Recovery Program

Loss of control (LOC), also known as upset aircraft (ASW, 2/13, p. 18) was the leading cause of large commercial jet accidents worldwide in the 2001–2010 decade. According to the Boeing Statistical Summary,¹ 20 fatal accidents of 87 reported in the period were caused by LOC. These LOC accidents resulted in 1,756 onboard fatalities as well as 231 external fatalities.

Following several high-profile upset accidents, colleagues and I reviewed airline LOC accidents and published a report on the findings in 2008.² That review included transport category and commuter airline operations during the 15 years from 1993 through 2007. The period was chosen to provide a reasonable statistical sample while avoiding a possible discontinuity caused by the introduction of fly-by-wire (FBW) technology. There were 75 accidents in that study period, with 3,261 fatalities. Major areas of concern included 27 stalls, 20 upsets caused by ice-­contaminated airfoils and eight spatial disorientation (SDO) upsets. Eleven of the 75 accidents were exacerbated by faulty recovery techniques used by pilots.

New Upset Review

Our updated review, the subject of this article, analyzed all air carrier upset events for the period 1981 through 2010. All U.S. Federal Aviation Regulations (FARs) Part 121 and scheduled Part 135 (commuter) revenue operations were covered. Equivalent non-U.S. events were included. We considered only transport and commuter categories. Transport category airplanes eligible for operation under Part 135 were classed as “commuters” regardless of the actual operating rule. Single-engine airplanes used in scheduled Part 135 operations were excluded.

This review used data from the Australian Transport Safety Bureau (ATSB), Transportation Safety Board of Canada (TSB), French Bureau d’Enquêtes et d’Analyses pour la Sécurité de l’Aviation Civile (BEA), U.S. National Transportation Safety Board (NTSB) and Aviation Safety Network (ASN) databases.

We also reviewed a database³ that includes accidents from many countries. Search keywords were “loss of control,” “upset,” “unusual attitude” and “stall.” Following identification from the databases, the accident reports were reviewed. Accidents resulting from midair collisions, criminal or deliberate activities, in-flight fire or pilot incapacitation were culled from the list.

There were minor differences in event filtering between the 2008 study and this one. We only considered revenue Part 121 and scheduled Part 135 flights (and non-U.S. equivalents), whereas the earlier study included non-revenue flights, excluding only engine-out ferry flights and maintenance test flights.

Results

We identified 207 events (32 incidents and 175 accidents)⁴ resulting in 8,610 onboard fatalities with an additional 217 ground fatalities (Table 1). There were 554 serious injuries to airplane occupants and an additional 19 on the ground. It is likely that the incident data are underreported.

Events were classified according to causal factors involved (Table 2). The primary cause was gleaned from investigating authorities’ accident reports where available and otherwise inferred from the ASN database. Forty-five percent of events happened at night and 56 percent occurred during instrument meteorological conditions.

Aerodynamic Stalls

There were 64 events (2,589 fatalities) involving stalls, either as the primary cause or as a consequence of the upset (Table 3). Twelve of these stalls involved contaminated airfoils.

Only one stall was in an FBW aircraft. The envelope protection was disabled by sensor failure in that event.

Twelve events, resulting in 336 fatalities, involved the autopilot flying the airplane at the time of the stall (Table 4, p. 50). Six airplane types were involved. A single aircraft type accounted for five autopilot-induced stalls. Two other types each had two autopilot-­induced stalls.

Spatial Disorientation

In 37 events, resulting in 1,931 fatalities, SDO played a role. They included 18 cases of primary spatial disorientation, eight instrument failures, four events that occurred during or following a stall, two events that occurred when a pilot attempted to override the autopilot and six instances of somatogravic illusion, when rapid acceleration gives the false impression that the airplane is nose-up, or rapid deceleration mistakenly suggests that the aircraft is nose-down.

Fourteen SDO events resulted in classic spiral dives. Nine aircraft types — none involving FBW aircraft — were represented. Five somatogravic illusion cases were found. These involved a takeoff or go-around. One additional “undetermined cause” accident has the earmarks of this illusion. Eight events were associated with distractions while troubleshooting.

Faulty Recoveries

Faulty airplane recovery techniques by pilots were involved in 20 events, resulting in 1,557 fatalities. Among those events were seven stalls, eight SDO encounters, two wake vortex encounters and three “other.”

The most common theme identified was failure to immediately reduce angle-of-attack (AoA). It appears that many pilots responded to upsets by pulling back on the stick.⁵ A second theme was applying rapid rudder reversals. This appears to be much more common than previously thought.^6,7

Takeoff Accidents

Eighteen events causing 920 fatalities happened during takeoff, when either the configuration was improperly set (five accidents with 374 fatalities) or the wings were contaminated with ice or frost (13 accidents with 546 fatalities). Distribution of upsets by phase of flight is shown in Figure 1.

