Seconds to Disaster: US Edition (7 page)

Aircraft are becoming more
and more sophisticated and yet this statement will disturb readers;
frighteningly, a widely spoken phrase by pilots in response to an aircraft's
odd behavior is, “What is it doing now?”

Meaning that spurious behavior
by the aircraft’s onboard computers has caused an inadvertent action to be
performed by the automation. From computers turning the aircraft in the wrong
direction, to every display in front of the pilots suddenly turning blank,
glitches do occur. They occur more often than you would think, but pilots
generally tend to cope.

US Federal Aviation Administration's
chief scientific and technical adviser, Dr Kathy Abbott, does not believe
computers are ready to replace pilots, who “successfully deal with seventy
percent of unanticipated failures, let alone the failures for which there was a
checklist”.
[57]

To reduce the workload on the
pilots and enable them to deal with the current aircraft flight situation and
to plan ahead, the flying can be done and the systems monitored by computers.

When the first fly-by-wire
Airbus was under production, an unofficial phrase coming from the heart of
Europe was that the most expensive passenger seat on the aircraft would be that
of the pilot. Which may be partly the reason that pilots are being ‘designed
out’ of the aircraft, when in reality, the intelligence of the automation is
not yet good enough to do the pilot’s job.

The pilots sit at the nose of
what can be very large planes, locked away behind a cockpit door and isolated
from the flight attendants, and also “in essence” isolated from the aircraft
systems . “More importantly is the mental isolation caused by the nature of the
controls,” says Donald Norman of UC San Diego.

Another problem is that the
automation does exactly what it should up to this point, relieving the workload
on the pilots but taking them “out of the loop.” But often when something goes
wrong there is no warning or obvious lead up as the automation provides no
running commentary on its operations to the flight crew; as was the case, we
will see in the next chapter, with the pilots of the Air France Flight 447.

Pilots who one minute were
sitting in relative peace can be abruptly plunged into a maelstrom of failures
and warnings.

One such example was the
explosion of an engine onboard a Qantas Airbus A380 on November 4
^th
2010. Severe damage to other parts of the aircraft caused fifty seven separate warnings to be generated by the
automated systems, which were presented to the pilots in the cockpit.

Faced with such an onslaught
of failures, the captain, Richard De Crespigny, decided to identify what
systems he and his crew still had operational and how to safeguard and use
these systems. This onslaught of failures is in essence what is becoming known
in the aviation industry as a “Black Swan” event: an incident that is entirely
unforeseeable. In this case, due to the severe nature of the damage caused when
the engine exploded.

Much of the automation was
sidelined in this case by the pilots in a successful attempt at simplifying the
situation. It was a decision that likely saved the lives of the passengers and
crew on board.

On March 1st 2008, Lufthansa
flight 44 from Munich to Hamburg attempted to land in strong winds of up to 47
knots. The left main wheel touched down and so the computers switched from “flight
mode” to “ground mode”. However, the aircraft was not yet firmly placed on the
runway, and the crew lost the control they needed due to the computer law
changeover designed into the Airbus 320 they were flying. Despite 60 tons of
plane and all its momentum, they were now at the mercy of the wind that swept
the aircraft towards the runway edge, and as a result the wingtip of the A320 struck
the tarmac.

The flying pilot slammed
forward the throttles to abort the landing and made a go around; this decision
by the pilots saved the day. Within seconds of this action the computers
understood the pilots wanted to get airborne once more and so handed back full
control.

132 passengers and 5 crew
escaped disaster that day. Investigators found the wind limits laid down by the
manufacturer and the operator were not only confusing, but there were varying
interpretations by pilots and the airlines about what you can actually do with
that model of aircraft. Also the control laws created a “glitch”, a moment when
the onboard automation didn’t recognize the situation.

“No handbook tells you the
plane will do this,” a senior Lufthansa pilot told Der Spiegel.
[58]
Another Black Swan event?

