Dec 18th 2011, 12:20 by N.B. | WASHINGTON, D.C.
LIKE many business travellers, Gulliver has long maintained an interest in the crash of Air France flight 447, which plunged into the Atlantic between South America and Africa in June 2009. In May, we linked to Wil Hylton's terrific New York Times Magazine piece on the crash, and in March we highlighted a colleague's thoughts about what might have gone wrong. This colleague, who writes for the Babbage blog, was ultimately proven largely correct: the evidence from the cockpit voice recorder and flight data recorder recovered from the bottom of the Atlantic strongly suggested that the pilots had raised the nose of the plane repeatedly when they should have been lowering it, thereby bleeding off speed and eventually putting the plane into a stall.
Now Popular Mechanics' Jeff Wise has published an annotated English translation of the crucial last moments of flight 447. The piece, which walks readers through all of the pilots' actions, step by step, is at once damning and heart-stopping. (It's already been named one of the top long-form journalism pieces of the year by Longform.org founder Mark Armstrong.) Here's a particularly gripping excerpt:
02:11:43 (Captain) Eh… Qu'est-ce que vous foutez?
What the hell are you doing?
02:11:45 (Bonin) On perd le contrôle de l'avion, là!
We've lost control of the plane!
02:11:47 (Robert) On a totalement perdu le contrôle de l'avion... On comprend rien... On a tout tenté...
We've totally lost control of the plane. We don't understand at all... We've tried everything.
As we've mentioned in previous posts on this issue, Patrick Smith, the author of Salon's "Ask the Pilot" feature, has argued that the pilots should not be criticised too harshly. They did, after all, face numerous equipment failures. His argument is worth considering. But it's ultimately similar to Mr Wise's conclusion that many pilots could have acted in the same way:
[T]he crash raises the disturbing possibility that aviation may well long be plagued by a subtler menace, one that ironically springs from the never-ending quest to make flying safer. Over the decades, airliners have been built with increasingly automated flight-control functions. These have the potential to remove a great deal of uncertainty and danger from aviation. But they also remove important information from the attention of the flight crew. While the airplane's avionics track crucial parameters such as location, speed, and heading, the human beings can pay attention to something else. But when trouble suddenly springs up and the computer decides that it can no longer cope—on a dark night, perhaps, in turbulence, far from land—the humans might find themselves with a very incomplete notion of what's going on. They'll wonder: What instruments are reliable, and which can't be trusted? What's the most pressing threat? What's going on? Unfortunately, the vast majority of pilots will have little experience in finding the answers.
That's not exactly comforting. Anyway, read the whole thing.
In this blog, our correspondents inform and entertain business travellers with news, views and reviews that help them make the most of life on the road. Sign up for our weekly "Gulliver's best" newsletter to have the blog's highlights delivered to your inbox »
Advertisement
Over the past five days
Over the past seven days
Advertisement
Readers' comments
The Economist welcomes your views. Please stay on topic and be respectful of other readers. Review our comments policy.
Sort:
http://af447.typepad.com/af447/
I believe one simple thing would have saved that plane. If the two control sticks had been "slaved" together, so that when one moves, the other would also move, the second copilot would have known that the first copilot had the stick back. Unfortunately, the way Airbus chose to build the plane, when one pilot is flying, the only way the other pilot knows the position of the stick is if the first pilot tells him. That is insane.
It is fascinating stuff, and I hope you don't mind if I bring to your attention Roger Rapoport's new extensive book on this subject. I won't link to it, to avoid breaking any posting rules, but I do suggest you check it out. He is the only journalist who's spoken to all sides in this story and gets behind the headlines. The book is called The Rio/Paris Crash and you can find it on Amazon, iTunes etc.
Going through the transcript, I'd prefer to be in a Boeing - at least the co-pilot will know the junior pilot is pulling back on the stick. Airbus diehards will say CRM is the main cause, maybe that is true, but the lack of CRM was probably exacerbated by the dual input mode on an Airbus.
Also, here are the stats again: Accident hull losses: 6 for A330, 1 for B777. Fatalities: 338 for A330, Zero for B777. Injuries: 106 for A330, 47 for B777. In service: 812 for A330, 924 for B777. I rest my case.
