http://libraryonline.erau.edu/online...s/AAR75-13.pdf for Welsh Wingman

- no bigger a pill than usual There I disagree - it IS there to protect from 'bad piloting as such' and it does it very well in normal circumstances - things like excessive pitch, too high an AoA, too much 'g' etc etc.
- you need to remember that normal 'manual flying' in an Airbus is still 'protected' by the system. Thus they do NOT need to know the limits of safe flying, even manually, as the aircraft controls those.
- no. That was EXACTLY my point!

Welsh Wingman:
Flugunfall 01 DEC 1974 einer Boeing 727-251 N274US - Stony Point, NY

Litebulbs:
Not sure what you're asking? The indicated airspeed whether accurate or not isn't the issue in determining the energy state of the aircraft. We know what the airspeed was before the incident. We know that the crew are not reported to have added thrust and that the AT was disconnected. You can't climb for free so the energy came from speed. They stopped climbing when they were at the ceiling for their thrust setting at the alpha they were commanding. Note that when TOGA was selected they were able to climb a further 500ft. In this case they added energy to the equation.

Note that skydivers, before they open their parachutes, have a glide ratio at a very high angle of attack, just not a very good one. With a fabric "wing," the glide ratio improves. Click for an example.

Similarly, the wing is still providing "lift" beyond the stalling angle of attack, just less and less of what it was before, and more and more drag. The airplane should pitch down at stall because the center of gravity is ahead of the center of lift but in this case, the center of gravity may not have been been very far ahead of the center of lift and you've obviously got engine thrust, an almost fully nose-up trimmed horizontal stabilizer (which is probably sized to keep the cg range as wide as possible), and nose-up elevator creating enough nose-up pitching moment to offset any nose-down moment. I am surprised that there was still enough roll control authority at that angle of attack to keep the wings more or less level.

Tailspin Turtle wrote:
Not really?

CoG could be some way behind the "centre of lift". In this case the CoG was at 29% MAC. The "centre of lift" would generally be at 25%.

Graybeard, to get the AoA value you suggest, would not the aircraft have to be moving backwards?

See the diagram here.

Angle of Attack Indicator

If you move (orange) line (marked number three) down, you increase the the angle. To get to the value you assert, the orange line, resultant relative wind, would have to be coming from behind the aircraft's nose, behind and below the leading edge of the wing. That would need for the plane to be dropping not just straight down, but straight down and roughly moving in the direction (with nose up 16 degrees) that the tail was pointing. If it were doing that (and I doubt it was) the ailerons would not provide lift. The flight path described (see takata's picture some pages back) by the data BEA provides, indicates a long, wide, right turn (almost a teardrop) from apex of climb to impact with the water. Nowhere does the BEA report indicate the rapid change of heading associated with a spin.

So if it didn't spin, but was stalled, and was in a rate of turn that described the track over the ground from that reconstructed picture, the aircraft was moving in the direction that the nose, not the tail, was pointing. More to the point, your estimate would require the aircraft (whose ground speed was reported as 107 knots) experience a massive microburst of airflow to hold that AoA (relative wind from behind) and 107 knots forward.

Your AoA estimate there does not fit what has been reported.

Can you sketch out why you come up with that estimate, or were you tossing that against the wall to see if it would stick?

FE Hoppy
 

I am confused, that's all. At 2:10:05 and M0.8 there was a L Up input with a warning and a massive drop off in IAS. At 2:10:16 a climb started, increased to 7000fpm then reduced to 700fpm with an increase in ALT of 2500ft by 2:10:50 at M0.68.

So in 34 seconds at 7000fpm you could achieve a 4000ft increase in ALT. But surely you have to start the climb and then reduce it to 700fpm too, all within 34 seconds, whilst still having a forward speed of M0.68 and all from all from energy contained within the airframe.

after creating the "zoom-boom scenario" up to FL400+ to bring down the kinetic energie of 205 t with 240 m/s to an flightlevel zero without a highspeedchrash.... within 4-5 min... within less than 10 miles

we all thought: yes it seems physical possible, BUT it can not be because no pilot will pull in this situation....

and now we know the way, it need only a pull at the elevator a bit over some time and the right or wrong (too-loose-)lav for the follow of the trim to the max position and with a 270 deg segment of circle a climb to FL380 is enough to bring the kinetic energie to FL zero... BUT by all RAZORs I can not believe that the PF has pulled up over 3 min with his hand, pulled with all skills he had in his hands

you have more sensors in one hand than all airplanes together have in all ther highly sophisticated technic,

even if the PF sits his first day on the left side and had used the stick only with his right hand on the rhight side before, he will not pull so long..... no no no

so are we shure we can roll out all other possibility reasons for the up move of the trim?

icing AoA vane ???
the g-sensore
is the trim lav absolutly save, in all moments during the disconnect of the AP while changing the lavs???
something else.......I do not know

if an actuator like the auto-trim has a faulty circuit it either stops at the last position or it run to the end common with low energy an actuator can run to the end(my first RC-modell crashed in first flight, the elevator moved full down, I just plump forgott to recharge the akku before flight....)I also did not understand the climb of the A340 after disconect the AP, they say nothing over the trim, the say the flightpath followed a g-protection in this case, the path will oscillate in altitude, my feeling is even this jet was nearly before stalling and the protection was the PF ???

if the g-protection work over the elevator will the trim than beginn to follow also?

work the g-protection together with the airspeed? or the AoA?

