7 ms·

The fact that the landing gear lever was pushed down into the extended position, and then the plane decided not to deploy the landing gear because of the oversp

by tux1968 6y ago

The fact that the landing gear lever was pushed down into the extended position, and then the plane decided not to deploy the landing gear because of the overspeed issue is a horrible UI. The lever should refuse to budge unless moving it will in fact deploy the landing gear. These pilots are horrible, but that doesn't mean we can't improve the controls still.

anon102010 6y ago
Uh? The UI was giving them plenty of warnings and alerts. They have supposedly been trained thoroughly on all of this.
- tux1968 6y ago
  They were distracted. Why on earth would you object to the idea of better feedback? If the lever is locked until the plane is willing to engage the landing gear, it's more safe than the current UI.
  - HPsquared 6y ago
    What if the gear lever erroneously prevents the pilot from lowering the gear when he needs to? Such a system introduces additional failure modes.
  - fredoralive 6y ago
    What happens if the lockout mechanism breaks and prevents a pilot from selecting gear down when the landing conditions are right? (I guess they could go for the gravity deployment backup mode, but that would be rather extreme option for a broken solonoid (or so on) on a control lever).
    - tux1968 6y ago
      Anything can break in a plane which is why you design redundancy into the system. You could provide a manual override switch too.. but at least it would be a conscious act done by the pilot who is aware of the situation. I can't believe anyone is defending the current UI given we have an obvious example right in front of us of how it can fail.
      - ceejayoz 6y ago
        > I can't believe anyone is defending the current UI given we have an obvious example right in front of us of how it can fail. Well, it's also an example of the saying "when you make something foolproof, God invents a better fool". They made enough mistakes here it's clear these pilots were a ticking time bomb; the only way we're fully preventing that issue is to replace pilots entirely with an AI.
      - polishdude20 6y ago
        Actually there is a gear override lever behind the copilot's seat in a hatch in the ground.
      - m000z0rz 6y ago
        I think people are fixating on one problem here as an example of how broken the UI is. What about the problem where a pilot gets great down, does a go around, and forgets to put the gear up? In this case, how could anyone defend not having the plane out the gear up automatically, with warnings? Just because we have an "obvious example right in front of us" does not mean it is the only failure mode that needs to be considered in the design of the system.
        tux1968 6y ago
        Thank you. There is lots of room for improvement. Why everyone is so intent on defending the status-quo given its obvious deficiencies is mind boggling.
        FabHK 6y ago
        I find your certainty about something you appear to know nothing about mind boggling. Every crash is a deficiency of sorts, so let’s just tell Airbus to build planes that don’t crash! Easy! Let’s just have peace instead of war! Obvious! It is not sufficient to point out “obvious deficiencies”, one must also point out possible improvements. As other posters (with more patience than I can muster) have pointed out, it is not obvious how to improve this. Putting a lock in place to prevent movement of the lever adds another level of complexity that can itself fail. This is well known and has been extensively studied (a classic paper is No good deed goes unpunished: Case studies of incidents and potential incidents caused by protective systems [0]). Listen, for example, to this episode of “Undercover Economist” Tim Hartford’s Cautionary Tales [1] (though the example given might itself be problematic [2]). Airplanes are extraordinarily safe already (look at the amazingly low accident rate, given those fallible, sometimes even negligent and incompetent people that fly them). Contrary to your facile assertion “There is lots of room for improvement”, there are very few obvious improvements. Change