Hacker News Reader

Comment by js2 | Hacker News Reader

For years after AF447 I was nervous flying airbus. In reality, it's extremely unlikely that you'll die flying.

(I'd be nervous flying a Max too, but it's not rational.)

The difference with AF447 was that the aircraft at no point was defective, it was purely confusion on part of the flight crew and the issue with two pilots "in control" which the Captain absolutely should have dealt with.

The pitot tubes had iced-over and it wasn't the first time:

https://en.wikipedia.org/wiki/Air_France_Flight_447#Pitot_tu...

But that's not what made me nervous about Airbus. Rather, that's when I learned that Airbuses are flown by side-sticks that aren't mechanically linked while Boeings are flown by yokes which are.

https://en.wikipedia.org/wiki/Air_France_Flight_447#Side-sti...

The idea that two pilots can provide conflicting inputs without realizing it bothers me from a design standpoint.

The advantages of fly-by-wire are too good to pass up, so that leaves the question of how to design an FBW system.

A high school teacher of mine in the 1970s predicted an accident like AF447. He framed it this way: the 'American' approach is to implement FBW to always do what the pilot inputs indicate, whereas the 'French' approach is to do the right thing, and override the pilot if the FBW 'knows' better. That's an interesting cultural cultural consistency as well!

So, the 'American' approach is better if the sensors are not working as expected, and it makes the software simpler. The 'French' approach is better if the pilot is wrong, but both the sensors and the software must be working perfectly. Everyone makes mistakes, and all software has bugs. What to do?

(In reality, some 'judgement' is needed by the software, even in the American approach.)

EDIT: That said, some of the design choices in the Airbus FBW are baffling, such as making the control input the average of two different inputs. I like to think AF447 is less likely to have happened in a Boeing ship, although the ulitimate cause of the crash was a pilot making what amounts to a beginner mistake.

Don't miss William Langewiesche's article!

https://www.vanityfair.com/news/business/2014/10/air-france-...

None of this is relevant to the actual issue raised by the GP: the yokes of the pilot and co-pilot are not mechanically linked. They can be mechanically linked even with a FBW system. And personally, as someone with a bit of flying experience myself, I can't comprehend why you'd want them to not be mechanically linked. The opportunity for confusion with conflicting inputs is too damn high.

Mechanically linking is heavier than fbw/electrical/fiber optic linking, and what's the point if there's no mechanical linkage to the control surfaces?

With the fbw system, the software makes the choice on how to interpret the control movement, use one or both? If one, which one?

EDIT: Maybe you mean that a mechanical linkage would provide a feedback mechanism, so that one pilot would know if the other pilot was attempting an input? I don't know if there's force feedback on Airbus flight controls.

> what's the point if there's no mechanical linkage to the control surfaces?

In this case, the pilot would have realized the junior copilot was issuing control inputs and (likely) prevented a plane from crashing, saving the lives of all aboard.

Seems like a pretty decent point to me.

> EDIT: Maybe you mean that a mechanical linkage would provide a feedback mechanism, so that one pilot would know if the other pilot was attempting an input? I don't know if there's force feedback on Airbus flight controls.

Yes, that's what I meant. And no, there isn't. At least, not one that would indicate conflicting inputs from the other pilot.

Which is one of the main cause of the crash.. Is there an alarm now indicating conflicting inputs from pilots on Airbuses?

> although the ulitimate cause of the crash was a pilot making what amounts to a beginner mistake.

But it was only one of the pilots, the right-side pilot, who continued to hold the stick back and and retained command. The left-side pilot didn't realize that was occurring until it was too late.

> while Boeings are flown by yokes which are [mechanically linked]

They can still be disconnected with sufficient opposite force, there's a shearable torque tube between them.

Indeed, but you'd definitely notice (unlike on the Airbus). Furthermore, if I'm not mistaken, you'd then have a split elevator (one side up, one side down), while the Airbus just averages the two inputs and sets the elevator there, conceptually.

