13 ms·

Given the analysis of what happened in the recent Air France crash, I can't imagine why the industry does not write better software to help combat this. It seem

Given the analysis of what happened in the recent Air France crash, I can't imagine why the industry does not write better software to help combat this. It seems as if the programmers writing the software are more concerned about writing valid code to fit the designed system ("the pilot signaled us to climb at exactly 40 degrees, so do it") rather than writing code that models the real world situations accurately. I found this bit of an article about the crash the most troubling: It was at this point, after autopilot turned off and they worked to change their course, that a stall warning sounded, meaning that the airplane wasn't generating enough lift. The report notes the co-pilot grabbed the controls and lifted the plane, which, according to aviation experts is contrary to normal procedure during a stall, when the nose should in fact be lowered. If pulling back on the stick should never be done when a plane is warning of a stall, why does the software allow a pilot to do it? This is surely simplifying the situation, but I can't believe we are incapable of writing better software to prevent human mistakes. I wonder what kind of hard limits do exist in the current avionics. For instance, is it possible to roll a Boeing/Airbus upside-down? If yes, why?

0x12 15y ago
What the pilot will do to keep the passenger and plane safe can't be foretold by software written in static situations on terra firma. Sensors can lie, equipment can break. Your software may have no better idea of the true situation than the pilot. In the end it is a judgment call and if you limit the ability of those judgment calls to a bunch of software then you are saying that those in a different time and place have a better idea of what to do than those with their feet in the dirt. It looks like in this case someone made the wrong judgment call. False positives in warning systems in commercial aircraft are happening with some regularity, in the end the pilot has final say.
- apaprocki 15y ago
  I think a more robust model of N completely different systems (both mechanical and electrical) to compute the same variable could be found so that the probability that it is computing a value outside of x% of the actual real value is lower than the probability that the human could make a mistake. Even if a speed indicator model in the event of pitot tube loss had a 25% margin of error, autopilot could have done the right thing or it could have possibly influenced their decision to pull back. EDIT: You can down-vote, but this is already the direction that cars have gone. For example, there is no way to stop any Mercedes after 2009 from automatically applying full brakes in an impending collision. http://www.daimler.com/dccom/0-5-1210220-1-1210348-1-0-0-1210338-0-0-135-0-0-0-0-0-0-0-0.html http://www.daimler.com/dccom/0-5-1210220-1-1210348-1-0-0-121...
  - gnaffle 15y ago
    I'm not downvoting you, but I think this is a kind of problem that seems solvable on the surface, but is very, very difficult to get right. You will always have situations where all speed indicators fail in a similar way leading the software to believe that the speed is correct. With all the erring on the side of caution that aircraft makes have used, we've had a couple of cases where the software "decided" something and caused incidents. Studies in N-version programming (such as used in Airbus planes) show that software written by different teams often fail in the same corner cases (with differing outputs). Eventually you might have software with "situational awareness" that can be trusted to make fewer mistakes than humans, but we're not there yet.
    - apaprocki 15y ago
      I agree it will take a long time to develop automated systems that can be trusted. It took 26 years for tech to develop from the first ILS assisted passenger landing to the first fully automated ILS landing. If you were to take this specific speed sensor issue, I'm more concerned there aren't different types of systems being used to try to cross-validate the numbers. The pitot-static system has its own backup on the plane, but if there is an inherent weakness of that particular system (e.g. ice), there is no other way to measure speed that is not susceptible to icing. Surely that particular problem is within our reach, no?
      - gnaffle 15y ago
        To measure airspeed I guess something has to have air flowing through it or past it, and that something would be susceptible to icing. That said, current pitot have very good ice protection, and AF447 was an extreme example with a known problematic type that Air France were in the process of exchanging. Perhaps GPS ground speed data with previous wind estimates could at least help with establishing that "something must be wrong with the airspeeds".
        apaprocki 15y ago
        That is what this captain suggests: http://travel.usatoday.com/experts/cox/story/2011/05/Ask-the-Captain-Questions-about-Air-France-flight-447/47447562/1 http://travel.usatoday.com/experts/cox/story/2011/05/Ask-the... Something scary from a Boeing pilot in the comments: Loss of all airspeed indications is not something we train for. It's always assumed in transport category aircraft that redundancies built in will always give us at least attitude, heading, and airspeed.
- scotty79 15y ago
  > Your software may have no better idea of the true situation than the pilot. Also: The pilot may have no better idea of the true situation than your software. All that matters in the and is not who is more awesome and versatile but who crashes less planes.
antoinehersen 15y ago
Pilots are very reluctant to hand over control to any kind of computer. It goes completely agains their self image. This is more true in certain company than other. A very similar phenomenon is how the USAF crashes more drones than the Army since they use pilots that insist on flying them in manual, vs the Army operators that do not consider themselves pilot. http://www.theregister.co.uk/2009/04/29/young_usaf_predator_pilot_officer_slam/ http://www.theregister.co.uk/2009/04/29/young_usaf_predator_... Commercial flight will become much safer when the persons in the cockpit will considere themselves plane operators vs pilots.
