My book "Angle of Attack" is out!

[seagull]

A large part of this that is being missed is that the software is providing conflicting cues and there is a mismatch between what the airplane is doing and what the software is indicating, and what other software is commanding. We are in a new regime of problems that did not occur prior to software being a large part of the mix. Prior to the 1980s these accidents were pretty linear, but that is just not the case anymore. I would recommend Nancy Leveson's "Safeware" to get some basis for what we are seeing. I am doing a talk at ISASI in SAN coming up here in a couple of weeks (http://isasiannualseminar.com/) with one of the MIT research professors in which we are directly addressing the issue of how to analyze accidents that are part of a complex system, in particular where software is part of the mix. It is complicating things far more than most realize. We are demonstrating STAMP as applied to Asiana 214 as an example of the power of the technique developed by Nancy. I hope you can attend, it will be worthwhile.

 

[Cherokee_Cruiser]

If you studies human performance and motor response you would see that it not only was not surprising, but actually almost inevitable. While you may not be able to imagine it, this was not the only crew to not identify the event.

That's not a factually correct statement. They properly identified the real problem, which was the lack of airspeed information. Applying the appropriate procedure for unreliable/loss of airspeed would have been the proper course of action.

Were they aiming for alpha-floor to maximize performance?

No, and I posted the animation link above. He was chasing the FD bars.

Were they thinking they were overspeeding (almost for sure)? The time in the descent is actually not all that long.

No one knows what they were really thinking. How can you be overspeeding in the Flight Levels with the nose held above 10 degrees pitch. Airmanship tells you if you are not sure of your speed, look at the CA speed. And the standby speed. And the GS shown on the ND.

There's also no excuse for not knowing one's plane in terms of its pitch and power settings.




Let me ask you, do you really believe the Colgan 3407 crew was attempting a tail - stall recovery?

 

[Cherokee_Cruiser]

A large part of this that is being missed is that the software is providing conflicting cues and there is a mismatch between what the airplane is doing and what the software is indicating, and what other software is commanding. We are in a new regime of problems that did not occur prior to software being a large part of the mix. Prior to the 1980s these accidents were pretty linear, but that is just not the case anymore. I would recommend Nancy Leveson's "Safeware" to get some basis for what we are seeing. I am doing a talk at ISASI in SAN coming up here in a couple of weeks with one of the MIT research professors in which we are directly addressing the issue of how to analyze accidents that are part of a complex system, in particular where software is part of the mix. It is complicating things far more than most realize. We are demonstrating STAMP as applied to Asiana 214 as an example of the power of the technique developed by Nancy. I hope you can attend, it will be worthwhile.

How does that apply here? The airplane did what they asked it to do once they were in alternate law. Once it was stalled, the airplane still displayed the characteristics you'd expect in an airplane that is stalled. It even yelled the aural warning "stall stall stall"

Agreed, although it is not clear they realized they were.

Didn't realize they were at 17 degree pitch up? What software is going to get the blame for that

 

[seagull]

That's not a factually correct statement. They properly identified the real problem, which was the lack of airspeed information. Applying the appropriate procedure for unreliable/loss of airspeed would have been the proper course of action.

No, and I posted the animation link above. He was chasing the FD bars.

No one knows what they were really thinking. How can you be overspeeding in the Flight Levels with the nose held above 10 degrees pitch.

Let me ask you, do you really believe the Colgan 3407 crew was attempting a tail - stall recovery?

Not quite, you are forgetting the accelerations. Absent the accelerations things are quite different. We did a series of tests in simulators without motion, with standard motion and with modified motion drive algorithms (Lm2), not for this event, but the findings carry over. It was really fascinating to see the difference in pilot response to a lateral APC (a dutch roll situation) with and without valid motion cues. No motion or incorrect motion was a LOT easier for pilots to recover. Very dramatic. Look at the g traces on the AF447 accident. The 2nd and 3rd derivatives are what humans react to. Match them.

While you can say "how can you be overspeeding" when the cues that are most salient are indicating you are, coupled with the g-forces involved, you might find that your impression is different.

On Colgan, no, I do not, but then I did not do any performance analysis on that one. Perhaps if I get some time I'll take a look at it again. If I can get the tab data it would be better.