Pitot tubes icing over is common on all planes not just Airbus planes. It's more or less expected and planned for.

I’m not a pilot. I’ve just read the Wikipedia page on this crash and the final report. I don’t know what is common or expected and planned for but I take your characterization to mean that you think that it’s not a significant problem.

There’s three pitot tubes. There were ADs issued over them icing over. Airbus replaced them multiple times with tubes from different vendors.

In the final report, the first major issue is “Temporary inconsistency between the measured speeds, likely as a result of the obstruction of the pitot tubes by ice crystals, caused autopilot disconnection and reconfiguration to alternate law.”

Icing over of pitot tubes seems more significant to me than I think you’re making it out to be.

It really highlights how terribly trained the pilots involved are - temporary inconsistency in measured speeds (there are still plenty of reasonable speed sources) in almost all other planes does not result in the plane crashing. Heck, my GPS can do groundspeed easily enough and you have basic pitch and power settings.

How did they not notice their altitude was climbing as they pulled the plane up - they got into a CLIMB rate of 7,000 feet per minute - that's STUPID! WHY climb like that? This has nothing to do with airspeed.

The stall alarm goes off 75 times!

They reduce power to idle for a bit??

It's total nonsense, anyone who has flown a single engine cessna for 200 hours or more would have been able to get out of this easily just based on stall buffet and stall alarms.

Or you underestimate the complexity of the situation and overestimate how a 200-hour Cessna pilot would have performed in that cockpit that night.

I'm not sure what accident you are talking about but the MCAS in the 737 Max overrode pilot input. The real problem was that pilots did not know that the MCAS existed, nor did they know how to disable it.

He's talking about AF447, which involved an Airbus.

No, large aircraft have pitot tube heaters. Flying in non-visual conditions without working pitot tubes would be crazy.

There are aircraft, for example the B-2, that can't fly at all without working pitot tubes.

I won't fly Air France, not just because of AF447, but also the time they diverted into an airport in the middle of a civil war and had a whip round in first class to pay for the gas to get out of there.

https://www.independent.ie/life/travel/travel-news/air-franc...

I won't fly Air France because they cost me 500 euros for nothing. I was in Paris and set to leave and they went on strike. I waited in line for hours to try and get on any flight out, and they said there was no chance I would leave that day, and I should book a hotel.

So we booked the cheapest thing we could find that would work with our baby, and it was 500 euros for the night. Two hours later they called us and told us to get to the airport right away if we wanted to leave France in less than a week.

So we left France on small plane, and couldn't get a refund on the hotel because it was less than 24. All because they couldn't figure out how to get us on that flight two hours earlier when I was at their customer service desk.

Your misconception was assuming people in Paris cared about you.

It is my experience that they barely care about other Parisians, and effectively negatively about anyone else.

I can understand why but a part of me is left thinking, what an adventure that could have been. Sitting around over a drink and telling your story of the time you got caught up in the Syrian Civil War.

The stall warning stopped when the plane was too far into a stall to consider the data valid. I’d say that’s a malfunction for usability. It caused the pilot to keep pulling back because that stopped the warning.

It sure looks defective to me:

It was controlled more by pressure than movement, using joysticks instead of the traditional huge yoke. When one person was screwing up, the other could not observe this. On a Boeing, each person would feel the other person's force because the controls are physically linked.

The stall warning was designed for mild stalls, not severe stalls, and would turn off if the stall was really bad. They got into that state. Every time they reduced the stall, they would get back into the range in which the warning would alert. This caused them to go back into the worse condition, in which the stall warning just gave up.

The pitot tubes, used to sense speed, were prone to clogging with ice. Better equipment is expected on a large passenger plane.

That's all the aircraft itself. If you want to blame the pilots for any of that, then Boeing can rightly say the same for 737 troubles.

Notice how 5/6 reasons the accident report contains are "crew screwed up"

That's a "you're holding it wrong" argument. There are always human factors, no matter how well trained. So while the errors these pilots made shouldn't have happened if they were better trained, at least one of the errors, fighting over who was controlling the plane w/o realizing it, is impossible in a Boeing cockpit.

