PPRuNe Forums

PPRuNe Forums (https://www.pprune.org/)
-   Tech Log (https://www.pprune.org/tech-log-15/)
-   -   AF 447 Thread No. 6 (https://www.pprune.org/tech-log/460625-af-447-thread-no-6-a.html)

HarryMann 27th September 2011 21:03


It doesn't require the complex system to in fact break, or for you to forget your training, to introduce the possibility that a stressed human mind trying to start to appreciate an unanticipated possibility never achieves sufficient confident to diagnose and then act. The awareness of a complex intervening layer is in itself sufficient to frustrate intelligent problem solving, at least in a timely way.

Something to consider, for sure.. that intervening layer is always a 'head' problem


A 'big red button' which forced direct law, with direct law behaviour a set of memory items, would seem a reasonable last resort to offer a bemused crew.

Not forgetting appropriate display of unusual trim conditions and cancellation of any warning cancellations, naturally.
Radical, but reasonable

Lonewolf_50 27th September 2011 21:38

Dozy, is it your position that only the PNF was operating under the awareness that the aircraft was in Alternate Law? I do not think that what has been released from the CVR supports that position. As a number of others have noted, we have no access to various non-verbal communication that went on between them.

Further that point, given the difficulty PF had initially with roll control, one can be fairly certain that he was all too aware that he was in Alternate Law.

The more cogent point made is what BEA seems to have addressed in its findings of how and what preparation, training, and comfort with flying in Alternate Law at high altitude the crew had to fall back on. One could couple a "recency of training data point" to link to the choice to select TOGA ... which takes us back to Lyman.

If his mindset was overspeed, applying TOGA does not seem to fit the problem he was trying to solve.

Diagnostic 27th September 2011 22:54

@Lonewolf_50:

I'm not trying to reply for Dozy, but I wanted to add a comment:

Originally Posted by Lonewolf_50 (Post 6722227)
Dozy, is it your position that only the PNF was operating under the awareness that the aircraft was in Alternate Law? I do not think that what has been released from the CVR supports that position.

IMHO the lack of an acknowledgement by the PF (according to the CVR transcript) to the PNF calling Alternate Law does leave open the possibility that the PF had not really "heard" that statement.


Originally Posted by Lonewolf_50 (Post 6722227)
If his mindset was overspeed, applying TOGA does not seem to fit the problem he was trying to solve.

Agreed, but later he deployed the speedbrakes, which therefore does fit with an overspeed mentality. My view is that the PF's mental picture may have changed (perhaps multiple times) during the whole event sequence, which would therefore explain the seemingly contradictory actions - they were not contradictory at the time he did each one, as his mental picture of the situation had changed in the meantime.

In other words, if we consider that he may just have been trying several different actions because he didn't have any confidence of his diagnosis, then it is perhaps easier to understand why, during the whole event sequence, he did seemingly contradictory things like TOGA and later speedbrakes.

That's my current "model" to try to explain the PF's varied actions. Does this make sense as a possibility?

Lyman 27th September 2011 23:51

Diagnostic

Yes. It is possible PNF was alerting PF to AL with loss of RAS, as a second, and more determined way of getting the PF in AL 'mode'. Most of PNF's comments were of this type: "Watch out..." "Less Lateral..." "Loss of speeds......Alternate Law". He was, if not the scold, the short fused "instructor", albeit seemingly with good motive.

Yes, again. PF's seeming variable mind set re: overspeed/STALL occurs in a domain where they are not radically different in value. At least initially. We must not forget that the aircraft at a later time warned him of impending STALL each time as he was about to recover. We do not know yet, but at many times post a/p loss the a/c and PF were at odds, as PNF was with PF. Finally, with the arrival of the Captain, who seemed of no use, was there any time after the loss of autoflight that any one was on the same page as the others?

With such a fundamental lack of basic airworthiness, it at times seems bizarre to focus on details...... To what effect?

He did deploy brakes. He was ready to a second time, in presence of Captain, when Captain said "No, do not use brakes". For all we know, it was the lack of a complete stow of a starboard side spoiler that caused the chronic Right Wing drag/drop.