This crash and the resultant loss of 228 lives occurred almost simply because those in control were talking past each -- there was a breakdown in standard system cross-checks --- there was the fundamental flaw that pilots would not talk to each other, that they could suffer communication breakdown at a critical time. The system did not tell them what each were doing.
All of our endeavours, our technology leaps will always require that great managers are the ones that overlook, supervise these complex systems.
This is not incredibly different from how the Financial Crisis that have played out in Europe and the United States have developed into very serious, deep problems that threaten the entire system, way of life.
After having read the full transcript in French and English, I am fully confident of the follow:
Despite the initial issue of the auto-pilot malfunctioning, the main issue is obviously human error. Most importantly, the captain should have never left 2 co-pilots for such a long time in the cockpit, and if he did, he should have answered the desperate calls from the co-pilots.
Having said that, I fully agree with Juris. The main issue is that the IT folks and the company heads, in spite of their talent to render flying safer and more automatic, obviously do not have the communication structure or support to communicate the intricacies of the technology they just perfected. So, they develop computer modules under a tight deadline, and because of profit motives and the pressure to perform under the rapid technological innovation wave ,leave out the most important: Focused and thorough initial training and continuing training under the "What if" /contingency scenario to operate the plane for when the auto-pilot disengages. Moreover, the right delivery channels is not being used especially vis-avis module updates for AIRBUS (or BOEING)-e-learnings, emails, quick classes are used instead of comprehensive teachings for circumstances just like the one in the AF 447 situation. As I am forever greatful for technology, as a consultant for change and technology, I cannot stress enough the urgency to slow down the IT process to leave room for proper and thorough "human" training and co-existance of instinctual behavior under pressure. Is the head IT engineer explaining the process in simple understandable lingo to the head trainer, so they in turn can relay to any pilot around the world so to understand it enough to use the knowledge under pressure; Or is it being lost in translation? Are the quality engineers given enough room to veto a technology if the users are not 110% fluent with the workings of it? Are the regulatory bodies of the airline industry cutting costs and wait till a tragedy happens before make vital corrections to avoid danger in the air.
Please, let's not lose our "checks and balances" system in the airline industry for the sake of profit, excitement, and speed. Let's slow down and go back to the basics of dominance of human initiative over machinery, most importantly in "what if" scenarios where machinery suddenly fails and pilots have to go back to being pilots.
I am amazed that more attention is not paid by journalists to the issue of Fly By Wire used in all the newer (post A320) Airbus aircraft. I wrote a long piece for The Guardian (25th Sept 1987) and a much longer story for The Washington Post (2 April 1989) on the philosophic air safety issues of these aircraft and set out the case neatly. I draw readers attention to a new examination of a Qantas incident with an A330: http://www.atsb.gov.au/newsroom/2009/release/2009_02.aspx
You will find copies of these articles at:http://jimbeatsonjournalist.blogspot.com/
Why are pitot tubes even necessary, vulnerable as they are to blockage? I seem to remember a crash in Africa that was found to have been caused by insects nesting in these same tubes while the aircraft was parked on the ground.
My $400 mobile phone can measure the speed of my car in motion with high precision by using GPS. Surely an aircraft auto-pilot could do the same?
Not with high precision, but yes - an airplane can estimate an approximate speed from a combination of GPS and inertial data.
The result isn't highly accurate (few things compare to pitot tubes), but it would be sufficient to fly an airplane on a steady course.
Certainly, this information should be used.
There are many potential alternative (additional, resilient and redundant) measures of air velocity, from tuned frequency resonant structures to engine torque/ speed ratios.
There is a superabundance of data - all of it should be collected, digitally compared for consistency, and the resulting best estimate displayed to the pilots. In event that a component appears to fail, the situation should be presented to the pilots, along with the continued best estimate (of speed, climb rate, etc); the autopilot should continue to fly, using the best estimate of its state and environment - intervention should be at the discretion of pilots, once they have had a chance to figure out what's going on.
asmith, GPS gives you ground speed, not air speed, which is what an aircraft needs. A pitot tube is a simple and usually reliable method of obtaining air speed which does not depend on any external system. It is good for an aircraft to be self-sufficient with respect to the equipment needed to maintain safe flight.