something and you might prevent one accident but enable another one. As an example: terrorists enter the cockpit. Easy, obvious: lock the door! Ok. Suicidal pilot locks out the other pilot and flies into a mountain. Easy, obvious: unlock the door. GOTO 10. It’s not obvious. These are hard problems that many competent people have thought about in depth. That’s why “everyone” is so “intent on defending the status-quo”. In other areas, there might be “obvious improvements”, eg regulatory matters, but even there it’s not easy. Aviation is operating within an international framework, there are rules and international treaties and regulatory bodies and stakeholders and so on. But my main point is that it’s absurd to accuse Airbus of overlooking an obvious improvement without even a cursory understanding of the matter. [0] https://aiche.onlinelibrary.wiley.com/doi/abs/10.1002/prs.680160305 https://aiche.onlinelibrary.wiley.com/doi/abs/10.1002/prs.68... [1] https://timharford.com/2019/11/cautionary-tales-ep-3-lala-land-galileos-warning/ https://timharford.com/2019/11/cautionary-tales-ep-3-lala-la... [2] https://leancrew.com/all-this/2019/11/galileo-and-failure/ https://leancrew.com/all-this/2019/11/galileo-and-failure/
  - pbhjpbhj 6y ago
    Shouldn't it be more like you get rumble feedback and the stick pushes back against you, hard, if there's an overspeed warning? But if the stick is pushed again, all the way, requiring considerable manual force, then landing gear extension is attempted? Why do I say this? Well then the pilot has autonomy, if the overspeed warning is an error, or you have a problem reducing speed you can still attempt to fly the aircraft? I mean sure, there'll be a speed at which gear extension just causes a crash, but there's also presumably mid-ground.?? Edit: total armchair aero engineering it; also in this case it might just have caused a problem at greater altitude ... but then at least there's time to correct things.
    - qtplatypus 6y ago
      A stick shaker for over speed on the landing gear lever (much like the stick shaker for stalls) seems a good idea.
  - anon102010 6y ago
    Every layer of this type of complexity adds risk. Seriously, MCAS was designed to increase safety, but instead added risk. It may be better to go to full automation then to start having various controls be locked (with the issues around those added mechanisms). There are already LOTS of situation on airbus in particular where the plane simply will not do what you tell it. Overall this has saved a lot of lives (envelope protection etc). You CAN almost always override / remove the safety envelope (pull breakers to get to direct law etc) but why. These plans can now be flown by relatively junior pilots (or in this case by folks with potentially fake pilot licenses).
- CaptainMarvel 6y ago
  Flying didn’t become as safe as it is today by relying on the pilots to be perfect
  - _ph_ 6y ago
    Perfect? No. But no one, not being capable of noticing clear warnings has no business operating a vehicle, especially a commercial airplane. It is actually the corner case, that the airplane refused to deploy the wheels. Usually, there is a technical problem preventing the deployment. So checking that the landing gear actually deployed should be one of the most fundamental things a pilot does, as well as looking out for error messages.
    - briandear 6y ago
      Looking at the damned airspeed indicator was all it would have taken.
  - kayfox 6y ago
    The UI is preventing the pilots from extending the landing gear and causing it to be structurally damaged. In short, the UI is trying to prevent a mistake from having consequences.
- briandear 6y ago
  The altimeter and airspeed indicator was all they needed. They were high and fast and attempted to dive to the runway. Piss poor flying.
HPsquared 6y ago
The standard is to have indicator lights showing the actual position of the gear, and alarms if you are coming in to land without the gear deployed. If these pilots were truly incompetent, they were likely used to having a wide range of alarms constantly going off and probably ignored the alarm.
tass 6y ago
