Airbus Plans To Use Computers

[J.O.]

I've come to like (or at least tolerate in some cases) Airbus automation, but on this one, I'm not too sure I'd like it...

Autopilot Would Be In Control

European jet maker Airbus has been at the forefront of integrating onboard computers into the cockpits of commercial airliners... and the company is reportedly ready to take another big step towards expanding cockpit automation: onboard computers that will automatically maneuver jetliners to avoid midair collisions, without any input from pilots.

Airbus says future flight crews on its jets will be instructed and trained to rely on autopilots in most cases to escape an impending midair collision. Pilots are currently trained to disconnect the autopilot when they get an alert, and then manually climb or descend to avoid the other aircraft.

The Wall Street Journal reports Airbus plans to install computerized avoidance systems as soon as next year, pending regulatory approvals... despite protests from pilot groups and some aircraft equipment suppliers, who are reluctant to put such an important safety concern in the electronic hands of an automated system.

Air Line Pilots Association safety official Larry Newman said his group opposes such devices, as "this tends to lead to getting the pilot further and further away from the process" of responding to emergencies.

Airbus maintains that could be a good thing, as computer control during emergencies would reduce the chance of a human pilot overreacting, or over controlling the aircraft... which can cause greater problems. Automatic avoidance systems would ensure that all aircraft "respond correctly and quickly" to alerts, with "less stress on the pilot [and] less potential for injury" to passengers, Airbus safety expert Bill Bozin told the WSJ.

Bozin added that, in some circumstances, pilots would still be advised to take control of the plane back from the autopilot... although such occurrences would be rare.

So, it would seem automated collision avoidance might soon become a reality... at least on Airbus planes. A spokesman for Boeing told the Wall Street Journal the company would remain "aligned with our fundamental philosophy," which "believes the captain is in charge" of handling the airliner in event of an emergency.

aero-news.net

[Maverick]

Hey JO,

Sorry I couldn't talk to you that much when you called we were having a crazy busy garage sale! Some one actually nabbed one of the "Joy of" books!

Cheers,

Judy

If you tell us which "Joy of" book was nicked we could all keep an eye out for it.

[deicer]

What next.....

The Aussie's are already in type trials to have ATC control the aircraft from top 'o drop down.....

And then,,,,

The Dreaded Autoland

Iceman

[Kip Powick]

If you tell us which "Joy of" book was nicked we could all keep an eye out for it.

I gotta ask ..................

The "Joy of Cooking"....or....

"The Joy of S--"

[Mitch Cronin]

Hey Jeff... Does "Professor Daestrom and The M5 computer" ring any bells?

I'm all for letting computers do the thousands of corrections per second (or whatever it is) to keep a wild ass machine somewhat controllable (by a HUMAN!)... as in some wild and fancy fighters and such, and I can even appreciate the Airbus feature of only letting the airplane do what it's capable of doing, regardless of excess input... But this strikes me as a step too far, and what's even scarier is that it's probably only the first of many steps they'll want... eventually leading to the man and the dog... who of course will be very soon afterward declared redundant.

Save the dogs!... err.. and the pilots!

...seriously though... I don't like it. Who can say they've never seen all this fandangled automation glitch? Imagine being taught to let the beast do it's own thing? Now how far does it get before you realize it's in error?

[J.O.]

Judy:

I guess Glen needs a manual for everything, eh?

It sounds like you folks are in for some new excitment in your lives. I wish you cool breezes and taut lines! Just keep us in the loop, okay?

Hey Mitch:

Sure does! I just hope I don't have to tell an Airbus that it should shut itself down some day, thus making me vulnerable to attack from the Federation's battle fleet!

I'm with you, there are many good uses for automation, such as landing in low vis conditions, flight envelope protections and the like. TCAS manoeuvres are somewhat of an emergency, and I'm not convinced a machine can be adequately programmed to handle all of the possible permutations. They are best left to the pilots, IMHO.

Jeff

[Kip Powick]

Now how far does it get before you realize it's in error?

Perhaps you may want to ask Captain Asseline that very question.

[conehead]

Edited due some research into the Habsheim crash.

