Airbus has learned a lot about the "glass cockpit", but there is much more to be gleaned.
David Learmount/LONDON
In little more than a decade, a breathtaking change has taken place in airliner-cockpit design, and in flight management and control technology, but some pilots believe that there is still much to be learned from they perceive as "mistakes" which have been made.
Pilots praise most of what has been done and hardly any would wish to abandon today's avionics for "traditional" cockpit instrumentation. They sometimes criticise modern flight decks, however, and the automatic functions of digital flight-management systems (FMS) on the grounds that they can confuse aircrews despite being designed to make their jobs simpler. FMS "mode-confusion" has caused pilots to make mistakes leading to serious incidents and even fatal accidents.
The US Federal Aviation Administration is now setting up a commission to review the effectiveness of the modern airliner cockpit as a man/machine interface, and to examine the results of increased aircraft automation in human-factor and airline flight-safety terms (Flight International, 4-10 January, P9). The review starts early this year, as Boeing's first fly-by-wire (FBW) airliner, the 777, is prepared for entry into revenue service.
Oliver Will of the German pilots' union, Vereinigung Cockpit, who has flown the world's first digital FBW airliner, the Airbus Industrie A320, for Lufthansa, says: "It's a beautiful aeroplane. We love it. It's comfortable, it's safe - I never saw an aircraft going through wind-shear like an Airbus - but why build in so many traps?"
The "traps" to which Will refers were highlighted in the September 1993 A320 accident at Warsaw, Poland, in which the aircraft landed in a rainstorm with a high indicated airspeed and a tailwind, aquaplaned and overran the runway.
That cocktail of unfriendly conditions could go some way to explain the overrun, but nevertheless, according to the report, the incident probably would not have happened, had the A320's protection systems not delayed deployment of the lift dumpers and reverse thrust, even though the pilot selected them. The protection systems were designed to prevent deployment of lift-dumping spoilers and reverse thrust until the aircraft had definitely touched down.
Vereinigung Cockpit believes that the A320's "extremely complex spoiler logic" was one factor in a long causal chain of events, most of which, Will acknowledges, were not aircraft-related. He adds: "It is quite normal with a new aircraft to have a learning process...we would never point our finger toward Airbus and claim that this is unusual." Airbus should, nevertheless, learn from its "mistakes", according to Will.
DEVELOPMENT INFLUENCES
Before the dramatic air-transport avionics changes in all the major manufacturers' types between 1981 and 1991, there had been no conceptual change in aircraft man/machine-interface design since the 1940s and, arguably, since well before that. Improvement in pre-1980s cockpits consisted of the gradual application of ergonomics - which is important, but not fundamental - and increasing sophistication in electro-mechanical (E-M) instruments.
Today, traditional aircrew operational thinking, and the established training system, is challenged during a pilot's first conversion to a modern cockpit, particularly if the type has a digital fly-by-wire (DFBW) control system. Formerly, pilots faced no conceptual change in flying or flight-management technique at any stage between primary trainer and airliner cockpit.
This situation changed subtly, but certainly, with the introduction of digital electronics to flight control and flight management. Independent human-factors consultant Jean-Jacques Speyer talks of the need for "cultural adaptation" to what he calls "the digital future".
The Airbus A310, which entered service in 1983 was one of the first of the new-generation "glass-cockpit" airliners. The aircraft had a conventional control system (not FBW), but with the flaps, slats and spoilers electrically signaled. Speyer had been consulted on the A310's cockpit development. He says: "Basic human factors issues that have a direct impact on the efficiency of flight deck operations were always kept in mind as guidelines." His aims were to minimise physical and mental workload "both routinely and in abnormal conditions" and to maximise the information-processing and decision-making capability of the crew.
Since then, however, human-factors specialists have started to question whether reducing workload below a certain point is a good thing. Speyer, in a later study looking at "cognition and vigilance in highly automated aeroplanes" (Boeing 767s and Airbus A340s), re-assesses the criteria for automation. Among the desirable criteria he lists are:
automation of tasks for which humans are ill-suited;
enablement of easy transfer between automatic and manual flight;
provision of easy override of any automatic navigation selection.