Do we know exactly when Alternate Law 2 selected?

RR_NDB 28th September 2011 00:46

Stimuli in order to be able to analyze a/c "behavior"
 
Hi,

A lot of sense considering he was always trying to "understand".




jcjeant 28th September 2011 00:48

Hi,

You know .. PF's actions may well be the result of his ignorance of the phenomenon that came to him.
His state of mind can be that of someone who does undestand nothing of what happend
And therefore he will do actions that are actually testing and according to results .. do other activities .. hoping that one of them will be good to solve the problem he could not analyze
OT .. but ...
This reminds me a auto crash stop on a diesel generator
The group suddenly stopped and the engineer in charge has undertaken many tests dismantling and replacement parts
Having to resume investigations .. I immediately understood by examining the log data measures engine parameters. that something unusual had happened at the oil system (temperature and pressure)
An worn lubricating oil pump was the problem and not the fuel injection system and turbo blowers that had been dismantled ...
The other mechanic was therefore not understood and therefore tried anything
If he was lucky .. it would have started with the oil system ..
This was not the case ....
A loss of 8 hours of time and money .

Lyman 28th September 2011 00:57

In an emergency, not knowing what to do comes from not knowing what you face. Not knowing what you face is caused by a lack of, or misleading, cueing.

It is not helped by not knowing what one should do if one knew to do it. That is not aided by having to read something to try to understand what it is one does not know. If three of you do not know, the airplane will do what it does, whether you know what that is or not.

If you do not know what the airplane is doing, you should be home playing rummy. If the airplane is coy, or misleading, that can be judged as lack of skill in understanding what it is supposed to do, unless something comes up that the aircraft cannot do, in which case the three who do not know will be blamed for not doing what they didn't know to do in the beginning.

The fact that the airplane and by proxy her designers, did not know, is not important, for they are not present, only the evidence of their work is.
The mistakes they made can be corrected with new work that can be added to the aircraft and utilised until the aircraft once again comes across something it cannot do, and the pilots will be required to understand immediately what it is they do not know, and most likely were not carefully taught.

Repeat........

RR_NDB 28th September 2011 01:07

Contrary to Airbus SAS philosophy?
 
Hi,


Mr Optimistic

A 'big red button' which forced direct law, with direct law behaviour a set of memory items, would seem a reasonable last resort to offer a bemused crew.Not forgetting appropriate display of unusual trim conditions and cancellation of any warning cancellations, naturally.


Dificult to imagine a change in their minds to implement this (very reasonable) last resort. :E "Collision" of K.I.S.S. x K.I.C.S.

Complex Systems can deliver, at certain situations, Stupid outputs. Again the old "Testability issue" of Complex Systems.

Diagnostic 28th September 2011 01:36

@ RR_NDB and jcjeant:

Agreed, yes - one interpretation is that the PF was basically "trying things", to see what happened, at least on some occasions (e.g. the speedbrakes). I had written something very similar in an earlier draft of my posting, but I deleted it, to try to be brief :) So we're thinking along similar lines, I believe.

From that standpoint, the various actions from the PF make a little more "sense" IHMO. If he was indeed in that "let's try X and see if it helps" mode, then perhaps the intermittent stall warning helped to drive & reinforce exactly the wrong actions from him. As I think most people agree, on some occasions, it seems that he stopped doing the correct (ND) inputs, when the SW started to sound, as if he was "testing" his ND actions, to see if they helped, without the real "belief" that this was the right thing to do. (Before anyone says it, yes, I know this doesn't explain the lack of apparent recognition / acknowledgement of the 50+s of continuous stall warning initially. :confused: )

@jcjeant - re your OT: I have seen many similar examples of that type of poor troubleshooting too :( Yours is a good example of someone guessing at a (wrong) diagnosis, and not confirming that it explains the available data (e.g. oil temperature & pressure). Thanks for that story.

Lyman 28th September 2011 01:46

Won't "They" merely repeat that Direct Law is available anyway? Why the Button?

Wouldn't "They" be correct?