No its not. The point of these reports is to get to the "primary causes" of the accident and include design decisions that contribute to an accident.

These are trained pilots who did not follow their training. They didn't follow procedures that were in place for these types of events. They did not follow cockpit management procedures. They didnt know how to properly deal with stall conditions, a fundamental piloting skill. They managed to crash a airplane that was flying perfectly fine.

I don't understand the fixation on the sidestick. Its not like they just tossed it in there. Thousands of engineer hours were spent creating the systems to manage control inputs. It may have been a contributing factor, but the sidestick isn't even mentioned in the proposed improvements section. This was pilot failure.

That's fair. Thank you for elaborating.

The thing is, in all aircraft (very much including this Airbus), there are procedures you're supposed to follow for certain failure conditions. They're generally in something called the Quick Reference Handbook, or QRH, but there are also simple flows that crews are supposed to be trained for. One thing that is key in this situation is to announce "my plane" if you are the one flying...which never happened. The Airbus also has a button to mark sidestick priority, removing the other pilot's inputs entirely. That also was not used. No, one part of this (holding the stick full back) could not happen on a Boeing, but the rest of it sure could.

The thing that personally scares me is not Airbus' take on how to fly planes, but rather Boeing's current take on the 737MAX where things are physical controls, kinda, somewhat, unless they aren't and become fly-by-wire. That's the issue with the MAX: if they'd been willing to train pilots for the new dynamics, rather than try to mask it with MCAS, it'd be fine. If it were fully fly-by-wire like an Airbus, it'd be fine. But the halfway house confused everybody on board.

Oh, I agree. My original comment way up thread was based on my perception of the Airbus cockpit to the pre-Max Boeing cockpit.

Since the 737 Max incidents, my perception has changed and my preference now is to fly Antonov. :-)

Because humans screw up all the time. They are the weakest link. You can have the best damn plane and it only takes one guy or gal to drive it into the ground.

The difference between the Boeing problem, where the computer would do un-intuitive things that caused the planes to dive, and the AF447 A330 situation, where the pitot tubes froze over (they shouldn't have) but the aircraft wouldn't try to crash itself, is significant.

Of course the pitots shouldn't have frozen over, and of course the stall warnings were poorly thought out, and of course the lack of direct awareness by the other pilot of Bonin's inputs leads to misunderstanding of the situation, but there's one big problem in the AF447 case that has nothing to do with bugs in the A330.

Bonin (who flew the plane into the ocean) had no awareness of the Airbus's different flight modes or that the autopilot disconnect meant the plane was in Alternate Law, and as a result blissfully kept pulling back on the joystick thinking the computer would save him from ever stalling. The different flight modes are like the most basic part of operating an Airbus in an emergency, and the idea that any trained pilot wouldn't first consider which mode they're in is staggering.

Read the transcript. You have Bonin pulling back on the stick almost continuously without saying so, you have Robert advising him to descend, and Bonin replying that he was descending, when he never did. He let the controls go back to neutral, the plane was still ascending with a wildly high AOA for the conditions, and he quickly reverted to pulling back on the joystick.

Only less than a minute before impact, when the rapid descent and confusion lead to Robert advising Bonin to climb, does Bonin reveal the critical information, at which point both Robert and the Captain must have been shocked and horrified, both realizing they had to dive and also realizing they didn't have enough altitude and were going to crash:

    02:13:40 (Robert) Climb... climb... climb... climb...
    02:13:40 (Bonin) But I've had the stick back the whole time!
     [At last, Bonin tells the others the crucial fact whose import he has so grievously failed to understand himself.]
    02:13:42 (Captain) No, no, no… Don’t climb… no, no. 
    02:13:43 (Robert) Descend, then… Give me the controls… Give me the controls!