[Guest rattler]

On Sunday June 26, 1988, the airclub at the airfield of Mulhouse-Habsheim in Alsace/France had organized with Air France a low approach of a brand new Airbus A320 in landing configuration. Michel Asseline was the pilot in command of F-GFKC, Pierre Mazière was his first officer, when the aircraft overflew the airfield at 2 pm in wonderful sunny weather. Some seconds later the aircraft touched the tops of the trees behind the runway and crashed into a forest. 3 passengers died in the accident and about 50 were injured. The accident was filmed by a video amateur and has been shown dozens of times on TV. F-GFKC was the first of a couple of aircraft of this type to be lost in the next few years (see below).

The Black Boxes were taken undamaged from the aircraft 2 hours after the crash, but unfortunately they have been out of control of justice for 10 days, and since May 1998 it is proven that the Flight Data Recorder was substituted during this period. The Lausanne Institute of Police Forensic Evidence and Criminology (IPSC) comes to the conclusion that the Black Boxes used in the trial to declare the pilot guilty are NOT the ones taken from the aircraft.

The aircraft was new, Airbus was waiting for commands, a lack of confidence in the highly computerized aircraft would have meant a commercial disaster - not only for the manufacturer, but also for the French administration, which has a share in the European Airbus consortium.

The Official Version

The French minister of transportation (Louis Mermoz), the company (Air France) and the aircraft manufacturer (Airbus Industry) declared with precipitation shortly after the accident that the aircraft was beyond any doubt. The final report (published 18 months after the accident) comes to the same conclusion, but the authenticity of the data on which the report has always been very doubtful, and since May 1998 it is proven by the report of the Lausanne IPSC that the Flight Data Recorder (DFDR) was substituted after the crash. For 10 years the media have not stopped reporting about the anomalies which have accompanied the technical investigation of the accident from the beginning.

The Captain's Version

Captain Asseline flew the aircraft manually. He had been instructed by Air France to overfly the airfield at 100 ft above ground. When he increased throttle to level off at 100 ft, the engines did not respond. So after some seconds he got worried and thought there was something like a short-circuit in the completely computerized throttle control. So he pulled the throttle back all the way and forth again. By that time the aircraft had touched the trees.

After the accident, Captain Asseline was very astonished when he saw on an amateur video tape that the gear was only 30 ft above ground when the aircraft was passing over the runway. He affirms the altimeter of the Airbus A320 indicated 100 ft.

Air Disaster dot com article on the accident.

[Don Hudson]

Mitch;

I think this kind of automation/control is inevitable. Given increasingly precious airspace to accomodate burgeoning traffic demands, the need for optimum cruise altitudes to minimize fuel flow and the capabilities of hardware and software today and the misapprehended "need" by instrumentalist thinkers to remove the "human factor" especially when training costs are significant, I think an automated TCAS response is a certainty. What's more, I think that extending this thinking to automated responses based upon EGPWS warnings and eliminating the "human factor" is also a virtual certainty. I think in most cases, the technology will work better than human responses.

What is missing, perhaps intentionally, is the appreciation of what we all know too well and that is the ability to "gestalt"...to think creatively, alternatively, swiftly and with imagination of future outcomes. The very characteristics which make such a system attractive because it does not have "human attributes" such as indecision, hesitation, or a comprehension of "future" or "past" may also make it spectacularly wrong instead of merely wrong where headlines and not a minor incident report is the result. As sure as autolands were once impossible and now so routine we have an Alert Height which never requires us to look outside at earth, these automated responses are coming.

[Don Hudson]

Going from memory here....the safety report I have from Airbus (which includes all the usual DFDR traces) reported that the crew had discussed the fly-by and had intended to fly slowly with a high angle of attack at an altitude above 100'. In order to do this the Alpha-Prot and stall protection CB's were pulled so that the stall protection would not be triggered, taking the engines to "TOGA-Lock" (For non-Airbus folks, that's full thrust, uncommanded by the crew).

