Concerted action is needed to address vulnerabilities in average pilots’ capabilities to safely monitor their flight path, conduct a missed approach, avoid stalls and maintain control of highly automated commercial jets, aviation specialists say. Several of 33 speakers at the Flight Safety Foundation International Air Safety Seminar, Nov. 2–5 in Milan, Italy, spoke with uncharacteristic urgency about these re-emerging risks — long thought to have been mitigated. “Major improvements have been made in the design, training and operational use of onboard systems for flight path management … and their associated flight crew interfaces,” said Kathy Abbott, chief scientific and technical adviser for flight deck human factors at the U.S. Federal Aviation Administration (FAA). “Incident and accident reports suggest that flight crews continue to have problems interfacing with these systems and have difficulty using these flight path management systems.”
She presented a few of the preliminary findings and recommendations of the Flight Deck Automation Working Group formed in 2001 by the Performance-Based Aviation Rulemaking Committee (PARC) and the U.S. Commercial Aviation Safety Team (CAST). Abbott prefaced her remarks by noting the airline industry’s “impressive safety record” overall and the clear evidence that, in many cases, the expected interventions of flight crews have “saved the day” by successfully mitigating the resurgent risks discussed.
The working group’s assignment was to probe the safety and efficiency of modern flight deck systems for flight path management, including energy-state management, for jet transport aircraft operated in two-pilot “air carrier–like operations.” The working group analyzed accidents, incidents and normal operations, and conducted structured inter-views with manufacturers, operators and training organizations. The term flight path management system was used as shorthand for the autopilot, autothrottle/autothrust, FMS and a subset of the interfaces involved in trajectory management and energy management (that is, excluding systems such as autobrakes and autopressurization systems).
The final report in early 2011 will be a comprehensive update to the FAA’s June 1996 report titled “The Interfaces Between Flightcrews and Modern Flight Deck Systems,” this time looking in depth at 200 subcategories of data, some not considered previously. Data sources included pilot reports representing 734 incidents submitted in 2001–2009 to the Aviation Safety Reporting System (ASRS) of the U.S. National Aeronautics and Space Administration; reports on 26 accidents and 20 major incidents; and aggregated data from flight deck observations in 2001–2009 of 9,165 flights worldwide, all normal operations, in the line operations safety audit (LOSA) database of the LOSA Collaborative.
“We found vulnerabilities in [automation] mode and energy-state awareness, manual handling, and managing system malfunctions or failures,” Abbott said. “These included failures anticipated by designers, [failures] for which there were no flight crew procedures, and [failures] in flight management system (FMS) programming.”
To enable comparisons of disparate data sources, statistical techniques were used to normalize them. In the subcategory of manual handling errors, for example, comparisons revealed that approximately 25 percent of LOSA flights had a manual handling er-ror, compared with slightly more than 60 percent of flights in which a manual handling error was identified by an investigative board as a factor in an accident.
Manual handling errors comprised 30 percent of the major incidents and less than 10 percent in the ASRS data, Abbott said. Errors included lack of recognition of autopilot or autothrottle disconnects; lack of monitoring or maintaining energy or speed; incorrect upset recovery; inappropriate control inputs; and dual side-stick inputs. Another area of vulnerability was programming errors and incorrect use of the FMS. No priority, frequency or relative importance was assigned to these.
Another area of vulnerability was programming and use of the FMS. “[Making an FMS error] is very common, and we found that it was more prevalent in times of high workload, high pressure, amended clearances from air traffic control [ATC] and so on,” Abbott said.
“One of our concerns is that [pilots’] data-entry errors, together with cross-verification errors, may introduce some real safety vulnerabilities,” Abbott said. “We also saw that standard operating procedures [SOPs] were not being followed as expected.” Cross-verification errors were found in more than half of the selected accidents, with those involving callouts and monitoring about equal at nearly 40 percent.
Procedural errors encompassed complex or unfamiliar procedures that became confusing to pilots. In some instances, ATC amended clearances unnecessarily increased workload and complexity, contributing to FMS programming errors, the working group found. In some cases, the solution would have been for pilots to tell ATC — when appropriate — that they could not comply with an instruction, she said.
