Prospects for reducing commercial air transport accidents involving loss of control–in flight (LOC-I) have advanced significantly, based on recent validations of technology and consensus-building success, reports a team of 20 U.S. subject matter experts that has worked on the issue since 2010. The team’s “short list” of voluntary safety enhancements combines what they consider the most feasible and effective engineering solutions among a wider range of possibilities, they said.
Some of the selected technologies might not be certified for this purpose or widely implemented until 2035, however, said Michael Snow, human performance specialist, Aviation Safety Group, The Boeing Co., and co-chair of the Airplane State Awareness Joint Safety Analysis Team (JSAT) of the U.S. Commercial Aviation Safety Team (CAST).
He was joined in a November presentation of this work by James Wilborn, aviation safety engineer, Aircraft Certification Service, U.S. Federal Aviation Administration (FAA), and co-chair of the JSAT. They discussed the findings and recommendations at Flight Safety Foundation’s 67th annual International Air Safety Summit in Abu Dhabi, United Arab Emirates.
Unlike the technology and training that have been credited over the last 20 years with reducing by half the world’s controlled flight into terrain (CFIT) accidents (see “EGPWS Data Show Benefits of Multiple Technologies for Premature-Descent Alerts,” p. 30), Snow said, “We see a little bit of progress [on LOC-I] but not nearly as much as we’d like. … Loss of control–in flight is … not as monolithic in its causes and outcomes as some of the other accident categories like midair collision or CFIT. Therefore, it doesn’t lend itself as well to one alerting system that’s going to solve the accident [problem]. That’s one of the reasons we examined this category and tried to generate solutions.”
While other international specialists have focused on mitigating LOC-I from the standpoint of pilot training for airplane upset prevention, recognition and recovery, the JSAT concentrated on loss of flight crew airplane state awareness as a subset of situation awareness. “In the human factors community, we defined situation awareness as awareness of task-relevant information, understanding of that information and then ability to forecast [outcomes], based on that understanding. … Especially task-relevant information to the task of ‘aviate’ are the basic attitude of the airplane and the energy state of the airplane,” Snow said.
Learning From History
To understand how loss of airplane state awareness occurred in the 1998–2010 period, the JSAT members selected a preliminary set of 18 non-U.S. accidents, five U.S. accidents, three non-U.S. incidents and four U.S. incidents. The events were selected as the best examples “in which one of the links in the causal chain was the flight crew losing attitude awareness and then not regaining it,” he said.
From these, they analyzed a subset of 18 events (11 non-U.S. accidents, two U.S. accidents, three non-U.S. incidents and two U.S. incidents). Seven analyzed accidents were classified as attitude-awareness events and involved 674 fatalities; six analyzed accidents were classified as energy state–awareness events and involved 596 fatalities (Figure 1).
Figure 1 — Contribution of Airplane State Awareness Themes to Fatal Commercial Jet Accidents, Worldwide, 2003–2012
CFIT = controlled flight into terrain; F-NI = fire/smoke–non-impact; LOCI-I = loss of control–in flight; RE = runway excursion; SCF-PP = system/component failure or malfunction (powerplant); MAC = midair collision; WSTRW = wind shear or thunderstorm
Note: The article further describes the U.S. and non-U.S. accidents and incidents that comprise these events. Bracketed numbers are associated fatalities. The events/numbers omit the U.S. Colgan Air Flight 3407 fatal accident in 2009 and all other turboprop-aircraft accidents.
Source: U.S. Commercial Aviation Safety Team
In the group of six events, the common issue was “the flight crew losing energy state awareness on the low side — so not tracking or solving a developing low-energy state for whatever reason,” Snow said. “[We] examined the government-published report on [each] accident to determine all of the problems in the accident, how much those problems contributed to each accident, and … [all proposed] solutions [Figure 2].”
Figure 2 — Projected Risk Reduction for Loss of Control–in Flight From CAST Safety Enhancements (SE192–SE211)
Notes: Changes shown by deltas (Δ) show approximate cumulative changes by year from three types of mitigations combined. Note that airplane design-related changes will be the last to be widely implemented.