As far as cancelling the cancellating logic and eliminating the current obligatory autotrim into STALL, and adding BUSS (they did), and a workable AoA cueing system, that will be done, assuredly. But it will be acknowledged as "probably not really necessary anyway". Won't it?

I suppose in the end, after all is said and done, arrogance is not that lethal, the statistics show us that. Don't they?

mm43 28th September 2011 05:12

When the PFDs are changed (as per A380) to provide conclusive evidence of where the side-stick is, who has got control, along with rudder pedal position and AoA indication - then the "big red button" will be redundant.

http://oi54.tinypic.com/33pap6q.jpg

If the AoA scale is colored "red" to the top, one would need to believe you are stalled. SS down while keeping wings level and get the nose down and keep it down until the AoA is back under 5 degrees.

On the otherhand, with PFDs as shown above, you'd be hard pressed to get the aircraft into a stall. "Human Factors" notwithstanding!

RR_NDB 28th September 2011 13:34

Crew decision (and not automatically decided by the System)
 
Hi,

mm43 @ #1005


...then the "big red button" will be redundant.


I would prefer to decide when to use the last resort. My understanding of "big red button" is of a resource not offered automatically by the System. A resource to be used when i decide to "fire" the System. Then starting to use the System just to provide what i will need to "hand" fly the a/c.

The "reconfigs" after that could (should) be implemented gradually, eg THS, etc. and presented to the crew.

CONF iture 28th September 2011 17:02


When the PFDs are changed (as per A380) to provide conclusive evidence of where the side-stick is, who has got control, along with rudder pedal position and AoA indication - then the "big red button" will be redundant.
mm43,
Correct me if I'm wrong, but I don't think it is how the 380 is equipped ?
To me it is more the kind of Animation you can obtain from FDR data.
What is seen as "big red button" is a simple way to force Direct Law and benefit from a more 'conventional' aircraft.

Lyman 28th September 2011 17:45

The concept of leaving AB Flight Laws behind, and with the select of a button, at that, is an odious proposal.

It infers that the simple, "DIRECT" method of flight control is superior to that of laboriously designed degrading (cascading?) electronic systems that are inferior to manual control in certain situations: THEY ARE.

This is all about PRIDE, and TURF, and MARQUE.

Nothing to do with flight control, or safety.

Lonewolf_50 28th September 2011 18:22

Diagnostic.

Agreed, but later he deployed the speedbrakes, which therefore does fit with an overspeed mentality.
Later, yes. Agreed.

My view is that the PF's mental picture may have changed (perhaps multiple times) during the whole event sequence, which would therefore explain the seemingly contradictory actions - they were not contradictory at the time he did each one, as his mental picture of the situation had changed in the meantime.
Yes, that is a very good way to present the event from his perspective. He kept tyring to fit what was happening into a mental picture that he recognized. It seems he never succeeded.

In other words, if we consider that he may just have been trying several different actions because he didn't have any confidence of his diagnosis, then it is perhaps easier to understand why, during the whole event sequence, he did seemingly contradictory things like TOGA and later speedbrakes.
Yes.

That's my current "model" to try to explain the PF's varied actions. Does this make sense as a possibility?
Makes a lot of sense to me. :ok:

mm43 28th September 2011 20:35


CONF iture,
Correct me if I'm wrong, but I don't think it is how the 380 is equipped ?
You are of course right! Though I suspect that with the twin PFDs that a similar configuration is available when the correct page(s) is/are selected.

Strangely, the image was part of an Airbus power-point presentation on their revised Stall Recovery Procedure.

Diagnostic 28th September 2011 21:18

@Lonewolf_50:
Many thanks for your comments. :) I think it will also be very interesting what the human factors part of the final BEA report says. IMHO sometimes CRM in critical situations works well (e.g. Sioux City UA232), and sometimes it doesn't, like here :(

I'm lucky in my job that I'm often working with engineers who I have worked with before, which makes it easy to build-up knowledge of each other's strengths & weaknesses, and act accordingly to speed-up the process of reaching a common goal. I can only imagine how difficult it is to work on a flight deck, potentially with people you've never (or only rarely) worked with before, and where you could be put into a time-critical troubleshooting situation at any point. :eek:

CONF iture 28th September 2011 22:04


Originally Posted by mm43
Though I suspect that with the twin PFDs that a similar configuration is available when the correct page(s) is/are selected.

