Concerted action is needed to address vulnerabilities in average pilots’ capabilities to safely monitor their flight path, conduct a missed approach, avoid stalls and maintain control of highly automated commercial jets, aviation specialists say. Several of 33 speakers at the Flight Safety Foundation International Air Safety Seminar, Nov. 2–5 in Milan, Italy, spoke with uncharacteristic urgency about these re-emerging risks — long thought to have been mitigated.
“Major improvements have been made in the design, training and operational use of onboard systems for flight path management … and their associated flight crew interfaces,” said Kathy Abbott, chief scientific and technical adviser for flight deck human factors at the U.S. Federal Aviation Administration (FAA). “Incident and accident reports suggest that flight crews continue to have problems interfacing with these systems and have difficulty using these flight path management systems.”
Robust Go-Arounds
Since the late 1990s, advocacy of timely go-around decisions and correct go-around maneuvers has been a core element of a global campaign to further reduce risk during the approach and landing phases of flight. Possible explanations of why a few airline flight crews recently have failed to take these actions or to safely complete landings were offered by Bertrand de Courville, an Airbus A330 and A340 captain for Air France and co-chairman of the European Commercial Aviation Safety Team.
He presented insights, based on reviews of research reports and safety investigations, to the Flight Safety Foundation International Air Safety Seminar. “Formal criteria and informal, undocumented criteria [exist] for deciding to go around but, in the end, any pilot should discontinue the approach or landing whenever he or she perceives that safety is going to be compromised,” de Courville said. “We have [from 2005 industry data] an average of one to two go-arounds per 1,000 flights. This means, for short-range pilots, less than one go-around per year, and for long-range pilots, about one go-around in five to 10 years. … Compared with [this small] number of go-arounds flown, the ratio of incidents during go-arounds is much too high — but we can make it safer.”
An International Air Transport Association safety report for 2005 also showed that 34 percent of go-around decisions were related to air traffic control (ATC) issues, 22 percent were related to meteorological factors and 16 percent were related to unstabilized or destabilized approaches, he said.
“Every year, 30 percent of fatal accidents are related to a situation where some criteria for go-arounds were present,” de Courville said. “This does not mean that the pilots in each event were aware of those criteria, [rather] that afterwards, during the investigation, it was possible to identify that those criteria could have been present and could have been part of the knowledge of the crew. … A go-around could have been decided if the crew had been aware enough of the situation they [encountered] — usually at a very low height above ground.”
Predominant meteorological factors included braking issues and rapidly changing visibility and wind.
“Despite relevant conclusions, well thought-out recommendations and findings have not made much of a dent in the numbers of those accidents,” de Courville said. “Something has to be done using [a strategic] perspective: Seeing the go-around as a defense. … We have to understand the weaknesses and develop solutions to make go-arounds more robust.”
The Transportation Safety Board of Canada has suggested that cutting the accident rate 25 percent in commercial air transport would be possible if flight crews performed much better in both the go-around decision and the maneuver. “No other single defense could have this impact,” de Courville said.
Factors observed affecting the initial stage of go-arounds include effective flight crew teamwork, communication and empowerment; the quality and timeliness of weather-related runway condition information; and the flight crew’s ability to quickly assess the situation to identify risks and decide to discontinue the approach.
“In the final phase of the approach, the time pressures are much higher, the workload is high, and there is little or no [time] for communication between pilots other than standard callouts,” he said. “The decision to go around must be immediate, and this decision will depend on very precise synchronization of human performance and the capacity to react quickly.”
Effects of the visibility actually encountered often must be acknowledged as the most critical threat. “In some weather environments, such as heavy rain showers or fog patches, the crew may continue an approach without being aware that the horizontal visibility they will face at the end of the approach — or beyond the runway threshold — will be less than the minimum required,” de Courville said. “When this happens close to the ground, below decision altitude or minimum descent altitude, [even] with the approach and runway lights in sight, pilots may think they still have sufficient cues to continue the landing. In fact, the horizontal visibility may have reduced to a few hundred meters, which is not sufficient to accurately detect and correct deviations [from the required flight path]. … Many runway overruns, lateral excursions or landing‑short accidents have been related to this type of situation.
The go-around maneuver itself — an initial climb and often a level-off — also can be deceptively simple. “At low altitude and low speed, sometimes very close to the ground, the reduced [safety] margin gives little time to perform and to react in case of deviation — change of altitude/flight path, aircraft configuration and trim balance — and in some cases, ATC called during the go-around,” de Courville said. Mode changes in aircraft automation also affect the actual complexity, he added.