This would make the control less reliable as well as more expensive and heavier. Additionally, there are other factors which may prevent the gear from deploying so you need to check even if the lever successfully moved.
ceejayoz 6y ago
> The lever should refuse to budge unless moving it will in fact deploy the landing gear. That introduces a new and nasty failure state, "lever locking mechanism gets stuck".
- tux1968 6y ago
  It's not hard to have an override switch. But it would at least make the pilots 100% aware and actively engaged. You have an example right in front of you how the current system is deficient.
  - zymhan 6y ago
    Surely you understand there are teams of engineers debating things like this when designing planes, right? You certainly don't seem to have a deep grasp of aerospace engineering, so maybe trust that others who do have asked these questions.
donarb 6y ago
Where in the report does it say that it was the plane and not the pilots that retracted the landing gear? As far as I know, there is nothing in the flight software that automatically deploys/retracts the landing gear, it's under the pilots control.
- pbhjpbhj 6y ago
  In the video linked above the gear stays retracted (with overspeed alarm sounding!) until the speed reduces. The speed doesn't reduce until they go-around and the engines fail. The gear then extends which bleeds airspeed, they turn hard, lose altitude and crash 1km short; with a massive loss of lives. It doesn't seem right that their approach could be so fast? So perhaps the pilots themselves lowered the gear. A comment on YouTube suggests that the gear does behave that way, it holds the command to lower gear and enacts it when airspeed falls sufficiently?
  - donarb 6y ago
    I was talking about the first approach. On the second approach they did lower their gear, expecting to land. But both engines died and they lacked the power to reach the runway. Back to the first approach, if you look at the report with the graph of the speed/altitude, the landing gear is retracted just after they are told by ATC to abort the landing and go around. See page 11. https://www.caapakistan.com.pk/Upload/SIBReports/AAIB-431.pdf https://www.caapakistan.com.pk/Upload/SIBReports/AAIB-431.pd...
HeyLaughingBoy 6y ago
I get your point, and I'm sure that was an area of discussion during the system design. From my perspective, though, it introduces a potential failure point that may not be worthwhile. If you want the lever to not move when the landing gear controller will ignore the command, then you need to lock the lever in place. If that locking mechanism fails during a normal approach, you have an airplane landing with gear up. I'm sure the FMEA (https://en.wikipedia.org/wiki/Failure_mode_and_effects_analysis https://en.wikipedia.org/wiki/Failure_mode_and_effects_analy...) in this case will conclude that it's more likely that the lock will fail closed than that the checklist was ignored and both pilots will not realize that they're trying to lower gear at too high a speed since that requires three faults to occur: ignore checklist, pilot in command attempting gear down at airspeed too high, and copilot not noticing that.
- jcrawfordor 6y ago
  It would be particularly hard not to notice, as the gear not down warning would be sounding for a good portion of the approach. In the PIA case there seem to have been multiple warnings sounding that the pilots did not resolve - it's hard to say why, perhaps alert fatigue related to not following normal landing procedures normally.
phire 6y ago
There are many reasons why the landing gear might fail to fully extend and lock. There is no way the lever can know about all of these ahead of time. Which is why the checklists require the pilots check the landing gear status lights to check the landing gear is down and locked.
- tux1968 6y ago
  Of course, and that wouldn't change. But why on earth does that preclude the idea of better feedback for the case where the plane wont even try to extend the gear even if you were to lower the lever?
afwaller 6y ago
They did not try to lower the gear on their first landing. It would have lowered. They raised the gear. It was in the commanded gear up (stowed position) when they landed and the indicator would have shown it was up.

