Reminds me of Air France 447. When you train people to do a task using a robot, and they're used to using the robot 90% of the time, when the robot decides its had enough and hands back control unexpectedly bad things can happen.
Asiana 214 [0] is also relevant. The aircraft went into that partly disabled the auto-throttle. The pilot expected the engines to spool up automatically, but they didn't.
A key factor was that Asiana pilots were actively discouraged from hand flying the jet throughout most of the approach. They sometimes refer to younger pilots as "Children of the Magenta Line" [1] because of their over-reliance on the LCD flight director to fly the jet.
A similar situation could easily occur with Tesla autopilot which works as expected 99.9% of the time, with the driver caught off guard in the 0.1% of the time it doesn't work properly and causing a crash.
Ironically, AA has since made some efforts to scrub those video lectures from the internet, because they came from an advanced training course that was partly blamed for the crash of AA flight 587:
The NTSB indicated that American Airlines' Advanced Aircraft Maneuvering Program tended to exaggerate the effects of wake turbulence on large aircraft. Therefore, pilots were being trained to react more aggressively than was necessary.
AF447 story is amazing. The pilots where pushing pitch lever opposite directions and fly by wire system would cancel those out. Meanwhile the plane was tanking down into the ocean and captain was sleeping until last 10 seconds before crash.
I think autopilot confidence-mood light should be placed on such vehicles. This way you could predict what is going to happen with the vehicle.
Do you mean a dash indicator light or the ambient lighting itself? Personally, I think that a cockpit with ambient lighting that adjusts based on autopilot status would be a much better indicator. When the autopilot is engaged and everything is copacetic, the lighting in the entire cockpit could be in a dim red color. As the autopilot gets less confident in the situation, the ambient lighting could get more yellow, with an increase in brightness.
The autopilot losing enough confidence and wanting to be turned off should blink between two colors and sound an audible alarm until the pilot presses a button to acknowledge the autopilot wants to turn itself off.
One interesting detail is that accelerating an A330 to M0.90 would probably not significantly damage the aircraft, if at all. For a unreliable airspeed issue, 85% thrust with 5 degree nose high attitude would keep the jet in the air. Keeping the nose much higher than 5 degrees risks a deep stall, which can easily result in a fatal crash.
There's a similar concept at play for medical devices. One part of IEC60601 specifies three alarm system priorities, and the colors get scarier, the visual indicators flash faster, and the tones get more urgent the higher priority the alarm is.
To be fair, captains gotta sleep sometimes. Thats why copilots exist. Its more important for the captain to trust his copilots in a strange situation. I would argue that more errors have been made by captains / managers who start micromanaging when they panic, instead of trusting their lieutenants.
The captain woke up eventually, returned to the front to check out what was going on, and then trusted his pilots to explain to him what was going on. Unfortunately, one of his pilots was incompetent and his actions was confusing the other (actually competent) pilot.
The issue is that the ignorant copilot didn't know the issue about stalling out, nor how to get out of a stall. It takes specific training to pull a plane out of a stall. It goes against human instinct (you have to push the plane down, THEN after certain velocity is reached, pull up later).
The competent pilot was overruled by the incompetent one (the incompetent one was in the primary seat). The rest is history.
Pulling up immediately is the human panic response that needs to be "trained out". And its what one of the two pilots did in the situation.
Pulling the stick all the way back is the normal stall recovery procedure for an Airbus 330. That's totally different from standard piloting. With the flight control system in normal law, the control system protections will keep the angle of attack below a stall, and will increase throttle to get airspeed if necessary.
AF447 had ice-clogged pitot tubes, and the pilots lacked reliable altitude and airspeed info. Redundant sensors reported conflicting data. The flight control system dropped back to "direct mode", where the control stick (which is a little joystick-like lever) directly moved the control surfaces. In that mode, pulling back the stick stalls the airplane.
Hitting the pilot with a mode change like that in the middle of an emergency was part of what caused the disaster.
Re pulling the stick all the way back: Yes, that sounds weird, but that's what the manual says. [1], "A330/A340 FLIGHT CREW TRAINING MANUAL OPERATIONAL PHILOSOPHY -- FLIGHT CONTROLS" p. 15.
"High AOA protection is an aerodynamic protection: The PF will notice if the normal flight envelope is exceeded for any reason, because the autopitch trim will stop, the aircraft will sink to maintain its current AOA (alpha PROT, strong static stability), and a significant change in aircraft behavior will occur.