I would seriously doubt that.
It would be, after all this time ... an implicit acknowledgement that sidestick input information is valuable after all, or even worse, could be necessary.

Thanks for the link.
I would rather think that the slide in question must be just an extract from a full video animation.

DozyWannabe 29th September 2011 17:03


Originally Posted by CONF iture (Post 6724036)
It would be, after all this time ... an implicit acknowledgement that sidestick input information is valuable after all, or even worse, could be necessary

Which would be a problem why? Airbus are not the arrogant shysters you seem to think they are - they'd never have put that stall article in their safety journal if they were. The fact is that yes, in some situations some kind of input representation could be useful, but the majority of the time it is not especially so.

To my recollection there has been precisely one non-fatal incident and one accident where it might (stress *might*) have been useful for the PNF to see what the PF was doing with the stick. That's not many bearing in mind we're talking 23 years of FBW Airbus service these days...

I don't see why the "big red button" is coming into the discussion again either - this was not a "what's it doing now?" accident. Indeed the aircraft effectively gave them the BRB effect - giving the pilots full authority plus autotrim in Alternate Law, which at least one of the pilots mishandled. I'm loath to go back to what I was saying several threads ago, because I don't want to induce a hamster wheel effect, but this kind of accident has happened in non-automated aircraft as well - I don't think the FBW had a hand in this case either. Some may disagree, but so far there has been no evidence to support that assertion.

Lyman 29th September 2011 18:28

Yes, I agree, they are not shysters. However, one expects better than one out of two, in Aviation.

CONF iture 30th September 2011 00:57

'shysters' - No. Did I say so ?
'arrogant' - Not wrong. But over confident would be more appropriate.


Originally Posted by DW
To my recollection there has been precisely one non-fatal incident and one accident where it might (stress *might*) have been useful for the PNF to see what the PF was doing with the stick. That's not many bearing in mind we're talking 23 years of FBW Airbus service these days...

  1. What are, in your mind, those 2 events ?
  2. Why, in your mind, it *might* have been useful for the PNF to see what the PF was doing with the stick ?

RR_NDB 30th September 2011 17:46

Finite-state machine in FBW a/c
 
Hi,

FBW is clearly a way to optimize an a/c. (weight reduction, easier to design with redundancy, etc.)

Question for EE and pilots acquainted with Digital FBW a/c:

The problems arise when the machine (a/c) enter some certain states?

E.g.: TAM 3054 overshoot, AF447 first with THS "going" to 13 degrees NU and later presenting erratic SW indications. These planes entered exceptional "states"?

May we consider these planes "entered" strange states difficult to be understood (almost impossible in short time) by crews yet submitted to abnormal and stressful situations?

In non DFBW these "strange states" are rare. The NW 6231 727 (Thiells) Pitot's "memorized pressure due icing" misleading the entire crew. Perhaps we can say the plane entered an "strange state" with it's Pitot's "showing" altitude (instead the speed) to the (astonished) crew.

In summary, my 1st question is:

State machines concept may explain several cases where the crew was not able to even understand what was going on?

Observe the issue is not FBW (a good approach) but how we "protect" the plane using "finite States machines". And Airbus SAS pioneered this.

A possible 2nd question is:

Is it possible, by training, prepare the crew to timely understand (the strange states) and act accordingly?

Are we capable to preview the "strange states" the complex machines (full of protections) may enter?

Lyman 30th September 2011 18:37

An excellent, excellent question.

The bottom line here in this entire discussion re: AB fbw, is that it is highly functional in virtually all its iterations when confronted with straight forward challenges to remaining in the air.

If no one else has figured this out, the problem arises, as it does with ALL aircraft, when the monkey grabs the football.

Airbus have this less figured out than other types, and their arrogance in admitting to it is still killing people.

Abnormal situation requires abstract and intuitive action.

NOT ALTERNATE. Bowing to ALTERNATE solutions is killing us.

We don't need ALTERNATE, we need CUSTOMIZED.