RegDep.... Things haven't changed much since the '70's have they? As I posted several dozen pages back, an aircraft can "feel" pretty normal in a stall on a dark and bumpy night. You have to look for clues like the altimeter unreeling to know what's happening if airspeed, FPV, and AOA are suspect or missing. Thanks for posting the report. Hopefully the world's instructor pilots are reading.....

Well the pitch input was at 05 and the climb commenced at 16. The peak value was 7000fpm but the mean was about 1400fpm. If we are to believe the the quoted speeds they lost 60kts in this manoeuvre and ended with the same thrust setting and 4°alpha.

How about this scenario:
PF makes his correction for roll and doesn't notice the rate of climb or is confused by the stall warning. When he notices the 7000fpm he corrects with nose down and levels at 375 all without adding thrust. He's now at 4°alpha but having not added thrust his speed is reducing which induces the second stall warning. Now he adds the thrust and pulls up. The aircraft doesn't have much more thrust to give and his alpha is increasing all the time while the speed is reducing. We know that the isis speed comes back at 2:11:06 (15 seconds later ) and shows 185 which matches the PFD.

Doesn't appear unreasonable and doesn't require any external energy input.

RegDep/FE Hoppy
 

Very grateful re: your link to the NTSB report on NW6231. That's the flight I have always thought of when you mix pitot tube icing and aerodynanic stall. Probably a generational thing. Showing my vintage.

But for the BEA, and from the stance of investigating the loss of AF447, I still think TE901 and have done since my very first skim of their 27 May report. Why would pilots continue to pitch-up the nose on a stalled aircraft from 38,000ft all the way down? It's been done all the way down before, see above, but other factors will surely come into play in the full CVR and FDR (with details of the aircraft and its systems responses).

As initially inexplicable as flying a perfectly good aircraft into a 12,500ft volcano at 1500ft feet? Eventually, you get to the truth - ANZ flight crews unaware of the MSA or else ignoring them on "sightseeing" flights, McMurdo ATC giving permission to descend well below any ANZ SOP MSA (the radar not picking-up the plane/interrupted HF communications as clues to an intervening land mass?), no Antarctica "whiteout" training for the flight crews, and then the plane being programmed the night before to fly towards Mt Erebus rather than down McMurdo Sound (as per the earlier flight crew briefing) and without the flight crew even being notified.

The flight crew doing something which appears inexplicable at first sight, training and operating issues coming out "in the wash" (haven't Airbus already changed their recommended high altitude stall procedures, focussing less on power application and more on a willingness to sacrifice height and get air flowing over the wings again, in the intervening period between crash and CVR/FDR recovery?) - sound familiar to AF447? Intense media activity (albeit nothing as compared to the pressure that McDonnell Douglas were under in November 1979 in relation to their DC-10s, post-Paris and Chicago crashes - I bet the engineer who downloaded all the INS data from the wreckage to prove a controlled flight into terrain got one hell of an Xmas bonus that year!). BEA may additionally have aircraft issues to add to the mix with AF447 (there are a number of troubling issues, particularly in the short time between A/P cut-out and the stall beginning at FLT380).

Alot of speculation in the meantime, on still limited known facts from the CVR/FDR, but some excellent technical input from this website. Just don't get overly fixated with that last sad few minutes (I know it goes against the grain for us aviators), because most of the chain was completed and in place before the A/P computed "do not compute" and handed the plane over to the flight crew. Think how small a trigger, the ice-defective FOHE grill on the Trent 800 engines, was to bring down a B777 on final approach to LHR. The margins are tiny.

And a salutary reminder to today's aviators, airlines and manufacturers of what the great Captain D P Davies wrote (well, more or less) over 4 decades ago - if you are left with a choice of causing an aerodynamic stall or causing anything else, probably best to go with the latter...........

That's all gentlemen (and probably a few ladies), from me, until after the next BEA report. Keep up the good work/keep the posts coming.

We have travelled less since December 1974 than everyone had hoped (the Colgan Air propliner, not just AF447, and even with the Aeroperu and Birgenair "wake up" calls in the 1990s).

Thanks. My bad again. I should have written neutral point instead of center of lift.