A number of flight crews mismanaged system malfunctions. “Slightly over 30 percent of normal flights, according to the LOSA data, had a malfunction or a minimum equipment list [MEL] item as a threat in the flight,” she said. “About 15 percent of the accidents, but over 50 percent of the major incidents … had a malfunction present as a threat.” Specific examples were air data computer failures; failures of the air data inertial reference unit, the inertial reference unit or the secondary standby air data attitude reference unit; computer or software failures; electrical failures; and uncommanded autopilot disconnects or pitch-up for unknown reason.
About 42 percent of the selected flights revealed inadequate pilot knowledge of the flight director, autopilot, autothrottle/autothrust or FMS. Knowledge gaps, or inability to retrieve required information, extended to the understanding of systems and their limitations. Knowledge of standard operating procedures (SOPs), need for confirmation and cross-check, and mode transitions and understanding of airplane behavior were other concerns. Some of these flights reflected inadequate knowledge for unusual attitude recognition and recovery, including at high altitude, or for speed and energy manage-ment, she said.
Other vulnerabilities were summarized as pilot over-reliance on automated systems. “Pilots sometimes abdicated too much responsibility to the automated system,” Abbott said. “Part of this is a perceived lack of trust in pilot performance [conveyed by airline policies favoring use of automation and related procedures]. … In some cases … insufficient training, experience or judgment are factors that play into why the pilots might be more comfortable operating under the automated systems than flying manually. … One of the results — and a big concern — was that pilots were not prepared to deal with nonroutine situations.”
One of the biggest trends since 1996 has been the proliferation of air carrier flight department policies on how their crews are to use automation. The working group’s concerns about this tentatively include the uneven quality of the guidance and the possibility that company operational policies may contribute to unsafe shifts of pilot focus.
“Managing the flight path of the airplane needs to be the major focus for the pilots: Flying the airplane, not flying the automation,” Abbott added. “Focusing so much on man-aging the modes and managing the automation distracts from managing the flight path of the airplane.
“We are recommending that operational policies be put into place that focus on flight path management. The top recommendation for pilot training is improved industry practice and [new FAA] regulatory guidance and requirements for flight path and energy management, including for upset recovery.” These policies should differentiate guidance vs. control of airplanes and be able to adapt to each airline’s changes in flight opera-tions, she said.
Rebuilding Stall Defenses
Assumptions about a pilot’s capability to deal with the rare occurrences of stalls in line operations cannot be based solely on a pilot’s experience, said Dave Carbaugh, a captain and chief pilot, flight technical and safety, Boeing Commercial Airplanes. “Stalls can occur when performing a wide variety of maneuvers,” he said. “The wing will stop flying when the critical angle-of-attack is exceeded and, therefore, performance will decrease. The natural reaction of flight crews is to continue to pull on the [control] column or [side-stick].”
If that initial reaction is not averted or corrected in time, the aircraft enters the full-stall regime of the lift curve, where safe recovery from loss of control becomes more difficult, he said.
Most importantly, specialists now recommend a specific, uniform response to the earli-est indications of a stall that contradicts the technique used for decades, and still is taught by instructors who have not learned/adopted the current best practice.
“There needs to be a forward movement of the column or stick to reduce the angle-of-attack,” Carbaugh said. “This may be intuitively difficult when the airplane is nose-low already and the altimeter shows altitude decreasing rapidly. … Training and checking policies [today] are designed to maximize the likelihood that the pilots will respond correctly and with consistency to unexpected stall warnings, aerodynamic stalls and/or stick pusher activations. Unfortunately, [recent] accidents and incidents show that this has not always happened.”
Loss of control in flight (LOC-I) accident data contain a subset of accidents that began as stalls. “This a substantial part of LOC-I — and it is, most importantly, preventable,” he said. “In the 2009 Colgan Air accident, the pilots’ [control inputs] never went forward of the neutral column position after getting the stick shaker. The crew responded inappropriately to the stall warning, and the airplane ended up in a nose-low-attitude accelerated stall.”
Unexpectedly deficient pilot performance in handling actual approach-to-stall scenarios reflects “considerable differences in how this is demonstrated or taught, … recurrent training exposure [and] the wide variety and backgrounds which most pilots bring to the table,” Carbaugh said.
Training organizations today have to reject the discredited recovery technique known as “powering out” (selecting maximum thrust) and adjusting pitch for constant altitude or minimum loss of altitude, he said. That technique has been proven to dangerously extend the duration of a stall.