The aircraft should have been flyable even without the pitot tubes, using other information and proper pilot judgment. This has been noted elsewhete.
There's a difference between ground and air speed. For an aircraft the latter is more important, because it affects the flying abilities of the plane. This is my impression of the matter, but I'm no expert, so correct me if wrong.
Because your GPS measures speed over ground, and in an airplane, airspeed is the critical parameter.
EXample: Your speed over ground can be 300 knots, but if you are in a 150 knot tailwind, your airspeed is only 150 knots which is a stall condition for most aircraft at high altitudes. in flying, speed over ground is useful for knowing when you might arrive at your destination, but not for much else.
Pretty scary. It's easy enough to criticize Bobin — his shortcomings are evident — but wrong, I think, to make him the scapegoat. I see plenty to criticize elsewhere:
Procedures and policy. Two first officers? That doesn't make any sense. The least experienced pilot was at the controls. The more experienced pilot should have taken control at the first sign of trouble. But the captain should have been at the controls anyway. He took his break on schedule even though they were heading into a storm when he should have waited until they were through it. Why were they flying into a storm, anyway? These days we have pretty good information on weather and airliners routinely avoid storms.
The aircraft. Central to the matter is the performance of the innovative control system of the aircraft. Every aspect of this having any bearing on the incident needs to be looked at objectively.
Air France will have incentive to put as much blame as possible on the subordinate officers and minimize that on the airline and its aircraft. BAE will have incentive to blame the pilots and the airline, and defend its control system. It will be interesting to read how fault is apportioned in the final report.
I disagree.
What is often missing from arguments like "too much automation makes people stupid" is that all this innovation allows people to practice a lot more. Take non-standard situation like this one. In the past, people literally had to fly a plane to learn to respond to things like this one. These days it is possible to simply sit at the flight simulator and learn what to do.
Not only this, but with a lot of important information being automated, it is really easy to set a buzzer if some flight parameters become bad.
As a result, by historic standards these days American and European airlines, that actually take care of things like that one, have very low crash rate. Things are not so smooth in, say, Russia, but it is exactly due to the fact that US/Europe are moving into the right direction when it comes to aviation.
Anyone citing the PM article as a legitimate piece of journalism has not read anything else. Especially pertinent is the third BEA report. The multiple failures of the Airbus flight management system which gave the pilots alternating over speed and stall warnings, was a classic example of non-graceful system failure. The BEA report states that although the system knew the angle of attack, it was not displayed to the pilots. When airspeed is non-reliable, angle of attack becomes the truth teller. When the horizon is not visible, it is the only truth. Not displaying it to the pilots is prima facia evidence of misfeasance. Further, the report indicates that there was an up trim generated by the flight management system that was probably sufficient to stall the aircraft. That the BEA lays the ground work to 'blame the dead guys' ignores the routing of the flight through the displayed storm. All other flights that night went 100-200 miles west and had smooth flights. What Air France rules prevented that diversion? Even if the French system refuses to identify the failures of Airbus and Air France, we should not jump on board and help the wrongful persecution.
"The BEA report states that although the system knew the angle of attack, it was not displayed to the pilots."
Why would the pilots have paid attention to a display of the angle of attack while ignoring the stall warning alarm ?
Rather than a hundred gauges, the pilots really ought to see a 3d image of the plane, its orientation relative to the ground, with big colorful velocity and acceleration vectors.
That way, the path would be instantly obvious - Robert would have instantly seen the influence of Bonin pulling up on the controls. It would have been instantly visually obvious that the airplane really was in a stall, and that Bonin had done that whilst telling everyone else he was descending.
Lots of analogue and digital gauges can't be viewed simultaneously, present an awful distraction during times of stress, and require mental arithmetic to make sense of - not something humans are good at under pressure.
Naturally, pilots should be able to call up to the screen any gauge reading they want, complete with confidence interval and failure likelihood.
And finally, eliminate audio alarms within the cockpit. Loud noise stops people from thinking clearly; and it makes communication difficult. A clear visual display, with aircraft orientation, velocity and acceleration, is all that the pilots need to see for much of the flight. Visually flash up warning messages, part failure notifications etc. But leave pilots the audio spectrum for thinking, talking and keeping cool.