And CUSTOMIZATION comes from the cerebellum, not the thirty year old chip, programmed by people who still do not "get" ABNORMAL.

One cannot anticipate that which he has no experience with.

Zorin_75 30th September 2011 18:57


Is it possible, by training, prepare the crew to timely understand (the strange states) and act accordingly?
Nose pointing up, plane going down, blaring stall warning. Very strange state. Maybe they should teach that in flight school.

Lyman 30th September 2011 19:13

I've done that, in flight school. It is an odd regime, and it was shown to me by my instructor. I still remember it. "Hold back stick". WHAT?

Did any of the crew on 447 experience such an attitude? Ever?

As above, To get creative, one needs to have some confidence in a solution, not grab at straws.

To get where you need to be, to save your life, one needs to know where one is.

RR_NDB 30th September 2011 19:13

Reality is richer than any Design could anticipate
 
Hi,

With highly capable pilots instead of just "trained operators".

IMO the training requirements are much higher when operating complex machines.

Unless you think (erroneously) everything can be previewed by engineers during design phase.

Perhaps "IT people" influence on Airbus SAS Design approach was excessive.

Many years ago a friend (ex. Air Force one pilot and Safety Board Head) told me: A good pilot must always call his plane by "Sir". With a lot of respect.

An a/c using Finite States Machines in their Systems design approach IMHO requires much more respect. You must be very careful (and respectful) with it.

Their behaviour is never completely understandable. The old "Testability issue" of Complex Systems.

Lyman 30th September 2011 19:20

Testability

The a/c cannot be tested in these places, but her pilots can be....

To stay ahead of one's aircraft requires one must know more than she.

DozyWannabe 30th September 2011 19:44


Originally Posted by RR_NDB (Post 6727320)
Perhaps "IT people" influence on Airbus SAS Design approach was excessive.

The "IT People" (actually real-time systems architects and engineers, and among the best in their field at the time) simply implemented a set of specifications from the aeronautical engineers, who themselves consulted with pilots, in exactly the same way that electromechanical engineers have always done in aviation.

Philosophically speaking, the computer specialists only dealt with the "How" - the "What" came from the same people it has always come from.

Airliners have always been complex systems, and have only grown in complexity over time. I suspect very few pilots during the middle decades of the last century knew exactly how the Q-feel system on their Comets and 707s worked, and I'm pretty sure even fewer pilots knew how advanced avionics suites such as those on the Trident and L-1011 worked. The only difference between that generation and the current generation have been how the various systems were implemented, but this will always come up against a seemingly innate human distrust of technology. I wonder how many of BEA's "old guard" took great exception to the (then) new-fangled autoland system, for example.

Lyman 30th September 2011 22:44

The complexity is by and large manufactured of whole cloth. In addition, in dumbing down the threshold of operation, the "complexities" become sequestered in myth, and therefore become unmitigable by tacit agreement; operators will not be trained to them.

No one is better able (potentially) to handle a dynamic situation than the one who is present. To suggest that solutions have already been discerned for every possibility, and Programmed into an airplane, is not only myopic, it has the aroma of Death about it.

Case in Point. "We think Auto Trim UP into a Stall is a solution." On what Planet? Rather than allow that, why was it not aggressively disallowed? Yet in overspeed, the THS is locked in place, when at least arguably, it has a function in correcting PITCH to corral speed.

Independent of training level, how is that desirable?

Explain?

CONF iture 1st October 2011 01:29


Case in Point. "We think Auto Trim UP into a Stall is a solution." On what Planet? Rather than allow that, why was it not aggressively disallowed? Yet in overspeed, the THS is locked in place, when at least arguably, it has a function in correcting PITCH to corral speed.
That’s even worse Lyman, under Normal Law, the system logically thinks it’s time to cancel autotrim by reaching Alpha Prot or slightly above, but when the situation has degraded and Alternate Law is active, the system thinks it’s smart to autotrim all the way whatever the Alpha …

Airbus : If you think you have some doubt about the data you receive, just keep things simple, degrade all the way straight to Direct Law. Make things easier for your crew. Airplanes fly well in Direct Law too ... including yours.