“[Past] approach-to-stall training was often a scripted maneuver using limited and unre-alistic scenarios, flown as a precision maneuver to get ready for a check ride,” Carbaugh added. “Often, altitude control was emphasized — which is unrealistic, doesn’t promote energy awareness and can be downright dangerous given that most accidents and incidents occur with sufficient altitude available [for safe recovery]. … It doesn’t matter if you’re an airline-transport–rated captain or a private pilot, you don’t want to spend any time with the stall horn or stick shaker or [other] stall warning going on. [Regulators and airlines] need to emphasize the manufacturer’s procedures for reducing the angle-of-attack and for energy awareness.”
Typical simulator training scenarios at 5,000 to 10,000 ft above ground level contrast sharply with those of recent stall-related accidents. “Those accidents occurred either at high altitude or during the approach phase of flight,” he said, suggesting more realistic altitudes and flight phases to be used in training.
Conducting stall training only a few times during a pilot’s career also has not served flight crews well. “This promotes less understanding of handling, angle-of-attack considerations or energy awareness,” Carbaugh said. “In some areas of the world, pilots are only exposed to approach-to-stall training when they initially get checked out on a new type of airplane. It’s not practiced or checked as part of recurrent training, and this has certainly proved to be a negative aspect of today’s training.”
Today’s stall recovery procedure has been built and exhaustively tested around the concept of pitch reduction only — immediate reduction of angle-of-attack — to restore smooth airflow to the wing as quickly as possible in any situation, he said.
Generic Stall Recovery
Various techniques for identifying stall onset and for recovering from stalls in commercial jets over the years have filtered down from the design, engineering and flight test experience of airframe manufacturers, said Claude Lelaie, a captain and retired Airbus test pilot who is now an adviser to the company’s CEO.
As members of the FAA-Industry Stall/Stick Pusher Working Group, Airbus, ATR, Boeing, Bombardier and Embraer recently collaborated in creating a generic stall recovery procedure valid for all types of airplanes by agreeing on basic recovery principles and the order of steps to be accomplished, he said.
“Any manufacturer building a new aircraft can use that [generic procedure] directly,” Lelaie said. “This procedure will be applicable in all cases except for liftoff, where we may have different procedures according to the manufacturer. The first [pilot] action is to disengage the autopilot and autothrottle. The reason is quite simple: The autopilot can lead to some trim in the wrong direction, increasing the risk of stall.” Similarly, the behavior of the autothrottle varies by mode and may not be predictable for the pilots, so it has been eliminated as a factor early in the procedure.
“The second action is nose-down pitch control … applied until out of the stall with nose-down pitch trim as needed,” he said. “ The priority is to reduce the angle-of-attack, and in some cases where the control column or the side-stick does not [provide] enough [authority], pilots use the trim. The bank angle is wings level … to orient the lift vector.”
The stall working group re-examined the question of using thrust. “Sometimes, the flight crew is stalling with almost maximum thrust, which is the case at high altitude,” Lelaie said. “The first priority is not to deal with thrust. So we have put ‘as needed’ in the procedure to show that sometimes the crew doesn’t touch the thrust, and sometimes they select idle thrust. It may help to go to idle if they have an engine below the wing and very low speed [to counteract] a pitch-up motion. So [thrust setting] is really dependent on the circumstances of the stall.” The generic procedure finally calls for “speed brakes — retract” and a return to the desired flight path.
“Airbus probably does more than 1,000 stalls for each new aircraft [tested],” he said. “Personally, I did 69 stalls in a single flight on an A380, but I know that some test pilots have done more than that. Test pilots do stalls for finalizing the aircraft configuration, for determining all the performance [data] and … for adjusting the flight control settings … at low altitude and high altitude.”
A two-minute video animation — of an A380 stall with the airplane’s fly-by-wire automation in degraded law, a mode that decreases the protections afforded during line opera-tions in normal law — showed the airplane’s conventional stall behavior and an immedi-ate recovery solely by a side-stick pitch-down input. Recovering the desired pitch attitude and initial altitude were accomplished with a small thrust increase, he said.
“I started to fly beginning in 1963,” Lelaie said. “What is the difference between the A380 stall and the light aircraft stall I was doing at that time? Nothing. Push on the stick to reduce angle-of-attack, recover smoothly and then add a bit of thrust.”
Airbus informed the industry specialists’ deliberations by conducting stalls in comparison flights using two aircraft, an A340-600 and an A320, and corresponding simulators. “Our conclusion was that there is no significant difference between the aircraft and the simulator — the simulator at least can be used to teach the recovery from stall warning and even from the buffeting, with limited restriction,” Lelaie said.
