Expect the Unexpected

French accident investigators, citing the June 1, 2009, crash into the Atlantic Ocean of an Air France Airbus A330, are calling for changes in pilot training to help crews recognize — and safely cope with — “unusual and unexpected” developments during flight.

The French Bureau d’Enquêtes et d’Analyses (BEA) included more than two dozen safety recommendations in its final report on the accident, issued in July. Other recommendations were issued earlier in the course of the three-year investigation.

The final report concluded that the A330’s crash resulted from a succession of events, beginning with the “temporary inconsistency between measured airspeeds” — probably caused by ice crystals clogging the pitot probes — and followed by what the report said were “inappropriate control inputs that destabilized the flight path,” misinterpretations of instrument indications, a failure to recognize that the airplane was entering a stall and “the crew’s failure to diagnose … the stall situation and, consequently, the lack of any actions that would have made recovery possible” (ASW, 8/12, p. 14).

All 228 people in the airplane were killed in the crash, a little more than two hours after takeoff from Rio de Janeiro, Brazil, for Paris.

The BEA focused many of its 41 safety recommendations on aircraft configuration problems, calling on the European Aviation Safety Agency (EASA) to take steps to ensure that type rating training and recurrent training not only “take into account the specificities of the aircraft for which they are designed” but also incorporate “exercises that take into account all of the reconfiguration laws,” the final report said.

The four reconfiguration laws are inherent elements of the Airbus fly-by-wire system, with each one providing different degrees of protection against flight-envelope deviations.

Current training does not adequately focus a crew’s attention on “the precise identification of the type of reconfiguration and of the level of protection and on the necessity to monitor the trajectory and the primary parameters,” the report said.

The document noted that, after the autopilot disconnect, control inputs by the flight crew “significantly degraded the airplane’s kinetic energy.”

The BEA also recommended that EASA require that pilot training include exercises to ensure that pilots possess solid theoretical knowledge of flight mechanics.

Citing the accident flight, the BEA said, “The rapid exit from the flight envelope was not anticipated by the pilots, nor was it understood. In the absence of any reliable speed indications, understanding of the overall physics of flight at high altitude could have considerably helped the pilots to anticipate the rapid degradation of the situation.”

In addition, the BEA said that pilots should receive initial, recurrent and type training designed to enable them to “develop and maintain a capacity to manage crew resources when faced with the surprise generated by unexpected situations.”

During the accident flight, “the startle effect played a major role in the destabilization of the flight path and in the two pilots’ understanding [of] the situation,” the BEA report said.

The report criticized existing initial and recurrent training for failing to ensure that pilots can respond quickly and correctly to unexpected in-flight situations.

“The exercises are repetitive, well known to crews and do not enable skills in resource management to be tested outside of this context,” the report said. “All of the effort invested in anticipation and predetermination of procedural responses does not exclude the possibility of situations with a ‘fundamental surprise’ for which the current system does not generate the indispensable capacity to react.”

During the accident flight, the “rapid increase in crew workload in an unusual and unexpected situation led to the degradation of the quality of communication and coordination between the pilots,” the report said.

In accompanying recommendations, the BEA said EASA should review pilot training requirements to ensure that operators “reinforce [crew resource management] training to enable acquisition and maintenance of adequate behavioral automatic responses in unexpected and unusual situations with a highly charged emotional factor.”

In addition, EASA should define the criteria for selecting and training instructors to provide a “high and standardized level of instruction,” the BEA said.

Flight Simulators

Other recommendations called on EASA to address training issues for flight simulators:

• To modify existing regulations to “ensure better fidelity for simulators in reproducing realistic scenarios of abnormal situations”; and,
•  To “ensure the introduction into the training scenarios of the effects of surprise.”

The report noted that the pilots of the accident airplane did not recognize the significance of the disappearance of airspeed information and appearance of “unreliable IAS [indicated airspeed]” warnings on the electronic centralized aircraft monitor (ECAM).

“The three crewmembers had undertaken their training according to a known scenario on the simulator, though the technical limitations of the simulator, whose fidelity is satisfactory in most cases, do not allow certain unusual situations to be simulated,” the report said. Those limitations mean that, during training, the pilots are unlikely to experience the startle effect triggered by encountering an unexpected situation or the “inappropriate reflex actions on the controls that can occur as a consequence,” the report added.

Ergonomics

Several recommendations addressed what the BEA characterized as ergonomic issues involving flight director displays. The agency recommended that EASA “require a review of the redisplay and reconnection logic” of the flight directors to determine the conditions under which the pilots would be required to take action to re-engage them after a display disappeared and then reappeared.

The accident pilots might not have noticed that the crossbars on a display appeared and disappeared on the flight directors and probably did not realize that the mode had changed because they were “reading and assimilating the displays on the FMA [flight mode annunciator] in dynamic and stressful conditions not being instinctive or natural,” the report said.

