AF 447: Let's Talk About Why – 2: Virtual Reality

How many times have you heard Airbus pilots say, “It's not an airplane, it's a video game.”?

In this blog I will explore the fact and fiction in this statement. My objective is not to praise a great airplane or run down a flawed one, but rather to find how to live with a perfectly good one.

For almost a decade I flew the A320 (and the A319 and A321) as Captain and Training Captain. I came to see her not as a video game but as a person with whom I had to deal. I came to appreciate her many sterling qualities and also her weaknesses. Both informed our work together.

Fundamentals

First, she is an airplane like any other. If you accelerate her to Vr and raise the nose, does she not fly? If you provoke her into an Angle of Attack above 16°, does she not stall? Do not the laws of aerodynamics still hold?

These fundamental things will always apply as we work through her many wonders: Fly-by-Wire, Envelope Protection, and Flight Guidance systems. These wonders are what software people call a “front end” to her conventional aircraft qualities. But the wonders can be a powerful distraction as well as a boon.

Another pilot comment heard (more frequently in the first decade of operation, roughly the 1990's) is “What the #*%# is it doing now?”. The question was being asked because the pilots didn't know where to look for the answer, and also because an airplane maneuvering on her own was a novelty. When things happen that we don't understand, we human beings tend to see them as acts of God. We substitute reverence for understanding. A320 software – partly because it is so good, most of the time – has been an object of such reverence.

But just as we are not perfect, neither is this marvellous software. As the history of the airplane in service demonstrates, it is only as good as its interface with the pilots.

The Crashes

The first three crashes – Mulhouse, Bangalore, and Strasbourg – are illustrative. In the first two the engines were at idle and the crew were unaware that the power was being commanded to idle by the Auto-thrust. This information is clearly presented at the left end of the Flight Mode Annunciator or FMA, which appears in a band across the top of the Primary Flight Display, or PFD. The Auto-thrust Mode is what the Auto-thrust thinks it is doing. The only acceptable modes for approach are Speed and Off. At Mulhouse and Bangalore the Auto-thrust Mode was reading Idle.

What was not clearly understood at the time of these crashes was how to change the Auto-thrust mode from Idle to Speed, which is to turn off both Flight Directors. Further, the annunciation of the Flight Director modes on the FMA was not as communicative as it is today. At Bangalore one pilot turned off his Flight Director and the other did not. As a result the Auto-thrust mode remained in Idle. Today in that situation the FMA would show 1FD- , meaning that FD 1 is operating on the left side and that FD2, on the right side, is off. (With both FD’s on the FMA would show 1FD2). Both pilots can see what is going on. This improvement was implemented after analysis of these crashes.

The Strasbourg crash resulted in another improvement in the airplane-pilot interface. The flight was performing a non-precision approach which specified a Flight Path Angle. The crew selected -3.3 into the Flight Control Unit but failed to switch it to Track/Flight Path Angle mode. The FCU remained in Heading/Vertical Speed mode and interpreted the command as -3300 feet per minute. (There is a big difference between the two. At normal approach speeds a Flight Path Angle of -3.3 would be 800-900 fpm.) The presentation has since been changed in two important ways: first, to change the HDG/VS mode on the FCU to show 3300 while leaving the TRK/FPA mode as 3.3. Second, the commanded rates are now repeated on the Flight Mode Annunciator.

In these accidents the crew were not aware of what the software was doing. In the following example, the loss of an A330 in flight test at Toulouse in 1994, the crew were not aware of a crucial software limitation.

In most autopilots there is an altitude capture mode. In Airbus aircraft this is known as ALT*, or “Alt Star.” The computer uses the selected altitude and the vertical speed to calculate how far ahead to begin the capture maneuver, which is an asymptotic curve. Higher vertical speeds require that the maneuver be begun earlier if “G” forces are to remain within limits. Crucially, because the software calculates the curve based vertical speed, it de facto assumes that the thrust available at the start of the capture maneuver will remain available. Thus the loss of an engine while in ALT* is a first-rate emergency requiring flight crew intervention within a few seconds.

Man/Machine Communication

I present these examples not as an exhaustive course on Airbus software, but as an illustration of how extra intelligence brings with it extra complication. First, the communication between man and machine is of paramount importance. The interface cannot be too well-designed and the pilot cannot take too much care in maintaining effective two-way communication. This is why at my airline any change in the FMA was verbalized by the Pilot Flying, in effect giving voice to the machine and keeping the three pilots (two human, one cybernetic) on the same page.

Second, each time a task is assigned to automation the process must remain transparent to the pilot. He must understand in general terms what the computers are doing, and even more importantly what they are not doing. Should the automation for any reason drop the task it must be immediately obvious to the pilot and he must have steps rehearsed which let him take control and do the task himself.

Engine failure in ALT* is a good example. With today's improved FCU interface the pilot can push the Vertical Speed knob, which simultaneously selects V/S as the vertical mode and sets the target V/S to zero. In less than a second he has intervened, taken control, and given himself time.

If altitude cannot be maintained on the remaining engine(s) he can twist the knob to set a modest descent. Then the drill calls for getting a clearance to a lower altitude, turning off the Auto-thrust and setting Maximum Continuous Thrust on the good engine(s), selecting the cleared altitude and Pulling the Altitude knob to select Open Descent. Speed and thrust can then be adjusted to suit the situation.