AoA, stall and philosophy
 

1) Whew! Glad some folks corrected/confirmed my geometry concerning flight path and AoA.

Every airplane since the one I checked out in back in early 1904 ( Wilbur was my IP), has depended upon the shape of the wing and the AoA ( relative wind over the wing) to get airborne and stay there.

Why is AoA not a basis for all thoughts here concerning the ability of an airplane to fly?

2) I initially homed in on a classic, uncontrollable "deep stall" scenario due to my experience in the Viper. After seeing many charts and graphs and verbiage concerning the 'bus, I backed off.

Then I learned about the actual flight path of the jet and some limited tidbits concerning pilot inputs. I do not think the jet was in an unrecoverable stall. It was simply stalled!

Unlike our little jet, which could find its way to a true deep stall that was beyond human or aerodynamic capacity to overcome, the 'bus does not seem capable of "getting there". It has to be "held" there - by the pilot, the basic control law implementation, or a combination.

The role of the THS in this accident will become a major finding. That's my story, and I'm stickin' to it.

How did the THS get to max "up" position? Well, the jet has a gee command for pitch, not attitude or AoA. So if I hold a gee command greater than 1 gee, the THS moves to allow the elevators to behave "normally". Pull back, go up. Push forward, go down. Pull back a lot, go down quickly.

Somehow the THS remained in the max position for a nose up command. Cause is to be determined.

3) Philosophy.

The FBW systems and many other schemes are designed to a) protect the plane or b) protect the "cargo".

In my case, the design philosophy was not to protect the plane!! We could have had a plane with a 15 gee capability, an effective AoA of 60 degrees, etc. But what we got was a plane that would roll and pitch and turn at a very effective limit that no other plane of its time could equal. We could pull as hard as we could, but the jet would only reach the AoA and gee limits. We could command max roll at any condition and the "system" would limit that command in order to keep the pointy end forward. So we had a system that protected the pilot from doing stupid things, but perform better than any adversary we'd be likely to face.

I see a combination of protection with the 'bus. It tries to protect the plane from over-gee, max speed, max roll angle, max pitch attitude, etc. It also protects the pilot from demanding more of the plane than it is capable of delivering - to a point.

So we now come to unique conditions at FL350 and pilot inputs that meet conflicting "laws", and the "laws" themselves.

So is the problem training, airmanship, inappropriate control laws for "abnormal" sensor data, ad infinitum?. And the beat goes on.......
______________________

I am disappointed about the lack of understanding here concerning AoA and stall characteristics. Stall recovery and recognition of stalls are paramount capabilities all pilots must master.

Citing FCOM 1.27.20 P2:
“When angle of attack protection is active, THS is limited between setting at entry in protection and 2° nose down (i.e. further nose up trim cannot be applied).”

This makes sense since AoA protection is to prevent stall and doesn’t need more nose up trim.

Question is: Why is THS allowed unrestricted nose up move in ALT law when the stall alarm is active? Is there a logical answer to this?

Had the AoA parameter value that triggered the stall alarm simultaneously preclude more nose up THS, the AoA would probably not have reached 30 + deg, whatever the pilot was trying to do. Elevator alone efficiency is limited .

FE Hoppy: There's no reason to think the climb didn't start shortly after the nose up input just after 05. A big weakness of the narrative format that the BEA adopted for this report is that it makes it hard to tell when the events being described are basically simultaneous and when they are sequential, and you really have to be alert to subtle tense differences (eg TOGA was set at 2:10:51, but the throttles are already at idle at 2:12:02, so we don't know when in the intervening period power was reduced).

Other than that, your scenario is not implausible. And could it be that they attributed to turbulence the upward acceleration that they must have felt?

So this puts us at the top of the climb, at the edge of the stall (or at its beginning). What is much harder to understand, though, is the following three-some minutes. Other than power being reduced sometime before 2:12:02 and some nose-down inputs at 2:12:02+15, there seems to have been little effort to break the stall. What was going on in that cockpit?

Lonewolf50

As you point out, the g trace will be interesting. The first input (?) by the "new" Pilot Flying, was NU and roll left. Accompanied by two Stall alerts, this is an a/c at its maximum energy and densest air (for the climb). After this input, everything is bleeding off. Except altitude. We see ROC that varies, and no specific time points for each value. The duration of the climb is thirty seconds which must include an entry, max, and end of 700, with a third Stall Alert that means business.

I am picturing a climb with a very emphatic Elevator input, to initiate a g loaded Stall warning, and an ensuing rise in AoA that is remarkable. I also entertain the thought that some damage to the airframe may have occurred, or damage to actuators, something that made recovery more difficult, and may even have prevented ND. From Machaca's picture of the inside of the tail cone, and some familiarity with the mechanicals inside, the THS is a massive beast. The elevators by comparison look like tacked on tabs.

None of this conjecture will command attention unless and until further data is released.