Jean-Pierre Daniel, manager of prospective systems at Aerospatiale, the Airbus partner responsible for flight deck engineering and assembly, says: "So far, we have [increased mode availability] because the customers have demanded it. Workload reduction was the motive."
On the face of it, all the aims of a contemporary cockpit designer have been achieved in the modern flight deck. The quantity and accuracy of in-cockpit information available to pilots has increased, while airline-maintenance departments say that the flight deck "instruments" - CRT displays with their integrated, multiplexed, back-up systems - are more reliable than their E-M forebears.
Pilots have greater aircraft-systems monitoring capacity, and the potential for greater situational awareness, using the trend and vector information on CRT primary flight displays and full-plan navigation displays. This provides the material for better decision making.
According to established aircrew folklore, however, "...what's it doing now?" has become the most frequent pilot-to-pilot remark since the arrival of the so-called glass cockpit. Increased flight-mode choice from digital FMS and the increased automation intended to reduce crew workload and to improve safety, have turned out to have their downside.
Airbus human-factors group manager Eddie Racca says that information being gathered systematically from instructors at Airbus Training indicates that "...pilots don't realise the core importance of the flight-mode annunciator".
PILOTS AND AIRBUS
Vereinigung Cockpit members have a particularly wide experience of Airbus aircraft, Lufthansa having been a launch customer for the A300, A310, A320, A321 and A340. The union would like to see Airbus address several specific issues, but none of the 13 points in the pilot union's central "wish list" of operational improvements applies exclusively to Airbus aircraft.
Most of its recommendations apply to all types. It says, for example, that transport aircraft with "glass cockpits" should be fitted with cameras to record what the CRT displays show the pilots. The union contends that the flight-data recorder (FDR), may well store what the sensor systems record, but adds, that the FDR provides no evidence of what the pilots see.
Will highlights a general demand which his union believes Airbus must follow: it is that aircraft operating manuals and other instructional documentation - including amendments - must be better designed, preferably in consultation with line pilots.
Vereinigung Cockpit accuses Airbus of not giving pilots enough information in manuals, alleging that they lack detail and depth and have sometimes been misleading or wrong. For example, says Will, the detail about automatic spoiler-logic for landing - designed to prevent lift-dumping while airborne - was incomplete and it took a long time to ascertain the answer which was needed to understand the Warsaw incident.
Airbus points out that today, given the same set of circumstances, the accident would not happen, because of completed modifications.
COMMUNICATIONS WARNING
Communication between the airlines and Airbus, according to Will, "...must become much better both ways". For example, he says, Lufthansa had cancelled Airbus' recommended procedure for checking the electronic centralised aircraft-monitor screen for spoiler deployment after touchdown, says Will. He explains: "Lufthansa had said that since it's automatic, you don't need to - but they didn't tell Airbus, or perhaps they did and Airbus didn't stop them." He emphasises: "We're pointing at the operators and the communications system - and not only Airbus, but Boeing also."
NAGOYA AND CERTIFICATION
One demand on the German union's action list directly evokes the April 1994 China Airlines (CAL) A300-600 accident at Nagoya, Japan, in which 264 people died. The demand is that aircraft controls, which do not react "logically" to pilot action should be redesigned or their operation made unmistakably clear to pilots.
The control behaviour which the union highlights concerns the reaction of the A300-600/A310 autopilot to pilot attempts to override it by using manual pitch force on the control column (as opposed to using the autopilot disengage switch). Although autopilot-disconnect is designed normally to occur when manual pitch-force is applied, it was disabled specifically in go-around (G-A) and automatic-landing modes to comply with certification requirements, says Airbus chief engineer Bernard Ziegler.
In G-A or automatic-landing mode with autopilot engaged, for example, pushing or pulling on the control column will operate the elevator in the normal way. The autopilot, however, was programmed to counteract that elevator input by motoring the horizontal stabilisers, (which normally carry out the manual pitch-trim and the autopilot pitch-control functions) in the opposite direction.
