Serious incident to the 777-300ER on 5 April 2022 at CDG [pdf]
bea.aero
bea.aero
The detent connection enables one pilot to control the left and right cables. The idea is that if one set of cables jams, the pilot can still control his elevator by applying enough force to pop the cam out of the detent.
Of course, if both pilots pull hard enough in opposite directions, it will come out of the detent as well.
I was one of the engineers working on the 757 elevator system. I don't recall anyone talking about the possibility of the two pilots fighting each other for control. It was just inconceivable. Besides, both pilots would be able to feel the controls "popping" out of the detent. I doubt a warning horn would have made them less confused.
I don't know if pilot training included popping out of the detent so they know what it feels like, but it seems like a good idea.
Suicidal pilot?
Also something I've always wondered - when designing an airliner what's the boilerplate error rate for a trained human pilot, that you use in "ah yes but what if the pilot does it wrong?" type calculations?
A lot of effort goes into figuring out what a pilot would naturally do, and to make that work. Much information comes from real life incidents.
The engineers and management I worked with were all keenly aware of their responsibility for safety and quality. Nobody wanted to make a mistake that caused an accident. I never heard anyone try to sacrifice safety for money.
This is an automatic range limiter, not under pilot control.
There is also a stabilizer trim system, which pivots the entire horizontal stabilizer, elevators and all.
It's all rather complicated.
Probably just behind the MCAS.
Say one pilot loses consciousness, the other one has to extract them from their seat before they can fly the airplane. That's no easy task - humans are surprisingly heavy once they pass out.
Edit: I've got it! We'll have a single pilot but they'll be based on a Rust rewrite of ChatGPT running on RISC-V.
Airbus has a dual input alert, apparently Boeing doesn’t, and didn’t add it after this incident, blows my mind. Still they’re far from perfect, stress deafness is absolutely a thing.
Active sticks (force feedback) are finally making it into commercial cockpits, they’ve been deployed in business jets, and the Irkut MC-21 was supposed to be the first implementation in an airliner (as it’s french-made, that’s been sunk by the Russian invasion of Ukraine and subsequent economic blockade).
This means hopefully active stick swill make it into big two airframes eventually. I assume there’s some redesign work ongoing as it likely requires additional power and data connection, AFAIK currently the sticks (Airbus’s anyway) are just centered and resisting via springs, I don’t think there’s any data fed back into the sticks.
Probably because it's a patent lawsuit minefield.
I would assume the issues are / were around reliability, failure modes, certification and training rather than patents.
What force feedback in addition would you have in mind?
They did (and I think from the start, because unlike on Boeing's controls which are mechanically linked, there's no easy way of knowing the other pilot is inputting). From the wikipedia article of the crash:
> The inputs cancelled each other out and triggered an audible "dual input" warning.
https://en.wikipedia.org/wiki/Air_France_Flight_447
It's just that, as has been seen on many crashes, hearing is one of the first senses that disappears under heavy stress.
As you say, UI design choices can make errors more or less likely. Absolutely everyone makes mistakes. We need to design to reduce the likelihood of mistakes and to minimise the impact of mistakes when they do happen.
To be clear, I think everyone in the industry understands this, but when reported in the media, the average public just hears, "Pilots f'ed up," which is almost never a complete picture.
Taking the recent incident at HND earlier this month between a JAL A350 and JCG DHC-8, the investigation (currently still ongoing) is pointing to the JCG Captain astronomically fucking up:
* ATC ordered the JCG DHC-8 to hold short of the runway and informed them they were #1 in the take off queue. Take off clearance was never given.
* The First Officer of the JCG DHC-8 read back the order to hold short and their position in the queue.
* JAL A350 had clearance to land and (along with other aircraft) listened in to the above conversation, routine stuff to help maintain situational awareness.
* The Captain of the JCG DHC-8 entered the runway, violating order to hold short, and sat there for approximately 40 seconds until they were struck by the JAL A350.
ATC, JAL, and even the JCG First Officer all did things right and yet all it took was apparently one Captain screwing up.
Yes, there were compounding factors like how it was nighttime and all the airport lights flooded out the JCG DHC-8's lights, but pilot error is the only reasonable way of ultimately explaining incidents like this.
Also important is that there is no single root cause for any event. Therefore there is no single 'error' that could be attributed to any one root anyway (in particular the pilot).
They go and list everything that went wrong, without even a lot of concern for causality. They also list all reasonable points of improvement, regardless if they were important for this one incident or not.
Human error is always there, of course. But the idea that they are blaming this on the human is wrong. They are not blaming anything on anything.