- apaprocki 15y ago
  Very interesting.. Pilots that want to be rated for Cat II/III ILS landings have to perform them every now and then to stay rated, so I bet a lot of people have been through computer controlled landings without even knowing. Definitely whenever the weather is unmanageable, they have to turn over control already. Here's a really good example of something that would be very difficult for a human to do: http://www.youtube.com/watch?v=TXJCHUmuUyw http://www.youtube.com/watch?v=TXJCHUmuUyw http://www.youtube.com/watch?v=Fe_pEK_kRVw http://www.youtube.com/watch?v=Fe_pEK_kRVw
- gnaffle 15y ago
  I think it's easy to say that without taking into account all the experience that pilots may bring to the table when an incident occurs. Pilots (and airlines) seem more than happy to turn flying over to the computers, in fact FAA and Airbus are concerned that modern pilots lack hand-flying skills due to over-automation. The AF447 crew did not have training in high altitude hand-flying, for instance. Until you have a situationally aware computer that consistently beats humans in accident scenarios, we still have to trust humans to do the job, for better or worse.
  - omegant 15y ago
    And still with AI systems taking care of the plane security there would be failures that will knock downd computers , lightning strikes, generator spikes, some kind of fisical damage to the plane, fire at the computer rack. All this is usual enough to keep comercial flights from using drones.
vladd 15y ago
There are several types of "flight law" modes (see http://en.wikipedia.org/wiki/Flight_control_modes_%28electronic%29 http://en.wikipedia.org/wiki/Flight_control_modes_%28electro... ) that define the set of protections enforce-able by the software. For example, in the case of Airbus airplanes, flying in normal law's flare mode provides protection against high angle of attack and bank angle protection. However, when something bad happens, the plane is usually switched in alternate or direct law, based on the philosophy that the software can fail and the pilot is the only one able to see the big picture and compensate for possible faulty sensor data. It's all a question of who to trust in highly-tensed situations: is the pilot suffering from vertigo or it's just a matter of faulty sensor readings due to external ice build-up? And if the software were to override pilot decisions, just think about liabilities in case something goes wrong, which is a Pandora's box for aircraft manufacturers.
scott_s 15y ago
The end of the article talks about software that does exactly this.
omegant 15y ago
The airfrance crash INMHO was a lack of training( or missunderstanding of it) because the pilot flying on the captain seat ( actually a copilot, the captain was resting) was performing the maneuver for fighting windshear( you won't find this on any conclusions is my guess from his input on the sidestick). In a stall you want to recover your speed asap , you dive and apply full throttle till you are able to level off with normal speed. Windshear usually happens when you encounter heavy wind changes on approach or take off, usually caused by heavy thunderstorms. Your speed will increase and then sudenly decrease to stall levels. It can very easily throw you to the ground. As you are very low, the stablished procedure is to apply full throttle ( as in a stall) but PULL your controlls full up ( the software limits the nose up position to around 25 deg nose up in airbus models). You flight at the minimum speed ( airbus airplanes will not allow you to fly below that speed at least if you are at low altitude, a plane using both engines at go around power will climb). The point is that as they entered the thunderstom ( that previously was avoided by preceding airliners) and had that pitot icing, they reacted with a windshear procedure when it was unnecessary ( there is a procedure to flight without reliable speed indications just trusting your artificial horizont and thrust position for a given speed, they should have applied it in a perfect world[it is very easy to say what is the solution afterwards of course]). At those altitudes the engines have no power left to perfor a windshear, so the speed started falling till they entered a deep stall. That stall was recoverable( this is a supposition) for lets say 2 minutes, but they still were aplying full up controlls thinking :why is this procedure that I have practiced thousand times in the simulator not working?( not understanding they were in a common stall) It seems that the other flight officer may have known what was happening but failed to take the controls. All this is my supposition based on the preliminary documents pblished and my experience with A320 aircrafts wich have pretty similar flight controls logic ( I am an airline pilot with 12 years experience flying boeing, douglas and airbus). Something completely diferent could be the final cause. Windshear is a primary maneuver to practice and master due to the extreme danger that it represents for any kind of plane ( maybe not for fighters). Stall is seen as a improbable danger due to the airplane software protections. Both are practised but the windshear is more enfaticed at least in europe, also the stall is seen as a basic flying skill, something not practical to practice in an expensive simulator with limited training time for all that complicated failures. To reply your question, you can not induce a roll to an airbus airplane ( not past 45 deg with normal conditions) unless you have lost some flight computers. You could for example with MD 80 or 737 as there are no computer protections. I don't know about 777 or other fly by wire boeings, but I guess they got some kind of protection. Sorry for all the typos and spelling! I am writting on a van on my way to the airport.