At Nagoya, the CAL co-pilot, flying a manual instrument-landing system approach with auto-throttle engaged, appears to have inadvertently selected G-A mode and not noticed it, despite information on the primary flight display. The resultant power-increase, quickly overridden manually, had put the aircraft high on the glide-slope. Still not realising that the aircraft was in G-A mode, the pilot then selected "autopilot-engage" and immediately tried to counteract the resulting nose-up pitch by pushing nose-down on the control column.
The autopilot reacted as programmed by motoring the stabilisers nose-up to counteract the elevator input. The resulting reduced manual pitch-down authority available when the confused pilot finally disengaged the autopilot was a major factor in the sequence of events leading to the crash.
This is a touchy topic for Airbus, not only because of the tragedy itself, says Ziegler, but because the critical control-mode anomalies were the result of aircraft-certification specifications against which he had argued. Pilot use of the control column in pitch normally disconnects an Airbus autopilot, but the European Joint Aviation Authorities (JAA) had argued that this should not be possible in automatic-landing mode, to prevent inadvertent autopilot disconnection at a critical phase.
Because the G-A mode is fundamental to safe late-abandonment of a Category IIIb automatic-landing approach, the same rule was also to apply in G-A mode. The FAA had subsequently certificated the aircraft in the USA with the same mode criteria.
Late in 1993, after two non-fatal A310 incidents where inadvertently applied G-A or Level-Change mode had produced related aircraft behaviour with similar pilot reaction, the certification authorities relented and reduced the G-A/automatic-landing-mode inadvertent-disconnection protection requirement to below 400ft (120m) only.
SOFTWARE CHANGES
In December 1993, Airbus had issued a service bulletin (SB), which the French civil aviation authority (DGAC) immediately classified as a mandatory airworthiness directive (AD) requiring French operators to incorporate the autopilot-software modifications within two years. Airbus offered the software modifications to all A300-600 and A310 operators immediately.
At Nagoya, all the problems developed above 400ft, so the modification would have prevented the accident. Unfortunately, CAL had not incorporated the new software.
Another crucial factor, says Ziegler, is that on the original A300s, while the pitch trim (and therefore the horizontal stabiliser) is moving, there is a synthetic "whoop-whoop" sound as the pitch-trim wheel rotates. This is particularly important in view of the Nagoya accident and the Vereinigung Cockpit demand that aircraft-control behaviour should be clear to the pilots. The UK Civil Aviation Authority, a leading member of the JAA, had ordered suppression of the pitch-trim-operation warning sound in the A300-600 and A310, reveals Ziegler.
"OVER-SENSITIVE" PROTECTION
A related, non-fatal mode-confusion incident occurred to a TAROM Romanian Airlines A310 on 24 September 1994, on the approach to runway 26 at Paris Orly Airport. The aircraft had its gear down, flaps/slats at 15°, manual control selected (autopilot disengaged), but auto-throttle engaged and flight director functioning. In this condition, notes the French Bureau Enquetes Accidents (BEA) interim incident report, the flight director was in V/S [vertical speed] mode, which, in the event of over-speed, provides automatic protection by changing to Level Change mode.
Descending through 1,700ft at 197kt (370km/h), the crew selected flap/slats to 20°. The speed was 2kt above the limit for the new flap setting, so the flight-director mode changed to Level Change, but "...the crew did not identify the mode-change", according to the report. The subsequent dramatic reaction of the aircraft and crew have led to industry suggestions that Airbus over-protects its aircraft and crews with automatic systems which, if misunderstood, can produce danger where the objective was safety.
Ziegler points out, however, that the FBW Airbuses do not switch mode on over-speed; they reduce descent rate.