The system by definition allowed this command, for it tracked it with THS inputs (NU). So a discussion of LAW here is important, but perhaps not relevant, for here the evidence is the salient issue, not the LAW, and what the a/c "would be doing". (Paraphrasing DJ77.....)

Seems to me, regardless of the controls 'domain', this a/c trimmed for Stall, and held it. IF PE, not too very well protected from the PF after all.

Even in Direct Law, or mechanical, this is possible?

Addendum. Since Takata says the ACARS stream can happen all at once, (but reported in sequence, and spaced out) could this radical climb have initiated the Cabin Advisory Vertical Speed? I still do not grok this ACARS system........

A Cautionary Tale of Expecting Too Much
 

About a decade or so ago, I was involved in the substitution of a digital engine fuel control for the old but very reliable hydro-mechanical control on a single (turboshaft) engine helicopter. In order to simplify it and reduce cost, it was in effect, a single-channel system that failed to a manual fuel control. In other words, when the electronics went off line, the pilot had to twist the throttle to maintain rotor rpm just like in a piston-engine helicopter instead of the fuel control maintaining a constant rotor rpm based on the pilot's control inputs.

Our test pilots accepted it, the FAA evaluated and certificated it, the training academy developed a training curriculum for it, and out the door to operators it went.

Unfortunately, the unit was initially a lot less reliable than we thought it would be and when Joe/Jane average pilot had to take over and twist the throttle, he or she often proved inadequate to the task.

After the first couple of crashes following reversion to manual mode were reported, I arranged to fly one for 30 minutes or so and didn't understand what their problem was. My first helicopter flight, like all older helicopter pilots, was in one powered by a piston engine and manually maintaining rotor rpm in takeoff, cruise, and landing was not a big deal even though I wasn't current and certainly not as good as I used to be (although probably never was).

So for a while we tweaked training, improved the unit's reliability, published advisory articles, etc. Nevertheless, the crashes continued. We were expecting too much from a generation who were raised on turbine-powered helicopters and in at least a few cases, older pilots who hadn't twisted a throttle to maintain rotor rpm in a long time.

Hi BOAC,

Apologies if that sounded facetious, it was intended in a friendly manner, I assure you.

I don't know if I'd read it that way - the protections are there to prevent the aircraft from getting into a dangerous situation, whether that be pilot-initiated or otherwise.

As I said before, it's a very emotive issue for pilots and the narrative of the dastardly French getting around the table and saying "zese pilots, zey are dangerous, so we will build an aircraft zat will nursemaid zem and tell zem 'ow to do zeir jobs" is a sadly prevalent one, despite it having very little basis in fact.

Pilot mistakes are but one facet of what the protections were put in place for. From my perspective the whole philosophy centred on the fact that we now had space-age technology at our disposal, but our aircraft were designed around an ergonomics system that was largely unchanged since the war years. You put an astronaut in an A320 flight deck and I'm sure he'll feel right at home. As such, it may be helpful to think of the Airbus FBW philosophy not so much as taking authority away from pilots, but trusting line pilots with the kind of technology used to fly to the moon.

First sentence, absolutely. Second sentence, I couldn't disagree more. If the aircraft was capable of remaining in Normal Law indefinitely and that was proven, then whoever tries to put that notion forward might have a case for that - but the fact is that it isn't and therefore the limits of safe flying *must* be included in training. IMO any airline that does not include coping with FBW/FMC failure modes in their recurrent training is playing Russian Roulette with the lives of their crews and their passengers.

From my SLF point of view, I wouldn't want to see wholly-automatic pilotless airliners even considered until they are entirely composed of failsafe components - which means as long as they are built of material that can fail, have engines that are vulnerable to bird strikes and FOD and have sensors that can be blocked or otherwise rendered ineffective, I want a human being upfront who can diagnose the problem, come up with a solution and get us down safely.

Ok, accepted and thanks. Next question if I may? At this point would it be acceptable to assume that the ground speed would be about 400kts?

Using the back of a fag packet (are we still allowed to do that?) TAS at FL380 for IAS 185 would be about 325kts. I don't know what the wind was so add or subtract as required.

At 185 KIAS, they also have a vertical component of 70 knots, (7000fpm)? So, Ground Speed is affected?

That would be at 2:11:06 for 325kts, from roughly 400kts between 15-50 seconds before?

Probably obvious to the aviators, but this is only 0.4 incremental g above level flight. Add 0.1 g of cobblestone turbulence into the mix, and it is only 0.3 incremental g from the stick to achieve stall warning.
Depending on the pitch rate, this could be the cause of the initial stall warnings.

Litebulbs:

2:10:05 FL350 "sharp fall from 275 kt" 275 at FL350 @ 465TAS
FL375 "speed increased sharply to 215 kt" 215 at FL375 @ 375TAS
2:11:06 ? "15 seconds later" isis 185 kt FL380 @325TAS

Not sure of the significance of TAS but these are my rough calculations.