Yes, and left and right triggers should allow you to do a barrel roll.
If you insist :) You can be the test pilot.
Really though, there is nothing technically demanding about this.
We already have a pretty graphical 3d model of the city and the roads; our car is overlayed in its localized position, and other recognized objects appear in the 3d display too. This happens in real time - our car's velocity and acceleration vectors (yellow and red) are bright and clear, as are those of all tracked objects in the environment.
This is really pretty basic. There is no technical challenge in providing this in aircrafts (except, obviously, that extensive software testing will be necessary to verify robustness.
The barrier to such things is reluctance to innovate, and perhaps regulation on airlines. Still, there should be far more experimentation (with flight simulators), to scientifically investigate the kind of interfaces that pilots (and training pilots) find most intuitive and can respond to quickly.
I expect that a decent graphical display would win out over dials and gauges any day. (In an autonomous car for instance, you can get a far better 360 degree perception of the environment by looking at the screen - beats glancing between mirrors.)
All airplane have a 'wet compass" on the instrument panel. It is independent of any other system. When all else fails the wet compass shows which way the airplane is headed. The AOA indicator should be the same concept. An attitude indicator (AI), also known as gyro horizon or artificial horizon is installed on other aircraft and appears to be installed between the computer displays of all glass cockpit Boeings. If the pilot knows the throttle setting and the angle of attack a stall can be averted. Several other aircraft have suffered pitot tube blockage and subsequent loss of airspeed indication. When the incident happens with a visible horizon, the pilot can fly out of it. AF447 was in the middle of a violent thunderstorm with complete obscuration of the horizon. When the flight management computer quit, the pilots had no attitude reference by which to fly.
Wait - did they or did they not have any of the simple, self-contained, old-fashioned instruments available in the cockpit ? A VSI (vertical speed indicator) does not depend upon the pitot tube, but upon the change in static air pressure. That alone would have told them that they were descending rapidly once they'd stalled the aircraft.
I know nothing first-hand about an airliner's cockpit. My airplane is a pre-WW2 taildragger, strictly VFR.
The BEA report did not cite any 'steam gauge' instrumentation, and I have seen no cockpit photos or other indication of any instrumentation that didn't go through the air data inertial reference units (ADIRU), other than the wet compass.
bampbs..
A pre war taildragger?
An Airmaster?
Porterfield
The Airbus has a Standby Horizon which gives attitude and bank information- it's usable even with a complete electrical failure. Alternatively, there is ISIS (integrated standby instrument system) and this also displays attitude information.
One of the first things you learn in flying school is:
Power + Attitude = Performance.
Setting 79% N1 Power and keeping the nose at 2.5 degrees nose up with the wings level on the Airbus A330 will result in the aircraft happily flying straight and level.
The training in airlines in recent years has stressed highly on recovery from low speed scenarios and going "back-to-basics".
Then the pilots panicked, and forgot that there were instruments they could still rely on. A calm look at the Standby Horizon ought to have been enough to see what was up.
My last instructor is an airline captain, and he says that flying an airliner is a bore for anyone who really likes to fly. I'm glad to hear that training is going "back-to-basics". Maybe some hours in a small airplane every-so-often would do an ATP good.
Jouris is most correct. A plane should always have a non-computerized fly by wire system of last resort. To think that 2 pilots did not see, feel, perceive the wrong angle (the single most basic thing in flying) is to say that there is far too much confusion and overabundance of signals in that plane's cockpiy
Oddly enough, as harrowing as that article is, I did feel comforted, just because so much had to go wrong, and keep going wrong. Compared to when I'm bicycling, and just one little thing has to go wrong for me to get creamed.
I think this transcript makes it clear that humans can't be trusted to fly planes.
The instrumentation and autopilot must be both resilient and with multiple redundancies - and it should never automatically disengage. Instead, it should only warn the pilots that it has less than 99.999% confidence of the flight path, and give pilots the joint choice to intervene if they think the know better.
I've noticed that enthusiasm for automated control occurs most often among people who are outside the IT industry.
I am put in mind of the comment of a colleague many years ago. It has application far broader than the specifics he points to:
All of American [now world] business is critically dependent on millions of lines of computer code . . . written by people with no visible qualification to have done so.