De Courville called for replacing the industry training practice of flight crews periodically performing only a one-engine-out go-around from decision altitude or minimum descent altitude. “Very rarely is it flown [in simulators] from a different altitude, and very rarely is it flown with all engines available,” he said.
Other issues addressable through training include maintaining an instrument scan — without over-emphasizing guidance from the flight director to the detriment of airmanship — and making pilot responses to ATC the third priority after aircraft control and navigation.
—WR
She presented a few of the preliminary findings and recommendations of the Flight Deck Automation Working Group formed in 2001 by the Performance-Based Aviation Rulemaking Committee (PARC) and the U.S. Commercial Aviation Safety Team (CAST). Abbott prefaced her remarks by noting the airline industry’s “impressive safety record” overall and the clear evidence that, in many cases, the expected interventions of flight crews have “saved the day” by successfully mitigating the resurgent risks discussed.
The final report in early 2011 will be a comprehensive update to the FAA’s June 1996 report titled “The Interfaces Between Flightcrews and Modern Flight Deck Systems,” this time looking in depth at 200 subcategories of data, some not considered previously. Data sources included pilot reports representing 734 incidents submitted in 2001–2009 to the Aviation Safety Reporting System (ASRS) of the U.S. National Aeronautics and Space Administration; reports on 26 accidents and 20 major incidents; and aggregated data from flight deck observations in 2001–2009 of 9,165 flights worldwide, all normal operations, in the line operations safety audit (LOSA) database of the LOSA Collaborative.
“We found vulnerabilities in [automation] mode and energy-state awareness, manual handling, and managing system malfunctions or failures,” Abbott said. “These included failures anticipated by designers, [failures] for which there were no flight crew procedures, and [failures] in flight management system (FMS) programming.”
To enable comparisons of disparate data sources, statistical techniques were used to normalize them. In the subcategory of manual handling errors, for example, comparisons revealed that approximately 25 percent of LOSA flights had a manual handling error, compared with slightly more than 60 percent of flights in which a manual handling error was identified by an investigative board as a factor in an accident.
Manual handling errors comprised 30 percent of the major incidents and less than 10 percent in the ASRS data, Abbott said. Errors included lack of recognition of autopilot or autothrottle disconnects; lack of monitoring or maintaining energy or speed; incorrect upset recovery; inappropriate control inputs; and dual side-stick inputs. Another area of vulnerability was programming errors and incorrect use of the FMS. No priority, frequency or relative importance was assigned to these.
A number of flight crews mismanaged system malfunctions. “Slightly over 30 percent of normal flights, according to the LOSA data, had a malfunction or a minimum equipment list [MEL] item as a threat in the flight,” she said. “About 15 percent of the accidents, but over 50 percent of the major incidents … had a malfunction present as a threat.”
About 42 percent of the selected flights revealed inadequate pilot knowledge of the flight director, autopilot, autothrottle/autothrust or FMS. Knowledge gaps, or inability to retrieve required information, extended to the understanding of systems and their limitations. Knowledge of standard operating procedures (SOPs), need for confirmation and cross-check, and mode transitions and understanding of airplane behavior were other concerns.
“We are recommending that operational policies be put into place that focus on flight path management,” Abbott said. “The top recommendation for pilot training is improved industry practice and [new FAA] regulatory guidance and requirements for flight path and energy management, including for upset recovery.”
Rebuilding Stall Defenses
Assumptions about a pilot’s capability to deal with the rare occurrences of stalls in line operations cannot be based solely on a pilot’s experience, said Dave Carbaugh, a captain and chief pilot, flight technical and safety, Boeing Commercial Airplanes. “Stalls can occur when performing a wide variety of maneuvers,” he said. “The wing will stop flying when the critical angle-of-attack is exceeded and, therefore, performance will decrease. The natural reaction of flight crews is to continue to pull on the [control] column or [side-stick].”
If that initial reaction is not averted or corrected in time, the aircraft enters the full-stall regime of the lift curve, where safe recovery from loss of control becomes more difficult, he said.
Most importantly, specialists now recommend a specific, uniform response to the earliest indications of a stall that contradicts the technique used for decades, and still is taught by instructors who have not learned/adopted the current best practice.
