Lauber on AF447 and autopilot disconnect

Dear David,

Some thoughts on a number of aspects associated with AF447.

1. In recent years many medical practitioners have expressed concern about the inadequate standards of knowledge of human anatomy possessed by today’s medical students - the result of many medicals schools neither teaching or examining the subject with the rigour of earlier times. These reservations have been around for 30-40 years to my knowledge but have had little effect so far. Perhaps therefore I should not be surprised that you might suggest that the aerodynamics discussed by John Lauber may be a bit difficult for some readers. They are in fact a very basic PPL aerodynamics and appear on page 10 of the Introduction to Volume 1 of one of the standard UK PPL training manuals (Birch and Bramson). That anyone remotely interested in what goes on at the pointy end should be unfamiliar with them is as unsettling to this self-loading cargo as it would be to go under the knife of an anatomically illiterate surgeon.

However what John Lauber says is true and the autopilot does, like the human pilot, depend on Q information. But it does not necessarily follow that when it has questionable Q information it should simply abdicate. When one is using any form of automatic guidance system (cruise control on a car to autopilot on an aircraft) its suddenly ceasing to function can be confronting. In AF447 there may have been at least two factors which would have compromised the “inherent stability of modern aircraft” noted by John Lauber. First they were in turbulence and second the A330 captain quoted by David Connolly indicates that autopilot disconnect would most likely have been associated with a thrust change. He also suggests that less than 50% of pilots would cope. The latter is probably an argument for more training re hand flying in coffin corner but the problem could be helped by a more gentle handover from autopilot to human pilot. When AS information is lost in the cruise pilots are taught to keep all other parameters (Pitch, thrust and altitude) constant and keep the wings level. It would probably be helpful if, when the AP loses AS information it (a) informs the pilot of the loss of information and (b) continued to maintain pitch, thrust, altitude and zero bank until the pilot had collected his thoughts and chosen to intervene.

This is a mirror image of the equally unhelpful autopilot in G-YMMM. In AF447 the autopilot chose to abdicate when, had it been appropriately ‘trained’, it could have done, in the short term, what was both sensible and possible ie maintain the status quo as above. In G-YMMM the autopilot tried to do what was not possible (stay on the glide-slope) and then did what was not sensible (fly the aircraft down to stall-warning speed 170 feet AGL). Had it been ‘trained’ to avoid the latter the aircraft would at least have arrived at zero altitude whilst still a controllable flying machine.

Do pilots ever get any say in the design of autopilots?

2. In my version of the DP Davis text he is much more emphatic – not “consider” the alternative but “chose” the alternative. Third edn. Page 128.

3. Some factual questions pertinent to AF447 and which one of your readers may be able to answer.

(a) What are the natural stalling characteristics of A330 and does it need any kind of artificial stall protection?

(b) Does it have any stall protection devices beyond the AOA protection in normal law?

(c) Has it ever been test flown to AOAs of 35 – 40 degrees?

(d) Is it capable of a “locked-in” stall?

(e) The three pitots presumably supply data to the LH panel, RH panel and standby ASI. From which pitots does autopilot 2 gets its AS information.

4. DP Davis refers to AOA being the “inviolate” piece of information in that it is AOA which determines whether or not you are stalled - a message now repeated by Airbus test pilot Xavier Lesceu. Other parameters (air speed, pitch angle) need some interpretation. If your nose up pitch is equal to or greater than the stalling AOA and your VS is negative then it is not rocket science to deduce that your AOA is in excess of the stalling AOA but at lesser angles of pitch the mental geometry is more complex – probably impossibly complex when you are over the Atlantic, in the dark, in turbulence and descending at 10,000 feet per min!

Given that AOA is a major determinant of lift and the most variable determinant of lift in all flight conditions, why is this information not made available to pilots? It was on one commercial aircraft produced 30 years ago and AOA information is frequently available to the aircraft since it is used the trigger shakers, knockers and pushers of sticks. It would not be too difficult or expensive to give it to the pilots. Does someone think that it would confuse pilots even more?

5. Aircraft, despite what their pilots sometimes think, are inanimate objects which simply respond to the forces acting on them – mainly gravity, thrust and aerodynamic forces. The initial BEA account tells us what the aircraft did and what it did is explicable in terms of what we are told about the forces acting on it. The pilots are a different matter. Whilst we are told what they did (or at least some of what they did) the reasons why they did it are far from clear. The reported dialogue would have only occupied about twenty seconds of the four minutes and twenty seconds from AP disconnect to impact and nothing is attributed to the captain. Presumably there is more dialogue to be reported and hopefully it will give some insight into the crew’s thoughts and actions.