Source: U.S. Commercial Aviation Safety Team
One event the JSAT studied was the May 5, 2007, crash of Kenya Airways Flight 507, a Boeing 737-800, after takeoff in dark night and thunderstorm conditions from Douala, Cameroon (ASW, 8/10). “[This is] fairly typical of the unrecovered roll excursions in the set,” Snow said. “They were on initial climb at 1,000 ft with the autopilot disconnected. Bank angle increased from 20 degrees to 35 degrees over roughly 30 seconds. Importantly, at normal g [one times standard acceleration of gravity] … if you are banking the airplane in level flight, you are also [aerodynamically] loading up the airplane. … At 45 degrees, you’re at 1.4 g; at 60 degrees you’re pulling 2.0 g, etc. So when we see this pattern of increasing bank angle and normal g, we can infer a lack of [pilot] intent. We also know … this roll rate was sub-threshold … [that is,] not something the flight crew felt. In the absence of external visual stimuli, there was no clue, other than the instruments, that the airplane was rolling, and it all happened at normal g, so they didn’t feel the airplane loading up as if it were an intentional bank.”
The team inferred from the official report’s cockpit voice recording that the flight crew was unaware, before the airplane overbank, that the autopilot was not engaged. “So, we inferred a loss of attitude awareness there,” he said. “[This airplane generated an] alert out of the Enhanced Ground Proximity Warning System at 35 degrees [of bank], where the box says ‘bank angle, bank angle’ and the sky pointer turns yellow to indicate a developing overbank situation. … The pilot flying made inputs to the control wheel that went right-left-right, mostly right, over the next few seconds. Bank angle increased past vertical, and vertical speed obviously dropped off … and the airplane crashed. So that’s kind of a basic pattern from the attitude-awareness side [of the airplane-state problem].”
A different LOC-I accident provided a model of what typically occurs when the flight crew’s loss of energy state awareness is a significant “theme” of the causal chain, he said. West Caribbean Airways Flight 708, a Boeing MD-82, crashed near Machiques, Venezuela, on Aug. 16, 2005. Snow said, “Engine anti-ice was turned off. [The flight crew] climbed to Flight Level 330 [approximately 33,000 ft]. Once they had reached that flight level, they reengaged the engine anti-ice, the actual power being reduced; put the autopilot in hold mode; and then airspeed and Mach decayed very gradually over the next 10 minutes, leading to autopilot disconnect [and] stick-shaker stall warning. In this case, the pilot flying responded with a full-aft column input and nose-up trim.”
The JSAT concluded from official reports that the captain, the pilot flying, believed something was wrong with the engines. “The first officer was saying, ‘It’s a stall, captain.’ The airplane took … 3 to 3 1/2 minutes to fall out of the sky and crash — so [there was] that signature loss of energy-state awareness,” he said.
From the JSAT’s analyzed events, several other causal themes were identified for exploration of solutions. Snow said, “We’ve gotten really good, really safe, as an industry — and it takes at least six of these themes coming together to create an adverse event. … We had lack of external visual references — either IMC [instrument meteorological conditions] or night or both — in all but one of the events. Flight crew impairment [occurred] in about one-third; that was always fatigue, except in one case where there was alcohol involved.
“Ineffective alerting [occurred] in every single one. … We had … inappropriate control action in two-thirds of the events [meaning,] basically, the flight crew acting on the control inceptors to take a developing bad situation and make it worse [such as by] rolling into an overbank rather than out of an overbank [or] pitching down into a nose-down attitude [or] pulling back on the control wheel or the stick to increase angle-of-attack in response to a stall warning.
“Training issues [occurred] in about half — often, [this meant] not having training that would have been helpful, like crew resource management or upset recovery training. Sometimes, [the issue was] not recalling or acting on the training in the appropriate context. Airplane maintenance [was] an issue in about one-third. … Safety culture [was] an issue in about two-thirds. … Systems knowledge [was involved] in about one-third. … Automation confusion and awareness [were seen] in roughly two-thirds. … Invalid source data [i.e., unreliable flight-critical aero data sent to the flight deck were noted] in five.” The data-related events were a failed inertial navigation system; unreliable airspeed or pitot-static issue; frozen angle-of-attack sensor vanes; and a failed radar altimeter.