Bit of a diversion again for non-Airbus pilots; - in such a condition, (Alpha-prot), the Airbus can be flown with full backstick (hard on the stops) just above the stall, doing 20deg bank turns while climbing. In fact, climbing (rapidly, at light gross weights) is exactly what the crew wanted to prevent and instead wished to demonstrate level flight just above the stall as in so many airshow maneuvers we see, so they did pull the Alpha-prot system CBs. That's in the report.

This act alone indicates that the crew did not intend to fly below 100' AGL. The reason for this, and the crew knew it, is, Alpha-prot is disabled automatically below 100' obviating the need to pull any breakers if they actually had intended to fly at 30', below the treeline.

So what happened?

The Habsheim "runway" was a small grass strip about 3000' long and about 50' wide. Those of us who fly in Canada and then fly to the States or the Caribbean will know that we consciously remind ourselves that the 200'-wide runways we are used to in Canada are only 150' wide down south. The reason we remind ourselves is so that we don't flare too late because of the optical illusion created by the smaller runway, (waiting for it to "get bigger" and smacking it in the process!...Been there...Done it).

According to the Airbus report, the crew suffered from this optical illusion in a big way and simply flew the routine at what they thought was a higher altitude. The trees would have appeared lower at the beginning of the run.

What happened to their scan and the radio-altimeter? What happened to CRM?

A fly-by isn't a normal maneuver and when one is accustomed to procedure (and procedure rules a pilot's working life), something out of the ordinary can be a bit distracting. Ask any airline crew about the go-around maneuver.

I can't recall what the report says about this, but I suspect the scan and CRM may have (quite literally) gone out the window as these guys were watching their flightpath carefully, thinking they were higher than they really were. The F/O first expresses surprise and calls to the Captain to watch out for the trees. A few seconds later, (a long time...), the CVR reports "click, click" of the thrust levers as TOGA is set. The engines can be heard spooling up in the video just before the trees are eaten.

Whether the recorder was switched or not doesn't matter. Even the reasons for the accident, in the end, don't matter. The story here is, this is not an automation accident. It is a combination of crew error and human error along with the usual high risk that goes with any airshow exercise.

[Kip Powick]

The story here is, this is not an automation accident.

I tend to disagree ...a bit ....Don, based on what I have read..... Here is a pretty indepth report about the switching of the black boxes which was apparently done to exonerate Airbus from possible problems with their automated engine controls...It is a good read.

I will agree that the depth perception angle is a good defence but I really think these guys thought that the automation would look after them and when it didn't...well who did what????? will we ever know the truth ??? Yes CRM was at fault as well but they apparently did get "automated" alarms but chose to disregard them.

Indepth Report...

[Don Hudson]

Hi Kip;

Re, "exonerate Airbus from possible problems with their automated engine controls"

That doesn't make any sense. The Airbus "automated engine controls" are FADECs which control a CFM56...there's nothing more complicated than the earlier 767-300 FADEC. There's nothing to hide there at all and no basis whatsoever for the statement. Besides, it isn't "Airbus' " engine controls or engine.

Re, "but they apparently did get "automated" alarms but chose to disregard them."

I know of no cockpit "alarms" except the verbal alarms "stall, stall" and master warning light which made great sense under the circumstances. The statement that they "chose to ignore them" is specious in my view. The warnings very likely occurred just before the aircraft went into the trees. They certainly did not occur earlier in the fly-by.

The DFDR readings show about a 6 to 8 second spool-up time for the two engines. The CAS got as low as about 109kts. The thrust levers went to TOGA about 7 seconds before the trees. From idle thrust (thrust levers showed 0deg in the DFDR until they were placed to TOGA) to 90%N1, that time is absolutely nominal. Nothing was wrong with the engines or the "automation".