Peter Bore
June 11 2011

David L and Peter Bore.
Davies of the Valleys was a clever boyo indeed. Brammy of the Guild merely thinks he is.
Referring to Peter’s questions.
(a) What are the natural stalling characteristics of A330 and does it need any kind of artificial stall protection?
Normal stall characteristics, it should have a tactile shaker from an ergonomic perspective.
(b) Does it have any stall protection devices beyond the AOA protection in normal law?
No.
(c) Has it ever been test flown to AOAs of 35 – 40 degrees?
No.
(d) Is it capable of a “locked-in” stall?
AF-447 demonstrated in the affirmative. Thanks to an auto-trimming horizontal stabilizer in apparent manual in the Alternate Law twilight zone, flight a “locked-in” deep stall is available and a coffin corner is open to all altitudes.
(e) The three pitots presumably supply data to the LH panel, RH panel and standby ASI. From which pitots does autopilot 2 gets its AS information.
All autopiliots receive their data from the Air Data Computer which process the pitot-static pressures.

As Dr. Lauber implies, it is quite rational for an AP/AT to abdicate rather than adjudicate a pitot-static discrepancy. Ditto for an EFIS Boeing. Discounting the ergonomic deficiencies of the offside rule by law of sidestick per se, the real sting in the tail is the auto-trimming in “Alternate Law” manual flight, which needs urgent review if not outright repeal. It is timely to recall the death of Airbus 330 Chief Test Pilot, Nick Warner of Colchester, England as PNF/PM on F-WWKH, A-330-300 on June 30 1994 and his crew, co-pilot/ PF, an engineer and 4 pax, 2 Airbus and 2 Alitalia. It happened at Toulouse-Blagnac/LFBO. I suspect the registration was coincident with Nick’s exclamations as the ship reverted to “Direct Law”.
Narrative:
The test flight was part of the preparation required for the certification of the Pratt & Whitney equipped Airbus A-330 autopilot to Cat. III standards. The first part of the test flight was completed successfully when the aircraft landed on runway 15L. A 180deg turn was made for a runway 33R takeoff. The second takeoff was to be performed under conditions similar to those of the first takeoff. For this test however, the autopilot would incorporate the modification under study (Spatiaal with Bubble in 3972 state). The aircraft weighed 147,700kg and a centre of gravity of 42%. The takeoff was performed by the co-pilot with, instead of Flex 49 of assumed temp deducted not derated thrust of 49C on Boeing EICAS this is “TO +49c”. Assumed temp is deducted, not derated and assumes rated VMCG. Rotation was positive and pitch input was stopped when the attitude changed from 12deg to 18deg nose-up. Within 5 seconds after takeoff several attempts to engage the autopilot were unsuccessful. After it was engaged, activation was delayed by 2 sec because the 1st officer was exerting a slight nose down input on the side stick. The aircraft, still trimmed at 2.2deg nose-up pitched up to reach 29deg and the speed had decreased to 145 knots. The captain meanwhile reduced thrust on the no. 1 engine to idle and cut off the hydraulic system in accordance with the flight test order. Immediately after it activated, the autopilot switched to altitude acquisition mode (altitude had been set at 2000 feet on the previous flight phase). This caused the pitch attitude to increase to 32deg in an attempt to reach 2000 feet. The speed decreased further to 100 knots (VMCA=118 kts). Roll control was lost and the captain reduced no. 2 engine thrust to idle to recover symmetry on the roll axis. Bank and pitch attitudes had reached 112deg left and -43deg resp, before the pilot managed to regain “Direct Law via it’s Abnormal Law subset” control. It was however too late to avoid ground impact at a pitch attitude of around -15deg.

PROBABLE CAUSES:
The initial causes are primarily related to the type of the test and its execution by the crew during the last takeoff.
1) Choice of maximum rated thrust instead of Flex 49, assumed temperature method.
2) Very aft CG for the last takeoff.
3) Trim set in the takeoff range, but in too high a nose-up position.
4) Selected altitude of 2000 feet.
5) Imprecise and late definition of the test to be conducted and the tasks to be performed by the captain and acting first officer, respectively.
6) Positive and very rapid rotation executed by the acting first officer.
7) The captain was busy with the test operations to be performed immediately after take off (engagement of the autopilot, reduce thrust on the engine and cut off the blue hydraulic system) which temporarily placed him outside the control loop.
8) In addition the absence of pitch attitude protection in the autopilot altitude acquisition mode played a significant role. Both engines were delivering TOGA rated thrust reference upon autopilot engagement. Thereafter with no.1 idled, the autopilot “assumed” it still had the same V/S schedule capability at engagement and pitched up to attain an altitude it no longer had the V/S schedule capability to attain.

