Yup. He made a completely stupid decision. The airplane worked perfectly all the way to the crash site.

Actually, it doesn't say that. It says to establish a specific pitch--+5 DEG, +10 DEG, or +15 DEG, depending on flight level and whether or not you're above thrust reduction altitude. Depending on the pitch you're at, this might require either pushing forward on the stick, or pulling back on it. In the case of the final descent of AF 447, the pitch angle was very high, and so the unreliable airspeed procedure would have required pushing forward on the stick, just as Adam said.

I thought all they needed was a good pair of hands; sharpened by lots of hand flying?

No engineer can make 100% reliable automation.

Witness Airbus. Normally, the plane flies easier with normal law on the controls. Then the computer craps out with bad input and gives the pilot alternate law. Now the plane is HARDER to control, and the pilot has to learn BOTH modes. People died when the pilot couldn't handle it.


Revisionist history. Go back and read the Eclipse promotional materials. They mirror Cirrus as to how "easy" the plane will be to fly due to the automation.

Then came the type rating. Reality strikes again.

Your belief is only because the Eclipse exists and the SF50 doesn't, so you are free to imagine an ideal SF50 situation.


That would be a worthwhile exercise. Compare a Meridian AFM and King Air 90 AFM from the same vintage year. I bet they aren't as different as you think they are, and the procedures left out of the Meridian AFM are where the King Air has a viable option and the Meridian is just hosed.


Regulations and physics are inescapable. The engineering team simply can't make decisions that eliminate the vast majority of the emergency/abnormal procedures. If they could, EVERY maker would be doing that!

Mike C.

Correct.

In this case, it said go to +5 pitch and CLB (climb) power detent. This required a pull back on the stick as the airplane was cruising at less than +5 pitch, about 0 when the AP disconnect occurred.


When the AP disconnected, the pitch attitude was near 0. It took about 5 seconds before pitch attitude exceeded +5 with pilot input, so the pitch response by the pilot was correct for that time, but then it was overcooked reaching +12. The pilots then later pushed down and achieved pitch attitude +6 about 44 seconds after AP disconnect, so not too far from the target, and they still had good airspeed despite the climb (> 200 KIAS). Plane was never in stall during this time, and no stall warning sounded.

About 45 seconds into the event was the first stall warning, but the unreliable airspeed procedure said stall warning may go off incorrectly. The crew didn't know what to believe.

Night, IMC, turbulence, broken airplane, two FOs, and no captain makes for a confusing situation. There's no question the crew contributed to this accident, but to call it all pilot error is to ignore the design, procedural, and training defects this accident exposed.

Here is the final report:

https://www.bea.aero/docspa/2009/f-cp09 ... 601.en.pdf

Mike C.

His pitch attitude exceeded 40 degrees at times.

Educate us with an example of a previously manual system, pilot operated it directly, where the task was replaced with an automatic system, and that made the airplane simpler.

In every case I can think of, the automatic system has sensors, computer (be it mechanical, analog, or digital), and actuators. That's more complexity, particularly when accounting for failure modes. Sensors, in particular, are never perfect, for example the pitot tubes on AF447, or the power lever sensors on Eclipse.

This is not a new phenomenon, the fuel controllers on my airplane are very complex mechanical computers designed to make it simpler for the pilot to operate the engine normally, but they create a long list of possible failures one has to deal with. Same will be true of the FADEC.

Mike C.

The maximum pitch attitude AF447 achieved was +17.9 per the report.

Perhaps you mean AOA?

Mike C.

Got it from the article. Could be wrong.

AF447 was a wake up call for the people at Airbus, because their planes were and still are designed with a different philosophy than i.e. Boeing. That philosophy was, 'let the machine do as much as it can, the pilots are making mistakes eventually anyway; let the aircraft fly itself, and give the pilots as few as possible opportunities to f*** up'; the whole fly-by-wire system was designed around it and has that philosophy in its DNA.

As far as I understand, the pitch angle was only one problem; much worse was the fact that the PF pulled the stick while the PM pushed it, which tells the FMS to essentially do nothing due to contradicting human input. So the plane just went into a deep stall, pitch up, wings level by the remaining laws of the FMS, and descended, without many interruptions by first two, then three (the captain joined them later from his sleep) pilots, until it smashed onto the sea.