The above procedure is not difficult, is easily performed in the time available before losing control, and requires no particular skill. What it does require of the pilot is that he view the airplane (and her wonders of automation) as an equal: a skilled pilot who nevertheless can have a bad day, make a mistake, or be simply unavailable.

Anthropomorphism

I know I am not alone in assigning a personality to the Airbus. I have said elsewhere that I came to regard her as a friend, or more than a friend. I (ahem) even loved her. Perhaps I still do and that why I am writing this.

Wait, though. I know full well she is aluminum, carbon fibre, and Intel and Motorola Assembler. I also know she is a damn good pilot and that she can be trusted like a close friend. But – and this is the important part – she is my equal. I can fly too, but I sometimes make mistakes, have a bad day, or fail to communicate effectively. Ditto my software friend. I can be blinded by pride. Ditto my software friend. She is French and she has pride in her DNA.

In the Simulator we practice Pilot Incapacitation, recognizing that to err is human. What we have a harder time with is Automation Incapacitation. This is perhaps a symptom of our reverence for something that is beyond our understanding, for our unrecognized assumption that technology is perfect, or at least better than we are. This unrecognized and unwarranted assumption can be fatal.

It is much better to appreciate her as an equal and deal with her as a whole person, warts and all.

Feedback and Feel

Let's dig a step further. I believe what pilots are talking about, when they say Airbus aircraft are video games, is the lack of feedback and feel in the controls. The throttles, for example, do not move when the Auto-thrust is active. The pilot sees only Speed on the FMA and the engine indications on the ECAM. To take control smoothly (for example to do a manual approach) he must pull the thrust levers back until the little green donuts match the current thrust, and click the off button on the lever. The FMA says Off and he's on his own. But the approach is still a bit of a parlor trick because there is no feel in the sidestick. When a conventional aircraft gets slow increasing back pressure is necessary to keep the nose from dropping. Not so in an Airbus. Instead, the Autotrim will move the stabilizer nose-up to maintain 1G flight. The pilot's eye has to dart to the airspeed indicator to get what he might have sensed in the stick or control column. All of this contributes to the “video game” feel.

Perhaps a direct Angle of Attack readout in a Heads Up Display would compensate for the lack of feel. But this is ignoring an essential fact: the Airbus is a conventional airframe, with positive aerodynamic longitudinal stability. It is not like some fighter aircraft with neutral or negative longitudinal stability, where the aircraft is uncontrollable without fly-by-wire. The stability is there, but it is shielded from the pilot.

It must be pointed out that the Airbus is a beautiful airplane and a joy to fly and that it has hundreds of wonderful design features I would not like to see disappear. Just one example is “the hook” (the display on the airspeed tape of Vls (lowest selectable speed)) and its relationship to “the bug” (Vapp, or final approach speed). The bug speed is calculated by the FMCG (Flight Management and Guidance Computer) based on the Gross Weight (or Zero Fuel Weight) entered by the pilots. The hook is calculated from first principles by comparing Angle of Attack with dynamic pressure (airspeed). In a normal approach these are 0.5 cm (1/4 inch) apart. This is one of those comfort crosschecks for pilots. If the bug and the hook are too close together, the weight entered in the FMCD is likely wrong, and the calculated Vapp is too slow.

But even here an intelligence has been interposed between the pilot and his aircraft. Why not also display the Angle of Attack directly, and always fly the approach at the same angle of attack regardless of weight? (See my blog AF 447 – Let's Talk about Why – 1: Angle of Attack). It is this interposition of intelligence that contributes to what I see as the problem: the illusion of Virtual Reality.

Virtual Reality

Flying an airplane, any airplane, is a very real job. The airplane can be a bear or sweet to fly, it can be automated or not, it can “land itself.” But the bottom line of the captain's job does not change, and that is to be the arbiter of last resort: the man or woman who imagines, constructs, and sees the picture that determines the outcome. It is his or her job to maintain that picture. In the trade we call it situational awareness. If something goes wrong and that picture is wrong people die. And if the captain believes the glass display before him is superior to his own mental image, then he will be more likely to abdicate his responsibility to maintain situational awareness.

Today's glass cockpit is seductive. A wealth of information sits before the pilot: some of it is raw data; often it has been extensively processed into a colourful and sometimes beautiful picture. Like a video game, this is virtual reality. Software is doing the imagining for the pilot.

It can be argued that the picture in the pilot's head is also virtual reality, merely a representation of the external world. But this argument does not acknowledge the survival instinct that guides the pilot's doubt and questioning, his constant checking for consistency, his testing of the obvious.

Airbus aircraft are beautiful and a joy to fly. But they are not perfect. Like all of us, they have a fatal flaw. The Ancient Greeks knew this hamartia as an essential component of human character. Bernard Ziegler, the brilliant designer of the Airbus software, has been quoted as saying he wanted to make the airplane pilot-proof. Consequentially, as I have shown, there are areas where the pilots have been shielded from useful, even essential, information. The Airbus pilot must work hard to ensure he is not entirely removed from the loop.

Reality for an airline passenger is not virtual. This game cannot be started over. The next time you hear someone say, this airplane lands itself, will you be comforted? Or will you be hoping that the pilots are not just along for the ride?