To those souls lost,
Rest in peace!
Paradox of 'Simplicity'...Flight 447
Consider for as moment these two cockpits. On the left is the granddaddy of jet airliners – the Boeing 707 – which first flew paying passengers in 1958. On the right is the Airbus A-330 – which started flying the line 35 years later. Now quick: which is the more complex airplane? Looks can be deceiving.
Relatively speaking, the 707 is a much simpler airplane – which is different from saying it is simpler to fly. Mastering and monitoring all those steam gauges required an alert three-person crew. In the 707, the burden of the complexity – and the opportunity for error – is on the human side of the instrument panel. Because humans make mistakes and machines do not, airplane designers have steadily shifted that workload to the other side of the gauges over the years. The A-330 instrument panel is proof they have done a bang up job. It looks simple to fly doesn't it? It is.
The joke is that in the not too distant future, flight crews will consist of one human pilot and an ill-tempered junkyard dog. The pilot is there to watch the computers fly the airplane – and the dog there to bite him if he tries to touch the controls.
Airbus has embraced the philosophy (if not the joke) with zeal. The company builds highly automated "Fly-By-Wire" airplanes. NASA developed the first fly by wire aircraft in 1972 – an F-8C Crusader. On FBW planes, the movable surfaces on the wings, the horizontal and vertical stabilizer are not connected to the controls on the flight deck with cables, pulleys pushrods and hydraulic actuators as they were on the 707.
Instead, electrical wires transmit the pilot's commands to hydraulic actuators that move the aero surfaces. Between the pilot and those surfaces is a bank of computers that are actually flying the plane. The computers are programmed with some strict rules (in fact, Airbus calls them "Laws") designed to assess the human commands from the flight deck – and veto them if they would put the plane in harm's way. Point the nose too high or too low – or bank to steeply and the computer will correct your bad airmanship. Who's in charge here?
Pilots like to call their autopilots "George" (old phonetic shorthand for "gyro", which makes the AP work) – on an FBW airplane, "HAL" might be more apt.
But what happens when the silicon co-pilot gives up the ghost? It gets very ugly - very quickly. Just before Air France 447 went down, it transmitted a four-minute spurt of text data reporting 5 failures and 19 warnings via its Aircraft Communications Addressing and Reporting System (ACARS). The data is cryptic and we will only know the full scenario if searchers find the black boxes, but we know the autopilot disengaged, the flight control computer failed, warning flags appeared over the primary flight data screens used by the captain and first officerand the rudder moved beyond its limits.
All of it is consistent with a flight control system that was getting some bad information about how fast the airplane was moving through the air. The device that performs this task is called a pitot tube. Pointed in the direction of flight, it measures the relative pressure of air as it flows in. For pilots this is a crucial device – (like an EKG for a heart surgeon, I suppose).
If you don't know your airspeed, you can easily stall or overspeed the plane. That's why the A-330 has three pitot tubes. They tend to be ice collectors on an airplane flying through precipitation. If they glaze over, or get clogged with crystals, they won't work – so that is why they are heated. Even so, A-330 pitot tubes were icing up and failing in flight so Airbus issued a "service bulletin" recommending airlines replace them with a newer model that has a more powerful heater. It was not considered urgent – and so the pitot tubes on the doomed plane had not been removed and replaced. But I would not focus on this too much.
The epic thunderstorm system that Air France 447 flew into would have been a huge hail and ice-generating machine that could have overwhelmed even the new and improved pitot tubes if they had been installed.
Regardless, the failure cascade chronicled in the ACARS text message hauntingly matches a 2008 event when an Air Caraibes A-330 flying the same route encountered some serious pitot tube icing. That plane was not in such severe circumstances so the crew was able to get things back under control – and lived to tell the tale.
Now here is a key point to remember: as systems fail in an Airbus, the laws that the computers live by change from "normal", to "alternate", to "abnormal alternate" to "direct". At each stage the computers surrender more authority to the humans – until finally silicon surrenders and the carbon pilots are on their own – with no help at all from HAL – at just the point they need him most.
