Flight QF72: What happens when automation leaves pilots powerless?

Would you say that this has limitations and it's not a silver bullet? Eg. What if your software added numbers, formal verification proved that your program was indeed correct because it added the numbers. However, it missed the requirement that you also had to do subtraction, which for some reason was omitted in the specification.

Everything is an inevitability, that's the problem with the design space. We haven't yet invented some perfect machine that will handle everything.

But there are functional and realistic limits to how well you can perform under certain failure scenarios. You might have to increase weight to add more sensors and wiring. That logic to reconcile more sensors will be more complex, and possibly prone to error itself. Added complexity against failure doesn't necessarily increase safety, as much as we always wish it would.

Not available on an Airbus.. there is no mechanical linkage from the flight stick to anything other than it's own housing.

However, on both the modern Airbus and Boeing plans, there's a RAT[1] that will generate hydraulic and electrical power if the planes main and auxiliary systems fail. The (in)famous Gimli Glider[2] used it to survive total power loss after it ran it's fuel tanks dry.

[1]:https://en.wikipedia.org/wiki/Ram_air_turbine [2]:https://en.wikipedia.org/wiki/Gimli_Glider

On the 757, the pilot's controls move steel cables which open and close the valves on hydraulic rams which move the surfaces. Hydraulic power is necessary, which is why there's the backup RAT to supply enough hydraulic pressure to run the primary flight controls if the engines all fail.

A "feel computer" pushes back on the pilot's controls so moving the controls feels like it would on a machine where the surfaces were connected to the cables.

I'm pretty sure the 757 can be flown with no electric power.

> I think the real solution is, as I said above, to give the human pilot a last-ditch way of regaining complete manual control of the plane.

This was my point all along, there is no such thing as "manual control" anymore. It's all a big system working in concert, even moving the control surfaces. And as systems get more complicated, and start to require faster than human response speeds, it will be even less "manual control".

> In the incident described in the article, the pilot could have prevented all of the damage--if only the airplane had responded to his control inputs.

Except that this is ALSO a failure mode: https://en.wikipedia.org/wiki/Air_France_Flight_447

I suspect that the real problem is that the aerospace programmers still regard the humans as a "last ditch" recovery point when that is now totally infeasible. The programming needs to start assuming that it gets no help but needs to recover anyway.

For a more terrestrial example, both Three Mile Island and Fukushima would have turned out better if the humans had sat on their hands and done NOTHING.

That assumes the human won't mistakenly misuse the manual override and cause a crash when the computer would otherwise have been fine on its own.

Computers and humans are both fallible and it's not obvious that the human should be given higher authority than the computer. There isn't a simple answer to this kind of problem. Ultimately someone or something has to make decisions based on sensor data/vision/etc and that something or someone might always get it wrong.

Every Airbus has this already: https://en.wikipedia.org/wiki/Flight_control_modes#Direct_la...

Most articles written by journalists about technical issues read like the journalist took the facts and ran them through a Mixmaster before printing them.

One nice anomaly is the "Aviation Disasters" TV series, which gets the tech right as far as I can tell.

  > there were plenty of times where his airplane did
  > something unexpected and he lost control. But he always
  > had some option for regaining it. (In the last extremity,
  > he could eject [....])

But that's not really a lack of control. In those cases you're merely being challenged to regain control of the aircraft. You just need to fight harder, think smarter, or exit. In any event you still have control (or at least a sense of control) over your life.

I understand why this issue was so unnerving for the pilot. Heck, any passenger could sympathize: it's why flying can be so scary--total and complete lack of control; little to any knowledge about what's happening and why; you're completely at the mercy of somebody else, or nothing at all.

So, yeah, I get it. I was just thinking that of all sorts of pilots, a fighter pilot would be the last to be unnerved by losing control; unnerved to the point of not wanting to fly anymore. a) Fighter jets are super powerful and super sophisticated and when something goes wrong there may not even be any time to regain control no matter your training or experience; you're always flying at that envelope where the unexpected can and often does happen, so I just assumed you invariably accept that you're flipping a coin every time you take-off. b) I presume combat is one of those things where you either resolve yourself to a lack of control or realize you're not able to cope and move on to something else (if you can, and assuming you can move on emotionally). But I guess I shouldn't presume a modern fighter pilot (esp. from the 1980s) to have experienced the same sort of peril as someone on the ground during a war.

That said, I'm not trying to suggest he lost his mind or something. He responded appropriately in the moment. He was able to let his training and experience dictate his responses. He consciously understands that he was unnerved after the fact because of that lack of control, as opposed to not understanding those feelings and fears. I'm just surprised that those feelings (or at least their severity) were novel to him and changed his perception of flying, not that he was unnerved, per se.