The pilot should not be drunk.
The pilot’s boss should not have let him onto the airplane while drunk.
That guy’s boss should have ensured that they breathalyze every pilot. And so on up the chain to the owners of the airline, who should appoint a CEO who can get the job done.
In aviation, every knob you turn has at least two effects.
Confirmation bias is really hard to break. When you're in a situation and start telling yourself a story about what's going on, it's really hard for even break that narrative, even when the "you're being an idiot" light turns on.
I remember one airliner crash turned out to have been caused by one of the pilots letting his kid sit in the seat while at altitude.
When humans are involved, there's always the potential for human error.
> when reported in the media, the average public just hears, "Pilots f'ed up,"
Unfortunately, for a mass media audience, this is unavoidable. People are always looking for "the answer". To understand nuance in a specialized field, most people will need an overview of the problem set to grasp the topic. Really you'd need more of a 60 Minutes type exposé to explain that; it's too much for a typical news report.
The reason pilots are there is to diagnose problems and take the right corrective action. This also means they can misdiagnose problems and take the wrong action. This is where pilot training comes in.
I would have hoped for Boeing to add a warning system in the case of dual input, like in Airbus aircrafts, but it seems they did the bare minimum here. Simple warnings were added to the pilot hanbook that basically amount to "don't apply opposite inputs".
Anything that goes wrong is due to dysfunctional management, not greed.
“Dysfunctional management” is a direct function of managerial incentives, which is generally capitalistic greed (aka “obligation to maximize shareholder value”)
As for where you draw the line on safety regulations, the optimum answer is always “considerably past the point that business owners start complaining about excessive regulation”.
Pricing is due to both supply and demand - there can’t be a sustainable supply of a expensive-to-make cars at loss-making prices
However, all else equal, a vehicle with more active and passive safety features and more safety engineering is more expensive. Even after you account for economies of scale.
For example, airbags are extremely mass produced and have just about as much economies of scale as possible. But, in countries where they are not mandated, you can still find cars offered without them, because they are cheaper. The same is also true for vehicles without UHHS safety cages, ABS, stability control, etc. All of these things cost money.
We should all live in countries that mandate extremely high safety standards and spend their time worrying about how to raise the average income to compensate, rather than in a country that accepts unreasonable risk just to keep wages unreasonably low.
If Ford had accounted for those punitive costs in their calculation, then the outcome of the cost/benefit calculation would have overwhelmingly favoured a fix. The real business problem was not the empathy-free approach, but poor mathematical modelling.
That was in large part due to the disgust over the report they had penned.
> If Ford had accounted for those punitive costs in their calculation, then the outcome of the cost/benefit calculation
Would still have been a cost/benefit calculation rather than a moral or ethical one, aka capitalistic greed.
Nowadays companies can seriously suffer by mishandling their "attitudes" over social justice issues, my gut reaction was that if that's true how could they get away with a plane falling out of the sky. Still a bigger deal than dozen people dying in cars with faulty fuel systems, perhaps just because of the optics.
You're describing effective regulatory oversight. That is a manual control on capitalism, and something capitalism inevitably fights against. Psychopaths exist and look for ways to exploit capitalism, including "fuck it, we'll risk loss of human life and possibly having to shut down the company", which you said isn't due to capitalism. But it is: it's due to the combination of capitalism and human nature, but we can only control the former. The solution is regulatory oversight, as you just pointed out.
Also: realize that psychopaths will absolutely risk shutting down the company if they think they can exit with a personal profit before that happens. CEOs routinely fuck over the longevity of the companies they lead, knowing they won't be around for the fallout. In fact it's hard to find situations where this doesn't happen -- it's almost always private companies or companies where the CEO is completely entrenched.
That's a disingenuous take. There are plenty of examples where psycho apparatchiks of anti-capitalist regimes made decisions "for the common good" that resulted in loss of life and even genocide and still they hailed those results as a win.
You missed the whole point. The point is that having psychos in charge is not a characteristic of an economic system. It's a characteristic of forming organizations manned by human beings.
It's terribly disingenuous to use that as a pretext to bash an economic system as if you don't have the exact same problem affecting organizations that are not ran based on that economic system. It's like claiming that the fact that water is wet is a precipitation of capitalism.
I don't think that's a valid comparison.
For a startup to disrupt a market, it should have some semblance of a win.
Boeing is doing all this to avoid a major loss.
Fighting to stay afloat is not the same as disrupting a market.
If Boeing were developing radical new designs, I’d be with you. I might even be with them. But they’re not. The 737 Max 9 isn’t revolutionary in any capacity; the newness is practically all in the engines.
