Interview Would Air France F447 have happened with Boeing
On 1 June 2009, Air France flight 447 from Rio de Janeiro (Brazil) to Paris (France) suddenly entered an aerodynamic stall and crashed into the Atlantic Ocean, killing all 228 passengers and crew onboard. Although the initial reports on the possible causes of the disaster evolved around the malfunction of the plane’s pitot tubes, the investigation concluded that the main reason for the tragedy was pilot’s error.
It has often been debated whether the accident of Flight AF447 from Rio to Paris was partly a consequence of the Airbus flight controls. No linkage between sidesticks, lack of feedback, a deceptive Flight Director, auto trim and a flawed stall alarm. Two Air France Captains share their opinions. One of them is Gérard Arnoux, now retired, who for many years flew Airbus 320 for Air France and is now a technical advisor in the criminal court case. The other captain, who prefers to remain anonymous, flew Airbus 320 aircraft for many years and is now currently commanding a B777.
The Boeing 777 is known as the competitor of the A330 and is also a fly-by-wire aircraft, so what is the difference?
Air France B777 Captain: On the B777 we have fly-by-wire flight controls, but Boeing philosophy is different from Airbus. On a Boeing you see the input of the other pilot on the flight controls, as you see the autothrottle inputs at a glance. On Airbus you must search for information. For the throttles you have to ‘read’ engines N1 (rotation speed in %) like you would read a digital clock.
Having a yoke with physical feedback is quite different than having a joystick?
Air France B777 Captain: A Boeing-777 will always give you a physical feedback of your pilot action and physical evidence when your pilot actions are wrong. On Airbus the G-load piloting law erases a lot of that physical feeling. The G-load piloting law is why the Airbus is so easy to pilot when everything goes right, because the aircraft is always in trim and you realize it is like you would pilot through an autopilot: just look at flight director and make corrections through small inputs and that is enough. I have flown the A320 family and it is very easy to fly once you have understood that your inputs, with your wrist on the joystick, must be very accurate and minimal. The less you touch, the better it works. When you are very gentle and accurate on the stick, it is a pleasure to see it flies alone. You cannot do that on Boeing 777.
Until something goes wrong. Like unreliable speed readings, for instance?
Air France B777 Captain: You must know that training on speed failure in a simulator was very rare and during my 25 years practice on French airlines, before 2009 I must have been trained maximum three times in a simulator for this situation, while we were having at least two engine failures to deal with at every simulator session.
I do not know why speed failure was not trained. This kind of failure can be very stressing when at the same time you have overspeed warning and low speed warning, even stick shaker… The basic principle is to do nothing, just keep your thrust and attitude parameters of the aircraft. In the early years of the A320 we still had an incidence-meter (angle of attack meter, not installed on the A330) but still it is not easy and to rely on instruments, when real and false alarms are raised together.
On Flight AF447 the pilots should just have kept on flying level flight, which they did not. Erroneous readings on their instruments, like the faulty Flight Director, which gave the order to pitch up?
Air France B-777 Captain: After the Auto Pilot (AP) disconnected, the Flight Director (FD) reappeared in basic mode, which is really not a good thing because the basic mode is just a copy of what you were doing when you connected the FD. They were climbing then, so the FD connected in Vertical Speed mode and told them to climb!
Also, it seems that before the AP and AT shut off, the crew had just reduced speed to ‘turbulence speed’, a second before the autothrottle disconnected, so the thrust was less than the thrust needed to level flight... and the co-pilot pulled the joystick not having the right thrust.
Another important factor to understand the accident is how Airbus auto trim works. As the co-pilot pulled back on the stick, the pitch trim helped him going backward to trim the aircraft because the computer acts as if Bonin* wanted the speed as low as possible. The pilots were not aware of the fact that the pitch trim was trimming all the way back, because on an Airbus you do not have an artificial feeling, no stick shakers. They should have read the pitch trim indicator, which is something you forget to do on an Airbus, because it is always in trim! They also should have had a visual warning telling them to use the pitch trim manually.
The design of Airbus side-sticks and the fact that they are hidden for the other pilot, has been much criticised, even by an Airbus-man as Captain Sullenberger. Why is this still like that?
Gérard Arnoux: It is strange, but it is part of Airbus design philosophy and they will not change that, even after AF447. I have read that recent aircraft by Bombardier and Embraer have active side-sticks. On Airbus there is no feedback and no linkage between the joysticks. Airbus does not do that. It is something dogmatic. There has also been a lot of criticism on the dangerous logic of the auto trimmable THS (Trimmable Horizontal Stabiliser), even when the plane is in Alternate Law. It induces the pilots to leave the protective flight envelope.