I can't imagine where the crew, experienced as they were on Airbus, may have thought there was "magic" in the automation that would somehow "save" them..basic Airbus knowledge teaches the pilot the benefits as well as the limitations of automation; there are no hidden "saviours" but only flight path protections under limited circumstances, and they had already disengaged those by pulling the CB's. In the end, why would a professional airline crew, especially with passengers on board, place their aircraft in such a position at an airshow whereby their only salvation would be "the automation"? The position chosen is not plausible and such statements about automation causing the accident are made or believed almost exclusively by those who have never flown the aircraft. There have been some software anomalies to do with Config 3 (20deg) landing flap and strong crosswinds and the Warsaw accident highlighted an air/ground issue where reverse and brakes were not available in Config Full (35deg) until the a/c was "told" it was on the ground by the main gear. That indeed was the case; I have experienced that on a wet (long) runway myself. The issue is not a problem in Config 3.

Unfortunately, I think this is a crew, and human factors CFIT accident which happened under highly-charged circumstances where other factors were strongly in play.

While there have certainly been mode confusion incidents and accidents (Bangalore, Warsaw, Strasbourg) automation itself (taking control away from/beyond the crew has not occurred and has never been the cause of an Airbus accident. That's not blind support but is what the evidence tells us. I didn't like the Airbus one bit when I first flew it in 1992 but have come to "understand" it...it does take a while...longer than the Boeing. The issues on the aircraft are ones indeed, of understanding and therefore of training and experience, not lack of crew control over what the software/hardware was or wasn't commanding.

[Mitch Cronin]

Don...

Inevitable? Hmmm... Maybe so. I'm sure there are those in the aircraft manufacturing biz that believe fully automated, pilotless aircraft are inevitable... And maybe that's true? ...but I'll never climb aboard one to go flying.

I've seen too many examples of "hmmm, we didn't anticipate that" from the makers of the "magic"... almost every mod that comes is an answer to one of those, isn't it?... and too many glitches.... I can't ever forget the concern and confusion I saw from a 320 pilot who'd watched his airplane go to alpha floor protection, in cruise! Twice!

I understand that hesitation, or unfortunate confusion over conflicting messages has highlighted the need to follow TCAS RA's without question, and as such, it almost seems perfectly reasonable to then allow the computers to instantly execute the maneuvers called for by the RA... But what seems inevitable to me, is that if pilots are going to be trained to let the bird fly it's own collision avoidance, there will come a day when they should intervene, but they won't. I'd rather trust the adaptability of a human than the rather poor aproximation of same that computers are capable of.... at the moment anyway... That may change, but I'll wager we're out of jet fuel by the time computers can shift modes of operation as quickly and as appropriately as a human who's been trained to do so.

Another thought... you won't do an autoland without 3 functioning autopilots, right? Would there now be 3 independant TCAS systems tied in with them? That could - scratch "could", add "would" - cause a whole new set of problems...

I dunno... I guess I'm exhibiting one of the age old human traits of resistance to change... but allowing computers to assist in keeping our bodies whole isn't so hard as giving them complete control.... Maybe if I hadn't seen so many very odd glitches? ... including those where the computer's own self check coldly claims there is nothing wrong, yet there is!

[Kip Powick]

Hi Kip;

Re, "but they apparently did get "automated" alarms but chose to disregard them."

I know of no cockpit "alarms" except the verbal alarms "stall, stall" and master warning light which made great sense under the circumstances. The statement that they "chose to ignore them" is specious in my view. The warnings very likely occurred just before the aircraft went into the trees. They certainly did not occur earlier in the fly-by.

Re - GPWS from "indepth report

This alarm sounded 44 seconds before the trees on the short Habsheim flight. It is clearly audible on the CVR, but it was not recorded by the DFDR as it would normally have been. This supports the theory that the data tapes were tampered with after the crash. This data would have assisted identifying fraud by enabling better synchronisation of the CVR and DFDR tapes.

44 Seconds is quite a long time. Based on your post would I be correct in assuming you don't feel there is any credibility to the "indepth report" I linked you to.

[Mitch Cronin]

Kip... I dunno about the whole report, as I haven't read the whole thing at this point... but as I was looking for the quote you added in your last post, I tripped over this:

"The "official" DFDR data says that the A320 flew at stall speed of 113 knots at Habsheim, but it also shows that the angle of incidence never exceeded 14.5°, and never reached the 21° angle of stall speed.

