Hacker News Reader

Comment by kloch | Hacker News Reader

It's tempting to blame the inexperienced first officers, their training, or the CRM failures on this flight, but the blame for this crash has to land squarely on the atrociously bad UX of the Airbus cockpit.

Sensory overload and no clear readout of what is actually broken (pitot tube icing in this case) is bad but the fly-by-wire joystick configuration is what really doomed this flight. In Boeing airliners and many other types of aircraft the control sticks are mechanically linked together: you can physically feel if the other pilot is fighting your inputs:

> “Controls to the left,” Robert said, still worried about their bank angle. Pressing the priority button on his side stick, he took control and locked out Bonin, but Bonin immediately pressed his own priority button and assumed control again.

If the controls were mechanically linked Robert would have recognized his inputs were being overridden and would have been able to save the plane.

View on HN

Someone in my extended family works at Airbus as an engineer (hence the throwaway account)

When I asked him about this accident, I brought up this specific point - the mechanical non-linkage.

Sure, the Airbus is fly by wire (there are no "mechanics"), but you can still program one joystick to mimic the other joystick, right? As far as I know, the Airbus plane actually averages the inputs..?? [0]

Anyway, he sorta-angrily gave me the same explanation as I just saw posted here as well: it was a crew management issue. (which of course may have played a huge role).

I am not a pilot so I am probably missing something. But he (the Airbus family member) did seem quite defensive about this. What portion was internalized corporate-comm "we are not at fault" reasoning? What portion was engineering hubris of "fly by wire is unquestionably superior to mechanical linkage"?

I don't know. But I do find it strange... and indefensible. When does the average of inputs make sense? I'm open to an explanation. Is there a good one?

---

[0] See https://news.ycombinator.com/item?id=4224707 from 2012.

"This input was averaged (read: canceled) with the other pilot's nose up input."

(and further down in the same sub-thread)

"The AF447 inputs were averaged."

Averaged inputs on the sticks was the worst thing I read about back when this happened. I can't imagine a circumstance where this is desirable, and it can only lead to confusion.

The 777 and 787 are fly-by-wire aircraft with mechanically-linked yokes. In extreme situations (one yoke is actually stuck and won't move at all), there is a breakaway on that link, and if you exert enough force upon it (like, really hulk at the thing), you can snap it. I don't know whether this has been necessary in flight, but the facility is there. The control surfaces are split between the yokes, so for example the left yoke pitch control commands the left-side elevator, making the plane still controllable with only one working yoke.

> I don't know whether this has been necessary in flight, but the facility is there.

It happened in one accident, where pilots were literally tugging the yokes in opposite directions. They were literally struggling against each other to fix the attitude.

What would you have the system do instead of averaging the inputs? If you have 2 inputs when you should have 1, you warn with a light and sound, and what input do you use in the meantime?

There are plenty of situations where averaging two safe-but-opposite inputs would cause a crash. For instance, if you're holding hands/handcuffed with someone and walking toward a pole, you must both either go left, or both go right. This is a very common scenario in life and we have many solutions for the problem.

In the Air France situation, there's no way for the plane to "know" which pilot's input is correct, so I don't have a good answer, but "just average two drastically different inputs" seems crazy.

> When I asked him about this accident, I brought up this specific point - the mechanical non-linkage. Sure, the Airbus is fly by wire (there are no "mechanics"), but you can still program one joystick to mimic the other joystick, right?

That's come up at least twice in NTSB ship accident reports. Some ships have more than one control station. This is usually to allow driving from a control station out on a bridge wing, where the pier can be seen clearly. A high speed ferry plowed into a dock in New York City in 1993 because of confusion over which station had control. "The NTSB concludes that the propulsion control system on the Seastreak Wall Street used poorly designed visual and audible cues to communicate critical information about mode and control transfer status."[1] Big throttle levers at each station, but only the ones at one station at a time did anything. The levers did not move together.

The U.S. Navy went all the way to touch-screen throttles. After a collision involving confusion over which of three control stations was driving, they're going back to big handles.[2]

The Airbus system has been criticized, but it's two people sitting side by side. The ship systems have control stations much further apart.

[1] https://www.ntsb.gov/investigations/AccidentReports/Reports/...

[2] https://www.theverge.com/2019/8/11/20800111/us-navy-uss-john...

> It's tempting to blame the inexperienced first officers or their training but the blame for this crash has to land squarely on the atrociously bad UX of the Airbus cockpit.

The real problem is that someone who doesn't look at his most critical instrument* in instrument flying conditions, causes a stall, doesn't respond to stall warnings, doesn't communicate, refuses to hand over controls even though he doesn't understand what is happening, is in the cockpit at all. Either the training was inadequate, or deficiencies in Bonin's flying were overlooked.

Also, the PNFs hesitancy to shout "my controls" and/or hitting the priority button, especially as he moves to pitch the plane down when it was probably still recoverable.

That the off-duty captain standing behind them is the first to vocalize they're at 10000 ft and stalling is indeed not great.

He did hit the priority button and say "Controls to the left." Bonin hit his priority button to take back control but didn't say he was taking back control.

The reality is there is not a single thing you can legislate or train that will prevent a pilot from flying a perfectly working plane into the ground if they get stubborn.

Aircraft emergencies are all about keeping you out of panic so that your natural instincts don't surface, because pretty much every natural or intrinsic human instinct, if followed, will just result in you flying the plane into the ground. Every sense you have is overwhelmed with "things aren't working the way I know they are supposed to and my control inputs seemingly have random results", and in a panic, your brain REALLY wants to revert to "just keep going up, away from danger", which is the opposite of what you need to do 95% of the time.

