Cockpit crisis | Hacker News Reader

Cockpit crisis

www2.macleans.ca

71 pointsadamtmca37 comments

> Cockpit component company Rockwell Collins, for example, made waves at this year’s Paris air show when it talked about developing a “panic button” for commercial airplanes that would give confused and stricken pilots the option of flipping a switch and letting the computer fly the plane to safety. Not surprisingly, the concept drew ridicule from aviators, who are quick to point out that computers are hardly infallible, as anyone who has ever struggled with a crashed Web browser knows.

One of the more dangerous things when operating a vehicle is cognitive overload; when shit goes wrong, a bunch of stuff tends to get dumped on you and you can't think fast enough to catch up. A way to let the airplane worry about itself for a minute while the pilots can catch up seems to be a decent way to address this side effect of being a conscious being instead of an automaton.

The jab about the unreliability of computers is just that; avionics software is on a much slower release schedule and has a much more fixed set of inputs than a web browser, allowing for a more thorough (or even formal) analysis of its behavior.

> “People say it’s impossible to stall an Airbus, right? It has stall-protection systems and it won’t allow you to exceed the maximum angle of attack where a stall would occur,” argues Paul Strachan, an Air Canada pilot who is the head of the company’s pilots’ union. “But that’s not true. If there’s ice on the wing, that whole detection system isn’t accurate to begin with. I would be pretty hesitant to get on a plane with no pilot.”

Flight control systems can be built to compensate for all sorts of failures[1] that would pose grave difficulty for human pilots, but nobody's really advocating for completely-autonomous passenger planes. The problem right now is that the autonomous systems to reduce pilot workload and improve safety have failure modes that tend to overload the pilots with information. A working, reliable "panic button" would definitely help pilots get back in front of the plane in an emergency situation, but so would fixing the information overload to allow pilots to prioritize important issues (pitot freezing up, speed indicators unreliable) over side effects (unreliable stall warning, alternate law activation).

[1]: http://www.youtube.com/watch?v=xN9f9ycWkOY

If there were a "Panic button", would pilots actually use it? In the case they mentioned, it sounds like the pilot was quite confident that pitching the nose up further would get him out of the stall. Who knows what his reasons were for doing that, but he had to "outmuscle" the existing automated systems to do it. Does that sound like a person who would push a button and let the plane save itself?

> it sounds like the pilot was quite confident that pitching the nose up further would get him out of the stall

I don't think it was confidence, just a semi-reflexive action (if too low, pull up) when there wasn't enough thrust or lift to manage that.

If the training was such that the appropriate response to any cognitive overload/panic situation was to mash the panic button and reason things out, it would save lives.

It sounds like that it's not a "Panic" button that pilots need, but a "Filter" button. Where if you've got 10 alarms going off, the "Filter" shows you the 1 or 2 alarms that matter most and need immediate action. Certainly the computational horsepower for this already exists onboard!

The logic exists too, but it's stored in binders full of easily-updated paper checklists instead of hard-to-update computer software (hard-to-update because FAA certification takes time).

This type of result is attained with experience. My own experience (and many other people I know feel the same) regarding pressure and panic is that you need to have experience to be able to withstand pressure and panic, not better filtered information.

Even with only a few alarms, it's easy for inexperienced people to get panicked about something. But the claims of Sullenberger, the pilot who landed the plane in the Hudson river, are sobering.

http://www.businessinsider.com/capt-sullenberger-stop-cuttin...

Would you recommend that airlines publicize the experience of the pilot on each flight, and offer discounts for travelling with less experienced pilots? Because, other than with something like this, "experience" doesn't sound like an alternative to a "panic button" or a "filter button." Where does the experience come from?

It comes from training in flight school, smaller planes, the air force, etc. There are lots of ways to get quality experience before making the jump to the big planes.

I'm pretty sure all major airlines require a ton of hours on smaller planes, and often large cargo planes, before flying passenger jets--so perhaps experience is not the panacea, or must be more carefully tailored to include the right kinds of crisis situations.

> I'm pretty sure all major airlines require a ton of hours on smaller planes...

That used to be true, and may be right now, but the trend is towards airlines accepting simulator time in lieu. The trouble with that is that simulators are subject to the same problem as any other complex input device: if you haven't foreseen the problem beforehand, you don't program the simulator to model it, and the pilot isn't trained to handle it. Experience can help that simulator time can't.

The recent high-pressure turbine blade failure on Qantas is a case in point where the pilots were overwhelmed with page after page of error faults, 145 of them if I remember correctly. If they hadn't been very fortunate to have two other senior captains in the cockpit with them, they would have had a great deal of trouble dealing with the information flow.