Funnily they're doing the same thing with the 737 Maxes undergoing certification now (10 and 7), which have a small design defect in that if the engine de-icing is on and you leave it on after takeoff, it will overheat and melt the cowling... silently, without any warning or sensor or indicator. They plan on fixing this in like 2025 and want an exemption to allow them to certify the 7 and 10, same as the 8 and 9 that are already certified and flying with this defect, with the solution of "pilots should just not forget to turn it off".
But this?
Expecting pilots to communicate to each other about which one of them is flying the aircraft (as opposed to like, just grabbing a yoke and YOLOing it?) does not seem like an overly onerous amount of red tape.
That seems like an absolutely fundamental aspect of flying. It's so fundamental I'm not even sure it would qualify as CRM (crew resource management)
It already exists, but in emergency under stress it's an easy thing to forget or even not hear at all(cf. the linked incident and many others).
I'm starting to wonder if there's something inherent in the design of the Airbus side-stick that makes this sequence of events (i.e. banking, overcorrecting, climbing) more likely if the aircraft suddenly switches from normal to alternate law.
I think it’s less something specific to the Airbus sidestick implementation and more over-reliance on cockpit automation in general. Airbus alternate law flies more like (not exactly like) a non-FBW traditional airplane, and pilots who never train that skill (because they always fly normal law) become overloaded when thrown into that situation unexpectedly.
A primary problem is that your muscle-memory is all wrong. Holding the stick to the side no longer gives a constant-bank turn. You have to re-center the stick when you get to the desired bank angle. Pulling all the way back doesn’t give you a constant near-maximum rate of climb (You can stall the airplane), and need to apply a little less back pressure when you get to the desired pitch. You also need to manually adjust pitch trim for any speed or power changes. So a failure that induces alt law means that you took off in one airplane and are now flying a different airplane.
The event that precipitated alt law is nearly always an emergency or near-emergency on its own. So not only are you flying a different airplane than the one you’re used to, you’re also diagnosing system failures at the same time.
If there’s anything to blame with Airbus’s implementation, I would argue it’s that the normal law is too dissimilar to how airplanes actually fly.
Edited for clarity.
Airbus got some flak at the time for the AF 447 accident, both for this side stick issue and for the way the stall system unintuively stopped when the plane was pointed up (because its speed decreased to a level that was below some threshold that allowed the warnings).
I find it surprising how these UI elements in aviation are so primitive, we should improve them.
Mechanically linked dual controls, like those on this aircraft, do give you indication that the other pilot is operating them (i.e. your controls physically move in tandem with their inputs). The problem is that if you both provide exactly opposite inputs at the same time both parties can interpret the physical resistance as jammed controls. An audible warning could be useful, but it could also fail if you're in a critical situation that has triggered other audible alerts (e.g. an audible stall warning). Audible warnings also carry the danger of not being comprehensive - if pilots come to rely on warnings of input conflicts instead of training to use explicit verbal communication, they may mistakenly assume that the absence of a conflicting input warning means there is no conflicting input (which may not be the case if the warning system is not absolutely comprehensive).
Another approach here is to have a mechanism that allows one pilot to lock-the controls of the other pilot, coupled with some sort of visual/audible indication as to who is in control. This is sort of a different spin on the 'explicit communication' approach.
This thread is kinda funny because generally aviation threads on HN like to shit on airbus for their sidesticks and tout linked controls as obviously superior.
The trouble is that those warnings should not be necessary.
It is drummed into the skulls of all pilots that there is only ever one person at the controls.
When you are a student pilot with an instructor in the other seat, the "I have control", "You have control" mantra is drummed into you.
When you progress onto professional multi-crew operations, this is further re-enforced through operational "Pilot Flying", "Pilot Not Flying" roles introduced during your MCC (Multi Crew Cooperation) training.
Also, from a purely practical perspective Boeing are yoke-based aircraft, not Airbus joysticks. So it should be pretty bloody obvious if dual control is going on.
Yet we have an example here where it wasn't obvious to a (presumably) fully competent crew who got to the point of missing an approach and declaring an emergency for a flight control anomaly that they couldn't diagnose as being the other human 4 feet away from them also being on the controls.
"Should be" obviously wasn't "is" in this case.
Edit to add: Also from the report:
The following factors may have contributed to the simultaneous inputs on the controls:
<snipped 5 other bullets>
• the conviction that simultaneous inputs on the controls would be quickly perceived by crews on this type of aeroplane.I think you need to re-read the PDF. My reading of it is that the missed-approach decision was made by the PF on the basis of the unstablised approach, and that it is what happened after that decision that is under investigation in this report. Undertaking MAP due to unstable approach is pretty standard stuff that occurs all day, every day.