BOAC;
I realize you're being a bit facetious and that you don't like automation per se, or perhaps the way it has been handled. There is plenty of room I think, to grow with technology, while ensuring a robust critique based upon the experience and knowledge we, as airline pilots have gained. In the early days when we did so, Airbus was not the least bit interested in our input and critique, and actively so. But much has changed since the 90s. Today, there is no percentage in dissing for dissing's sake - one must get on with it. In fact, one risks becoming irrelevant in such dogged pursuits but I hasten to add that there remain wonderful airliners out there which are completely conventional and a delight to fly. I've flown them and truly enjoyed them and trusted them. I would have been quite happy to have retired off the DC8, but we're all along for the ride whatever it is.

It's complicated. For a greater foundation regarding the notions of automation one perhaps has to return first to the military where FBW was not about "protection", it was about capability, clearly a very different motivation than airline flying!

An airline managements' greatest mistake as automation developed, is buying into the (manufacturer's) notion that aircraft automation was all about saving money in training, reducing crew complement costs and 'easing' hiring practises, (not paying for 'expensive' experience because "experience was in the software" kind of idea).

The L1011, being a design from a primarily military designer, incorporated some wonderful notions of early automation, (while it's contemporary competitor's design remained a bread-and-butter, pedantic conventional design, very successful commercially and 'nice-to-fly' I believe but ordinary). The L1011 was a dream to learn and to fly. It came out of the chute CATIIIc-ready; the -500 series came with a brilliant FMC system.

Boeing advanced the notion of "automation" through integration of the FMC and autopilot system. While it was Airbus that took automation into new territory with FBW, Boeing's triple-seven incorporated a deeper level of automation than the B767, (but not nearly as much as the new A320), but Boeing has fully embraced automation in the B787, and they have pioneered CFRP as a primary structural approach. I wished there was a B787 Ops Manual floating around so we could get a detailed look at what level of automation exists and how the standard problems of fbw flight controls have been solved.

The problems are not of technology but of psychology, perception, expectation and the strong tendency to "normalization" as a way of viewing the world. "Normal" is a design feature today whereas it was anything but in the early days of aviation and automation. Error-trapping behaviours..."recursiveness" are some of the characteristic behaviours intended to come to terms with inevitable human "error", for nobody makes Mistakes. Mistakes are the result of accepting one's actions as being "in-concert" with perceived circumstances and events. Otherwise, such actions are "intentional", (rule-breaking, etc) and we already know that pilots never set out on a flight to intentionally make a mistake or have an accident.

Automation does not interfere with this error/threat management process but the "veil of automation", which has been greatly lifted over the past twenty years or so, must continue to be lifted, and it is not solely the pilot who must do such lifting. The question, as we all know, is..."What made sense to the person such that they acted in a way that, in our wonderful way of invoking hindsight bias, "caused" the accident. A corollary to that understanding might be, - To what extent can design, by itself, break causal pathways and still not render such serious threats transparent to the crew? Much has already been done by virtue of continuous changes in software as a result of exchanges with the industry. But it almost seems as if we are at the point of needing a paradigm-shift to next steps.

Machinbird;

Sorry for not expressing myself more clearly. The point I was making is that according to BEA "the plane started to climb" sometime after 2:10:16, whereas 10 seconds of "0.3 incremental g" would give the plane a ROC of 5800 fpm at that point. This is just to illustrate the difficulty I had with BEA's indications of timing, when constructing my 'tentative' time-history.

A paradigm shift
 

Salute!

Well put, PJ.

Seems to this old pioneer with the first completely FBW system that we need to separate the functions that protect the airframe and those that make the plane easy to fly in its intended mission. Our design did both, as with the Airbus, but not to the same degree.

- Gee command increase related to bank angle for a level turn. Same for pitch attitude, as a constant one gee command results in ever-increasing pitch attitude and resulting AoA if speed slows. This makes thing easy for the crew, but I wonder if it reduces "airmanship" and basic skills.

- reduced requirements upon the crew to use trim and train for "unusual" conditions

- control laws that seem to be related to specific portions of the mission, as in "TOGA"

- confusing alarms and cautions when things begin to fail

And the beat goes on.

As all know here by now, I am a big proponent of FBW systems in terms of performance, but not necessarily for making it real easy to get from point A to point B without having basic piloting skills.

Thanks for your views, PJ.

Just trying to picture at what point it stopped being the thing it was designed to be and turned into an object under the affect of gravity as 34 seconds after the last speed reading, it was passing FL350 at -10000fpm and possibly had no forward momentum at all (10000fpm being 107kts), just dropping vertically, wings generally level at reasonably constant pitch attitude, with engines still at 55% and no normal airflow over the stab.

