Here is more about the crash of Air France Flight 447 in 2009. Computer user interface designers are acutely aware of how confusing and error-prone systems are whose operation depends upon mode settings which may not be obvious to the user and which may change depending upon circumstances of which the user is unaware. While this can be annoying when it happens in a text editor or other application, mode confusion in an airliner fly-by-wire system can lead to tragedy.
A perfectly functioning Airbus A330 with 228 passengers and crew on board was flown in a sustained aerodynamic stall from its cruising altitude of 35,000 feet (10.67 km) to impact in the Atlantic Ocean, killing all on board. The precipitating cause was icing on the airliner’s pitot tubes causing unreliable airspeed indications, which triggered disconnect of the autopilot and a series of crew interventions that placed and kept the plane in a deep stall until impact. During most of the descent, simply manually setting thrust to cruise power and neutralising the controls would have resulted in recovery, but the flight computers had switched into an alternative control law where its reaction to pilot inputs produced results the pilots could not understand.
This video, almost an hour long, is a deep dive into the accident, with a second by second analysis of how the pilots reacted to the crisis and how their inputs (sometimes conflicting) interacted with the flight computers controlling the aircraft.
It was a great break down. The side stick model really does not seem like a good idea to me. I know Airbus is all in on this but if this had been a Boeing this probably would not have happened.
It is surprising that no mention was made of the back up flight instruments present on the panel. Among these is a gyroscopic artificial horizon, independent of the partially-operative and intermittent flight instruments on which the pilots erratically, in their confusion, tried to rely. As was indicated in the OP, neutralizing the controls and keeping on cruise power would have given ample time to figure out the situation. Just looking at and using the artificial horizon - common on all the simplest aircraft - would have afforded the pilots the essential knowledge they were doing the right thing by Neutralizing the controls as suggested. It would have ended the stall resulting from back pressure on the side stick and would have helped end the aileron over control, as the same instrument also gives accurate lateral axis information. Once the stall ended, so would have the lateral instability.
Also striking was the highly imprecise language the pilots used. They continuously conflated altitude, attitude, climb/descend and control inputs in a manner which defied correct interpretation by the listener. This could only have added to the already intense confusion. As terrifying as this situation undoubtedly was for the unfortunate participants/victims, it nonetheless requires sober analysis and correction.
Given that flight automation has different “laws” for different failure modes, and that these non-infrequently confuse the pilots, it seems prudent to have a default piloting “law”: When presented with a partial panel and loss of situational awareness, neutralize the controls, apply cruise power, and rely on the backup, separate gyroscopic instruments to control the attitude of the aircraft.
I believe that the lack of tactile feedback from the other stick contributed significantly to the disaster. Boeing-style yoke with mechanical linkage would have made the discrepancy in control inputs instantly apparent.
The additional fact (IIRC) that the throttle handles are not motorized, so while the engines went to idle the handles remained in cruise position. Simply adjusting the thrust slightly should have restored full power.
Thankfully, airlines have taken these hard-learned lessons to heart and more frequently cover these scenarios in recurrent training. Remembering how to manually (“hand”) fly the airplane is a key skill to keep in practice.
A Brussels Airlines first officer once told me that they almost always hand fly landings, for which I have been very thankful since this disaster. (The occasion was landing on a runway direction in Africa that did not have any instrument aids, and I was curious what they used – “Mark I eyeball” was essentially his response.)
As a very lapsed private pilot I read/watch a lot of aircrash articles and videos. Too many accidents are pilots that forget they’re flying an airplane and not playing a video game. Besides 447 look at the 737 Max crashes. Reports contradicting the “it’s all Boeing’s fault” have become harder to find, but the Lion Air flight had stabilizer problems that were reported and handled properly in the flight before the accident, and the accident crew properly disabled the autotrim/runaway stabilizer, started to get the plane under control, and turned the autotrim back on. My recollection is that this happened several times but I’m unable to find a report mentioning it. Reportedly disabling the automatic stabilizer (runaway stabilizers have crashed non-Maxes) is standard procedure for 737s and other aircraft, but it was never covered in my small Cessna, Beach, and Piper training and I only know from reading. Despite the reported problems maintenance didn’t fix the aircraft before the accident flight.
In the Ethiopian Air crash the plane flew through a flock of birds and got multiple warnings, the pilots immediately turned on the autopilot rather than hand flying, one report I found (or rather an analysis of the reports) said both pilots were incapable of flying without the automation, while they initially followed proper procedures they lost it because they were unable to actually fly the plane.
It seems like part of the Max response was a hit job on Boeing, who admittedly has been pretty good at shooting themselves in the foot (or is that landing gear?) lately. Early A320 flights had fly by wire problems resulting in crashes, without similar hysteria. The first A320 passenger flight, AF 296 in 1988, with 136 on board, crashed killing 3 people. The official report was too slow and low to the ground on a low pass, the pilot claimed the fly by wire didn’t respond properly. Claims about evidence tampering altering the black boxes were made. One could presume, if true, those were to protect Airbus.
With ever increasing creepiness, and perhaps appropriateness for the Crazy Years, the all knowing giggle noticed an interest in 737 Max crashes and presented this article criticizing the official report of Ethiopian Air crash.
The short version is that while MCAS contributed to the crash, if the crew had properly flown the aircraft it wouldn’t have crashed. And that the Ethiopian authorities aren’t that great at accident analysis, either by design or lack of skills.
My wife and I have been streaming a binge of Air Disasters on Smithsonian Channel. We have watched 30 episodes so far and these included Air France 447. I estimate about half of the episodes involved loss of awareness of aircraft attitude, like 447. Yet, only once in all these episodes is the triple-redundant gyroscopic backup attitude indicator on every aircraft, even mentioned. The answers given always include “more training”, but none are specific as to what the new training actually is. Yes, modern commercial aviation is very safe. However, among the serious, high-fatality accidents, alternate “laws” of partial automation are over-represented
I must wonder if the new training tells confused pilots to do what we have discussed here: neutralize controls, apply cruise power and refer to the gyroscopic artificial horizon (usually in the center between the two pilots) to determine the airplane’s attitude. It surprises me that the vast majority of accident investigations fail to even mention this obvious designed-in (lifesaving!) solution to what may be an otherwise insoluble problem resulting from inevitable - thankfully rare, partial failures of flight automation systems.
In the old days (before my time, nor was I ever instrument rated) IFR was needle, ball, and airspeed, none of this fancy stuff. I’m guessing that there was some altimeter in there too. Today some pilots can’t handle basic flying without automation
The idea is this technology will take over if the pilots need to focus on heavy decision-making or if they were to become incapacitated.
Under its own control, the plane can descend and land, while recognising other aircraft, weather and terrain.
The system also allows the plane to speak to air traffic control over the radio with a synthetic voice created through the use of artificial intelligence.
It’s encouraging that Airbus is working on this technology for airliners, but the article never mentioned that essentially the same capability is provided by the Garmin Autoland system, which was introduced in 2020 and is now certified for installation in the Piper M600, Cirrus Vision Jet, and Daher TBM 940/960, with certification underway for the HondaJet Elite II and Beechcraft Denali. Garmin Autoland won the Collier Trophy in 2020.
Here is a demonstration of Autoland from October 2019.
Not sure that Airbus’s automatic controller would have helped in Flight 447. The situation there seemed to be that the Air France Airbus had two conscious pilots each of whom believed he knew the right actions to take – but they were different actions. Add in a third AI pilot speaking in its synthesized voice telling the two opposing pilots that they are both wrong – and this begins to sound like the plot for the next “Airport” movie.
Training pilots is expensive, but that may be the most effective safety measure.