Personally, as a light aircraft pilot myself, I would not be comfortable with young airline pilots with only simulator experience. At least one of them needs to have a few thousand hours of hands-on-stick experience.

Interesting, and disturbing. I sure hope that after every air disaster or near disaster, a new scenario is added to the mandatory simulator training.

I think the problem needs to be seen as a whole. The specific combination of the current warning alarms is more important than one single alarm.

So how will this work when none of the instrumentation is giving the computer the correct airspeed? IN the Air France crash, all three of the Pitot tubes had failed.

Pitot tubes, even when jammed, are not the only instrumentation a plane has. In this particular case, whatever gyroscope device is available would probably signal that the angle of attack is completely wrong, tubes or no tubes.

But without Pitot tubes, what indication of airspeed does one have? And without airspeed, I would think that it is the computer that just hit the panic button.

AOA != pitch

True, of course. Still, any such automated system would have to have massive redundancy and sophisticated heuristics just to get certified.

If /all/ the instruments are incorrect, you might be boned. However, there's gobs of instruments that can be used to paint a partial picture: GPS can be used for altitude and groundspeed in a pinch; there's accelerometers and gyroscopes in place to monitor heading, attitude, and acceleration; and all of these systems are redundant too.

Worst case, add power, level out, and hopefully you'll be stable for a few minutes while the pilots catch up to the airplane.

Groundspeed is not terrible useful.

It can be used to identify when pitot tubes have failed (200kt difference?), and to know that if altitude is stable and the pitch is reasonable that the airplane is in a relatively stable state aerodynamically.

That said, I'm not an aeronautical or control systems engineer, so this is just speculation.

I'm not sure I agree. The speed over the ground means practically nothing from an aerodynamic perspective. You can fly a little Cessna such that it moves backwards relative to the ground if the wind is strong enough.

Once you get to airliner altitudes (say, FL350 and above), the plane does not really want to fly anymore; there is only a narrow band of throttle / pitch inputs that will result in stable flight. You can see this in your favorite flight sim: take a Cessna 172 up to 4000ft and try crashing it. Turn off the engine, cross the controls, and pull the nose up until it stalls. Then release all the controls, and the thing goes back to flying normally with no input from you (and without an engine). Then try this again at 13,500ft in a thunderstorm and see what happens. You can even have engine power. The plane behaves very differently at its service ceiling.

Airspeed data is critical, which is why there were three redundant airspeed systems. Turns out, it wasn't enough.

It's a fine line. There are cases where we actually know that pilots listening to the computer would have saved lives (as in the Überlingen crash)

One possible approach that might have helped in the Air France case might be to let the pilots know what the plane doesn't know, instead of bombarding them with the unsolvable problems it did know.

At one point, they were at full thrust, nose-up, and climbing, yet in the heat of a storm of warnings, they failed to recognize that the airframe, engines, wings were all performing exactly as designed, aside from a panicking computer.

At that point they had completely lost situational awareness, and held the plane nose-up and falling until it contacted the water. If they had been able to 'step back' and look at the wider situation, they almost certainly should have been able to guesstimate some power settings, trim appropriately to lower the nose to recover to a normal flight attitude and hang on until they could trouble-shoot the frozen pitot tubes that had caused the air data computers to lose airspeed info.

That presumes the aircraft and/or its various monitoring and control systems have an awareness of what information is or isn't known.

Unfortunately, in a failure scenario, your most obvious sign of trouble is usually not a clear an unambiguous warning, but a perplexing disagreement between various data.

Your problem is 1) identifying this state 2) identifying a corrective / maintenance action and 3) executing on this. Hopefully before you run into a failure-to-maintain-sufficient-altitude or failure-to-maintain-core-integrity, or other appropriate sustainable operational mode.

Complex situation is complex.

During the stall and plunge of Air France Flight 447 into the ocean, the plane's angle of attack "was not directly displayed to the pilots".

Seems to me a fatal design flaw bordering on ridiculous, to create a user interface that is not displaying this critical piece of information.

There were several other major UI failures:

> In the case of Flight 447, Air France’s pilots’ union has pointed a finger at Airbus by suggesting that the stall warning system on the A330 likely contributed to the doomed ﬂight crew’s confusion by sounding only intermittently even though the plane remained in a stall the whole time.

> In the Air France crash, for example, investigators noted that the plane’s critical angle of attack “was not directly displayed to the pilots” [...]

Not only were they overloaded with useless noise, but critical information was either delivered in a confusing way, by design, or hidden from view...

