Alternate Law is triggered and latched. The protections in Alternate Law are soft protections that consist of warnings and attempts to return to S&L - unless they are overridden by pilot inputs as they appear to have been in this case.

And they have it - you can't blame the systems for the apparent response of the PF, which would be wildly inappropriate in any airliner.

Would be interested in hearing them, but I don't see where that applies here - this is not a case of the Airbus control logic being a specific example of a complex system confusing the pilots, this is a case of a really nasty overwhelming situation getting on top of a crew who were not prepared to deal with it by their trainers and empoyers, just as it was with the Stony Point 727, the BirgenAir 757 and the ColganAir Q400.

Maybe another time, as I've got a lot on at the minute and can't follow this as much as I'd like to.

infrequentflyer789

Sorry, but if you are going to claim to be precise - the system doesn't think anything at all.

Some people here seem to be ascribing far more complexity and "intelligence" to the aircraft systems than is actually present.

This is leading them into the trap of blaming the designers for not considering rule A (do not trim up if AOA >X, Alt = Y, airspeed = Z) which apparently is perfectly obvious (with hindsight from an armchair - 3 real pilots on the night didn't find it obvious...). Thinking the designers screwed up because the system is too complex, they demand it be made simpler, not realising that it is already far simpler than they realise, and far too simple to implement the rules they've asked for.


The autotrim simply moves THS, limited by stops, to unload the elevator - with a bit of hysteresis thrown in (probably thresholds on elevator displacements and time).

The pilots may stop / override autotrim, and other systems on the plane may stop autotrim. Various protections may stop (or limit) the autotrim, and the higher level mode/law state may switch those protections on or off, or switch off autotrim itself (off in direct law).

Autotrim did what the pilots asked simply because that is what it does, and nothing told it to stop. It didn't look at the pilot input and the AOA and the current law/state and decide it oughtto move because law=alt even though AOA > stalled.

infrequentflyer789

THS responded to pilot up-elevator input. Nothing more nothing less and nothing uncommanded. Down-elevator would have undone it - but the elevators were never put down after the stall.

THS didn't auto into the stall either. Look at the traces. Stall was achieved with elevator alone.

Inadvertently stall a big jet and you've already got a big chance of dying (odds are bad enough even in GA). Do it with no outside visual reference, some already broken instruments and in turbulence in middle of a cb... and your chances are probably <10% at best (at an optimistic guess). By the time the THS started moving, they were already well into a trap and needing a miracle.

DozyWannabe

You win the last couple of pages of this thread.

I missed this statement earlier, but when I did see it I wondered where otherwise intelligent and logical people get their information. The FCU does neither of these things. Under manual control and in Normal Law it simply responds to commands - the only time protections come into play is when what is being commanded exceeds the pre-programmed design limits of the aircraft, in which case it will respond to every command that would not exceed that limit. No "intelligence" beyond a set of pre-programmed responses, no "guessing".

Quite where gums gets his information on AF training procedures I am not sure, but he sounds awfully certain.

infrequentflyer789

Not if the pilot doesn't trim - see Perpignan. Doesn't work too well on other planes either - Bournemouth, Schipol...

Common factor - suprise auto dropout. Let's hit the pilot with stall warning and at the same time disconnect the biggest pitch control surface from the stick, so the pilot needs two controls for pitch where a moment ago it was just one...

Is that really the best user interface ?

CONF iture

Best user interface must be the simple one.

• Auto trim under Auto pilot
• But Manual trim under Manual flight

No ambiguity on who has to trim.
If the pilot quits trimming when he should not … then he might have to pay the price but let’s not pretend to build the perfect aircraft that will solve all.

As a pilot I need a simple tool I can understand and trust.
Don’t make it more clever than necessary.
Train me properly on it.

gums

Thank you, Conf.

When I read the 'bus "manuals" and such that we have had provided here, I see a plethora of reversion "laws" that are not really "laws". They are simply less restrictions on bank angle, pitch attitude, a few AoA functions and associated "warning" chimes or whatever, and the beat goes on.

My main point is that the pilots need both understanding of the system and the flying/handling characteristics of the jet when they aren't sitting there "managing" systems. So Conf's statement rings home to this old pilot. Some of us are not anti-computer or anti-FBW or anti-anything. We just need to know when we have control or HAL is getting in the way.

The "basic" control laws of the 'bus must be made clear, and there just seems to me that those basic laws are not well-known amongst the crews, and the warnings and advisory stuff does not reflect the actual aero condition of the jet when it loses a sensor or two.

BTW, I use the term "HAL" because it implies some artificial intelligence on the part of the basic FBW system design I have seen in the 'bus manuals we have had linked to here. And I don't like it.

There are "limits" and "protections" but I am not sure that the system clearly distinguishes which is which as far as the pilot understands.

I still maintain that too many "limits" are embedded in the reversion sequences that are not necessary for safely flying the jet when we have such a simple failure as pitot-static system problems. We don't need a direct control of the elevator or ailerons/spoilers as if we were flying a P-51 70 years ago. I see too many "protections" embedded in the control laws of the 'bus that are not necessary for basic flying the jet, and they can cause confusion for the pilots when sierra happens.