Cool Guys 1st October 2011 01:29

Simplicity
 
While on the subject of simplicity I would like to butt in if I may.

I can understand how the pilot on AF447 reacted in the way he did. I can’t say that I can explain it but I can understand it. Years ago I pushed the wrong button when my colleague got his fingers caught in a machine. I switched the Run Switch to the “off” position rather than hitting the Emergency Stop button. The Run Switch stopped the machine after its present cycle. The Emergency Stop instantly cut all power. At the point where my colleague got his fingers stuck I had 5 seconds to hit the Emergency Stop to prevent a blade from slicing his fingers off. In the rush I switched the wrong control (I pulled the stick back rather than push it forward). I realised my mistake and I quickly hit the Emergency Stop. Fortunately I reacted fast enough and my colleague still has his fingers.

In the above example I had complete understanding of these controls because I designed them, but I had no practical training on what to do in this circumstance so I did the wrong thing when I needed an instant reaction. However because of my understanding of the controls, and because I had sufficient time, I was able to save the day. Practical training gives you a natural reflex to do something quickly in an emergency situation but understanding gives you the ability to think about the situation and work out what is the right thing to do even if you have not been trained on the procedure. Understanding is gained by theoretical learning and quick response is gained by practical training, actually doing what you should do in real life when a emergency situation occurs.

However these 2 things are related. Training helps understanding and understanding helps training. Sully was not trained on water landings but due to his in depth knowledge he was still able to perform the feat. When learning a complex process you need both. Simplicity is also a factor. After this incident I changed the layout of the front panel including making the Emergency Stop more prominent and simplifying the layout. I simplified the interface. A machine operator or pilot has better things to think about than excessively complex controls. A pilot definitely has many other things to think about. If something is simple it is easier to understand and it is easier to train people on. It is like these 3 things form a triangle. Understanding – Training - Simplicity. You need all 3 sides. If you increase one you naturally increase the other 2. If you reduce one you reduce the other 2. If you make something simpler the person’s understanding will be better and it will be easier to train him. If you make something more complex the person is likely to have a lower understanding and it will be more difficult to train.

A group of semi knowledgeable people generally make things overly complex. One single knowledgeable person can generally make the same thing more simple.
It is easier to make something complex than to make it simple. Unfortunately it is easier to make a complex interface than a simple one.

Obviously an aircraft control system will be a complex system but it should not be made more complex than what it needs to be, and even if someone has done all that is required to get everything totally sussed, surely he would be better off working out how to get laid by his wife than to work out some overly complex interface.

RR_NDB 1st October 2011 03:40

K.I.S.S. design rule
 
Cool Guys

The rule is here:

KISS principle

And the best phrase, IMO:

"It seems that perfection is reached not when there is nothing left to add, but when there is nothing left to take away"

From Antoine de Saint Exupéry, writer and also an aviator.

gums 1st October 2011 04:25

State machines, training and "touch"
 
Just had to get my barb in for Doze, heh heh. And support RR.


The "IT People" (actually real-time systems architects and engineers, and among the best in their field at the time) simply implemented a set of specifications from the aeronautical engineers, who themselves consulted with pilots, in exactly the same way that electromechanical engineers have always done in aviation.

Philosophically speaking, the computer specialists only dealt with the "How" - the "What" came from the same people it has always come from.
Basically, Doze has it right, to a point.

As a systems engineer after I hung up my g-suit, I wrote the specs and the sfwe folks "coded" it. None of the sfwe "engineers" in my company knew squat about aero or mech or actual piloting. No big deal. They were used to dealing in "abstracts" and sfwe design, not a physical system that was to be implemented or simulated in sfwe.

I was their worst nightmare!

I was an aero/EE guy from school, and was a no-kidding pilot with no small amount of experience in various jets. I had also done sfwe work for a few things during my career as a pilot.

I had to explain frame rate requirements due to hysteresis of the mechanical gyro/gimbal platforms and seeker heads of missiles. The old analog systems did the trick via their basic design and had negligible lag as the digital systems had with their frame rates. So we "smooth" the data for control and display. Big deal. But we also had to deal with real world body rates and maybe tgt motion for a weapon and so on. So some functions had to run at very high frame rates while others could lope along at 10 Hz.

enuf background.