0x12 15y ago

What the pilot will do to keep the passenger and plane safe can't be foretold by software written in static situations on terra firma. Sensors can lie, equipment can break. Your software may have no better idea of the true situation than the pilot. In the end it is a judgment call and if you limit the ability of those judgment calls to a bunch of software then you are saying that those in a different time and place have a better idea of what to do than those with their feet in the dirt. It looks like in this case someone made the wrong judgment call. False positives in warning systems in commercial aircraft are happening with some regularity, in the end the pilot has final say.

apaprocki 15y ago
I think a more robust model of N completely different systems (both mechanical and electrical) to compute the same variable could be found so that the probability that it is computing a value outside of x% of the actual real value is lower than the probability that the human could make a mistake. Even if a speed indicator model in the event of pitot tube loss had a 25% margin of error, autopilot could have done the right thing or it could have possibly influenced their decision to pull back. EDIT: You can down-vote, but this is already the direction that cars have gone. For example, there is no way to stop any Mercedes after 2009 from automatically applying full brakes in an impending collision. http://www.daimler.com/dccom/0-5-1210220-1-1210348-1-0-0-1210338-0-0-135-0-0-0-0-0-0-0-0.html http://www.daimler.com/dccom/0-5-1210220-1-1210348-1-0-0-121...
- gnaffle 15y ago
  I'm not downvoting you, but I think this is a kind of problem that seems solvable on the surface, but is very, very difficult to get right. You will always have situations where all speed indicators fail in a similar way leading the software to believe that the speed is correct. With all the erring on the side of caution that aircraft makes have used, we've had a couple of cases where the software "decided" something and caused incidents. Studies in N-version programming (such as used in Airbus planes) show that software written by different teams often fail in the same corner cases (with differing outputs). Eventually you might have software with "situational awareness" that can be trusted to make fewer mistakes than humans, but we're not there yet.
  - apaprocki 15y ago
    I agree it will take a long time to develop automated systems that can be trusted. It took 26 years for tech to develop from the first ILS assisted passenger landing to the first fully automated ILS landing. If you were to take this specific speed sensor issue, I'm more concerned there aren't different types of systems being used to try to cross-validate the numbers. The pitot-static system has its own backup on the plane, but if there is an inherent weakness of that particular system (e.g. ice), there is no other way to measure speed that is not susceptible to icing. Surely that particular problem is within our reach, no?
    - gnaffle 15y ago
      To measure airspeed I guess something has to have air flowing through it or past it, and that something would be susceptible to icing. That said, current pitot have very good ice protection, and AF447 was an extreme example with a known problematic type that Air France were in the process of exchanging. Perhaps GPS ground speed data with previous wind estimates could at least help with establishing that "something must be wrong with the airspeeds".
      - apaprocki 15y ago
        That is what this captain suggests: http://travel.usatoday.com/experts/cox/story/2011/05/Ask-the-Captain-Questions-about-Air-France-flight-447/47447562/1 http://travel.usatoday.com/experts/cox/story/2011/05/Ask-the... Something scary from a Boeing pilot in the comments: Loss of all airspeed indications is not something we train for. It's always assumed in transport category aircraft that redundancies built in will always give us at least attitude, heading, and airspeed.
scotty79 15y ago
> Your software may have no better idea of the true situation than the pilot. Also: The pilot may have no better idea of the true situation than your software. All that matters in the and is not who is more awesome and versatile but who crashes less planes.

antoinehersen 15y ago

Pilots are very reluctant to hand over control to any kind of computer. It goes completely agains their self image. This is more true in certain company than other. A very similar phenomenon is how the USAF crashes more drones than the Army since they use pilots that insist on flying them in manual, vs the Army operators that do not consider themselves pilot. http://www.theregister.co.uk/2009/04/29/young_usaf_predator_pilot_officer_slam/ http://www.theregister.co.uk/2009/04/29/young_usaf_predator_... Commercial flight will become much safer when the persons in the cockpit will considere themselves plane operators vs pilots.