It just does not make sense, but I am an engineer, not a pilot.

PJ - it was not really 'facetious' but a genuine caution against DW's suggestion of putting the a/c straight into Direct when things go awry - it just would not fit with AB OR the airlines psychology, although to a non-AB pilot it seems like a damn fine idea right now.. It is the last phrase of your first sentence that is correct - the 'way'. I LOVE automation - having 'grown up' from an alt hold /wings level A/Plt, work out the drift with Doppler and find the Canary Islands with DR, I progressed to the 737NG. Life became so easy. I had to force myself to throw in a visual arrival here and there, however, rather than let the LNAV/AP take me round an ILS. Loving it does not mean I wish to hand over FLYING to it. How would an AB operator take to crews flying a detail in Direct (however that could be done?) just for 'practice'?

"paradigm-shift" - indeed. My opinions on the training for these systems and the views of management, insurers and accountants have been expressed elsewhere and do not need repeating. If this turns out to be 228 pax dead because the 'automation' confused the hell out of the crew, that would be a crime, whether it be due to inadequate training or 'unexpected' software loops.

Really? It's a bit at odds with what my late prof discovered when visiting Toulouse:

True, but Prof Mellor's visit was in 1993, and the implication is that pilots have been in the requirements-gathering loop since the start of the A320 project.

Now, if you're saying that they weren't interested in input outside the pilots that defined their requirements-gathering group, I don't know. But I do remember the hyperbole that was flying around back then - not helped by the Habsheim clusterfunk, so it's understandable that AI (as they were then) were probably on the defensive. Sorting out the wheat from the chaff when it came to line pilot feedback must have been an unforgiving task.

As I said earlier, I'm not sure. I really think it was an honest look at where the state of the art was in aerospace technology and seeing if that couldn't be turned towards making line pilots' lives easier. "Protections" and safety enhancements were just a way of selling the idea to the public - remember that the A320's development passed through the year 1985, which was the worst year on record for jet-era civil aviation in terms of fatal accidents. Even the quadruple-failsafe 747, arguably the safest design flying at the time, was discovered to have a single point of failure in the case of rear pressure bulkhead damage blowing out the tailcone and ripping out all four hydraulic systems. If the mass of cables and hydraulics could be reduced to a failsafe electronically-controlled system and save a significant amount of all-up mass at the same time, the design decision is a no-brainer.

I'm not sure that was ever the case, certainly not after the Mt. St. Odile accident - the saving that Airbus were pushing to airlines came not from reducing training in terms of aircraft handling, but from the fact that with the A32/3/40 series, the conversion training was completely minimal - almost a case of simply changing the numbers the pilots had to work with.

2-crew aircraft had been a fact of life on short-haul since the days of the One-Eleven, DC-9 and Jurassic 737, and the A300 made it possible on long-haul operations as well (shortly followed by the mighty 747-400). I think that's very important to remember.

The "contemporary competitor's" tale is in fact a classic case of cutting corners in design to attain a commercial goal, in this case beating a competitor to market. I've heard many tales of pilots waxing lyrical about how good the DC-10 felt to fly - and this also illustrates the point you make about what constitutes "Normal". In the case of the DC-10, the designers were so confident that what they were doing stuck to tried-and-true methodology that they suffered a failure of imagination - specifically regarding what happens in the case of explosive decompression in an aircraft of that size.

Hmm... not sure. What Boeing did with the 777 was very similar to what the "q-feel" engineers did in the '40s and '50s, which was take the new technology and implement it, but then use that technology to provide a facsimile of what came before. It always puzzled me in the days of the early AvB flamewars that those who said they were suspicious of the Airbus technology simply because of the fact that they did not trust computers were perfectly happy with the B777, which had all the requisite feel of the older airliners - provided by computer-driven force feedback.


This is true, and AI certainly managed to make a rod for their own backs in terms of their relationship with the piloting community based on their product evangelism and sales tactics in the early days. I like to think that they recognised that was a mistake and have learned from it.

IMO it should never have been allowed to fall in the first place. The industry as a whole reacted to the advent of second-generation automation in a completely dysfunctional way. Not to blow my own trumpet, but I've had some really kind and supportive PMs over the last few weeks we've been discussing this subject, and the common thread has always been "Thanks for explaining it in a way I can understand". Understanding it is not difficult - I'm a layman when it comes to aviation, and until I got hold of a copy of HTBJ recently, a lot of the AoA discussion went right over my head, but when it comes to modern FBW systems in general and the Airbus model in particular, I firmly believe that all the dry language and engineering talk in the books can be boiled down to simple rules of logic by anyone of average intelligence.

In this case it's simply:

Normal Law -> All systems go, you can rely upon the protections
Alternate Law -> There's something wrong - protections will try to help you but if you need full authority it's there.
Alternate Law 2 -> You're missing data required for the protections to work, but you've got full pitch and trim authority via your sidestick and thrust authority via the levers.
Direct Law -> Exactly what it says on the tin.