 

[seagull]

How does that apply here? The airplane did what they asked it to do once they were in alternate law. Once it was stalled, the airplane still displayed the characteristics you'd expect in an airplane that is stalled. It even yelled the aural warning "stall stall stall"

Didn't realize they were at 17 degree pitch up? What software is going to get the blame for that

On the first, "displayed characteristics you'd expect..." Really? What are those, exactly?

On the second, see my answer above regarding accelerations, etc. The software at that point was contributing to the loss of control. That is not just my opinion, but also every human factors expert on the planet.

 

[Cherokee_Cruiser]

Not quite, you are forgetting the accelerations. Absent the accelerations things are quite different. We did a series of tests in simulators without motion, with standard motion and with modified motion drive algorithms (Lm2), not for this event, but the findings carry over. It was really fascinating to see the difference in pilot response to a lateral APC (a dutch roll situation) with and without valid motion cues. No motion or incorrect motion was a LOT easier for pilots to recover. Very dramatic. Look at the g traces on the AF447 accident. The 2nd and 3rd derivatives are what humans react to. Match them.

While you can say "how can you be overspeeding" when the cues that are most salient are indicating you are, coupled with the g-forces involved, you might find that your impression is different.

On Colgan, no, I do not, but then I did not do any performance analysis on that one. Perhaps if I get some time I'll take a look at it again. If I can get the tab data it would be better.

I don't know what you are saying. You ran some motion event that didn't model AF447, but are drawing a conclusion that at 0.5g that AF crew felt, they acted correctly? And if you are saying their impression is quite different, then what? Seat of the pant flying? Sorry, but if you are making flight control inputs because your body is "feeling" something one way, you're doing it wrong. Many pilots have died doing just that, and in GA that means ending up in the graveyard spiral.

On the first, "displayed characteristics you'd expect..." Really? What are those, exactly?

On the second, see my answer above regarding accelerations, etc. The software at that point was contributing to the loss of control. That is not just my opinion, but also every human factors expert on the planet.

What software? Are you talking FM, GC, FMGC, the FCU? And yes the airplane gave the classic signs of a stall: blaring stall warning (the most obvious one) repetitively, buffet (shaking)/light turbulence, nose pointed up and the altitude rapidly decreasing. Human factors, what's your reasoning for why they didn't once acknowledge the stall warning which sounded 74 times?

 

[seagull]

How much aerobatic time do you have?

On the stall, what does a buffet feel like? If you lose all your airspeed indications is it possible for that to trigger a false stall warning?

 

[Cherokee_Cruiser]

Come on man, you're the author. Answer the questions, don't answer questions with more questions.

No aerobatics. On the stall, vibration/shaking/light turbulent-like. If you lose airspeed indications could you get a stall warning, yes depending on how the airspeeds failed (immediate, or rolled back towards 0, etc). But we know probe ice melted and the speed indications came back. And once a warning goes off 74 times, perhaps it's time to at least once acknowledge it. The machine can only take so much blame. The Airbus warned the pilots that it was stalled.

 

[jtrain609]

It didn't happen just once... there were something like 5 incidents with the 330 at NW prior to AF447 along with a few other not complete blockages. A lead instructor I've flown with a few times on the 330 is also the grandaddy of modern FOQA. His insights as well as Bill Palmer's are fascinating.

Oh, and: Don't. Pitch. To. 17. Degrees. At. FL350.

Wasn't it a little more involved than that?

They got overspeed and underspeed warnings at the same time. One guy pushed full forward and one pulled full back, and the Airbus averaged out the flight control inputs and the elevator did nothing. Neither pilot used the priority button, and they had so much going on that they didn't hear the priority warning.

That's been my understanding of this accident. If they had gotten themselves into alternate law and used a known pitch and power combo they would have flown out of it, but they didn't know to.

We're training guys to do that now.

 

[seagull]

Come on man, you're the author. Answer the questions, don't answer questions with more questions.

No aerobatics. On the stall, vibration/shaking/light turbulent-like. If you lose airspeed indications could you get a stall warning, yes depending on how the airspeeds failed (immediate, or rolled back towards 0, etc). But we know probe ice melted and the speed indications came back. And once a warning goes off 74 times, perhaps it's time to at least once acknowledge it. The machine can only take so much blame. The Airbus warned the pilots that it was stalled.