The report states there were zero force inputs by PM prior to the missed-approach, which correlates with the other note in the report that the PM ghosted the controls in the period following the missed-approach and that is when the apparent reflex action occured.
This disorientation of the PF was the triggering event, which caused him to call the go-around [prior to stabilized approach criteria being violated], the approach to be terminated, and required the PM (the captain) to make corrective [and conflicting] control inputs. These conflicting inputs were not accompanied by the normal exchange of controls communications.
You are correct that the missed approach procedure was initiated before the controls conflict between humans began (but after the co-pilot's disorientation made him suspect a flight controls problem). I was wrong on that point.
Single points of failure should be avoided. Like in driving, things should work out if driver A or driver B does the right thing, or if the road is designed right, or if pedestrians are following reasonable rules, you just try to make all those things true, so if any of them are not, it isn't a disaster.
Of course they shouldn't be, but it's a protection against scenerios such as miscommunication, being distracted and forgetting you handed them over, etc.
> mantra is drummed into you.
The real danger to well-trained behavior is emergencies and task-saturation. That's when you're most likely be distracted, act impulsively, etc.
Literally halve of all warnings can be covered by "The humans should have been paying attention and noticed it".
> The captain then acted, most probably by reflex action, on the control column to reduce this pitch attitude without taking back the controls and making the procedure call-out, based on the principle of only one pilot having the controls. The two pilots then simultaneously made inputs on the controls. The pitch controls were desynchronized for 12 s due to opposing forces
It sounds like Air France has still not trained their pilots on proper cockpit discipline. This already proved fatal before (AF 447).
As a passenger, the real problem with flying nowadays is that it's quite a lot like riding the bus.
1.5.5.1 Captain’s statement The captain indicated that it was a flight with difficult hours. He explained that six hours before the flight, he had had a nap of an hour and a half, and that with the co-pilot, they alternated controlled rest periods during the cruise flight.
1.5.5.2 Co-pilot’s statement The co-pilot said it was a tiring flight. He added that they had taken controlled rest during the flight to deal with this specificity. He explained that four hours before leaving the hotel, he had had a nap of an hour and a half to two hours.
--
More from the captain statement:
The captain noticed that at 400 ft9, the aeroplane had clearly veered to the left. He was surprised. He saw the wheel move 45°10 to the left and did not see the co-pilot correct this. The co-pilot then called out “go around”. According to the captain, this was a critical situation: aborting the approach in a turn with the wheel turned in the same direction. The captain saw the co -pilot make a nose-up input on the control column, press the TO/GA switches and push the throttle levers forward. The power increased but the captain did not see the LNAV TO/GA display appear. The co-pilot then held the wheel with both hands and the pitch attitude became positive. But the wheel was still turned to the left
This is a well understood and generic problem in dual-control aviation - see https://www.faasafety.gov/files/helpcontent/Courses/ALC-36/c... for example. The standard exchange of flight control procedure is designed to create a common understanding between the pilots as to who is in control of the plane. Interestingly it's similar to a TCP three-way handshake:
Pilot A: You have control of the plane.
Pilot B: I have control of the plane.
Pilot A: Acknowledge you have control of the plane.
It is unconscionable that the training for this aircraft does not include a thorough examination of competence in interpreting multiple control inputs/control jamming.
The fact that under these conditions the aircraft defaults to responding to -neither- control input, but rather the mean of the two, without any master caution or obvious alarm condition seems like a dubious engineering decision at best, and certainly should merit significant training to recognize the conditions under which the -aircraft would decide not to respond fully to ANY control input- .
Of course, cockpit discipline is paramount, and this near-accident was a direct result of CRM failure, but by design the control system makes this forseeable eventuality much more insidiously dangerous and disorienting to pilots. At the very least, significant training on the specific possibility is merited, and an alarm condition for this specifically out of parameter situation should exist.
If I didn’t know better, I would suspect that Boeing was intentionally engineering their flight control automation systems to exploit foreseeable pilot errors and exacerbate them, and then maliciously forgoing trading requirements on those features.
Wouldn’t it be better to simply hard-lock the controls together, with a release switch for each control to allow either pilot to unlock their controller from the other in case of a stuck control system or an uncooperative pilot? That would seem to capture the benefits of de synchronizable controls while avoiding the empirically problematic downside.