Because 4,000ft was set on the TAROM A310's flight-director control panel, when the mode changed to Level Change the auto-throttle advanced the power levers, causing a nose-up pitch moment. The pilot retarded the power levers without disengaging the auto-throttle, but why the aircraft acted as it subsequently did has yet to be answered. The key will be what happened to the pitch-trim believes the BEA, which says that FDR readouts did not indicate any fault with it or with any other system.
The aircraft climbed steeply to 4,000ft, stalled and dived. The crew regained control at 1,000ft and landed normally after a circuit, according to the BEA.
The Orly incident spurred the FAA, on 18 October 1994, to issue its own AD echoing the DGAC's instruction, but giving an unusually short compliance period of 60 days. The US National Transportation Safety Board wants manual-force override of the autopilot down to ground level in all modes, but the FAA is sticking with the below-400ft rule.
Working under what Airbus calls the "continuous product-improvement plan", Ziegler says: "We asked pilots of airlines to draw up a list of what they wanted changed - in priority order." Airbus developed a package of improvement modifications but, he says, "...very few bought the modifications package".
Overall, Ziegler says that his personal belief is that it may be appropriate to reduce the number of flight-mode choices to reduce the possibility of mode confusion. The company's vice-president for training and flight operations, Pierre Baud, says that he agrees. Baud notes that Northwest Airlines prohibits the use of flight path-angle (FPA), requiring its crews to use V/S mode for descent only, but Dragonair finds the FPA mode useful for Hong Kong approaches.
Ziegler says: "Pilots use only about 20% of the capacity of their FMS, so I would personally make it much more simple, but the market and the pilots want it all. That's an area I feel most strongly about, but the customers don't listen."
In the case of the January 1992 Air Inter A320 controlled-flight-into-terrain accident, the crews appeared to believe that they had selected a 3° FPA descent, but had, in fact, selected 3,000ft/min (15.24m/s) V/S, according to the final report. The flight-control panel-selector design has been changed to make incorrect selection more improbable, but Ziegler dismisses selector error as the key. The Air Inter pilots, he says, "...had totally focused on the lateral [navigation] at the expense of the vertical". Warning systems can only be a part of the answer, Ziegler believes, because there is a limit to what warning systems can do when human beings become too focused.
THE FUTURE
Having brought DFBW to commercial air transport, Airbus is studying using more of its potential as well as improvement and correction. There are limits. Aerospatiale's Jean-Pierre Daniel says: "The solutions have to be applied to the cockpits that we have...we have to consider compatibility and crew cross-qualification."
The possibilities of digital control seem to be limitless. Daniel and Ziegler name several, which would suggest a further reduction in the pilot's role, but they do not imply that the measures will be adopted. Apart from delivering the reminder that it is the market and its perceptions of cost-benefits which controls the adoption of change, Daniel says: "Pilots have to be able to act in order to maintain awareness. The question is what should they do, and how much? Today, the workload is certainly not too much. Perhaps we have to increase it."
Having said that, Daniel asks why, with an integrated full-authority digital engine control (FADEC) system to take care of asymmetry, should there be a throttle for each engine. Why not one to control aircraft power as a whole? Daniel makes it clear that producing an integrated FADEC would be no major challenge.
Ziegler, clearly motivated by the A330 flight-test accident on 30 June 1994, floats the possibility of digital control being extended to protect Vmca (the speed below which stall in yaw becomes dangerous). He says: "The potential exists to control Beta [angle of yaw or drift] as we already control Alpha [angle of attack]. But that's not possible yet because the parameters are too variable beyond Vmca."
Meanwhile, Airbus is gaining operational experience every day with DFBW, using a digital system, which is not designed to make the pilot feel as if he is flying a traditional aeroplane. Boeing is about to enter the operational ring with its 777, an aircraft which artificially reproduces for the pilots the characteristics of a traditionally controlled aeroplane, although it is flown using digital-control laws.
Is Boeing right in its premise that reality must be disguised to achieve the best possible man-machine interface? Or, there being no perfect solution, do both companies' approaches have an equal chance of being effective? As the world progresses into a digital future, only time will tell.
Source: Flight International
