Understanding Air France 447 (27 page)

By 02:11:31 the airplane was officially out of control. The AOA was excessively high, the airspeed excessively low. Pitch response was poor at best, and roll control was non-existent. It was at that time that First Officer Bonin declared, “I don’t have control of the airplane any more now.” It had exceeded four of the five loss-of-control envelopes: Adverse Aerodynamics, Dynamic Pitch control, Dynamic Roll Control, and Structural Integrity. The Unusual Attitude envelope was the only one not exceeded, as the pitch and bank angles did not reach the boundaries of that envelope.

The safe harbor technique is a tool that can be applied quickly to prevent an automation exception from progressing to a loss of control. It involves first turning off automation (autopilot, flight director, and autothrust), this removes any distractions and disengages inappropriate modes. Then the pilot flies a known (memorized) pitch and power setting for level flight. Once the airplane is firmly under control, the exception condition can be dealt with and conditions permitting, automation reestablished in an orderly manner.

747 Captain Dennis Landry, promoter of the Safe Harbor concept, offers the following analogy:

When we were kids we could all ride a bike really well. We often rode with “no hands” and could talk with our friends while navigating streets full of potholes. At that point we were “ATP skilled” bike-riders. But when we reached driving age, we found cars to be way cooler. “Glass Cockpits” are similar: no more bike riding or “Steam Gauge” flying for me. We stuck the bike on the roof of the car just in case the car ever broke down. 

What if, fifteen years later on a dark lonely night in bad weather, the car breaks down? No worries: we still have a bike strapped to the roof. Never mind that we have not ridden it for 15 years, WE can RIDE! Well, you start down a steep hill and as you attempt to turn the bike the handle bars come off. When you were 16 and an “ATP skill level” bike rider this would have been fun. But now it’s a whole lot less enjoyable..

Maintaining hand flying skills to be able to competently handle emergency flight with an automation exception requires practice. Hand flying by following the flight director, while common, is not adequate preparation for the full instrument scan required during an unplanned automation exception event. That practice should be made under safe conditions such as only day, visual conditions, in low workload environments (10,000 - 25,000 feet), and with a briefing to fellow crewmembers beforehand.

This work by ALPA is ongoing and will hopefully become a routine part of regular training and practice in line flying to mitigate automation addiction.

Flight Directors

It is not 100% clear that the AF447 pilots followed the flight directors when they reappeared after the autopilot disconnected, but it looks like a distinct possibility.

What is clear about the flight directors is that except for a few short seconds, from the time the autopilot disconnected, they were providing inappropriate guidance.

The flight directors automatically disappeared due to disagreeing air data (airspeed), but remained selected on. When two sources of air data agreed again, they reappeared in heading and vertical speed mode, which is the default mode for flight director or autopilot engagement.

The vertical speed when they came back on was very high, initially 1,400 feet per minute, then later 6,000 feet per minute. Therefore, that was the target vertical speed that they provided guidance to maintain. 

The flight directors are a very powerful cue. It is easy to rely on them with little awareness of what attitude they are commanding. Following the flight directors does not relieve the pilot of the responsibility to ensure the guidance they are providing is appropriate.

For a low-time pilot like FO Bonin, who probably rarely hand flies the airplane, it is likely that when they reappeared he tried to follow them. This may be the reason that First Officer Robert was telling Bonin that he was going up, and Bonin seemed confused as to whether he was climbing or not. The airplane was able to perform the high climb rates initially commanded by the flight director; however, as speed decayed, it became impossible to do so.

The first steps in the unreliable airspeed procedure, and a memory item, are to turn off the flight directors (and the autopilot and autothrust, if not already off). If not selected off, the flight directors can reappear on their own (and in an inappropriate mode). The Flight Mode Annunciator (FMA) will display the current flight director mode, but it is easy to miss when things are busy. The autopilot and autothrust will not re-engage on their own, only the flight director will. Pilots should then re-engage the automatic systems only when the air data has been confirmed correct (e.g., by reference to performance tables).

One of the recommendations of the investigation was that flight directors should not automatically re-engage once they disappear, but should require explicit pilot selection to be re-engaged (like the autopilot). This would have prevented their redisplay in AF447's steep climb, where the flight directors provided inappropriate guidance to continue the climb at high vertical speeds. There are several situations, besides data loss, that can trigger the flight directors to disappear.

Training Matters

Training and experience matters a great deal in producing pilots that can handle these or other unexpected situations.

For these high performance airplanes, training exercises need to demonstrate and compare the stall margins and recovery techniques in both high and low altitude regimes.

At low altitude, high angles of attack are required for stall, and power addition provides a quick recovery with minimal loss of altitude.

Contrast that with the high altitude scenario, where the stall margin is very narrow, and power addition can be weak or ineffective in reducing the angle of attack, and in some cases may actually hamper the ability to pitch the airplane down. In this environment, altitude will
have to
be traded to gain airspeed. The performance physics simply do not allow the airplane to regain airspeed in level flight with the available power once it has gotten critically slow. Additionally, as the recovery progresses, and Mach number increases the airplane’s stall margin again decreases. Therefore, the recovery must be made somewhat gently to prevent a secondary stall encounter in the recovery.