The questions were pertinent and thank you for answering honestly.

When you are at 1/2 g it is not like anything you've experienced, particularly if it is sustained. Absent training it is extremely disorienting. Unloading is what happens when you are rolling the nose over. In fact, 1/2 g is a common target. If you are already there and it is combined with the sound of graupel (which sounds like high speed), plus ECAM warnings about no high speed protection, plus a FD commanding something that seems to make sense given the other cues, well it gets dicey. Arm chair flying really does not do justice.

On the stall, in a real airplane at altitude the effect is closer to +/- 1 to 1.5 g, with a lot of lateral motion. Think moderate or greater turbulence feeling. Not like light turbulence or chop. Now recall that while feeling that you are ALSO in the top of a thunderstorm. Is it turbulence or buffet? How do you know, with YOUR experience?

On the stall warning, you have answered the same as 95% of the pilots we surveyed, however you are incorrect. However, if you think your airspeed are still dead (and recall they had no way of knowing that they 'came back' as you know with hindsight knowledge), and you think that would lead to a false stall warning (as you indicated you did), why would you give the warning credence?

 

[Cherokee_Cruiser]

Wasn't it a little more involved than that?

They got overspeed and underspeed warnings at the same time.

That was Aeroperu a Boeing 757. I think flight 603.

One guy pushed full forward and one pulled full back, and the Airbus averaged out the flight control inputs and the elevator did nothing. Neither pilot used the priority button, and they had so much going on that they didn't hear the priority warning.

The animation shows inputs made. For the most part, it's the right seat FO Bonin who did the controlling. There were a few occasions where both simultanesously had inputs. And a few times when only the left seat FO Robert made control inputs. The priority button was pushed (accidental?) because a "priority right" can be heard on the CVR.

That's been my understanding of this accident. If they had gotten themselves into alternate law and used a known pitch and power combo they would have flown out of it, but they didn't know to.

We're training guys to do that now.

They were already in alternate law right off the bat, right when all 3 speed indications went crazy. Without speed indications, the AP goes off (first ecam message), thrust lock ecam, and altn law / protections lost ecam messages.

 

[Cherokee_Cruiser]

The questions were pertinent and thank you for answering honestly.

When you are at 1/2 g it is not like anything you've experienced, particularly if it is sustained. Absent training it is extremely disorienting. Unloading is what happens when you are rolling the nose over. In fact, 1/2 g is a common target. If you are already there and it is combined with the sound of graupel (which sounds like high speed), plus ECAM warnings about no high speed protection, plus a FD commanding something that seems to make sense given the other cues, well it gets dicey. Arm chair flying really does not do justice.

Still, primary instrument training tells you to ignore all body sensations and feelings and look at what the instruments are telling you. Remember, the ONLY thing this crew lost entirely were the airspeed indications. The attitude and heading system was entirely unaffected. At ALL points, the crew had valid pitch/roll information. The altitude and VS indications were momentarily inaccurate, but fairly quickly came back. Regardless, our training tells us to ignore all body sensations and use flight instruments to decipher flight path information.

On the stall, in a real airplane at altitude the effect is closer to +/- 1 to 1.5 g, with a lot of lateral motion. Think moderate or greater turbulence feeling. Not like light turbulence or chop. Now recall that while feeling that you are ALSO in the top of a thunderstorm. Is it turbulence or buffet? How do you know, with YOUR experience?

Ok, so? And they started descending (falling) very quickly and no words were mentioned anymore about still being in a storm. Experience tells a pilot to look at his flight instruments, verify across all 3, decide what looks accurate and then take corrective action.

On the stall warning, you have answered the same as 95% of the pilots we surveyed, however you are incorrect. However, if you think your airspeed are still dead (and recall they had no way of knowing that they 'came back' as you know with hindsight knowledge), and you think that would lead to a false stall warning (as you indicated you did), why would you give the warning credence?