The following also contributed to the accident:
1) The inability of the crew to identify the mode in which the autopilot was placed.
2) The confidence of the crew in the expected reactions of the aircraft-Alpha Floor activation expectation bias.
3) The late reaction from the flight test engineer when faced with a potentially hazardous change in parameters, speed in particular.
4) The time taken by the captain to react to an abnormal situation.
And there I was thinking previously, that the MD-11 or as I call it, the “Mad Dog # 11 Pitch Bitch of Long Beach”, was hard work ?. It is, but bad as it is, it is, it is not ambiguous, even with it’s Longitudinal Stab Augmentation System, basically a yaw damper in pitch mode. I paste a description of it’s operation.
MD-11 FCOM :
The FFC sums the Captain’s and First Officer’s control wheel inputs. When there is no force on the
control columns, LSAS holds the current pitch attitude. When the force exceeds two pounds, LSAS
operation is suspended and the elevators are in manual control. When the force on the control
column is reduced below two pounds, LSAS holds the newly acquired pitch attitude. The limits on the
attitude that LSAS can hold are +30 and -10 degrees. The maximum elevator deflection that LSAS
can command is five degrees.
Notice “elevators only and a kilo of feeling too for good measure” .
All autopilots, be they Boeing or Airbus can fly the plane into a stall or into the ground in their basic V/S (Very Slowly, Very Special) non-integrated modes, which is why it is best. The AP assumes that there is sufficient AT thrust to meet it’s pilot selected attitude to altitude V/S demands in VNAV or FLCH it blends in thrust to close the MCP posted demand to the FMA registered post in 2 minutes, up to reference thrust. Unbundled AP simplicity is also the freedom to kill yourself. Therefore it is essential to be more pilot qualified than computer qualified. Regarding AOA displays, they are an added luxury on Biz Jets, like the Citation X. Commercially, they are thought of as a distraction and the attitude is take care of the speed and the AOA will take care of itself, pardon the pun.
Airbus is deficient in this regard. “S/he” PF needs some connected awareness of a physical interaction. Mind is body is mind in a holistic sense, as Peter will appreciate. And the sidestick is certainly, by all metrics less human holistic and more feminine, albeit more “femme fatale”, when lustily gripped in desperation more than romantically held in Alpha-Floor expectation, especially when S/he is PFD focused and not peripherally aware of their partner’s stick inputs, as S/he is, with an interconnected yoke. AF-447’s startled crew discovered this and were left at the Oceanic Floor of the Alpha Floor Twilight Zone. A “femme fatale” stab in the back, sting in the tail, as it were.
Attitude is instrument visual, as you say, to mitigate somatic bias. And further, as you correctly state “no good pilot RELIES on feel”. Of course not in general ! And on heading-track LNAV/VNAV PTH, in particular! “Feel” in general and-Q Feel in particular were born on the Avro Vulcan Bomber of 1952 and evolved on Boeing with a fin mounted Pitot probe internal bellows (initially) on the B-707/720. It was more mechanically evolved on 727 and 737. The B-747 Classic brought its ADC-evolved cardware (between soft and hardware) inboard, using the normal pitot probes without it’s own specific probe and the B-744 evolved it further with a specific static port plate Q-feel for “ELEVATOR FEEL”, visible just below and forward of the leading edge of the horizontal stabilizer on both sides. Feelings may be hurt, but they are our last resort, albeit, of desperation in an AF-447-like uncontrolled descent. But, unlike Airbus, Boeing does not deny feelings, as they plan for the worst pilot at centre than an Airbus academic pilot on the unfeeling periphery. And if all is being lost, it is best to go down fighting with gasping feeling in S/he’s triceps, with a possible last second heaving kinetic-potential energy conversion. Freedom to buckle the spars invites an airframe write-off, with a write-on crew/pax slim survival. We drive and fly with our brain matter and feelings are a basic necessity for man/machine interface. They should not be a luxury. Head must rule the emotional heart, but the head must also take some input from the emotional heart.
Humans flying aircraft are primarily an IFR exercise after takeoff and before landing. But ergonomically speaking, I personally, feel much more connected/anchored in a Boeing. Also, with dual moving yokes, one is peripherally aware of your partner’s inputs, as I said. On an Airbus, one only gets this feeling on the rudder pedals, ouite a philosophical disconnect, that is seemingly NEVER mentioned in debates. Boeing build a plane for the worst pilot, which is the best place to start. The sidestick on Airbus seems to have left a vacuum filled with ambiguous auto-man-auto fudge. I think the hull loss and serious incident rate reflects this. Driving to the airport, we feel the car, glance at the speed and navigate by the visual road and one is further connected to the “car’s torque feeling” by the gear stick, less so in an automatic static detent stick. That is optimal in a congested city/terminal area, suboptimal on a motorway/magenta LNAV highway.
The sidestick has an inherently short range of motion....one little wrist twitch and a side stick airplane is potentially pitching rolling like there's no tomorrow, as in AF-447 literally.
If you need a tiny adjustment- you have to move your wrist the tiniest amount.
As a contrast, looking at say, a school bus steering wheel.....a little arm jerk is essentially nothing. A moderate correction- you make a real input....a hard turn- you need a hard input.
A genuine on-the-floor stick and or a traditional control wheel/yoke gives you several inches of movement to provide control inputs...as opposed to less than a couple of inches on the sidestick.