Does anyone know what "The pitch controls were desynchronized for 12s" actually means? and was this a system response to the two controls having opposing forces, or an unexpected result of it.
Edit: Actually, I'm completely wrong, ignore me
That is my understanding of both systems at least
> often only associated it with a jammed control
I assume in no small part because
> the description of the system in the [flight crew operating manual] was limited to an explanation about the risk of a control jamming
And it seems likely the precise behaviour of the system in case of breakout is not documented either.
> The inputs cancelled each other out and triggered an audible "dual input" warning.
My understanding is that it always averages the input, even when they're not desynchronized (but obviously, since the inputs are equal in that case, the average ends up being equal to the inputs themselves).
Boeing's control columns are mechanically linked, but given (iirc) 50 lbs of force, they will mechanically desynchronize. If memory serves, they will snap back into sync once the force is released. I don't recall there being an aural warning for this.
The issues with Airbus's approach are that (a) in high-stress environments, aural warnings are the first ones to be unconsciously ignored, and (b) you get no haptic feedback, either from the other pilot's side stick, or from the control surfaces (since modern Airbuses are FBW, though you could still do electronic feedback via an active side stick). There's some talk of Airbus moving to active side sticks in the future to mitigate this issue.
The issue with Boeing's approach is that in a high-stress, tunnel-visioned situation, you can't tell another pilot's input feedback apart from something like jammed flight controls, a runaway stabiliser, or any other trim or autopilot malfunction, to name a few. There's also some talk of Boeing moving to active side sticks in the future to mitigate this issue.
[0] https://aircrafttechnic.com/wp-content/uploads/2020/10/Ads%C4%B1z-4.png> in the event of antagonistic inputs exceeding the breakout mechanism’s activation threshold, the controls would be desynchronised and the control surface would react according to the mean control position.
The breakout threshold is 50lbs, but it’s the combined thresholds, so sudden opposite force applied by two pilots (as apparently happened here) can unexpectedly trigger it. The report confirms there is no warning of breakout situation whether visual or aural.
The advantage is obvious: it's the most similar to how it worked back when the controls were fully mechanical.
IIRC, some old planes even had each side mechanically controlling independent halves of the control surfaces, such that the end result is the average of the inputs in case one of the control surfaces (or the cabling connecting to the controls) is jammed.
Pilots are trained very thoroughly to react to stick shakers in one specific and immediate way -- execute the stall escape manoeuvre, and that's to immediately, with only very minimal instrument scanning (typically, just check altitude and airspeed), apply power and push nose down to the extent the surrounding terrain will allow you.
I do agree that dual input could be better handled, but I doubt we'll see many big leaps in that area until active side sticks become the norm. For Boeing aircraft with yokes, I can't see a good solution. Maybe have some kind of hard-to-miss, single-purpose visual indicator on the glare shield, like where Airbus puts theirs? Or an alert when the two control columns get unlinked?
Also, to be clear -- stick shakers are a Boeing-only feature. Airbus has an aural, but very distinctive "STALL, STALL" warning, plus flight envelope protection provided by the FBW system. Alpha floor protection (A.FLOOR) is the subsystem responsible for preventing stalls.
EDIT: ya know, maybe as HUDs get more widespread in civil aviation there might be better ways to surface this information. Fundamentally, we can only alert pilots in so many ways based on the five major senses, and with taste and smell being out, that leaves aural, haptic, and visual indicators.
Aural and haptic are sort-of out for the reasons outlined above, and visual indicators have to resort to being easily parseable in peripheral vision, since if a pilot's in a high-stress situation they may be looking out the windshield first. That's why it makes sense to put urgent stuff on the glare shield; it's easier to see it out of your peripheral.
With HUDs, these indicators can be more information dense. Instead of a green light or an arrow indicating dual input or stick priority, you can have DUAL INPUT flash over the centre of the HUD.
Most modern HUDs have the drawback of being monochrome green, which is a limiting factor on information density here.
Is that true? I seem to recall that Airbus gave "priority" to one side or the other (with the side being switchable on demand, not fixed).
- airbus controls are not mechanically linked, save possibly on the A300 (which has a yoke not side-stick), but there’s less than 200 of these still flying
- airbus sticks have a priority / takeover button, but by default dual inputs are averaged (this is also what happens in Boeings when you trigger a breakout apparently)
- Airbus has a “dual input” aural alarm
Side sticks are not mechanically linked.
In all cases, the flight computer works of the average of the two sticks. When they are in sync, this works great. In a situation like this one, where the pilots are pushing in opposite directions, the average will all of a sudden, be quite different from both controls.