Commercial air transport expansion in the Asia Pacific Region without compromising safety depends largely on exchanging routine operational data and best practices, and adopting integrated systems, say a number of airline, manufacturing and government specialists. In November, they told Flight Safety Foundation’s 64th annual International Air Safety Seminar (IASS) in Singapore, however, that further risk reduction worldwide also requires addressing threats that have been a low priority or only recently have received serious attention.
“The biggest, all-encompassing challenge is rising air travel demand,” said Lui Tuck Yew, minister of transport and second minister for foreign affairs of Singapore. “Based on projections by Airbus, outside of the traditional cores of North America, Western Europe and Japan, air traffic in emerging markets will account for an overwhelming 70 percent of global volumes by 2030. … With more crowded airspace, aerodromes and increasingly complex future operations, the challenge of upholding — let alone advancing — safety levels is a daunting one. … This is where the greatest strains on infrastructure, on resources and on expertise will need to be addressed.”
Singapore, which in 2009 implemented safety management systems (SMSs) among operators and in 2011 implemented a state safety program, is among states committed to accelerating the regional and global adoption of “more focused safety governance,” he said.
Today’s highest safety level ever coincides with tough economic choices and requires conscious resistance to any relaxation of safety efforts, Lui said, adding, “About 0.6 major accidents per million flights [globally] is not bad, but … cold comfort to the close to 800 people who died in accidents last year [and] their surviving loved ones. … The many close calls and ‘could have beens’ clearly leave no room for complacency [see “Letting Go of Precursors” below].”
Letting Go of Precursors
All-too-familiar scenarios during flight simulator training underutilize opportunities for pilots to exercise skills in solving complex, unexpected problems, says Ed Pooley, a retired airline captain and principal of the Air Safety Consultancy. Many loss of control–in flight (LOC-I) accidents and some runway excursions of the past 10 years arguably did not even have recognizable precursors, he said during IASS 2011 in Singapore.
The implication is that pilots may not find it “possible to experience a particular type of challenge often enough — or at all — in the simulator to be familiar with its specifics,” Pooley said. “Modern reliability means … the informed response to the unexpected counts.”
Pyramid and iceberg diagrams in aviation safety education have helped to explain some, but not all, relationships of causal elements preceding unacceptable outcomes, which he defined as major aircraft accidents and situations in which a major accident was narrowly avoided. Some types — especially LOC-I — can be resistant to an oversimplified, precursor-dependent analysis, he said.
One difficulty in de-emphasizing precursors is that they seem obvious even in some LOC-I situations, he noted. These comprise issues like mismanaged response to a single system abnormality, non-awareness of actual autopilot or autothrottle status, activation of the stall protection system, unintended penetration of severe weather, inappropriate aircraft configuration, fuel mismanagement and/or a significant bird strike.
Fairly recent runway excursions, however, have revealed causal “paths,” or sets of circumstances, too numerous or complicated to lead directly to the unacceptable outcome. “They can have as much to do with the degree to which a safety culture and a just culture prevail generally within an operation,” Pooley said, citing as examples the 2010 overrun of a Boeing 737 at Mangalore, India, and another 737 runway overrun at Yogyakarta, Indonesia, in 2007.
Ample cases of other connections also exist between unacceptable outcomes and precursors such as a minor runway excursion, deep landing, excessive airspeed or height over the landing threshold, high-speed rejected takeoff, significant delay in anti-skid unit activation or initial wheel spin-up, deviation from a straight line during takeoff or landing when above normal taxi speed, abnormally slow acceleration during takeoff, tail scrape at rotation, a change from reduced thrust to takeoff/go-around thrust after initial setting of reduced thrust, and/or an abnormal pattern of thrust reverser deployment, he said.
In five of six recent cases cited, “a fatal accident was avoided because of the optimum response of the pilots involved,” Pooley noted, encouraging airlines and pilots to be open to the introduction in flight simulators of “first-time, out-of-the-blue scenarios that require more than just … correct application of the quick reference handbook.” Such a change would have to shift away from only handling a prescribed sequence of engine malfunctions, for example, “to focus more on the … response to unanticipated, typically ‘once-in-a-career’ challenges,” he said. Direct observations or routinely automated analysis of flight simulator data then could generate pilot response–based methods for predicting, tracking and trending the collective performance of pilots, Pooley said.