“There needs to be a forward movement of the column or stick to reduce the angle-of-attack,” Carbaugh said. “This may be intuitively difficult when the airplane is nose-low already and the altimeter shows altitude decreasing rapidly.”
Training organizations today have to reject the discredited recovery technique known as “powering out” (selecting maximum thrust) and adjusting pitch for constant altitude or minimum loss of altitude, he said. That technique has been proven to dangerously extend the duration of a stall.
Today’s stall recovery procedure has been built and exhaustively tested around the concept of pitch reduction only — immediate reduction of angle-of-attack — to restore smooth airflow to the wing as quickly as possible in any situation, he said.
Generic Stall Recovery
Various techniques for identifying stall onset and for recovering from stalls in commercial jets over the years have filtered down from the design, engineering and flight test experience of airframe manufacturers, said Claude Lelaie, a captain and retired Airbus test pilot who is now an adviser to the company’s CEO.
As members of the FAA-Industry Stall/Stick Pusher Working Group, Airbus, ATR, Boeing, Bombardier and Embraer recently collaborated in creating a generic stall recovery procedure valid for all types of airplanes by agreeing on basic recovery principles and the order of steps to be accomplished, he said.
“Any manufacturer building a new aircraft can use that [generic procedure] directly,” Lelaie said. “This procedure will be applicable in all cases except for liftoff, where we may have different procedures according to the manufacturer. The first [pilot] action is to disengage the autopilot and autothrottle.
“The second action is nose-down pitch control … applied until out of the stall with nose-down pitch trim as needed. … The priority is to reduce the angle-of-attack, and in some cases where the control column or the side-stick does not [provide] enough [authority], pilots use the trim. The bank angle is wings level … to orient the lift vector.”
The stall working group re-examined the question of using thrust. “Sometimes, the flight crew is stalling with almost maximum thrust, which is the case at high altitude,” Lelaie said. “The first priority is not to deal with thrust. So we have put ‘as needed’ in the procedure to show that sometimes the crew doesn’t touch the thrust, and sometimes they select idle thrust. It may help to go to idle if they have an engine below the wing and very low speed [to counteract] a pitch-up motion.
So [thrust setting] is really dependent on the circumstances of the stall.” The generic procedure finally calls for “speed brakes — retract” and a return to the desired flight path.
New Life After Tragedy
Flight Safety Foundation’s 63rd International Air Safety Seminar (IASS) in Milan, Italy, benefited from a first-time partnership with Italian hosts who have advocated safety reforms for nine years. “We are unique as the only air crash victim organization in the world to host the IASS,” said Paolo Pettinaroli, president of the Fondazione 8 Ottobre 2001, an 8,300-member nonprofit foundation dedicated to preventing accidents and improving society’s response to crash victims’ families. “The final result of our hard work on IASS … the interest from all over the world … was the best that could ever happen,” he said. If discussions and decisions at the November seminar lead to positive changes that “land on the runways of all the airports of the world … that would be, for us, the biggest satisfaction,” he added.
The impetus for creating Fondazione 8 Ottobre 2001 was a fatal runway incursion in Milan on that date. A Scandinavian Airlines System Boeing MD-82, taking off from Runway 36R at Milano Linate Airport, collided with a Cessna Citation 525A that had been taxied in fog-induced visibility of 50 to 100 m (164 to 328 ft) onto the active runway (Accident Prevention, 4/04). In all, 118 passengers, crewmembers and airport workers were killed, and both airplanes were destroyed.
Although the Italian Agenzia Nazionale per la Sicurezza del Volo (ANSV) cited the runway incursion by the Cessna crew as the immediate cause, the accident investigation body also listed 18 contributing factors, issued 18 safety recommendations and commented that “the system in place at Milano Linate airport was not geared to trap misunderstandings, let alone inadequate procedures, blatant human errors and faulty airport layout.”
The first meeting of victims’ families, as an informal committee, was held one month after the accident, Pettinaroli said. “It was a very difficult moment because these people desperately needed some economic help,” he said. “They were [mainly] people in small industries who had to close their shops and factories. … The committee gathered all the families of the victims in order to get an immediate result. Thanks to the committee, we did get a lot of help from the government, from the City of Milan and from [insurance companies and other] institutions.”