anon102010 6y ago

Uh? The UI was giving them plenty of warnings and alerts. They have supposedly been trained thoroughly on all of this.

tux1968 6y ago
They were distracted. Why on earth would you object to the idea of better feedback? If the lever is locked until the plane is willing to engage the landing gear, it's more safe than the current UI.
- HPsquared 6y ago
  What if the gear lever erroneously prevents the pilot from lowering the gear when he needs to? Such a system introduces additional failure modes.
- fredoralive 6y ago
  What happens if the lockout mechanism breaks and prevents a pilot from selecting gear down when the landing conditions are right? (I guess they could go for the gravity deployment backup mode, but that would be rather extreme option for a broken solonoid (or so on) on a control lever).
  - tux1968 6y ago
    Anything can break in a plane which is why you design redundancy into the system. You could provide a manual override switch too.. but at least it would be a conscious act done by the pilot who is aware of the situation. I can't believe anyone is defending the current UI given we have an obvious example right in front of us of how it can fail.
    - ceejayoz 6y ago
      > I can't believe anyone is defending the current UI given we have an obvious example right in front of us of how it can fail. Well, it's also an example of the saying "when you make something foolproof, God invents a better fool". They made enough mistakes here it's clear these pilots were a ticking time bomb; the only way we're fully preventing that issue is to replace pilots entirely with an AI.
    - polishdude20 6y ago
      Actually there is a gear override lever behind the copilot's seat in a hatch in the ground.
    - m000z0rz 6y ago
      I think people are fixating on one problem here as an example of how broken the UI is. What about the problem where a pilot gets great down, does a go around, and forgets to put the gear up? In this case, how could anyone defend not having the plane out the gear up automatically, with warnings? Just because we have an "obvious example right in front of us" does not mean it is the only failure mode that needs to be considered in the design of the system.
      - tux1968 6y ago
        Thank you. There is lots of room for improvement. Why everyone is so intent on defending the status-quo given its obvious deficiencies is mind boggling.
        FabHK 6y ago
        I find your certainty about something you appear to know nothing about mind boggling. Every crash is a deficiency of sorts, so let’s just tell Airbus to build planes that don’t crash! Easy! Let’s just have peace instead of war! Obvious! It is not sufficient to point out “obvious deficiencies”, one must also point out possible improvements. As other posters (with more patience than I can muster) have pointed out, it is not obvious how to improve this. Putting a lock in place to prevent movement of the lever adds another level of complexity that can itself fail. This is well known and has been extensively studied (a classic paper is No good deed goes unpunished: Case studies of incidents and potential incidents caused by protective systems [0]). Listen, for example, to this episode of “Undercover Economist” Tim Hartford’s Cautionary Tales [1] (though the example given might itself be problematic [2]). Airplanes are extraordinarily safe already (look at the amazingly low accident rate, given those fallible, sometimes even negligent and incompetent people that fly them). Contrary to your facile assertion “There is lots of room for improvement”, there are very few obvious improvements. Change something and you might prevent one accident but enable another one. As an example: terrorists enter the cockpit. Easy, obvious: lock the door! Ok. Suicidal pilot locks out the other pilot and flies into a mountain. Easy, obvious: unlock the door. GOTO 10. It’s not obvious. These are hard problems that many competent people have thought about in depth. That’s why “everyone” is so “intent on defending the status-quo”. In other areas, there might be “obvious improvements”, eg regulatory matters, but even there it’s not easy. Aviation is operating within an international framework, there are rules and international treaties and regulatory bodies and stakeholders and so on. But my main point is that it’s absurd to accuse Airbus of overlooking an obvious improvement without even a cursory understanding of the matter. [0] https://aiche.onlinelibrary.wiley.com/doi/abs/10.1002/prs.680160305 https://aiche.onlinelibrary.wiley.com/doi/abs/10.1002/prs.68... [1] https://timharford.com/2019/11/cautionary-tales-ep-3-lala-land-galileos-warning/ https://timharford.com/2019/11/cautionary-tales-ep-3-lala-la... [2] https://leancrew.com/all-this/2019/11/galileo-and-failure/ https://leancrew.com/all-this/2019/11/galileo-and-failure/
- pbhjpbhj 6y ago
  Shouldn't it be more like you get rumble feedback and the stick pushes back against you, hard, if there's an overspeed warning? But if the stick is pushed again, all the way, requiring considerable manual force, then landing gear extension is attempted? Why do I say this? Well then the pilot has autonomy, if the overspeed warning is an error, or you have a problem reducing speed you can still attempt to fly the aircraft? I mean sure, there'll be a speed at which gear extension just causes a crash, but there's also presumably mid-ground.?? Edit: total armchair aero engineering it; also in this case it might just have caused a problem at greater altitude ... but then at least there's time to correct things.
  - qtplatypus 6y ago
    A stick shaker for over speed on the landing gear lever (much like the stick shaker for stalls) seems a good idea.
- anon102010 6y ago
  Every layer of this type of complexity adds risk. Seriously, MCAS was designed to increase safety, but instead added risk. It may be better to go to full automation then to start having various controls be locked (with the issues around those added mechanisms). There are already LOTS of situation on airbus in particular where the plane simply will not do what you tell it. Overall this has saved a lot of lives (envelope protection etc). You CAN almost always override / remove the safety envelope (pull breakers to get to direct law etc) but why. These plans can now be flown by relatively junior pilots (or in this case by folks with potentially fake pilot licenses).
CaptainMarvel 6y ago
Flying didn’t become as safe as it is today by relying on the pilots to be perfect
- _ph_ 6y ago
  Perfect? No. But no one, not being capable of noticing clear warnings has no business operating a vehicle, especially a commercial airplane. It is actually the corner case, that the airplane refused to deploy the wheels. Usually, there is a technical problem preventing the deployment. So checking that the landing gear actually deployed should be one of the most fundamental things a pilot does, as well as looking out for error messages.
  - briandear 6y ago
    Looking at the damned airspeed indicator was all it would have taken.
- kayfox 6y ago
  The UI is preventing the pilots from extending the landing gear and causing it to be structurally damaged. In short, the UI is trying to prevent a mistake from having consequences.
briandear 6y ago
The altimeter and airspeed indicator was all they needed. They were high and fast and attempted to dive to the runway. Piss poor flying.