I am not sure that all the 'bus "limits" were specified by pilots. My gut feeling is that the FBW design offered an opportunity to do "neat" things, and the sfwe folks went with a few suggestions. The emphasis upon auto-everything except putting on the brakes after touchdown and steering the jet to the ramp bothers me.

DozyWannabe

Well, based on what I was told by the people who were there, you're dead wrong. Don't let your experiences with a weapons outfit in the US make judgements for you on how a pan-European civil airliner project went down.

Also, CONF is a long-time hater of everything the 'bus stands for, so of course he's going to say that. To clarify for CONF, here's the supposedly "ambiguous" list of trim auto/manual status:

Normal : Auto
Alternate : Auto
Direct : Manual

RR_NDB claims that the Airbus system is an example of "Top [Down] Engineering", whereas in fact I was told it was a classic example of Top-Down specification with Bottom-Up implementation - meeting in the middle, which a lot of engineers claim is the most effective way to do things. The whole idea behind the "Laws" was to present a relatively easy set of mnemonics for pilots to understand the aircraft status - as such the A320 was the first airliner to attempt to address the problem of a non-normal situation increasing workload on the pilots in a 2-crew flight deck.

In the days of 3-crew operation, the Flight Engineer was expected to know the systems intimately, along with all the failure mode combinations and settings to maintain safe flight when those failures occurred. The only reason Alternate Law has sub-modes is because that knowledge of the systems is coded into the FCU logic - I'll say it again here - all a pilot really has to remember about Alternate Law is that there are no hard protections and that more care has to be taken to ensure flight envelope limits are not exceeded. If that's too complicated for the average pilot to understand, it's a wonder any pilot ever passed their IR*.

The implementation was "Bottom-Up" in the sense that Direct Law is the first layer of abstraction, providing straightforward control of the surfaces via digital means. Alternate was the next layer, roughly analogous to the old A300/A310 protections which activated only when the pilots let go of the controls. Normal was the third and final layer, which added the advanced FCU protections that made the Airbus FBW series seem like such an advance - when it was in fact only an iterative improvement over the previous generation.

Even the supposedly more "pilot-centred" B777 has more than just "manual" and "autopilot" modes, and again as I've said before, the force-feedback logic is itself far more complicated under the hood than anything in any of the A320's systems.

[* - Note to those for whom English is a second language - what I'm actually saying here is that I don't believe that the average pilot would find the flight control law system on the Airbus FBW series too complex to understand.]

jcjeant

Hi,

Always interesting to visit the BEA site
The last communication at 30 September : (in french)
http://bea.aero/fr/enquetes/vol.af.4...re.2011.fr.pdf

The BEA said that he is the sole authority to provide information on a
investigation it has opened following an accident or incident
It seems presumptuous ....
Or maybe it is a warning to employees of BEA (from which the majority of leaks come)
The BEA notes that repeatedly working papers relating to
safety investigation with information being uncommitted,
covered by professional secrecy are disclosed to the media, for
other than safety investigation.


BEA read Pprune .. ? or this .. ?
AF447 « AF447

GerardC

You are wrong "putting on the brakes after T/D" IS "automatic".
They even invented a "brake to vacate" gadget on the A 380 to "program" the runway exit point after touch down.

Lyman

infrequentflyer789

You're not wrong, and I know what you're saying. For the moment, consider that the Pilot flying after a/p loss was working his theory "I think we have some crazy speed.."

Repeating how the aircraft behaves with its trim doesn't help an understanding.

From the releases and FDR data, we believe the a/c was NOT oversped, and all the UP elevator was the pilot's.

He made a mistake. A mistake he appears to have held on to for the rest of the flight. We know this because at the very last, when the Captain tells him "Climb", he says "But I have held back stick for some time."

You want to go straight to "What Morons"? Feel free, but the a/c is part of the crash, and how she gets along with her crew is (seems) to be the cause of this crash.

More important is what caused the PF to believe the a/c was fast. Guessing won't do, and chiding a dead man solves nothing.

FYI. The 54 seconds of STALL annunciation comes from the DFDR. Call me old fashioned, but until I hear it on the CVR I consider the jury to be OUT.
No offense, but proof is needed.

We know that the a/c recovers from STALL with elevators DOWN and full UP THS. So if the elevators are effective, why did someone decide that on the way up, Trim was necessary? And should be Auto?

CONF iture

Dozy,
Behave your comments please.
Or is it supposed to be the ultimate argument when things don’t go your way ?

Working on the Airbus is my job, maybe I have some credential to appreciate what could be better on it.
Do not take it too personal if critics are formulated towards Airbus.

What does it clarify on behalf of AP or Manual flying ?
Put as many laws as you like but leave to the pilot to trim when he’s manually flying.

DozyWannabe

It's the same for both! Though if I recall correctly autoflight is inhibited in Direct Law.

Why?