— WR
Circular Logic
Circling approaches have been an underestimated risk, said Tzvetomir Blajev, coordinator, safety improvement, Eurocontrol. Essentially, they are anachronistic given today’s highly automated, turbine-powered aircraft operating with precise navigation capabilities. As chairman of the FSF European Advisory Committee (EAC), Blajev said that committee research has explored the changes in risk level, technical inconsistencies and operational concerns expressed by 110 respondents to a recent international survey.
“The majority, if not all, of the respondents considered the risk associated with a circling approach to be much higher than for other types of approaches,” he said. “I was quite astonished to see that … there appears to be widespread confusion about the meaning of terms.” The EAC also has found faulty/disconnected expectations among procedure designers, regulators and pilots.
For example, visual maneuvering areas have been explained to pilots but are not well depicted. “The pilot [typically] must have other pieces of knowledge of how the aircraft must be maneuvered on the prescribed track for the protection to be maintained,” Blajev said. Ironically, visual reference points and tracks with turning points defined by navigation systems exist at some airports, and more circling approaches could be flown using automation, offering “a very powerful mitigation,” he added.
Other concerns include inadequate international guidance for air traffic control (ATC); differences in vectors from ATC for visually identifying the airport environment or visually following the preceding aircraft; and ATC requiring the same reported ceiling and visibility as for a visual approach. “There was no common understanding of when the crew can commence descent to touchdown from the minimum descent altitude/height,” Blajev said.
The likelihood that pilots will not be able to see the entire circling area, and could become disoriented, also was deemed a significant risk. “The long-term solution is replacement by performance-based navigation approaches,” he said. Some IASS attendees suggested that the EAC also consider the effects of routine aircraft operation with minimum fuel and poor flight crew compliance with standard operating procedures (SOPs).
Visible TCAS RAs
Another legacy problem — potentially unsafe interactions among traffic-alert and collision avoidance systems (TCAS), short-term conflict alert systems (STCA) and air traffic controllers — is controversial for stimulating technological solutions at the ATC facility level, said Nick McFarlane, managing director, Helios Technologies. The driving reason is that surveillance technology bought recently by air navigation service providers (ANSPs) that have Mode-S radar has selectable, built-in capability to display downlinked TCAS resolution advisories (RAs).
“Many RAs are not reported [because] pilots don’t make the report to a controller,” he said, citing a European study in which only 45 percent of RAs were reported in a correct and timely manner. “The aircrew should always follow the RA. … If the controller is not aware that the RA is under way, he may provide an instruction that is contrary to the RA if he doesn’t have a pilot report. Safety margins will be severely degraded if pilots follow ATC clearances that are contrary to the RA.”
Downlinking TCAS RAs to ATC displays involves risks not yet addressed by international standards. Proponents say the practice increases situational awareness. Regulators in the United States, the United Kingdom, Australia and other countries reject the practice.
“The desired behavior … is that an STCA alert will go off about 30 seconds before the TCAS RA goes off in the cockpit,” McFarlane said. “That should give the controller a chance to intervene and take action before the geometry becomes so bad that the RA occurs. Unfortunately, in certain geometries, the STCA alerts can be [too late].”
TCAS RA downlinks were implemented in Japan in 2003 in the wake of a 2001 near-midair collision, and a series of European studies since the mid-1990s also expanded knowledge of the safety and feasibility of downlinks. “In parallel, [six] European ATC centers have implemented RA downlink,” McFarlane said. The latest initiative, Projects 4.8.3 and 15.4.3 of the Single European Sky Air Traffic Management Research program, recently developed an operational concept. “An RA displayed on the controller’s position [would be] equivalent to having a pilot report,”
McFarlane said. “Until the [TCAS] ‘clear of conflict,’ this means that the controller shall not attempt to modify the aircraft flight path and ceases to be responsible for the separation of the affected aircraft.”