They need UX people, badly.

The article doesn't mention near misses. How many stalls occur that crews safely recover their planes from? Can we learn anything from their circumstances?

I'm guessing this is a normal occurrence that isn't worth collecting statistics on. Recovering from a stall is simple; it's something you'll do very early in flight training (well before your first solo flight).

Planes crash when a lot of things go wrong at once. In the case of the Colgan Air crash, the problem was not the stall. The problem was that the pilots were sleepy, confused, and under-trained. The stall was too much for them because they were in a state where they could panic, and they didn't have the training to stop panicing and start flying the plane. So they randomly poked the controls, and that didn't save the plane.

Take two training pilots on a full 8 hour's sleep, and the stall probably wouldn't have even happened. If it did, a "whoa" would have been exchanged and they might have gone around for another landing approach. But I don't think it would be a big deal, it's just some randomness that is par for the course when you are trying to float twenty tons of metal through the air.

I'm a glider pilot, and I'm close to stalling every time I fly. It's just something that's part of the regular procedure: You recognize when it's about to happen, and take the appropriate action (which is to ease down on the stick and maintain correct angle of attack). If you're at a reasonable altitude, there is no danger involved. However, I'm pretty sure that an airliner operating regularly practically never approaches a stall condition.

The whole discussion reminded me of Malcolm Gladwell's article "blowup".

http://www.gladwell.com/1996/1996_01_22_a_blowup.htm

The quality of these professional pilots is really disturbing. Why would they pull up more when the plane is already in a stall? I'm pretty sure they teach in lesson 2 or 3 of flight school how to recover from stalls by pulling down on the stick.

That was part of the problem. They covered that in lesson 2 or 3 but didn't follow up at lesson 1300. Like you, I assumed stall recovering was something ongoing but apparently its not. Once you have 1 certificate you move on to the next and the next.

It's like long division in multivar class. Some people can do it again given time but most people wouldn't be able to divide 1345 into 26 right off the bat.

But this isn't rocket science. It isn't even long division. Maintaining a safe angle of attack is the _most basic_ pilot skill there is. If you fly an airplane at all, this is something you have to think about both on approach and takeoff.

To me, it seems ridiculous that pilots are unable to remember this stuff. Really. To recover from a stall, you ease down on the stick and alternatively apply power. Barring a deep-stall condition, it's really that simple. They even teach you that the most basic error in a stall condition is to pull back on the stick in a panic-stricken attempt at forcing the plane to gain altitude. I'm stupefied at these reports.

Although it is recorded as a pilot error to me it is a complete system failure that resulted in pilot error. Considering its a fairly modern plane the typically adhere to lights outs on systems functioning correctly. Then when they don't you have 2 pilots overwhelmed with a slew of whistles and bells going off simultaneously.

The systems were "reporting" alternating stall and overspeed warnings. So you have one system telling you to pull up to slow down and then another saying you are about to stall, the stall readings are invalid...the computer gives up and says you're on your own.

BTW, the AOA screen is not even visible, it's buried in a submenu of the main screen.

Well, to be fair, flying a heavy is vastly different from a light plane. You don't have the seat-of-the-pants feel, centre-of-gravity varies greatly during the flight with fuel burn-off, at cruise you are flying only a few knots over the stall speed, and so on.

There were even situations where pushing forward was the wrong thing to do (although no longer, thank goodness). The 727 could enter a situation where the elevator itself was stalled from the main wing stall.

Modern heavies are about systems management and cockpit procedures. As someone below points out, if one system is telling you to pull up from overspeed, and another is telling you to push forward from stall, which do you believe? And, more importantly, how quickly can you trouble-shoot to find the correct action?

Here's the background on the Buffalo captain, it is frightening how unqualified and poorly paid junior pilots are: http://www.msnbc.msn.com/id/30683954/ns/us_news-life/t/pilot...

http://www.usatoday.com/news/washington/2009-05-13-buffalo-c...

The super computers are strategically taking out problematic groups of humans, staging machine accidents that the humans cannot recover from manually.

I see this as a reoccurring theme in the next 100 years as we get self driving cars, automated food processing, intelligent machines automating everything. We gotta deal with this in a smart way, require by law "Kill computer" switch accessible and known by all operators, to get the computer to stop demanding its own way and just do what the human tells it to do.

Though we can't say we weren't warned, Hal saying he can't jeopardize the mission to Wall-E auto computer demanding it's own way over the will of the captain. Is there even a solution to this problem or are we doomed to be pets one day?

Reply on news.ycombinator.com