Apply that to aircraft controls, or any other automated system, and you see the problem.
No offense to the people who write the computer code. But their priorities are, in every case I have seen in 4 decades in the business, focused primarily on other things: First, on completing something by the deadline (set, generally, with no reference to how complex the task is). And secondarily on including all of the functions demanded. Robustness, performance, allowing for unlikely combinations of inputs -- the folks writing the code are often professional enough to want to address those. But their management demands other priorities of them.
Quite the opposite.
I might be young, but I'm completely wired into the IT industry, and currently programing driverless cars with AutoNOMOS in Berlin.
In safety critical application (such as the computers for drive-by-wire, fuel injection, gear changing, automatic parking, cruise control or driver assistance), robustness and safety are all that matter. This isn't like video games or Microsoft office - there can be no glitches, nor reliance on patches or updates.
In safety critical applications, the feature creep is only allowed to happen at the prototyping stage. Enormous investment and years of research go into producing high-quality prototypes. Only once the specification, structure, design and implementations of the software are all well defined, does the real work begin.
Hundreds of engineers review code in groups, line by line. Very extensive live testing is done, under the most extreme conditions and scenarios. High quality simulators are designed, to put the system through hundreds of millions of hours of extreme testing - any discrepancy is analyzed thoroughly, and necessary adaptations made. After several cycles of this, the technology finally enters the product.
At least in Germany, this is how IT works in safety critical applications. Which is one reason why - while I can drive around Berlin in a driverless car - it will be at least 15 years before such cars enter production. Product development cycles are long - much longer than for computer games, business software or even operating systems. In massively scalable applications, where tens of billions of dollars in capital and human lives (liability) are at stake, robustness actually pays.
One would assume that this works much the same in the airline industry.
As made clear in the transcription, the plane had a high precision gyroscope; it "knew" when the nose was too high and it was at risk of stalling; once stall began, it "knew" that the plane was hurtling towards the earth at 45 degrees. At any time, an autopilot could easily have escaped from this, and flown everybody home safely.
The flaw: in deference to pilots, the autopilot disengaged when the pitot tubes froze over. Pitot tubes provide a precise speed estimate - but the autopilot doesn't need this to fly. It can easily infer speed (with low but adequate precision) from inertial measurements and from engine power. It could have continued flying without them (maybe not on an optimal flightpath, but on a path guaranteed not to stall the plane).
It is an unnecessary design flaw for the autopilot to require pitot tube measurements. It is an even worse flaw to automatically disengage - instead, pilots should be given all relevant information, and should have the choice to disengage the autopilot only if they think they know better.
If only they had set a new flight path and reengaged the autopilot once pitot tube function had resumed.
Or indeed, if only there had been a better way of communicating the control inputs of all pilots, and the estimated path of the aircraft. Clearly *STALL* *BLEEP* *BUZZ* *STALL*..., combined with falling altitude readings just isn't good enough. Indeed, perhaps the alarming nature if this contributed to the stress, disorientation and inability of the pilots to communicate and sort things out.
Plenty there to improve on. But the ultimate goal (say, 25 years hence) has to be to remove human pilots from the system entirely - computers don't suffer from stress and disorientation; when one computer fails, this can be quickly diagnosed control transfered to another system (i.e. redundancy through such principles as majority voting). No communication break downs, rest breaks, heart attacks, food poisonings, panic attacks or irrational fear of storms. Human failure now causes over a fifth of deaths in the developed world - getting rid of human drivers and pilots is a public health priority.
Jouris, I'm a retired programmer with Computer Science degrees and 40 years in the business, and I take no offense. My experience is that thete are far more programs that need to be written today than there are competent programmers to write them. We can only hope that the best programmers are employed for the mission-critical applications, but we cannot be sure of this.
Its almost excruciating to imagine the last moments of Flight 447. Falling rapidly into the abyss of the mid-Atlantic. The transcript paints a horrific picture of indecisiveness.
All we can do is to incorporate that scenario into flight training programmes and pray such an event never repeats itself.
Reads like a possible script for Airplane III
Someone please tell me the young co-pilot got his aviation licence by dishonesty! The alternative is just too depressing.