Airframe Ice

Thirty-four icing-related events resulted in 706 fatalities. Thirteen of those involved stalls. In particular, eight of the 10 autopilot-induced stalls occurred with ice-contaminated airfoils. Airframe icing events involved one heated-wing airplane, 17 ­pneumatic-boot airplanes and two airplanes with unprotected flap vanes.

There were 22 in-flight events, involving one heated-wing airplane (two fatalities), 17 boot-equipped airplanes (seven types — 158 fatalities) and two unprotected flap surfaces (single airplane type — no fatalities).

Among the 17 events involving booted airplanes, one turboprop type had eight events and two turboprop types had three events each. Perhaps we should ask why we are still designing boot-equipped transport airplanes in the 21st century. Only one tailplane stall was identified during this period.

There were 13 attempted takeoffs with contaminated wings, resulting in most of the 546 icing-related fatalities.

Flight Control Malfunctions

Twenty-six events, responsible for 594 fatalities, were caused by flight control system failures. There was an additional accident involving a structural failure that led to loss of control.

Most of the events involved familiar components — actuator or autopilot hardovers, actuator or linkage jams, disconnected control cables and similar malfunctions. In one accident there was a complete hydraulic failure.

Pilot-induced oscillations (PIOs) are thought to be a flight control problem. They are not caused by the pilot, but may involve excessively sensitive controls.

FBW airplanes showed three new categories of software problems. The upsets studied resulted from inappropriate software control gains which led to an overcontrol tendency. Many of these could have been classed as PIOs, but have been listed in this analysis as “control gains” if the accident report recommended changes in the gains to prevent future accidents. In three cases, the flight control software logic was flawed — usually causing inappropriate flight mode changes.

Ten autopilot-induced stalls were not counted in this category but were included under “stalls.”

Pilot Experience

Pilot flight hours from 1981 through 2010 were examined. The data are sparse. While there was a downward trend in flight hours since 1980, low flight time of accident pilots does not appear to stand out as a factor. No difference between U.S. and non-U.S. carriers was evident, although commuter pilots have less flight time, and there were fewer commuter operations in the 1980s.

Training for Upset Prevention and Recovery

Many upsets were identified in which manual instrument flying proficiency appeared to be lacking. Airline flying has changed during the author’s career, from emphasis on “stick and rudder” skills to “system management.” This begins with initial pilot training. Many upsets begin with autopilot disconnection, degraded handling and systems faults. When coupled with reduced instrument skills from lack of use, it shouldn’t surprise us when the crew has difficulty in regaining control.

The loss of pilots’ instrument proficiency needs to be addressed. This must take into account the minimal amount of hand flying typical in airline operations today. In addition, many of these upsets result from automation failure, with the pilot being given manual control of the airplane in difficult circumstances.

The primary problem found in upset prevention and recovery techniques was the failure of many pilots to aggressively reduce the AoA. This very likely is a result of overemphasis on minimizing loss of altitude. Pilots have been trained incorrectly to “power out” of approaches to stalls, rather than actually recover from a stall. The U.S. Federal Aviation Administration (FAA) has published an advisory circular (AC)⁸ that changes the FAA’s criteria for air carrier stall training to emphasize AoA reduction over minimizing altitude loss. This AC is a step in the right direction.

However, some existing simulators cannot be reliably used for stall training, particularly in high altitude, out-of-trim conditions, or during steep turns. While simulators might be used in these flight regimes, such use requires flight test and wind tunnel data that are not always available.⁹

The AC stresses the need for motion cues to allow the pilot trainee to recognize and feel the differences as the airplane approaches the stall. These differences are subtle. Training simulators, at this stage of their development, do not provide fully realistic motion cues. Motion cues can help, but misleading motion cues can provide negative transfer of training.

From my perspective, stall training must be in a fully validated simulator using data throughout the possible flight envelope, not just the normal flight envelope. If such a simulator is not available, then at least initial stall training must be accomplished in flight in the actual airplane.

Envelope Protection

The data clearly show that FBW airplanes equipped with envelope protection have been effective in preventing stall accidents. There were no in-service stall accidents in an airplane with a functional envelope protection system. Currently the Cirrus SR-20 and King Air 200, 200 and 350 are certificated with retrofit envelope protection systems.

Reducing Spatial Disorientation

The problem of SDO follows from the deterioration of instrument skills. However, simply improving pilot instrument skills may not be sufficient. Pilot training should include specific SDO training on upset prevention, recognition and recovery. This should include specific illusions, such as the somatogravic illusion, which can lead a pilot into perceiving pitch attitude to be much higher than it really is during a go-around.