The pilots did not feel that they were too pitched up, because they had no feedback on the joystick.
Air France B-777 Captain: On a Boeing you could never have done such thing (pulling on the flight control too much), because the pitch trim does not trim anymore when you approach stall speed, leaving flight controls harder and harder, as long as you are in Normal Mode (‘Normal Law’ on Airbus). On a Boeing, in Secondary Mode there is no stall protection either, but even in this law, a pilot trims with physical feedback. That is why, on a Boeing, you cannot stall without being physically aware of what is going on. It looks much safer to me. On AF 447, the only way to recover from the stall would have been to push on the stick for more than 30 seconds to allow the trim to set itself at the right setting to help the aircraft to recover! This is not intuitive at all.
Have Flight Director flaws been addressed since and fixed on the current A330’s that are still flying around?
Gérard Arnoux: Flight Director which shut off and reappeared, displaying wrong information, has been fixed. There have been four Airworthiness directives by EASA (European Aviation Safety Agency) from 2010 to 2012 that addressed this problem and now Flight Director does not work anymore after unreliable airspeed situation.
What about the stall warning which on the Airbus is inoperative under 60 knots? You called it ‘counterintuitive’ in your legal report?
Gérard Arnoux: I found it strange that legal experts did not mention it in their reports, because that is actually illegal and as far as I know, the stall alarms on Airbus still do not work under 60 knots, this has not changed. It is clear that Airbus completely underestimated this problem. Before 1 June 2009, the pilot-chief of training and flight at Airbus, Pierre Baud, stated in the in-house magazine FAST, that anti-stall training on Airbus planes was not necessary.
So why are there as many accidents on Boeing aircraft as on Airbus?
Air France B-777 Captain: Today pilots are assisted by so many systems that they do not need to be so accurate, they do not need to be performing. We have been trained and recommended to fly on AP as much as possible, which is not a problem for a senior pilot like me. It can be a great problem for a young pilot that has become a ‘computer pilot’ as if it was a game. Many airlines do not allow their pilots to fly hands-on above 10.000 feet and a lot of airlines do not encourage visual approach and that goes not only for Airbus, but also for Boeing pilots.
In the B777 Emirates accident in Dubai (2014), the pilots had an instrument telling them they were too fast, that is why they pulled up, but in a bad way because they forgot to push the throttles. Old pilots always push their throttles when pulling up. They probably could have stopped the aircraft before the end of the runway, which does not mean pulling up was a bad option.
In the San Francisco B777 crash (2013), four experienced pilots crashed in fine weather because they were relying on their autothrottle. As the majority of pilots now, they never use manual throttle because it is not encouraged, so they feel uncomfortable to disconnect. These Pilots were supposed to obey systems that have been implemented for safety purposes. They are becoming kind of Pavlov’ pilots.
Automation is becoming a risk factor.
Air France B777 Captain: I had a very interesting B-777 simulator session last week with the Traffic Collision Avoidance System (TCAS). I was on a collision course with another aircraft I was seeing. There was a TCAS-alert and I was waiting for a TCAS-command, because the aircraft’s computers ‘talk with each other’. So, I was awaiting this order to disconnect the Autopilot and Autothrottle and fly the avoidance order, but the command never came, due to a bug. At the very last moment I decided to disconnect and did a brutal maneuver to avoid the colliding aircraft.
I realized that I expected too much from computer systems and it was a good lesson of what happens when the computer fails.
So, the conclusion is that there should be limits on automation?
Air France B777 Captain: There are two paths the aviation industry can take from here: One path would be more computers, better auto throttles, better autopilots and more systems to detect whatever mistakes pilots make. Another would be to train pilots to fly manually and learn to avoid errors. In the first case, you do not need any more pilots and there always will be crashes. The computers will only prevent crashes imagined by engineers. A computer will never decide to do what Sully did with his A320 on the Hudson.
People talk about pilot errors, but never about pilot solutions, which save lives by not following the checklist, like Captain Champion de Crespigny who flew Qantas Airbus 380 with 469 people to safety in 2010, after an uncontained engine failure, fuel tank leak, hydraulic failure, etc.
Computers in aircraft are a good thing, as long as they serve pilots and not the opposite. Maybe I am wrong, but I feel safer in a Boeing, which is like a big solid truck with Apple computers you can disconnect, than in an Airbus, which is like a Space Shuttle with PC computers that have the last word. With Boeing, average or tired pilots will do the job, with Airbus you need the best, it is not optional.
Tom Dieusaert is a Belgian journalist and author of ‘Computer Crashes: when airplane systems fail’ based on the AF447 accident.