Over the years, member families closely followed the criminal trial of air traffic controllers in an Italian court. “During this time, we found out that we had to do something more to prevent another accident from happening,” Pettinaroli said. “We wanted to give some suggestions for better safety in air transportation, but how? We decided that the only way was to organize ourselves with some high-level technical experts. We found 15 of them and organized our technical task force, which … monitors what is happening [in aviation safety] worldwide, but especially in Italy. Every time something happens, or anytime we find something that does not work properly, we denounce the operation. We let the press know and [inform] public opinion of what is going on so the persons involved will take some action. It is never easy to involve those responsible for safety, to do what will make things better. People always think that safety is too expensive … but they don’t know how expensive it is when something happens — in economic terms and, from a moral point of view, in [emotional] terms.”
The Fondazione efforts proved influential in the installation of an advanced surface movement guidance and control system at Milano Linate, and the technical task force still monitors investigations of other accidents to develop positions advocating new safety improvements, he said.
To make its work known widely, the Fondazione has established a memorial, launched a website in Italian and English,1 conducted annual safety conferences in Italy, funded a scholarship program and issued technical publications. Although an original goal of preventing more fatal runway incursions at Milano Linate has been met, a recent proposal to disband next year was rejected at the ninth annual conference of the Fondazione, he said.
Newly elected to the FSF board of governors, Pettinaroli brings empathy for affected families and their interests from his own experience. “I lost my son, Lorenzo, a young manager who had lived in London the three years previous [to takeoff aboard the accident MD-82],” he recalled. “He had received a promotion and had come back to Italy to live while he was traveling up and down Europe.” Echoing the IASS speech2 by Deborah Hersman, chairman of the U.S. National Transportation Safety Board, he noted that the first 48 hours after an accident can be the most difficult period that the families ever face.
“Our families asked in 2001, ‘What do we do? How do we survive in this situation?’” Pettinaroli recalled. In his own case, the moment when he heard that no passengers or crewmembers had survived the Milano Linate collision was “the beginning of a new life,” he said. “At that moment, I decided my life was finished, and I had to do something in order that nobody else should suffer,” he said. “I resigned from my job, and I dedicated myself to this.”
—WR
Note
- The English version is at www.comitato8ottobre.com/home.asp?language=en
- The speech is at www.ntsb.gov/speeches/hersman/daph101102.html. (Note: This speech is no longer available on the NTSB site.)
Acceptable Simulator Fidelity
Airlines and other training organizations can now implement these best practices with resources they already have, said David McKenney, a Boeing 737 captain for United Airlines who is co-chairman, with the FAA’s Abbott, of the FAA PARC-CAST Flight Deck Automation Working Group and previously co-chairman of the FAA-Industry Stall/Stick Pusher Working Group.
“We have evidence right now, from incidents and accidents, that pilots are not responding correctly [to unexpected stall or stick pusher events] even though they have been trained,” McKenney said. “Almost all events had a couple things in common: The airplanes were established on an instrument landing system [ILS] final approach, coupled up with the autopilot and with autothrottles selected. Very few pilots, if any, have ever trained [for] stalls with the autopilot on. Yet that is where most of our pilots are encountering stalls, and one of our [final] recommendations will be to include that in recurrent training.”
An exaggerated aerodynamic lift curve illustrates the stages of progression to g-break/full stall in relation to the fidelity of current full flight simulators to represent them in a new generation of training scenarios.1
The startle factor also must be addressed in stall-related training, as it has in airplane upset recovery training, he added. “It can cause confusion and other psychological effects, and actually cause the pilots to overreact by [applying] too much pressure on the controls,” McKenney said, noting that secondary stalls have occurred in this context. Startle training enables flight crews to overcome instinctive human responses. Suppressing a knee-jerk reaction, the trained pilots consciously take a half second to a second to assess and confirm the situation. “They then apply a measured and proportional response [without] overcorrection,” he said.
Simulator instructors also have opportunities to surprise crews with indications of a stall during unrelated flight simulator sessions. “We suggest that crews do the stalls on the ILS at 1,000, 2,000 and 3,000 ft above ground level … and in other realistic scenarios where they are turning toward the runway at a low altitude, in a configuration with the gear down and the flaps down,” McKenney said. “For recurrent stall training, a maximum of a three-year cycle is recommended.”
The working group developed, and has urged the FAA to publish this year, an advisory circular revising stall training.
Read an enhanced version of this article.
Note
- Presenters defined g-break as the point of maximum lift on the lift curve.