The problem, it appears, is
not that the automation is too powerful, but not powerful enough. It is not
truly “aware”, according to Donald Norman, and in the human sense cannot
self-monitor; therefore it cannot always give the pilots the total feedback
they need to alert them to a potential problem. Such feedback is essential if
equipment does fail and unexpected events—Black Swan events—occur.

In the words of David
Learmount, of Flight Global: “There has been a loss of pilot exposure to
anything other than pre-packaged flight planning, followed by automated flight.”
He believes the atrophying of their skills must be reversed: “Airlines must
rebuild the pilot skills that automation takes away from them.”

Leaning heavily on automation
to save the day, the airline industry strives to shorten the pilot training
route, to lengthen flight duty hours and increase work schedules. This is
raising a lot of concerns among seasoned professionals; one such result could
be a generation of pilots with low experience and a dependency on automation.

“Automation reduced the
workload, the pressures in the cockpit and helped reduce accidents. That
pressure is reappearing with the arrival of the low fares frenzy. But the
carpet is fraying at the edges and is about to unravel,” says a seasoned captain,
who has over ten thousand hours with an airline headed towards a new low
fares philosophy. He worries that dependency on automation is seeding
complacency.

Much of the training and
simulator testing done today was intended for older aircraft and hasn’t kept
pace with high tech design let alone automation.

Crew training has to change to
take into account the psychology of pilots on the flight deck. The industry and
regulators need to get serious. A complete review of cockpit automation and
training for pilots is called for in order to prepare them for when their
onboard automation might fail. Such a review also requires improved
communication from the aircraft’s automation, so as to aid flight crews
recognize quickly the exact nature of what has gone wrong.

Accident chronicles may record
human error, but on the many occasions when technically troubled flights are
saved by airline crews they are often not made publically known, or even
exposed within an airline. The Miracle on the Hudson was one such Black Swan
event that did achieve worldwide attention for obvious reasons.

But unfortunately, not all
technical disasters are overcome.

Many things
that are wrong with the airline industry converged on the tragic night over the
Atlantic when AF447 disappeared. As always with any accident, it poses many
questions, not least of which is why so many passengers and crew lost their
lives in a calamitous accident that never should have happened.

According to the French investigators, the
catalysts for this tragedy were small but potentially harmful ice crystals that
blocked up the aircraft’s pitot tubes.

Poking out from the aircraft skin, these
pitot tubes measure the inflow of air so that the aircraft’s computers may
calculate current speed and altitude.

That night over the Atlantic as first
officers Robert and Bonin checked their radar due to thunderstorm activity in
their vicinity, they discussed icing risks, which was standard procedure for
their route of flight.  Meanwhile, tiny ice crystals began to form inside the
pitot tubes. Manufactured by Thales, these tubes had a known history of
technical problems due to icing.

As first officers Robert and Bonin flew
their aircraft in the vicinity of the thunderstorms, suddenly the
autopilot and the automatic thrust of the engines tripped out and the
previously tranquil flight deck plummeted into a cascade of alarms. Synthetic
voices shouted out warnings and the aircraft speed displayed on the pilot’s
screens became unreliable and confusing.

The Airbus computers, which would normally
prevent the pilots from moving the aircraft into a dangerous flight condition, abruptly
handed back control to the crew.

But how could experienced pilots lose
control of their aircraft?

The instant transition from a normal flight
into a possible life threatening scenario may have plunged the two first
officers into an information overload,
overwhelming them. In the words of David Learmount of Flight Global, “the pilots were confronted with a
situation they clearly didn’t recognize, or didn’t believe, or didn’t
understand.”
[59]

Did the cockpit design contribute to the disaster?

(A
new human factors sub group created within the AF447 investigation team will
likely offer some important conclusions about this question and ought to be
noted in the final report.)
[60]

The Airbus design is one of the most
complex of any aircraft, in that it relies heavily — if not completely — on
computers. Airbus design philosophy is such that reliance of onboard computerization is almost taken to the point of infallibility.