What part of stall warning am I incorrect? As for not giving the warning credence, the simple answer is because they were clueless, and several times (numerous times) made the comments of "what's happening" "we don't understand, we've lost control" "why isn't it climbing" "but what's happening?" .................... So when you're at the point where no one has ANY idea what really is happening, that would be a good time to heed ANY aural warning coming from the plane. What can you lose? Or at least mention it verbally to the other crew.


It's also Air France. They didn't exactly have a stellar reputation for the 2000 decade (defined from 2000-2009) with 3 major hull loses, 2 entirely fatal.

 

[PeanuckleCRJ]

Wasn't it a little more involved than that?

They got overspeed and underspeed warnings at the same time. One guy pushed full forward and one pulled full back, and the Airbus averaged out the flight control inputs and the elevator did nothing. Neither pilot used the priority button, and they had so much going on that they didn't hear the priority warning.

That's been my understanding of this accident. If they had gotten themselves into alternate law and used a known pitch and power combo they would have flown out of it, but they didn't know to.

We're training guys to do that now.

The PF on 447 pulled to full back stick and held it there until the CA was up front and told him to let go... then it was too late.

You're thinking of Asiana where the FO pulled full back and the CA pushed full forward but failed to use the takeover button. The CA in Asiana even realized that he needed to override the FO, but failed to use the takeover.

We fight like we train as a testament to what Shem is saying, however the multiple NW occurrences in identical conditions do not make it a universal truth. Excellent pitch/power awareness sure seem to help... In weather getting bounced around combined with the malfunction, the tunnel vision of a poor pilot not allowed to fly much will result in AF447 quite often...

 

[Cherokee_Cruiser]

Not Asiana, you mean Air Asia.

But to be fair.......

 

[PeanuckleCRJ]

Not Asiana, you mean Air Asia.

But to be fair.......

hahaha! You got it!

 

[Skåning]

It's also Air France. They didn't exactly have a stellar reputation for the 2000 decade (defined from 2000-2009) with 3 major hull loses, 2 entirely fatal.

The PF on 447 pulled to full back stick and held it there until the CA was up front and told him to let go... then it was too late.

I'm surprised it took this long to mention the fact that Air France has had an abysmal safety record since 2000. Pilot induced for the most part. Who knows if it's the culture or training department, but they are a big outlier.

Two years after 447, an Air France A340 almost stalled over the Caribbean. Recovery and detection of the situation was poor.
http://avherald.com/h?article=44280b2a

Hell they had THREE hard landings in 2011 that resulted in substantial damage!

 

[Nick]

I'm surprised it took this long to mention the fact that Air France has had an abysmal safety record since 2000. Pilot induced for the most part. Who knows if it's the culture or training department, but they are a big outlier.

Two years after 447, an Air France A340 almost stalled over the Caribbean. Recovery and detection of the situation was poor.
http://avherald.com/h?article=44280b2a

First to crash the A320.

First to crash the A330.

First to crash the A340.

First to have major structural damage to the A380.

First to crash Concorde.


.

 

[MikeD]

Are you suggesting, legitimately, that the organization(s) that make pilots "dumb system operators" legitimately have no responsibility?

Not implying that at all. But those are secondary factors, not primary causal factors. As in, the organizations that produced said pilots, are not the actual physical actions that put a plane into the ground/water. They are the "why" to the primary causal factors that are the "what" and "how" regarding specific actions or inactions that put a plane into the ground, hence why they are secondary/contributing. Just categorizing various factors in their proper spots in order to understand where they relate to the actions ns that occurred. Secondary snd tertiary do not imply "less important" than primary, it only implies where they lie in the factors that answer the what/how/why questions.

 

[MikeD]

Come on man, you're the author. Answer the questions, don't answer questions with more questions.

No aerobatics. On the stall, vibration/shaking/light turbulent-like. If you lose airspeed indications could you get a stall warning, yes depending on how the airspeeds failed (immediate, or rolled back towards 0, etc). But we know probe ice melted and the speed indications came back. And once a warning goes off 74 times, perhaps it's time to at least once acknowledge it. The machine can only take so much blame. The Airbus warned the pilots that it was stalled.