As RR says, a finite state machine will react to inputs with very deterministic outputs/actions. That was my company's philosophy for armament control and display systems, and our designs were very easy to validate thru testing. The good news was our systems were easy for the human operators to understand and operate. Our sfwe was not trying to be "intelligent", and "guess" what the human wanted to do.

So I have to throw my lot with the folks that postulate the AF447 crew was presented with conflicting displays and aircraft reactions to their control inputs, and they did not know with certainty what was really happening. Further, their training seemed to emphasize all the FBW protections and the cascade of control law reversions that attempted to retain bank angle limits, pitch angle limits, AoA limits ( read Alpha prot), mach/overspeed warnings, etc. Sheesh!!! Think you would be confused?

Make no mistake, I do not advocate a simple, direct control of the various aero surfaces such as some here believe would save the day. Even the old, old mechanical systems used mechanical/hydraulic components to limit surface deflections and their rates of deflection.

My problem has always been with the "autopilot" type functions and protections that seem inherent in the 'bus FBW design and its reversion modes. For Chrissakes, the jet seems to be extremely stable and docile. Without the autopilot engaged, it should handle just as any large jet. It should also handle well if airspeed/ "q" inputs are lost. But this is where training enters the equation. How does the jet "feel" when most of those "protections" are gone? And worse, what "protections" are still there? So there needs to be a clearly defined reversion sequence that the pilots are trained to deal with, and the more simple, the better, The finite state machine RR and I refer to.

Zorin_75 1st October 2011 08:15


but when the situation has degraded and Alternate Law is active, the system thinks it’s smart to autotrim all the way whatever the Alpha …
More precisely, in this state the system thinks it's less smart than the pilot therefore it will do as told without protest.
All these discussions about complex systems are certainly not without merit, but do you think it is a fair assumption this crew would have fared better in a 757?

rudderrudderrat 1st October 2011 09:09

Hi DozyWannabe,

this will always come up against a seemingly innate human distrust of technology
We never distrusted the technology - but were ready to take over when it failed. When it failed and the AP dropped out, the aircraft felt very familiar because it only had the one manual flight Law (Direct).

Why design a series of sub laws which the pilot very rarely experiences or has the opportunity to practice?

RR_NDB 1st October 2011 15:04

Combinational logic x Sequential logic
 
In Combinational logic " the output is a pure function of the present input only". E.g. the (interlock) micro switch on the door of a Cessna prevents flaps activation.

In Sequential logic the "output depends not only on the present input but also on the history of the input". F-GZCP System "memorized" PF initial NU, maintaining THS at 13deg til the end of the flight.

In TAM 3054 case both pilots didn't understand timely the system output (combinational logic).

Combinational and Sequential logic can help decisively but unfortunately may generate "difficulty to understand" in certain situations specially if you add human factors to the issue.

Not present among us, you know. Most here are open minded professionals always trying to do the best. Using technology and ALWAYS checking it for a "quality control", in a constant "questioning". Something VERY USEFUL for any Project as an important and necessary feedback.

Lyman 1st October 2011 15:55

"Seeming innate mistrust of technology."

That is a euphemism for "what do you know, my concierge can fly this a/c."

It is out of place here, and harkens to a lay attitude.

Fly by wire is not anything but a new (if thirty years old tech is "new") way to control an aircraft.

It is faster, and generally more responsive and efficient than a human being. It can fly a/c that are unflyable by humans.

Stop. It is also a quick way to the graveyard whilst whistling Dixie if the programming is put together by numpties.

It is a TOOL. A wonderful TOOL. But a TOOL. Those who think it can be operated in fluids without great care are dangerous.

DozyWannabe 1st October 2011 17:42


Originally Posted by rudderrudderrat (Post 6728079)
We never distrusted the technology - but were ready to take over when it failed. When it failed and the AP dropped out, the aircraft felt very familiar because it only had the one manual flight Law (Direct).