In a 1994 documentary called Fatal Logic, German
journalist Tim Van Beveren challenged the concept of infallibility assumed by
not only airbus designers but by the founder of the fly-by-wire philosophy.

(Fly-by-wire is an automated system of
control of the aircraft, which eliminates certain controls which were formally
of a mechanical nature.)

Van Beveren interviewed at length the
spiritual father of automation in the cockpit, Bernard Ziegler of Airbus.
[61]
When presented with a
significant fault discovered by pilots regarding the A340 aircraft design software,
Zeigler admitted that even an aircraft as automated as an Airbus cannot cope
with every eventuality. “This is one of the highly remote probabilities where
you really need a crew to interpret. You cannot cover such low probabilities
with a computer”.
[62]

According to Van Beveren, the airing of
this comment was blocked by Airbus but is still available on the documentary.

Airbus aircraft have protections built in
which are meant to safeguard it from becoming “upset”—a
term that means an unusual flight angle in which the aircraft may no longer
keep flying; such as a stall. For instance, the protections will not allow the
pilots to bank the airplane past 67 degrees. In Airbus Terminology this is
called “Normal Law”.

However, in the event of certain computer
failures then the aircraft can end up in what is known as “Alternate Law”, and
in this law you lose many of the “Airbus protections”.

In the Air France 447 case it wasn’t that
the computers failed, they did what they were designed to do: in other words, when
the information is so conflicting that the computer can no longer cope, it
hands back control to the pilots.

Three computers calculate speed. With
conflicting information from the pitot tubes blocked by ice crystals they
simply said: “we give up”, causing a cascade of computer confusion and
resignation. This resulted in the change from the Normal Law to Alternate Law
and among other things the loss of the autopilot and the auto thrust.

So did the automation fail? The pilots were
handed an aircraft that was in “Alternate Law”, without many of the computer
generated protections against “upset”. However, when Airbus introduced
fly-by-wire aircraft they claimed there was no longer the need to train pilots
on how to take control in the event of the aircraft becoming unstable, or “upset”,
especially at high altitude.

Airbus states in its training manuals, “the
effectiveness of fly-by-wire architecture, and the existence of control laws, eliminates
the need for upset recovery manoeuvres to be trained in protected Airbus
aircraft.”
[63]

But a source inside the French pilots union SNPL
(Syndicat National des Pilotes de Ligne) confessed, “We discussed that item
many times with Airbus test pilots and some engineers. They stated the
opposite. That if you lost the protections you will
need
to be trained
against an upset or worse…”
[64]

Experts, investigators and the Air France
pilots believe it is exactly this type of training that may have saved the day,
and prevented the tragedy of AF447.
[65]

The real point is that most pilots just
don’t get high altitude upset training unless the airline
opts
to do so.
“They never have the chance to practice recovery manoeuvres,” says Chesley
Sullenberger, the captain of the Miracle on the Hudson aircraft.

The reality is that Air France pilots were
not trained for the catastrophic situation that developed on AF 447—because
Airbus said there was no need.

We must remember that the Captain of the Colgan Air Flight 3407 crash, Marvin
Renslow, did not have sufficient stall training, or upset recovery training—exactly
as was the case with the Air France pilots.

There was no captain on the flight deck of
Air France 447 when things started to go wrong.

The public would be right in asking why.

To fly long-haul obviously requires long
flight times and demands long duty days for the pilots and flight attendants.
Common to most long-haul companies and on long-haul flights, the law demands
that airlines roster an additional pilot.

For the airlines the cheapest option is for
that extra pilot to be a first officer and not a captain. This first officer is
known as a “cruise” or “relief” pilot.

On AF 447, being a long haul flight, there was one captain
and two first officers.

The practise may vary among airlines but
here’s how it works: over a thirteen hour flight say, the aircraft may be in a
cruise for twelve hours. Some of this cruise time will be divided into three
break periods for the pilots, which could last from three to four hours.