     [Bonin yields the controls, and Robert finally puts the nose down. The plane begins to regain speed. But it is still descending at a precipitous angle. As they near 2000 feet, the aircraft's sensors detect the fast-approaching surface and trigger a new alarm. There is no time left to build up speed by pushing the plane's nose forward into a dive. At any rate, without warning his colleagues, Bonin once again takes back the controls and pulls his side stick all the way back.]
    02:14:23 (Robert) Damn it, we’re going to crash… This can’t be happening!
    02:14:25 (Bonin) But what’s happening?
    02:14:27 (Captain) Ten degrees of pitch…

    Exactly 1.4 seconds later, the cockpit voice recorder stops.

Transcript with notes: https://www.tailstrike.com/010609.html

Bonin may have passed training but he clearly wasn't competent to fly an Airbus. Air France crew resource management (communication between pilots) sucked, and a bunch of Airbus quirks led to the other pilots not discovering that Bonin was doing the wrong thing until it was too late. However, virtually any other pilot wouldn't have stalled the plane.

It seems like the difference here is that in the Boeing incidents the flight computer was Bonin, inputting the grossly wrong control[1] based on a tragically flawed model of the current angle of attack. Among all Airbus pilots, there are probably only a small number of Bonins. On the Boeing 737-MAX, every plane has a Bonin.

[1] Not just the wrong command, but of a magnitude that greatly exacerbated the situation, based on an unwarranted level of certitude.

I thought the pitot tube 'failed' by getting iced up? I'm not sure of that's a common thing to happen though.

Obviously the subsequent decisions were what ultimately led to the disaster.

> it's extremely unlikely that you'll die flying

It's usually the not-flying that kills you

Given airplane safety statistics, you actually probably are more likely to die flying than not flying as long as you're in a plane.

> you actually probably are more likely to die flying than not flying as long as you're in a plane

You're more likely to die from natural causes on a plane than from the plane crashing.

Some quick googling:

"287 fatalities on commercial aircraft in 2019." [1]

"Deaths on board are far rarer: one for every 7.74 million passengers." [2]

4543 million passengers globally in 2019. [3]

4543 / 7.74 = 516.

516 > 287. And 2019 had relatively high deaths from crashes (down from 561 in 2018, but higher than the 59 in 2017.)

(Of course, natural cause deaths depend upon your demographic. Planes don't care who is on them when they crash.)

[1] https://www.forbes.com/sites/michaelgoldstein/2020/01/02/avi...

[2] https://www.nytimes.com/2019/10/18/well/live/death-airplane-...

[3] https://www.statista.com/statistics/564717/airline-industry-...

I figured as much, thanks for actually pulling in the stats to prove it.

What about the statistic of dying while flying on a Max?

I guess it depends on exactly what point we consider the state of flying to have ended during a crash. The second the plane first makes contact with the ground, or after all of the fragments stop moving?

I think it comes out in favor of flying either way, but for sure the second makes it pretty lopsided. It limits the possibilities of OnPlane && !Flying to waiting for takeoff, and since you spend more time in the air than grounded even death by natural causes in flight would overtake death while grounded.

> In reality, it's extremely unlikely that you'll die flying

Ironically, hundreds and hundreds of people have died, and that's what caused a ban on 737MAX

Almost all airline accidents in modern days are "freak" accidents, but I personally consider AF447 one of the freakiest of the freaks. The long wait to figure out what was wrong probably amplifies the feeling.

I'm not an expert but I do watch aircrash investigation and many of the accidents are caused by mistakes from pilots, airtraffic controllers and or mechanics.

Thats why this crash bothers me. A design flaw in a production aircraft is not something you expect in the modern age.

Maybe you should re-watch the episode :) . This was much more than a "design flaw". There was an issue with the pitot tube design, but it was enough to bring the airliner down like a rock.

A combination of route planning, misunderstanding of what is happening, CRM, poor UX, and at the end, incompetence were also a factor.

The Max doesn't have the safety levels normal airplanes have.

There haven't been enough flights to get confidence on an exact amount, but it's near the level of urban transportation, not of airline planes.

Reply on news.ycombinator.com