It is disconcerting. I do take some heart in the fact that there's thousands of safe operational hours on the flight computers in question. That said, I'd hope that behind the scenes, there's some engineers pouring over data and test units to find exactly why it happened and what needs to be fixed to ensure it can never happen again.

We don't know for sure what caused the ADIRU to start outputting the current altitude numbers but tagged as angle of attack values but this shouldn't have caused an in-flight upset. A spike in AOA from 2.1 degrees to 50.625 degrees and back in 3 seconds is not physically possible, and indeed, the flight computers are capable of detecting and ignoring such flagrantly erroneous data, even if the ADIRU's built-in-test-equipment hasn't announced an ADIRU failure. However, the code that detected anomalous changes in ADIRU data output was a simplistic filter that was vulnerable to a very specific timing of erroneous spikes. It could not handle spikes that were 1.2 seconds (an arbitrary parameter of the filter) apart, and, well, this specific ADIRU failure happened to send erroneous data with that exact timing. The flight computer thus thought that 50.625 degrees was a valid AOA measurement, and reacted accordingly -- by commanding a pitch down with the elevators to avoid the "stall" it thought it was experiencing.

The only issue that hasn't been addressed in the report (which is good reading, https://www.atsb.gov.au/media/3532398/ao2008070.pdf) is that the angle-of-attack value is not directly displayed to the pilots on their flight displays. AOA is measured by the 3 ADIRUs and is one of the most crucial measurements used by the flight computers and their control laws -- after all, whether the wing is stalled or not is a direct function of AOA! AOA value is also critical to upset / loss-of-control / stall recovery but without an AoA instrument, the pilot needs to infer it from other instrument values -- which is nontrivial and also depends on instruments that might be malfunctioning.

Hiding the most crucial air data parameter from the pilots (who are expected to take over when the computers or the air data sensors act up) is a bad design decision. Sullenberger agrees, "We have to infer angle of attack indirectly by referencing speed. That makes stall recognition and recovery that much more difficult. For more than half a century, we've had the capability to display Angle of Attack in the cockpits of most jet transports, one of the most critical parameters, yet we choose not to do it.": http://www.safetyinengineering.com/FileUploads/Situation%20a... . This was a recommendation in the AF447 report as well, " It is essential in order to ensure flight safety to reduce the angle of attack when a stall is imminent. Only a direct readout of the angle of attack could enable crews to rapidly identify the aerodynamic situation of the aeroplane and take the actions that may be required."

Displaying AOA in the flight displays might have helped in this incident as well. Had the pilots seen indicated AOA values spiking immediately preceding the uncommanded pitch-downs, diagnosis and corrective action (which might have included disabling the offending ADIRU) would have been much easier.

It's a question that can't really be answered. It's sort of like asking about

1) instances where your alarm clock prevented you from being late to work

2) instances where your alarm clock failed to wake you up

How could you possibly determine how often your alarm clock prevented you from being late? You can certainly tell how often it fails to do it's job, but you can't determine how often it's success is necessary because there aren't any near misses to detect. With no control group there can be no comparison.

You could count incidents which the flight computer is helpful, but you cannot count incidents that never happened in the first place because of the flight computer.

> Even then, Qantas hasn't lost an airframe or had any fatalities since the dawn of the jet age.

They do have a record as a safe airline ( though Southwest and Ryanair are probably 'safer' given the number of short-haul daily flights they operate ) but QANTAS also go to extreme lengths to maintain that reputation.

For example in 1999 one of their 747s, reg VH-OJH, overran the runway in Bangkok after aquaplaning. The insurers examined it whilst it lay on a golf course and wrote it off as uneconomic to repair. QANTAS however decided to proceed on its own initiative, to maintain its 'no jet losses' reputation, and spent over $100 million on repairs. Probably more than or just about exactly what the aircraft was worth at that time.

They actually had another 11 years service out of that one before it was sent to Marana for storage.

> Safety officials are still investigating how safety checks failed to spot that the calibration data had been deleted.

So I guess the checks for checking the checks of the data failed? You can never have too much redundancy!

Most people assume that's just a precaution to make it easier to move around the cabin and not a choking hazard!

IIRC, Boeing 777s (which are FBW) will automatically disengage the autopilot if you start forcing the stick to a different position. The flight envelope protections are implemented by adding a physical resistance to the stick, but can be overridden by using force, which seems a highly intuitive and deferential implementation. It certainly seems a lot more responsible than Airbus's design, both for the above reasons and for the mechanical linkage you mention.

No, there was an incident several months later with QF71 flying the same route in the opposite direction.

https://en.m.wikipedia.org/wiki/Qantas_Flight_72 See the subheading in the Final Report section