Moderate amount of aerobatic experience here, all high altitude aero work and stall training to full stalls done in an actual jet, as opposed to a sim. A T-38, not a transport category mind you, but swept wing aero is swept wing aero nonetheless. In the stall, the jet remains pitched slightly to more nose up, as the "bongo drums" on the wing tips progress to the "dancing elephants" as the stall moves further along the wing in its progress. Lateral rolling motions, but most notable is the severe descent rate that develops, again while the jet is in not much more than a landing attitude and stays that way, while literally falling out of the sky VSI-wise. This is what I talk about regarding the airplane talking to you: if you fail to listen to it (overconfidence or complacency or distraction), or worse, don't understand the language its speaking to you in (inexperience or lack of understanding of aero or lack of training), then the situation isnt going to end well for you. The severe buffet sensatIons and rolling moments felt, should trigger crosscheck of the VSI and speed, combined with the aural warnings being given by the jet, all should have been big clue factors that the crew would have keyed in on, but didn't. Whether lack of experience, lack of technical/systems, or lack of required or necessary training either given or received, or any combo of the above, are all factors that need an honest look as to how we are doing business here with our own airlines, so we don't have crews end up in the same situation with the same or similar series of mistakes being made, resulting in the same outcome, as this crew did.

 

[MikeD]

A large part of this that is being missed is that the software is providing conflicting cues and there is a mismatch between what the airplane is doing and what the software is indicating, and what other software is commanding. We are in a new regime of problems that did not occur prior to software being a large part of the mix. Prior to the 1980s these accidents were pretty linear, but that is just not the case anymore. I would recommend Nancy Leveson's "Safeware" to get some basis for what we are seeing. I am doing a talk at ISASI in SAN coming up here in a couple of weeks (http://isasiannualseminar.com/) with one of the MIT research professors in which we are directly addressing the issue of how to analyze accidents that are part of a complex system, in particular where software is part of the mix. It is complicating things far more than most realize. We are demonstrating STAMP as applied to Asiana 214 as an example of the power of the technique developed by Nancy. I hope you can attend, it will be worthwhile.

One of the issues is that we have to get some back to basics going in training. Automation is supposed to be a workload reducer ideally. Where old heads back in the day who went from dials to automation had the challenge of learning to reduce their workload by incorporating it; more and more that is shifting to pilots who don't know what to do without it, or how to manage their workload when its operating degraded. Systems....avionics/automation knowledge, to include associated hardware and software, is becoming more and more important as automation advances; yet still seems to be a weaker point in some accidents. Sure, when the A320 was new at Air France in 1988, and the crew put flight 296 into trees by placing the jet into a square corner that it would not allow them to recover from in the way they wanted to recover; that can be attributed to the newness of automation and its capabilities and limitations (such as alpha protection) at the time being less than ideally understood, and contributing in a tertiary manner to the errors made. But today, we've come so far as to where automation is the standard rather than the exception, and systems understanding should be well above what it appears to be in some of these accidents. Not talking knowing how to build the automation, but how to reasonably use it and what to expect from it in both normal as well as abnormal situations.

And even further, what to do when it becomes abnormal to the point of being more hinderance than help. The F-117 was one of the earliest planes after the F-16 with fly-by-wire that was tied into an autopilot that was cued by an INS-derived nav/attack computer. The training on that jet was very automation-heavy focused: what the automation does, how it does it, when it does it, why it does it, how it tells you what its doing, what its capabilities and limitations are, what happens when different malfunctions occur and how it tells you what's occurring at those times as well as what it now cannot do for you. The idea was to stay ahead of the jet and its automation at all times when being a systems monitor, but more importantly, when to step in as a pilot and take things over yourself when things stopped looking/feeling/sounding right with what the jet was doing or what it was telling you, especially if its telling you that its "sick", or otherwise operating degraded for some reason. Being ready to either go degraded or take manual control, was something that one had to always be prepared for and ready to execute, just like as if flying a single-engine Cessna and always having somewhere out in front of your windscreem ready to be a landing place to aim for were the engine to quit.

Whether and to what depth (if so), similar levels of understanding are taught at airlines around the world today with regards to automation aircraft, Im not sure. But if the crash of AF447 is any indication, then we may be wanting to ask ourselves again, "how are WE doing business" as it comes to factors which should have been apparent to the experienced hours-wise crew here; yet ended up not being.