In separate research, four Airbus instructor pilots with varied levels of airline experience — but no line experience of an actual stall — participated in 30 minutes of classroom training and one three-hour session in an A320 simulator, in which all pilots successfully practiced/demonstrated the generic recovery, he said.
“We then put them in the A320 and instructed them to [gradually increase pitch] to the stall condition, the stall warning or buffeting,” Lelaie said. “We had one case of a pilot going into a secondary stall, which again demonstrates why we warn pilots against the possibility of secondary stall.” In one high-altitude scenario, three levels of buffet were identified, but some of these pilots did not recognize any buffet.
“High Mach buffet was a discovery, totally new for them,” he said. “That is important be-cause, depending on the aircraft type, sometimes the buffet may come before the stall warning. … We have to improve the full-flight simulator fidelity for buffets, especially at high-altitude, but that is not very difficult, according to the simulator manufacturers in the working group.”
Acceptable Simulator Fidelity
Airlines and other training organizations can now implement these best practices with resources they already have, said David McKenney, a Boeing 737 captain for United Airlines who is co-chairman, with the FAA’s Abbott, of the FAA PARC-CAST Flight Deck Automation Working Group and previously co-chairman of the FAA-Industry Stall/Stick Pusher Working Group.
“We have evidence right now, from incidents and accidents, that pilots are not respond-ing correctly [to unexpected stall or stick pusher events] even though they have been trained,” McKenney said. “Almost all events had a couple things in common: The airplanes were established on an instrument landing system [ILS] final approach, coupled up with the autopilot and with autothrottles selected. Very few pilots, if any, have ever trained [for] stalls with the autopilot on. Yet that is where most of our pilots are encountering stalls, and one of our [final] recommendations will be to include that in recurrent training.”
An exaggerated aerodynamic lift curve (see Figure 1 in the PDF version of this article) illustrates the stages of progression to g-break/full stall in relation to the fidelity of cur-rent full flight simulators to represent them in a new generation of training scenarios.1
“As pilots approach the stall, they get a stall warning, in which the stick shaker — or stick pusher, if so equipped — is normally the first indication up to the g-break … and then they get into the [full-stall regime],” he said. “Based on the standard today, and the way that simulators are evaluated, we can train effectively up to the stall warning, the first indication. We also can train up to the stick pusher as long as we validate the force that the stick pusher provides.” Stick pusher–force validation currently is not required otherwise.
“In the amber area of the lift curve, we can train stalls even though we do lose some fidelity in the simulator,” McKenney said. At the g-break and past the g-break, the red area of the lift curve, the industry still cannot conduct effective training because most simulators are not representative of the aircraft handling characteristics, he added.
The background developed for decisions by the working group should help build indus-try confidence about overhauling stall training where needed. “We can start training on recognizing approach-to-stall situations and doing the recovery procedures that the manufacturers have given us,” McKenney said. “When pilots recognize that that they’re getting close to stall and they initiate the recovery, it doesn’t matter if they are at the stick pusher stage or the [full-stall stage]; basically, it is the same recovery procedure.”
The startle factor also must be addressed in stall-related training, as it has in airplane upset recovery training, he added. “Startle or surprise occurs when the pilot’s mental model of what the aircraft should be doing differs from what the aircraft is doing,” McKenney said. “It can cause confusion and other psychological effects, and actually cause the pilots to overreact by [applying] too much pressure on the controls.” Secon-dary stalls have occurred in this context.
The training enables flight crews to overcome instinctive human responses. Suppressing a knee-jerk reaction, the trained pilots consciously take a half second to a second to assess and confirm the situation. They then apply “a measured and proportional response” without overcorrection, he said.
Simulator instructors also have opportunities to surprise crews with indications of a stall during unrelated flight simulator sessions. “We suggest that crews do the stalls on the ILS at 1,000, 2,000 and 3,000 ft above ground level … and in other realistic scenarios where they are turning toward the runway at a low altitude, in a configuration with the gear down and the flaps down,” McKenney said. “For recurrent stall training, a maximum of a three-year cycle is recommended.”
The working group developed, and has urged the FAA to publish this year, an advisory circular revising stall training. A longer-term project will be for the International Civil Aviation Organization to revise relevant standards and recommended practices, and for civil aviation authorities to amend regulations, he said.
Note
- Presenters defined g-break as the point of maximum lift on the lift curve.