Conversely, a nice big Boeing wheel or a glider centre stick, would involve biceps, forearms, shoulders with visual connection to a central brain. It does not require surgical precision from the pilots fingertips and wrist.
As for conspiracy theorists on Dr. Lauber’s Airbus affiliation ?, such theorists confer credibility on astrologers and are probably economists in disguise. He always exhibits clear objectivity. "Existing commercial sidesticks offer no visual or tactile cues to the pilot and must have restrictive performance limits”, as Boeing says. All are equal in Airbus FBW logic, except the stabiliser is more auto equal, when a hapless pilot in a stressed reversion to basics expecting only elevator and forgetting about auto trim in Normal Law and forgetting completely about it’s operation in Alternate Law. And the rudder is a “Fixed Ratio” law unto itself.
Airbus v Boeing, same movie different cinema ?, aerodynamically yes, but good films are not made but remade. The time is apt to go back to the future. And regulation has always been and shall be, public comfort serving political vindication. As form follows function, the design should be always above and beyond any regulation and bound by the laws of physics, which provides a margin of compliance before the next political-bureaucratic muddled law. This accident has far from “destabilized the thinking of a lot of people”. Lot # moi, has always exercised stable thought, I hope ?. Airbus Alternate Law previously seemed hazard free. An auto-trimmed, full travel stab-locked stable deep stall was probably never even considered in general and in the coffin corner in particular. I would argue that Airbus FBW philosophy is 100% stable and misguided simultaneously. And when one assumes something to be foolproof, Murphy’s “Direct Law” ensures that a better fool is always on final approach.
And last, but foremost, remember the Lufthansa A-320 EDDF-LFPG on March 21 2001 with 115 pax and 6 crew with crosswired controls after maintenance which is one of the best reasons against commercial sidesticks. It is also why the control check has to be done twice prior to taxi since then on Airbus flights. To wit : After T/O from EDDF’s Rwy 18, the plane rolled left, the Captain PF moved his sidestick to the right, the plane rolled further left to 22 degrees. The Captain then called out “I can’t do anything more !”-a fairly familiar call out on an Airbus flightdeck-the FO PM, instinctively moved his sidestick to the right beforehand, obviously in contravention of Airbus FBW logic, like the AF-447 crew too. He then said “I have control!”, before pushing his sidestick takeover button. This ended safely, but was an accident in everything except outcome. A salutary tale indeed of a near-Nick experience with a Schumacher-like FO’s fly by light reflex in the nick of time.

Investigators omit the main cause of why this all started. AF447 crews total lack of good CRM flew smack into a solid line of 50,000 Foot Thunderstorms in the ITCZ . They did not deviate like other airliners on same track and were seen by eyewitnessed airliners see AF447 go Smack into them which directly resulted in severe turbulence auto-pilot disconnect which resulted in stalling aircraft NOT PITOT PROBE ICED UP SENSORS as Air France /Airbus Criminals falsely say to cover up their incompetent flight crew /training procedures. High Level Sig Prog Charts/Goes Satellite Weather Data confirms validity, I checked as soon as I saw this on CNN 3 years ago I knew exactly what happened. The most overlooked safety issue in this business is flight crews continuous disregard for following safe Severe Weather Avoidance per the 10 commandments written in black and white in the AIrmans Information Manual by FAA.