I think it was in fact a little more complex than that once you got down into the actual implementation of the design - routing hydraulics, electrical systems and the like. As I said quite a while back, it was only when digital computers started getting involved that the distrust became more vocal, because you had a generation of pilots for whom computers were known as either big number-crunching machines in rooms (which is how they were in real life), or cold, logical machines that frequently went wrong and threatened lives (as they were consistently presented in fiction).

Human psychology is a weird one in that the collective memory can sometimes distort the reality of a situation with cultural perception - this is why I get so mad when people refer to the FCU system as "HAL", because I know that the reality of the former is a million miles from the cultural perception of the latter (which was, after all, a fictitious construct based more on an outgrowth of Asimov's laws as opposed to reflecting any kind of reality). I could go into mind-numbingly dull detail on the subject, but I'll spare you guys that (for now!).


Why design a series of sub laws which the pilot very rarely experiences or has the opportunity to practice?
Firstly, there are only three "Laws" that deal with computer-assisted flight (with the MAN TRIM ONLY fallback when everything is out). Alternate is a single law with variations based on the type of failure the aircraft has suffered (in much the same way as failures of specific systems on older designs meant variations in how to deal with those failures), and all you really need to have at the front of your mind is that if you're outside of Normal Law, you don't have any hard protections - consequently the aircraft must be handled as carefully as if it were conventionally-controlled with no protections. Sustained hauling back on the sidestick outside of Normal Law is therefore as much of a no-no as sustained hauling back on the yoke in a conventional aircraft.

Secondly, pilots *are* supposed to practice them (note PJ2's insistence on practicing all modes in the sim, up to and including MAN TRIM ONLY). ColganAir proved that you don't need an all-singing, all-dancing digital flight control system to lull airline training programmes (and the pilots they produce) into a false sense of security when it comes to stall/upset recovery. Thus we get into a bigger problem that affects the whole industry, whereby many of the MBAs that run the airlines and the accountants that provide the balance sheets do not understand that if you cut training costs, you're shaving the safety margins ever further and increasing the risk that there may be people at the controls who will fumble a recovery in an emergency.

The '90s downturn led to the beancounters shaving the maintenance budgets, which in turn led to an Alaska MD-80 falling into the Pacific, and an FAA crackdown. It seems that in response to that their next move was to shave the training budgets, which is just as dangerous - but the effects are slower to materialise - and it's much tougher to prove that a crash caused by pilot error can be traced back to lackadaisical training than it is to prove a stripped jackscrew was caused by shoddy maintenance.

Lyman 1st October 2011 18:02

Talk about Hamsterwheel.......

DozyWannabe 1st October 2011 18:09


Originally Posted by RR_NDB (Post 6728490)
F-GZCP System "memorized" PF initial NU, maintaining THS at 13deg til the end of the flight.

The system (by which I mean the flight controls) only "memorised" it because there was not a consquential opposite command to move it the other way, either from the sidestick or the trim wheel.


In TAM 3054 case both pilots didn't understand timely the system output (combinational logic).
Well, there were procedural complications in that case. The original "reverser inoperative" procedure called for the thrust levers to both be placed in idle and only the engine with the working reverser to be placed into reverse. Airbus discovered several incidents where the lever to the engine with the inoperative reverser was not pulled to idle, extending the landing distance considerably and risking an accident.

As such they came up with a new procedure where both levers were to be pulled all the way through flight idle to reverse on rollout, which made the problem go away, but led to a slight, but noticeable increase in landing distance as the engine thrust on the side with reverser inop would increase, inducing forward thrust on that side.

The TAM crew knew of this latter procedure and indeed used it on the previous leg of the flight, as evidenced by the FDR traces - however the Conghonas runway was short and known to be treacherous, especially in wet conditions. The logical theory is that the very experienced Captain knew of the increased landing distance that the new procedure caused and elected to use the old procedure, ironically, to give him an increased safety margin given the atrocious conditions at Conghonas that night. Unfortunately the crew made the same mistake that had caused that procedure to be revised in the first place and the rest is history.


All times are GMT. The time now is 09:30.


Copyright © 2026 MH Sub I, LLC dba Internet Brands. All rights reserved. Use of this site indicates your consent to the Terms of Use.