HPsquared 6y ago

The standard is to have indicator lights showing the actual position of the gear, and alarms if you are coming in to land without the gear deployed. If these pilots were truly incompetent, they were likely used to having a wide range of alarms constantly going off and probably ignored the alarm.

tass 6y ago

This would make the control less reliable as well as more expensive and heavier. Additionally, there are other factors which may prevent the gear from deploying so you need to check even if the lever successfully moved.

ceejayoz 6y ago

> The lever should refuse to budge unless moving it will in fact deploy the landing gear. That introduces a new and nasty failure state, "lever locking mechanism gets stuck".

tux1968 6y ago
It's not hard to have an override switch. But it would at least make the pilots 100% aware and actively engaged. You have an example right in front of you how the current system is deficient.
- zymhan 6y ago
  Surely you understand there are teams of engineers debating things like this when designing planes, right? You certainly don't seem to have a deep grasp of aerospace engineering, so maybe trust that others who do have asked these questions.

donarb 6y ago

Where in the report does it say that it was the plane and not the pilots that retracted the landing gear? As far as I know, there is nothing in the flight software that automatically deploys/retracts the landing gear, it's under the pilots control.

pbhjpbhj 6y ago
In the video linked above the gear stays retracted (with overspeed alarm sounding!) until the speed reduces. The speed doesn't reduce until they go-around and the engines fail. The gear then extends which bleeds airspeed, they turn hard, lose altitude and crash 1km short; with a massive loss of lives. It doesn't seem right that their approach could be so fast? So perhaps the pilots themselves lowered the gear. A comment on YouTube suggests that the gear does behave that way, it holds the command to lower gear and enacts it when airspeed falls sufficiently?
- donarb 6y ago
  I was talking about the first approach. On the second approach they did lower their gear, expecting to land. But both engines died and they lacked the power to reach the runway. Back to the first approach, if you look at the report with the graph of the speed/altitude, the landing gear is retracted just after they are told by ATC to abort the landing and go around. See page 11. https://www.caapakistan.com.pk/Upload/SIBReports/AAIB-431.pdf https://www.caapakistan.com.pk/Upload/SIBReports/AAIB-431.pd...

HeyLaughingBoy 6y ago

I get your point, and I'm sure that was an area of discussion during the system design. From my perspective, though, it introduces a potential failure point that may not be worthwhile. If you want the lever to not move when the landing gear controller will ignore the command, then you need to lock the lever in place. If that locking mechanism fails during a normal approach, you have an airplane landing with gear up. I'm sure the FMEA (https://en.wikipedia.org/wiki/Failure_mode_and_effects_analysis https://en.wikipedia.org/wiki/Failure_mode_and_effects_analy...) in this case will conclude that it's more likely that the lock will fail closed than that the checklist was ignored and both pilots will not realize that they're trying to lower gear at too high a speed since that requires three faults to occur: ignore checklist, pilot in command attempting gear down at airspeed too high, and copilot not noticing that.

jcrawfordor 6y ago
It would be particularly hard not to notice, as the gear not down warning would be sounding for a good portion of the approach. In the PIA case there seem to have been multiple warnings sounding that the pilots did not resolve - it's hard to say why, perhaps alert fatigue related to not following normal landing procedures normally.

phire 6y ago

There are many reasons why the landing gear might fail to fully extend and lock. There is no way the lever can know about all of these ahead of time. Which is why the checklists require the pilots check the landing gear status lights to check the landing gear is down and locked.

tux1968 6y ago
Of course, and that wouldn't change. But why on earth does that preclude the idea of better feedback for the case where the plane wont even try to extend the gear even if you were to lower the lever?

afwaller 6y ago

They did not try to lower the gear on their first landing. It would have lowered. They raised the gear. It was in the commanded gear up (stowed position) when they landed and the indicator would have shown it was up.