They were in the dark, getting hammered by turbulence, flying blind, by hand, a plane that was designed and built to be controlled by machines – with human supervision.
Suddenly that deceptively simple cockpit was a riddle so complex it could not be solved.
J.
Relatively speaking, the 707 is a much simpler airplane – which is different from saying it is simpler to fly. Mastering and monitoring all those steam gauges required an alert three-person crew. In the 707, the burden of the complexity – and the opportunity for error – is on the human side of the instrument panel. Because humans make mistakes and machines do not, airplane designers have steadily shifted that workload to the other side of the gauges over the years. The A-330 instrument panel is proof they have done a bang up job. It looks simple to fly doesn't it? It is.
The joke is that in the not too distant future, flight crews will consist of one human pilot and an ill-tempered junkyard dog. The pilot is there to watch the computers fly the airplane – and the dog there to bite him if he tries to touch the controls.
Airbus has embraced the philosophy (if not the joke) with zeal. The company builds highly automated "Fly-By-Wire" airplanes. NASA developed the first fly by wire aircraft in 1972 – an F-8C Crusader. On FBW planes, the movable surfaces on the wings, the horizontal and vertical stabilizer are not connected to the controls on the flight deck with cables, pulleys pushrods and hydraulic actuators as they were on the 707.
Instead, electrical wires transmit the pilot's commands to hydraulic actuators that move the aero surfaces. Between the pilot and those surfaces is a bank of computers that are actually flying the plane. The computers are programmed with some strict rules (in fact, Airbus calls them "Laws") designed to assess the human commands from the flight deck – and veto them if they would put the plane in harm's way. Point the nose too high or too low – or bank to steeply and the computer will correct your bad airmanship. Who's in charge here?
Pilots like to call their autopilots "George" (old phonetic shorthand for "gyro", which makes the AP work) – on an FBW airplane, "HAL" might be more apt.
But what happens when the silicon co-pilot gives up the ghost? It gets very ugly - very quickly. Just before Air France 447 went down, it transmitted a four-minute spurt of text data reporting 5 failures and 19 warnings via its Aircraft Communications Addressing and Reporting System (ACARS). The data is cryptic and we will only know the full scenario if searchers find the black boxes, but we know the autopilot disengaged, the flight control computer failed, warning flags appeared over the primary flight data screens used by the captain and first officerand the rudder moved beyond its limits.
All of it is consistent with a flight control system that was getting some bad information about how fast the airplane was moving through the air. The device that performs this task is called a pitot tube. Pointed in the direction of flight, it measures the relative pressure of air as it flows in. For pilots this is a crucial device – (like an EKG for a heart surgeon, I suppose).
If you don't know your airspeed, you can easily stall or overspeed the plane. That's why the A-330 has three pitot tubes. They tend to be ice collectors on an airplane flying through precipitation. If they glaze over, or get clogged with crystals, they won't work – so that is why they are heated. Even so, A-330 pitot tubes were icing up and failing in flight so Airbus issued a "service bulletin" recommending airlines replace them with a newer model that has a more powerful heater. It was not considered urgent – and so the pitot tubes on the doomed plane had not been removed and replaced. But I would not focus on this too much.
The epic thunderstorm system that Air France 447 flew into would have been a huge hail and ice-generating machine that could have overwhelmed even the new and improved pitot tubes if they had been installed.
Regardless, the failure cascade chronicled in the ACARS text message hauntingly matches a 2008 event when an Air Caraibes A-330 flying the same route encountered some serious pitot tube icing. That plane was not in such severe circumstances so the crew was able to get things back under control – and lived to tell the tale.
Now here is a key point to remember: as systems fail in an Airbus, the laws that the computers live by change from "normal", to "alternate", to "abnormal alternate" to "direct". At each stage the computers surrender more authority to the humans – until finally silicon surrenders and the carbon pilots are on their own – with no help at all from HAL – at just the point they need him most.
They were in the dark, getting hammered by turbulence, flying blind, by hand, a plane that was designed and built to be controlled by machines – with human supervision.
Suddenly that deceptively simple cockpit was a riddle so complex it could not be solved.
J.