I didn't intend to suggest that, so maybe I miscommunicated. What I was saying is that as part of recurrent training, pilots should be taught how to deal with controlling the aircraft in Alternate Law and Direct Law reversions so that if it happens on the line itwon't come as a shock.

PJ2
 

One final post at this stage, only in response to your excellent and thought provoking post, before I bow out.

I certainly don't want to get sucked into a philosophical debate about Airbus v Boeing (which admittedly you are trying to "kill off at birth" at this stage by your reference to the automation on board the B777 and also the impending B787) and for which you are far better qualified.

My "gripe" is the present interface between man and machine, which just feels unsatisfactory, and I could write for days on the disaster of manufacturers selling automation on the basis of crew cost savings.

If you are going to start pushing pilot error for AF447 "flying" into a stall and for not "flying" out of a stall, as per the media rush in some quarters upon publication of the 27 May 2011 BEA statement, flight crews simply have to have had a fair amount of (at least simulator) training at "flying" (i.e. direct law for Airbus pilots) at cruise altitude. How many have, to their own entire satisfaction? How many airlines facilitate small aircraft flying for their pilots? The one thing that I would say about many of my former colleagues who flew the Concordes - they were always flying one small plane or another in their own time e.g. Hutchinson and Cook.

To use a B777 example, to avoid Airbus-specific issues, it's easy enough for a flight crew to deal with an ice-blocked RR Trent engine FOHE leading to a single engine rollback at cruise altitude. The test of the interface is when you have a double engine rollback on final approach for the same reason, and whether that flight crew (having mostly been monitoring systems for 10 hours+) reacts quickly and decisively enough to adjust the flaps to at least get their B777 over the airport perimeter obstacles that could prove catastrophic. I am not convinced that there would invariably have been a "happy" outcome irrespective of flight crew (intra-airline, let alone inter-airline - is not part of the manufacturer agenda to keep-up with aviation demand to an extent that would push traditional pilot training resources beyond breaking point?).

My worry with the level of automation, which undoubtedly has prevented "pilot induced" accidents (you only have to look at the statistics), is where it leaves us when things suddenly go wrong and I mean really go awry e.g. such that the flight envelope degrades and the plane is handed over to the pilots in less than ideal circumstances (at night, with conflicting airspeed data, at cruise altitude, in inclement equatorial weather). That is where AF447 should be treated as a wake-up call, because I am not seeing many posts from current commercial pilots to the effect that modern training and SOPs have flight crews all ready for this eventuality.

I have my doubts about how alert and ready Capt Dubois in the LHS would have been, let alone his F/Os, but will keep my own counsel on this (at least until the full CVR transcript is released and we really know what was really happening in that cockpit, particularly as they were stalled and on their way down before Dubois even returned). We will see.

P.s. several old colleagues were devastated when their precious L-1011s were sold to the RAF, and they would vouch for every sentence in your post! Nothing more ever needs saying about the DC-10 being pressed into service (the Paris crash still angers, even after all these years, because of the earlier Windsor Ontario incident with that cargo door) when the Tristar was crippled by the RB211 induced bankruptcy/nationalisation at RR.

According to BEA, "the descent lasted 3 min 30, during which the airplane remained stalled". Since the descent actually lasted 3 min 22, that means the airplane stalled before reaching its apogee of FL380. I use the word apogee because that part of its trajectory was partially ballistic at less than 1g. My tentative trajectory confirms that.

HazelNuts39
 

But when did it stop going forward and just start dropping? The wing stopped working, so the the magic that pushes it up there went, but its inertia was also dispersed, so it fell to earth, no longer being a controllable device, just a horrible loss of life.

It apears to have been recording data all the way down, so it was intact and powered by its main generation systems (not been questioned) in a reasonable stable attitude, just not going forward.

:eek: You meant to say "extraordinary" there, didn't you? ...c'mon... fess up?

grrr.r.r.r.r.r.rrrrr :suspect:

;)

Litebulbs;

It never stopped going forward, the wing did not stop working, it just became very inefficient, producing more drag than lift.

Maybe when it was at FLxxx, but not down low and it goes back to GS107 equaling 10000fpm ish.

PJ2 & Gums - Nicely put..

Just to add some quotes from two publications well worth the read, and particularly relevant.

Nancy Leveson (Safeware - System safety and computers -1995)

Computers and other automated devices are best at trivial, straightforward tasks. An a priori response must be determined for every situation whereby an algorithm provides predetermined rules and procedures to deal only with the set of conditions that have been foreseen. Not all conditions are foreseeable however, especially those that arise from a combination of events, and even those that can be predicted are programmed by error-prone humans.