There was some indication in our study that standby attitude instruments may not be providing adequate cues. The approval process for standby indicators should include enabling upset recognition and recovery from both pilot seats. Both primary and standby attitude indicators should provide visual cues to clearly show the pilot the angular relationship of AoA. This would help prevent the situation in which the airplane descends into the ground with the stick pulled back. An air-mass flight path angle, such as demonstrated in the variable-stability VISTA NF-16D, operated by the U.S. Air Force test pilot training school in conjunction with Calspan, should be evaluated.¹⁰ A scalar AoA tape or dial-pointer is not compelling enough.

Many SDO upsets involve pilots distracted by cascading failures or common-cause failures in which the pilots discern no obvious pattern from the caution or warning displays.

Takeoff Accidents

There were five takeoff accidents in which the configuration was improperly set. This suggests that the certification requirement for a takeoff warning system may be inadequate. Perhaps FARs Part 25.703 should be amended to require that takeoff be prevented with an improper configuration. This would be similar to Part 25.670(a) for flight control gust locks.

There were 13 takeoff accidents in which the wings were contaminated with ice or frost (546 fatalities). No explanation was evident for why these accidents keep happening.

Concerns and Recommendations

The study suggests that deterioration in the basic manual flying skills of airline pilots today should be addressed. The industry must take a long, hard look at the past trends in pilot training emphasizing “management skills” and de-emphasizing basic flying skills. Every now and then, the pilot has to abandon management skills and revert to simply flying the airplane.

This study suggests the following recommendations:

• Expand the proposed air carrier training advisory circular to the entire aviation community, including general aviation and primary flight training.
• Continue the development of simulators with sufficient data to cover the high-AoA regime with adequate motion cues. Until such simulators are in place, stall training must be conducted in the airplane.
• Develop displays to graphically present AoA information in high-AoA situations to aid upset prevention and recovery. The air-mass flight path display flown in the VISTA would be a start.
• Develop displays to cue the pilot to developing SDO scenarios and to provide guidance for recovery.
• Develop and install retrofit and forward-fit envelope protection as a mitigation technique.
• Amend the takeoff warning systems requirement (Part 25.703) to require a means of preventing takeoff with an improper configuration, similar to Part 25.670(a) for flight control gust locks.
• Amend the ice protection requirements (Part 25.1419) to require prevention of ice accretion on critical airfoils instead of allowing accretion followed by removal.
• Develop and install retrofit and forward-fit of autopilots incorporating cabin altitude monitoring and automatic descent profiles.
• Ensure that pilot experience (including second-pilot data) is documented during accident investigation. A return to the NTSB Factual Report–Aviation form would help. 

The help of Dennis Crider and Loren Groff of the NTSB in obtaining accident data and the help of Madeleine Kolb in reviewing the manuscript and other editorial assistance are gratefully appreciated.

Richard L. (Dick) Newman, Ph.D., is an engineer and test pilot with more than 25 years of experience in the development, testing and certification of aircraft systems.

Newman retired from the FAA Aircraft Certification Service in 2009 and then spent three years with the Human Performance Department of the Naval Air Systems Command. He was a faculty member at Embry-Riddle Aeronautical University, a pilot for a major airline and has 7,000 hours of flight time.

Notes

1. Statistical Summary of Commercial Jet Airplane Accidents, Worldwide Operations, 1959–2010. The Boeing Co.
2. Lambregts, A.A.; Nesemeier, G.; Wilborn, J.E; Newman, R.L. Airplane Upsets: Old Problems, New Issues. AIAA-2008-6867. August 2008.
3. Dorsett, R. Aircraft Accident Reports on DVD. Austin, Texas, U.S.: Flight Simulation Systems.
4. For this study, an accident is defined as an occurrence during flight which results in substantial or worse damage to the aircraft, or serious injury, or death to any person. An incident is defined as an occurrence not rising to the severity of an accident.
5. Hirschman, D. “The ‘Panic Pull.’” AOPA Pilot, Oct. 2011, p. 91.
6. Peterson, L.S. et al. An International Survey of Transport Airplane Pilots’ Experiences and Perspectives of Lateral/Dimensional Control Events and Rudder Issues in Transport Airplanes. DOT/FAA/AM-10/14. October 2010.
7. Hoh, R.H.; Nicoll, T.K.; Desrochers, P. Piloted Simulation Study to Develop Transport Aircraft Rudder Control System Requirements. Phase 2: Develop Criteria for Rudder Overcontrol. DOT/FAA/AR-10/17. November 2010.
8. FAA. “Stall and Stick Pusher Training.” Advisory Circular AC-120. Aug. 6, 2012.
9. Foster, J.V. et al. Dynamics Modeling and Simulation of Large Transport Airplanes in Upset Conditions. AIAA-2005-5933. August 2005.
10. The VISTA is a successor to the NT-33, a modified Lockheed T-33 trainer whose stability characteristics, control system and displays could be modified to simulate those of other aircraft.