If the PF then pulls the sidestick full aft, a maximum AOA (approximately corresponding to CL Max) is commanded. ...
If the angle-of-attack still increases and reaches ALPHA Floor threshold, the A/THR triggers TOGA thrust and engages (unless in some cases of one engine-out)."
What this says is that, in normal law, pulling the stick all the way back will give you the maximum pitch currently allowed, and if the pitch is higher than that, the engines go to full power automatically. That's a stall recovery.
But AF447 didn't have good sensor data for airspeed. That disabled this automatic recovery capability. (There are alarms and displays when this happens.) With the control system unable to assist the pilot, pulling the stick all the way back was totally wrong. Also, the AF447 pilots thought they were in an overspeed condition, while in fact they were stalled.
(I'm not a pilot; I used to work for an aerospace company.)
It (the A/THR triggers TOGA thrust and engages) is not a stall recovery.
From Flying Training: "Stalling will occur whenever the critical angle of attack is exceeded, irrespective of airspeed. The only way to recover is to decrease the angle of attack (i.e. relax the back pressure and/or move the control column forward)."
This is referring to the aerodynamic stall, which is what caused AF447 to crash, not an engine stall.
I'm not an Airbus driver, but it's my understanding that normal law provides stall protection, and pulling the stick full aft will give you the highest angle of attack consistent with not stalling the aircraft. This is what is being discussed in the paragraphs you quote. It is, however, possible to stall the Airbus in alternate law, in exactly the same way as it happens in any other aircraft. AF447 was flying in alternate law.
In summary: increasing thrust is not what breaks the (aerodynamic) stall (but it is used to minimize height loss). Reducing AOA by pitching forward breaks the stall, and that is done on an Airbus by pushing forward on the sidestick.
Was going to say exactly this. Pilots do practice recovery training (with normal stall recovery as well as in adverse conditions), and I'm sure all of the pilots on board were aware (or at least should have been aware) of the correct procedure.
Airbuses are weird beasts though, and I have to say that as a pilot I find the normal stall recovery procedure to be completely counter intuitive. The compounding problems with the pitot tubes being iced over plus seeing St. Elmo's Fire due to improperly routing the aircraft directly into a thunderstorm certainly didn't help matters.
Perhaps what's happening is that Airbus realized in the aftermath of AF447 that the idea of "pull up, the airplane will do what's right to save you" wasn't a good one and changed their training materials. I don't know for sure as I'm not terribly familiar with Airbus. I do think that the whole input averaging is an awful idea though.
Hitting the pilot with a mode change like that in the middle of an emergency was part of what caused the disaster.
That's true, but mostly because the guy flying AF447 wasn't a "pilot", he didn't understand how to properly fly the aircraft. Like most Airbus pilots, he was a "system manager" and spent thousands of flight hours watching while the aircraft itself did most of the work. When the automation failed, he simply didn't know what to do to fly the plane by hand.
From what I've read (and I'm not a pilot either), the proper response to unreliable or conflicting airspeed data for the A330, when you're at high altitude (not trying to land or take off or anything like that) is simple. It's something like:
85% power, wings level, 5 degrees nose up pitch
It's not a stretch to ask a pilot to remember something simple like that. Even when stressed.
Of course, it is a stretch to ask airlines to either hire competent pilots, or at the least to periodically put pilots into stressful situations like that in the simulator. They won't do it because simulator time is too expensive. It's more cost effective for Air Chance to lose an occasional plane than to make sure they have competent and trained people in the cockpit.
You're tone is hash, but you're correct in pointing out that lack of basic flying skills was a factor in AF447.
Unusual Attitude Recovery [0] in suitable aircraft (L-39 jet trainer is somewhat common) has been made available to airline pilots.
They do make airline simulator sessions somewhat stressful for airline pilots. Capt. Robert "Hoot" Gibson called it "death by simulation" when he trained to fly the Space Shuttle. They still gave him a workout in the simulator to fly a Southwest 737.
Yes,it does. The problem is that the pilots didn't know that they were in stall because of conflicting readings from their instrumentation due to a failure in the pitot-static system. Pitot-static runs airspeed/altimeter/vertical speed indicator.
Doesn't get much more wrong than that, poor guys. Is there some kind of G/inertia meter that could have clued them up? To see an overspeed + climb but the freefall indicator is going crazy.
