Air France crash 'due to pilot & technical failure' (Final report on 2009 crash) | Hacker News Reader

Air France crash 'due to pilot & technical failure' (Final report on 2009 crash)

bbc.co.uk

18 pointsColinWright36 comments

The fact that airbus AVERAGES the control inputs, with no indication of conflicting inputs, when one pilot is pulling back and one pilot is pushing down is just a perfect example that even at the most critical points, where the stakes are the highest, we as engineers and designers fail to think through the implications of bad design.

Agreed, the design was not good at all. Indeed, they now added a compulsory formation in the pilots curriculum for this kind of situation (degraded control mode). However, the pilots took a very big risk when they said "On ne va pas se laisser emmerder par des cunimbs." (We won't be pissed off by cumulonimbi!) and got straight into the storm while others were all rerouting around. Ego kills.

I've read about this problem several times already but nobody ever explained what was the rationale behind this strange behaviour. Maybe there's a case where that's useful?

I can't imagine any engineer would just say "Mmh, what happens if both pilots move the commands in different directions? Oh well, let's just take the average". I'm sure there's more to it.

I don't know the answer but this is "mission critical" code. Averaging inputs is more testable than having a process for passing control and managing edge cases.

Every branch in mission critical code is tested for all possible permutations. Averaging is simpler from a verification standpoint. Theoretically...

But would adding an extra caution light / sound to the already-stressful situation have helped? I agree that averaging the inputs seems like an imperfect solution, but what would the alternative be... ignore both or ignore just the Captain/First Officer's inputs?

edit: Re: physically-linked controls (à la Boeing), with one pilot pulling back as hard as he can Vs. the other pushing fwd, isn't the result still (approximately) an average of the two inputs? Obviously they'd feel that the controls weren't moving, but that could be attributed to a number of factors (e.g. icing of the control surfaces).

Well the alternative is what planes with yokes were doing before: they move together. However, I feel this behavior would be odd on a joystick...

an alternative would be to move the sticks together, the way non-fly-by-wire planes work.

They could also make the sticks move together even on fly by wire planes (Boeing does it) using force feedback. That is one thing that Airbus really should have done instead of providing no physical feedback. The expectation is that you would use your eyes instead, but the visual channel is already heavily loaded.

Maybe in the non-pathological case (two pilots performing the same actions almost in sync--which would include many moments of minor conflict as one transitions before the other) it results in a slightly smoother result?

Even if so, a terrible design choice to improve the common case at the expense of the rarer but much more critical case.

There was an interesting discussion on here about this nearly a year ago, after the data recorders turned up.

http://news.ycombinator.com/item?id=3327202

That HN submission links to a Popular Mechanics article that goes over the last 10-12 minutes of AF447's voice recorder, line by line. It's a very detailed read and worth the time. It will also chill you to the bone.

I wrote an explanation of how flight instruments are powered that is germane to this discussion (and IMO helps clarify what happened).

http://news.ycombinator.com/item?id=2595230

I can't imagine the horror of knowing you're going to die in a couple of minutes when the plane crashes.

It is remarkably hard to tell especially as your senses get mislead in a plane. This is why there is a very big distinction between VFR and IFR. With VFR (visual) you look out the window and can clearly see the horizon, which way is up etc and cannot fly at night or in weather/visibility conditions.

With IFR (instrument) the training is to ignore your senses because they will mislead you and use your instruments instead even if they seem wrong based on your senses.

Here for example is a plane rolling while tea is being poured. If you couldn't see out the window you wouldn't even know what was going on http://www.youtube.com/watch?v=Xp2Uc9XvmjY

There have been crashes where VFR pilots have flown into instrument conditions and ask which was is up. It sounds incredulous to us on the ground but it really does happen.

The net effect is that the passengers and crew on the plane would not have felt as if anything is wrong.

Fortunately you can't be sure. On average around 2/3 people die in a plane crash and you can improve your chances a lot by sitting in the right place (near the aisle, a couple of rows from the back is safest if I remember correctly) with seatbelts on. While still terrifying, I was surprised about those chances of survival and so were most of the people I talked to about it.