What Snow called “a specifically mismanaged distraction” was found to have occurred in every accident/incident selected for analysis. “We could clearly see something — usually in the cockpit voice recorder [data] — that took the flight crew’s attention away from the basic task of ‘aviate’ for some critical interval [that] can be 6 seconds, 10 seconds, sometimes as long as 30 or 40 seconds. … We need to do a slightly better job of minimizing distractions and managing them when they happen,” he said.
CAST Safety Enhancements
The FAA’s Wilborn told attendees that background for understanding 11 airplane state awareness–relevant safety enhancements (SEs) — SE192 through SE211 — is available at no cost from the CAST website <www.cast-safety.org>. Details of the JSAT’s final conclusions and recommendations — also reflecting CAST members’ consensus-acceptance and commitment of resources for their implementation — are available at no cost on Eurocontrol’s SKYbrary website <www.skybrary.aero/index.php/Category:CAST_SE_Plan>.
As examples, four SEs are air carrier actions, targeting low-airspeed aural alerting; standard operating procedures (SOPs); non-standard flight operation; and flight crew training verification and validation. A service bulletin developed by Boeing and Honeywell addresses new methods of low-speed alerting on the flight deck that are being adopted by some U.S. air carriers.
The SOP-related SE describes use of flight data–monitoring programs to identify causes and remediate instances of flight crew non-adherence to SOPs, he said. Non-passenger-carrying/non-revenue flights by air carriers — such as functional check flights or ferry flights — have had “significant safety issues” that are addressed by one SE. Another SE explains how an operator can verify that a third-party vendor actually provides the pilot training specified by contract, including enhanced upset prevention and recovery training that includes current approach-to-stall recovery procedures; upset-prevention scenarios; stall recoveries after the autopilot has led the aircraft into the stall; unreliable-airspeed scenarios; recovery from spatial disorientation situations, such as the sub-threshold roll noted; safely responding to non-normal situations; and enhanced go-around scenarios. The last item could include factors such as beginning the go-around maneuver in a very lightweight aircraft from a position other than charted decision height/missed approach point in visual meteorological conditions (VMC), then transitioning to IMC. These improvements will be reinforced by FAA guidance material scheduled for publication in early 2015, he said.
Aircraft manfacturers represented at CAST — Airbus, Boeing, Bombardier and Embraer — provided to the JSAT information about their latest available technologies relevant to airplane state awareness. Those deemed most likely to help achieve industrywide objectives theoretically could have eliminated 60 percent of the airplane state awareness problems seen in the analysis, Wilborn said.
Figure 3 — Bank Angle–Recovery Guidance
Note: Automated bank-angle protection on new aircraft typically changes the aural “bank angle, bank angle” alert to, for example, “roll right, roll right” and shows the correct direction for roll-axis recovery with a red arrow on the primary flight display.
Source: U.S. Commercial Aviation Safety Team
The solutions submitted by the manufacturers comprised proprietary systems for low-airspeed alerting and protection; removing invalid airspeed data from the displays; automatic activation of pitot heat; multi-sensory alerting of pilots to invalid inertial navigation system data; fault-tolerant data sources achieved through multi-voting (or other software logic); a ‘connecting-checklist’ by default — such as electronic checklists or central messaging systems; angle-of-attack or stall protection; and protecting fly-by-wire airplanes from unsafely low airspeeds by inhibiting automatic nose-up trim. The JSAT’s final additions to its recommendations were automated bank-angle protection (ideally with multi-sensory pilot alerting of bank angle state, including recovery guidance), and synthetic vision systems.
In the latest bank-angle protection systems, if the flight crew does not understand, for example, how to respond to a 35-degree “bank angle, bank angle” alert, and then ends up at 45 degrees, “the alert changes to ‘roll right, roll right’ and a red arrow appears on the PFD [primary flight display] to show you which way to go,” Wilborn said (Figure 3). “Virtual day-VMC displays — or synthetic vision systems — are useful … to help maintain spatial orientation and energy awareness.