Cockpit voice recordings retrieved from the
black box reveal that as the disaster began to develop, First Officer Robert
pushed the call button several times to summon Captain Dubois.

It’s not known for sure if the captain was
asleep in his bunk, but the rest area is immediately outside of the cockpit and
accessed through a secure door. It took a minute and a half for Captain Dubois
to return; an eternity in aviation terms when, in the midst of an emergency,
seconds can count. (Some airlines using Airbus aircraft actually removed the
pilot rest area outside the cockpit so that extra business class seating could
be fitted. In this instance pilots have to use the flight attendant’s rest
area, located halfway down the aircraft. This increases the amount of time it
would take for a pilot to return to the cockpit in an emergency situation.)

Another problem compounded the unfolding
crisis.

The Airbus’ electronic flight instrument
systems are constructed in such a way that if all the primary systems fail—in
other words, if there is a major loss of instruments—the standby instruments
that are used as back-up are located close to the
captain’s
seated
position. In the event of a loss of electrical generation, the emergency
electrical power will supply
only
the captain’s instrument panel.

So now the
least
experienced pilot
onboard the aircraft found himself in a situation where he was hand-flying on
only the most basic instrumentation and in a possible disaster scenario. In
this case, it involved flying through a dangerous thunderstorm with no external
radar to help navigate the storm cells.

The two first officers on board AF447 were
respected and skilful, but they desperately needed the experience of their
captain when things started to unravel. Unfortunately, it appears there was no
time for Captain Dubois to get back to the cockpit and grasp a full
understanding of the emergency before the aircraft crashed.Some long-haul
captains freely admit that they hardly manage to sleep well during their
assigned break; they toss and turn, getting no rest.  Perhaps having
another captain on the flight deck would ease their anxiety, and allow them to
benefit from the rest they are required to take under aviation law.

But it remains to be seen whether airlines
are prepared to incur that extra cost to safeguard passengers’ lives.

Incidences similar to Air France 447’s
pitot failures have occurred in the past with airlines using the same Thales
manufactured pitot tubes.

Some of those failures led to loss of speed
indications at high altitudes due to icing during cruise—again similar to Air
France 447.  These failures prompted many exchanges between Airbus
and Air France to determine whether or not to replace the Thales pitot tubes
with a new model, by the same manufacturer. Airbus asked Air France to wait for
better models to become available by Thales, but stated that a more recent
Thales model performed better in icing. Air France ordered and had just
received a shipment of these replacements in the week leading up to the
disaster.

A complicating factor for the pilots is
that Airbus announced that erroneous stall warnings could sound in the event of
a pitot blockage—information that conflicts with standard procedures dictating
that all stall warnings should always be respected.

Since the AF447 disaster, all Air France
aircraft are now equipped with American Goodrich pitot tubes, not Thales.

This poses a vital question: was there a
failure on behalf of the regulators to push Airbus and Thales for quicker
replacement of the pitot tubes?

The fact is that this type of phenomenon
occurred in many other airlines, although not exactly in the same conditions.

A selection of
13 cases of similar pitot tube failure was cited by the French Air Accident
investigators, BEA, which looked into the AF 447 crash:
[66]

Air France (4
cases)TAM (2 cases)

Qatar Airways (4
cases)

Northwest (1
case)

Air Caraïbes
Atlantique (2 cases)

The BEA
interviewed pilots from these flights. “The crews did not understand what had happened at the
time and NONE of them called for the appropriate checklist or carried out the
memorized response….due to the surprise and lack of training.”
  

Surprise, lack
of training, the lack of a commander in the flight deck, lack of timely
replacement of faulty pitot tubes, and the unwillingness to upgrade the
aircraft with a computerised angle of attack system that could have prevented
the Air France crash—what all of these contributing factors are
about is cost.

In the end, passengers died needlessly
because of cost.

As tragic as Air France 447 was, this
disaster will be analysed for decades to come and we hope that the loss of
passenger and crew lives will not be in vain. And that in their memory the
industry will strive toward ever safer skies for everyone.