“It seems that requiring an action from the crew to re-engage this automatic system would, on the one hand, lead to a consistency with the autopilot and the autothrust, and on the other hand, stimulate a check on the modes and the consistency of the commands presented at the time of the re-engagement.”

The BEA said the recommended flight director review should examine several other issues, including the functional or display logic “so that it disappears or presents appropriate orders when the stall warning is triggered” and “the relevance of having a dedicated warning … when specific monitoring is triggered, in order to facilitate comprehension of the situation.”

The pilots should see a dedicated warning when a specific type of monitoring begins, the report said, noting that, during the accident flight, the series of failure messages appearing on the ECAM “did not allow the crew to make a rapid and effective diagnosis of the situation the airplane was in, in particular of the blockage of the pitot probes.”

Several of the airplane’s systems had identified the problem, but the failure messages dealt only with narrow aspects of the effects of the failure while providing no information that would aid the pilots in their diagnosis.

Related recommendations said that EASA should determine the conditions in which an aural stall warning should be accompanied by a visual indication that a stall is imminent and should require action to determine the conditions, at very slow airspeeds, under which a stall warning should be required.

Feedback

Noting that programs already exist under which the holders of aircraft type certificates define the aircraft’s minimum associated training program, the BEA said that EASA should make mandatory the operational and human factors analyses of in-service events — action that the BEA said would improve training procedures. In addition, the BEA recommended that the French Direction Generale de l’Aviation Civile (DGAC) “take steps aimed at improving the relevance and the quality of incident reports written by flight crews” and see that the documents are distributed to manufacturers.

“In-service feedback is an essential prerequisite in the process of improving flight safety,” the report said. “The reports written by crews after events do not always reveal their severity or all of the elements [involved]. This makes somewhat random the preservation of the indispensable elements needed for an investigation and thus difficult for the operator, the manufacturer and the authorities to evaluate the associated risks and threats and to undertake an exhaustive analysis that makes it possible to take appropriate measures.”

The report also noted that past DGAC in-flight and ground inspections of Air France had failed to reveal major problems, including the “fragile nature of the CRM [and] the weaknesses of the two copilots in manual aeroplane handling.”

As a result, the BEA recommended that the DGAC review its oversight “so as to improve its cohesion and effectiveness.”

Other recommendations included in the final report called for better coordination of search and rescue efforts in the South Atlantic and other maritime and remote areas (ASW, 8/12, p. 13).

Earlier in the investigation, the BEA issued a number of related safety recommendations, including several intended to aid in the recovery of flight recorders installed in airplanes that crash into deep water and others that would require studies of other methods of delivering basic information on aircraft flight parameters.

The search for the airplane’s flight recorders continued for 22 months after the accident, and the BEA noted in its final report that the crash not only “confirms the importance of data from the flight recorders in order to establish the circumstances and causes of an accident” but also “brings to light the difficulties that can be encountered in [locating], recovering and reading out the recorders after an accident at sea.”

The crash prompted the BEA to establish an international working group to review methods of safeguarding flight data, of locating aircraft wreckage — especially underwater wreckage, and recovering flight recorders. The working group’s proposals were followed by recommendations from the BEA to EASA and the International Civil Aviation Organization (ICAO) that included:

• Extending to 90 days (from the currently required 30) the required transmission time for the underwater locator beacons (ULBs) on flight recorders in passenger airplanes used in public transport flights in maritime areas; and,
• Studying the possibility of requiring airplanes on public transport passenger flights to regularly transmit data on altitude, airspeed, heading and other basic flight parameters.

Subsequent recommendations called for requiring the installation of equipment in these airplanes to enable the “triggering of data transmission to facilitate localization as soon as an emergency situation is detected on board” and for studying the possibility of requiring activation of emergency locator transmitters, also at the first indication of an emergency.

The recommendations gave impetus to ongoing efforts to develop alternative methods of delivering the data contained on aircraft flight data recorders, including the use of streaming data.

A number of existing systems transmit data automatically from aircraft to ground stations, typically for maintenance or flight monitoring. Two such systems are AeroMechanical Services’ FLYHTStream, which provides on-demand triggered data streaming based on global positioning system data, and Airborne Data Service, a satellite communications data service developed by Star Navigation Systems Group and Astrium Services to provide for real-time flight data transmission to operators (ASW, 4/12, p. 26).

This article is based on the English translation of the BEA’s “Final Report on the Accident on 1st June 2009 to the Airbus A330-203, Registered F-CZCP, Operated by Air France, Flight AF 447, Rio de Janeiro–Paris.” The report is available in English and the original French at http://www.bea.aero.