From what I hear from people flying Boeing, they say this kind of behaviour would not have been possible in a Boeing, simply because the system does not take away the control of the airplane as the Airbus does. There are still yokes, and you either push or pull both, no error possible. All professional airline pilots, flying Airbus and Boeing, are tellling me the same thing: The airbus probably needs less flying skills when everything is allright. It more or less automatically does a perfect turn, a perfect descend, all that, without much interference of the pilots. But a hell of a lot of experience and skills are needed once there are problems. Sullenberger would not have been able to put the plane down in the Hudson, for the simple reason that the plane wouldn't have him allowed to do it. That's what I hear.

So, I think Mike is right: making systems more convenient gives a wrong sense of safety; and a large amount of experience, skill and memorized items to recover. Automation iscomplexity, which can bite you hard once the system does not work as it is supposed to. Which does not mean we shouldn't embrace these systens... they are good and help save lives. But not without knowing what the grey mass between our ears has to do once the %#$@ hits the fan.

Lets don't forget that they flew into the top of a thunderstorm when other airplanes on the same route made some pretty big deviations.

That wasn't the automations fault.

The automation in planes is in a lot more systems than are controlled by the pilot. Several new planes don't even have circuit breakers for example

Removing things that fail in all parts of an airplane makes flying safer. You guys are just focused on autopilot stuff. Autopilot only 1 system in an airplane.

Educate us with an example of a previously manual system, pilot operated it directly, where the task was replaced with an automatic system, and that made the airplane simpler.

In every case I can think of, the automatic system has sensors, computer (be it mechanical, analog, or digital), and actuators. That's more complexity, particularly when accounting for failure modes. Sensors, in particular, are never perfect, for example the pitot tubes on AF447, or the power lever sensors on Eclipse.

This is not a new phenomenon, the fuel controllers on my airplane are very complex mechanical computers designed to make it simpler for the pilot to operate the engine normally, but they create a long list of possible failures one has to deal with. Same will be true of the FADEC.

Mike C.

All planes have circuit protection. Old style is manual circuit breakers. New style is remote electronic breakers, ECB. But all planes have something to protect the wiring harness and equipment from overloads.

Remote circuit breakers require a user interface in the cockpit, generally part of an MFD, a communication means to the breaker hub, a microcontroller built into the breaker itself to monitor and communicate status, a current sensing means, and a circuit interruption means. This is vastly more complex than a manual circuit breaker, including having the need for software both in the MFD and the breaker hub.

There are definite benefits to the remote breakers, particularly with weight from not having to run the actual power all the way to the cockpit and then to each system using it. But simplicity is not one of the benefits.

There are additional failure modes. For example, communications between MFD and ECB can fail, then the pilot can no longer control the breaker or monitor its status.

Note that having more failure modes doesn't necessarily mean less reliable, it just means there are more ways to fail, and thus more training and procedures for the pilot.


Yes, but in this case, manual breakers got replaced with something else far more complex. ECBs *might* be safer, but they are definitely not less training.

Mike C.

25 minutes prior to AP disconnect, the crew dimmed the lights in an effort to visually see the weather up ahead, so they were aware of it at least as early as this stage.

2 minutes, about 15 nm at cruise speeds, before the AP disconnect, the crew discussed weather and made a deviation, a left turn, in heading mode. It is logical this turn was prompted by what their radar showed for weather ahead.

The crew was not oblivious to the weather, even if they didn't actually avoid it in the end.

The report is ambiguous about whether they entered a storm or not, or simply clouds at high altitude. Their weather radar returns are not recorded by the FDR, and there is limited weather information for storms in middle of the Atlantic.

The report never says they encountered significant turbulence, only that they encountered slight turbulence, and then it increased slightly. If there were truly in the top of a real storm, that would have been different. The BEA report on page 58 says they never exceeded the definition of "light" turbulence (defined as 0.5 G peak to peak amplitude, or 0.75 G to 1.25 G assuming an average 1.0 G flight condition, not really that bad).

I do not believe the crew flew into the top of a real thunderstorm on this flight, just some convective clouds with icing in them.


It shares part of the blame. It was part of the accident chain. Blaming the entire accident on one link of that chain, such a pilot error, is simplistic and misses the real lessons here.

Mike C.