There is therefore something very disturbing in this data, because only one single speed can correspond to a particular angle of incidence in aviation

This 14.5° angle of incidence corresponds to only one aircraft speed and that is speed is 128 knots, not 113 knots!"

If the credibility of the rest of the thing is similar, then it's all junk!

Those comments are right out to lunch! "Angle of incidence" is fixed by the manufacturer. No flying can change it without bending the wing... And, even forgiving that error and assuming they meant "angle of attack", it's a patently false statement that any such angle can be reached at only one speed!

Edited to add: Maybe I'm being a bit harsh there... could be translation errors have wormed there way into those statements... Obviously, at a fixed flight path angle, and configuration, any given angle of attack will indeed correspond to a specific speed, but if that's what was meant, it wasn't said (in the English version we're reading here at any rate).

[Mitch Cronin]

The Airbus only has two autopilots

!! I knew that...

2 FMGC's... I wonder where my head went when I wrote that? ...was I thinking of ADIRU's? or other airplanes maybe? ...oops.

there is no problem with a single-autopilot autoland if necessary

That I didn't know. I thought autoland would only be used if all was hunky dory...

That could be flying at maximum recommended altitude (or higher) and encoutering turbulence, or flying close to Vls and extending the speedbrakes or tightening a turn to final.

I spoke with the pilot about just that and he said they'd had no turbulence and I can't remember at what altitude, but it wasn't near any limits... a happy cruise at the time with nobody touching anything... Our guys found nothing wrong. ??

I appreciate what you're saying Rich... garbage in equals garbage out... and for the most part, I agree wholeheartedly... ...however...You're speaking of a collection of machinery which is all working properly. I've seen computer failures that included an inability for the affected systems other computers to detect that failure... Sometimes lost data will be interpreted wrongly, or it appears that sometimes the last known data can be assumed when that's innapropriate... I can't tell you the number of times I've watched as on-board computers of various sorts have lied to me about what's going on...

Obviously that frequency is because of the unusual nature of the various situations we put the aircraft into... but still ... Being pushed out of a hangar while the airplane is ringing all it's chimes and telling me the gear is up is a pretty odd image indelibly burned into my memory.

It may be that I'm a little overcautious, but I don't mind being a contributer of one of the little voices that helps to ask those who sell this automagic if they really are sure.

[Don Hudson]

Kip;

I am a flight safety person. When I read works that have a clear agenda I remain aloof until enough information can be confirmed from as many independant (non-aligned) sources as possible that the work may have something sufficiently credible to say that an accident report should be re-examined or perhaps even re-thought. I can't work as fast as some at coming to conclusions regarding credibility of these kinds of works.

I have located my Accident Investigation paper from Airbus (I wrote the post from memory of the paper) which was written in November of 1995 by Airbus Industrie Flight Safety and will re-read.

I fully understand the import of the claims made by your linked article. I have read of them for a number of years now and have seen the documentary on Asselin as well. Every so often this accident arises in these kinds of discussions and is re-fought over and over as an "example of automation run amok". I have yet to read any incident or accident reports which point to primary or secondary automation causes where the crew did not have direct control over the aircraft or where, despite aggressive crew interventions, due to automation control, there was an incident or accident.

All safety people understand that there are powerful forces and understandable agendas involved in such issues so it is no surprise that "op-ed" papers spring up in defence of one view or another. The accident investigation process is not immune to politics and other pressures but it is the most independantly-driven process available. It does not intend exoneration or blame but only asks the question, "what, how, why and where".

Cheers,

Don

[Don Hudson]

Hi Mitch;

Re

QUOTE (Rich Pulman @ Jun 1 2006, 10:39 AM)

there is no problem with a single-autopilot autoland if necessary

That I didn't know. I thought autoland would only be used if all was hunky dory...

The 320 & 340 fleet-types are capable of full autoland on one autopilot.

When CATIII approaches are being conducted, part of the approach/landing preparation is to assess the aircraft systems and capabilities. Ninety-nine percent of the time "CATIII DUAL" is available (two autopilots) and our limits are governed then by an "AH, Alert Height" concept where we never look out but keep our eyes and ears glued inside the cockpit for any sign of abnormality. We disconnect the autopilot only to taxi the aircraft off the runway. Its essentially a zero-zero landing but practically speaking (due to the RVR installation) there are visibility requirements but no ceiling requirement. Only CAT I approaches have the old-fashioned "200 & 1/2" weather limits.