The idiosyncrasies of fly-by-wire airplanes must be demonstrated and understood, not just mentioned in a briefing. In this case the absence of angle-of-attack protection and low speed stabilities, the function of the auto-trim, and the fact that the airplane’s natural dynamic stability to pitch down was masked by the g-load demand system are key to understanding the handling of the airplane in these situations. For the airplane to pitch down, in situations where the fly-by-wire stabilities are lost, requires the pilot to push forward on the sidestick. These are key concepts of the airplane that should not be glossed over. Pilots do not intuitively know this. When I have demonstrated these factors to crews in training, numerous pilots stated that this was the most informative simulator session they have ever had.

Training in these areas has improved since the accident, due in part to the findings of the accident, as it brought to light some areas of misunderstanding.

The background of a pilot can also make a difference. First Officer Bonin came up through an ab initio program on the airline fast track. I am sure stalls were taught and demonstrated, but the training may not have been extensive. Most of his flight career was probably spent in cruise flight with a heavy use of automation. Despite almost 3,000 hours total time, his actual hands on time of
actively flying
the airplane may have been minimal.

Contrast that with a pilot who worked as a flight instructor
teaching
stalls recovery or spin training. Graduates of military training programs also receive intense instruction in maneuvers and awareness of angle of attack and the effects of high altitude and high speed aerodynamics, as well as a very wide envelope of attitudes. Also skilled are pilots with many hours on airplanes where hand flying was required due less sophisticated autopilots or none at all.

Pilots who have come up through ab initio programs may have missed much of this experience. Training programs and company policies need to be aware of this and include hand flying in initial and recurrent training, as well as support hand flying the airplane during routine operations where practical.

An A320 Captain relates the following story of a pitot-static problem he encountered in an A320. The incident follows the probable contamination of the static ports during a washing, which was then addressed by maintenance before departure.

We had just punched into the overcast and raised the flaps when the stall warning sounded and the flight control system went to alternate law indicated on the PFD. I had the first officer lower the nose immediately and cobbed the power. (we were above Point Loma by now and had nothing but ocean ahead of us-a stall recovery maneuver was not an option) There were no ECAM messages during this entire scenario. I immediately looked at the FO's airspeed to see what it said because the water in the system was still on my mind. I then checked the backup instruments to see what the airspeed was indicating. All three were within about five knots so the puzzle was raised a couple of degrees in my mind. What was the real airspeed? When we broke out on top about a minute later I could visually tell that we were hauling so I knew we were above stall speed and the attitude was nowhere near stall attitude. The warning stayed on till about 275K and we kept the airspeed there till we came up with a plan.

He attributes his ability to maintain control, verify indications with the standby system, and successfully land the airplane in instrument conditions to his extensive hand flying experience in the Navy and on the DC-9.

Good training helps to reinforce or strengthen those skills. But good training does not happen on its own. It takes a training program that is willing to provide the training needed, even if it means going beyond the regulatory requirements, and it takes good instructors to make it happen effectively.

Good instructors can detect signs of pilot misunderstanding. The cues are often subtle: how students move the controls, what modes they select, how they plan their energy management on approach, when they change configuration and much more. Then, the instructor can try to fill in the holes in a pilot’s experience or understanding with exercises to improve his understanding an skill.

A threat to this system is the increasing use of instructors with no experience in the airplane they are teaching in, especially in later stages of training. They set up the simulator as per the syllabus, perform the maneuvers listed in the lesson to the standards prescribed, but may lack the experience and ability to catch the hints of misunderstanding subtly displayed by the student. Their lack of actual line flying experience can sometimes allow them to miss the significance of certain items as it would apply to real life scenarios. Will their students be ready if real life strays from the cookbook procedure?

Sitting and watching the autopilot fly the airplane, following flight directors with little awareness of what pitch attitude to fly should they disappear, are behaviors that despite adding hours to a logbook, add little to a pilot’s real experience and ability to be the defining factor between a failure and tragedy.

The AF447 Final Report
⁴⁴
validates these assertions with the findings of Air France’s own internal safety report. Among the findings:

• The piloting abilities of long-haul and/or ab initio pilots were sometimes poor;
  
• A notable loss of good sense and general aeronautical knowledge;
  
• Weaknesses in terms of representation and awareness of the situation during system failures (reality, severity, danger level, induced effects …).
  

It does not take a great deal of imagination to apply these findings to the crew of AF447. It is sad to consider that these are probably not the only three pilots incapable of handling this situation. Though the empirical evidence indicates they are the minority, as the dependence on technology and economics change the nature of pilot training, we must consider what the future will bring. Training departments at all airlines must take these factors into account.

Chapter 11: Going Forward

It would be easy to simply criticize the incompetence of the two first officers, but it is not as simple as that. The vast majority of accidents have multiple causes. Air France 447 is no exception.

The loss of the autopilot, autothrust, and airspeed indications, occurring in turbulent weather at night was combined with degraded flight controls, and flight directors that provided inappropriate guidance. The situation was beyond the ability of the crew to:

• Recognize what had happened,
  
• Recognize what was happening, and
  
• Determine what actions to take to restore controlled flight.
  

But, the skills of the two first officers were a product of their prior training and experience.

Not long ago, hand flying was common. Operating today’s highly automated aircraft virtually 100% of the time with the automation engaged has allowed manually flying skills to erode to the point where they may not be sufficient to handle an emergency. We must also recognize that a generation of pilots have been trained on the techniques of following the flight director, and the development of high-level manual flying skills have been de-emphasized.

If we fail to train our fellow pilots to manually fly the airplane under the most challenging conditions then we have failed them, our passengers, and cabin crew. In the absence of this training, any significant loss of auto-flight systems or degradation of flight controls could result in a scenario for which they are not prepared. Which is a recipe for another disaster.