The VSI (vertical speed indicator) is the "freefall indicator" of which you speak. :)
The problem is that when there's the pitot-static failure the VSI (generally) indicates by "sticking" wherever it was when the failure occurred.
"Speed" means a different thing to a pilot than it does to a non-pilot. Groundspeed is irrelevant (aerodynamically), airspeed is everything. To sense "overspeed" you have to know airspeed. And since airspeed is a measure of the movement of the aircraft relative to the medium it's moving through (air), there has to be a system to measure that movement. That system is the pitot-static system. The pitot tube sticks into the uninterrupted airflow, usually on the wing somewhere, the static port sits where the air is calm, usually on the fuselage. The airspeed indicator in particular relies on the differential between the two inputs to determine airspeed.
Sure, captains have to sleep - the night before the flight, not one hour after partying and staying awake the whole next day. Also, he picked a time to nap when clearly his younger charges were not too confident about approaching weather. He just needed to stay focused 15 minutes longer. I don't know if Capt. Marc Dubois was drinker, but I am assuming he probably had a few given how pervasive alcohol is in today's world, not to mention pilots and romanticizing drinking and flying 'war stories'. I know a few pilots, and like other drinkers, they play down drinkings effects from the night before on their ability to fly.
The original OP post is about automated systems should not crash into an obstacle even if a driver summons it to do so. The AF447 article builds up a great story of error upon error, but I think the root cause was a captain asleep or too groggy at the wheel. Given the Airbus's safety record, I think it is ok to say the automation has most likely saved more lives than if we were 'pilot only' at this point.
This post is complete and utter nonsense in so many ways I don't know how to begin.
Relevant: I am a licensed pilot and am very familiar with the NTSB and similar agencies that do post crash analysis. They are among the most thorough and most scientific and objective inquiries that exist in the modern world.
You're making really serious allegations against actual people that are wholly unsupported.
Please point out where I deviated from the facts as pointed out in the article from Vanity Fair cited in this sub-thread, and to which I was replying to @dragontamer above. You are making allegations of my post being 'complete and utter nonsense', or that they are 'wholly unsupported'.
I am not sure what the NTSB has to do with the remarks I made. If anything, the head investigator relayed supporting allegations to the Vanity Fair author. Here is a quote from the article [1]:
>>The chief French investigator, Alain Bouillard, later said to me, “If the captain had stayed in position through the Intertropical Convergence Zone, it would have delayed his sleep by no more than 15 minutes, and because of his experience, maybe the story would have ended differently.
>>But, it became known, he had gotten only one hour of sleep the previous night. Rather than resting, he had spent the day touring Rio with his companion.
I accept that you are a licensed pilot. I am a technical diver, with many hours underwater fixing hydraulic and electrical systems, dealing with emergencies like hydraulic fluid leaks, and emergency repairs. I am use to tight situations, however, I am not an underwater accident or incident investigator, and my diving credentials only give me some insight into those types of incidents, that's it.
I have also checked other news accounts, and the off-duty flight attendant allegedly his mistress based on his own emails uncovered by investigators.
More from the Vanity Fair article:
>Marc Dubois, 58, was traveling with an off-duty flight attendant and opera singer. In the French manner, the accident report made no mention of Dubois’s private life, but that omission then required a finding that fatigue played no role, when the captain’s inattention clearly did.
I am not saying the static pitot tubes freezing had nothing to do with it, as obviously this was the kick-off to the problem. I am addressing the article, which engagingly enumerates the steps from how an equipment malfunction escalated to human error, and subsequently the associated behaviors and responses to an airline crash.
I was sincerely interested to see your reply to mine, since I am still not sure why you came down so strong on it, and to perhaps gain your insight on it.
> I think autopilot confidence-mood light should be placed on such vehicles. This way you could predict what is going to happen with the vehicle.
I think this is an excellent idea. Soft blue lighting (or whatever) while it's driving automatically, soft green for manual, angry pulsing red for "human I need an assistance now".
Oh, I didn't mean for the lighting to be either/or (although I can see how my post read like that). I'm thinking more like the aura lighting on Culture drones - so for my example, auto mode might be blue, but tinged with more and more pink/red as it gets more worried (ie. lower confidence), a pulse of white if someone cuts it off, that kind of thing. Angry flashing red would be the equivalent of a human driver having a panic attack and taking their hands off the wheel.
http://www.vanityfair.com/news/business/2014/10/air-france-f...