The only fix in this case would have been literally evicting that pilot from the cockpit, and there's no button for that.

> The only fix in this case would have been literally evicting that pilot from the cockpit, and there's no button for that.

Military jets have such a button. Maybe commercial needs to take some inspiration?

what, an ejector to parachute the pilots, fuck the passengers? that would be pretty funny. It does save the airline pilot replacement training though. Or maybe an ejector to throw just the bad pilot out?

Just the bad pilot is what I had in mind

Reading the CVR again, he did in fact ask for the controls ("So give me the controls") several times, but still seemed to be under the impression that they were in overspeed, or at least had to climb.

I think my sibling comment is probably right, Bonin would've required much more severe shouting to take his hand off the stick.

Certainly worth reading: https://bea.aero/uploads/tx_elyextendttnews/annexe.01.en.pdf

Honestly, part of the mistake is also on Dubois. When flying as a team, it is essential to establish hierarchy and make sure who has authority. As the one with the lesser number of hours, Bonin should have been relegated in favor of Robert. That being said, hierarchy should not be as much of an obstacle that the one in authority disregards the suggestions of the copilot.

Bonin in his panic hit his priority button to take back control but didn't say he was taking back control. He should have announced he has the controls - and it is obvious knowledge to pilots that flight behavior us from the averaged stick inputs. But only when they know both are handling flight surfaces.

If a pilot stubbornly wants to keep control maybe out of desperation or panic - and performs actions which are counterfactual to the knowledge of aerodynamics every pilot is taught, there is no instrument system which can salvage this catastrophe.

["Bonin acted like an idiot" - not my words, but two of my CFI friends, who discuss aviation topics on weekends often over beers.]

Bonin was an idiot, I agree. But Dubois should have established a clear hierarchy to prevent the idiot getting control over Robert.

I won't like to criticize someone with a different trade skill (much less when they're already dead), but to paraphrase two of my CFI friends, their summary view was "Bonin acted stupidly". He didn't communicate he had controls, kept pulling the stick to nose up. The pilot psyche element had lot to play in this accident. He was sticking to a naive understanding of aerodynamics in panic - which was counterfactual - rather than counting on prior training experience (like what we developers would say an antipattern). Relaying a similar point, his training still wasn't enough to gather situational awareness & apply common-sense instead of a panicky behavior.

>It's tempting to blame the inexperienced first officers, their training, or the CRM failures on this flight, but the blame for this crash has to land squarely on the atrociously bad UX of the Airbus cockpit.

Hard disagree. No matter how bad the UX, there just isn't any conceivable situation where Bonin's pulling up the rudder for minutes on end wasn't suicidally dangerous, or made any sense at all.

I have to agree with you. Even non-pilots who play video games have enough common sense not to do that: they notice that when they climb sharply they lose speed and eventually stall and that when they dive back down it gives them their speed back and allows them to recover.

His inexperience cannot be denied. Must have been terrifying for the pilot when the plane's safeties and automation suddenly disengaged. Uncertainty and panic must have seized him and never let go.

> Even non-pilots who play video games have enough common sense not to do that

But in video games you likely have good visibility and an external view. AF447 did neither. The human ear is actually really terrible from telling a pitch up stall condition from a pitch down overspeed one, lacking visual references.[1]

[1]: https://en.wikipedia.org/wiki/Sensory_illusions_in_aviation (somatogravic)

Same sentiment heard elsewhere. Pulling stick up in a stall midflight is a rookie mistake. Pulling up & increasing thrust is a takeoff peculiarity. Even if AF447's altimeter was faulty, they both missed something else in their panic - they fell 20,000ft in few minutes, going faster & faster. The g-forces are palpable enough to experienced pilot (who reky on it sometimes when they fly in complete darkness).

This incident was rookie flying behavior coupled with a complete disregard of situational awareness. The flight UX of Airbus isn't that bad: 330 & 340 have a much better panel layout & less clutter than their Boeing counterparts from late 90s.

* The overhead panel would've shown FAULT on the ADIRs.

* The ECAM did show IF SPD DISAGREE: ADR CHECK PROC.

* The plane did shout DUAL INPUT several times, and a button to lock out the other pilot is right on the stick. You can hear it being used by Bonin.

I'd say this is a failure of lack of crew resource management (not even technical ability) more than anything else.

The thing is, people in high-stress situations tend to miss audio cues. That's why Boeing uses stick shakers for the stall warnings.

And there were _several_ incidents with Airbuses that were caused by dual inputs.

Armchair amateur, Pitot tube failure is such a frequent occurrence that I’m angry we display any other warning than this one.

- It should have a needle to eject caps on it, so that pilots don’t forget the caps (Brisbane accident, among many),

- The needle should also sense, if not remove, the ice (Air France accident),

- It should wake up the pilots and reset controls to fixed values for the current altitude, since when Pitot tubes fail, autopilot and autothrottle are worse than worthless (they will automatically crash the plane).

Pitot tube failures are incredibly frustrating. In one case it's theorized a wasp nest blocked the inside of one, after not being covered while on the ground a long time.

https://en.wikipedia.org/wiki/Birgenair_Flight_301

They seem so close to the cockpit window that it’s frustrating pilots can’t open the window (which they can, but not in flight) and clean it up.

If a “needle” worked to remove the ice, that’s what they would use instead of a complex anti-ice system.

Reply on news.ycombinator.com