Sidney Dekker (The field Guide to understanding Human Error -2006 ) in his preface nicely sums up his 'New View' of human error as follows:

What goes wrong:

Human error is a symptom of trouble deeper inside a system. To explain failure, do not try to find where people went wrong. Instead, find how people's assessment and actions made sense at the time, given the circumstances that surrounded them.

How to make it right:

Complex systems are not basically safe. Complex systems are a trade-offs between multiple irreconcilable goals (safety and efficiency). People have to create safety through practice at all levels of an organisation.

Note: N Leveson is Boeing Professor of Computer Sc at the University of Washington. NASA advisor on the Shuttle software development process.

S Dekker is professor of human factors, School of aviation Lund University Sweden. He is also has experience as a pilot, type trained on DC-9 and A340.

BOAC;

'k, that clarifies and d'accord with your historical views as well...shoulda known.

A fbw system is inconsistent with the simplistic notion of the 'big red button'. The B777's reversion has never been discussed here but it does not have such a reversion either, although it is closer to DozyWannabe's notion.

DozyWannabe;

Thanks for engaging the broader (off-topic?) view. I'll respond to the first point and think about the others!

When I initially checked out (and upgraded as captain at the same time) on the A320 in 1992, the airplane still had the "Interim Standard", which did not have VNAV. The only AFS descent regimes were IDLE/OPEN DESCENT, SPD/HDG-VERTICAL SPEED or much more rarely SPD/TRK-FPA, (rarely used, because the descent from cruise was not the place to use a "path-oriented" tool that had not calculated the ToD. One could just hand-fly the descent which I did most of the time including ATs off.

Although the airline wanted its full time use, (from "just after takeoff 'til the end of the landing roll", was the SOP in the first manuals until we simply fought back and got it changed), automation was just a tool, in my back-pocket to use "when-if". That was my (cantankerous?) attitude then, and it didn't change when I retired off the A330/A340. Just to be clear because there's a lot of "I" here, I'm describing what was the case at the time, and not "holding court"...I don't like such behaviours but sometimes one has to speak out of personal experience.

So learning the airplane was a challenge and re-learning it when the "Full Standard" was introduced some time later. We got real FMGECs for the first time and the air was full of "what the hell is it doing now?". But disconnection was the rule because all the guys had flown the Lockheed, Douglas and Boeing equipment and knew, and flew it like a regular airplane and engaged the AP/AT when happy.

During that initial period we saw a lot of "why did they [Airbus] do this?" moments. We received a few visits from AB during the introduction of the airplane into the fleet. At meetings which the entire group of guys (who weren't flying) attended, we provided our feedback from our experience. I don't want to fully describe the engagement and reception but it was dismissive and even arrogant and it was that way over a long period of time. I was so frustrated at not getting answers or an ear that I went to other sources and found someone at the FAA who not only had an ear but participated in the certification work for the airplane in the US, so he knew what he was talking about. He's the guy who landed the airplane in Direct Law on manual THS trim only, just to see. We carried on a rich dialogue for a few years until I lost track but it was our experience as experienced pilots but new on the A320 that Airbus never came to the table to listen.

They may have had their "study group" and I've heard ET talk which I thoroughly enjoyed but it was a long time before AB began to actually listen to the end-users. That changed over the years, for reasons.

The documents posted by PerkyPerkins bear very careful reading, especially the parts about stall recovery and especially the parts regarding simulator work in reproducing states beyond "normal". I highly recommend this reading.

I completely dismissed as more public nonsense and talking without the benefit of actual evidence, the Spiegel article and professor Hutig's comments because, for reasons, I already knew that simulators were GIGO devices but that simulators replicate quite well, normal aircraft and system behaviour. We need to be far, far less credulous when reading what the media has to say about this accident. Shields and Crap Detectors need to be fully deployed!

Got to go.

ventus45, your cross control theory is intriguing.

(Wouldn't the pilots feel the yaw displacement as well as the roll if the rudder was out when the ap went off? It should be in a trimmed position up until the AP goes off, so quite possibly no kick and no roll). What could happen, however, is that as the aircraft changed speeds, the rudder may not be in correct position for the new airspeeds. If you aren't on the pedals, a yaw/roll moment could develop if the aircraft isn't trimming or finding new positions for the rudder by itself.

To that one can factor int a case of mild vertigo for PF, a pilot used to the incredibly smooth balanced flight modern airliners are capable of providing.

The RLU position may not be so hard to explain:

by the time the controls were passed, it is likely that the (originally PNF) now in control pilot used both hands and feet to try to recover, so it's hard to say if the Rudder was displaced many times before impact, or perhaps stuck on high and remained stuck. With the THS remained stuck ... it can lead one to a symmertrical line of inquiry.

3holelover;

oops, yes, extra...ordinary, yes, that's what I meant...really.

;)