apaprocki 15y ago
Very interesting.. Pilots that want to be rated for Cat II/III ILS landings have to perform them every now and then to stay rated, so I bet a lot of people have been through computer controlled landings without even knowing. Definitely whenever the weather is unmanageable, they have to turn over control already. Here's a really good example of something that would be very difficult for a human to do: http://www.youtube.com/watch?v=TXJCHUmuUyw http://www.youtube.com/watch?v=TXJCHUmuUyw http://www.youtube.com/watch?v=Fe_pEK_kRVw http://www.youtube.com/watch?v=Fe_pEK_kRVw
gnaffle 15y ago
I think it's easy to say that without taking into account all the experience that pilots may bring to the table when an incident occurs. Pilots (and airlines) seem more than happy to turn flying over to the computers, in fact FAA and Airbus are concerned that modern pilots lack hand-flying skills due to over-automation. The AF447 crew did not have training in high altitude hand-flying, for instance. Until you have a situationally aware computer that consistently beats humans in accident scenarios, we still have to trust humans to do the job, for better or worse.
- omegant 15y ago
  And still with AI systems taking care of the plane security there would be failures that will knock downd computers , lightning strikes, generator spikes, some kind of fisical damage to the plane, fire at the computer rack. All this is usual enough to keep comercial flights from using drones.

vladd 15y ago

There are several types of "flight law" modes (see http://en.wikipedia.org/wiki/Flight_control_modes_%28electronic%29 http://en.wikipedia.org/wiki/Flight_control_modes_%28electro... ) that define the set of protections enforce-able by the software. For example, in the case of Airbus airplanes, flying in normal law's flare mode provides protection against high angle of attack and bank angle protection. However, when something bad happens, the plane is usually switched in alternate or direct law, based on the philosophy that the software can fail and the pilot is the only one able to see the big picture and compensate for possible faulty sensor data. It's all a question of who to trust in highly-tensed situations: is the pilot suffering from vertigo or it's just a matter of faulty sensor readings due to external ice build-up? And if the software were to override pilot decisions, just think about liabilities in case something goes wrong, which is a Pandora's box for aircraft manufacturers.

scott_s 15y ago

The end of the article talks about software that does exactly this.

omegant 15y ago

The airfrance crash INMHO was a lack of training( or missunderstanding of it) because the pilot flying on the captain seat ( actually a copilot, the captain was resting) was performing the maneuver for fighting windshear( you won't find this on any conclusions is my guess from his input on the sidestick). In a stall you want to recover your speed asap , you dive and apply full throttle till you are able to level off with normal speed. Windshear usually happens when you encounter heavy wind changes on approach or take off, usually caused by heavy thunderstorms. Your speed will increase and then sudenly decrease to stall levels. It can very easily throw you to the ground. As you are very low, the stablished procedure is to apply full throttle ( as in a stall) but PULL your controlls full up ( the software limits the nose up position to around 25 deg nose up in airbus models). You flight at the minimum speed ( airbus airplanes will not allow you to fly below that speed at least if you are at low altitude, a plane using both engines at go around power will climb). The point is that as they entered the thunderstom ( that previously was avoided by preceding airliners) and had that pitot icing, they reacted with a windshear procedure when it was unnecessary ( there is a procedure to flight without reliable speed indications just trusting your artificial horizont and thrust position for a given speed, they should have applied it in a perfect world[it is very easy to say what is the solution afterwards of course]). At those altitudes the engines have no power left to perfor a windshear, so the speed started falling till they entered a deep stall. That stall was recoverable( this is a supposition) for lets say 2 minutes, but they still were aplying full up controlls thinking :why is this procedure that I have practiced thousand times in the simulator not working?( not understanding they were in a common stall) It seems that the other flight officer may have known what was happening but failed to take the controls. All this is my supposition based on the preliminary documents pblished and my experience with A320 aircrafts wich have pretty similar flight controls logic ( I am an airline pilot with 12 years experience flying boeing, douglas and airbus). Something completely diferent could be the final cause. Windshear is a primary maneuver to practice and master due to the extreme danger that it represents for any kind of plane ( maybe not for fighters). Stall is seen as a improbable danger due to the airplane software protections. Both are practised but the windshear is more enfaticed at least in europe, also the stall is seen as a basic flying skill, something not practical to practice in an expensive simulator with limited training time for all that complicated failures. To reply your question, you can not induce a roll to an airbus airplane ( not past 45 deg with normal conditions) unless you have lost some flight computers. You could for example with MD 80 or 737 as there are no computer protections. I don't know about 777 or other fly by wire boeings, but I guess they got some kind of protection. Sorry for all the typos and spelling! I am writting on a van on my way to the airport.