Really? I can understand how the front of the aircraft (as it collapses) can cushion the impact if you are in that position, but after that you still have to avoid being killed by hypothermia or drowning (if you hit water) or fire (if you hit land.)

The average plane crash is not a 10km stall into the ground.

from the reports it appears that most people onboard would have been blissfully unaware of their impending doom - which is some solace.

Yes, even the pilots didn't seem to realize they were going to crash seconds before hitting the water. I can't begin to imagine the shock of this realisation though.

The root cause was Technical failure, not pilot error. The instruments were wrong and the burden of accuracy on such a technically complicated machine is on the aircraft.

But that's too easy to sue for so the manufacturers of the systems press to blame the dead crew.

This is standard corporate culture.

The fact that the pilot ignored the continuous audible "Stall! Stall! Stall!" alarm and kept the control stick pulled fully back (the opposite of what you want to do in a stall) suggests to me that it's legitimate to place some of the blame on human error.

It's worth pointing out that the stall alarm goes off both when you go into a stall and when you come out of it, and you have to do very different things in those situations.

  > The fact that the pilot ignored the continuous "Stall! Stall! Stall!" alarm 
  > and kept the control stick pulled fully back

The fact is that the black boxes recorded this behavior. Can we be 100% certain that the copilot actually did this? My concern is that we're still trusting the output of a system that has proven to be suspect.

The copilot mentions he pulled the stick all along in the cockpit recording about 30 seconds before crashing. EDIT: When the pilot realized the error, he tried to correct, but it was already too late.

Other than the airspeed sensors freezing up, I'm not aware of any other known malfunctions. What makes you say the system was "proven to be suspect"?

I'm quoting Wikipedia's summary of the Report:

  * The stall warning deactivates by design when the angle of attack measurements
    are considered invalid and this is the case when the airspeed drops 
    below a certain limit.
  * In consequence, the stall warning stopped and came back on several times 
    during the stall; in particular, it came on whenever the pilot pushed forward 
    on the stick and then stopped when he pulled back; this may have
    confused the pilots.
  * Despite the fact that they were aware that altitude was declining rapidly,
    the pilots were unable to determine which instruments to trust: it may have
    appeared to them that all values were incoherent.

Personally, I'm not sure whether to believe that the copilot simply made an amateur mistake .

It was pilot error. An amateur pilot in the same situation would not have crashed the plane, as it was a really basic error. I don't mean to say the pilots were bad - just that with flying, as with all skills, being very advanced can make you quite bad at some of the basics.

The instruments actually could not have done much better, without any external reference points there are some situations that are indistinguishable from air speed, pressure, and g-forces alone. Sadly, the stall profile they were in was one such situation.

While one pilot made an error, the more senior pilot could not tell the error was being made because of the way the controls work. To put it in your terms - the same problem couldn't occur in a cessna.

> the same problem couldn't occur in a cessna

Frequently true! :D Although my personal mantra is "the same problem couldn't occur in a sailplane" ;)

The pitot static system had demonstrated itself to be failing, leading the pilots to lose faith in their instruments.

Let he who has flown in the soup with flaky instrumentation cast the first stone.

All (or most) comercial planes also have an amber LED alarm on the caution panel that says PITOT when the PITOT HEAT switch is turned off.

If that alarm was functional and activated before they entered that stall profile, it was, in my opinion, some serious misjudgement by the pilots not to turn the pitot heat on.

But then again, I've only flown a PA-38 on storm conditions, so take this with a huge grain of salt.

Can we clarify the title to "2009 Air France crash 'due to pilot and technical failure'"?

The way it is now makes it sound like there was another crash.

The crash was in 2009. This story is from 2012 -- today, in fact.

I've amended the title to observe that this is the July 1012 publishing of the final report for the crash that was in 2009.

Hmm, it didn't seem to work.

Silent failure hitting the 80 char limit, lack of change not noticed on mobile device. Now fixed - sorry.

Reply on news.ycombinator.com