"CATIII Single" is one autopilot and our weather limits go up slightly. We are governed by a "DH - Decision Height" concept of 50ft on the radio altimeter and a visibility requirement of 600ft RVR.

While all this is going on, the software driving everybody during the approach is constantly monitoring system condition, aircraft position and trends, and the two FMGCs (Flight Management Guidance Computers for non-Airbus folks) are "voting" (as the IRS's (ADIRS) do during all phases of flight) and comparing notes as it were. An immediate go-around is indicated on ANY abnormality. Like most transport aircraft built today, the Airbus can go-around from any height and can even touch down briefly during the maneuver before continuing the go-around. Seen it...its very pretty to watch and builds huge confidence in the systems.

The present redundancies, voting processes, sophistication and processor speeds make the development of other flight maneuvers inevitable.

As I said in my post however, and I agree with you completely Mitch, this does not eradicate error or the possibility of an incident in other operations such as TCAS and GPWS responses. Keeping the very sparse sample rate in mind vs hand-flown approaches, there has not been an autoland accident yet, to my knowledge, but there have certainly been many approach/landing CFIT accidents with a human factors component.

There is an entire discussion to re-awaken regarding hand-flying, the loss of flying skills and so on. Another time!

[Dork]

Seems to be little mention of the A330 that rolled over on it's back with all the experts on board after T/O. All were killed due to the....computer program.

[Guest rattler]

Seems to be little mention of the A330 that rolled over on it's back with all the experts on board after T/O. All were killed due to the....computer program.

Can you provide a goto to the safety investigation for this one or at least the news article re the crash???????

[Don Hudson]

Dork;

The A330 accident was again the result of crew inattention and lack of coordination and planning of the test maneuver. There is an "automation" aspect to the accident, as any Airbus or Boeing (glass) pilot will state and that is the altitude capture mode known as "Alt *" (pronounced "alt-star"). However, this automation issue would not be reached in normal airline flying but only in extreme test conditions where no airline pilot has any business being, jet upset notwithstanding.

In this mode, (whether the 767/777 or the Airbus 320/340 series), the capture attitude of the aircraft is held in place during the level off without regard for angle of attack, attitude, power setting or energy level. The system is designed for capture in the last 250' or so although it can be triggered as much as 1000' or more below the target altitude if the rate of climb is sufficient (3 to 4 thousand fpm...this was the case with the very light accident aircraft).

In the test circumstances involved in the accident, the aircraft was held at 28deg NU, one engine was throttled back and the speed bled very rapidly from 133kts to just below 57kts (if memory serves) during which the pitch attitude reached 33deg NU. Normal "C*" control laws would have taken the aircraft into alpha-prot (full thrust) long before this condition was reached but these protections (not on the Boeing) are not available in Alt* and the aircraft can theoretically be stalled just like any aircraft can be if placed in that condition. We know about this and train for engine failure in the Alt* mode both on the Boeing and the Airbus.

No secrets or mysteries here either although I am not sure the crew of the accident aircraft knew of or understood the Alt* issue at the time.

[J.O.]

Hi Don:

I seem to recall that there was an upgrade to the flight envelope protections software after the A330 accident Toulouse. I checked my manuals but couldn't find any reference. Any thoughts?

Jeff

[Gumbi]

This is a link to a book written by an ex Air France captain about what he claims to be a huge cover-up re: the Habsheim accident.

He has since lost his job, and this pdf version is now the only version of the book available and, unfortunately for most of you, it is in french. However, I will try to find an english version as this is very interesting reading...

http://jacno.com/an01.htm

[Don Hudson]

JO

The software in use on the accident aircraft was described as "experimental" but to what extent I'm unable to say. There was a bulletin some time ago on the Alt* issue after the accident and since I keep everything not nailed down or glued (folks will tell you including my wife), I'll try to find it.