Opponents fear an “inevitable human response” to intervene improperly if a controller believes a pilot is not correctly following the RA. “There are concerns among ANSPs about how controllers should respond if they receive an RA displayed on their screen but they have [no] pilot report to go with it.” Other issues include the form of presentation to ATC, including the TCAS sense, and the signal latency and legal responsibility.
Safe Functional Checks
Functional check flights were the focus of another effort to mitigate a chronic safety problem. IASS panelists and attendees discussed outcomes from the FSF Functional Check Flight Symposium, held in February in Vancouver, Canada (see “Check Flight Checkup”). This type of flight “had been something that the industry had quietly forgotten about or pushed into the background for too long,” said Harry Nelson, experimental test pilot, Airbus, and moderator. “The airlines [in February] made a very strong demand of the manufacturers for more assistance … examples and advice on check schedules.” A follow-on FSF working group continues to issue guidance (see “Golden Rules,” below).
Golden Rules
Participants in the FSF Functional Check Flight Symposium in February 2011 agreed that the following principles, designed for a flight team comprising a flight crew typically augmented by airframe and avionics specialists, mitigate well-known risks:
- Get the mission priorities right (first safety, then test accuracy, then efficiency).
- Decide and brief team members on “break off” points for discontinuing the sequence of steps in each test.
- If test results do not match the team’s expectations, stop the check.
- Take extra care any time the planned sequence of steps is disrupted.
- Identify in advance which check points will involve relatively high risk, including a low-currency flight crew, and practice related procedures in a flight simulator before conducting the functional check flight.
- Do not introduce unplanned tests during flight, and do not be tempted to explore aircraft certification test points.
- Always be failure-minded by assuming and preparing for functional failures as the norm.
The operational mindset must be to assume that failure is likely to occur at any point during the flight until the aircraft testing has proven otherwise, panelists agreed. “Decide and brief breakoff points,” Nelson said. “Do not ad lib … which I call ‘snag chasing.’”
Everyone involved must internalize the potential risks and spare no effort to mitigate them, said Rod Skaar, assistant chief pilot, production, The Boeing Co. “A functional check flight is an active validation. … We [must] know what answer to every test is expected [and] the acceptable parameters for success,” he said. Such flights differ in critical respects from first flights, demonstration flights, acceptance flights, end-of-lease flights and ferry flights.
In selecting team members for these flights, airlines seriously err if they view all captains and first officers as equally qualified, said panelist Craig Hoskins, director of safety at JetBlue Airways, adding, “This [selection] is not manufacturer-specific, it is mission-specific.”
“The team approach is fundamental to safety,” said Al Wongkee, flight operations manager, Bombardier, suggesting flight crew augmentation by at least two airframe/avionics specialists. “You have to be prepared for what can go wrong. … There is a lot more involved than just the skill or training or currency of two pilots.”
The FSF Functional Check Flight Working Group met in July to determine the role and tasking of manufacturers, and will be validating proposals to be forwarded to a separate European Aviation Safety Agency (EASA) maintenance check flight working group, said Claude Lelaie, special adviser to the Airbus president and CEO, and chairman of the European group.
The EASA meetings began in June to draft regulatory language prompted by the November 2008 crash of an A320 near Perpignan, France, and by other requests from European accident investigation bodies, Lelaie said. “By the end of 2011, we should have almost completed all the work, and maybe in the middle of 2012, we will have a full document,” he said.
The preliminary work envisions a regulation applicable to both airplanes and helicopters using the term “maintenance check flights” and defines “complex” aircraft check flights as involving at least two pilots operating a jet or turboprop aircraft with seating for more than 19 passengers and maximum takeoff weight of more than 5.7 tonnes (12,500 lb), according to Lelaie.
A matrix sets out pilot qualifications and any special training required in relation to straightforward, post-maintenance checks of normal functions using line operations SOPs; high-risk tests of a safety-critical system or involving a non-standard flight maneuver with specially developed SOPs; complex vs. non-complex aircraft, etc.